wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
 196             (wpa_s->wpa_state == WPA_AUTHENTICATING ||
 197              wpa_s->wpa_state == WPA_ASSOCIATING))
 198                 bssid = wpa_s->pending_bssid;
 199         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 200                 MAC2STR(bssid));
 201         wpa_blacklist_add(wpa_s, bssid);
 202         wpa_sm_notify_disassoc(wpa_s->wpa);
 203         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 204         wpa_s->reassociate = 1;
 205
 206         /*
 207          * If we timed out, the AP or the local radio may be busy.
 208          * So, wait a second until scanning again.
 209          */
 210         wpa_supplicant_req_scan(wpa_s, 1, 0);
 211 }
 212
 213
 214 /**
 215  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 216  * @wpa_s: Pointer to wpa_supplicant data
 217  * @sec: Number of seconds after which to time out authentication
 218  * @usec: Number of microseconds after which to time out authentication
 219  *
 220  * This function is used to schedule a timeout for the current authentication
 221  * attempt.
 222  */
 223 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 224                                      int sec, int usec)
 225 {
 226         if (wpa_s->conf->ap_scan == 0 &&
 227             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 228                 return;
 229
 230         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 231                 "%d usec", sec, usec);
 232         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 233         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 234 }
 235
 236
 237 /**
 238  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 239  * @wpa_s: Pointer to wpa_supplicant data
 240  *
 241  * This function is used to cancel authentication timeout scheduled with
 242  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 243  * been completed.
 244  */
 245 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 246 {
 247         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 248         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 249         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 250 }
 251
 252
 253 /**
 254  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 255  * @wpa_s: Pointer to wpa_supplicant data
 256  *
 257  * This function is used to configure EAPOL state machine based on the selected
 258  * authentication mode.
 259  */
 260 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 261 {
 262 #ifdef IEEE8021X_EAPOL
 263         struct eapol_config eapol_conf;
 264         struct wpa_ssid *ssid = wpa_s->current_ssid;
 265
 266 #ifdef CONFIG_IBSS_RSN
 267         if (ssid->mode == WPAS_MODE_IBSS &&
 268             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 269             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 270                 /*
 271                  * RSN IBSS authentication is per-STA and we can disable the
 272                  * per-BSSID EAPOL authentication.
 273                  */
 274                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 275                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 276                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277                 return;
 278         }
 279 #endif /* CONFIG_IBSS_RSN */
 280
 281         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 282         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 283
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 285             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 286                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 287         else
 288                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 289
 290         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 291         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 292                 eapol_conf.accept_802_1x_keys = 1;
 293                 eapol_conf.required_keys = 0;
 294                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 295                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 296                 }
 297                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 298                         eapol_conf.required_keys |=
 299                                 EAPOL_REQUIRE_KEY_BROADCAST;
 300                 }
 301
 302                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 303                         eapol_conf.required_keys = 0;
 304         }
 305         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 306         eapol_conf.workaround = ssid->eap_workaround;
 307         eapol_conf.eap_disabled =
 308                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 309                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 310                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 311         eapol_conf.external_sim = wpa_s->conf->external_sim;
 312
 313 #ifdef CONFIG_WPS
 314         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 315                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 316                 if (wpa_s->current_bss) {
 317                         struct wpabuf *ie;
 318                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 319                                                          WPS_IE_VENDOR_TYPE);
 320                         if (ie) {
 321                                 if (wps_is_20(ie))
 322                                         eapol_conf.wps |=
 323                                                 EAPOL_PEER_IS_WPS20_AP;
 324                                 wpabuf_free(ie);
 325                         }
 326                 }
 327         }
 328 #endif /* CONFIG_WPS */
 329
 330         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 331
 332         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 333 #endif /* IEEE8021X_EAPOL */
 334 }
 335
 336
 337 /**
 338  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 339  * @wpa_s: Pointer to wpa_supplicant data
 340  * @ssid: Configuration data for the network
 341  *
 342  * This function is used to configure WPA state machine and related parameters
 343  * to a mode where WPA is not enabled. This is called as part of the
 344  * authentication configuration when the selected network does not use WPA.
 345  */
 346 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 347                                        struct wpa_ssid *ssid)
 348 {
 349         int i;
 350
 351         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 353         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 355         else
 356                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 357         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 359         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 360         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 361         wpa_s->group_cipher = WPA_CIPHER_NONE;
 362         wpa_s->mgmt_group_cipher = 0;
 363
 364         for (i = 0; i < NUM_WEP_KEYS; i++) {
 365                 if (ssid->wep_key_len[i] > 5) {
 366                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 367                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 368                         break;
 369                 } else if (ssid->wep_key_len[i] > 0) {
 370                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 371                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 372                         break;
 373                 }
 374         }
 375
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 377         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 379                          wpa_s->pairwise_cipher);
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 381 #ifdef CONFIG_IEEE80211W
 382         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 383                          wpa_s->mgmt_group_cipher);
 384 #endif /* CONFIG_IEEE80211W */
 385
 386         pmksa_cache_clear_current(wpa_s->wpa);
 387 }
 388
 389
 390 void free_hw_features(struct wpa_supplicant *wpa_s)
 391 {
 392         int i;
 393         if (wpa_s->hw.modes == NULL)
 394                 return;
 395
 396         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 397                 os_free(wpa_s->hw.modes[i].channels);
 398                 os_free(wpa_s->hw.modes[i].rates);
 399         }
 400
 401         os_free(wpa_s->hw.modes);
 402         wpa_s->hw.modes = NULL;
 403 }
 404
 405
 406 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 407 {
 408         struct wpa_bss_tmp_disallowed *bss, *prev;
 409
 410         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 411                               struct wpa_bss_tmp_disallowed, list) {
 412                 dl_list_del(&bss->list);
 413                 os_free(bss);
 414         }
 415 }
 416
 417
 418 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 419 {
 420         int i;
 421
 422         bgscan_deinit(wpa_s);
 423         autoscan_deinit(wpa_s);
 424         scard_deinit(wpa_s->scard);
 425         wpa_s->scard = NULL;
 426         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 427         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 428         l2_packet_deinit(wpa_s->l2);
 429         wpa_s->l2 = NULL;
 430         if (wpa_s->l2_br) {
 431                 l2_packet_deinit(wpa_s->l2_br);
 432                 wpa_s->l2_br = NULL;
 433         }
 434 #ifdef CONFIG_TESTING_OPTIONS
 435         l2_packet_deinit(wpa_s->l2_test);
 436         wpa_s->l2_test = NULL;
 437 #endif /* CONFIG_TESTING_OPTIONS */
 438
 439         if (wpa_s->conf != NULL) {
 440                 struct wpa_ssid *ssid;
 441                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 442                         wpas_notify_network_removed(wpa_s, ssid);
 443         }
 444
 445         os_free(wpa_s->confname);
 446         wpa_s->confname = NULL;
 447
 448         os_free(wpa_s->confanother);
 449         wpa_s->confanother = NULL;
 450
 451         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 452         eapol_sm_deinit(wpa_s->eapol);
 453         wpa_s->eapol = NULL;
 454
 455         rsn_preauth_deinit(wpa_s->wpa);
 456
 457 #ifdef CONFIG_TDLS
 458         wpa_tdls_deinit(wpa_s->wpa);
 459 #endif /* CONFIG_TDLS */
 460
 461         wmm_ac_clear_saved_tspecs(wpa_s);
 462         pmksa_candidate_free(wpa_s->wpa);
 463         wpa_sm_deinit(wpa_s->wpa);
 464         wpa_s->wpa = NULL;
 465         wpa_blacklist_clear(wpa_s);
 466
 467         wpa_bss_deinit(wpa_s);
 468
 469         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 470         wpa_supplicant_cancel_scan(wpa_s);
 471         wpa_supplicant_cancel_auth_timeout(wpa_s);
 472         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 473 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 474         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 475                              wpa_s, NULL);
 476 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 477
 478         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 479
 480         wpas_wps_deinit(wpa_s);
 481
 482         wpabuf_free(wpa_s->pending_eapol_rx);
 483         wpa_s->pending_eapol_rx = NULL;
 484
 485 #ifdef CONFIG_IBSS_RSN
 486         ibss_rsn_deinit(wpa_s->ibss_rsn);
 487         wpa_s->ibss_rsn = NULL;
 488 #endif /* CONFIG_IBSS_RSN */
 489
 490         sme_deinit(wpa_s);
 491
 492 #ifdef CONFIG_AP
 493         wpa_supplicant_ap_deinit(wpa_s);
 494 #endif /* CONFIG_AP */
 495
 496         wpas_p2p_deinit(wpa_s);
 497
 498 #ifdef CONFIG_OFFCHANNEL
 499         offchannel_deinit(wpa_s);
 500 #endif /* CONFIG_OFFCHANNEL */
 501
 502         wpa_supplicant_cancel_sched_scan(wpa_s);
 503
 504         os_free(wpa_s->next_scan_freqs);
 505         wpa_s->next_scan_freqs = NULL;
 506
 507         os_free(wpa_s->manual_scan_freqs);
 508         wpa_s->manual_scan_freqs = NULL;
 509
 510         os_free(wpa_s->manual_sched_scan_freqs);
 511         wpa_s->manual_sched_scan_freqs = NULL;
 512
 513         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 514
 515         /*
 516          * Need to remove any pending gas-query radio work before the
 517          * gas_query_deinit() call because gas_query::work has not yet been set
 518          * for works that have not been started. gas_query_free() will be unable
 519          * to cancel such pending radio works and once the pending gas-query
 520          * radio work eventually gets removed, the deinit notification call to
 521          * gas_query_start_cb() would result in dereferencing freed memory.
 522          */
 523         if (wpa_s->radio)
 524                 radio_remove_works(wpa_s, "gas-query", 0);
 525         gas_query_deinit(wpa_s->gas);
 526         wpa_s->gas = NULL;
 527
 528         free_hw_features(wpa_s);
 529
 530         ieee802_1x_dealloc_kay_sm(wpa_s);
 531
 532         os_free(wpa_s->bssid_filter);
 533         wpa_s->bssid_filter = NULL;
 534
 535         os_free(wpa_s->disallow_aps_bssid);
 536         wpa_s->disallow_aps_bssid = NULL;
 537         os_free(wpa_s->disallow_aps_ssid);
 538         wpa_s->disallow_aps_ssid = NULL;
 539
 540         wnm_bss_keep_alive_deinit(wpa_s);
 541 #ifdef CONFIG_WNM
 542         wnm_deallocate_memory(wpa_s);
 543 #endif /* CONFIG_WNM */
 544
 545         ext_password_deinit(wpa_s->ext_pw);
 546         wpa_s->ext_pw = NULL;
 547
 548         wpabuf_free(wpa_s->last_gas_resp);
 549         wpa_s->last_gas_resp = NULL;
 550         wpabuf_free(wpa_s->prev_gas_resp);
 551         wpa_s->prev_gas_resp = NULL;
 552
 553         os_free(wpa_s->last_scan_res);
 554         wpa_s->last_scan_res = NULL;
 555
 556 #ifdef CONFIG_HS20
 557         if (wpa_s->drv_priv)
 558                 wpa_drv_configure_frame_filters(wpa_s, 0);
 559         hs20_deinit(wpa_s);
 560 #endif /* CONFIG_HS20 */
 561
 562         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 563                 wpabuf_free(wpa_s->vendor_elem[i]);
 564                 wpa_s->vendor_elem[i] = NULL;
 565         }
 566
 567         wmm_ac_notify_disassoc(wpa_s);
 568
 569         wpa_s->sched_scan_plans_num = 0;
 570         os_free(wpa_s->sched_scan_plans);
 571         wpa_s->sched_scan_plans = NULL;
 572
 573 #ifdef CONFIG_MBO
 574         wpa_s->non_pref_chan_num = 0;
 575         os_free(wpa_s->non_pref_chan);
 576         wpa_s->non_pref_chan = NULL;
 577 #endif /* CONFIG_MBO */
 578
 579         free_bss_tmp_disallowed(wpa_s);
 580
 581         wpabuf_free(wpa_s->lci);
 582         wpa_s->lci = NULL;
 583 }
 584
 585
 586 /**
 587  * wpa_clear_keys - Clear keys configured for the driver
 588  * @wpa_s: Pointer to wpa_supplicant data
 589  * @addr: Previously used BSSID or %NULL if not available
 590  *
 591  * This function clears the encryption keys that has been previously configured
 592  * for the driver.
 593  */
 594 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 595 {
 596         int i, max;
 597
 598 #ifdef CONFIG_IEEE80211W
 599         max = 6;
 600 #else /* CONFIG_IEEE80211W */
 601         max = 4;
 602 #endif /* CONFIG_IEEE80211W */
 603
 604         /* MLME-DELETEKEYS.request */
 605         for (i = 0; i < max; i++) {
 606                 if (wpa_s->keys_cleared & BIT(i))
 607                         continue;
 608                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 609                                 NULL, 0);
 610         }
 611         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 612             !is_zero_ether_addr(addr)) {
 613                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 614                                 0);
 615                 /* MLME-SETPROTECTION.request(None) */
 616                 wpa_drv_mlme_setprotection(
 617                         wpa_s, addr,
 618                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 619                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 620         }
 621         wpa_s->keys_cleared = (u32) -1;
 622 }
 623
 624
 625 /**
 626  * wpa_supplicant_state_txt - Get the connection state name as a text string
 627  * @state: State (wpa_state; WPA_*)
 628  * Returns: The state name as a printable text string
 629  */
 630 const char * wpa_supplicant_state_txt(enum wpa_states state)
 631 {
 632         switch (state) {
 633         case WPA_DISCONNECTED:
 634                 return "DISCONNECTED";
 635         case WPA_INACTIVE:
 636                 return "INACTIVE";
 637         case WPA_INTERFACE_DISABLED:
 638                 return "INTERFACE_DISABLED";
 639         case WPA_SCANNING:
 640                 return "SCANNING";
 641         case WPA_AUTHENTICATING:
 642                 return "AUTHENTICATING";
 643         case WPA_ASSOCIATING:
 644                 return "ASSOCIATING";
 645         case WPA_ASSOCIATED:
 646                 return "ASSOCIATED";
 647         case WPA_4WAY_HANDSHAKE:
 648                 return "4WAY_HANDSHAKE";
 649         case WPA_GROUP_HANDSHAKE:
 650                 return "GROUP_HANDSHAKE";
 651         case WPA_COMPLETED:
 652                 return "COMPLETED";
 653         default:
 654                 return "UNKNOWN";
 655         }
 656 }
 657
 658
 659 #ifdef CONFIG_BGSCAN
 660
 661 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 662 {
 663         const char *name;
 664
 665         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 666                 name = wpa_s->current_ssid->bgscan;
 667         else
 668                 name = wpa_s->conf->bgscan;
 669         if (name == NULL || name[0] == '\0')
 670                 return;
 671         if (wpas_driver_bss_selection(wpa_s))
 672                 return;
 673         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 674                 return;
 675 #ifdef CONFIG_P2P
 676         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 677                 return;
 678 #endif /* CONFIG_P2P */
 679
 680         bgscan_deinit(wpa_s);
 681         if (wpa_s->current_ssid) {
 682                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 683                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 684                                 "bgscan");
 685                         /*
 686                          * Live without bgscan; it is only used as a roaming
 687                          * optimization, so the initial connection is not
 688                          * affected.
 689                          */
 690                 } else {
 691                         struct wpa_scan_results *scan_res;
 692                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 693                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 694                                                                    0);
 695                         if (scan_res) {
 696                                 bgscan_notify_scan(wpa_s, scan_res);
 697                                 wpa_scan_results_free(scan_res);
 698                         }
 699                 }
 700         } else
 701                 wpa_s->bgscan_ssid = NULL;
 702 }
 703
 704
 705 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 706 {
 707         if (wpa_s->bgscan_ssid != NULL) {
 708                 bgscan_deinit(wpa_s);
 709                 wpa_s->bgscan_ssid = NULL;
 710         }
 711 }
 712
 713 #endif /* CONFIG_BGSCAN */
 714
 715
 716 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 717 {
 718         if (autoscan_init(wpa_s, 0))
 719                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 720 }
 721
 722
 723 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 724 {
 725         autoscan_deinit(wpa_s);
 726 }
 727
 728
 729 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 730 {
 731         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 732             wpa_s->wpa_state == WPA_SCANNING) {
 733                 autoscan_deinit(wpa_s);
 734                 wpa_supplicant_start_autoscan(wpa_s);
 735         }
 736 }
 737
 738
 739 /**
 740  * wpa_supplicant_set_state - Set current connection state
 741  * @wpa_s: Pointer to wpa_supplicant data
 742  * @state: The new connection state
 743  *
 744  * This function is called whenever the connection state changes, e.g.,
 745  * association is completed for WPA/WPA2 4-Way Handshake is started.
 746  */
 747 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 748                               enum wpa_states state)
 749 {
 750         enum wpa_states old_state = wpa_s->wpa_state;
 751
 752         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 753                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 754                 wpa_supplicant_state_txt(state));
 755
 756         if (state == WPA_INTERFACE_DISABLED) {
 757                 /* Assure normal scan when interface is restored */
 758                 wpa_s->normal_scans = 0;
 759         }
 760
 761         if (state == WPA_COMPLETED) {
 762                 wpas_connect_work_done(wpa_s);
 763                 /* Reinitialize normal_scan counter */
 764                 wpa_s->normal_scans = 0;
 765         }
 766
 767 #ifdef CONFIG_P2P
 768         /*
 769          * P2PS client has to reply to Probe Request frames received on the
 770          * group operating channel. Enable Probe Request frame reporting for
 771          * P2P connected client in case p2p_cli_probe configuration property is
 772          * set to 1.
 773          */
 774         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 775             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 776             wpa_s->current_ssid->p2p_group) {
 777                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 778                         wpa_dbg(wpa_s, MSG_DEBUG,
 779                                 "P2P: Enable CLI Probe Request RX reporting");
 780                         wpa_s->p2p_cli_probe =
 781                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 782                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 783                         wpa_dbg(wpa_s, MSG_DEBUG,
 784                                 "P2P: Disable CLI Probe Request RX reporting");
 785                         wpa_s->p2p_cli_probe = 0;
 786                         wpa_drv_probe_req_report(wpa_s, 0);
 787                 }
 788         }
 789 #endif /* CONFIG_P2P */
 790
 791         if (state != WPA_SCANNING)
 792                 wpa_supplicant_notify_scanning(wpa_s, 0);
 793
 794         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 795                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 796 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 797                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 798                         MACSTR " completed [id=%d id_str=%s]",
 799                         MAC2STR(wpa_s->bssid),
 800                         ssid ? ssid->id : -1,
 801                         ssid && ssid->id_str ? ssid->id_str : "");
 802 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 803                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 804                 wpa_blacklist_clear(wpa_s);
 805                 wpa_s->extra_blacklist_count = 0;
 806                 wpa_s->new_connection = 0;
 807                 wpa_drv_set_operstate(wpa_s, 1);
 808 #ifndef IEEE8021X_EAPOL
 809                 wpa_drv_set_supp_port(wpa_s, 1);
 810 #endif /* IEEE8021X_EAPOL */
 811                 wpa_s->after_wps = 0;
 812                 wpa_s->known_wps_freq = 0;
 813                 wpas_p2p_completed(wpa_s);
 814
 815                 sme_sched_obss_scan(wpa_s, 1);
 816         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 817                    state == WPA_ASSOCIATED) {
 818                 wpa_s->new_connection = 1;
 819                 wpa_drv_set_operstate(wpa_s, 0);
 820 #ifndef IEEE8021X_EAPOL
 821                 wpa_drv_set_supp_port(wpa_s, 0);
 822 #endif /* IEEE8021X_EAPOL */
 823                 sme_sched_obss_scan(wpa_s, 0);
 824         }
 825         wpa_s->wpa_state = state;
 826
 827 #ifdef CONFIG_BGSCAN
 828         if (state == WPA_COMPLETED)
 829                 wpa_supplicant_start_bgscan(wpa_s);
 830         else if (state < WPA_ASSOCIATED)
 831                 wpa_supplicant_stop_bgscan(wpa_s);
 832 #endif /* CONFIG_BGSCAN */
 833
 834         if (state == WPA_AUTHENTICATING)
 835                 wpa_supplicant_stop_autoscan(wpa_s);
 836
 837         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 838                 wpa_supplicant_start_autoscan(wpa_s);
 839
 840         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 841                 wmm_ac_notify_disassoc(wpa_s);
 842
 843         if (wpa_s->wpa_state != old_state) {
 844                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 845
 846                 /*
 847                  * Notify the P2P Device interface about a state change in one
 848                  * of the interfaces.
 849                  */
 850                 wpas_p2p_indicate_state_change(wpa_s);
 851
 852                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 853                     old_state == WPA_COMPLETED)
 854                         wpas_notify_auth_changed(wpa_s);
 855         }
 856 }
 857
 858
 859 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 860 {
 861         int pending = 0;
 862 #ifdef CONFIG_WPS
 863         struct wpa_supplicant *wpa_s = global->ifaces;
 864         while (wpa_s) {
 865                 struct wpa_supplicant *next = wpa_s->next;
 866                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 867                         pending = 1;
 868 #ifdef CONFIG_P2P
 869                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 870                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 871                         wpas_p2p_disconnect(wpa_s);
 872 #endif /* CONFIG_P2P */
 873                 wpa_s = next;
 874         }
 875 #endif /* CONFIG_WPS */
 876         if (pending)
 877                 return;
 878         eloop_terminate();
 879 }
 880
 881
 882 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 883 {
 884         struct wpa_global *global = signal_ctx;
 885         wpa_supplicant_terminate_proc(global);
 886 }
 887
 888
 889 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 890 {
 891         enum wpa_states old_state = wpa_s->wpa_state;
 892
 893         wpa_s->pairwise_cipher = 0;
 894         wpa_s->group_cipher = 0;
 895         wpa_s->mgmt_group_cipher = 0;
 896         wpa_s->key_mgmt = 0;
 897         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 898                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 899
 900         if (wpa_s->wpa_state != old_state)
 901                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 902 }
 903
 904
 905 /**
 906  * wpa_supplicant_reload_configuration - Reload configuration data
 907  * @wpa_s: Pointer to wpa_supplicant data
 908  * Returns: 0 on success or -1 if configuration parsing failed
 909  *
 910  * This function can be used to request that the configuration data is reloaded
 911  * (e.g., after configuration file change). This function is reloading
 912  * configuration only for one interface, so this may need to be called multiple
 913  * times if %wpa_supplicant is controlling multiple interfaces and all
 914  * interfaces need reconfiguration.
 915  */
 916 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 917 {
 918         struct wpa_config *conf;
 919         int reconf_ctrl;
 920         int old_ap_scan;
 921
 922         if (wpa_s->confname == NULL)
 923                 return -1;
 924         conf = wpa_config_read(wpa_s->confname, NULL);
 925         if (conf == NULL) {
 926                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 927                         "file '%s' - exiting", wpa_s->confname);
 928                 return -1;
 929         }
 930         wpa_config_read(wpa_s->confanother, conf);
 931
 932         conf->changed_parameters = (unsigned int) -1;
 933
 934         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 935                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 936                     os_strcmp(conf->ctrl_interface,
 937                               wpa_s->conf->ctrl_interface) != 0);
 938
 939         if (reconf_ctrl && wpa_s->ctrl_iface) {
 940                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 941                 wpa_s->ctrl_iface = NULL;
 942         }
 943
 944         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 945         if (wpa_s->current_ssid) {
 946                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 947                         wpa_s->own_disconnect_req = 1;
 948                 wpa_supplicant_deauthenticate(wpa_s,
 949                                               WLAN_REASON_DEAUTH_LEAVING);
 950         }
 951
 952         /*
 953          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 954          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 955          */
 956         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 957                 /*
 958                  * Clear forced success to clear EAP state for next
 959                  * authentication.
