wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "p2p/p2p.h"
  37 #include "blacklist.h"
  38 #include "wpas_glue.h"
  39 #include "wps_supplicant.h"
  40 #include "ibss_rsn.h"
  41 #include "sme.h"
  42 #include "gas_query.h"
  43 #include "ap.h"
  44 #include "p2p_supplicant.h"
  45 #include "wifi_display.h"
  46 #include "notify.h"
  47 #include "bgscan.h"
  48 #include "autoscan.h"
  49 #include "bss.h"
  50 #include "scan.h"
  51 #include "offchannel.h"
  52 #include "hs20_supplicant.h"
  53 #include "wnm_sta.h"
  54 #include "wpas_kay.h"
  55
  56 const char *wpa_supplicant_version =
  57 "wpa_supplicant v" VERSION_STR "\n"
  58 "Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi> and contributors";
  59
  60 const char *wpa_supplicant_license =
  61 "This software may be distributed under the terms of the BSD license.\n"
  62 "See README for more details.\n"
  63 #ifdef EAP_TLS_OPENSSL
  64 "\nThis product includes software developed by the OpenSSL Project\n"
  65 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  66 #endif /* EAP_TLS_OPENSSL */
  67 ;
  68
  69 #ifndef CONFIG_NO_STDOUT_DEBUG
  70 /* Long text divided into parts in order to fit in C89 strings size limits. */
  71 const char *wpa_supplicant_full_license1 =
  72 "";
  73 const char *wpa_supplicant_full_license2 =
  74 "This software may be distributed under the terms of the BSD license.\n"
  75 "\n"
  76 "Redistribution and use in source and binary forms, with or without\n"
  77 "modification, are permitted provided that the following conditions are\n"
  78 "met:\n"
  79 "\n";
  80 const char *wpa_supplicant_full_license3 =
  81 "1. Redistributions of source code must retain the above copyright\n"
  82 "   notice, this list of conditions and the following disclaimer.\n"
  83 "\n"
  84 "2. Redistributions in binary form must reproduce the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer in the\n"
  86 "   documentation and/or other materials provided with the distribution.\n"
  87 "\n";
  88 const char *wpa_supplicant_full_license4 =
  89 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  90 "   names of its contributors may be used to endorse or promote products\n"
  91 "   derived from this software without specific prior written permission.\n"
  92 "\n"
  93 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  94 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  95 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  96 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  97 const char *wpa_supplicant_full_license5 =
  98 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
  99 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 100 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 101 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 102 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 103 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 104 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 105 "\n";
 106 #endif /* CONFIG_NO_STDOUT_DEBUG */
 107
 108 /* Configure default/group WEP keys for static WEP */
 109 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 110 {
 111         int i, set = 0;
 112
 113         for (i = 0; i < NUM_WEP_KEYS; i++) {
 114                 if (ssid->wep_key_len[i] == 0)
 115                         continue;
 116
 117                 set = 1;
 118                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 119                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 120                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 121         }
 122
 123         return set;
 124 }
 125
 126
 127 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 128                                     struct wpa_ssid *ssid)
 129 {
 130         u8 key[32];
 131         size_t keylen;
 132         enum wpa_alg alg;
 133         u8 seq[6] = { 0 };
 134
 135         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 136          * sending unicast and multicast packets. */
 137
 138         if (ssid->mode != WPAS_MODE_IBSS) {
 139                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 140                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 141                 return -1;
 142         }
 143
 144         if (!ssid->psk_set) {
 145                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 146                         "WPA-None");
 147                 return -1;
 148         }
 149
 150         switch (wpa_s->group_cipher) {
 151         case WPA_CIPHER_CCMP:
 152                 os_memcpy(key, ssid->psk, 16);
 153                 keylen = 16;
 154                 alg = WPA_ALG_CCMP;
 155                 break;
 156         case WPA_CIPHER_GCMP:
 157                 os_memcpy(key, ssid->psk, 16);
 158                 keylen = 16;
 159                 alg = WPA_ALG_GCMP;
 160                 break;
 161         case WPA_CIPHER_TKIP:
 162                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 163                 os_memcpy(key, ssid->psk, 16 + 8);
 164                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 165                 keylen = 32;
 166                 alg = WPA_ALG_TKIP;
 167                 break;
 168         default:
 169                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 170                         "WPA-None", wpa_s->group_cipher);
 171                 return -1;
 172         }
 173
 174         /* TODO: should actually remember the previously used seq#, both for TX
 175          * and RX from each STA.. */
 176
 177         return wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 178 }
 179
 180
 181 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 182 {
 183         struct wpa_supplicant *wpa_s = eloop_ctx;
 184         const u8 *bssid = wpa_s->bssid;
 185         if (is_zero_ether_addr(bssid))
 186                 bssid = wpa_s->pending_bssid;
 187         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 188                 MAC2STR(bssid));
 189         wpa_blacklist_add(wpa_s, bssid);
 190         wpa_sm_notify_disassoc(wpa_s->wpa);
 191         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 192         wpa_s->reassociate = 1;
 193
 194         /*
 195          * If we timed out, the AP or the local radio may be busy.
 196          * So, wait a second until scanning again.
 197          */
 198         wpa_supplicant_req_scan(wpa_s, 1, 0);
 199 }
 200
 201
 202 /**
 203  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 204  * @wpa_s: Pointer to wpa_supplicant data
 205  * @sec: Number of seconds after which to time out authentication
 206  * @usec: Number of microseconds after which to time out authentication
 207  *
 208  * This function is used to schedule a timeout for the current authentication
 209  * attempt.
 210  */
 211 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 212                                      int sec, int usec)
 213 {
 214         if (wpa_s->conf->ap_scan == 0 &&
 215             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 216                 return;
 217
 218         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 219                 "%d usec", sec, usec);
 220         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 221         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 222 }
 223
 224
 225 /**
 226  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 227  * @wpa_s: Pointer to wpa_supplicant data
 228  *
 229  * This function is used to cancel authentication timeout scheduled with
 230  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 231  * been completed.
 232  */
 233 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 234 {
 235         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 236         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 237         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 238 }
 239
 240
 241 /**
 242  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 243  * @wpa_s: Pointer to wpa_supplicant data
 244  *
 245  * This function is used to configure EAPOL state machine based on the selected
 246  * authentication mode.
 247  */
 248 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 249 {
 250 #ifdef IEEE8021X_EAPOL
 251         struct eapol_config eapol_conf;
 252         struct wpa_ssid *ssid = wpa_s->current_ssid;
 253
 254 #ifdef CONFIG_IBSS_RSN
 255         if (ssid->mode == WPAS_MODE_IBSS &&
 256             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 257             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 258                 /*
 259                  * RSN IBSS authentication is per-STA and we can disable the
 260                  * per-BSSID EAPOL authentication.
 261                  */
 262                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 263                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 264                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 265                 return;
 266         }
 267 #endif /* CONFIG_IBSS_RSN */
 268
 269         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 270         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271
 272         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 273             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 274                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 275         else
 276                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 277
 278         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 279         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 280                 eapol_conf.accept_802_1x_keys = 1;
 281                 eapol_conf.required_keys = 0;
 282                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 283                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 284                 }
 285                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 286                         eapol_conf.required_keys |=
 287                                 EAPOL_REQUIRE_KEY_BROADCAST;
 288                 }
 289
 290                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 291                         eapol_conf.required_keys = 0;
 292         }
 293         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 294         eapol_conf.workaround = ssid->eap_workaround;
 295         eapol_conf.eap_disabled =
 296                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 297                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 298                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 299         eapol_conf.external_sim = wpa_s->conf->external_sim;
 300
 301 #ifdef CONFIG_WPS
 302         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 303                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 304                 if (wpa_s->current_bss) {
 305                         struct wpabuf *ie;
 306                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 307                                                          WPS_IE_VENDOR_TYPE);
 308                         if (ie) {
 309                                 if (wps_is_20(ie))
 310                                         eapol_conf.wps |=
 311                                                 EAPOL_PEER_IS_WPS20_AP;
 312                                 wpabuf_free(ie);
 313                         }
 314                 }
 315         }
 316 #endif /* CONFIG_WPS */
 317
 318         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 319
 320         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 321 #endif /* IEEE8021X_EAPOL */
 322 }
 323
 324
 325 /**
 326  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 327  * @wpa_s: Pointer to wpa_supplicant data
 328  * @ssid: Configuration data for the network
 329  *
 330  * This function is used to configure WPA state machine and related parameters
 331  * to a mode where WPA is not enabled. This is called as part of the
 332  * authentication configuration when the selected network does not use WPA.
 333  */
 334 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 335                                        struct wpa_ssid *ssid)
 336 {
 337         int i;
 338
 339         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 340                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 341         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 342                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 343         else
 344                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 345         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 346         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 347         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 348         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 349         wpa_s->group_cipher = WPA_CIPHER_NONE;
 350         wpa_s->mgmt_group_cipher = 0;
 351
 352         for (i = 0; i < NUM_WEP_KEYS; i++) {
 353                 if (ssid->wep_key_len[i] > 5) {
 354                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 355                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 356                         break;
 357                 } else if (ssid->wep_key_len[i] > 0) {
 358                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 359                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 360                         break;
 361                 }
 362         }
 363
 364         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 365         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 366         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 367                          wpa_s->pairwise_cipher);
 368         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 369 #ifdef CONFIG_IEEE80211W
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 371                          wpa_s->mgmt_group_cipher);
 372 #endif /* CONFIG_IEEE80211W */
 373
 374         pmksa_cache_clear_current(wpa_s->wpa);
 375 }
 376
 377
 378 void free_hw_features(struct wpa_supplicant *wpa_s)
 379 {
 380         int i;
 381         if (wpa_s->hw.modes == NULL)
 382                 return;
 383
 384         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 385                 os_free(wpa_s->hw.modes[i].channels);
 386                 os_free(wpa_s->hw.modes[i].rates);
 387         }
 388
 389         os_free(wpa_s->hw.modes);
 390         wpa_s->hw.modes = NULL;
 391 }
 392
 393
 394 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 395 {
 396         int i;
 397
 398         bgscan_deinit(wpa_s);
 399         autoscan_deinit(wpa_s);
 400         scard_deinit(wpa_s->scard);
 401         wpa_s->scard = NULL;
 402         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 403         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 404         l2_packet_deinit(wpa_s->l2);
 405         wpa_s->l2 = NULL;
 406         if (wpa_s->l2_br) {
 407                 l2_packet_deinit(wpa_s->l2_br);
 408                 wpa_s->l2_br = NULL;
 409         }
 410 #ifdef CONFIG_TESTING_OPTIONS
 411         l2_packet_deinit(wpa_s->l2_test);
 412         wpa_s->l2_test = NULL;
 413 #endif /* CONFIG_TESTING_OPTIONS */
 414
 415         if (wpa_s->conf != NULL) {
 416                 struct wpa_ssid *ssid;
 417                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 418                         wpas_notify_network_removed(wpa_s, ssid);
 419         }
 420
 421         os_free(wpa_s->confname);
 422         wpa_s->confname = NULL;
 423
 424         os_free(wpa_s->confanother);
 425         wpa_s->confanother = NULL;
 426
 427         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 428         eapol_sm_deinit(wpa_s->eapol);
 429         wpa_s->eapol = NULL;
 430
 431         rsn_preauth_deinit(wpa_s->wpa);
 432
 433 #ifdef CONFIG_TDLS
 434         wpa_tdls_deinit(wpa_s->wpa);
 435 #endif /* CONFIG_TDLS */
 436
 437         pmksa_candidate_free(wpa_s->wpa);
 438         wpa_sm_deinit(wpa_s->wpa);
 439         wpa_s->wpa = NULL;
 440         wpa_blacklist_clear(wpa_s);
 441
 442         wpa_bss_deinit(wpa_s);
 443
 444         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 445         wpa_supplicant_cancel_scan(wpa_s);
 446         wpa_supplicant_cancel_auth_timeout(wpa_s);
 447         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 448 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 449         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 450                              wpa_s, NULL);
 451 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 452
 453         wpas_wps_deinit(wpa_s);
 454
 455         wpabuf_free(wpa_s->pending_eapol_rx);
 456         wpa_s->pending_eapol_rx = NULL;
 457
 458 #ifdef CONFIG_IBSS_RSN
 459         ibss_rsn_deinit(wpa_s->ibss_rsn);
 460         wpa_s->ibss_rsn = NULL;
 461 #endif /* CONFIG_IBSS_RSN */
 462
 463         sme_deinit(wpa_s);
 464
 465 #ifdef CONFIG_AP
 466         wpa_supplicant_ap_deinit(wpa_s);
 467 #endif /* CONFIG_AP */
 468
 469         wpas_p2p_deinit(wpa_s);
 470
 471 #ifdef CONFIG_OFFCHANNEL
 472         offchannel_deinit(wpa_s);
 473 #endif /* CONFIG_OFFCHANNEL */
 474
 475         wpa_supplicant_cancel_sched_scan(wpa_s);
 476
 477         os_free(wpa_s->next_scan_freqs);
 478         wpa_s->next_scan_freqs = NULL;
 479
 480         os_free(wpa_s->manual_scan_freqs);
 481         wpa_s->manual_scan_freqs = NULL;
 482
 483         os_free(wpa_s->manual_sched_scan_freqs);
 484         wpa_s->manual_sched_scan_freqs = NULL;
 485
 486         gas_query_deinit(wpa_s->gas);
 487         wpa_s->gas = NULL;
 488
 489         free_hw_features(wpa_s);
 490
 491         ieee802_1x_dealloc_kay_sm(wpa_s);
 492
 493         os_free(wpa_s->bssid_filter);
 494         wpa_s->bssid_filter = NULL;
 495
 496         os_free(wpa_s->disallow_aps_bssid);
 497         wpa_s->disallow_aps_bssid = NULL;
 498         os_free(wpa_s->disallow_aps_ssid);
 499         wpa_s->disallow_aps_ssid = NULL;
 500
 501         wnm_bss_keep_alive_deinit(wpa_s);
 502 #ifdef CONFIG_WNM
 503         wnm_deallocate_memory(wpa_s);
 504 #endif /* CONFIG_WNM */
 505
 506         ext_password_deinit(wpa_s->ext_pw);
 507         wpa_s->ext_pw = NULL;
 508
 509         wpabuf_free(wpa_s->last_gas_resp);
 510         wpa_s->last_gas_resp = NULL;
 511         wpabuf_free(wpa_s->prev_gas_resp);
 512         wpa_s->prev_gas_resp = NULL;
 513
 514         os_free(wpa_s->last_scan_res);
 515         wpa_s->last_scan_res = NULL;
 516
 517 #ifdef CONFIG_HS20
 518         hs20_deinit(wpa_s);
 519 #endif /* CONFIG_HS20 */
 520
 521         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 522                 wpabuf_free(wpa_s->vendor_elem[i]);
 523                 wpa_s->vendor_elem[i] = NULL;
 524         }
 525 }
 526
 527
 528 /**
 529  * wpa_clear_keys - Clear keys configured for the driver
 530  * @wpa_s: Pointer to wpa_supplicant data
 531  * @addr: Previously used BSSID or %NULL if not available
 532  *
 533  * This function clears the encryption keys that has been previously configured
 534  * for the driver.