 960                  */
 961                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 962         }
 963         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 964         wpa_sm_set_config(wpa_s->wpa, NULL);
 965         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 966         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 967         rsn_preauth_deinit(wpa_s->wpa);
 968
 969         old_ap_scan = wpa_s->conf->ap_scan;
 970         wpa_config_free(wpa_s->conf);
 971         wpa_s->conf = conf;
 972         if (old_ap_scan != wpa_s->conf->ap_scan)
 973                 wpas_notify_ap_scan_changed(wpa_s);
 974
 975         if (reconf_ctrl)
 976                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 977
 978         wpa_supplicant_update_config(wpa_s);
 979
 980         wpa_supplicant_clear_status(wpa_s);
 981         if (wpa_supplicant_enabled_networks(wpa_s)) {
 982                 wpa_s->reassociate = 1;
 983                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 984         }
 985         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 986         return 0;
 987 }
 988
 989
 990 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 991 {
 992         struct wpa_global *global = signal_ctx;
 993         struct wpa_supplicant *wpa_s;
 994         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 995                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 996                         sig);
 997                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 998                         wpa_supplicant_terminate_proc(global);
 999                 }
1000         }
1001
1002         if (wpa_debug_reopen_file() < 0) {
1003                 /* Ignore errors since we cannot really do much to fix this */
1004                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1005         }
1006 }
1007
1008
1009 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1010                                          struct wpa_ssid *ssid,
1011                                          struct wpa_ie_data *ie)
1012 {
1013         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1014         if (ret) {
1015                 if (ret == -2) {
1016                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1017                                 "from association info");
1018                 }
1019                 return -1;
1020         }
1021
1022         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1023                 "cipher suites");
1024         if (!(ie->group_cipher & ssid->group_cipher)) {
1025                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1026                         "cipher 0x%x (mask 0x%x) - reject",
1027                         ie->group_cipher, ssid->group_cipher);
1028                 return -1;
1029         }
1030         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1031                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1032                         "cipher 0x%x (mask 0x%x) - reject",
1033                         ie->pairwise_cipher, ssid->pairwise_cipher);
1034                 return -1;
1035         }
1036         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1037                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1038                         "management 0x%x (mask 0x%x) - reject",
1039                         ie->key_mgmt, ssid->key_mgmt);
1040                 return -1;
1041         }
1042
1043 #ifdef CONFIG_IEEE80211W
1044         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1045             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1046                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1047                         "that does not support management frame protection - "
1048                         "reject");
1049                 return -1;
1050         }
1051 #endif /* CONFIG_IEEE80211W */
1052
1053         return 0;
1054 }
1055
1056
1057 /**
1058  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1059  * @wpa_s: Pointer to wpa_supplicant data
1060  * @bss: Scan results for the selected BSS, or %NULL if not available
1061  * @ssid: Configuration data for the selected network
1062  * @wpa_ie: Buffer for the WPA/RSN IE
1063  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1064  * used buffer length in case the functions returns success.
1065  * Returns: 0 on success or -1 on failure
1066  *
1067  * This function is used to configure authentication and encryption parameters
1068  * based on the network configuration and scan result for the selected BSS (if
1069  * available).
1070  */
1071 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1072                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1073                               u8 *wpa_ie, size_t *wpa_ie_len)
1074 {
1075         struct wpa_ie_data ie;
1076         int sel, proto;
1077         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1078
1079         if (bss) {
1080                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1081                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1082                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1083         } else
1084                 bss_wpa = bss_rsn = bss_osen = NULL;
1085
1086         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1087             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1088             (ie.group_cipher & ssid->group_cipher) &&
1089             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1090             (ie.key_mgmt & ssid->key_mgmt)) {
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1092                 proto = WPA_PROTO_RSN;
1093         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1094                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1095                    (ie.group_cipher & ssid->group_cipher) &&
1096                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1097                    (ie.key_mgmt & ssid->key_mgmt)) {
1098                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1099                 proto = WPA_PROTO_WPA;
1100 #ifdef CONFIG_HS20
1101         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1102                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1103                 /* TODO: parse OSEN element */
1104                 os_memset(&ie, 0, sizeof(ie));
1105                 ie.group_cipher = WPA_CIPHER_CCMP;
1106                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1107                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1108                 proto = WPA_PROTO_OSEN;
1109 #endif /* CONFIG_HS20 */
1110         } else if (bss) {
1111                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1112                 wpa_dbg(wpa_s, MSG_DEBUG,
1113                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1114                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1115                         ssid->key_mgmt);
1116                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1117                         MAC2STR(bss->bssid),
1118                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1119                         bss_wpa ? " WPA" : "",
1120                         bss_rsn ? " RSN" : "",
1121                         bss_osen ? " OSEN" : "");
1122                 if (bss_rsn) {
1123                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1124                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1125                                 wpa_dbg(wpa_s, MSG_DEBUG,
1126                                         "Could not parse RSN element");
1127                         } else {
1128                                 wpa_dbg(wpa_s, MSG_DEBUG,
1129                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1130                                         ie.pairwise_cipher, ie.group_cipher,
1131                                         ie.key_mgmt);
1132                         }
1133                 }
1134                 if (bss_wpa) {
1135                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1136                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1137                                 wpa_dbg(wpa_s, MSG_DEBUG,
1138                                         "Could not parse WPA element");
1139                         } else {
1140                                 wpa_dbg(wpa_s, MSG_DEBUG,
1141                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1142                                         ie.pairwise_cipher, ie.group_cipher,
1143                                         ie.key_mgmt);
1144                         }
1145                 }
1146                 return -1;
1147         } else {
1148                 if (ssid->proto & WPA_PROTO_OSEN)
1149                         proto = WPA_PROTO_OSEN;
1150                 else if (ssid->proto & WPA_PROTO_RSN)
1151                         proto = WPA_PROTO_RSN;
1152                 else
1153                         proto = WPA_PROTO_WPA;
1154                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1155                         os_memset(&ie, 0, sizeof(ie));
1156                         ie.group_cipher = ssid->group_cipher;
1157                         ie.pairwise_cipher = ssid->pairwise_cipher;
1158                         ie.key_mgmt = ssid->key_mgmt;
1159 #ifdef CONFIG_IEEE80211W
1160                         ie.mgmt_group_cipher =
1161                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1162                                 WPA_CIPHER_AES_128_CMAC : 0;
1163 #endif /* CONFIG_IEEE80211W */
1164                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1165                                 "based on configuration");
1166                 } else
1167                         proto = ie.proto;
1168         }
1169
1170         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1171                 "pairwise %d key_mgmt %d proto %d",
1172                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1173 #ifdef CONFIG_IEEE80211W
1174         if (ssid->ieee80211w) {
1175                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1176                         ie.mgmt_group_cipher);
1177         }
1178 #endif /* CONFIG_IEEE80211W */
1179
1180         wpa_s->wpa_proto = proto;
1181         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1182         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1183                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1184
1185         if (bss || !wpa_s->ap_ies_from_associnfo) {
1186                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1187                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1188                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1189                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1190                         return -1;
1191         }
1192
1193 #ifdef CONFIG_NO_WPA
1194         wpa_s->group_cipher = WPA_CIPHER_NONE;
1195         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1196 #else /* CONFIG_NO_WPA */
1197         sel = ie.group_cipher & ssid->group_cipher;
1198         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1199         if (wpa_s->group_cipher < 0) {
1200                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1201                         "cipher");
1202                 return -1;
1203         }
1204         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1205                 wpa_cipher_txt(wpa_s->group_cipher));
1206
1207         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1208         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1209         if (wpa_s->pairwise_cipher < 0) {
1210                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1211                         "cipher");
1212                 return -1;
1213         }
1214         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1215                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1216 #endif /* CONFIG_NO_WPA */
1217
1218         sel = ie.key_mgmt & ssid->key_mgmt;
1219 #ifdef CONFIG_SAE
1220         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1221                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1222 #endif /* CONFIG_SAE */
1223         if (0) {
1224 #ifdef CONFIG_SUITEB192
1225         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1226                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1227                 wpa_dbg(wpa_s, MSG_DEBUG,
1228                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1229 #endif /* CONFIG_SUITEB192 */
1230 #ifdef CONFIG_SUITEB
1231         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1232                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1233                 wpa_dbg(wpa_s, MSG_DEBUG,
1234                         "WPA: using KEY_MGMT 802.1X with Suite B");
1235 #endif /* CONFIG_SUITEB */
1236 #ifdef CONFIG_IEEE80211R
1237         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1240         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1241                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1242                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1243 #endif /* CONFIG_IEEE80211R */
1244 #ifdef CONFIG_SAE
1245         } else if (sel & WPA_KEY_MGMT_SAE) {
1246                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1247                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1248         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1249                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1250                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1251 #endif /* CONFIG_SAE */
1252 #ifdef CONFIG_IEEE80211W
1253         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1254                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1255                 wpa_dbg(wpa_s, MSG_DEBUG,
1256                         "WPA: using KEY_MGMT 802.1X with SHA256");
1257         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1258                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1259                 wpa_dbg(wpa_s, MSG_DEBUG,
1260                         "WPA: using KEY_MGMT PSK with SHA256");
1261 #endif /* CONFIG_IEEE80211W */
1262         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1263                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1264                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1265         } else if (sel & WPA_KEY_MGMT_PSK) {
1266                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1268         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1269                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1270                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1271 #ifdef CONFIG_HS20
1272         } else if (sel & WPA_KEY_MGMT_OSEN) {
1273                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1274                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1275 #endif /* CONFIG_HS20 */
1276         } else {
1277                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1278                         "authenticated key management type");
1279                 return -1;
1280         }
1281
1282         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1284                          wpa_s->pairwise_cipher);
1285         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1286
1287 #ifdef CONFIG_IEEE80211W
1288         sel = ie.mgmt_group_cipher;
1289         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1290             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1291                 sel = 0;
1292         if (sel & WPA_CIPHER_AES_128_CMAC) {
1293                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1294                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1295                         "AES-128-CMAC");
1296         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1297                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1298                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1299                         "BIP-GMAC-128");
1300         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1301                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1302                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1303                         "BIP-GMAC-256");
1304         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1305                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1306                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1307                         "BIP-CMAC-256");
1308         } else {
1309                 wpa_s->mgmt_group_cipher = 0;
1310                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1311         }
1312         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1313                          wpa_s->mgmt_group_cipher);
1314         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1315                          wpas_get_ssid_pmf(wpa_s, ssid));
1316 #endif /* CONFIG_IEEE80211W */
1317
1318         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1319                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1320                 return -1;
1321         }
1322
1323         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1324                 int psk_set = 0;
1325
1326                 if (ssid->psk_set) {
1327                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1328                                        NULL);
1329                         psk_set = 1;
1330                 }
1331 #ifndef CONFIG_NO_PBKDF2
1332                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1333                     ssid->passphrase) {
1334                         u8 psk[PMK_LEN];
1335                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1336                                     4096, psk, PMK_LEN);
1337                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1338                                         psk, PMK_LEN);
1339                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1340                         psk_set = 1;
1341                         os_memset(psk, 0, sizeof(psk));
1342                 }
1343 #endif /* CONFIG_NO_PBKDF2 */
1344 #ifdef CONFIG_EXT_PASSWORD
1345                 if (ssid->ext_psk) {
1346                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1347                                                              ssid->ext_psk);
1348                         char pw_str[64 + 1];
1349                         u8 psk[PMK_LEN];
1350
1351                         if (pw == NULL) {
1352                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1353                                         "found from external storage");
1354                                 return -1;
1355                         }
1356
1357                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1358                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1359                                         "PSK length %d in external storage",
1360                                         (int) wpabuf_len(pw));
1361                                 ext_password_free(pw);
1362                                 return -1;
1363                         }
1364
1365                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1366                         pw_str[wpabuf_len(pw)] = '\0';
1367
1368 #ifndef CONFIG_NO_PBKDF2
1369                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1370                         {
1371                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1372                                             4096, psk, PMK_LEN);
1373                                 os_memset(pw_str, 0, sizeof(pw_str));
1374                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1375                                                 "external passphrase)",
1376                                                 psk, PMK_LEN);
1377                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1378                                                NULL);
1379                                 psk_set = 1;
1380                                 os_memset(psk, 0, sizeof(psk));
1381                         } else
1382 #endif /* CONFIG_NO_PBKDF2 */
1383                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1384                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1385                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1386                                                 "Invalid PSK hex string");
1387                                         os_memset(pw_str, 0, sizeof(pw_str));
1388                                         ext_password_free(pw);
1389                                         return -1;
1390                                 }
1391                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1392                                                NULL);
1393                                 psk_set = 1;
1394                                 os_memset(psk, 0, sizeof(psk));
1395                         } else {
1396                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1397                                         "PSK available");
1398                                 os_memset(pw_str, 0, sizeof(pw_str));
1399                                 ext_password_free(pw);
1400                                 return -1;
1401                         }
1402
1403                         os_memset(pw_str, 0, sizeof(pw_str));
1404                         ext_password_free(pw);
1405                 }
1406 #endif /* CONFIG_EXT_PASSWORD */
1407
1408                 if (!psk_set) {
1409                         wpa_msg(wpa_s, MSG_INFO,
1410                                 "No PSK available for association");
1411                         return -1;
1412                 }
1413         } else
1414                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1415
1416         return 0;
1417 }
1418
1419
1420 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1421 {
1422         *pos = 0x00;
1423
1424         switch (idx) {
1425         case 0: /* Bits 0-7 */
1426                 break;
1427         case 1: /* Bits 8-15 */
1428                 break;
1429         case 2: /* Bits 16-23 */
1430 #ifdef CONFIG_WNM
1431                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1432                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1433 #endif /* CONFIG_WNM */
1434                 break;
1435         case 3: /* Bits 24-31 */
1436 #ifdef CONFIG_WNM
1437                 *pos |= 0x02; /* Bit 25 - SSID List */
1438 #endif /* CONFIG_WNM */
1439 #ifdef CONFIG_INTERWORKING
1440                 if (wpa_s->conf->interworking)
1441                         *pos |= 0x80; /* Bit 31 - Interworking */
1442 #endif /* CONFIG_INTERWORKING */
1443                 break;
1444         case 4: /* Bits 32-39 */
1445 #ifdef CONFIG_INTERWORKING
1446                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1447                         *pos |= 0x01; /* Bit 32 - QoS Map */
1448 #endif /* CONFIG_INTERWORKING */
1449                 break;
1450         case 5: /* Bits 40-47 */
1451 #ifdef CONFIG_HS20
1452                 if (wpa_s->conf->hs20)
1453                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1454 #endif /* CONFIG_HS20 */
1455 #ifdef CONFIG_MBO
1456                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1457 #endif /* CONFIG_MBO */
1458                 break;
1459         case 6: /* Bits 48-55 */
1460                 break;
1461         case 7: /* Bits 56-63 */
1462                 break;
1463         case 8: /* Bits 64-71 */
1464                 if (wpa_s->conf->ftm_responder)
1465                         *pos |= 0x40; /* Bit 70 - FTM responder */
1466                 if (wpa_s->conf->ftm_initiator)
1467                         *pos |= 0x80; /* Bit 71 - FTM initiator */
1468                 break;
1469         }
1470 }
1471
1472
1473 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1474 {
1475         u8 *pos = buf;
1476         u8 len = 6, i;
1477
1478         if (len < 9 &&
1479             (wpa_s->conf->ftm_initiator || wpa_s->conf->ftm_responder))
1480                 len = 9;
1481         if (len < wpa_s->extended_capa_len)
1482                 len = wpa_s->extended_capa_len;
1483         if (buflen < (size_t) len + 2) {
1484                 wpa_printf(MSG_INFO,
1485                            "Not enough room for building extended capabilities element");
1486                 return -1;
1487         }
1488
1489         *pos++ = WLAN_EID_EXT_CAPAB;
1490         *pos++ = len;
1491         for (i = 0; i < len; i++, pos++) {
1492                 wpas_ext_capab_byte(wpa_s, pos, i);
1493
1494                 if (i < wpa_s->extended_capa_len) {
1495                         *pos &= ~wpa_s->extended_capa_mask[i];
1496                         *pos |= wpa_s->extended_capa[i];
1497                 }
1498         }
1499
1500         while (len > 0 && buf[1 + len] == 0) {
1501                 len--;
1502                 buf[1] = len;
1503         }
1504         if (len == 0)
1505                 return 0;
1506
1507         return 2 + len;
1508 }
1509
1510
1511 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1512                           struct wpa_bss *test_bss)
1513 {
1514         struct wpa_bss *bss;
1515
1516         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1517                 if (bss == test_bss)
1518                         return 1;
1519         }
1520
1521         return 0;
1522 }
1523
1524
1525 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1526                            struct wpa_ssid *test_ssid)
1527 {
1528         struct wpa_ssid *ssid;
1529
1530         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1531                 if (ssid == test_ssid)
1532                         return 1;
1533         }
1534
1535         return 0;
1536 }
1537
1538
1539 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1540                         struct wpa_ssid *test_ssid)
1541 {
1542         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1543                 return 0;
1544
1545         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1546 }
1547
1548
1549 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1550 {
1551         if (cwork == NULL)
1552                 return;
1553         os_free(cwork);
1554 }
1555
1556
1557 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1558 {
1559         struct wpa_connect_work *cwork;
1560         struct wpa_radio_work *work = wpa_s->connect_work;
1561
1562         if (!work)
1563                 return;
1564
1565         wpa_s->connect_work = NULL;
1566         cwork = work->ctx;
1567         work->ctx = NULL;
1568         wpas_connect_work_free(cwork);
1569         radio_work_done(work);
1570 }
1571
1572
1573 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1574 {
1575         struct os_reltime now;
1576         u8 addr[ETH_ALEN];
1577
1578         os_get_reltime(&now);
1579         if (wpa_s->last_mac_addr_style == style &&
1580             wpa_s->last_mac_addr_change.sec != 0 &&
1581             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1582                                 wpa_s->conf->rand_addr_lifetime)) {
1583                 wpa_msg(wpa_s, MSG_DEBUG,
1584                         "Previously selected random MAC address has not yet expired");
1585                 return 0;
1586         }
1587
1588         switch (style) {
1589         case 1:
1590                 if (random_mac_addr(addr) < 0)
1591                         return -1;
1592                 break;
1593         case 2:
1594                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1595                 if (random_mac_addr_keep_oui(addr) < 0)
1596                         return -1;
1597                 break;
1598         default:
1599                 return -1;
1600         }
1601
1602         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1603                 wpa_msg(wpa_s, MSG_INFO,
1604                         "Failed to set random MAC address");
1605                 return -1;
1606         }
1607
1608         os_get_reltime(&wpa_s->last_mac_addr_change);
1609         wpa_s->mac_addr_changed = 1;
1610         wpa_s->last_mac_addr_style = style;
1611
1612         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1613                 wpa_msg(wpa_s, MSG_INFO,
1614                         "Could not update MAC address information");
1615                 return -1;
1616         }
1617
1618         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1619                 MAC2STR(addr));
1620
1621         return 0;
1622 }
1623
1624
1625 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1626 {
1627         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1628             !wpa_s->conf->preassoc_mac_addr)
1629                 return 0;
1630
1631         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1632 }
1633
1634
1635 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1636
1637 /**
1638  * wpa_supplicant_associate - Request association
1639  * @wpa_s: Pointer to wpa_supplicant data
1640  * @bss: Scan results for the selected BSS, or %NULL if not available
1641  * @ssid: Configuration data for the selected network
1642  *
1643  * This function is used to request %wpa_supplicant to associate with a BSS.
1644  */
1645 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1646                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1647 {
1648         struct wpa_connect_work *cwork;
1649         int rand_style;
1650
1651         wpa_s->own_disconnect_req = 0;
1652
1653         /*
1654          * If we are starting a new connection, any previously pending EAPOL
1655          * RX cannot be valid anymore.