 535  */
 536 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 537 {
 538         int i, max;
 539
 540 #ifdef CONFIG_IEEE80211W
 541         max = 6;
 542 #else /* CONFIG_IEEE80211W */
 543         max = 4;
 544 #endif /* CONFIG_IEEE80211W */
 545
 546         /* MLME-DELETEKEYS.request */
 547         for (i = 0; i < max; i++) {
 548                 if (wpa_s->keys_cleared & BIT(i))
 549                         continue;
 550                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 551                                 NULL, 0);
 552         }
 553         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 554             !is_zero_ether_addr(addr)) {
 555                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 556                                 0);
 557                 /* MLME-SETPROTECTION.request(None) */
 558                 wpa_drv_mlme_setprotection(
 559                         wpa_s, addr,
 560                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 561                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 562         }
 563         wpa_s->keys_cleared = (u32) -1;
 564 }
 565
 566
 567 /**
 568  * wpa_supplicant_state_txt - Get the connection state name as a text string
 569  * @state: State (wpa_state; WPA_*)
 570  * Returns: The state name as a printable text string
 571  */
 572 const char * wpa_supplicant_state_txt(enum wpa_states state)
 573 {
 574         switch (state) {
 575         case WPA_DISCONNECTED:
 576                 return "DISCONNECTED";
 577         case WPA_INACTIVE:
 578                 return "INACTIVE";
 579         case WPA_INTERFACE_DISABLED:
 580                 return "INTERFACE_DISABLED";
 581         case WPA_SCANNING:
 582                 return "SCANNING";
 583         case WPA_AUTHENTICATING:
 584                 return "AUTHENTICATING";
 585         case WPA_ASSOCIATING:
 586                 return "ASSOCIATING";
 587         case WPA_ASSOCIATED:
 588                 return "ASSOCIATED";
 589         case WPA_4WAY_HANDSHAKE:
 590                 return "4WAY_HANDSHAKE";
 591         case WPA_GROUP_HANDSHAKE:
 592                 return "GROUP_HANDSHAKE";
 593         case WPA_COMPLETED:
 594                 return "COMPLETED";
 595         default:
 596                 return "UNKNOWN";
 597         }
 598 }
 599
 600
 601 #ifdef CONFIG_BGSCAN
 602
 603 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 604 {
 605         const char *name;
 606
 607         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 608                 name = wpa_s->current_ssid->bgscan;
 609         else
 610                 name = wpa_s->conf->bgscan;
 611         if (name == NULL || name[0] == '\0')
 612                 return;
 613         if (wpas_driver_bss_selection(wpa_s))
 614                 return;
 615         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 616                 return;
 617 #ifdef CONFIG_P2P
 618         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 619                 return;
 620 #endif /* CONFIG_P2P */
 621
 622         bgscan_deinit(wpa_s);
 623         if (wpa_s->current_ssid) {
 624                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 625                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 626                                 "bgscan");
 627                         /*
 628                          * Live without bgscan; it is only used as a roaming
 629                          * optimization, so the initial connection is not
 630                          * affected.
 631                          */
 632                 } else {
 633                         struct wpa_scan_results *scan_res;
 634                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 635                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 636                                                                    0);
 637                         if (scan_res) {
 638                                 bgscan_notify_scan(wpa_s, scan_res);
 639                                 wpa_scan_results_free(scan_res);
 640                         }
 641                 }
 642         } else
 643                 wpa_s->bgscan_ssid = NULL;
 644 }
 645
 646
 647 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 648 {
 649         if (wpa_s->bgscan_ssid != NULL) {
 650                 bgscan_deinit(wpa_s);
 651                 wpa_s->bgscan_ssid = NULL;
 652         }
 653 }
 654
 655 #endif /* CONFIG_BGSCAN */
 656
 657
 658 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 659 {
 660         if (autoscan_init(wpa_s, 0))
 661                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 662 }
 663
 664
 665 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 666 {
 667         autoscan_deinit(wpa_s);
 668 }
 669
 670
 671 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 672 {
 673         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 674             wpa_s->wpa_state == WPA_SCANNING) {
 675                 autoscan_deinit(wpa_s);
 676                 wpa_supplicant_start_autoscan(wpa_s);
 677         }
 678 }
 679
 680
 681 /**
 682  * wpa_supplicant_set_state - Set current connection state
 683  * @wpa_s: Pointer to wpa_supplicant data
 684  * @state: The new connection state
 685  *
 686  * This function is called whenever the connection state changes, e.g.,
 687  * association is completed for WPA/WPA2 4-Way Handshake is started.
 688  */
 689 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 690                               enum wpa_states state)
 691 {
 692         enum wpa_states old_state = wpa_s->wpa_state;
 693
 694         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 695                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 696                 wpa_supplicant_state_txt(state));
 697
 698         if (state == WPA_INTERFACE_DISABLED) {
 699                 /* Assure normal scan when interface is restored */
 700                 wpa_s->normal_scans = 0;
 701         }
 702
 703         if (state == WPA_COMPLETED) {
 704                 wpas_connect_work_done(wpa_s);
 705                 /* Reinitialize normal_scan counter */
 706                 wpa_s->normal_scans = 0;
 707         }
 708
 709         if (state != WPA_SCANNING)
 710                 wpa_supplicant_notify_scanning(wpa_s, 0);
 711
 712         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 713                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 714 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 715                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 716                         MACSTR " completed [id=%d id_str=%s]",
 717                         MAC2STR(wpa_s->bssid),
 718                         ssid ? ssid->id : -1,
 719                         ssid && ssid->id_str ? ssid->id_str : "");
 720 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 721                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 722                 wpa_s->extra_blacklist_count = 0;
 723                 wpa_s->new_connection = 0;
 724                 wpa_drv_set_operstate(wpa_s, 1);
 725 #ifndef IEEE8021X_EAPOL
 726                 wpa_drv_set_supp_port(wpa_s, 1);
 727 #endif /* IEEE8021X_EAPOL */
 728                 wpa_s->after_wps = 0;
 729                 wpa_s->known_wps_freq = 0;
 730                 wpas_p2p_completed(wpa_s);
 731
 732                 sme_sched_obss_scan(wpa_s, 1);
 733         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 734                    state == WPA_ASSOCIATED) {
 735                 wpa_s->new_connection = 1;
 736                 wpa_drv_set_operstate(wpa_s, 0);
 737 #ifndef IEEE8021X_EAPOL
 738                 wpa_drv_set_supp_port(wpa_s, 0);
 739 #endif /* IEEE8021X_EAPOL */
 740                 sme_sched_obss_scan(wpa_s, 0);
 741         }
 742         wpa_s->wpa_state = state;
 743
 744 #ifdef CONFIG_BGSCAN
 745         if (state == WPA_COMPLETED)
 746                 wpa_supplicant_start_bgscan(wpa_s);
 747         else if (state < WPA_ASSOCIATED)
 748                 wpa_supplicant_stop_bgscan(wpa_s);
 749 #endif /* CONFIG_BGSCAN */
 750
 751         if (state == WPA_AUTHENTICATING)
 752                 wpa_supplicant_stop_autoscan(wpa_s);
 753
 754         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 755                 wpa_supplicant_start_autoscan(wpa_s);
 756
 757         if (wpa_s->wpa_state != old_state) {
 758                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 759
 760                 /*
 761                  * Notify the P2P Device interface about a state change in one
 762                  * of the interfaces.
 763                  */
 764                 wpas_p2p_indicate_state_change(wpa_s);
 765
 766                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 767                     old_state == WPA_COMPLETED)
 768                         wpas_notify_auth_changed(wpa_s);
 769         }
 770 }
 771
 772
 773 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 774 {
 775         int pending = 0;
 776 #ifdef CONFIG_WPS
 777         struct wpa_supplicant *wpa_s = global->ifaces;
 778         while (wpa_s) {
 779                 struct wpa_supplicant *next = wpa_s->next;
 780                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 781                         pending = 1;
 782 #ifdef CONFIG_P2P
 783                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 784                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 785                         wpas_p2p_disconnect(wpa_s);
 786 #endif /* CONFIG_P2P */
 787                 wpa_s = next;
 788         }
 789 #endif /* CONFIG_WPS */
 790         if (pending)
 791                 return;
 792         eloop_terminate();
 793 }
 794
 795
 796 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 797 {
 798         struct wpa_global *global = signal_ctx;
 799         wpa_supplicant_terminate_proc(global);
 800 }
 801
 802
 803 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 804 {
 805         enum wpa_states old_state = wpa_s->wpa_state;
 806
 807         wpa_s->pairwise_cipher = 0;
 808         wpa_s->group_cipher = 0;
 809         wpa_s->mgmt_group_cipher = 0;
 810         wpa_s->key_mgmt = 0;
 811         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 812                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 813
 814         if (wpa_s->wpa_state != old_state)
 815                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 816 }
 817
 818
 819 /**
 820  * wpa_supplicant_reload_configuration - Reload configuration data
 821  * @wpa_s: Pointer to wpa_supplicant data
 822  * Returns: 0 on success or -1 if configuration parsing failed
 823  *
 824  * This function can be used to request that the configuration data is reloaded
 825  * (e.g., after configuration file change). This function is reloading
 826  * configuration only for one interface, so this may need to be called multiple
 827  * times if %wpa_supplicant is controlling multiple interfaces and all
 828  * interfaces need reconfiguration.
 829  */
 830 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 831 {
 832         struct wpa_config *conf;
 833         int reconf_ctrl;
 834         int old_ap_scan;
 835
 836         if (wpa_s->confname == NULL)
 837                 return -1;
 838         conf = wpa_config_read(wpa_s->confname, NULL);
 839         if (conf == NULL) {
 840                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 841                         "file '%s' - exiting", wpa_s->confname);
 842                 return -1;
 843         }
 844         wpa_config_read(wpa_s->confanother, conf);
 845
 846         conf->changed_parameters = (unsigned int) -1;
 847
 848         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 849                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 850                     os_strcmp(conf->ctrl_interface,
 851                               wpa_s->conf->ctrl_interface) != 0);
 852
 853         if (reconf_ctrl && wpa_s->ctrl_iface) {
 854                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 855                 wpa_s->ctrl_iface = NULL;
 856         }
 857
 858         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 859         if (wpa_s->current_ssid) {
 860                 wpa_supplicant_deauthenticate(wpa_s,
 861                                               WLAN_REASON_DEAUTH_LEAVING);
 862         }
 863
 864         /*
 865          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 866          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 867          */
 868         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 869                 /*
 870                  * Clear forced success to clear EAP state for next
 871                  * authentication.