1656          */
1657         wpabuf_free(wpa_s->pending_eapol_rx);
1658         wpa_s->pending_eapol_rx = NULL;
1659
1660         if (ssid->mac_addr == -1)
1661                 rand_style = wpa_s->conf->mac_addr;
1662         else
1663                 rand_style = ssid->mac_addr;
1664
1665         wmm_ac_clear_saved_tspecs(wpa_s);
1666         wpa_s->reassoc_same_bss = 0;
1667         wpa_s->reassoc_same_ess = 0;
1668
1669         if (wpa_s->last_ssid == ssid) {
1670                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1671                 wpa_s->reassoc_same_ess = 1;
1672                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1673                         wmm_ac_save_tspecs(wpa_s);
1674                         wpa_s->reassoc_same_bss = 1;
1675                 }
1676         } else if (rand_style > 0) {
1677                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1678                         return;
1679                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1680         } else if (wpa_s->mac_addr_changed) {
1681                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1682                         wpa_msg(wpa_s, MSG_INFO,
1683                                 "Could not restore permanent MAC address");
1684                         return;
1685                 }
1686                 wpa_s->mac_addr_changed = 0;
1687                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1688                         wpa_msg(wpa_s, MSG_INFO,
1689                                 "Could not update MAC address information");
1690                         return;
1691                 }
1692                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1693         }
1694         wpa_s->last_ssid = ssid;
1695
1696 #ifdef CONFIG_IBSS_RSN
1697         ibss_rsn_deinit(wpa_s->ibss_rsn);
1698         wpa_s->ibss_rsn = NULL;
1699 #endif /* CONFIG_IBSS_RSN */
1700
1701         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1702             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1703 #ifdef CONFIG_AP
1704                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1705                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1706                                 "mode");
1707                         return;
1708                 }
1709                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1710                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1711                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1712                                 wpas_p2p_ap_setup_failed(wpa_s);
1713                         return;
1714                 }
1715                 wpa_s->current_bss = bss;
1716 #else /* CONFIG_AP */
1717                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1718                         "the build");
1719 #endif /* CONFIG_AP */
1720                 return;
1721         }
1722
1723         if (ssid->mode == WPAS_MODE_MESH) {
1724 #ifdef CONFIG_MESH
1725                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1726                         wpa_msg(wpa_s, MSG_INFO,
1727                                 "Driver does not support mesh mode");
1728                         return;
1729                 }
1730                 if (bss)
1731                         ssid->frequency = bss->freq;
1732                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1733                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1734                         return;
1735                 }
1736                 wpa_s->current_bss = bss;
1737                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1738                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1739                         ssid->id);
1740 #else /* CONFIG_MESH */
1741                 wpa_msg(wpa_s, MSG_ERROR,
1742                         "mesh mode support not included in the build");
1743 #endif /* CONFIG_MESH */
1744                 return;
1745         }
1746
1747 #ifdef CONFIG_TDLS
1748         if (bss)
1749                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1750                                 bss->ie_len);
1751 #endif /* CONFIG_TDLS */
1752
1753         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1754             ssid->mode == IEEE80211_MODE_INFRA) {
1755                 sme_authenticate(wpa_s, bss, ssid);
1756                 return;
1757         }
1758
1759         if (wpa_s->connect_work) {
1760                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1761                 return;
1762         }
1763
1764         if (radio_work_pending(wpa_s, "connect")) {
1765                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1766                 return;
1767         }
1768
1769         wpas_abort_ongoing_scan(wpa_s);
1770
1771         cwork = os_zalloc(sizeof(*cwork));
1772         if (cwork == NULL)
1773                 return;
1774
1775         cwork->bss = bss;
1776         cwork->ssid = ssid;
1777
1778         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1779                            wpas_start_assoc_cb, cwork) < 0) {
1780                 os_free(cwork);
1781         }
1782 }
1783
1784
1785 static int bss_is_ibss(struct wpa_bss *bss)
1786 {
1787         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1788                 IEEE80211_CAP_IBSS;
1789 }
1790
1791
1792 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1793                             const struct wpa_ssid *ssid)
1794 {
1795         enum hostapd_hw_mode hw_mode;
1796         struct hostapd_hw_modes *mode = NULL;
1797         u8 channel;
1798         int i;
1799
1800 #ifdef CONFIG_HT_OVERRIDES
1801         if (ssid->disable_ht)
1802                 return 0;
1803 #endif /* CONFIG_HT_OVERRIDES */
1804
1805         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1806         if (hw_mode == NUM_HOSTAPD_MODES)
1807                 return 0;
1808         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1809                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1810                         mode = &wpa_s->hw.modes[i];
1811                         break;
1812                 }
1813         }
1814
1815         if (!mode)
1816                 return 0;
1817
1818         return mode->vht_capab != 0;
1819 }
1820
1821
1822 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1823                           const struct wpa_ssid *ssid,
1824                           struct hostapd_freq_params *freq)
1825 {
1826         enum hostapd_hw_mode hw_mode;
1827         struct hostapd_hw_modes *mode = NULL;
1828         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1829                            184, 192 };
1830         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1831         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1832         u8 channel;
1833         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1834         unsigned int j, k;
1835         struct hostapd_freq_params vht_freq;
1836         int chwidth, seg0, seg1;
1837         u32 vht_caps = 0;
1838
1839         freq->freq = ssid->frequency;
1840
1841         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1842                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1843
1844                 if (ssid->mode != WPAS_MODE_IBSS)
1845                         break;
1846
1847                 /* Don't adjust control freq in case of fixed_freq */
1848                 if (ssid->fixed_freq)
1849                         break;
1850
1851                 if (!bss_is_ibss(bss))
1852                         continue;
1853
1854                 if (ssid->ssid_len == bss->ssid_len &&
1855                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1856                         wpa_printf(MSG_DEBUG,
1857                                    "IBSS already found in scan results, adjust control freq: %d",
1858                                    bss->freq);
1859                         freq->freq = bss->freq;
1860                         obss_scan = 0;
1861                         break;
1862                 }
1863         }
1864
1865         /* For IBSS check HT_IBSS flag */
1866         if (ssid->mode == WPAS_MODE_IBSS &&
1867             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1868                 return;
1869
1870         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1871             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1872             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1873                 wpa_printf(MSG_DEBUG,
1874                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1875                 return;
1876         }
1877
1878         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1879         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1880                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1881                         mode = &wpa_s->hw.modes[i];
1882                         break;
1883                 }
1884         }
1885
1886         if (!mode)
1887                 return;
1888
1889 #ifdef CONFIG_HT_OVERRIDES
1890         if (ssid->disable_ht) {
1891                 freq->ht_enabled = 0;
1892                 return;
1893         }
1894 #endif /* CONFIG_HT_OVERRIDES */
1895
1896         freq->ht_enabled = ht_supported(mode);
1897         if (!freq->ht_enabled)
1898                 return;
1899
1900         /* Setup higher BW only for 5 GHz */
1901         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1902                 return;
1903
1904         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1905                 pri_chan = &mode->channels[chan_idx];
1906                 if (pri_chan->chan == channel)
1907                         break;
1908                 pri_chan = NULL;
1909         }
1910         if (!pri_chan)
1911                 return;
1912
1913         /* Check primary channel flags */
1914         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1915                 return;
1916
1917 #ifdef CONFIG_HT_OVERRIDES
1918         if (ssid->disable_ht40)
1919                 return;
1920 #endif /* CONFIG_HT_OVERRIDES */
1921
1922         /* Check/setup HT40+/HT40- */
1923         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1924                 if (ht40plus[j] == channel) {
1925                         ht40 = 1;
1926                         break;
1927                 }
1928         }
1929
1930         /* Find secondary channel */
1931         for (i = 0; i < mode->num_channels; i++) {
1932                 sec_chan = &mode->channels[i];
1933                 if (sec_chan->chan == channel + ht40 * 4)
1934                         break;
1935                 sec_chan = NULL;
1936         }
1937         if (!sec_chan)
1938                 return;
1939
1940         /* Check secondary channel flags */
1941         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1942                 return;
1943
1944         freq->channel = pri_chan->chan;
1945
1946         if (ht40 == -1) {
1947                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1948                         return;
1949         } else {
1950                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1951                         return;
1952         }
1953         freq->sec_channel_offset = ht40;
1954
1955         if (obss_scan) {
1956                 struct wpa_scan_results *scan_res;
1957
1958                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1959                 if (scan_res == NULL) {
1960                         /* Back to HT20 */
1961                         freq->sec_channel_offset = 0;
1962                         return;
1963                 }
1964
1965                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1966                                      sec_chan->chan);
1967                 switch (res) {
1968                 case 0:
1969                         /* Back to HT20 */
1970                         freq->sec_channel_offset = 0;
1971                         break;
1972                 case 1:
1973                         /* Configuration allowed */
1974                         break;
1975                 case 2:
1976                         /* Switch pri/sec channels */
1977                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1978                         freq->sec_channel_offset = -freq->sec_channel_offset;
1979                         freq->channel = sec_chan->chan;
1980                         break;
1981                 default:
1982                         freq->sec_channel_offset = 0;
1983                         break;
1984                 }
1985
1986                 wpa_scan_results_free(scan_res);
1987         }
1988
1989         wpa_printf(MSG_DEBUG,
1990                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1991                    freq->channel, freq->sec_channel_offset);
1992
1993         if (!drv_supports_vht(wpa_s, ssid))
1994                 return;
1995
1996         /* For IBSS check VHT_IBSS flag */
1997         if (ssid->mode == WPAS_MODE_IBSS &&
1998             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1999                 return;
2000
2001         vht_freq = *freq;
2002
2003         vht_freq.vht_enabled = vht_supported(mode);
2004         if (!vht_freq.vht_enabled)
2005                 return;
2006
2007         /* setup center_freq1, bandwidth */
2008         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
2009                 if (freq->channel >= vht80[j] &&
2010                     freq->channel < vht80[j] + 16)
2011                         break;
2012         }
2013
2014         if (j == ARRAY_SIZE(vht80))
2015                 return;
2016
2017         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
2018                 struct hostapd_channel_data *chan;
2019
2020                 chan = hw_get_channel_chan(mode, i, NULL);
2021                 if (!chan)
2022                         return;
2023
2024                 /* Back to HT configuration if channel not usable */
2025                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2026                         return;
2027         }
2028
2029         chwidth = VHT_CHANWIDTH_80MHZ;
2030         seg0 = vht80[j] + 6;
2031         seg1 = 0;
2032
2033         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2034                 /* setup center_freq2, bandwidth */
2035                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2036                         /* Only accept 80 MHz segments separated by a gap */
2037                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2038                                 continue;
2039                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2040                                 struct hostapd_channel_data *chan;
2041
2042                                 chan = hw_get_channel_chan(mode, i, NULL);
2043                                 if (!chan)
2044                                         continue;
2045
2046                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2047                                                   HOSTAPD_CHAN_NO_IR |
2048                                                   HOSTAPD_CHAN_RADAR))
2049                                         continue;
2050
2051                                 /* Found a suitable second segment for 80+80 */
2052                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2053                                 vht_caps |=
2054                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2055                                 seg1 = vht80[k] + 6;
2056                         }
2057
2058                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2059                                 break;
2060                 }
2061         } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_160MHZ) {
2062                 if (freq->freq == 5180) {
2063                         chwidth = VHT_CHANWIDTH_160MHZ;
2064                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2065                         seg0 = 50;
2066                 } else if (freq->freq == 5520) {
2067                         chwidth = VHT_CHANWIDTH_160MHZ;
2068                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2069                         seg0 = 114;
2070                 }
2071         }
2072
2073         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2074                                     freq->channel, freq->ht_enabled,
2075                                     vht_freq.vht_enabled,
2076                                     freq->sec_channel_offset,
2077                                     chwidth, seg0, seg1, vht_caps) != 0)
2078                 return;
2079
2080         *freq = vht_freq;
2081
2082         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2083                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2084 }
2085
2086
2087 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2088 {
2089         struct wpa_connect_work *cwork = work->ctx;
2090         struct wpa_bss *bss = cwork->bss;
2091         struct wpa_ssid *ssid = cwork->ssid;
2092         struct wpa_supplicant *wpa_s = work->wpa_s;
2093         u8 wpa_ie[200];
2094         size_t wpa_ie_len;
2095         int use_crypt, ret, i, bssid_changed;
2096         int algs = WPA_AUTH_ALG_OPEN;
2097         unsigned int cipher_pairwise, cipher_group;
2098         struct wpa_driver_associate_params params;
2099         int wep_keys_set = 0;
2100         int assoc_failed = 0;
2101         struct wpa_ssid *old_ssid;
2102         u8 prev_bssid[ETH_ALEN];
2103 #ifdef CONFIG_HT_OVERRIDES
2104         struct ieee80211_ht_capabilities htcaps;
2105         struct ieee80211_ht_capabilities htcaps_mask;
2106 #endif /* CONFIG_HT_OVERRIDES */
2107 #ifdef CONFIG_VHT_OVERRIDES
2108        struct ieee80211_vht_capabilities vhtcaps;
2109        struct ieee80211_vht_capabilities vhtcaps_mask;
2110 #endif /* CONFIG_VHT_OVERRIDES */
2111 #ifdef CONFIG_MBO
2112         const u8 *mbo = NULL;
2113 #endif /* CONFIG_MBO */
2114
2115         if (deinit) {
2116                 if (work->started) {
2117                         wpa_s->connect_work = NULL;
2118
2119                         /* cancel possible auth. timeout */
2120                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2121                                              NULL);
2122                 }
2123                 wpas_connect_work_free(cwork);
2124                 return;
2125         }
2126
2127         wpa_s->connect_work = work;
2128
2129         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2130             wpas_network_disabled(wpa_s, ssid)) {
2131                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2132                 wpas_connect_work_done(wpa_s);
2133                 return;
2134         }
2135
2136         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2137         os_memset(&params, 0, sizeof(params));
2138         wpa_s->reassociate = 0;
2139         wpa_s->eap_expected_failure = 0;
2140         if (bss &&
2141             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2142 #ifdef CONFIG_IEEE80211R
2143                 const u8 *ie, *md = NULL;
2144 #endif /* CONFIG_IEEE80211R */
2145                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2146                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2147                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2148                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2149                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2150                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2151                 if (bssid_changed)
2152                         wpas_notify_bssid_changed(wpa_s);
2153 #ifdef CONFIG_IEEE80211R
2154                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2155                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2156                         md = ie + 2;
2157                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2158                 if (md) {
2159                         /* Prepare for the next transition */
2160                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2161                 }
2162 #endif /* CONFIG_IEEE80211R */
2163 #ifdef CONFIG_WPS
2164         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2165                    wpa_s->conf->ap_scan == 2 &&
2166                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2167                 /* Use ap_scan==1 style network selection to find the network
2168                  */
2169                 wpas_connect_work_done(wpa_s);
2170                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2171                 wpa_s->reassociate = 1;
2172                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2173                 return;
2174 #endif /* CONFIG_WPS */
2175         } else {
2176                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2177                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2178                 if (bss)
2179                         os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2180                 else
2181                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2182         }
2183         if (!wpa_s->pno)
2184                 wpa_supplicant_cancel_sched_scan(wpa_s);
2185
2186         wpa_supplicant_cancel_scan(wpa_s);
2187
2188         /* Starting new association, so clear the possibly used WPA IE from the
2189          * previous association. */
2190         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2191
2192 #ifdef IEEE8021X_EAPOL
2193         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2194                 if (ssid->leap) {
2195                         if (ssid->non_leap == 0)
2196                                 algs = WPA_AUTH_ALG_LEAP;
2197                         else
2198                                 algs |= WPA_AUTH_ALG_LEAP;
2199                 }
2200         }
2201 #endif /* IEEE8021X_EAPOL */
2202         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2203         if (ssid->auth_alg) {
2204                 algs = ssid->auth_alg;
2205                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2206                         "0x%x", algs);
2207         }
2208
2209         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2210                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2211             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2212                 int try_opportunistic;
2213                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2214                                      wpa_s->conf->okc :
2215                                      ssid->proactive_key_caching) &&
2216                         (ssid->proto & WPA_PROTO_RSN);
2217                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2218                                             ssid, try_opportunistic) == 0)
2219                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2220                 wpa_ie_len = sizeof(wpa_ie);
2221                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2222                                               wpa_ie, &wpa_ie_len)) {
2223                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2224                                 "key management and encryption suites");
2225                         wpas_connect_work_done(wpa_s);
2226                         return;
2227                 }
2228         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2229                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2230                 /*
2231                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2232                  * use non-WPA since the scan results did not indicate that the
2233                  * AP is using WPA or WPA2.
2234                  */
2235                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2236                 wpa_ie_len = 0;
2237                 wpa_s->wpa_proto = 0;
2238         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2239                 wpa_ie_len = sizeof(wpa_ie);
2240                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2241                                               wpa_ie, &wpa_ie_len)) {
2242                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2243                                 "key management and encryption suites (no "
2244                                 "scan results)");
2245                         wpas_connect_work_done(wpa_s);
2246                         return;
2247                 }
2248 #ifdef CONFIG_WPS
2249         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2250                 struct wpabuf *wps_ie;
2251                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2252                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2253                         wpa_ie_len = wpabuf_len(wps_ie);
2254                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2255                 } else
2256                         wpa_ie_len = 0;
2257                 wpabuf_free(wps_ie);
2258                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2259                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2260                         params.wps = WPS_MODE_PRIVACY;
2261                 else
2262                         params.wps = WPS_MODE_OPEN;
2263                 wpa_s->wpa_proto = 0;
2264 #endif /* CONFIG_WPS */
2265         } else {
2266                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2267                 wpa_ie_len = 0;
2268                 wpa_s->wpa_proto = 0;
2269         }
2270
2271 #ifdef CONFIG_P2P
2272         if (wpa_s->global->p2p) {
2273                 u8 *pos;
2274                 size_t len;
2275                 int res;
2276                 pos = wpa_ie + wpa_ie_len;
2277                 len = sizeof(wpa_ie) - wpa_ie_len;
2278                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2279                                             ssid->p2p_group);
2280                 if (res >= 0)
2281                         wpa_ie_len += res;
2282         }
2283
2284         wpa_s->cross_connect_disallowed = 0;
2285         if (bss) {
2286                 struct wpabuf *p2p;
2287                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2288                 if (p2p) {
2289                         wpa_s->cross_connect_disallowed =
2290                                 p2p_get_cross_connect_disallowed(p2p);
2291                         wpabuf_free(p2p);
2292                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2293                                 "connection",
2294                                 wpa_s->cross_connect_disallowed ?
2295                                 "disallows" : "allows");
2296                 }
2297         }
2298
2299         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2300 #endif /* CONFIG_P2P */
2301
2302 #ifdef CONFIG_MBO
2303         if (bss) {
2304                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2305                 if (mbo) {
2306                         int len;
2307
2308                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2309                                                         wpa_ie + wpa_ie_len,
2310                                                         sizeof(wpa_ie) -
2311                                                         wpa_ie_len);
2312                         if (len > 0)
2313                                 wpa_ie_len += len;
2314                 }
2315         }
2316 #endif /* CONFIG_MBO */
2317
2318         /*
2319          * Workaround: Add Extended Capabilities element only if the AP
2320          * included this element in Beacon/Probe Response frames. Some older
2321          * APs seem to have interoperability issues if this element is
2322          * included, so while the standard may require us to include the
2323          * element in all cases, it is justifiable to skip it to avoid
2324          * interoperability issues.
2325          */
2326         if (ssid->p2p_group)
2327                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
2328         else
2329                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
2330
2331         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2332                 u8 ext_capab[18];
2333                 int ext_capab_len;
2334                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2335                                                      sizeof(ext_capab));
2336                 if (ext_capab_len > 0) {
2337                         u8 *pos = wpa_ie;
2338                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2339                                 pos += 2 + pos[1];
2340                         os_memmove(pos + ext_capab_len, pos,
2341                                    wpa_ie_len - (pos - wpa_ie));
2342                         wpa_ie_len += ext_capab_len;
2343                         os_memcpy(pos, ext_capab, ext_capab_len);
2344                 }
2345         }
2346
2347 #ifdef CONFIG_HS20
2348         if (is_hs20_network(wpa_s, ssid, bss)) {
2349                 struct wpabuf *hs20;
2350
2351                 hs20 = wpabuf_alloc(20);
2352                 if (hs20) {
2353                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2354                         size_t len;
2355
2356                         wpas_hs20_add_indication(hs20, pps_mo_id);
2357                         len = sizeof(wpa_ie) - wpa_ie_len;
2358                         if (wpabuf_len(hs20) <= len) {
2359                                 os_memcpy(wpa_ie + wpa_ie_len,
2360                                           wpabuf_head(hs20), wpabuf_len(hs20));
2361                                 wpa_ie_len += wpabuf_len(hs20);
2362                         }
2363                         wpabuf_free(hs20);
2364
2365                         hs20_configure_frame_filters(wpa_s);
2366                 }
2367         }
2368 #endif /* CONFIG_HS20 */
2369
2370         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2371                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2372                 size_t len;
2373
2374                 len = sizeof(wpa_ie) - wpa_ie_len;
2375                 if (wpabuf_len(buf) <= len) {
2376                         os_memcpy(wpa_ie + wpa_ie_len,
2377                                   wpabuf_head(buf), wpabuf_len(buf));
2378                         wpa_ie_len += wpabuf_len(buf);
2379                 }
2380         }
2381
2382 #ifdef CONFIG_FST
2383         if (wpa_s->fst_ies) {
2384                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2385
2386                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2387                         os_memcpy(wpa_ie + wpa_ie_len,
2388                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2389                         wpa_ie_len += fst_ies_len;
2390                 }
2391         }
2392 #endif /* CONFIG_FST */
2393
2394 #ifdef CONFIG_MBO
2395         if (mbo) {
2396                 int len;
2397
2398                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2399                                   sizeof(wpa_ie) - wpa_ie_len);
2400                 if (len >= 0)
2401                         wpa_ie_len += len;
2402         }
2403 #endif /* CONFIG_MBO */
2404
2405         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2406         use_crypt = 1;
2407         cipher_pairwise = wpa_s->pairwise_cipher;
2408         cipher_group = wpa_s->group_cipher;
2409         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2410             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2411                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2412                         use_crypt = 0;
2413                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2414                         use_crypt = 1;
2415                         wep_keys_set = 1;
2416                 }
2417         }
2418         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2419                 use_crypt = 0;
2420
2421 #ifdef IEEE8021X_EAPOL
2422         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2423                 if ((ssid->eapol_flags &
2424                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2425                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2426                     !wep_keys_set) {
2427                         use_crypt = 0;
2428                 } else {
2429                         /* Assume that dynamic WEP-104 keys will be used and
2430                          * set cipher suites in order for drivers to expect
2431                          * encryption. */
2432                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2433                 }
2434         }
2435 #endif /* IEEE8021X_EAPOL */
2436
2437         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2438                 /* Set the key before (and later after) association */
2439                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2440         }
2441
2442         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2443         if (bss) {
2444                 params.ssid = bss->ssid;
2445                 params.ssid_len = bss->ssid_len;
2446                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2447                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2448                                    MACSTR " freq=%u MHz based on scan results "
2449                                    "(bssid_set=%d)",
2450                                    MAC2STR(bss->bssid), bss->freq,
2451                                    ssid->bssid_set);
2452                         params.bssid = bss->bssid;
2453                         params.freq.freq = bss->freq;
2454                 }
2455                 params.bssid_hint = bss->bssid;
2456                 params.freq_hint = bss->freq;
2457                 params.pbss = bss_is_pbss(bss);
2458         } else {
2459                 params.ssid = ssid->ssid;
2460                 params.ssid_len = ssid->ssid_len;
2461                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2462         }
2463
2464         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2465             wpa_s->conf->ap_scan == 2) {
2466                 params.bssid = ssid->bssid;
2467                 params.fixed_bssid = 1;
2468         }
2469
2470         /* Initial frequency for IBSS/mesh */
2471         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2472             ssid->frequency > 0 && params.freq.freq == 0)
2473                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2474
2475         if (ssid->mode == WPAS_MODE_IBSS) {
2476                 params.fixed_freq = ssid->fixed_freq;
2477                 if (ssid->beacon_int)
2478                         params.beacon_int = ssid->beacon_int;
2479                 else
2480                         params.beacon_int = wpa_s->conf->beacon_int;
2481         }
2482
2483         params.wpa_ie = wpa_ie;
2484         params.wpa_ie_len = wpa_ie_len;
2485         params.pairwise_suite = cipher_pairwise;
2486         params.group_suite = cipher_group;
2487         params.key_mgmt_suite = wpa_s->key_mgmt;
2488         params.wpa_proto = wpa_s->wpa_proto;
2489         params.auth_alg = algs;
2490         params.mode = ssid->mode;
2491         params.bg_scan_period = ssid->bg_scan_period;
2492         for (i = 0; i < NUM_WEP_KEYS; i++) {
2493                 if (ssid->wep_key_len[i])
2494                         params.wep_key[i] = ssid->wep_key[i];
2495                 params.wep_key_len[i] = ssid->wep_key_len[i];
2496         }
2497         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2498
2499         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2500             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2501              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2502                 params.passphrase = ssid->passphrase;
2503                 if (ssid->psk_set)
2504                         params.psk = ssid->psk;
2505         }
2506
2507         if (wpa_s->conf->key_mgmt_offload) {
2508                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2509                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2510                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2511                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2512                         params.req_key_mgmt_offload =
2513                                 ssid->proactive_key_caching < 0 ?
2514                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2515                 else
2516                         params.req_key_mgmt_offload = 1;
2517
2518                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2519                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2520                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2521                     ssid->psk_set)
2522                         params.psk = ssid->psk;
2523         }
2524
2525         params.drop_unencrypted = use_crypt;
2526
2527 #ifdef CONFIG_IEEE80211W
2528         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2529         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2530                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2531                 struct wpa_ie_data ie;
2532                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2533                     ie.capabilities &
2534                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2535                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2536                                 "MFP: require MFP");
2537                         params.mgmt_frame_protection =
2538                                 MGMT_FRAME_PROTECTION_REQUIRED;
2539                 }
2540         }
2541 #endif /* CONFIG_IEEE80211W */
2542
2543         params.p2p = ssid->p2p_group;
2544
2545         if (wpa_s->p2pdev->set_sta_uapsd)
2546                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2547         else
2548                 params.uapsd = -1;
2549
2550 #ifdef CONFIG_HT_OVERRIDES
2551         os_memset(&htcaps, 0, sizeof(htcaps));
2552         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2553         params.htcaps = (u8 *) &htcaps;
2554         params.htcaps_mask = (u8 *) &htcaps_mask;
2555         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2556 #endif /* CONFIG_HT_OVERRIDES */
2557 #ifdef CONFIG_VHT_OVERRIDES
2558         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2559         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2560         params.vhtcaps = &vhtcaps;
2561         params.vhtcaps_mask = &vhtcaps_mask;
2562         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2563 #endif /* CONFIG_VHT_OVERRIDES */
2564
2565 #ifdef CONFIG_P2P
2566         /*
2567          * If multi-channel concurrency is not supported, check for any
2568          * frequency conflict. In case of any frequency conflict, remove the
2569          * least prioritized connection.
2570          */
2571         if (wpa_s->num_multichan_concurrent < 2) {
2572                 int freq, num;
2573                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2574                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2575                         wpa_printf(MSG_DEBUG,
2576                                    "Assoc conflicting freq found (%d != %d)",
2577                                    freq, params.freq.freq);
2578                         if (wpas_p2p_handle_frequency_conflicts(
2579                                     wpa_s, params.freq.freq, ssid) < 0) {
2580                                 wpas_connect_work_done(wpa_s);
2581                                 return;
2582                         }
2583                 }
2584         }
2585 #endif /* CONFIG_P2P */
2586
2587         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2588             wpa_s->current_ssid)
2589                 params.prev_bssid = prev_bssid;
2590
2591         ret = wpa_drv_associate(wpa_s, &params);
2592         if (ret < 0) {
2593                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2594                         "failed");
2595                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2596                         /*
2597                          * The driver is known to mean what is saying, so we
2598                          * can stop right here; the association will not
2599                          * succeed.
2600                          */
2601                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2602                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2603                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2604                         return;
2605                 }
2606                 /* try to continue anyway; new association will be tried again
2607                  * after timeout */
2608                 assoc_failed = 1;
2609         }
2610
2611         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2612                 /* Set the key after the association just in case association
2613                  * cleared the previously configured key. */
2614                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2615                 /* No need to timeout authentication since there is no key
2616                  * management. */
2617                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2618                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2619 #ifdef CONFIG_IBSS_RSN
2620         } else if (ssid->mode == WPAS_MODE_IBSS &&
2621                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2622                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2623                 /*
2624                  * RSN IBSS authentication is per-STA and we can disable the
2625                  * per-BSSID authentication.
2626                  */
2627                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2628 #endif /* CONFIG_IBSS_RSN */
2629         } else {
2630                 /* Timeout for IEEE 802.11 authentication and association */
2631                 int timeout = 60;
2632
2633                 if (assoc_failed) {
2634                         /* give IBSS a bit more time */
2635                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2636                 } else if (wpa_s->conf->ap_scan == 1) {
2637                         /* give IBSS a bit more time */
2638                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2639                 }
2640                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2641         }
2642
2643         if (wep_keys_set &&
2644             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2645                 /* Set static WEP keys again */
2646                 wpa_set_wep_keys(wpa_s, ssid);
2647         }
2648
2649         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2650                 /*
2651                  * Do not allow EAP session resumption between different
2652                  * network configurations.