 872                  */
 873                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 874         }
 875         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 876         wpa_sm_set_config(wpa_s->wpa, NULL);
 877         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 878         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 879         rsn_preauth_deinit(wpa_s->wpa);
 880
 881         old_ap_scan = wpa_s->conf->ap_scan;
 882         wpa_config_free(wpa_s->conf);
 883         wpa_s->conf = conf;
 884         if (old_ap_scan != wpa_s->conf->ap_scan)
 885                 wpas_notify_ap_scan_changed(wpa_s);
 886
 887         if (reconf_ctrl)
 888                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 889
 890         wpa_supplicant_update_config(wpa_s);
 891
 892         wpa_supplicant_clear_status(wpa_s);
 893         if (wpa_supplicant_enabled_networks(wpa_s)) {
 894                 wpa_s->reassociate = 1;
 895                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 896         }
 897         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 898         return 0;
 899 }
 900
 901
 902 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 903 {
 904         struct wpa_global *global = signal_ctx;
 905         struct wpa_supplicant *wpa_s;
 906         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 907                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 908                         sig);
 909                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 910                         wpa_supplicant_terminate_proc(global);
 911                 }
 912         }
 913 }
 914
 915
 916 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 917                                          struct wpa_ssid *ssid,
 918                                          struct wpa_ie_data *ie)
 919 {
 920         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 921         if (ret) {
 922                 if (ret == -2) {
 923                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 924                                 "from association info");
 925                 }
 926                 return -1;
 927         }
 928
 929         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 930                 "cipher suites");
 931         if (!(ie->group_cipher & ssid->group_cipher)) {
 932                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 933                         "cipher 0x%x (mask 0x%x) - reject",
 934                         ie->group_cipher, ssid->group_cipher);
 935                 return -1;
 936         }
 937         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 938                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 939                         "cipher 0x%x (mask 0x%x) - reject",
 940                         ie->pairwise_cipher, ssid->pairwise_cipher);
 941                 return -1;
 942         }
 943         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 944                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 945                         "management 0x%x (mask 0x%x) - reject",
 946                         ie->key_mgmt, ssid->key_mgmt);
 947                 return -1;
 948         }
 949
 950 #ifdef CONFIG_IEEE80211W
 951         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 952             (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
 953              wpa_s->conf->pmf : ssid->ieee80211w) ==
 954             MGMT_FRAME_PROTECTION_REQUIRED) {
 955                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 956                         "that does not support management frame protection - "
 957                         "reject");
 958                 return -1;
 959         }
 960 #endif /* CONFIG_IEEE80211W */
 961
 962         return 0;
 963 }
 964
 965
 966 /**
 967  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 968  * @wpa_s: Pointer to wpa_supplicant data
 969  * @bss: Scan results for the selected BSS, or %NULL if not available
 970  * @ssid: Configuration data for the selected network
 971  * @wpa_ie: Buffer for the WPA/RSN IE
 972  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 973  * used buffer length in case the functions returns success.
 974  * Returns: 0 on success or -1 on failure
 975  *
 976  * This function is used to configure authentication and encryption parameters
 977  * based on the network configuration and scan result for the selected BSS (if
 978  * available).
 979  */
 980 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 981                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 982                               u8 *wpa_ie, size_t *wpa_ie_len)
 983 {
 984         struct wpa_ie_data ie;
 985         int sel, proto;
 986         const u8 *bss_wpa, *bss_rsn, *bss_osen;
 987
 988         if (bss) {
 989                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 990                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
 991                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
 992         } else
 993                 bss_wpa = bss_rsn = bss_osen = NULL;
 994
 995         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
 996             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
 997             (ie.group_cipher & ssid->group_cipher) &&
 998             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
 999             (ie.key_mgmt & ssid->key_mgmt)) {
1000                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1001                 proto = WPA_PROTO_RSN;
1002         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1003                    wpa_parse_wpa_ie(bss_wpa, 2 +bss_wpa[1], &ie) == 0 &&
1004                    (ie.group_cipher & ssid->group_cipher) &&
1005                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1006                    (ie.key_mgmt & ssid->key_mgmt)) {
1007                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1008                 proto = WPA_PROTO_WPA;
1009 #ifdef CONFIG_HS20
1010         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1011                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1012                 /* TODO: parse OSEN element */
1013                 os_memset(&ie, 0, sizeof(ie));
1014                 ie.group_cipher = WPA_CIPHER_CCMP;
1015                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1016                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1017                 proto = WPA_PROTO_OSEN;
1018 #endif /* CONFIG_HS20 */
1019         } else if (bss) {
1020                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1021                 return -1;
1022         } else {
1023                 if (ssid->proto & WPA_PROTO_OSEN)
1024                         proto = WPA_PROTO_OSEN;
1025                 else if (ssid->proto & WPA_PROTO_RSN)
1026                         proto = WPA_PROTO_RSN;
1027                 else
1028                         proto = WPA_PROTO_WPA;
1029                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1030                         os_memset(&ie, 0, sizeof(ie));
1031                         ie.group_cipher = ssid->group_cipher;
1032                         ie.pairwise_cipher = ssid->pairwise_cipher;
1033                         ie.key_mgmt = ssid->key_mgmt;
1034 #ifdef CONFIG_IEEE80211W
1035                         ie.mgmt_group_cipher =
1036                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1037                                 WPA_CIPHER_AES_128_CMAC : 0;
1038 #endif /* CONFIG_IEEE80211W */
1039                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1040                                 "based on configuration");
1041                 } else
1042                         proto = ie.proto;
1043         }
1044
1045         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1046                 "pairwise %d key_mgmt %d proto %d",
1047                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1048 #ifdef CONFIG_IEEE80211W
1049         if (ssid->ieee80211w) {
1050                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1051                         ie.mgmt_group_cipher);
1052         }
1053 #endif /* CONFIG_IEEE80211W */
1054
1055         wpa_s->wpa_proto = proto;
1056         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1057         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1058                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1059
1060         if (bss || !wpa_s->ap_ies_from_associnfo) {
1061                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1062                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1063                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1064                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1065                         return -1;
1066         }
1067
1068         sel = ie.group_cipher & ssid->group_cipher;
1069         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1070         if (wpa_s->group_cipher < 0) {
1071                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1072                         "cipher");
1073                 return -1;
1074         }
1075         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1076                 wpa_cipher_txt(wpa_s->group_cipher));
1077
1078         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1079         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1080         if (wpa_s->pairwise_cipher < 0) {
1081                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1082                         "cipher");
1083                 return -1;
1084         }
1085         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1086                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1087
1088         sel = ie.key_mgmt & ssid->key_mgmt;
1089 #ifdef CONFIG_SAE
1090         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1091                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1092 #endif /* CONFIG_SAE */
1093         if (0) {
1094 #ifdef CONFIG_IEEE80211R
1095         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1096                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1097                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1098         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1099                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1100                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1101 #endif /* CONFIG_IEEE80211R */
1102 #ifdef CONFIG_SAE
1103         } else if (sel & WPA_KEY_MGMT_SAE) {
1104                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1105                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1106         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1107                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1108                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1109 #endif /* CONFIG_SAE */
1110 #ifdef CONFIG_IEEE80211W
1111         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1112                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1113                 wpa_dbg(wpa_s, MSG_DEBUG,
1114                         "WPA: using KEY_MGMT 802.1X with SHA256");
1115         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1116                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1117                 wpa_dbg(wpa_s, MSG_DEBUG,
1118                         "WPA: using KEY_MGMT PSK with SHA256");
1119 #endif /* CONFIG_IEEE80211W */
1120         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1121                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1122                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1123         } else if (sel & WPA_KEY_MGMT_PSK) {
1124                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1125                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1126         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1127                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1128                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1129 #ifdef CONFIG_HS20
1130         } else if (sel & WPA_KEY_MGMT_OSEN) {
1131                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1132                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1133 #endif /* CONFIG_HS20 */
1134         } else {
1135                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1136                         "authenticated key management type");
1137                 return -1;
1138         }
1139
1140         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1141         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1142                          wpa_s->pairwise_cipher);
1143         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1144
1145 #ifdef CONFIG_IEEE80211W
1146         sel = ie.mgmt_group_cipher;
1147         if ((ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1148              wpa_s->conf->pmf : ssid->ieee80211w) == NO_MGMT_FRAME_PROTECTION ||
1149             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1150                 sel = 0;
1151         if (sel & WPA_CIPHER_AES_128_CMAC) {
1152                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1153                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1154                         "AES-128-CMAC");
1155         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1156                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1157                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1158                         "BIP-GMAC-128");
1159         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1160                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1161                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1162                         "BIP-GMAC-256");
1163         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1164                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1165                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1166                         "BIP-CMAC-256");
1167         } else {
1168                 wpa_s->mgmt_group_cipher = 0;
1169                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1170         }
1171         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1172                          wpa_s->mgmt_group_cipher);
1173         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1174                          (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1175                           wpa_s->conf->pmf : ssid->ieee80211w));
1176 #endif /* CONFIG_IEEE80211W */
1177
1178         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1179                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1180                 return -1;
1181         }
1182
1183         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1184                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1185 #ifndef CONFIG_NO_PBKDF2
1186                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1187                     ssid->passphrase) {
1188                         u8 psk[PMK_LEN];
1189                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1190                                     4096, psk, PMK_LEN);
1191                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1192                                         psk, PMK_LEN);
1193                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1194                 }
1195 #endif /* CONFIG_NO_PBKDF2 */
1196 #ifdef CONFIG_EXT_PASSWORD
1197                 if (ssid->ext_psk) {
1198                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1199                                                              ssid->ext_psk);
1200                         char pw_str[64 + 1];
1201                         u8 psk[PMK_LEN];
1202
1203                         if (pw == NULL) {
1204                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1205                                         "found from external storage");
1206                                 return -1;
1207                         }
1208
1209                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1210                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1211                                         "PSK length %d in external storage",
1212                                         (int) wpabuf_len(pw));
1213                                 ext_password_free(pw);
1214                                 return -1;
1215                         }
1216
1217                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1218                         pw_str[wpabuf_len(pw)] = '\0';
1219
1220 #ifndef CONFIG_NO_PBKDF2
1221                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1222                         {
1223                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1224                                             4096, psk, PMK_LEN);
1225                                 os_memset(pw_str, 0, sizeof(pw_str));
1226                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1227                                                 "external passphrase)",
1228                                                 psk, PMK_LEN);
1229                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1230                         } else
1231 #endif /* CONFIG_NO_PBKDF2 */
1232                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1233                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1234                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1235                                                 "Invalid PSK hex string");
1236                                         os_memset(pw_str, 0, sizeof(pw_str));
1237                                         ext_password_free(pw);
1238                                         return -1;
1239                                 }
1240                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1241                         } else {
1242                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1243                                         "PSK available");
1244                                 os_memset(pw_str, 0, sizeof(pw_str));
1245                                 ext_password_free(pw);
1246                                 return -1;
1247                         }
1248
1249                         os_memset(pw_str, 0, sizeof(pw_str));
1250                         ext_password_free(pw);
1251                 }
1252 #endif /* CONFIG_EXT_PASSWORD */
1253         } else
1254                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1255
1256         return 0;
1257 }
1258
1259
1260 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1261 {
1262         *pos = 0x00;
1263
1264         switch (idx) {
1265         case 0: /* Bits 0-7 */
1266                 break;
1267         case 1: /* Bits 8-15 */
1268                 break;
1269         case 2: /* Bits 16-23 */
1270 #ifdef CONFIG_WNM
1271                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1272                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1273 #endif /* CONFIG_WNM */
1274                 break;
1275         case 3: /* Bits 24-31 */
1276 #ifdef CONFIG_WNM
1277                 *pos |= 0x02; /* Bit 25 - SSID List */
1278 #endif /* CONFIG_WNM */
1279 #ifdef CONFIG_INTERWORKING
1280                 if (wpa_s->conf->interworking)
1281                         *pos |= 0x80; /* Bit 31 - Interworking */
1282 #endif /* CONFIG_INTERWORKING */
1283                 break;
1284         case 4: /* Bits 32-39 */
1285 #ifdef CONFIG_INTERWORKING
1286                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1287                         *pos |= 0x01; /* Bit 32 - QoS Map */
1288 #endif /* CONFIG_INTERWORKING */
1289                 break;
1290         case 5: /* Bits 40-47 */
1291 #ifdef CONFIG_HS20
1292                 if (wpa_s->conf->hs20)
1293                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1294 #endif /* CONFIG_HS20 */
1295                 break;
1296         case 6: /* Bits 48-55 */
1297                 break;
1298         }
1299 }
1300
1301
1302 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1303 {
1304         u8 *pos = buf;
1305         u8 len = 6, i;
1306
1307         if (len < wpa_s->extended_capa_len)
1308                 len = wpa_s->extended_capa_len;
1309         if (buflen < (size_t) len + 2) {
1310                 wpa_printf(MSG_INFO,
1311                            "Not enough room for building extended capabilities element");
1312                 return -1;
1313         }
1314
1315         *pos++ = WLAN_EID_EXT_CAPAB;
1316         *pos++ = len;
1317         for (i = 0; i < len; i++, pos++) {
1318                 wpas_ext_capab_byte(wpa_s, pos, i);
1319
1320                 if (i < wpa_s->extended_capa_len) {
1321                         *pos &= ~wpa_s->extended_capa_mask[i];
1322                         *pos |= wpa_s->extended_capa[i];
1323                 }
1324         }
1325
1326         while (len > 0 && buf[1 + len] == 0) {
1327                 len--;
1328                 buf[1] = len;
1329         }
1330         if (len == 0)
1331                 return 0;
1332
1333         return 2 + len;
1334 }
1335
1336
1337 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1338                           struct wpa_bss *test_bss)
1339 {
1340         struct wpa_bss *bss;
1341
1342         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1343                 if (bss == test_bss)
1344                         return 1;
1345         }
1346
1347         return 0;
1348 }
1349
1350
1351 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1352                            struct wpa_ssid *test_ssid)
1353 {
1354         struct wpa_ssid *ssid;
1355
1356         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1357                 if (ssid == test_ssid)
1358                         return 1;
1359         }
1360
1361         return 0;
1362 }
1363
1364
1365 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1366                         struct wpa_ssid *test_ssid)
1367 {
1368         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1369                 return 0;
1370
1371         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1372 }
1373
1374
1375 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1376 {
1377         if (cwork == NULL)
1378                 return;
1379         os_free(cwork);
1380 }
1381
1382
1383 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1384 {
1385         struct wpa_connect_work *cwork;
1386         struct wpa_radio_work *work = wpa_s->connect_work;
1387
1388         if (!work)
1389                 return;
1390
1391         wpa_s->connect_work = NULL;
1392         cwork = work->ctx;
1393         work->ctx = NULL;
1394         wpas_connect_work_free(cwork);
1395         radio_work_done(work);
1396 }
1397
1398
1399 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1400 {
1401         struct os_reltime now;
1402         u8 addr[ETH_ALEN];
1403
1404         os_get_reltime(&now);
1405         if (wpa_s->last_mac_addr_style == style &&
1406             wpa_s->last_mac_addr_change.sec != 0 &&
1407             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1408                                 wpa_s->conf->rand_addr_lifetime)) {
1409                 wpa_msg(wpa_s, MSG_DEBUG,
1410                         "Previously selected random MAC address has not yet expired");
1411                 return 0;
1412         }
1413
1414         switch (style) {
1415         case 1:
1416                 if (random_mac_addr(addr) < 0)
1417                         return -1;
1418                 break;
1419         case 2:
1420                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1421                 if (random_mac_addr_keep_oui(addr) < 0)
1422                         return -1;
1423                 break;
1424         default:
1425                 return -1;
1426         }
1427
1428         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1429                 wpa_msg(wpa_s, MSG_INFO,
1430                         "Failed to set random MAC address");
1431                 return -1;
1432         }
1433
1434         os_get_reltime(&wpa_s->last_mac_addr_change);
1435         wpa_s->mac_addr_changed = 1;
1436         wpa_s->last_mac_addr_style = style;
1437
1438         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1439                 wpa_msg(wpa_s, MSG_INFO,
1440                         "Could not update MAC address information");
1441                 return -1;
1442         }
1443
1444         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1445                 MAC2STR(addr));
1446
1447         return 0;
1448 }
1449
1450
1451 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1452 {
1453         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1454             !wpa_s->conf->preassoc_mac_addr)
1455                 return 0;
1456
1457         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1458 }
1459
1460
1461 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1462
1463 /**
1464  * wpa_supplicant_associate - Request association
1465  * @wpa_s: Pointer to wpa_supplicant data
1466  * @bss: Scan results for the selected BSS, or %NULL if not available
1467  * @ssid: Configuration data for the selected network
1468  *
1469  * This function is used to request %wpa_supplicant to associate with a BSS.
1470  */
1471 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1472                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1473 {
1474         struct wpa_connect_work *cwork;
1475         int rand_style;
1476
1477         if (ssid->mac_addr == -1)
1478                 rand_style = wpa_s->conf->mac_addr;
1479         else
1480                 rand_style = ssid->mac_addr;
1481
1482         if (wpa_s->last_ssid == ssid) {
1483                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1484         } else if (rand_style > 0) {
1485                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1486                         return;
1487                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1488         } else if (wpa_s->mac_addr_changed) {
1489                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1490                         wpa_msg(wpa_s, MSG_INFO,
1491                                 "Could not restore permanent MAC address");
1492                         return;
1493                 }
1494                 wpa_s->mac_addr_changed = 0;
1495                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1496                         wpa_msg(wpa_s, MSG_INFO,
1497                                 "Could not update MAC address information");
1498                         return;
1499                 }
1500                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1501         }
1502         wpa_s->last_ssid = ssid;
1503
1504 #ifdef CONFIG_IBSS_RSN
1505         ibss_rsn_deinit(wpa_s->ibss_rsn);
1506         wpa_s->ibss_rsn = NULL;
1507 #endif /* CONFIG_IBSS_RSN */
1508
1509         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1510             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1511 #ifdef CONFIG_AP
1512                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1513                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1514                                 "mode");
1515                         return;
1516                 }
1517                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1518                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1519                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1520                                 wpas_p2p_ap_setup_failed(wpa_s);
1521                         return;
1522                 }
1523                 wpa_s->current_bss = bss;
1524 #else /* CONFIG_AP */
1525                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1526                         "the build");
1527 #endif /* CONFIG_AP */
1528                 return;
1529         }
1530
1531 #ifdef CONFIG_TDLS
1532         if (bss)
1533                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1534                                 bss->ie_len);
1535 #endif /* CONFIG_TDLS */
1536
1537         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1538             ssid->mode == IEEE80211_MODE_INFRA) {
1539                 sme_authenticate(wpa_s, bss, ssid);
1540                 return;
1541         }
1542
1543         if (wpa_s->connect_work) {
1544                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1545                 return;
1546         }
1547
1548         if (radio_work_pending(wpa_s, "connect")) {
1549                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1550                 return;
1551         }
1552
1553         cwork = os_zalloc(sizeof(*cwork));
1554         if (cwork == NULL)
1555                 return;
1556
1557         cwork->bss = bss;
1558         cwork->ssid = ssid;
1559
1560         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1561                            wpas_start_assoc_cb, cwork) < 0) {
1562                 os_free(cwork);
1563         }
1564 }
1565
1566
1567 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1568 {
1569         struct wpa_connect_work *cwork = work->ctx;
1570         struct wpa_bss *bss = cwork->bss;
1571         struct wpa_ssid *ssid = cwork->ssid;
1572         struct wpa_supplicant *wpa_s = work->wpa_s;
1573         u8 wpa_ie[200];
1574         size_t wpa_ie_len;
1575         int use_crypt, ret, i, bssid_changed;
1576         int algs = WPA_AUTH_ALG_OPEN;
1577         unsigned int cipher_pairwise, cipher_group;
1578         struct wpa_driver_associate_params params;
1579         int wep_keys_set = 0;
1580         int assoc_failed = 0;
1581         struct wpa_ssid *old_ssid;
1582 #ifdef CONFIG_HT_OVERRIDES
1583         struct ieee80211_ht_capabilities htcaps;
1584         struct ieee80211_ht_capabilities htcaps_mask;
1585 #endif /* CONFIG_HT_OVERRIDES */
1586 #ifdef CONFIG_VHT_OVERRIDES
1587        struct ieee80211_vht_capabilities vhtcaps;
1588        struct ieee80211_vht_capabilities vhtcaps_mask;
1589 #endif /* CONFIG_VHT_OVERRIDES */
1590
1591         if (deinit) {
1592                 if (work->started) {
1593                         wpa_s->connect_work = NULL;
1594
1595                         /* cancel possible auth. timeout */
1596                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1597                                              NULL);
1598                 }
1599                 wpas_connect_work_free(cwork);
1600                 return;
1601         }
1602
1603         wpa_s->connect_work = work;
1604
1605         if (!wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1606                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1607                 wpas_connect_work_done(wpa_s);
1608                 return;
1609         }
1610
1611         os_memset(&params, 0, sizeof(params));
1612         wpa_s->reassociate = 0;
1613         wpa_s->eap_expected_failure = 0;
1614         if (bss && !wpas_driver_bss_selection(wpa_s)) {
1615 #ifdef CONFIG_IEEE80211R
1616                 const u8 *ie, *md = NULL;
1617 #endif /* CONFIG_IEEE80211R */
1618                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1619                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1620                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1621                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1622                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1623                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1624                 if (bssid_changed)
1625                         wpas_notify_bssid_changed(wpa_s);
1626 #ifdef CONFIG_IEEE80211R
1627                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1628                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1629                         md = ie + 2;
1630                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1631                 if (md) {
1632                         /* Prepare for the next transition */
1633                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1634                 }
1635 #endif /* CONFIG_IEEE80211R */
1636 #ifdef CONFIG_WPS
1637         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1638                    wpa_s->conf->ap_scan == 2 &&
1639                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1640                 /* Use ap_scan==1 style network selection to find the network
1641                  */
1642                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1643                 wpa_s->reassociate = 1;
1644                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1645                 return;
1646 #endif /* CONFIG_WPS */
1647         } else {
1648                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1649                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1650                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1651         }
1652         wpa_supplicant_cancel_sched_scan(wpa_s);
1653         wpa_supplicant_cancel_scan(wpa_s);
1654
1655         /* Starting new association, so clear the possibly used WPA IE from the
1656          * previous association. */
1657         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1658
1659 #ifdef IEEE8021X_EAPOL
1660         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1661                 if (ssid->leap) {
1662                         if (ssid->non_leap == 0)
1663                                 algs = WPA_AUTH_ALG_LEAP;
1664                         else
1665                                 algs |= WPA_AUTH_ALG_LEAP;
1666                 }
1667         }
1668 #endif /* IEEE8021X_EAPOL */
1669         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1670         if (ssid->auth_alg) {
1671                 algs = ssid->auth_alg;
1672                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1673                         "0x%x", algs);
1674         }
1675
1676         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1677                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1678             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1679                 int try_opportunistic;
1680                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1681                                      wpa_s->conf->okc :
1682                                      ssid->proactive_key_caching) &&
1683                         (ssid->proto & WPA_PROTO_RSN);
1684                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
1685                                             ssid, try_opportunistic) == 0)
1686                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
1687                 wpa_ie_len = sizeof(wpa_ie);
1688                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1689                                               wpa_ie, &wpa_ie_len)) {
1690                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1691                                 "key management and encryption suites");
1692                         return;
1693                 }
1694         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
1695                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1696                 /*
1697                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1698                  * use non-WPA since the scan results did not indicate that the
1699                  * AP is using WPA or WPA2.