2653                  */
2654                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2655         }
2656         old_ssid = wpa_s->current_ssid;
2657         wpa_s->current_ssid = ssid;
2658
2659         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2660                 wpa_s->current_bss = bss;
2661 #ifdef CONFIG_HS20
2662                 hs20_configure_frame_filters(wpa_s);
2663 #endif /* CONFIG_HS20 */
2664         }
2665
2666         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2667         wpa_supplicant_initiate_eapol(wpa_s);
2668         if (old_ssid != wpa_s->current_ssid)
2669                 wpas_notify_network_changed(wpa_s);
2670 }
2671
2672
2673 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2674                                             const u8 *addr)
2675 {
2676         struct wpa_ssid *old_ssid;
2677
2678         wpas_connect_work_done(wpa_s);
2679         wpa_clear_keys(wpa_s, addr);
2680         old_ssid = wpa_s->current_ssid;
2681         wpa_supplicant_mark_disassoc(wpa_s);
2682         wpa_sm_set_config(wpa_s->wpa, NULL);
2683         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2684         if (old_ssid != wpa_s->current_ssid)
2685                 wpas_notify_network_changed(wpa_s);
2686         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2687 }
2688
2689
2690 /**
2691  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2692  * @wpa_s: Pointer to wpa_supplicant data
2693  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2694  *
2695  * This function is used to request %wpa_supplicant to deauthenticate from the
2696  * current AP.
2697  */
2698 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2699                                    int reason_code)
2700 {
2701         u8 *addr = NULL;
2702         union wpa_event_data event;
2703         int zero_addr = 0;
2704
2705         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2706                 " pending_bssid=" MACSTR " reason=%d state=%s",
2707                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2708                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2709
2710         if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2711             (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2712              wpa_s->wpa_state == WPA_ASSOCIATING))
2713                 addr = wpa_s->pending_bssid;
2714         else if (!is_zero_ether_addr(wpa_s->bssid))
2715                 addr = wpa_s->bssid;
2716         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2717                 /*
2718                  * When using driver-based BSS selection, we may not know the
2719                  * BSSID with which we are currently trying to associate. We
2720                  * need to notify the driver of this disconnection even in such
2721                  * a case, so use the all zeros address here.
2722                  */
2723                 addr = wpa_s->bssid;
2724                 zero_addr = 1;
2725         }
2726
2727 #ifdef CONFIG_TDLS
2728         wpa_tdls_teardown_peers(wpa_s->wpa);
2729 #endif /* CONFIG_TDLS */
2730
2731 #ifdef CONFIG_MESH
2732         if (wpa_s->ifmsh) {
2733                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2734                         wpa_s->ifname);
2735                 wpa_supplicant_leave_mesh(wpa_s);
2736         }
2737 #endif /* CONFIG_MESH */
2738
2739         if (addr) {
2740                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2741                 os_memset(&event, 0, sizeof(event));
2742                 event.deauth_info.reason_code = (u16) reason_code;
2743                 event.deauth_info.locally_generated = 1;
2744                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2745                 if (zero_addr)
2746                         addr = NULL;
2747         }
2748
2749         wpa_supplicant_clear_connection(wpa_s, addr);
2750 }
2751
2752 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2753                                               struct wpa_ssid *ssid)
2754 {
2755         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2756                 return;
2757
2758         ssid->disabled = 0;
2759         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2760         wpas_notify_network_enabled_changed(wpa_s, ssid);
2761
2762         /*
2763          * Try to reassociate since there is no current configuration and a new
2764          * network was made available.
2765          */
2766         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2767                 wpa_s->reassociate = 1;
2768 }
2769
2770
2771 /**
2772  * wpa_supplicant_add_network - Add a new network
2773  * @wpa_s: wpa_supplicant structure for a network interface
2774  * Returns: The new network configuration or %NULL if operation failed
2775  *
2776  * This function performs the following operations:
2777  * 1. Adds a new network.
2778  * 2. Send network addition notification.
2779  * 3. Marks the network disabled.
2780  * 4. Set network default parameters.
2781  */
2782 struct wpa_ssid * wpa_supplicant_add_network(struct wpa_supplicant *wpa_s)
2783 {
2784         struct wpa_ssid *ssid;
2785
2786         ssid = wpa_config_add_network(wpa_s->conf);
2787         if (!ssid)
2788                 return NULL;
2789         wpas_notify_network_added(wpa_s, ssid);
2790         ssid->disabled = 1;
2791         wpa_config_set_network_defaults(ssid);
2792
2793         return ssid;
2794 }
2795
2796
2797 /**
2798  * wpa_supplicant_remove_network - Remove a configured network based on id
2799  * @wpa_s: wpa_supplicant structure for a network interface
2800  * @id: Unique network id to search for
2801  * Returns: 0 on success, or -1 if the network was not found, -2 if the network
2802  * could not be removed
2803  *
2804  * This function performs the following operations:
2805  * 1. Removes the network.
2806  * 2. Send network removal notification.
2807  * 3. Update internal state machines.
2808  * 4. Stop any running sched scans.
2809  */
2810 int wpa_supplicant_remove_network(struct wpa_supplicant *wpa_s, int id)
2811 {
2812         struct wpa_ssid *ssid;
2813         int was_disabled;
2814
2815         ssid = wpa_config_get_network(wpa_s->conf, id);
2816         if (!ssid)
2817                 return -1;
2818         wpas_notify_network_removed(wpa_s, ssid);
2819
2820         if (wpa_s->last_ssid == ssid)
2821                 wpa_s->last_ssid = NULL;
2822
2823         if (ssid == wpa_s->current_ssid || !wpa_s->current_ssid) {
2824 #ifdef CONFIG_SME
2825                 wpa_s->sme.prev_bssid_set = 0;
2826 #endif /* CONFIG_SME */
2827                 /*
2828                  * Invalidate the EAP session cache if the current or
2829                  * previously used network is removed.
2830                  */
2831                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2832         }
2833
2834         if (ssid == wpa_s->current_ssid) {
2835                 wpa_sm_set_config(wpa_s->wpa, NULL);
2836                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2837
2838                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2839                         wpa_s->own_disconnect_req = 1;
2840                 wpa_supplicant_deauthenticate(wpa_s,
2841                                               WLAN_REASON_DEAUTH_LEAVING);
2842         }
2843
2844         was_disabled = ssid->disabled;
2845
2846         if (wpa_config_remove_network(wpa_s->conf, id) < 0)
2847                 return -2;
2848
2849         if (!was_disabled && wpa_s->sched_scanning) {
2850                 wpa_printf(MSG_DEBUG,
2851                            "Stop ongoing sched_scan to remove network from filters");
2852                 wpa_supplicant_cancel_sched_scan(wpa_s);
2853                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2854         }
2855
2856         return 0;
2857 }
2858
2859
2860 /**
2861  * wpa_supplicant_enable_network - Mark a configured network as enabled
2862  * @wpa_s: wpa_supplicant structure for a network interface
2863  * @ssid: wpa_ssid structure for a configured network or %NULL
2864  *
2865  * Enables the specified network or all networks if no network specified.
2866  */
2867 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2868                                    struct wpa_ssid *ssid)
2869 {
2870         if (ssid == NULL) {
2871                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2872                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2873         } else
2874                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2875
2876         if (wpa_s->reassociate && !wpa_s->disconnected &&
2877             (!wpa_s->current_ssid ||
2878              wpa_s->wpa_state == WPA_DISCONNECTED ||
2879              wpa_s->wpa_state == WPA_SCANNING)) {
2880                 if (wpa_s->sched_scanning) {
2881                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2882                                    "new network to scan filters");
2883                         wpa_supplicant_cancel_sched_scan(wpa_s);
2884                 }
2885
2886                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2887                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2888                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2889                 }
2890         }
2891 }
2892
2893
2894 /**
2895  * wpa_supplicant_disable_network - Mark a configured network as disabled
2896  * @wpa_s: wpa_supplicant structure for a network interface
2897  * @ssid: wpa_ssid structure for a configured network or %NULL
2898  *
2899  * Disables the specified network or all networks if no network specified.
2900  */
2901 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2902                                     struct wpa_ssid *ssid)
2903 {
2904         struct wpa_ssid *other_ssid;
2905         int was_disabled;
2906
2907         if (ssid == NULL) {
2908                 if (wpa_s->sched_scanning)
2909                         wpa_supplicant_cancel_sched_scan(wpa_s);
2910
2911                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2912                      other_ssid = other_ssid->next) {
2913                         was_disabled = other_ssid->disabled;
2914                         if (was_disabled == 2)
2915                                 continue; /* do not change persistent P2P group
2916                                            * data */
2917
2918                         other_ssid->disabled = 1;
2919
2920                         if (was_disabled != other_ssid->disabled)
2921                                 wpas_notify_network_enabled_changed(
2922                                         wpa_s, other_ssid);
2923                 }
2924                 if (wpa_s->current_ssid)
2925                         wpa_supplicant_deauthenticate(
2926                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2927         } else if (ssid->disabled != 2) {
2928                 if (ssid == wpa_s->current_ssid)
2929                         wpa_supplicant_deauthenticate(
2930                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2931
2932                 was_disabled = ssid->disabled;
2933
2934                 ssid->disabled = 1;
2935
2936                 if (was_disabled != ssid->disabled) {
2937                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2938                         if (wpa_s->sched_scanning) {
2939                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2940                                            "to remove network from filters");
2941                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2942                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2943                         }
2944                 }
2945         }
2946 }
2947
2948
2949 /**
2950  * wpa_supplicant_select_network - Attempt association with a network
2951  * @wpa_s: wpa_supplicant structure for a network interface
2952  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2953  */
2954 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2955                                    struct wpa_ssid *ssid)
2956 {
2957
2958         struct wpa_ssid *other_ssid;
2959         int disconnected = 0;
2960
2961         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2962                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2963                         wpa_s->own_disconnect_req = 1;
2964                 wpa_supplicant_deauthenticate(
2965                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2966                 disconnected = 1;
2967         }
2968
2969         if (ssid)
2970                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2971
2972         /*
2973          * Mark all other networks disabled or mark all networks enabled if no
2974          * network specified.
2975          */
2976         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2977              other_ssid = other_ssid->next) {
2978                 int was_disabled = other_ssid->disabled;
2979                 if (was_disabled == 2)
2980                         continue; /* do not change persistent P2P group data */
2981
2982                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2983                 if (was_disabled && !other_ssid->disabled)
2984                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2985
2986                 if (was_disabled != other_ssid->disabled)
2987                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2988         }
2989
2990         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2991             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2992                 /* We are already associated with the selected network */
2993                 wpa_printf(MSG_DEBUG, "Already associated with the "
2994                            "selected network - do nothing");
2995                 return;
2996         }
2997
2998         if (ssid) {
2999                 wpa_s->current_ssid = ssid;
3000                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
3001                 wpa_s->connect_without_scan =
3002                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
3003
3004                 /*
3005                  * Don't optimize next scan freqs since a new ESS has been
3006                  * selected.
3007                  */
3008                 os_free(wpa_s->next_scan_freqs);
3009                 wpa_s->next_scan_freqs = NULL;
3010         } else {
3011                 wpa_s->connect_without_scan = NULL;
3012         }
3013
3014         wpa_s->disconnected = 0;
3015         wpa_s->reassociate = 1;
3016
3017         if (wpa_s->connect_without_scan ||
3018             wpa_supplicant_fast_associate(wpa_s) != 1) {
3019                 wpa_s->scan_req = NORMAL_SCAN_REQ;
3020                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
3021         }
3022
3023         if (ssid)
3024                 wpas_notify_network_selected(wpa_s, ssid);
3025 }
3026
3027
3028 /**
3029  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
3030  * @wpa_s: wpa_supplicant structure for a network interface
3031  * @pkcs11_engine_path: PKCS #11 engine path or NULL
3032  * @pkcs11_module_path: PKCS #11 module path or NULL
3033  * Returns: 0 on success; -1 on failure
3034  *
3035  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
3036  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
3037  * module path fails the paths will be reset to the default value (NULL).
3038  */
3039 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
3040                                            const char *pkcs11_engine_path,
3041                                            const char *pkcs11_module_path)
3042 {
3043         char *pkcs11_engine_path_copy = NULL;
3044         char *pkcs11_module_path_copy = NULL;
3045
3046         if (pkcs11_engine_path != NULL) {
3047                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
3048                 if (pkcs11_engine_path_copy == NULL)
3049                         return -1;
3050         }
3051         if (pkcs11_module_path != NULL) {
3052                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
3053                 if (pkcs11_module_path_copy == NULL) {
3054                         os_free(pkcs11_engine_path_copy);
3055                         return -1;
3056                 }
3057         }
3058
3059         os_free(wpa_s->conf->pkcs11_engine_path);
3060         os_free(wpa_s->conf->pkcs11_module_path);
3061         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
3062         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
3063
3064         wpa_sm_set_eapol(wpa_s->wpa, NULL);
3065         eapol_sm_deinit(wpa_s->eapol);
3066         wpa_s->eapol = NULL;
3067         if (wpa_supplicant_init_eapol(wpa_s)) {
3068                 /* Error -> Reset paths to the default value (NULL) once. */
3069                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
3070                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
3071                                                                NULL);
3072
3073                 return -1;
3074         }
3075         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
3076
3077         return 0;
3078 }
3079
3080
3081 /**
3082  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
3083  * @wpa_s: wpa_supplicant structure for a network interface
3084  * @ap_scan: AP scan mode
3085  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
3086  *
3087  */
3088 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
3089 {
3090
3091         int old_ap_scan;
3092
3093         if (ap_scan < 0 || ap_scan > 2)
3094                 return -1;
3095
3096         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3097                 wpa_printf(MSG_INFO,
3098                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3099         }
3100
3101 #ifdef ANDROID
3102         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
3103             wpa_s->wpa_state >= WPA_ASSOCIATING &&
3104             wpa_s->wpa_state < WPA_COMPLETED) {
3105                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
3106                            "associating", wpa_s->conf->ap_scan, ap_scan);
3107                 return 0;
3108         }
3109 #endif /* ANDROID */
3110
3111         old_ap_scan = wpa_s->conf->ap_scan;
3112         wpa_s->conf->ap_scan = ap_scan;
3113
3114         if (old_ap_scan != wpa_s->conf->ap_scan)
3115                 wpas_notify_ap_scan_changed(wpa_s);
3116
3117         return 0;
3118 }
3119
3120
3121 /**
3122  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
3123  * @wpa_s: wpa_supplicant structure for a network interface
3124  * @expire_age: Expiration age in seconds
3125  * Returns: 0 if succeed or -1 if expire_age has an invalid value
3126  *
3127  */
3128 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3129                                           unsigned int bss_expire_age)
3130 {
3131         if (bss_expire_age < 10) {
3132                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3133                         bss_expire_age);
3134                 return -1;
3135         }
3136         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3137                 bss_expire_age);
3138         wpa_s->conf->bss_expiration_age = bss_expire_age;
3139
3140         return 0;
3141 }
3142
3143
3144 /**
3145  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3146  * @wpa_s: wpa_supplicant structure for a network interface
3147  * @expire_count: number of scans after which an unseen BSS is reclaimed
3148  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3149  *
3150  */
3151 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3152                                             unsigned int bss_expire_count)
3153 {
3154         if (bss_expire_count < 1) {
3155                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3156                         bss_expire_count);
3157                 return -1;
3158         }
3159         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3160                 bss_expire_count);
3161         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3162
3163         return 0;
3164 }
3165
3166
3167 /**
3168  * wpa_supplicant_set_scan_interval - Set scan interval
3169  * @wpa_s: wpa_supplicant structure for a network interface
3170  * @scan_interval: scan interval in seconds
3171  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3172  *
3173  */
3174 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3175                                      int scan_interval)
3176 {
3177         if (scan_interval < 0) {
3178                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3179                         scan_interval);
3180                 return -1;
3181         }
3182         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3183                 scan_interval);
3184         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3185
3186         return 0;
3187 }
3188
3189
3190 /**
3191  * wpa_supplicant_set_debug_params - Set global debug params
3192  * @global: wpa_global structure
3193  * @debug_level: debug level
3194  * @debug_timestamp: determines if show timestamp in debug data
3195  * @debug_show_keys: determines if show keys in debug data
3196  * Returns: 0 if succeed or -1 if debug_level has wrong value
3197  */
3198 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3199                                     int debug_timestamp, int debug_show_keys)
3200 {
3201
3202         int old_level, old_timestamp, old_show_keys;
3203
3204         /* check for allowed debuglevels */
3205         if (debug_level != MSG_EXCESSIVE &&
3206             debug_level != MSG_MSGDUMP &&
3207             debug_level != MSG_DEBUG &&
3208             debug_level != MSG_INFO &&
3209             debug_level != MSG_WARNING &&
3210             debug_level != MSG_ERROR)
3211                 return -1;
3212
3213         old_level = wpa_debug_level;
3214         old_timestamp = wpa_debug_timestamp;
3215         old_show_keys = wpa_debug_show_keys;
3216
3217         wpa_debug_level = debug_level;
3218         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3219         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3220
3221         if (wpa_debug_level != old_level)
3222                 wpas_notify_debug_level_changed(global);
3223         if (wpa_debug_timestamp != old_timestamp)
3224                 wpas_notify_debug_timestamp_changed(global);
3225         if (wpa_debug_show_keys != old_show_keys)
3226                 wpas_notify_debug_show_keys_changed(global);
3227
3228         return 0;
3229 }
3230
3231
3232 /**
3233  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3234  * @wpa_s: Pointer to wpa_supplicant data
3235  * Returns: A pointer to the current network structure or %NULL on failure
3236  */
3237 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3238 {
3239         struct wpa_ssid *entry;
3240         u8 ssid[SSID_MAX_LEN];
3241         int res;
3242         size_t ssid_len;
3243         u8 bssid[ETH_ALEN];
3244         int wired;
3245
3246         res = wpa_drv_get_ssid(wpa_s, ssid);
3247         if (res < 0) {
3248                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3249                         "driver");
3250                 return NULL;
3251         }
3252         ssid_len = res;
3253
3254         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3255                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3256                         "driver");
3257                 return NULL;
3258         }
3259
3260         wired = wpa_s->conf->ap_scan == 0 &&
3261                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3262
3263         entry = wpa_s->conf->ssid;
3264         while (entry) {
3265                 if (!wpas_network_disabled(wpa_s, entry) &&
3266                     ((ssid_len == entry->ssid_len &&
3267                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3268                     (!entry->bssid_set ||
3269                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3270                         return entry;
3271 #ifdef CONFIG_WPS
3272                 if (!wpas_network_disabled(wpa_s, entry) &&
3273                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3274                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3275                     (!entry->bssid_set ||
3276                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3277                         return entry;
3278 #endif /* CONFIG_WPS */
3279
3280                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3281                     entry->ssid_len == 0 &&
3282                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3283                         return entry;
3284
3285                 entry = entry->next;
3286         }
3287
3288         return NULL;
3289 }
3290
3291
3292 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3293 {
3294         struct wpa_global *global = wpa_s->global;
3295
3296         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3297                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3298                 if (global->drv_priv[i] == NULL) {
3299                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3300                                    "'%s'", wpa_drivers[i]->name);
3301                         return -1;
3302                 }
3303         }
3304
3305         wpa_s->driver = wpa_drivers[i];
3306         wpa_s->global_drv_priv = global->drv_priv[i];
3307
3308         return 0;
3309 }
3310
3311
3312 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3313                                      const char *name)
3314 {
3315         int i;
3316         size_t len;
3317         const char *pos, *driver = name;
3318
3319         if (wpa_s == NULL)
3320                 return -1;
3321
3322         if (wpa_drivers[0] == NULL) {
3323                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3324                         "wpa_supplicant");
3325                 return -1;
3326         }
3327
3328         if (name == NULL) {
3329                 /* default to first driver in the list */
3330                 return select_driver(wpa_s, 0);
3331         }
3332
3333         do {
3334                 pos = os_strchr(driver, ',');
3335                 if (pos)
3336                         len = pos - driver;
3337                 else
3338                         len = os_strlen(driver);
3339
3340                 for (i = 0; wpa_drivers[i]; i++) {
3341                         if (os_strlen(wpa_drivers[i]->name) == len &&
3342                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3343                             0) {
3344                                 /* First driver that succeeds wins */
3345                                 if (select_driver(wpa_s, i) == 0)
3346                                         return 0;
3347                         }
3348                 }
3349
3350                 driver = pos + 1;
3351         } while (pos);
3352
3353         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3354         return -1;
3355 }
3356
3357
3358 /**
3359  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3360  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3361  *      with struct wpa_driver_ops::init()
3362  * @src_addr: Source address of the EAPOL frame
3363  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3364  * @len: Length of the EAPOL data
3365  *
3366  * This function is called for each received EAPOL frame. Most driver
3367  * interfaces rely on more generic OS mechanism for receiving frames through
3368  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3369  * take care of received EAPOL frames and deliver them to the core supplicant
3370  * code by calling this function.
3371  */
3372 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3373                              const u8 *buf, size_t len)
3374 {
3375         struct wpa_supplicant *wpa_s = ctx;
3376
3377         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3378         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3379
3380 #ifdef CONFIG_TESTING_OPTIONS
3381         if (wpa_s->ignore_auth_resp) {
3382                 wpa_printf(MSG_INFO, "RX EAPOL - ignore_auth_resp active!");
3383                 return;
3384         }
3385 #endif /* CONFIG_TESTING_OPTIONS */
3386
3387 #ifdef CONFIG_PEERKEY
3388         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3389             wpa_s->current_ssid->peerkey &&
3390             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3391             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3392                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3393                 return;
3394         }
3395 #endif /* CONFIG_PEERKEY */
3396
3397         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3398             (wpa_s->last_eapol_matches_bssid &&
3399 #ifdef CONFIG_AP
3400              !wpa_s->ap_iface &&
3401 #endif /* CONFIG_AP */
3402              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3403                 /*
3404                  * There is possible race condition between receiving the
3405                  * association event and the EAPOL frame since they are coming
3406                  * through different paths from the driver. In order to avoid
3407                  * issues in trying to process the EAPOL frame before receiving
3408                  * association information, lets queue it for processing until
3409                  * the association event is received. This may also be needed in
3410                  * driver-based roaming case, so also use src_addr != BSSID as a
3411                  * trigger if we have previously confirmed that the
3412                  * Authenticator uses BSSID as the src_addr (which is not the
3413                  * case with wired IEEE 802.1X).
3414                  */
3415                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3416                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3417                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3418                         MAC2STR(wpa_s->bssid));
3419                 wpabuf_free(wpa_s->pending_eapol_rx);
3420                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3421                 if (wpa_s->pending_eapol_rx) {
3422                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3423                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3424                                   ETH_ALEN);
3425                 }
3426                 return;
3427         }
3428
3429         wpa_s->last_eapol_matches_bssid =
3430                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3431
3432 #ifdef CONFIG_AP
3433         if (wpa_s->ap_iface) {
3434                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3435                 return;
3436         }
3437 #endif /* CONFIG_AP */
3438
3439         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3440                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3441                         "no key management is configured");
3442                 return;
3443         }
3444
3445         if (wpa_s->eapol_received == 0 &&
3446             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3447              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3448              wpa_s->wpa_state != WPA_COMPLETED) &&
3449             (wpa_s->current_ssid == NULL ||
3450              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3451                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3452                 int timeout = 10;
3453
3454                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3455                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3456                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3457                         /* Use longer timeout for IEEE 802.1X/EAP */
3458                         timeout = 70;
3459                 }
3460
3461 #ifdef CONFIG_WPS
3462                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3463                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3464                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3465                         /*
3466                          * Use shorter timeout if going through WPS AP iteration
3467                          * for PIN config method with an AP that does not
3468                          * advertise Selected Registrar.
3469                          */
3470                         struct wpabuf *wps_ie;
3471
3472                         wps_ie = wpa_bss_get_vendor_ie_multi(
3473                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3474                         if (wps_ie &&
3475                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3476                                 timeout = 10;
3477                         wpabuf_free(wps_ie);
3478                 }
3479 #endif /* CONFIG_WPS */
3480
3481                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3482         }
3483         wpa_s->eapol_received++;
3484
3485         if (wpa_s->countermeasures) {
3486                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3487                         "EAPOL packet");
3488                 return;
3489         }
3490
3491 #ifdef CONFIG_IBSS_RSN
3492         if (wpa_s->current_ssid &&
3493             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3494                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3495                 return;
3496         }
3497 #endif /* CONFIG_IBSS_RSN */
3498
3499         /* Source address of the incoming EAPOL frame could be compared to the
3500          * current BSSID. However, it is possible that a centralized
3501          * Authenticator could be using another MAC address than the BSSID of
3502          * an AP, so just allow any address to be used for now. The replies are
3503          * still sent to the current BSSID (if available), though. */
3504
3505         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3506         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3507             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3508                 return;
3509         wpa_drv_poll(wpa_s);
3510         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3511                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3512         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3513                 /*
3514                  * Set portValid = TRUE here since we are going to skip 4-way
3515                  * handshake processing which would normally set portValid. We
3516                  * need this to allow the EAPOL state machines to be completed
3517                  * without going through EAPOL-Key handshake.
3518                  */
3519                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3520         }
3521 }
3522
3523
3524 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3525 {
3526         if ((!wpa_s->p2p_mgmt ||
3527              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3528             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3529                 l2_packet_deinit(wpa_s->l2);
3530                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3531                                            wpa_drv_get_mac_addr(wpa_s),
3532                                            ETH_P_EAPOL,
3533                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3534                 if (wpa_s->l2 == NULL)
3535                         return -1;
3536         } else {
3537                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3538                 if (addr)
3539                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3540         }
3541
3542         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3543                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3544                 return -1;
3545         }
3546
3547         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3548
3549         return 0;
3550 }
3551
3552
3553 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3554                                            const u8 *buf, size_t len)
3555 {
3556         struct wpa_supplicant *wpa_s = ctx;
3557         const struct l2_ethhdr *eth;
3558
3559         if (len < sizeof(*eth))
3560                 return;
3561         eth = (const struct l2_ethhdr *) buf;
3562
3563         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3564             !(eth->h_dest[0] & 0x01)) {
3565                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3566                         " (bridge - not for this interface - ignore)",
3567                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3568                 return;
3569         }
3570
3571         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3572                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3573         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3574                                 len - sizeof(*eth));
3575 }
3576
3577
3578 /**
3579  * wpa_supplicant_driver_init - Initialize driver interface parameters
3580  * @wpa_s: Pointer to wpa_supplicant data
3581  * Returns: 0 on success, -1 on failure
3582  *
3583  * This function is called to initialize driver interface parameters.
3584  * wpa_drv_init() must have been called before this function to initialize the
3585  * driver interface.
3586  */
3587 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3588 {
3589         static int interface_count = 0;
3590
3591         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3592                 return -1;
3593
3594         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3595                 MAC2STR(wpa_s->own_addr));
3596         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3597         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3598
3599         if (wpa_s->bridge_ifname[0]) {
3600                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3601                         "interface '%s'", wpa_s->bridge_ifname);
3602                 wpa_s->l2_br = l2_packet_init_bridge(
3603                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3604                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3605                 if (wpa_s->l2_br == NULL) {
3606                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3607                                 "connection for the bridge interface '%s'",
3608                                 wpa_s->bridge_ifname);
3609                         return -1;
3610                 }
3611         }
3612
3613         if (wpa_s->conf->ap_scan == 2 &&
3614             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3615                 wpa_printf(MSG_INFO,
3616                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3617         }
3618
3619         wpa_clear_keys(wpa_s, NULL);
3620
3621         /* Make sure that TKIP countermeasures are not left enabled (could
3622          * happen if wpa_supplicant is killed during countermeasures. */
3623         wpa_drv_set_countermeasures(wpa_s, 0);
3624
3625         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3626         wpa_drv_flush_pmkid(wpa_s);
3627
3628         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3629         wpa_s->prev_scan_wildcard = 0;
3630
3631         if (wpa_supplicant_enabled_networks(wpa_s)) {
3632                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3633                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3634                         interface_count = 0;
3635                 }
3636 #ifndef ANDROID
3637                 if (!wpa_s->p2p_mgmt &&
3638                     wpa_supplicant_delayed_sched_scan(wpa_s,
3639                                                       interface_count % 3,
3640                                                       100000))
3641                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3642                                                 100000);
3643 #endif /* ANDROID */
3644                 interface_count++;
3645         } else
3646                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3647
3648         return 0;
3649 }
3650
3651
3652 static int wpa_supplicant_daemon(const char *pid_file)
3653 {
3654         wpa_printf(MSG_DEBUG, "Daemonize..");
3655         return os_daemonize(pid_file);
3656 }
3657
3658
3659 static struct wpa_supplicant *
3660 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3661 {
3662         struct wpa_supplicant *wpa_s;
3663
3664         wpa_s = os_zalloc(sizeof(*wpa_s));
3665         if (wpa_s == NULL)
3666                 return NULL;
3667         wpa_s->scan_req = INITIAL_SCAN_REQ;
3668         wpa_s->scan_interval = 5;
3669         wpa_s->new_connection = 1;
3670         wpa_s->parent = parent ? parent : wpa_s;
3671         wpa_s->p2pdev = wpa_s->parent;
3672         wpa_s->sched_scanning = 0;
3673
3674         dl_list_init(&wpa_s->bss_tmp_disallowed);
3675
3676         return wpa_s;
3677 }
3678
3679
3680 #ifdef CONFIG_HT_OVERRIDES
3681
3682 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3683                              struct ieee80211_ht_capabilities *htcaps,
3684                              struct ieee80211_ht_capabilities *htcaps_mask,
3685                              const char *ht_mcs)
3686 {
3687         /* parse ht_mcs into hex array */
3688         int i;
3689         const char *tmp = ht_mcs;
3690         char *end = NULL;
3691
3692         /* If ht_mcs is null, do not set anything */
3693         if (!ht_mcs)
3694                 return 0;
3695
3696         /* This is what we are setting in the kernel */
3697         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3698
3699         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3700
3701         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3702                 errno = 0;
3703                 long v = strtol(tmp, &end, 16);
3704                 if (errno == 0) {
3705                         wpa_msg(wpa_s, MSG_DEBUG,
3706                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3707                                 i, v, end, tmp);
3708                         if (end == tmp)
3709                                 break;
3710
3711                         htcaps->supported_mcs_set[i] = v;
3712                         tmp = end;
3713                 } else {
3714                         wpa_msg(wpa_s, MSG_ERROR,
3715                                 "Failed to parse ht-mcs: %s, error: %s\n",
3716                                 ht_mcs, strerror(errno));
3717                         return -1;
3718                 }
3719         }
3720
3721         /*
3722          * If we were able to parse any values, then set mask for the MCS set.
3723          */
3724         if (i) {
3725                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3726                           IEEE80211_HT_MCS_MASK_LEN - 1);
3727                 /* skip the 3 reserved bits */
3728                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3729                         0x1f;
3730         }
3731
3732         return 0;
3733 }
3734
3735
3736 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3737                                  struct ieee80211_ht_capabilities *htcaps,
3738                                  struct ieee80211_ht_capabilities *htcaps_mask,
3739                                  int disabled)
3740 {
3741         le16 msk;
3742
3743         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3744
3745         if (disabled == -1)
3746                 return 0;
3747
3748         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3749         htcaps_mask->ht_capabilities_info |= msk;
3750         if (disabled)
3751                 htcaps->ht_capabilities_info &= msk;
3752         else
3753                 htcaps->ht_capabilities_info |= msk;
3754
3755         return 0;
3756 }
3757
3758
3759 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3760                                 struct ieee80211_ht_capabilities *htcaps,
3761                                 struct ieee80211_ht_capabilities *htcaps_mask,
3762                                 int factor)
3763 {
3764         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3765
3766         if (factor == -1)
3767                 return 0;
3768
3769         if (factor < 0 || factor > 3) {
3770                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3771                         "Must be 0-3 or -1", factor);
3772                 return -EINVAL;
3773         }
3774
3775         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3776         htcaps->a_mpdu_params &= ~0x3;
3777         htcaps->a_mpdu_params |= factor & 0x3;
3778
3779         return 0;
3780 }
3781
3782
3783 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3784                                  struct ieee80211_ht_capabilities *htcaps,
3785                                  struct ieee80211_ht_capabilities *htcaps_mask,
3786                                  int density)
3787 {
3788         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3789
3790         if (density == -1)
3791                 return 0;
3792
3793         if (density < 0 || density > 7) {
3794                 wpa_msg(wpa_s, MSG_ERROR,
3795                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3796                         density);
3797                 return -EINVAL;
3798         }
3799
3800         htcaps_mask->a_mpdu_params |= 0x1C;
3801         htcaps->a_mpdu_params &= ~(0x1C);
3802         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3803
3804         return 0;
3805 }
3806
3807
3808 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3809                                 struct ieee80211_ht_capabilities *htcaps,
3810                                 struct ieee80211_ht_capabilities *htcaps_mask,
3811                                 int disabled)
3812 {
3813         /* Masking these out disables HT40 */
3814         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3815                                 HT_CAP_INFO_SHORT_GI40MHZ);
3816
3817         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3818
3819         if (disabled)
3820                 htcaps->ht_capabilities_info &= ~msk;
3821         else
3822                 htcaps->ht_capabilities_info |= msk;
3823
3824         htcaps_mask->ht_capabilities_info |= msk;
3825
3826         return 0;
3827 }
3828
3829
3830 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3831                                struct ieee80211_ht_capabilities *htcaps,
3832                                struct ieee80211_ht_capabilities *htcaps_mask,
3833                                int disabled)
3834 {
3835         /* Masking these out disables SGI */
3836         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3837                                 HT_CAP_INFO_SHORT_GI40MHZ);
3838
3839         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3840
3841         if (disabled)
3842                 htcaps->ht_capabilities_info &= ~msk;
3843         else
3844                 htcaps->ht_capabilities_info |= msk;
3845
3846         htcaps_mask->ht_capabilities_info |= msk;
3847
3848         return 0;
3849 }
3850
3851
3852 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3853                                struct ieee80211_ht_capabilities *htcaps,
3854                                struct ieee80211_ht_capabilities *htcaps_mask,
3855                                int disabled)
3856 {
3857         /* Masking these out disables LDPC */
3858         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3859
3860         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3861
3862         if (disabled)
3863                 htcaps->ht_capabilities_info &= ~msk;
3864         else
3865                 htcaps->ht_capabilities_info |= msk;
3866
3867         htcaps_mask->ht_capabilities_info |= msk;
3868
3869         return 0;
3870 }
3871
3872
3873 void wpa_supplicant_apply_ht_overrides(
3874         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3875         struct wpa_driver_associate_params *params)
3876 {
3877         struct ieee80211_ht_capabilities *htcaps;
3878         struct ieee80211_ht_capabilities *htcaps_mask;
3879
3880         if (!ssid)
3881                 return;
3882
3883         params->disable_ht = ssid->disable_ht;
3884         if (!params->htcaps || !params->htcaps_mask)
3885                 return;
3886
3887         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3888         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3889         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3890         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3891                               ssid->disable_max_amsdu);
3892         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3893         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3894         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3895         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3896         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3897
3898         if (ssid->ht40_intolerant) {
3899                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3900                 htcaps->ht_capabilities_info |= bit;
3901                 htcaps_mask->ht_capabilities_info |= bit;
3902         }
3903 }
3904
3905 #endif /* CONFIG_HT_OVERRIDES */
3906
3907
3908 #ifdef CONFIG_VHT_OVERRIDES
3909 void wpa_supplicant_apply_vht_overrides(
3910         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3911         struct wpa_driver_associate_params *params)
3912 {
3913         struct ieee80211_vht_capabilities *vhtcaps;
3914         struct ieee80211_vht_capabilities *vhtcaps_mask;
3915
3916         if (!ssid)
3917                 return;
3918
3919         params->disable_vht = ssid->disable_vht;
3920
3921         vhtcaps = (void *) params->vhtcaps;
3922         vhtcaps_mask = (void *) params->vhtcaps_mask;
3923
3924         if (!vhtcaps || !vhtcaps_mask)
3925                 return;
3926
3927         vhtcaps->vht_capabilities_info = host_to_le32(ssid->vht_capa);
3928         vhtcaps_mask->vht_capabilities_info = host_to_le32(ssid->vht_capa_mask);
3929
3930 #ifdef CONFIG_HT_OVERRIDES
3931         /* if max ampdu is <= 3, we have to make the HT cap the same */
3932         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3933                 int max_ampdu;
3934
3935                 max_ampdu = (ssid->vht_capa &
3936                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3937                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3938
3939                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3940                 wpa_set_ampdu_factor(wpa_s,
3941                                      (void *) params->htcaps,
3942                                      (void *) params->htcaps_mask,
3943                                      max_ampdu);
3944         }
3945 #endif /* CONFIG_HT_OVERRIDES */
3946
3947 #define OVERRIDE_MCS(i)                                                 \
3948         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3949                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3950                         host_to_le16(3 << 2 * (i - 1));                 \
3951                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3952                         host_to_le16(ssid->vht_tx_mcs_nss_ ##i <<       \
3953                                      2 * (i - 1));                      \
3954         }                                                               \
3955         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3956                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3957                         host_to_le16(3 << 2 * (i - 1));                 \
3958                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3959                         host_to_le16(ssid->vht_rx_mcs_nss_ ##i <<       \
3960                                      2 * (i - 1));                      \
3961         }
3962
3963         OVERRIDE_MCS(1);
3964         OVERRIDE_MCS(2);
3965         OVERRIDE_MCS(3);
3966         OVERRIDE_MCS(4);
3967         OVERRIDE_MCS(5);
3968         OVERRIDE_MCS(6);
3969         OVERRIDE_MCS(7);
3970         OVERRIDE_MCS(8);
3971 }
3972 #endif /* CONFIG_VHT_OVERRIDES */
3973
3974
3975 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3976 {
3977 #ifdef PCSC_FUNCS
3978         size_t len;
3979
3980         if (!wpa_s->conf->pcsc_reader)
3981                 return 0;
3982
3983         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3984         if (!wpa_s->scard)
3985                 return 1;
3986
3987         if (wpa_s->conf->pcsc_pin &&
3988             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3989                 scard_deinit(wpa_s->scard);
3990                 wpa_s->scard = NULL;
3991                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3992                 return -1;
3993         }
3994
3995         len = sizeof(wpa_s->imsi) - 1;
3996         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3997                 scard_deinit(wpa_s->scard);
3998                 wpa_s->scard = NULL;
3999                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
4000                 return -1;
4001         }
4002         wpa_s->imsi[len] = '\0';
4003
4004         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
4005
4006         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
4007                    wpa_s->imsi, wpa_s->mnc_len);
4008
4009         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
4010         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
4011 #endif /* PCSC_FUNCS */
4012
4013         return 0;
4014 }
4015
4016
4017 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
4018 {
4019         char *val, *pos;
4020
4021         ext_password_deinit(wpa_s->ext_pw);
4022         wpa_s->ext_pw = NULL;
4023         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
4024
4025         if (!wpa_s->conf->ext_password_backend)
4026                 return 0;
4027
4028         val = os_strdup(wpa_s->conf->ext_password_backend);
4029         if (val == NULL)
4030                 return -1;
4031         pos = os_strchr(val, ':');
4032         if (pos)
4033                 *pos++ = '\0';
4034
4035         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
4036
4037         wpa_s->ext_pw = ext_password_init(val, pos);
4038         os_free(val);
4039         if (wpa_s->ext_pw == NULL) {
4040                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
4041                 return -1;
4042         }
4043         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
4044
4045         return 0;
4046 }
4047
4048
4049 #ifdef CONFIG_FST
4050
4051 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
4052 {
4053         struct wpa_supplicant *wpa_s = ctx;
4054
4055         return (is_zero_ether_addr(wpa_s->bssid) ||
4056                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
4057 }
4058
4059
4060 static void wpas_fst_get_channel_info_cb(void *ctx,
4061                                          enum hostapd_hw_mode *hw_mode,
4062                                          u8 *channel)
4063 {
4064         struct wpa_supplicant *wpa_s = ctx;
4065
4066         if (wpa_s->current_bss) {
4067                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
4068                                                   channel);
4069         } else if (wpa_s->hw.num_modes) {
4070                 *hw_mode = wpa_s->hw.modes[0].mode;
4071         } else {
4072                 WPA_ASSERT(0);
4073                 *hw_mode = 0;
4074         }
4075 }
4076
4077
4078 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
4079 {
4080         struct wpa_supplicant *wpa_s = ctx;
4081
4082         *modes = wpa_s->hw.modes;
4083         return wpa_s->hw.num_modes;
4084 }
4085
4086
4087 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
4088 {
4089         struct wpa_supplicant *wpa_s = ctx;
4090
4091         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
4092         wpa_s->fst_ies = fst_ies;
4093 }
4094
4095
4096 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
4097 {
4098         struct wpa_supplicant *wpa_s = ctx;
4099
4100         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
4101         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
4102                                           wpa_s->own_addr, wpa_s->bssid,
4103                                           wpabuf_head(data), wpabuf_len(data),
4104                                    0);
4105 }
4106
4107
4108 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
4109 {
4110         struct wpa_supplicant *wpa_s = ctx;
4111
4112         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4113         return wpa_s->received_mb_ies;
4114 }
4115
4116
4117 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
4118                                      const u8 *buf, size_t size)
4119 {
4120         struct wpa_supplicant *wpa_s = ctx;
4121         struct mb_ies_info info;
4122
4123         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4124
4125         if (!mb_ies_info_by_ies(&info, buf, size)) {
4126                 wpabuf_free(wpa_s->received_mb_ies);
4127                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
4128         }
4129 }
4130
4131
4132 static const u8 * wpas_fst_get_peer_first(void *ctx,
4133                                           struct fst_get_peer_ctx **get_ctx,
4134                                           Boolean mb_only)
4135 {
4136         struct wpa_supplicant *wpa_s = ctx;
4137
4138         *get_ctx = NULL;
4139         if (!is_zero_ether_addr(wpa_s->bssid))
4140                 return (wpa_s->received_mb_ies || !mb_only) ?
4141                         wpa_s->bssid : NULL;
4142         return NULL;
4143 }
4144
4145
4146 static const u8 * wpas_fst_get_peer_next(void *ctx,
4147                                          struct fst_get_peer_ctx **get_ctx,
4148                                          Boolean mb_only)
4149 {
4150         return NULL;
4151 }
4152
4153 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4154                                        struct fst_wpa_obj *iface_obj)
4155 {
4156         iface_obj->ctx              = wpa_s;
4157         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4158         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4159         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4160         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4161         iface_obj->send_action      = wpas_fst_send_action_cb;
4162         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4163         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4164         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4165         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4166 }
4167 #endif /* CONFIG_FST */
4168
4169 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4170                                     const struct wpa_driver_capa *capa)
4171 {
4172         struct wowlan_triggers *triggers;
4173         int ret = 0;
4174
4175         if (!wpa_s->conf->wowlan_triggers)
4176                 return 0;
4177
4178         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4179         if (triggers) {
4180                 ret = wpa_drv_wowlan(wpa_s, triggers);
4181                 os_free(triggers);
4182         }
4183         return ret;
4184 }
4185
4186
4187 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4188 {
4189         if (freq < 3000)
4190                 return BAND_2_4_GHZ;
4191         if (freq > 50000)
4192                 return BAND_60_GHZ;
4193         return BAND_5_GHZ;
4194 }
4195
4196
4197 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4198 {
4199         int i;
4200         unsigned int band = 0;
4201
4202         if (freqs) {
4203                 /* freqs are specified for the radio work */
4204                 for (i = 0; freqs[i]; i++)
4205                         band |= wpas_freq_to_band(freqs[i]);
4206         } else {
4207                 /*
4208                  * freqs are not specified, implies all
4209                  * the supported freqs by HW
4210                  */
4211                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4212                         if (wpa_s->hw.modes[i].num_channels != 0) {
4213                                 if (wpa_s->hw.modes[i].mode ==
4214                                     HOSTAPD_MODE_IEEE80211B ||
4215                                     wpa_s->hw.modes[i].mode ==
4216                                     HOSTAPD_MODE_IEEE80211G)
4217                                         band |= BAND_2_4_GHZ;
4218                                 else if (wpa_s->hw.modes[i].mode ==
4219                                          HOSTAPD_MODE_IEEE80211A)
4220                                         band |= BAND_5_GHZ;
4221                                 else if (wpa_s->hw.modes[i].mode ==
4222                                          HOSTAPD_MODE_IEEE80211AD)
4223                                         band |= BAND_60_GHZ;
4224                                 else if (wpa_s->hw.modes[i].mode ==
4225                                          HOSTAPD_MODE_IEEE80211ANY)
4226                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4227                                                 BAND_60_GHZ;
4228                         }
4229                 }
4230         }
4231
4232         return band;
4233 }
4234
4235
4236 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4237                                               const char *rn)
4238 {
4239         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4240         struct wpa_radio *radio;
4241
4242         while (rn && iface) {
4243                 radio = iface->radio;
4244                 if (radio && os_strcmp(rn, radio->name) == 0) {
4245                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4246                                    wpa_s->ifname, rn);
4247                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4248                         return radio;
4249                 }
4250
4251                 iface = iface->next;
4252         }
4253
4254         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4255                    wpa_s->ifname, rn ? rn : "N/A");
4256         radio = os_zalloc(sizeof(*radio));
4257         if (radio == NULL)
4258                 return NULL;
4259
4260         if (rn)
4261                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4262         dl_list_init(&radio->ifaces);
4263         dl_list_init(&radio->work);
4264         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4265
4266         return radio;
4267 }
4268
4269
4270 static void radio_work_free(struct wpa_radio_work *work)
4271 {
4272         if (work->wpa_s->scan_work == work) {
4273                 /* This should not really happen. */
4274                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4275                         work->type, work, work->started);
4276                 work->wpa_s->scan_work = NULL;
4277         }
4278
4279 #ifdef CONFIG_P2P
4280         if (work->wpa_s->p2p_scan_work == work) {
4281                 /* This should not really happen. */
4282                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4283                         work->type, work, work->started);
4284                 work->wpa_s->p2p_scan_work = NULL;
4285         }
4286 #endif /* CONFIG_P2P */
4287
4288         if (work->started) {
4289                 work->wpa_s->radio->num_active_works--;
4290                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4291                         "radio_work_free('%s'@%p: num_active_works --> %u",
4292                         work->type, work,
4293                         work->wpa_s->radio->num_active_works);
4294         }
4295
4296         dl_list_del(&work->list);
4297         os_free(work);
4298 }
4299
4300
4301 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4302 {
4303         struct wpa_radio_work *active_work = NULL;
4304         struct wpa_radio_work *tmp;
4305
4306         /* Get the active work to know the type and band. */
4307         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4308                 if (tmp->started) {
4309                         active_work = tmp;
4310                         break;
4311                 }
4312         }
4313
4314         if (!active_work) {
4315                 /* No active work, start one */
4316                 radio->num_active_works = 0;
4317                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4318                                  list) {
4319                         if (os_strcmp(tmp->type, "scan") == 0 &&
4320                             radio->external_scan_running &&
4321                             (((struct wpa_driver_scan_params *)
4322                               tmp->ctx)->only_new_results ||
4323                              tmp->wpa_s->clear_driver_scan_cache))
4324                                 continue;
4325                         return tmp;
4326                 }
4327                 return NULL;
4328         }
4329
4330         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4331             os_strcmp(active_work->type, "connect") == 0) {
4332                 /*
4333                  * If the active work is either connect or sme-connect,
4334                  * do not parallelize them with other radio works.
4335                  */
4336                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4337                         "Do not parallelize radio work with %s",
4338                         active_work->type);
4339                 return NULL;
4340         }
4341
4342         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4343                 if (tmp->started)
4344                         continue;
4345
4346                 /*
4347                  * If connect or sme-connect are enqueued, parallelize only
4348                  * those operations ahead of them in the queue.
4349                  */
4350                 if (os_strcmp(tmp->type, "connect") == 0 ||
4351                     os_strcmp(tmp->type, "sme-connect") == 0)
4352                         break;
4353
4354                 /*
4355                  * Check that the radio works are distinct and
4356                  * on different bands.
4357                  */
4358                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4359                     (active_work->bands != tmp->bands)) {
4360                         /*
4361                          * If a scan has to be scheduled through nl80211 scan
4362                          * interface and if an external scan is already running,
4363                          * do not schedule the scan since it is likely to get
4364                          * rejected by kernel.