1700                  */
1701                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1702                 wpa_ie_len = 0;
1703                 wpa_s->wpa_proto = 0;
1704         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1705                 wpa_ie_len = sizeof(wpa_ie);
1706                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1707                                               wpa_ie, &wpa_ie_len)) {
1708                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1709                                 "key management and encryption suites (no "
1710                                 "scan results)");
1711                         return;
1712                 }
1713 #ifdef CONFIG_WPS
1714         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1715                 struct wpabuf *wps_ie;
1716                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1717                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
1718                         wpa_ie_len = wpabuf_len(wps_ie);
1719                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
1720                 } else
1721                         wpa_ie_len = 0;
1722                 wpabuf_free(wps_ie);
1723                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1724                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
1725                         params.wps = WPS_MODE_PRIVACY;
1726                 else
1727                         params.wps = WPS_MODE_OPEN;
1728                 wpa_s->wpa_proto = 0;
1729 #endif /* CONFIG_WPS */
1730         } else {
1731                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1732                 wpa_ie_len = 0;
1733                 wpa_s->wpa_proto = 0;
1734         }
1735
1736 #ifdef CONFIG_P2P
1737         if (wpa_s->global->p2p) {
1738                 u8 *pos;
1739                 size_t len;
1740                 int res;
1741                 pos = wpa_ie + wpa_ie_len;
1742                 len = sizeof(wpa_ie) - wpa_ie_len;
1743                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
1744                                             ssid->p2p_group);
1745                 if (res >= 0)
1746                         wpa_ie_len += res;
1747         }
1748
1749         wpa_s->cross_connect_disallowed = 0;
1750         if (bss) {
1751                 struct wpabuf *p2p;
1752                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
1753                 if (p2p) {
1754                         wpa_s->cross_connect_disallowed =
1755                                 p2p_get_cross_connect_disallowed(p2p);
1756                         wpabuf_free(p2p);
1757                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
1758                                 "connection",
1759                                 wpa_s->cross_connect_disallowed ?
1760                                 "disallows" : "allows");
1761                 }
1762         }
1763
1764         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
1765 #endif /* CONFIG_P2P */
1766
1767 #ifdef CONFIG_HS20
1768         if (is_hs20_network(wpa_s, ssid, bss)) {
1769                 struct wpabuf *hs20;
1770                 hs20 = wpabuf_alloc(20);
1771                 if (hs20) {
1772                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
1773                         size_t len;
1774
1775                         wpas_hs20_add_indication(hs20, pps_mo_id);
1776                         len = sizeof(wpa_ie) - wpa_ie_len;
1777                         if (wpabuf_len(hs20) <= len) {
1778                                 os_memcpy(wpa_ie + wpa_ie_len,
1779                                           wpabuf_head(hs20), wpabuf_len(hs20));
1780                                 wpa_ie_len += wpabuf_len(hs20);
1781                         }
1782                         wpabuf_free(hs20);
1783                 }
1784         }
1785 #endif /* CONFIG_HS20 */
1786
1787         /*
1788          * Workaround: Add Extended Capabilities element only if the AP
1789          * included this element in Beacon/Probe Response frames. Some older
1790          * APs seem to have interoperability issues if this element is
1791          * included, so while the standard may require us to include the
1792          * element in all cases, it is justifiable to skip it to avoid
1793          * interoperability issues.
1794          */
1795         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
1796                 u8 ext_capab[18];
1797                 int ext_capab_len;
1798                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
1799                                                      sizeof(ext_capab));
1800                 if (ext_capab_len > 0) {
1801                         u8 *pos = wpa_ie;
1802                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
1803                                 pos += 2 + pos[1];
1804                         os_memmove(pos + ext_capab_len, pos,
1805                                    wpa_ie_len - (pos - wpa_ie));
1806                         wpa_ie_len += ext_capab_len;
1807                         os_memcpy(pos, ext_capab, ext_capab_len);
1808                 }
1809         }
1810
1811         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
1812         use_crypt = 1;
1813         cipher_pairwise = wpa_s->pairwise_cipher;
1814         cipher_group = wpa_s->group_cipher;
1815         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1816             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1817                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
1818                         use_crypt = 0;
1819                 if (wpa_set_wep_keys(wpa_s, ssid)) {
1820                         use_crypt = 1;
1821                         wep_keys_set = 1;
1822                 }
1823         }
1824         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
1825                 use_crypt = 0;
1826
1827 #ifdef IEEE8021X_EAPOL
1828         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1829                 if ((ssid->eapol_flags &
1830                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
1831                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
1832                     !wep_keys_set) {
1833                         use_crypt = 0;
1834                 } else {
1835                         /* Assume that dynamic WEP-104 keys will be used and
1836                          * set cipher suites in order for drivers to expect
1837                          * encryption. */
1838                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
1839                 }
1840         }
1841 #endif /* IEEE8021X_EAPOL */
1842
1843         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
1844                 /* Set the key before (and later after) association */
1845                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
1846         }
1847
1848         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
1849         if (bss) {
1850                 params.ssid = bss->ssid;
1851                 params.ssid_len = bss->ssid_len;
1852                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
1853                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
1854                                    MACSTR " freq=%u MHz based on scan results "
1855                                    "(bssid_set=%d)",
1856                                    MAC2STR(bss->bssid), bss->freq,
1857                                    ssid->bssid_set);
1858                         params.bssid = bss->bssid;
1859                         params.freq.freq = bss->freq;
1860                 }
1861                 params.bssid_hint = bss->bssid;
1862                 params.freq_hint = bss->freq;
1863         } else {
1864                 params.ssid = ssid->ssid;
1865                 params.ssid_len = ssid->ssid_len;
1866         }
1867
1868         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
1869             wpa_s->conf->ap_scan == 2) {
1870                 params.bssid = ssid->bssid;
1871                 params.fixed_bssid = 1;
1872         }
1873
1874         if (ssid->mode == WPAS_MODE_IBSS && ssid->frequency > 0 &&
1875             params.freq.freq == 0) {
1876                 enum hostapd_hw_mode hw_mode;
1877                 u8 channel;
1878
1879                 params.freq.freq = ssid->frequency;
1880
1881                 hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1882                 for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1883                         if (wpa_s->hw.modes[i].mode == hw_mode) {
1884                                 struct hostapd_hw_modes *mode;
1885
1886                                 mode = &wpa_s->hw.modes[i];
1887                                 params.freq.ht_enabled = ht_supported(mode);
1888                                 break;
1889                         }
1890                 }
1891         }
1892
1893         if (ssid->mode == WPAS_MODE_IBSS) {
1894                 if (ssid->beacon_int)
1895                         params.beacon_int = ssid->beacon_int;
1896                 else
1897                         params.beacon_int = wpa_s->conf->beacon_int;
1898         }
1899
1900         params.wpa_ie = wpa_ie;
1901         params.wpa_ie_len = wpa_ie_len;
1902         params.pairwise_suite = cipher_pairwise;
1903         params.group_suite = cipher_group;
1904         params.key_mgmt_suite = wpa_s->key_mgmt;
1905         params.wpa_proto = wpa_s->wpa_proto;
1906         params.auth_alg = algs;
1907         params.mode = ssid->mode;
1908         params.bg_scan_period = ssid->bg_scan_period;
1909         for (i = 0; i < NUM_WEP_KEYS; i++) {
1910                 if (ssid->wep_key_len[i])
1911                         params.wep_key[i] = ssid->wep_key[i];
1912                 params.wep_key_len[i] = ssid->wep_key_len[i];
1913         }
1914         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
1915
1916         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
1917             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
1918              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
1919                 params.passphrase = ssid->passphrase;
1920                 if (ssid->psk_set)
1921                         params.psk = ssid->psk;
1922         }
1923
1924         params.drop_unencrypted = use_crypt;
1925
1926 #ifdef CONFIG_IEEE80211W
1927         params.mgmt_frame_protection =
1928                 ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1929                 wpa_s->conf->pmf : ssid->ieee80211w;
1930         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
1931                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1932                 struct wpa_ie_data ie;
1933                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
1934                     ie.capabilities &
1935                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
1936                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
1937                                 "MFP: require MFP");
1938                         params.mgmt_frame_protection =
1939                                 MGMT_FRAME_PROTECTION_REQUIRED;
1940                 }
1941         }
1942 #endif /* CONFIG_IEEE80211W */
1943
1944         params.p2p = ssid->p2p_group;
1945
1946         if (wpa_s->parent->set_sta_uapsd)
1947                 params.uapsd = wpa_s->parent->sta_uapsd;
1948         else
1949                 params.uapsd = -1;
1950
1951 #ifdef CONFIG_HT_OVERRIDES
1952         os_memset(&htcaps, 0, sizeof(htcaps));
1953         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
1954         params.htcaps = (u8 *) &htcaps;
1955         params.htcaps_mask = (u8 *) &htcaps_mask;
1956         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
1957 #endif /* CONFIG_HT_OVERRIDES */
1958 #ifdef CONFIG_VHT_OVERRIDES
1959         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
1960         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
1961         params.vhtcaps = &vhtcaps;
1962         params.vhtcaps_mask = &vhtcaps_mask;
1963         wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
1964 #endif /* CONFIG_VHT_OVERRIDES */
1965
1966 #ifdef CONFIG_P2P
1967         /*
1968          * If multi-channel concurrency is not supported, check for any
1969          * frequency conflict. In case of any frequency conflict, remove the
1970          * least prioritized connection.
1971          */
1972         if (wpa_s->num_multichan_concurrent < 2) {
1973                 int freq, num;
1974                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
1975                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
1976                         wpa_printf(MSG_DEBUG,
1977                                    "Assoc conflicting freq found (%d != %d)",
1978                                    freq, params.freq.freq);
1979                         if (wpas_p2p_handle_frequency_conflicts(
1980                                     wpa_s, params.freq.freq, ssid) < 0)
1981                                 return;
1982                 }
1983         }
1984 #endif /* CONFIG_P2P */
1985
1986         ret = wpa_drv_associate(wpa_s, &params);
1987         if (ret < 0) {
1988                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
1989                         "failed");
1990                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
1991                         /*
1992                          * The driver is known to mean what is saying, so we
1993                          * can stop right here; the association will not
1994                          * succeed.
1995                          */
1996                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1997                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1998                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1999                         return;
2000                 }
2001                 /* try to continue anyway; new association will be tried again
2002                  * after timeout */
2003                 assoc_failed = 1;
2004         }
2005
2006         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2007                 /* Set the key after the association just in case association
2008                  * cleared the previously configured key. */
2009                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2010                 /* No need to timeout authentication since there is no key
2011                  * management. */
2012                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2013                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2014 #ifdef CONFIG_IBSS_RSN
2015         } else if (ssid->mode == WPAS_MODE_IBSS &&
2016                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2017                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2018                 /*
2019                  * RSN IBSS authentication is per-STA and we can disable the
2020                  * per-BSSID authentication.
2021                  */
2022                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2023 #endif /* CONFIG_IBSS_RSN */
2024         } else {
2025                 /* Timeout for IEEE 802.11 authentication and association */
2026                 int timeout = 60;
2027
2028                 if (assoc_failed) {
2029                         /* give IBSS a bit more time */
2030                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2031                 } else if (wpa_s->conf->ap_scan == 1) {
2032                         /* give IBSS a bit more time */
2033                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2034                 }
2035                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2036         }
2037
2038         if (wep_keys_set &&
2039             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2040                 /* Set static WEP keys again */
2041                 wpa_set_wep_keys(wpa_s, ssid);
2042         }
2043
2044         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2045                 /*
2046                  * Do not allow EAP session resumption between different
2047                  * network configurations.
2048                  */
2049                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2050         }
2051         old_ssid = wpa_s->current_ssid;
2052         wpa_s->current_ssid = ssid;
2053         wpa_s->current_bss = bss;
2054         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2055         wpa_supplicant_initiate_eapol(wpa_s);
2056         if (old_ssid != wpa_s->current_ssid)
2057                 wpas_notify_network_changed(wpa_s);
2058 }
2059
2060
2061 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2062                                             const u8 *addr)
2063 {
2064         struct wpa_ssid *old_ssid;
2065
2066         wpas_connect_work_done(wpa_s);
2067         wpa_clear_keys(wpa_s, addr);
2068         old_ssid = wpa_s->current_ssid;
2069         wpa_supplicant_mark_disassoc(wpa_s);
2070         wpa_sm_set_config(wpa_s->wpa, NULL);
2071         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2072         if (old_ssid != wpa_s->current_ssid)
2073                 wpas_notify_network_changed(wpa_s);
2074         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2075 }
2076
2077
2078 /**
2079  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2080  * @wpa_s: Pointer to wpa_supplicant data
2081  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2082  *
2083  * This function is used to request %wpa_supplicant to deauthenticate from the
2084  * current AP.
2085  */
2086 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2087                                    int reason_code)
2088 {
2089         u8 *addr = NULL;
2090         union wpa_event_data event;
2091         int zero_addr = 0;
2092
2093         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2094                 " pending_bssid=" MACSTR " reason=%d state=%s",
2095                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2096                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2097
2098         if (!is_zero_ether_addr(wpa_s->bssid))
2099                 addr = wpa_s->bssid;
2100         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2101                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2102                   wpa_s->wpa_state == WPA_ASSOCIATING))
2103                 addr = wpa_s->pending_bssid;
2104         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2105                 /*
2106                  * When using driver-based BSS selection, we may not know the
2107                  * BSSID with which we are currently trying to associate. We
2108                  * need to notify the driver of this disconnection even in such
2109                  * a case, so use the all zeros address here.
2110                  */
2111                 addr = wpa_s->bssid;
2112                 zero_addr = 1;
2113         }
2114
2115 #ifdef CONFIG_TDLS
2116         wpa_tdls_teardown_peers(wpa_s->wpa);
2117 #endif /* CONFIG_TDLS */
2118
2119         if (addr) {
2120                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2121                 os_memset(&event, 0, sizeof(event));
2122                 event.deauth_info.reason_code = (u16) reason_code;
2123                 event.deauth_info.locally_generated = 1;
2124                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2125                 if (zero_addr)
2126                         addr = NULL;
2127         }
2128
2129         wpa_supplicant_clear_connection(wpa_s, addr);
2130 }
2131
2132 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2133                                               struct wpa_ssid *ssid)
2134 {
2135         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2136                 return;
2137
2138         ssid->disabled = 0;
2139         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2140         wpas_notify_network_enabled_changed(wpa_s, ssid);
2141
2142         /*
2143          * Try to reassociate since there is no current configuration and a new
2144          * network was made available.
2145          */
2146         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2147                 wpa_s->reassociate = 1;
2148 }
2149
2150
2151 /**
2152  * wpa_supplicant_enable_network - Mark a configured network as enabled
2153  * @wpa_s: wpa_supplicant structure for a network interface
2154  * @ssid: wpa_ssid structure for a configured network or %NULL
2155  *
2156  * Enables the specified network or all networks if no network specified.
2157  */
2158 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2159                                    struct wpa_ssid *ssid)
2160 {
2161         if (ssid == NULL) {
2162                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2163                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2164         } else
2165                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2166
2167         if (wpa_s->reassociate && !wpa_s->disconnected) {
2168                 if (wpa_s->sched_scanning) {
2169                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2170                                    "new network to scan filters");
2171                         wpa_supplicant_cancel_sched_scan(wpa_s);
2172                 }
2173
2174                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2175                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2176         }
2177 }
2178
2179
2180 /**
2181  * wpa_supplicant_disable_network - Mark a configured network as disabled
2182  * @wpa_s: wpa_supplicant structure for a network interface
2183  * @ssid: wpa_ssid structure for a configured network or %NULL
2184  *
2185  * Disables the specified network or all networks if no network specified.
2186  */
2187 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2188                                     struct wpa_ssid *ssid)
2189 {
2190         struct wpa_ssid *other_ssid;
2191         int was_disabled;
2192
2193         if (ssid == NULL) {
2194                 if (wpa_s->sched_scanning)
2195                         wpa_supplicant_cancel_sched_scan(wpa_s);
2196
2197                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2198                      other_ssid = other_ssid->next) {
2199                         was_disabled = other_ssid->disabled;
2200                         if (was_disabled == 2)
2201                                 continue; /* do not change persistent P2P group
2202                                            * data */
2203
2204                         other_ssid->disabled = 1;
2205
2206                         if (was_disabled != other_ssid->disabled)
2207                                 wpas_notify_network_enabled_changed(
2208                                         wpa_s, other_ssid);
2209                 }
2210                 if (wpa_s->current_ssid)
2211                         wpa_supplicant_deauthenticate(
2212                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2213         } else if (ssid->disabled != 2) {
2214                 if (ssid == wpa_s->current_ssid)
2215                         wpa_supplicant_deauthenticate(
2216                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2217
2218                 was_disabled = ssid->disabled;
2219
2220                 ssid->disabled = 1;
2221
2222                 if (was_disabled != ssid->disabled) {
2223                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2224                         if (wpa_s->sched_scanning) {
2225                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2226                                            "to remove network from filters");
2227                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2228                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2229                         }
2230                 }
2231         }
2232 }
2233
2234
2235 /**
2236  * wpa_supplicant_select_network - Attempt association with a network
2237  * @wpa_s: wpa_supplicant structure for a network interface
2238  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2239  */
2240 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2241                                    struct wpa_ssid *ssid)
2242 {
2243
2244         struct wpa_ssid *other_ssid;
2245         int disconnected = 0;
2246
2247         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2248                 wpa_supplicant_deauthenticate(
2249                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2250                 disconnected = 1;
2251         }
2252
2253         if (ssid)
2254                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2255
2256         /*
2257          * Mark all other networks disabled or mark all networks enabled if no
2258          * network specified.
2259          */
2260         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2261              other_ssid = other_ssid->next) {
2262                 int was_disabled = other_ssid->disabled;
2263                 if (was_disabled == 2)
2264                         continue; /* do not change persistent P2P group data */
2265
2266                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2267                 if (was_disabled && !other_ssid->disabled)
2268                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2269
2270                 if (was_disabled != other_ssid->disabled)
2271                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2272         }
2273
2274         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2275                 /* We are already associated with the selected network */
2276                 wpa_printf(MSG_DEBUG, "Already associated with the "
2277                            "selected network - do nothing");
2278                 return;
2279         }
2280
2281         if (ssid) {
2282                 wpa_s->current_ssid = ssid;
2283                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2284         }
2285         wpa_s->connect_without_scan = NULL;
2286         wpa_s->disconnected = 0;
2287         wpa_s->reassociate = 1;
2288
2289         if (wpa_supplicant_fast_associate(wpa_s) != 1)
2290                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2291
2292         if (ssid)
2293                 wpas_notify_network_selected(wpa_s, ssid);
2294 }
2295
2296
2297 /**
2298  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2299  * @wpa_s: wpa_supplicant structure for a network interface
2300  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2301  * @pkcs11_module_path: PKCS #11 module path or NULL
2302  * Returns: 0 on success; -1 on failure
2303  *
2304  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2305  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2306  * module path fails the paths will be reset to the default value (NULL).
2307  */
2308 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2309                                            const char *pkcs11_engine_path,
2310                                            const char *pkcs11_module_path)
2311 {
2312         char *pkcs11_engine_path_copy = NULL;
2313         char *pkcs11_module_path_copy = NULL;
2314
2315         if (pkcs11_engine_path != NULL) {
2316                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2317                 if (pkcs11_engine_path_copy == NULL)
2318                         return -1;
2319         }
2320         if (pkcs11_module_path != NULL) {
2321                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2322                 if (pkcs11_module_path_copy == NULL) {
2323                         os_free(pkcs11_engine_path_copy);
2324                         return -1;
2325                 }
2326         }
2327
2328         os_free(wpa_s->conf->pkcs11_engine_path);
2329         os_free(wpa_s->conf->pkcs11_module_path);
2330         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2331         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2332
2333         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2334         eapol_sm_deinit(wpa_s->eapol);
2335         wpa_s->eapol = NULL;
2336         if (wpa_supplicant_init_eapol(wpa_s)) {
2337                 /* Error -> Reset paths to the default value (NULL) once. */
2338                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2339                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2340                                                                NULL);
2341
2342                 return -1;
2343         }
2344         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2345
2346         return 0;
2347 }
2348
2349
2350 /**
2351  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2352  * @wpa_s: wpa_supplicant structure for a network interface
2353  * @ap_scan: AP scan mode
2354  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2355  *
2356  */
2357 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2358 {
2359
2360         int old_ap_scan;
2361
2362         if (ap_scan < 0 || ap_scan > 2)
2363                 return -1;
2364
2365 #ifdef ANDROID
2366         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2367             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2368             wpa_s->wpa_state < WPA_COMPLETED) {
2369                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2370                            "associating", wpa_s->conf->ap_scan, ap_scan);
2371                 return 0;
2372         }
2373 #endif /* ANDROID */
2374
2375         old_ap_scan = wpa_s->conf->ap_scan;
2376         wpa_s->conf->ap_scan = ap_scan;
2377
2378         if (old_ap_scan != wpa_s->conf->ap_scan)
2379                 wpas_notify_ap_scan_changed(wpa_s);
2380
2381         return 0;
2382 }
2383
2384
2385 /**
2386  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2387  * @wpa_s: wpa_supplicant structure for a network interface
2388  * @expire_age: Expiration age in seconds
2389  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2390  *
2391  */
2392 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2393                                           unsigned int bss_expire_age)
2394 {
2395         if (bss_expire_age < 10) {
2396                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2397                         bss_expire_age);
2398                 return -1;
2399         }
2400         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2401                 bss_expire_age);
2402         wpa_s->conf->bss_expiration_age = bss_expire_age;
2403
2404         return 0;
2405 }
2406
2407
2408 /**
2409  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2410  * @wpa_s: wpa_supplicant structure for a network interface
2411  * @expire_count: number of scans after which an unseen BSS is reclaimed
2412  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2413  *
2414  */
2415 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2416                                             unsigned int bss_expire_count)
2417 {
2418         if (bss_expire_count < 1) {
2419                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2420                         bss_expire_count);
2421                 return -1;
2422         }
2423         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2424                 bss_expire_count);
2425         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2426
2427         return 0;
2428 }
2429
2430
2431 /**
2432  * wpa_supplicant_set_scan_interval - Set scan interval
2433  * @wpa_s: wpa_supplicant structure for a network interface
2434  * @scan_interval: scan interval in seconds
2435  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2436  *
2437  */
2438 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2439                                      int scan_interval)
2440 {
2441         if (scan_interval < 0) {
2442                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2443                         scan_interval);
2444                 return -1;
2445         }
2446         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2447                 scan_interval);
2448         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2449
2450         return 0;
2451 }
2452
2453
2454 /**
2455  * wpa_supplicant_set_debug_params - Set global debug params
2456  * @global: wpa_global structure
2457  * @debug_level: debug level
2458  * @debug_timestamp: determines if show timestamp in debug data
2459  * @debug_show_keys: determines if show keys in debug data
2460  * Returns: 0 if succeed or -1 if debug_level has wrong value
2461  */
2462 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2463                                     int debug_timestamp, int debug_show_keys)
2464 {
2465
2466         int old_level, old_timestamp, old_show_keys;
2467
2468         /* check for allowed debuglevels */
2469         if (debug_level != MSG_EXCESSIVE &&
2470             debug_level != MSG_MSGDUMP &&
2471             debug_level != MSG_DEBUG &&
2472             debug_level != MSG_INFO &&
2473             debug_level != MSG_WARNING &&
2474             debug_level != MSG_ERROR)
2475                 return -1;
2476
2477         old_level = wpa_debug_level;
2478         old_timestamp = wpa_debug_timestamp;
2479         old_show_keys = wpa_debug_show_keys;
2480
2481         wpa_debug_level = debug_level;
2482         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2483         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2484
2485         if (wpa_debug_level != old_level)
2486                 wpas_notify_debug_level_changed(global);
2487         if (wpa_debug_timestamp != old_timestamp)
2488                 wpas_notify_debug_timestamp_changed(global);
2489         if (wpa_debug_show_keys != old_show_keys)
2490                 wpas_notify_debug_show_keys_changed(global);
2491
2492         return 0;
2493 }
2494
2495
2496 /**
2497  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2498  * @wpa_s: Pointer to wpa_supplicant data
2499  * Returns: A pointer to the current network structure or %NULL on failure
2500  */
2501 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2502 {
2503         struct wpa_ssid *entry;
2504         u8 ssid[MAX_SSID_LEN];
2505         int res;
2506         size_t ssid_len;
2507         u8 bssid[ETH_ALEN];
2508         int wired;
2509
2510         res = wpa_drv_get_ssid(wpa_s, ssid);
2511         if (res < 0) {
2512                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2513                         "driver");
2514                 return NULL;
2515         }
2516         ssid_len = res;
2517
2518         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2519                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2520                         "driver");
2521                 return NULL;
2522         }
2523
2524         wired = wpa_s->conf->ap_scan == 0 &&
2525                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2526
2527         entry = wpa_s->conf->ssid;
2528         while (entry) {
2529                 if (!wpas_network_disabled(wpa_s, entry) &&
2530                     ((ssid_len == entry->ssid_len &&
2531                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2532                     (!entry->bssid_set ||
2533                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2534                         return entry;
2535 #ifdef CONFIG_WPS
2536                 if (!wpas_network_disabled(wpa_s, entry) &&
2537                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2538                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2539                     (!entry->bssid_set ||
2540                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2541                         return entry;
2542 #endif /* CONFIG_WPS */
2543
2544                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2545                     entry->ssid_len == 0 &&
2546                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2547                         return entry;
2548
2549                 entry = entry->next;
2550         }
2551
2552         return NULL;
2553 }
2554
2555
2556 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2557 {
2558         struct wpa_global *global = wpa_s->global;
2559
2560         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2561                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2562                 if (global->drv_priv[i] == NULL) {
2563                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2564                                    "'%s'", wpa_drivers[i]->name);
2565                         return -1;
2566                 }
2567         }
2568
2569         wpa_s->driver = wpa_drivers[i];
2570         wpa_s->global_drv_priv = global->drv_priv[i];
2571
2572         return 0;
2573 }
2574
2575
2576 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2577                                      const char *name)
2578 {
2579         int i;
2580         size_t len;
2581         const char *pos, *driver = name;
2582
2583         if (wpa_s == NULL)
2584                 return -1;
2585
2586         if (wpa_drivers[0] == NULL) {
2587                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2588                         "wpa_supplicant");
2589                 return -1;
2590         }
2591
2592         if (name == NULL) {
2593                 /* default to first driver in the list */
2594                 return select_driver(wpa_s, 0);
2595         }
2596
2597         do {
2598                 pos = os_strchr(driver, ',');
2599                 if (pos)
2600                         len = pos - driver;
2601                 else
2602                         len = os_strlen(driver);
2603
2604                 for (i = 0; wpa_drivers[i]; i++) {
2605                         if (os_strlen(wpa_drivers[i]->name) == len &&
2606                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2607                             0) {
2608                                 /* First driver that succeeds wins */
2609                                 if (select_driver(wpa_s, i) == 0)
2610                                         return 0;
2611                         }
2612                 }
2613
2614                 driver = pos + 1;
2615         } while (pos);
2616
2617         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2618         return -1;
2619 }
2620
2621
2622 /**
2623  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2624  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2625  *      with struct wpa_driver_ops::init()
2626  * @src_addr: Source address of the EAPOL frame
2627  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2628  * @len: Length of the EAPOL data
2629  *
2630  * This function is called for each received EAPOL frame. Most driver
2631  * interfaces rely on more generic OS mechanism for receiving frames through
2632  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2633  * take care of received EAPOL frames and deliver them to the core supplicant
2634  * code by calling this function.