4365                          */
4366                         if (os_strcmp(tmp->type, "scan") == 0 &&
4367                             radio->external_scan_running &&
4368                             (((struct wpa_driver_scan_params *)
4369                               tmp->ctx)->only_new_results ||
4370                              tmp->wpa_s->clear_driver_scan_cache))
4371                                 continue;
4372
4373                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4374                                 "active_work:%s new_work:%s",
4375                                 active_work->type, tmp->type);
4376                         return tmp;
4377                 }
4378         }
4379
4380         /* Did not find a radio work to schedule in parallel. */
4381         return NULL;
4382 }
4383
4384
4385 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4386 {
4387         struct wpa_radio *radio = eloop_ctx;
4388         struct wpa_radio_work *work;
4389         struct os_reltime now, diff;
4390         struct wpa_supplicant *wpa_s;
4391
4392         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4393         if (work == NULL) {
4394                 radio->num_active_works = 0;
4395                 return;
4396         }
4397
4398         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4399                               radio_list);
4400
4401         if (!(wpa_s &&
4402               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4403                 if (work->started)
4404                         return; /* already started and still in progress */
4405
4406                 if (wpa_s && wpa_s->radio->external_scan_running) {
4407                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4408                         return;
4409                 }
4410         } else {
4411                 work = NULL;
4412                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4413                         /* get the work to schedule next */
4414                         work = radio_work_get_next_work(radio);
4415                 }
4416                 if (!work)
4417                         return;
4418         }
4419
4420         wpa_s = work->wpa_s;
4421         os_get_reltime(&now);
4422         os_reltime_sub(&now, &work->time, &diff);
4423         wpa_dbg(wpa_s, MSG_DEBUG,
4424                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4425                 work->type, work, diff.sec, diff.usec);
4426         work->started = 1;
4427         work->time = now;
4428         radio->num_active_works++;
4429
4430         work->cb(work, 0);
4431
4432         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4433             radio->num_active_works < MAX_ACTIVE_WORKS)
4434                 radio_work_check_next(wpa_s);
4435 }
4436
4437
4438 /*
4439  * This function removes both started and pending radio works running on
4440  * the provided interface's radio.
4441  * Prior to the removal of the radio work, its callback (cb) is called with
4442  * deinit set to be 1. Each work's callback is responsible for clearing its
4443  * internal data and restoring to a correct state.
4444  * @wpa_s: wpa_supplicant data
4445  * @type: type of works to be removed
4446  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4447  * this interface's works.
4448  */
4449 void radio_remove_works(struct wpa_supplicant *wpa_s,
4450                         const char *type, int remove_all)
4451 {
4452         struct wpa_radio_work *work, *tmp;
4453         struct wpa_radio *radio = wpa_s->radio;
4454
4455         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4456                               list) {
4457                 if (type && os_strcmp(type, work->type) != 0)
4458                         continue;
4459
4460                 /* skip other ifaces' works */
4461                 if (!remove_all && work->wpa_s != wpa_s)
4462                         continue;
4463
4464                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4465                         work->type, work, work->started ? " (started)" : "");
4466                 work->cb(work, 1);
4467                 radio_work_free(work);
4468         }
4469
4470         /* in case we removed the started work */
4471         radio_work_check_next(wpa_s);
4472 }
4473
4474
4475 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4476 {
4477         struct wpa_radio *radio = wpa_s->radio;
4478
4479         if (!radio)
4480                 return;
4481
4482         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4483                    wpa_s->ifname, radio->name);
4484         dl_list_del(&wpa_s->radio_list);
4485         radio_remove_works(wpa_s, NULL, 0);
4486         wpa_s->radio = NULL;
4487         if (!dl_list_empty(&radio->ifaces))
4488                 return; /* Interfaces remain for this radio */
4489
4490         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4491         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4492         os_free(radio);
4493 }
4494
4495
4496 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4497 {
4498         struct wpa_radio *radio = wpa_s->radio;
4499
4500         if (dl_list_empty(&radio->work))
4501                 return;
4502         if (wpa_s->ext_work_in_progress) {
4503                 wpa_printf(MSG_DEBUG,
4504                            "External radio work in progress - delay start of pending item");
4505                 return;
4506         }
4507         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4508         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4509 }
4510
4511
4512 /**
4513  * radio_add_work - Add a radio work item
4514  * @wpa_s: Pointer to wpa_supplicant data
4515  * @freq: Frequency of the offchannel operation in MHz or 0
4516  * @type: Unique identifier for each type of work
4517  * @next: Force as the next work to be executed
4518  * @cb: Callback function for indicating when radio is available
4519  * @ctx: Context pointer for the work (work->ctx in cb())
4520  * Returns: 0 on success, -1 on failure
4521  *
4522  * This function is used to request time for an operation that requires
4523  * exclusive radio control. Once the radio is available, the registered callback
4524  * function will be called. radio_work_done() must be called once the exclusive
4525  * radio operation has been completed, so that the radio is freed for other
4526  * operations. The special case of deinit=1 is used to free the context data
4527  * during interface removal. That does not allow the callback function to start
4528  * the radio operation, i.e., it must free any resources allocated for the radio
4529  * work and return.
4530  *
4531  * The @freq parameter can be used to indicate a single channel on which the
4532  * offchannel operation will occur. This may allow multiple radio work
4533  * operations to be performed in parallel if they apply for the same channel.
4534  * Setting this to 0 indicates that the work item may use multiple channels or
4535  * requires exclusive control of the radio.
4536  */
4537 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4538                    const char *type, int next,
4539                    void (*cb)(struct wpa_radio_work *work, int deinit),
4540                    void *ctx)
4541 {
4542         struct wpa_radio *radio = wpa_s->radio;
4543         struct wpa_radio_work *work;
4544         int was_empty;
4545
4546         work = os_zalloc(sizeof(*work));
4547         if (work == NULL)
4548                 return -1;
4549         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4550         os_get_reltime(&work->time);
4551         work->freq = freq;
4552         work->type = type;
4553         work->wpa_s = wpa_s;
4554         work->cb = cb;
4555         work->ctx = ctx;
4556
4557         if (freq)
4558                 work->bands = wpas_freq_to_band(freq);
4559         else if (os_strcmp(type, "scan") == 0 ||
4560                  os_strcmp(type, "p2p-scan") == 0)
4561                 work->bands = wpas_get_bands(wpa_s,
4562                                              ((struct wpa_driver_scan_params *)
4563                                               ctx)->freqs);
4564         else
4565                 work->bands = wpas_get_bands(wpa_s, NULL);
4566
4567         was_empty = dl_list_empty(&wpa_s->radio->work);
4568         if (next)
4569                 dl_list_add(&wpa_s->radio->work, &work->list);
4570         else
4571                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4572         if (was_empty) {
4573                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4574                 radio_work_check_next(wpa_s);
4575         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4576                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4577                 wpa_dbg(wpa_s, MSG_DEBUG,
4578                         "Try to schedule a radio work (num_active_works=%u)",
4579                         radio->num_active_works);
4580                 radio_work_check_next(wpa_s);
4581         }
4582
4583         return 0;
4584 }
4585
4586
4587 /**
4588  * radio_work_done - Indicate that a radio work item has been completed
4589  * @work: Completed work
4590  *
4591  * This function is called once the callback function registered with
4592  * radio_add_work() has completed its work.
4593  */
4594 void radio_work_done(struct wpa_radio_work *work)
4595 {
4596         struct wpa_supplicant *wpa_s = work->wpa_s;
4597         struct os_reltime now, diff;
4598         unsigned int started = work->started;
4599
4600         os_get_reltime(&now);
4601         os_reltime_sub(&now, &work->time, &diff);
4602         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4603                 work->type, work, started ? "done" : "canceled",
4604                 diff.sec, diff.usec);
4605         radio_work_free(work);
4606         if (started)
4607                 radio_work_check_next(wpa_s);
4608 }
4609
4610
4611 struct wpa_radio_work *
4612 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4613 {
4614         struct wpa_radio_work *work;
4615         struct wpa_radio *radio = wpa_s->radio;
4616
4617         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4618                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4619                         return work;
4620         }
4621
4622         return NULL;
4623 }
4624
4625
4626 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4627                             struct wpa_interface *iface)
4628 {
4629         const char *ifname, *driver, *rn;
4630
4631         driver = iface->driver;
4632 next_driver:
4633         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4634                 return -1;
4635
4636         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4637         if (wpa_s->drv_priv == NULL) {
4638                 const char *pos;
4639                 pos = driver ? os_strchr(driver, ',') : NULL;
4640                 if (pos) {
4641                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4642                                 "driver interface - try next driver wrapper");
4643                         driver = pos + 1;
4644                         goto next_driver;
4645                 }
4646                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4647                         "interface");
4648                 return -1;
4649         }
4650         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4651                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4652                         "driver_param '%s'", wpa_s->conf->driver_param);
4653                 return -1;
4654         }
4655
4656         ifname = wpa_drv_get_ifname(wpa_s);
4657         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4658                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4659                         "interface name with '%s'", ifname);
4660                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4661         }
4662
4663         rn = wpa_driver_get_radio_name(wpa_s);
4664         if (rn && rn[0] == '\0')
4665                 rn = NULL;
4666
4667         wpa_s->radio = radio_add_interface(wpa_s, rn);
4668         if (wpa_s->radio == NULL)
4669                 return -1;
4670
4671         return 0;
4672 }
4673
4674
4675 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4676                                      struct wpa_interface *iface)
4677 {
4678         struct wpa_driver_capa capa;
4679         int capa_res;
4680
4681         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4682                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4683                    iface->confname ? iface->confname : "N/A",
4684                    iface->driver ? iface->driver : "default",
4685                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4686                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4687
4688         if (iface->confname) {
4689 #ifdef CONFIG_BACKEND_FILE
4690                 wpa_s->confname = os_rel2abs_path(iface->confname);
4691                 if (wpa_s->confname == NULL) {
4692                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4693                                    "for configuration file '%s'.",
4694                                    iface->confname);
4695                         return -1;
4696                 }
4697                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4698                            iface->confname, wpa_s->confname);
4699 #else /* CONFIG_BACKEND_FILE */
4700                 wpa_s->confname = os_strdup(iface->confname);
4701 #endif /* CONFIG_BACKEND_FILE */
4702                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4703                 if (wpa_s->conf == NULL) {
4704                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4705                                    "configuration '%s'.", wpa_s->confname);
4706                         return -1;
4707                 }
4708                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4709                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4710
4711                 /*
4712                  * Override ctrl_interface and driver_param if set on command
4713                  * line.
4714                  */
4715                 if (iface->ctrl_interface) {
4716                         os_free(wpa_s->conf->ctrl_interface);
4717                         wpa_s->conf->ctrl_interface =
4718                                 os_strdup(iface->ctrl_interface);
4719                 }
4720
4721                 if (iface->driver_param) {
4722                         os_free(wpa_s->conf->driver_param);
4723                         wpa_s->conf->driver_param =
4724                                 os_strdup(iface->driver_param);
4725                 }
4726
4727                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4728                         os_free(wpa_s->conf->ctrl_interface);
4729                         wpa_s->conf->ctrl_interface = NULL;
4730                 }
4731         } else
4732                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4733                                                      iface->driver_param);
4734
4735         if (wpa_s->conf == NULL) {
4736                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4737                 return -1;
4738         }
4739
4740         if (iface->ifname == NULL) {
4741                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4742                 return -1;
4743         }
4744         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4745                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4746                            iface->ifname);
4747                 return -1;
4748         }
4749         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4750
4751         if (iface->bridge_ifname) {
4752                 if (os_strlen(iface->bridge_ifname) >=
4753                     sizeof(wpa_s->bridge_ifname)) {
4754                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4755                                    "name '%s'.", iface->bridge_ifname);
4756                         return -1;
4757                 }
4758                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4759                            sizeof(wpa_s->bridge_ifname));
4760         }
4761
4762         /* RSNA Supplicant Key Management - INITIALIZE */
4763         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4764         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4765
4766         /* Initialize driver interface and register driver event handler before
4767          * L2 receive handler so that association events are processed before
4768          * EAPOL-Key packets if both become available for the same select()
4769          * call. */
4770         if (wpas_init_driver(wpa_s, iface) < 0)
4771                 return -1;
4772
4773         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4774                 return -1;
4775
4776         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4777                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4778                           NULL);
4779         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4780
4781         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4782             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4783                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4784                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4785                         "dot11RSNAConfigPMKLifetime");
4786                 return -1;
4787         }
4788
4789         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4790             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4791                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4792                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4793                         "dot11RSNAConfigPMKReauthThreshold");
4794                 return -1;
4795         }
4796
4797         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4798             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4799                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4800                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4801                         "dot11RSNAConfigSATimeout");
4802                 return -1;
4803         }
4804
4805         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4806                                                       &wpa_s->hw.num_modes,
4807                                                       &wpa_s->hw.flags);
4808         if (wpa_s->hw.modes) {
4809                 u16 i;
4810
4811                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4812                         if (wpa_s->hw.modes[i].vht_capab) {
4813                                 wpa_s->hw_capab = CAPAB_VHT;
4814                                 break;
4815                         }
4816
4817                         if (wpa_s->hw.modes[i].ht_capab &
4818                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4819                                 wpa_s->hw_capab = CAPAB_HT40;
4820                         else if (wpa_s->hw.modes[i].ht_capab &&
4821                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4822                                 wpa_s->hw_capab = CAPAB_HT;
4823                 }
4824         }
4825
4826         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4827         if (capa_res == 0) {
4828                 wpa_s->drv_capa_known = 1;
4829                 wpa_s->drv_flags = capa.flags;
4830                 wpa_s->drv_enc = capa.enc;
4831                 wpa_s->drv_smps_modes = capa.smps_modes;
4832                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4833                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4834                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4835                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4836                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4837                 wpa_s->max_sched_scan_plan_interval =
4838                         capa.max_sched_scan_plan_interval;
4839                 wpa_s->max_sched_scan_plan_iterations =
4840                         capa.max_sched_scan_plan_iterations;
4841                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4842                 wpa_s->max_match_sets = capa.max_match_sets;
4843                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4844                 wpa_s->max_stations = capa.max_stations;
4845                 wpa_s->extended_capa = capa.extended_capa;
4846                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4847                 wpa_s->extended_capa_len = capa.extended_capa_len;
4848                 wpa_s->num_multichan_concurrent =
4849                         capa.num_multichan_concurrent;
4850                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4851
4852                 if (capa.mac_addr_rand_scan_supported)
4853                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4854                 if (wpa_s->sched_scan_supported &&
4855                     capa.mac_addr_rand_sched_scan_supported)
4856                         wpa_s->mac_addr_rand_supported |=
4857                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4858         }
4859         if (wpa_s->max_remain_on_chan == 0)
4860                 wpa_s->max_remain_on_chan = 1000;
4861
4862         /*
4863          * Only take p2p_mgmt parameters when P2P Device is supported.
4864          * Doing it here as it determines whether l2_packet_init() will be done
4865          * during wpa_supplicant_driver_init().
4866          */
4867         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4868                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4869         else
4870                 iface->p2p_mgmt = 1;
4871
4872         if (wpa_s->num_multichan_concurrent == 0)
4873                 wpa_s->num_multichan_concurrent = 1;
4874
4875         if (wpa_supplicant_driver_init(wpa_s) < 0)
4876                 return -1;
4877
4878 #ifdef CONFIG_TDLS
4879         if ((!iface->p2p_mgmt ||
4880              !(wpa_s->drv_flags &
4881                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4882             wpa_tdls_init(wpa_s->wpa))
4883                 return -1;
4884 #endif /* CONFIG_TDLS */
4885
4886         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4887             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4888                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4889                 return -1;
4890         }
4891
4892 #ifdef CONFIG_FST
4893         if (wpa_s->conf->fst_group_id) {
4894                 struct fst_iface_cfg cfg;
4895                 struct fst_wpa_obj iface_obj;
4896
4897                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4898                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4899                            sizeof(cfg.group_id));
4900                 cfg.priority = wpa_s->conf->fst_priority;
4901                 cfg.llt = wpa_s->conf->fst_llt;
4902
4903                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4904                                         &iface_obj, &cfg);
4905                 if (!wpa_s->fst) {
4906                         wpa_msg(wpa_s, MSG_ERROR,
4907                                 "FST: Cannot attach iface %s to group %s",
4908                                 wpa_s->ifname, cfg.group_id);
4909                         return -1;
4910                 }
4911         }
4912 #endif /* CONFIG_FST */
4913
4914         if (wpas_wps_init(wpa_s))
4915                 return -1;
4916
4917         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4918                 return -1;
4919         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4920
4921         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4922         if (wpa_s->ctrl_iface == NULL) {
4923                 wpa_printf(MSG_ERROR,
4924                            "Failed to initialize control interface '%s'.\n"
4925                            "You may have another wpa_supplicant process "
4926                            "already running or the file was\n"
4927                            "left by an unclean termination of wpa_supplicant "
4928                            "in which case you will need\n"
4929                            "to manually remove this file before starting "
4930                            "wpa_supplicant again.\n",
4931                            wpa_s->conf->ctrl_interface);
4932                 return -1;
4933         }
4934
4935         wpa_s->gas = gas_query_init(wpa_s);
4936         if (wpa_s->gas == NULL) {
4937                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4938                 return -1;
4939         }
4940
4941         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4942                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4943                 return -1;
4944         }
4945
4946         if (wpa_bss_init(wpa_s) < 0)
4947                 return -1;
4948
4949         /*
4950          * Set Wake-on-WLAN triggers, if configured.
4951          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4952          * have effect anyway when the interface is down).
4953          */
4954         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4955                 return -1;
4956
4957 #ifdef CONFIG_EAP_PROXY
4958 {
4959         size_t len;
4960         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4961                                                      &len);
4962         if (wpa_s->mnc_len > 0) {
4963                 wpa_s->imsi[len] = '\0';
4964                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4965                            wpa_s->imsi, wpa_s->mnc_len);
4966         } else {
4967                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4968         }
4969 }
4970 #endif /* CONFIG_EAP_PROXY */
4971
4972         if (pcsc_reader_init(wpa_s) < 0)
4973                 return -1;
4974
4975         if (wpas_init_ext_pw(wpa_s) < 0)
4976                 return -1;
4977
4978         wpas_rrm_reset(wpa_s);
4979
4980         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4981
4982 #ifdef CONFIG_HS20
4983         hs20_init(wpa_s);
4984 #endif /* CONFIG_HS20 */
4985 #ifdef CONFIG_MBO
4986         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4987 #endif /* CONFIG_MBO */
4988
4989         wpa_supplicant_set_default_scan_ies(wpa_s);
4990
4991         return 0;
4992 }
4993
4994
4995 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4996                                         int notify, int terminate)
4997 {
4998         struct wpa_global *global = wpa_s->global;
4999         struct wpa_supplicant *iface, *prev;
5000
5001         if (wpa_s == wpa_s->parent)
5002                 wpas_p2p_group_remove(wpa_s, "*");
5003
5004         iface = global->ifaces;
5005         while (iface) {
5006                 if (iface->p2pdev == wpa_s)
5007                         iface->p2pdev = iface->parent;
5008                 if (iface == wpa_s || iface->parent != wpa_s) {
5009                         iface = iface->next;
5010                         continue;
5011                 }
5012                 wpa_printf(MSG_DEBUG,
5013                            "Remove remaining child interface %s from parent %s",
5014                            iface->ifname, wpa_s->ifname);
5015                 prev = iface;
5016                 iface = iface->next;
5017                 wpa_supplicant_remove_iface(global, prev, terminate);
5018         }
5019
5020         wpa_s->disconnected = 1;
5021         if (wpa_s->drv_priv) {
5022                 wpa_supplicant_deauthenticate(wpa_s,
5023                                               WLAN_REASON_DEAUTH_LEAVING);
5024
5025                 wpa_drv_set_countermeasures(wpa_s, 0);
5026                 wpa_clear_keys(wpa_s, NULL);
5027         }
5028
5029         wpa_supplicant_cleanup(wpa_s);
5030         wpas_p2p_deinit_iface(wpa_s);
5031
5032         wpas_ctrl_radio_work_flush(wpa_s);
5033         radio_remove_interface(wpa_s);
5034
5035 #ifdef CONFIG_FST
5036         if (wpa_s->fst) {
5037                 fst_detach(wpa_s->fst);
5038                 wpa_s->fst = NULL;
5039         }
5040         if (wpa_s->received_mb_ies) {
5041                 wpabuf_free(wpa_s->received_mb_ies);
5042                 wpa_s->received_mb_ies = NULL;
5043         }
5044 #endif /* CONFIG_FST */
5045
5046         if (wpa_s->drv_priv)
5047                 wpa_drv_deinit(wpa_s);
5048
5049         if (notify)
5050                 wpas_notify_iface_removed(wpa_s);
5051
5052         if (terminate)
5053                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
5054
5055         if (wpa_s->ctrl_iface) {
5056                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
5057                 wpa_s->ctrl_iface = NULL;
5058         }
5059
5060 #ifdef CONFIG_MESH
5061         if (wpa_s->ifmsh) {
5062                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
5063                 wpa_s->ifmsh = NULL;
5064         }
5065 #endif /* CONFIG_MESH */
5066
5067         if (wpa_s->conf != NULL) {
5068                 wpa_config_free(wpa_s->conf);
5069                 wpa_s->conf = NULL;
5070         }
5071
5072         os_free(wpa_s->ssids_from_scan_req);
5073
5074         os_free(wpa_s);
5075 }
5076
5077
5078 #ifdef CONFIG_MATCH_IFACE
5079
5080 /**
5081  * wpa_supplicant_match_iface - Match an interface description to a name
5082  * @global: Pointer to global data from wpa_supplicant_init()
5083  * @ifname: Name of the interface to match
5084  * Returns: Pointer to the created interface description or %NULL on failure
5085  */
5086 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
5087                                                   const char *ifname)
5088 {
5089         int i;
5090         struct wpa_interface *iface, *miface;
5091
5092         for (i = 0; i < global->params.match_iface_count; i++) {
5093                 miface = &global->params.match_ifaces[i];
5094                 if (!miface->ifname ||
5095                     fnmatch(miface->ifname, ifname, 0) == 0) {
5096                         iface = os_zalloc(sizeof(*iface));
5097                         if (!iface)
5098                                 return NULL;
5099                         *iface = *miface;
5100                         iface->ifname = ifname;
5101                         return iface;
5102                 }
5103         }
5104
5105         return NULL;
5106 }
5107
5108
5109 /**
5110  * wpa_supplicant_match_existing - Match existing interfaces
5111  * @global: Pointer to global data from wpa_supplicant_init()
5112  * Returns: 0 on success, -1 on failure
5113  */
5114 static int wpa_supplicant_match_existing(struct wpa_global *global)
5115 {
5116         struct if_nameindex *ifi, *ifp;
5117         struct wpa_supplicant *wpa_s;
5118         struct wpa_interface *iface;
5119
5120         ifp = if_nameindex();
5121         if (!ifp) {
5122                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
5123                 return -1;
5124         }
5125
5126         for (ifi = ifp; ifi->if_name; ifi++) {
5127                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
5128                 if (wpa_s)
5129                         continue;
5130                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
5131                 if (iface) {
5132                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
5133                         os_free(iface);
5134                         if (wpa_s)
5135                                 wpa_s->matched = 1;
5136                 }
5137         }
5138
5139         if_freenameindex(ifp);
5140         return 0;
5141 }
5142
5143 #endif /* CONFIG_MATCH_IFACE */
5144
5145
5146 /**
5147  * wpa_supplicant_add_iface - Add a new network interface
5148  * @global: Pointer to global data from wpa_supplicant_init()
5149  * @iface: Interface configuration options
5150  * @parent: Parent interface or %NULL to assign new interface as parent
5151  * Returns: Pointer to the created interface or %NULL on failure
5152  *
5153  * This function is used to add new network interfaces for %wpa_supplicant.
5154  * This can be called before wpa_supplicant_run() to add interfaces before the
5155  * main event loop has been started. In addition, new interfaces can be added
5156  * dynamically while %wpa_supplicant is already running. This could happen,
5157  * e.g., when a hotplug network adapter is inserted.
5158  */
5159 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5160                                                  struct wpa_interface *iface,
5161                                                  struct wpa_supplicant *parent)
5162 {
5163         struct wpa_supplicant *wpa_s;
5164         struct wpa_interface t_iface;
5165         struct wpa_ssid *ssid;
5166
5167         if (global == NULL || iface == NULL)
5168                 return NULL;
5169
5170         wpa_s = wpa_supplicant_alloc(parent);
5171         if (wpa_s == NULL)
5172                 return NULL;
5173
5174         wpa_s->global = global;
5175
5176         t_iface = *iface;
5177         if (global->params.override_driver) {
5178                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5179                            "('%s' -> '%s')",
5180                            iface->driver, global->params.override_driver);
5181                 t_iface.driver = global->params.override_driver;
5182         }
5183         if (global->params.override_ctrl_interface) {
5184                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5185                            "ctrl_interface ('%s' -> '%s')",
5186                            iface->ctrl_interface,
5187                            global->params.override_ctrl_interface);
5188                 t_iface.ctrl_interface =
5189                         global->params.override_ctrl_interface;
5190         }
5191         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5192                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5193                            iface->ifname);
5194                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5195                 return NULL;
5196         }
5197
5198         if (iface->p2p_mgmt == 0) {
5199                 /* Notify the control interfaces about new iface */
5200                 if (wpas_notify_iface_added(wpa_s)) {
5201                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5202                         return NULL;
5203                 }
5204
5205                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5206                         wpas_notify_network_added(wpa_s, ssid);
5207         }
5208
5209         wpa_s->next = global->ifaces;
5210         global->ifaces = wpa_s;
5211
5212         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5213         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5214
5215 #ifdef CONFIG_P2P
5216         if (wpa_s->global->p2p == NULL &&
5217             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5218             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5219             wpas_p2p_add_p2pdev_interface(
5220                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5221                 wpa_printf(MSG_INFO,
5222                            "P2P: Failed to enable P2P Device interface");
5223                 /* Try to continue without. P2P will be disabled. */
5224         }
5225 #endif /* CONFIG_P2P */
5226
5227         return wpa_s;
5228 }
5229
5230
5231 /**
5232  * wpa_supplicant_remove_iface - Remove a network interface
5233  * @global: Pointer to global data from wpa_supplicant_init()
5234  * @wpa_s: Pointer to the network interface to be removed
5235  * Returns: 0 if interface was removed, -1 if interface was not found
5236  *
5237  * This function can be used to dynamically remove network interfaces from
5238  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5239  * addition, this function is used to remove all remaining interfaces when
5240  * %wpa_supplicant is terminated.