2635  */
2636 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2637                              const u8 *buf, size_t len)
2638 {
2639         struct wpa_supplicant *wpa_s = ctx;
2640
2641         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2642         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2643
2644 #ifdef CONFIG_PEERKEY
2645         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
2646             wpa_s->current_ssid->peerkey &&
2647             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2648             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
2649                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
2650                 return;
2651         }
2652 #endif /* CONFIG_PEERKEY */
2653
2654         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
2655             (wpa_s->last_eapol_matches_bssid &&
2656 #ifdef CONFIG_AP
2657              !wpa_s->ap_iface &&
2658 #endif /* CONFIG_AP */
2659              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
2660                 /*
2661                  * There is possible race condition between receiving the
2662                  * association event and the EAPOL frame since they are coming
2663                  * through different paths from the driver. In order to avoid
2664                  * issues in trying to process the EAPOL frame before receiving
2665                  * association information, lets queue it for processing until
2666                  * the association event is received. This may also be needed in
2667                  * driver-based roaming case, so also use src_addr != BSSID as a
2668                  * trigger if we have previously confirmed that the
2669                  * Authenticator uses BSSID as the src_addr (which is not the
2670                  * case with wired IEEE 802.1X).
2671                  */
2672                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
2673                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
2674                         wpa_supplicant_state_txt(wpa_s->wpa_state),
2675                         MAC2STR(wpa_s->bssid));
2676                 wpabuf_free(wpa_s->pending_eapol_rx);
2677                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
2678                 if (wpa_s->pending_eapol_rx) {
2679                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
2680                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
2681                                   ETH_ALEN);
2682                 }
2683                 return;
2684         }
2685
2686         wpa_s->last_eapol_matches_bssid =
2687                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
2688
2689 #ifdef CONFIG_AP
2690         if (wpa_s->ap_iface) {
2691                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
2692                 return;
2693         }
2694 #endif /* CONFIG_AP */
2695
2696         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2697                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
2698                         "no key management is configured");
2699                 return;
2700         }
2701
2702         if (wpa_s->eapol_received == 0 &&
2703             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
2704              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
2705              wpa_s->wpa_state != WPA_COMPLETED) &&
2706             (wpa_s->current_ssid == NULL ||
2707              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
2708                 /* Timeout for completing IEEE 802.1X and WPA authentication */
2709                 wpa_supplicant_req_auth_timeout(
2710                         wpa_s,
2711                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2712                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
2713                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
2714                         70 : 10, 0);
2715         }
2716         wpa_s->eapol_received++;
2717
2718         if (wpa_s->countermeasures) {
2719                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
2720                         "EAPOL packet");
2721                 return;
2722         }
2723
2724 #ifdef CONFIG_IBSS_RSN
2725         if (wpa_s->current_ssid &&
2726             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
2727                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
2728                 return;
2729         }
2730 #endif /* CONFIG_IBSS_RSN */
2731
2732         /* Source address of the incoming EAPOL frame could be compared to the
2733          * current BSSID. However, it is possible that a centralized
2734          * Authenticator could be using another MAC address than the BSSID of
2735          * an AP, so just allow any address to be used for now. The replies are
2736          * still sent to the current BSSID (if available), though. */
2737
2738         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
2739         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
2740             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
2741                 return;
2742         wpa_drv_poll(wpa_s);
2743         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
2744                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
2745         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
2746                 /*
2747                  * Set portValid = TRUE here since we are going to skip 4-way
2748                  * handshake processing which would normally set portValid. We
2749                  * need this to allow the EAPOL state machines to be completed
2750                  * without going through EAPOL-Key handshake.
2751                  */
2752                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
2753         }
2754 }
2755
2756
2757 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
2758 {
2759         if (wpa_s->driver->send_eapol) {
2760                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
2761                 if (addr)
2762                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
2763         } else if ((!wpa_s->p2p_mgmt ||
2764                     !(wpa_s->drv_flags &
2765                       WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
2766                    !(wpa_s->drv_flags &
2767                      WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
2768                 l2_packet_deinit(wpa_s->l2);
2769                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
2770                                            wpa_drv_get_mac_addr(wpa_s),
2771                                            ETH_P_EAPOL,
2772                                            wpa_supplicant_rx_eapol, wpa_s, 0);
2773                 if (wpa_s->l2 == NULL)
2774                         return -1;
2775         } else {
2776                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
2777                 if (addr)
2778                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
2779         }
2780
2781         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
2782                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
2783                 return -1;
2784         }
2785
2786         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
2787
2788         return 0;
2789 }
2790
2791
2792 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
2793                                            const u8 *buf, size_t len)
2794 {
2795         struct wpa_supplicant *wpa_s = ctx;
2796         const struct l2_ethhdr *eth;
2797
2798         if (len < sizeof(*eth))
2799                 return;
2800         eth = (const struct l2_ethhdr *) buf;
2801
2802         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
2803             !(eth->h_dest[0] & 0x01)) {
2804                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
2805                         " (bridge - not for this interface - ignore)",
2806                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
2807                 return;
2808         }
2809
2810         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
2811                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
2812         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
2813                                 len - sizeof(*eth));
2814 }
2815
2816
2817 /**
2818  * wpa_supplicant_driver_init - Initialize driver interface parameters
2819  * @wpa_s: Pointer to wpa_supplicant data
2820  * Returns: 0 on success, -1 on failure
2821  *
2822  * This function is called to initialize driver interface parameters.
2823  * wpa_drv_init() must have been called before this function to initialize the
2824  * driver interface.
2825  */
2826 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
2827 {
2828         static int interface_count = 0;
2829
2830         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
2831                 return -1;
2832
2833         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
2834                 MAC2STR(wpa_s->own_addr));
2835         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
2836         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
2837
2838         if (wpa_s->bridge_ifname[0]) {
2839                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
2840                         "interface '%s'", wpa_s->bridge_ifname);
2841                 wpa_s->l2_br = l2_packet_init(wpa_s->bridge_ifname,
2842                                               wpa_s->own_addr,
2843                                               ETH_P_EAPOL,
2844                                               wpa_supplicant_rx_eapol_bridge,
2845                                               wpa_s, 1);
2846                 if (wpa_s->l2_br == NULL) {
2847                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
2848                                 "connection for the bridge interface '%s'",
2849                                 wpa_s->bridge_ifname);
2850                         return -1;
2851                 }
2852         }
2853
2854         wpa_clear_keys(wpa_s, NULL);
2855
2856         /* Make sure that TKIP countermeasures are not left enabled (could
2857          * happen if wpa_supplicant is killed during countermeasures. */
2858         wpa_drv_set_countermeasures(wpa_s, 0);
2859
2860         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
2861         wpa_drv_flush_pmkid(wpa_s);
2862
2863         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
2864         wpa_s->prev_scan_wildcard = 0;
2865
2866         if (wpa_supplicant_enabled_networks(wpa_s)) {
2867                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
2868                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2869                         interface_count = 0;
2870                 }
2871                 if (!wpa_s->p2p_mgmt &&
2872                     wpa_supplicant_delayed_sched_scan(wpa_s,
2873                                                       interface_count % 3,
2874                                                       100000))
2875                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
2876                                                 100000);
2877                 interface_count++;
2878         } else
2879                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
2880
2881         return 0;
2882 }
2883
2884
2885 static int wpa_supplicant_daemon(const char *pid_file)
2886 {
2887         wpa_printf(MSG_DEBUG, "Daemonize..");
2888         return os_daemonize(pid_file);
2889 }
2890
2891
2892 static struct wpa_supplicant * wpa_supplicant_alloc(void)
2893 {
2894         struct wpa_supplicant *wpa_s;
2895
2896         wpa_s = os_zalloc(sizeof(*wpa_s));
2897         if (wpa_s == NULL)
2898                 return NULL;
2899         wpa_s->scan_req = INITIAL_SCAN_REQ;
2900         wpa_s->scan_interval = 5;
2901         wpa_s->new_connection = 1;
2902         wpa_s->parent = wpa_s;
2903         wpa_s->sched_scanning = 0;
2904
2905         return wpa_s;
2906 }
2907
2908
2909 #ifdef CONFIG_HT_OVERRIDES
2910
2911 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
2912                              struct ieee80211_ht_capabilities *htcaps,
2913                              struct ieee80211_ht_capabilities *htcaps_mask,
2914                              const char *ht_mcs)
2915 {
2916         /* parse ht_mcs into hex array */
2917         int i;
2918         const char *tmp = ht_mcs;
2919         char *end = NULL;
2920
2921         /* If ht_mcs is null, do not set anything */
2922         if (!ht_mcs)
2923                 return 0;
2924
2925         /* This is what we are setting in the kernel */
2926         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
2927
2928         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
2929
2930         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
2931                 errno = 0;
2932                 long v = strtol(tmp, &end, 16);
2933                 if (errno == 0) {
2934                         wpa_msg(wpa_s, MSG_DEBUG,
2935                                 "htcap value[%i]: %ld end: %p  tmp: %p",
2936                                 i, v, end, tmp);
2937                         if (end == tmp)
2938                                 break;
2939
2940                         htcaps->supported_mcs_set[i] = v;
2941                         tmp = end;
2942                 } else {
2943                         wpa_msg(wpa_s, MSG_ERROR,
2944                                 "Failed to parse ht-mcs: %s, error: %s\n",
2945                                 ht_mcs, strerror(errno));
2946                         return -1;
2947                 }
2948         }
2949
2950         /*
2951          * If we were able to parse any values, then set mask for the MCS set.