5241  */
5242 int wpa_supplicant_remove_iface(struct wpa_global *global,
5243                                 struct wpa_supplicant *wpa_s,
5244                                 int terminate)
5245 {
5246         struct wpa_supplicant *prev;
5247 #ifdef CONFIG_MESH
5248         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5249         char *ifname = NULL;
5250 #endif /* CONFIG_MESH */
5251
5252         /* Remove interface from the global list of interfaces */
5253         prev = global->ifaces;
5254         if (prev == wpa_s) {
5255                 global->ifaces = wpa_s->next;
5256         } else {
5257                 while (prev && prev->next != wpa_s)
5258                         prev = prev->next;
5259                 if (prev == NULL)
5260                         return -1;
5261                 prev->next = wpa_s->next;
5262         }
5263
5264         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5265
5266 #ifdef CONFIG_MESH
5267         if (mesh_if_created) {
5268                 ifname = os_strdup(wpa_s->ifname);
5269                 if (ifname == NULL) {
5270                         wpa_dbg(wpa_s, MSG_ERROR,
5271                                 "mesh: Failed to malloc ifname");
5272                         return -1;
5273                 }
5274         }
5275 #endif /* CONFIG_MESH */
5276
5277         if (global->p2p_group_formation == wpa_s)
5278                 global->p2p_group_formation = NULL;
5279         if (global->p2p_invite_group == wpa_s)
5280                 global->p2p_invite_group = NULL;
5281         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5282
5283 #ifdef CONFIG_MESH
5284         if (mesh_if_created) {
5285                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5286                 os_free(ifname);
5287         }
5288 #endif /* CONFIG_MESH */
5289
5290         return 0;
5291 }
5292
5293
5294 /**
5295  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5296  * @wpa_s: Pointer to the network interface
5297  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5298  */
5299 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5300 {
5301         const char *eapol_method;
5302
5303         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5304             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5305                 return "NO-EAP";
5306         }
5307
5308         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5309         if (eapol_method == NULL)
5310                 return "UNKNOWN-EAP";
5311
5312         return eapol_method;
5313 }
5314
5315
5316 /**
5317  * wpa_supplicant_get_iface - Get a new network interface
5318  * @global: Pointer to global data from wpa_supplicant_init()
5319  * @ifname: Interface name
5320  * Returns: Pointer to the interface or %NULL if not found
5321  */
5322 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5323                                                  const char *ifname)
5324 {
5325         struct wpa_supplicant *wpa_s;
5326
5327         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5328                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5329                         return wpa_s;
5330         }
5331         return NULL;
5332 }
5333
5334
5335 #ifndef CONFIG_NO_WPA_MSG
5336 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5337 {
5338         struct wpa_supplicant *wpa_s = ctx;
5339         if (wpa_s == NULL)
5340                 return NULL;
5341         return wpa_s->ifname;
5342 }
5343 #endif /* CONFIG_NO_WPA_MSG */
5344
5345
5346 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5347 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5348 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5349
5350 /* Periodic cleanup tasks */
5351 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5352 {
5353         struct wpa_global *global = eloop_ctx;
5354         struct wpa_supplicant *wpa_s;
5355
5356         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5357                                wpas_periodic, global, NULL);
5358
5359 #ifdef CONFIG_P2P
5360         if (global->p2p)
5361                 p2p_expire_peers(global->p2p);
5362 #endif /* CONFIG_P2P */
5363
5364         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5365                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5366 #ifdef CONFIG_AP
5367                 ap_periodic(wpa_s);
5368 #endif /* CONFIG_AP */
5369         }
5370 }
5371
5372
5373 /**
5374  * wpa_supplicant_init - Initialize %wpa_supplicant
5375  * @params: Parameters for %wpa_supplicant
5376  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5377  *
5378  * This function is used to initialize %wpa_supplicant. After successful
5379  * initialization, the returned data pointer can be used to add and remove
5380  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5381  */
5382 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5383 {
5384         struct wpa_global *global;
5385         int ret, i;
5386
5387         if (params == NULL)
5388                 return NULL;
5389
5390 #ifdef CONFIG_DRIVER_NDIS
5391         {
5392                 void driver_ndis_init_ops(void);
5393                 driver_ndis_init_ops();
5394         }
5395 #endif /* CONFIG_DRIVER_NDIS */
5396
5397 #ifndef CONFIG_NO_WPA_MSG
5398         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5399 #endif /* CONFIG_NO_WPA_MSG */
5400
5401         if (params->wpa_debug_file_path)
5402                 wpa_debug_open_file(params->wpa_debug_file_path);
5403         else
5404                 wpa_debug_setup_stdout();
5405         if (params->wpa_debug_syslog)
5406                 wpa_debug_open_syslog();
5407         if (params->wpa_debug_tracing) {
5408                 ret = wpa_debug_open_linux_tracing();
5409                 if (ret) {
5410                         wpa_printf(MSG_ERROR,
5411                                    "Failed to enable trace logging");
5412                         return NULL;
5413                 }
5414         }
5415
5416         ret = eap_register_methods();
5417         if (ret) {
5418                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5419                 if (ret == -2)
5420                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5421                                    "the same EAP type.");
5422                 return NULL;
5423         }
5424
5425         global = os_zalloc(sizeof(*global));
5426         if (global == NULL)
5427                 return NULL;
5428         dl_list_init(&global->p2p_srv_bonjour);
5429         dl_list_init(&global->p2p_srv_upnp);
5430         global->params.daemonize = params->daemonize;
5431         global->params.wait_for_monitor = params->wait_for_monitor;
5432         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5433         if (params->pid_file)
5434                 global->params.pid_file = os_strdup(params->pid_file);
5435         if (params->ctrl_interface)
5436                 global->params.ctrl_interface =
5437                         os_strdup(params->ctrl_interface);
5438         if (params->ctrl_interface_group)
5439                 global->params.ctrl_interface_group =
5440                         os_strdup(params->ctrl_interface_group);
5441         if (params->override_driver)
5442                 global->params.override_driver =
5443                         os_strdup(params->override_driver);
5444         if (params->override_ctrl_interface)
5445                 global->params.override_ctrl_interface =
5446                         os_strdup(params->override_ctrl_interface);
5447 #ifdef CONFIG_MATCH_IFACE
5448         global->params.match_iface_count = params->match_iface_count;
5449         if (params->match_iface_count) {
5450                 global->params.match_ifaces =
5451                         os_calloc(params->match_iface_count,
5452                                   sizeof(struct wpa_interface));
5453                 os_memcpy(global->params.match_ifaces,
5454                           params->match_ifaces,
5455                           params->match_iface_count *
5456                           sizeof(struct wpa_interface));
5457         }
5458 #endif /* CONFIG_MATCH_IFACE */
5459 #ifdef CONFIG_P2P
5460         if (params->conf_p2p_dev)
5461                 global->params.conf_p2p_dev =
5462                         os_strdup(params->conf_p2p_dev);
5463 #endif /* CONFIG_P2P */
5464         wpa_debug_level = global->params.wpa_debug_level =
5465                 params->wpa_debug_level;
5466         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5467                 params->wpa_debug_show_keys;
5468         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5469                 params->wpa_debug_timestamp;
5470
5471         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5472
5473         if (eloop_init()) {
5474                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5475                 wpa_supplicant_deinit(global);
5476                 return NULL;
5477         }
5478
5479         random_init(params->entropy_file);
5480
5481         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5482         if (global->ctrl_iface == NULL) {
5483                 wpa_supplicant_deinit(global);
5484                 return NULL;
5485         }
5486
5487         if (wpas_notify_supplicant_initialized(global)) {
5488                 wpa_supplicant_deinit(global);
5489                 return NULL;
5490         }
5491
5492         for (i = 0; wpa_drivers[i]; i++)
5493                 global->drv_count++;
5494         if (global->drv_count == 0) {
5495                 wpa_printf(MSG_ERROR, "No drivers enabled");
5496                 wpa_supplicant_deinit(global);
5497                 return NULL;
5498         }
5499         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5500         if (global->drv_priv == NULL) {
5501                 wpa_supplicant_deinit(global);
5502                 return NULL;
5503         }
5504
5505 #ifdef CONFIG_WIFI_DISPLAY
5506         if (wifi_display_init(global) < 0) {
5507                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5508                 wpa_supplicant_deinit(global);
5509                 return NULL;
5510         }
5511 #endif /* CONFIG_WIFI_DISPLAY */
5512
5513         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5514                                wpas_periodic, global, NULL);
5515
5516         return global;
5517 }
5518
5519
5520 /**
5521  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5522  * @global: Pointer to global data from wpa_supplicant_init()
5523  * Returns: 0 after successful event loop run, -1 on failure
5524  *
5525  * This function starts the main event loop and continues running as long as
5526  * there are any remaining events. In most cases, this function is running as
5527  * long as the %wpa_supplicant process in still in use.
5528  */
5529 int wpa_supplicant_run(struct wpa_global *global)
5530 {
5531         struct wpa_supplicant *wpa_s;
5532
5533         if (global->params.daemonize &&
5534             (wpa_supplicant_daemon(global->params.pid_file) ||
5535              eloop_sock_requeue()))
5536                 return -1;
5537
5538 #ifdef CONFIG_MATCH_IFACE
5539         if (wpa_supplicant_match_existing(global))
5540                 return -1;
5541 #endif
5542
5543         if (global->params.wait_for_monitor) {
5544                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5545                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5546                                 wpa_supplicant_ctrl_iface_wait(
5547                                         wpa_s->ctrl_iface);
5548         }
5549
5550         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5551         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5552
5553         eloop_run();
5554
5555         return 0;
5556 }
5557
5558
5559 /**
5560  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5561  * @global: Pointer to global data from wpa_supplicant_init()
5562  *
5563  * This function is called to deinitialize %wpa_supplicant and to free all
5564  * allocated resources. Remaining network interfaces will also be removed.
5565  */
5566 void wpa_supplicant_deinit(struct wpa_global *global)
5567 {
5568         int i;
5569
5570         if (global == NULL)
5571                 return;
5572
5573         eloop_cancel_timeout(wpas_periodic, global, NULL);
5574
5575 #ifdef CONFIG_WIFI_DISPLAY
5576         wifi_display_deinit(global);
5577 #endif /* CONFIG_WIFI_DISPLAY */
5578
5579         while (global->ifaces)
5580                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5581
5582         if (global->ctrl_iface)
5583                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5584
5585         wpas_notify_supplicant_deinitialized(global);
5586
5587         eap_peer_unregister_methods();
5588 #ifdef CONFIG_AP
5589         eap_server_unregister_methods();
5590 #endif /* CONFIG_AP */
5591
5592         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5593                 if (!global->drv_priv[i])
5594                         continue;
5595                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5596         }
5597         os_free(global->drv_priv);
5598
5599         random_deinit();
5600
5601         eloop_destroy();
5602
5603         if (global->params.pid_file) {
5604                 os_daemonize_terminate(global->params.pid_file);
5605                 os_free(global->params.pid_file);
5606         }
5607         os_free(global->params.ctrl_interface);
5608         os_free(global->params.ctrl_interface_group);
5609         os_free(global->params.override_driver);
5610         os_free(global->params.override_ctrl_interface);
5611 #ifdef CONFIG_MATCH_IFACE
5612         os_free(global->params.match_ifaces);
5613 #endif /* CONFIG_MATCH_IFACE */
5614 #ifdef CONFIG_P2P
5615         os_free(global->params.conf_p2p_dev);
5616 #endif /* CONFIG_P2P */
5617
5618         os_free(global->p2p_disallow_freq.range);
5619         os_free(global->p2p_go_avoid_freq.range);
5620         os_free(global->add_psk);
5621
5622         os_free(global);
5623         wpa_debug_close_syslog();
5624         wpa_debug_close_file();
5625         wpa_debug_close_linux_tracing();
5626 }
5627
5628
5629 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5630 {
5631         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5632             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5633                 char country[3];
5634                 country[0] = wpa_s->conf->country[0];
5635                 country[1] = wpa_s->conf->country[1];
5636                 country[2] = '\0';
5637                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5638                         wpa_printf(MSG_ERROR, "Failed to set country code "
5639                                    "'%s'", country);
5640                 }
5641         }
5642
5643         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5644                 wpas_init_ext_pw(wpa_s);
5645
5646         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5647                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5648
5649 #ifdef CONFIG_WPS
5650         wpas_wps_update_config(wpa_s);
5651 #endif /* CONFIG_WPS */
5652         wpas_p2p_update_config(wpa_s);
5653         wpa_s->conf->changed_parameters = 0;
5654 }
5655
5656
5657 void add_freq(int *freqs, int *num_freqs, int freq)
5658 {
5659         int i;
5660
5661         for (i = 0; i < *num_freqs; i++) {
5662                 if (freqs[i] == freq)
5663                         return;
5664         }
5665
5666         freqs[*num_freqs] = freq;
5667         (*num_freqs)++;
5668 }
5669
5670
5671 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5672 {
5673         struct wpa_bss *bss, *cbss;
5674         const int max_freqs = 10;
5675         int *freqs;
5676         int num_freqs = 0;
5677
5678         freqs = os_calloc(max_freqs + 1, sizeof(int));
5679         if (freqs == NULL)
5680                 return NULL;
5681
5682         cbss = wpa_s->current_bss;
5683
5684         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5685                 if (bss == cbss)
5686                         continue;
5687                 if (bss->ssid_len == cbss->ssid_len &&
5688                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5689                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5690                         add_freq(freqs, &num_freqs, bss->freq);
5691                         if (num_freqs == max_freqs)
5692                                 break;
5693                 }
5694         }
5695
5696         if (num_freqs == 0) {
5697                 os_free(freqs);
5698                 freqs = NULL;
5699         }
5700
5701         return freqs;
5702 }
5703
5704
5705 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5706 {
5707         int timeout;
5708         int count;
5709         int *freqs = NULL;
5710
5711         wpas_connect_work_done(wpa_s);
5712
5713         /*
5714          * Remove possible authentication timeout since the connection failed.
5715          */
5716         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5717
5718         /*
5719          * There is no point in blacklisting the AP if this event is
5720          * generated based on local request to disconnect.
5721          */
5722         if (wpa_s->own_disconnect_req) {
5723                 wpa_s->own_disconnect_req = 0;
5724                 wpa_dbg(wpa_s, MSG_DEBUG,
5725                         "Ignore connection failure due to local request to disconnect");
5726                 return;
5727         }
5728         if (wpa_s->disconnected) {
5729                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5730                         "indication since interface has been put into "
5731                         "disconnected state");
5732                 return;
5733         }
5734
5735         /*
5736          * Add the failed BSSID into the blacklist and speed up next scan
5737          * attempt if there could be other APs that could accept association.
5738          * The current blacklist count indicates how many times we have tried
5739          * connecting to this AP and multiple attempts mean that other APs are
5740          * either not available or has already been tried, so that we can start
5741          * increasing the delay here to avoid constant scanning.
5742          */
5743         count = wpa_blacklist_add(wpa_s, bssid);
5744         if (count == 1 && wpa_s->current_bss) {
5745                 /*
5746                  * This BSS was not in the blacklist before. If there is
5747                  * another BSS available for the same ESS, we should try that
5748                  * next. Otherwise, we may as well try this one once more
5749                  * before allowing other, likely worse, ESSes to be considered.
5750                  */
5751                 freqs = get_bss_freqs_in_ess(wpa_s);
5752                 if (freqs) {
5753                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5754                                 "has been seen; try it next");
5755                         wpa_blacklist_add(wpa_s, bssid);
5756                         /*
5757                          * On the next scan, go through only the known channels
5758                          * used in this ESS based on previous scans to speed up
5759                          * common load balancing use case.
5760                          */
5761                         os_free(wpa_s->next_scan_freqs);
5762                         wpa_s->next_scan_freqs = freqs;
5763                 }
5764         }
5765
5766         /*
5767          * Add previous failure count in case the temporary blacklist was
5768          * cleared due to no other BSSes being available.
5769          */
5770         count += wpa_s->extra_blacklist_count;
5771
5772         if (count > 3 && wpa_s->current_ssid) {
5773                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5774                            "consider temporary network disabling");
5775                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5776         }
5777
5778         switch (count) {
5779         case 1:
5780                 timeout = 100;
5781                 break;
5782         case 2:
5783                 timeout = 500;
5784                 break;
5785         case 3:
5786                 timeout = 1000;
5787                 break;
5788         case 4:
5789                 timeout = 5000;
5790                 break;
5791         default:
5792                 timeout = 10000;
5793                 break;
5794         }
5795
5796         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5797                 "ms", count, timeout);
5798
5799         /*
5800          * TODO: if more than one possible AP is available in scan results,
5801          * could try the other ones before requesting a new scan.
5802          */
5803         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5804                                 1000 * (timeout % 1000));
5805 }
5806
5807
5808 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5809 {
5810         return wpa_s->conf->ap_scan == 2 ||
5811                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5812 }
5813
5814
5815 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5816 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5817                                               struct wpa_ssid *ssid,
5818                                               const char *field,
5819                                               const char *value)
5820 {
5821 #ifdef IEEE8021X_EAPOL
5822         struct eap_peer_config *eap = &ssid->eap;
5823
5824         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5825         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5826                               (const u8 *) value, os_strlen(value));
5827
5828         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5829         case WPA_CTRL_REQ_EAP_IDENTITY:
5830                 os_free(eap->identity);
5831                 eap->identity = (u8 *) os_strdup(value);
5832                 eap->identity_len = os_strlen(value);
5833                 eap->pending_req_identity = 0;
5834                 if (ssid == wpa_s->current_ssid)
5835                         wpa_s->reassociate = 1;
5836                 break;
5837         case WPA_CTRL_REQ_EAP_PASSWORD:
5838                 bin_clear_free(eap->password, eap->password_len);
5839                 eap->password = (u8 *) os_strdup(value);
5840                 eap->password_len = os_strlen(value);
5841                 eap->pending_req_password = 0;
5842                 if (ssid == wpa_s->current_ssid)
5843                         wpa_s->reassociate = 1;
5844                 break;
5845         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5846                 bin_clear_free(eap->new_password, eap->new_password_len);
5847                 eap->new_password = (u8 *) os_strdup(value);
5848                 eap->new_password_len = os_strlen(value);
5849                 eap->pending_req_new_password = 0;
5850                 if (ssid == wpa_s->current_ssid)
5851                         wpa_s->reassociate = 1;
5852                 break;
5853         case WPA_CTRL_REQ_EAP_PIN:
5854                 str_clear_free(eap->pin);
5855                 eap->pin = os_strdup(value);
5856                 eap->pending_req_pin = 0;
5857                 if (ssid == wpa_s->current_ssid)
5858                         wpa_s->reassociate = 1;
5859                 break;
5860         case WPA_CTRL_REQ_EAP_OTP:
5861                 bin_clear_free(eap->otp, eap->otp_len);
5862                 eap->otp = (u8 *) os_strdup(value);
5863                 eap->otp_len = os_strlen(value);
5864                 os_free(eap->pending_req_otp);
5865                 eap->pending_req_otp = NULL;
5866                 eap->pending_req_otp_len = 0;
5867                 break;
5868         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5869                 str_clear_free(eap->private_key_passwd);
5870                 eap->private_key_passwd = os_strdup(value);
5871                 eap->pending_req_passphrase = 0;
5872                 if (ssid == wpa_s->current_ssid)
5873                         wpa_s->reassociate = 1;
5874                 break;
5875         case WPA_CTRL_REQ_SIM:
5876                 str_clear_free(eap->external_sim_resp);
5877                 eap->external_sim_resp = os_strdup(value);
5878                 break;
5879         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5880                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5881                         return -1;
5882                 ssid->mem_only_psk = 1;
5883                 if (ssid->passphrase)
5884                         wpa_config_update_psk(ssid);
5885                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5886                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5887                 break;
5888         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5889                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5890                         return -1;
5891                 if (os_strcmp(value, "good") == 0)
5892                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5893                 else if (os_strcmp(value, "bad") == 0)
5894                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5895                 else
5896                         return -1;
5897                 break;
5898         default:
5899                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5900                 return -1;
5901         }
5902
5903         return 0;
5904 #else /* IEEE8021X_EAPOL */
5905         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5906         return -1;
5907 #endif /* IEEE8021X_EAPOL */
5908 }
5909 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5910
5911
5912 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5913 {
5914         int i;
5915         unsigned int drv_enc;
5916
5917         if (wpa_s->p2p_mgmt)
5918                 return 1; /* no normal network profiles on p2p_mgmt interface */
5919
5920         if (ssid == NULL)
5921                 return 1;
5922
5923         if (ssid->disabled)
5924                 return 1;
5925
5926         if (wpa_s->drv_capa_known)
5927                 drv_enc = wpa_s->drv_enc;
5928         else
5929                 drv_enc = (unsigned int) -1;
5930
5931         for (i = 0; i < NUM_WEP_KEYS; i++) {
5932                 size_t len = ssid->wep_key_len[i];
5933                 if (len == 0)
5934                         continue;
5935                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5936                         continue;
5937                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5938                         continue;
5939                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5940                         continue;
5941                 return 1; /* invalid WEP key */
5942         }
5943
5944         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5945             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5946             !ssid->mem_only_psk)
5947                 return 1;
5948
5949         return 0;
5950 }
5951
5952
5953 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5954 {
5955 #ifdef CONFIG_IEEE80211W
5956         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5957                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5958                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5959                         /*
5960                          * Driver does not support BIP -- ignore pmf=1 default
5961                          * since the connection with PMF would fail and the
5962                          * configuration does not require PMF to be enabled.
5963                          */
5964                         return NO_MGMT_FRAME_PROTECTION;
5965                 }
5966
5967                 if (ssid &&
5968                     (ssid->key_mgmt &
5969                      ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
5970                        WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
5971                         /*
5972                          * Do not use the default PMF value for non-RSN networks
5973                          * since PMF is available only with RSN and pmf=2
5974                          * configuration would otherwise prevent connections to
5975                          * all open networks.
5976                          */
5977                         return NO_MGMT_FRAME_PROTECTION;
5978                 }
5979
5980                 return wpa_s->conf->pmf;
5981         }
5982
5983         return ssid->ieee80211w;
5984 #else /* CONFIG_IEEE80211W */
5985         return NO_MGMT_FRAME_PROTECTION;
5986 #endif /* CONFIG_IEEE80211W */
5987 }
5988
5989
5990 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5991 {
5992         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5993                 return 1;
5994         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5995                 return 0;
5996         return -1;
5997 }
5998
5999
6000 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
6001 {
6002         struct wpa_ssid *ssid = wpa_s->current_ssid;
6003         int dur;
6004         struct os_reltime now;
6005
6006         if (ssid == NULL) {
6007                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
6008                            "SSID block");
6009                 return;
6010         }
6011
6012         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
6013                 return;
6014
6015         ssid->auth_failures++;
6016
6017 #ifdef CONFIG_P2P
6018         if (ssid->p2p_group &&
6019             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
6020                 /*
6021                  * Skip the wait time since there is a short timeout on the
6022                  * connection to a P2P group.
6023                  */
6024                 return;
6025         }
6026 #endif /* CONFIG_P2P */
6027
6028         if (ssid->auth_failures > 50)
6029                 dur = 300;
6030         else if (ssid->auth_failures > 10)
6031                 dur = 120;
6032         else if (ssid->auth_failures > 5)
6033                 dur = 90;
6034         else if (ssid->auth_failures > 3)
6035                 dur = 60;
6036         else if (ssid->auth_failures > 2)
6037                 dur = 30;
6038         else if (ssid->auth_failures > 1)
6039                 dur = 20;
6040         else
6041                 dur = 10;
6042
6043         if (ssid->auth_failures > 1 &&
6044             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
6045                 dur += os_random() % (ssid->auth_failures * 10);
6046
6047         os_get_reltime(&now);
6048         if (now.sec + dur <= ssid->disabled_until.sec)
6049                 return;
6050
6051         ssid->disabled_until.sec = now.sec + dur;
6052
6053         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
6054                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
6055                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
6056                 ssid->auth_failures, dur, reason);
6057 }
6058
6059
6060 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
6061                               struct wpa_ssid *ssid, int clear_failures)
6062 {
6063         if (ssid == NULL)
6064                 return;
6065
6066         if (ssid->disabled_until.sec) {
6067                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
6068                         "id=%d ssid=\"%s\"",
6069                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
6070         }
6071         ssid->disabled_until.sec = 0;
6072         ssid->disabled_until.usec = 0;
6073         if (clear_failures)
6074                 ssid->auth_failures = 0;
6075 }
6076
6077
6078 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
6079 {
6080         size_t i;
6081
6082         if (wpa_s->disallow_aps_bssid == NULL)
6083                 return 0;
6084
6085         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
6086                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
6087                               bssid, ETH_ALEN) == 0)
6088                         return 1;
6089         }
6090
6091         return 0;
6092 }
6093
6094
6095 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
6096                     size_t ssid_len)
6097 {
6098         size_t i;
6099
6100         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
6101                 return 0;
6102
6103         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
6104                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
6105                 if (ssid_len == s->ssid_len &&
6106                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
6107                         return 1;
6108         }
6109
6110         return 0;
6111 }
6112
6113
6114 /**
6115  * wpas_request_connection - Request a new connection
6116  * @wpa_s: Pointer to the network interface
6117  *
6118  * This function is used to request a new connection to be found. It will mark
6119  * the interface to allow reassociation and request a new scan to find a
6120  * suitable network to connect to.
6121  */
6122 void wpas_request_connection(struct wpa_supplicant *wpa_s)
6123 {
6124         wpa_s->normal_scans = 0;
6125         wpa_s->scan_req = NORMAL_SCAN_REQ;
6126         wpa_supplicant_reinit_autoscan(wpa_s);
6127         wpa_s->extra_blacklist_count = 0;
6128         wpa_s->disconnected = 0;
6129         wpa_s->reassociate = 1;
6130
6131         if (wpa_supplicant_fast_associate(wpa_s) != 1)
6132                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6133         else
6134                 wpa_s->reattach = 0;
6135 }
6136
6137
6138 /**
6139  * wpas_request_disconnection - Request disconnection
6140  * @wpa_s: Pointer to the network interface
6141  *
6142  * This function is used to request disconnection from the currently connected
6143  * network. This will stop any ongoing scans and initiate deauthentication.
6144  */
6145 void wpas_request_disconnection(struct wpa_supplicant *wpa_s)
6146 {
6147 #ifdef CONFIG_SME
6148         wpa_s->sme.prev_bssid_set = 0;
6149 #endif /* CONFIG_SME */
6150         wpa_s->reassociate = 0;
6151         wpa_s->disconnected = 1;
6152         wpa_supplicant_cancel_sched_scan(wpa_s);
6153         wpa_supplicant_cancel_scan(wpa_s);
6154         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
6155         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
6156 }
6157
6158
6159 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
6160                     struct wpa_used_freq_data *freqs_data,
6161                     unsigned int len)
6162 {
6163         unsigned int i;
6164
6165         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
6166                 len, title);
6167         for (i = 0; i < len; i++) {
6168                 struct wpa_used_freq_data *cur = &freqs_data[i];
6169                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
6170                         i, cur->freq, cur->flags);
6171         }
6172 }
6173
6174
6175 /*
6176  * Find the operating frequencies of any of the virtual interfaces that
6177  * are using the same radio as the current interface, and in addition, get
6178  * information about the interface types that are using the frequency.
6179  */
6180 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6181                                 struct wpa_used_freq_data *freqs_data,
6182                                 unsigned int len)
6183 {
6184         struct wpa_supplicant *ifs;
6185         u8 bssid[ETH_ALEN];
6186         int freq;
6187         unsigned int idx = 0, i;
6188
6189         wpa_dbg(wpa_s, MSG_DEBUG,
6190                 "Determining shared radio frequencies (max len %u)", len);
6191         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6192
6193         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6194                          radio_list) {
6195                 if (idx == len)
6196                         break;
6197
6198                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6199                         continue;
6200
6201                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6202                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6203                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6204                         freq = ifs->current_ssid->frequency;
6205                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6206                         freq = ifs->assoc_freq;
6207                 else
6208                         continue;
6209
6210                 /* Hold only distinct freqs */
6211                 for (i = 0; i < idx; i++)
6212                         if (freqs_data[i].freq == freq)
6213                                 break;
6214
6215                 if (i == idx)
6216                         freqs_data[idx++].freq = freq;
6217
6218                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6219                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6220                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6221                                 WPA_FREQ_USED_BY_INFRA_STATION;
6222                 }
6223         }
6224
6225         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6226         return idx;
6227 }
6228
6229
6230 /*
6231  * Find the operating frequencies of any of the virtual interfaces that
6232  * are using the same radio as the current interface.
6233  */
6234 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6235                            int *freq_array, unsigned int len)
6236 {
6237         struct wpa_used_freq_data *freqs_data;
6238         int num, i;
6239
6240         os_memset(freq_array, 0, sizeof(int) * len);
6241
6242         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6243         if (!freqs_data)
6244                 return -1;
6245
6246         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6247         for (i = 0; i < num; i++)
6248                 freq_array[i] = freqs_data[i].freq;
6249
6250         os_free(freqs_data);
6251
6252         return num;
6253 }
6254
6255
6256 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6257 {
6258         struct rrm_data *rrm = data;
6259
6260         if (!rrm->notify_neighbor_rep) {
6261                 wpa_printf(MSG_ERROR,
6262                            "RRM: Unexpected neighbor report timeout");
6263                 return;
6264         }
6265
6266         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6267         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6268
6269         rrm->notify_neighbor_rep = NULL;
6270         rrm->neighbor_rep_cb_ctx = NULL;
6271 }
6272
6273
6274 /*
6275  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6276  * @wpa_s: Pointer to wpa_supplicant
6277  */
6278 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6279 {
6280         wpa_s->rrm.rrm_used = 0;
6281
6282         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6283                              NULL);
6284         if (wpa_s->rrm.notify_neighbor_rep)
6285                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6286         wpa_s->rrm.next_neighbor_rep_token = 1;
6287 }
6288
6289
6290 /*
6291  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6292  * @wpa_s: Pointer to wpa_supplicant
6293  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6294  * @report_len: Length of neighbor report buffer
6295  */
6296 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6297                                    const u8 *report, size_t report_len)
6298 {
6299         struct wpabuf *neighbor_rep;
6300
6301         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6302         if (report_len < 1)
6303                 return;
6304
6305         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6306                 wpa_printf(MSG_DEBUG,
6307                            "RRM: Discarding neighbor report with token %d (expected %d)",
6308                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6309                 return;
6310         }
6311
6312         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6313                              NULL);
6314
6315         if (!wpa_s->rrm.notify_neighbor_rep) {
6316                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6317                 return;
6318         }
6319
6320         /* skipping the first byte, which is only an id (dialog token) */
6321         neighbor_rep = wpabuf_alloc(report_len - 1);
6322         if (neighbor_rep == NULL)
6323                 return;
6324         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6325         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6326                    report[0]);
6327         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6328                                        neighbor_rep);
6329         wpa_s->rrm.notify_neighbor_rep = NULL;
6330         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6331 }
6332
6333
6334 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6335 /* Workaround different, undefined for Windows, error codes used here */
6336 #define ENOTCONN -1
6337 #define EOPNOTSUPP -1
6338 #define ECANCELED -1
6339 #endif
6340
6341 /* Measurement Request element + Location Subject + Maximum Age subelement */
6342 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
6343 /* Measurement Request element + Location Civic Request */
6344 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
6345
6346
6347 /**
6348  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6349  * @wpa_s: Pointer to wpa_supplicant
6350  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6351  *        is sent in the request.
6352  * @lci: if set, neighbor request will include LCI request
6353  * @civic: if set, neighbor request will include civic location request
6354  * @cb: Callback function to be called once the requested report arrives, or
6355  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6356  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6357  *      the requester's responsibility to free it.
6358  *      In the latter case NULL will be sent in 'neighbor_rep'.
6359  * @cb_ctx: Context value to send the callback function
6360  * Returns: 0 in case of success, negative error code otherwise
6361  *
6362  * In case there is a previous request which has not been answered yet, the
6363  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6364  * Request must contain a callback function.
6365  */
6366 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6367                                        const struct wpa_ssid_value *ssid,
6368                                        int lci, int civic,
6369                                        void (*cb)(void *ctx,
6370                                                   struct wpabuf *neighbor_rep),
6371                                        void *cb_ctx)
6372 {
6373         struct wpabuf *buf;
6374         const u8 *rrm_ie;
6375
6376         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6377                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6378                 return -ENOTCONN;
6379         }
6380
6381         if (!wpa_s->rrm.rrm_used) {
6382                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6383                 return -EOPNOTSUPP;
6384         }
6385
6386         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6387                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6388         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6389             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6390                 wpa_printf(MSG_DEBUG,
6391                            "RRM: No network support for Neighbor Report.");
6392                 return -EOPNOTSUPP;
6393         }
6394
6395         if (!cb) {
6396                 wpa_printf(MSG_DEBUG,
6397                            "RRM: Neighbor Report request must provide a callback.");
6398                 return -EINVAL;
6399         }
6400
6401         /* Refuse if there's a live request */
6402         if (wpa_s->rrm.notify_neighbor_rep) {
6403                 wpa_printf(MSG_DEBUG,
6404                            "RRM: Currently handling previous Neighbor Report.");
6405                 return -EBUSY;
6406         }
6407
6408         /* 3 = action category + action code + dialog token */
6409         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
6410                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
6411                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
6412         if (buf == NULL) {
6413                 wpa_printf(MSG_DEBUG,
6414                            "RRM: Failed to allocate Neighbor Report Request");
6415                 return -ENOMEM;
6416         }
6417
6418         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6419                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6420                    wpa_s->rrm.next_neighbor_rep_token);
6421
6422         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6423         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6424         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6425         if (ssid) {
6426                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6427                 wpabuf_put_u8(buf, ssid->ssid_len);
6428                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6429         }
6430
6431         if (lci) {
6432                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6433                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6434                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
6435
6436                 /*
6437                  * Measurement token; nonzero number that is unique among the
6438                  * Measurement Request elements in a particular frame.
6439                  */
6440                 wpabuf_put_u8(buf, 1); /* Measurement Token */
6441
6442                 /*
6443                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6444                  * reserved.
6445                  */
6446                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6447                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
6448
6449                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
6450                 /* Location Subject */
6451                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6452
6453                 /* Optional Subelements */
6454                 /*
6455                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
6456                  * The Maximum Age subelement is required, otherwise the AP can
6457                  * send only data that was determined after receiving the
6458                  * request. Setting it here to unlimited age.
6459                  */
6460                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
6461                 wpabuf_put_u8(buf, 2);
6462                 wpabuf_put_le16(buf, 0xffff);
6463         }
6464
6465         if (civic) {
6466                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6467                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6468                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
6469
6470                 /*
6471                  * Measurement token; nonzero number that is unique among the
6472                  * Measurement Request elements in a particular frame.
6473                  */
6474                 wpabuf_put_u8(buf, 2); /* Measurement Token */
6475
6476                 /*
6477                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6478                  * reserved.
6479                  */
6480                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6481                 /* Measurement Type */
6482                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
6483
6484                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
6485                  * Location Civic request */
6486                 /* Location Subject */
6487                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6488                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
6489                 /* Location Service Interval Units: Seconds */
6490                 wpabuf_put_u8(buf, 0);
6491                 /* Location Service Interval: 0 - Only one report is requested
6492                  */
6493                 wpabuf_put_le16(buf, 0);
6494                 /* No optional subelements */
6495         }
6496
6497         wpa_s->rrm.next_neighbor_rep_token++;
6498
6499         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6500                                 wpa_s->own_addr, wpa_s->bssid,
6501                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6502                 wpa_printf(MSG_DEBUG,
6503                            "RRM: Failed to send Neighbor Report Request");
6504                 wpabuf_free(buf);
6505                 return -ECANCELED;
6506         }
6507
6508         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6509         wpa_s->rrm.notify_neighbor_rep = cb;
6510         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6511                                wpas_rrm_neighbor_rep_timeout_handler,
6512                                &wpa_s->rrm, NULL);
6513
6514         wpabuf_free(buf);
6515         return 0;
6516 }
6517
6518
6519 static struct wpabuf * wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
6520                                                  const u8 *request, size_t len,
6521                                                  struct wpabuf *report)
6522 {
6523         u8 token, type, subject;
6524         u16 max_age = 0;
6525         struct os_reltime t, diff;
6526         unsigned long diff_l;
6527         u8 *ptoken;
6528         const u8 *subelem;
6529
6530         if (!wpa_s->lci || len < 3 + 4)
6531                 return report;
6532
6533         token = *request++;
6534         /* Measurement request mode isn't used */
6535         request++;
6536         type = *request++;
6537         subject = *request++;
6538
6539         wpa_printf(MSG_DEBUG,
6540                    "Measurement request token %u type %u location subject %u",
6541                    token, type, subject);
6542
6543         if (type != MEASURE_TYPE_LCI || subject != LOCATION_SUBJECT_REMOTE) {
6544                 wpa_printf(MSG_INFO,
6545                            "Not building LCI report - bad type or location subject");
6546                 return report;
6547         }
6548
6549         /* Subelements are formatted exactly like elements */
6550         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
6551         if (subelem && subelem[1] == 2)
6552                 max_age = WPA_GET_LE16(subelem + 2);
6553
6554         if (os_get_reltime(&t))
6555                 return report;
6556
6557         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
6558         /* LCI age is calculated in 10th of a second units. */
6559         diff_l = diff.sec * 10 + diff.usec / 100000;
6560
6561         if (max_age != 0xffff && max_age < diff_l)
6562                 return report;
6563
6564         if (wpabuf_resize(&report, 2 + wpabuf_len(wpa_s->lci)))
6565                 return report;
6566
6567         wpabuf_put_u8(report, WLAN_EID_MEASURE_REPORT);
6568         wpabuf_put_u8(report, wpabuf_len(wpa_s->lci));
6569         /* We'll override user's measurement token */
6570         ptoken = wpabuf_put(report, 0);
6571         wpabuf_put_buf(report, wpa_s->lci);
6572         *ptoken = token;
6573
6574         return report;
6575 }
6576
6577
6578 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
6579                                                const u8 *src,
6580                                                const u8 *frame, size_t len)
6581 {
6582         struct wpabuf *buf, *report;
6583         u8 token;
6584         const u8 *ie, *end;
6585
6586         if (wpa_s->wpa_state != WPA_COMPLETED) {
6587                 wpa_printf(MSG_INFO,
6588                            "RRM: Ignoring radio measurement request: Not associated");
6589                 return;
6590         }
6591
6592         if (!wpa_s->rrm.rrm_used) {
6593                 wpa_printf(MSG_INFO,
6594                            "RRM: Ignoring radio measurement request: Not RRM network");
6595                 return;
6596         }
6597
6598         if (len < 3) {
6599                 wpa_printf(MSG_INFO,
6600                            "RRM: Ignoring too short radio measurement request");
6601                 return;
6602         }
6603
6604         end = frame + len;
6605
6606         token = *frame++;
6607
6608         /* Ignore number of repetitions because it's not used in LCI request */
6609         frame += 2;
6610
6611         report = NULL;
6612         while ((ie = get_ie(frame, end - frame, WLAN_EID_MEASURE_REQUEST)) &&
6613                ie[1] >= 3) {
6614                 u8 msmt_type;
6615
6616                 msmt_type = ie[4];
6617                 wpa_printf(MSG_DEBUG, "RRM request %d", msmt_type);
6618
6619                 switch (msmt_type) {
6620                 case MEASURE_TYPE_LCI:
6621                         report = wpas_rrm_build_lci_report(wpa_s, ie + 2, ie[1],
6622                                                            report);
6623                         break;
6624                 default:
6625                         wpa_printf(MSG_INFO,
6626                                    "RRM: Unsupported radio measurement request %d",
6627                                    msmt_type);
6628                         break;
6629                 }
6630
6631                 frame = ie + ie[1] + 2;
6632         }
6633
6634         if (!report)
6635                 return;
6636
6637         buf = wpabuf_alloc(3 + wpabuf_len(report));
6638         if (!buf) {
6639                 wpabuf_free(report);
6640                 return;
6641         }
6642
6643         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6644         wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
6645         wpabuf_put_u8(buf, token);
6646
6647         wpabuf_put_buf(buf, report);
6648         wpabuf_free(report);
6649
6650         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6651                                 wpa_s->own_addr, wpa_s->bssid,
6652                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6653                 wpa_printf(MSG_ERROR,
6654                            "RRM: Radio measurement report failed: Sending Action frame failed");
6655         }
6656         wpabuf_free(buf);
6657 }
6658
6659
6660 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6661                                               const u8 *src,
6662                                               const u8 *frame, size_t len,
6663                                               int rssi)
6664 {
6665         struct wpabuf *buf;
6666         const struct rrm_link_measurement_request *req;
6667         struct rrm_link_measurement_report report;
6668
6669         if (wpa_s->wpa_state != WPA_COMPLETED) {
6670                 wpa_printf(MSG_INFO,
6671                            "RRM: Ignoring link measurement request. Not associated");
6672                 return;
6673         }
6674
6675         if (!wpa_s->rrm.rrm_used) {
6676                 wpa_printf(MSG_INFO,
6677                            "RRM: Ignoring link measurement request. Not RRM network");
6678                 return;
6679         }
6680
6681         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6682                 wpa_printf(MSG_INFO,
6683                            "RRM: Measurement report failed. TX power insertion not supported");
6684                 return;
6685         }
6686
6687         req = (const struct rrm_link_measurement_request *) frame;
6688         if (len < sizeof(*req)) {
6689                 wpa_printf(MSG_INFO,
6690                            "RRM: Link measurement report failed. Request too short");
6691                 return;
6692         }
6693
6694         os_memset(&report, 0, sizeof(report));
6695         report.tpc.eid = WLAN_EID_TPC_REPORT;
6696         report.tpc.len = 2;
6697         report.rsni = 255; /* 255 indicates that RSNI is not available */
6698         report.dialog_token = req->dialog_token;
6699
6700         /*
6701          * It's possible to estimate RCPI based on RSSI in dBm. This
6702          * calculation will not reflect the correct value for high rates,
6703          * but it's good enough for Action frames which are transmitted
6704          * with up to 24 Mbps rates.
6705          */
6706         if (!rssi)
6707                 report.rcpi = 255; /* not available */
6708         else if (rssi < -110)
6709                 report.rcpi = 0;
6710         else if (rssi > 0)
6711                 report.rcpi = 220;
6712         else
6713                 report.rcpi = (rssi + 110) * 2;
6714
6715         /* action_category + action_code */
6716         buf = wpabuf_alloc(2 + sizeof(report));
6717         if (buf == NULL) {
6718                 wpa_printf(MSG_ERROR,
6719                            "RRM: Link measurement report failed. Buffer allocation failed");
6720                 return;
6721         }
6722
6723         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6724         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6725         wpabuf_put_data(buf, &report, sizeof(report));
6726         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6727                     wpabuf_head(buf), wpabuf_len(buf));
6728
6729         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6730                                 wpa_s->own_addr, wpa_s->bssid,
6731                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6732                 wpa_printf(MSG_ERROR,
6733                            "RRM: Link measurement report failed. Send action failed");
6734         }
6735         wpabuf_free(buf);
6736 }
6737
6738
6739 struct wpa_supplicant *
6740 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6741 {
6742         switch (frame) {
6743 #ifdef CONFIG_P2P
6744         case VENDOR_ELEM_PROBE_REQ_P2P:
6745         case VENDOR_ELEM_PROBE_RESP_P2P:
6746         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6747         case VENDOR_ELEM_BEACON_P2P_GO:
6748         case VENDOR_ELEM_P2P_PD_REQ:
6749         case VENDOR_ELEM_P2P_PD_RESP:
6750         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6751         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6752         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6753         case VENDOR_ELEM_P2P_INV_REQ:
6754         case VENDOR_ELEM_P2P_INV_RESP:
6755         case VENDOR_ELEM_P2P_ASSOC_REQ:
6756         case VENDOR_ELEM_P2P_ASSOC_RESP:
6757                 return wpa_s->p2pdev;
6758 #endif /* CONFIG_P2P */
6759         default:
6760                 return wpa_s;
6761         }
6762 }
6763
6764
6765 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6766 {
6767         unsigned int i;
6768         char buf[30];
6769
6770         wpa_printf(MSG_DEBUG, "Update vendor elements");
6771
6772         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6773                 if (wpa_s->vendor_elem[i]) {
6774                         int res;
6775
6776                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6777                         if (!os_snprintf_error(sizeof(buf), res)) {
6778                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6779                                                 wpa_s->vendor_elem[i]);
6780                         }
6781                 }
6782         }
6783
6784 #ifdef CONFIG_P2P
6785         if (wpa_s->parent == wpa_s &&
6786             wpa_s->global->p2p &&
6787             !wpa_s->global->p2p_disabled)
6788                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6789 #endif /* CONFIG_P2P */
6790 }
6791
6792
6793 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6794                             const u8 *elem, size_t len)
6795 {
6796         u8 *ie, *end;
6797
6798         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6799         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6800
6801         for (; ie + 1 < end; ie += 2 + ie[1]) {
6802                 if (ie + len > end)
6803                         break;
6804                 if (os_memcmp(ie, elem, len) != 0)
6805                         continue;
6806
6807                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6808                         wpabuf_free(wpa_s->vendor_elem[frame]);
6809                         wpa_s->vendor_elem[frame] = NULL;
6810                 } else {
6811                         os_memmove(ie, ie + len, end - (ie + len));
6812                         wpa_s->vendor_elem[frame]->used -= len;
6813                 }
6814                 wpas_vendor_elem_update(wpa_s);
6815                 return 0;
6816         }
6817
6818         return -1;
6819 }
6820
6821
6822 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6823                                    u16 num_modes, enum hostapd_hw_mode mode)
6824 {
6825         u16 i;
6826
6827         for (i = 0; i < num_modes; i++) {
6828                 if (modes[i].mode == mode)
6829                         return &modes[i];
6830         }
6831
6832         return NULL;
6833 }
6834
6835
6836 static struct
6837 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6838                                                  const u8 *bssid)
6839 {
6840         struct wpa_bss_tmp_disallowed *bss;
6841
6842         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6843                          struct wpa_bss_tmp_disallowed, list) {
6844                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6845                         return bss;
6846         }
6847
6848         return NULL;
6849 }
6850
6851
6852 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6853                           unsigned int sec)
6854 {
6855         struct wpa_bss_tmp_disallowed *bss;
6856         struct os_reltime until;
6857
6858         os_get_reltime(&until);
6859         until.sec += sec;
6860
6861         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6862         if (bss) {
6863                 bss->disallowed_until = until;
6864                 return;
6865         }
6866
6867         bss = os_malloc(sizeof(*bss));
6868         if (!bss) {
6869                 wpa_printf(MSG_DEBUG,
6870                            "Failed to allocate memory for temp disallow BSS");
6871                 return;
6872         }
6873
6874         bss->disallowed_until = until;
6875         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6876         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6877 }
6878
6879
6880 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6881 {
6882         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6883         struct os_reltime now, age;
6884
6885         os_get_reltime(&now);
6886
6887         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6888                          struct wpa_bss_tmp_disallowed, list) {
6889                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6890                         /* This BSS is not disallowed anymore */
6891                         dl_list_del(&tmp->list);
6892                         os_free(tmp);
6893                         continue;
6894                 }
6895                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6896                         bss = tmp;
6897                         break;
6898                 }
6899         }
6900         if (!bss)
6901                 return 0;
6902
6903         os_reltime_sub(&bss->disallowed_until, &now, &age);
6904         wpa_printf(MSG_DEBUG,
6905                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6906                    MAC2STR(bss->bssid), age.sec, age.usec);
6907         return 1;
6908 }