2952          */
2953         if (i) {
2954                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
2955                           IEEE80211_HT_MCS_MASK_LEN - 1);
2956                 /* skip the 3 reserved bits */
2957                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
2958                         0x1f;
2959         }
2960
2961         return 0;
2962 }
2963
2964
2965 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
2966                                  struct ieee80211_ht_capabilities *htcaps,
2967                                  struct ieee80211_ht_capabilities *htcaps_mask,
2968                                  int disabled)
2969 {
2970         le16 msk;
2971
2972         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
2973
2974         if (disabled == -1)
2975                 return 0;
2976
2977         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
2978         htcaps_mask->ht_capabilities_info |= msk;
2979         if (disabled)
2980                 htcaps->ht_capabilities_info &= msk;
2981         else
2982                 htcaps->ht_capabilities_info |= msk;
2983
2984         return 0;
2985 }
2986
2987
2988 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
2989                                 struct ieee80211_ht_capabilities *htcaps,
2990                                 struct ieee80211_ht_capabilities *htcaps_mask,
2991                                 int factor)
2992 {
2993         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
2994
2995         if (factor == -1)
2996                 return 0;
2997
2998         if (factor < 0 || factor > 3) {
2999                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3000                         "Must be 0-3 or -1", factor);
3001                 return -EINVAL;
3002         }
3003
3004         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3005         htcaps->a_mpdu_params &= ~0x3;
3006         htcaps->a_mpdu_params |= factor & 0x3;
3007
3008         return 0;
3009 }
3010
3011
3012 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3013                                  struct ieee80211_ht_capabilities *htcaps,
3014                                  struct ieee80211_ht_capabilities *htcaps_mask,
3015                                  int density)
3016 {
3017         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3018
3019         if (density == -1)
3020                 return 0;
3021
3022         if (density < 0 || density > 7) {
3023                 wpa_msg(wpa_s, MSG_ERROR,
3024                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3025                         density);
3026                 return -EINVAL;
3027         }
3028
3029         htcaps_mask->a_mpdu_params |= 0x1C;
3030         htcaps->a_mpdu_params &= ~(0x1C);
3031         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3032
3033         return 0;
3034 }
3035
3036
3037 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3038                                 struct ieee80211_ht_capabilities *htcaps,
3039                                 struct ieee80211_ht_capabilities *htcaps_mask,
3040                                 int disabled)
3041 {
3042         /* Masking these out disables HT40 */
3043         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3044                                 HT_CAP_INFO_SHORT_GI40MHZ);
3045
3046         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3047
3048         if (disabled)
3049                 htcaps->ht_capabilities_info &= ~msk;
3050         else
3051                 htcaps->ht_capabilities_info |= msk;
3052
3053         htcaps_mask->ht_capabilities_info |= msk;
3054
3055         return 0;
3056 }
3057
3058
3059 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3060                                struct ieee80211_ht_capabilities *htcaps,
3061                                struct ieee80211_ht_capabilities *htcaps_mask,
3062                                int disabled)
3063 {
3064         /* Masking these out disables SGI */
3065         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3066                                 HT_CAP_INFO_SHORT_GI40MHZ);
3067
3068         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3069
3070         if (disabled)
3071                 htcaps->ht_capabilities_info &= ~msk;
3072         else
3073                 htcaps->ht_capabilities_info |= msk;
3074
3075         htcaps_mask->ht_capabilities_info |= msk;
3076
3077         return 0;
3078 }
3079
3080
3081 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3082                                struct ieee80211_ht_capabilities *htcaps,
3083                                struct ieee80211_ht_capabilities *htcaps_mask,
3084                                int disabled)
3085 {
3086         /* Masking these out disables LDPC */
3087         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3088
3089         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3090
3091         if (disabled)
3092                 htcaps->ht_capabilities_info &= ~msk;
3093         else
3094                 htcaps->ht_capabilities_info |= msk;
3095
3096         htcaps_mask->ht_capabilities_info |= msk;
3097
3098         return 0;
3099 }
3100
3101
3102 void wpa_supplicant_apply_ht_overrides(
3103         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3104         struct wpa_driver_associate_params *params)
3105 {
3106         struct ieee80211_ht_capabilities *htcaps;
3107         struct ieee80211_ht_capabilities *htcaps_mask;
3108
3109         if (!ssid)
3110                 return;
3111
3112         params->disable_ht = ssid->disable_ht;
3113         if (!params->htcaps || !params->htcaps_mask)
3114                 return;
3115
3116         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3117         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3118         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3119         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3120                               ssid->disable_max_amsdu);
3121         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3122         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3123         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3124         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3125         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3126
3127         if (ssid->ht40_intolerant) {
3128                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3129                 htcaps->ht_capabilities_info |= bit;
3130                 htcaps_mask->ht_capabilities_info |= bit;
3131         }
3132 }
3133
3134 #endif /* CONFIG_HT_OVERRIDES */
3135
3136
3137 #ifdef CONFIG_VHT_OVERRIDES
3138 void wpa_supplicant_apply_vht_overrides(
3139         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3140         struct wpa_driver_associate_params *params)
3141 {
3142         struct ieee80211_vht_capabilities *vhtcaps;
3143         struct ieee80211_vht_capabilities *vhtcaps_mask;
3144 #ifdef CONFIG_HT_OVERRIDES
3145         int max_ampdu;
3146         const u32 max_ampdu_mask = VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX;
3147 #endif /* CONFIG_HT_OVERRIDES */
3148
3149         if (!ssid)
3150                 return;
3151
3152         params->disable_vht = ssid->disable_vht;
3153
3154         vhtcaps = (void *) params->vhtcaps;
3155         vhtcaps_mask = (void *) params->vhtcaps_mask;
3156
3157         if (!vhtcaps || !vhtcaps_mask)
3158                 return;
3159
3160         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3161         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3162
3163 #ifdef CONFIG_HT_OVERRIDES
3164         /* if max ampdu is <= 3, we have to make the HT cap the same */
3165         if (ssid->vht_capa_mask & max_ampdu_mask) {
3166                 max_ampdu = (ssid->vht_capa & max_ampdu_mask) >>
3167                         find_first_bit(max_ampdu_mask);
3168
3169                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3170                 wpa_set_ampdu_factor(wpa_s,
3171                                      (void *) params->htcaps,
3172                                      (void *) params->htcaps_mask,
3173                                      max_ampdu);
3174         }
3175 #endif /* CONFIG_HT_OVERRIDES */
3176
3177 #define OVERRIDE_MCS(i)                                                 \
3178         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3179                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3180                         3 << 2 * (i - 1);                               \
3181                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3182                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3183         }                                                               \
3184         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3185                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3186                         3 << 2 * (i - 1);                               \
3187                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3188                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3189         }
3190
3191         OVERRIDE_MCS(1);
3192         OVERRIDE_MCS(2);
3193         OVERRIDE_MCS(3);
3194         OVERRIDE_MCS(4);
3195         OVERRIDE_MCS(5);
3196         OVERRIDE_MCS(6);
3197         OVERRIDE_MCS(7);
3198         OVERRIDE_MCS(8);
3199 }
3200 #endif /* CONFIG_VHT_OVERRIDES */
3201
3202
3203 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3204 {
3205 #ifdef PCSC_FUNCS
3206         size_t len;
3207
3208         if (!wpa_s->conf->pcsc_reader)
3209                 return 0;
3210
3211         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3212         if (!wpa_s->scard)
3213                 return 1;
3214
3215         if (wpa_s->conf->pcsc_pin &&
3216             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3217                 scard_deinit(wpa_s->scard);
3218                 wpa_s->scard = NULL;
3219                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3220                 return -1;
3221         }
3222
3223         len = sizeof(wpa_s->imsi) - 1;
3224         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3225                 scard_deinit(wpa_s->scard);
3226                 wpa_s->scard = NULL;
3227                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3228                 return -1;
3229         }
3230         wpa_s->imsi[len] = '\0';
3231
3232         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3233
3234         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3235                    wpa_s->imsi, wpa_s->mnc_len);
3236
3237         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3238         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3239 #endif /* PCSC_FUNCS */
3240
3241         return 0;
3242 }
3243
3244
3245 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3246 {
3247         char *val, *pos;
3248
3249         ext_password_deinit(wpa_s->ext_pw);
3250         wpa_s->ext_pw = NULL;
3251         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3252
3253         if (!wpa_s->conf->ext_password_backend)
3254                 return 0;
3255
3256         val = os_strdup(wpa_s->conf->ext_password_backend);
3257         if (val == NULL)
3258                 return -1;
3259         pos = os_strchr(val, ':');
3260         if (pos)
3261                 *pos++ = '\0';
3262
3263         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3264
3265         wpa_s->ext_pw = ext_password_init(val, pos);
3266         os_free(val);
3267         if (wpa_s->ext_pw == NULL) {
3268                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3269                 return -1;
3270         }
3271         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3272
3273         return 0;
3274 }
3275
3276
3277 static int wpas_check_wowlan_trigger(const char *start, const char *trigger,
3278                                      int capa_trigger, u8 *param_trigger)
3279 {
3280         if (os_strcmp(start, trigger) != 0)
3281                 return 0;
3282         if (!capa_trigger)
3283                 return 0;
3284
3285         *param_trigger = 1;
3286         return 1;
3287 }
3288
3289
3290 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3291                                     const struct wpa_driver_capa *capa)
3292 {
3293         struct wowlan_triggers triggers;
3294         char *start, *end, *buf;
3295         int last, ret;
3296
3297         if (!wpa_s->conf->wowlan_triggers)
3298                 return 0;
3299
3300         buf = os_strdup(wpa_s->conf->wowlan_triggers);
3301         if (buf == NULL)
3302                 return -1;
3303
3304         os_memset(&triggers, 0, sizeof(triggers));
3305
3306 #define CHECK_TRIGGER(trigger) \
3307         wpas_check_wowlan_trigger(start, #trigger,                      \
3308                                   capa->wowlan_triggers.trigger,        \
3309                                   &triggers.trigger)
3310
3311         start = buf;
3312         while (*start != '\0') {
3313                 while (isblank(*start))
3314                         start++;
3315                 if (*start == '\0')
3316                         break;
3317                 end = start;
3318                 while (!isblank(*end) && *end != '\0')
3319                         end++;
3320                 last = *end == '\0';
3321                 *end = '\0';
3322
3323                 if (!CHECK_TRIGGER(any) &&
3324                     !CHECK_TRIGGER(disconnect) &&
3325                     !CHECK_TRIGGER(magic_pkt) &&
3326                     !CHECK_TRIGGER(gtk_rekey_failure) &&
3327                     !CHECK_TRIGGER(eap_identity_req) &&
3328                     !CHECK_TRIGGER(four_way_handshake) &&
3329                     !CHECK_TRIGGER(rfkill_release)) {
3330                         wpa_printf(MSG_DEBUG,
3331                                    "Unknown/unsupported wowlan trigger '%s'",
3332                                    start);
3333                         ret = -1;
3334                         goto out;
3335                 }
3336
3337                 if (last)
3338                         break;
3339                 start = end + 1;
3340         }
3341 #undef CHECK_TRIGGER
3342
3343         ret = wpa_drv_wowlan(wpa_s, &triggers);
3344 out:
3345         os_free(buf);
3346         return ret;
3347 }
3348
3349
3350 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3351                                               const char *rn)
3352 {
3353         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3354         struct wpa_radio *radio;
3355
3356         while (rn && iface) {
3357                 radio = iface->radio;
3358                 if (radio && os_strcmp(rn, radio->name) == 0) {
3359                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3360                                    wpa_s->ifname, rn);
3361                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3362                         return radio;
3363                 }
3364
3365                 iface = iface->next;
3366         }
3367
3368         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3369                    wpa_s->ifname, rn ? rn : "N/A");
3370         radio = os_zalloc(sizeof(*radio));
3371         if (radio == NULL)
3372                 return NULL;
3373
3374         if (rn)
3375                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3376         dl_list_init(&radio->ifaces);
3377         dl_list_init(&radio->work);
3378         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3379
3380         return radio;
3381 }
3382
3383
3384 static void radio_work_free(struct wpa_radio_work *work)
3385 {
3386         if (work->wpa_s->scan_work == work) {
3387                 /* This should not really happen. */
3388                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3389                         work->type, work, work->started);
3390                 work->wpa_s->scan_work = NULL;
3391         }
3392
3393 #ifdef CONFIG_P2P
3394         if (work->wpa_s->p2p_scan_work == work) {
3395                 /* This should not really happen. */
3396                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3397                         work->type, work, work->started);
3398                 work->wpa_s->p2p_scan_work = NULL;
3399         }
3400 #endif /* CONFIG_P2P */
3401
3402         dl_list_del(&work->list);
3403         os_free(work);
3404 }
3405
3406
3407 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3408 {
3409         struct wpa_radio *radio = eloop_ctx;
3410         struct wpa_radio_work *work;
3411         struct os_reltime now, diff;
3412         struct wpa_supplicant *wpa_s;
3413
3414         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3415         if (work == NULL)
3416                 return;
3417
3418         if (work->started)
3419                 return; /* already started and still in progress */
3420
3421         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3422                               radio_list);
3423         if (wpa_s && wpa_s->external_scan_running) {
3424                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3425                 return;
3426         }
3427
3428         os_get_reltime(&now);
3429         os_reltime_sub(&now, &work->time, &diff);
3430         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3431                 work->type, work, diff.sec, diff.usec);
3432         work->started = 1;
3433         work->time = now;
3434         work->cb(work, 0);
3435 }
3436
3437
3438 /*
3439  * This function removes both started and pending radio works running on
3440  * the provided interface's radio.
3441  * Prior to the removal of the radio work, its callback (cb) is called with
3442  * deinit set to be 1. Each work's callback is responsible for clearing its
3443  * internal data and restoring to a correct state.
3444  * @wpa_s: wpa_supplicant data
3445  * @type: type of works to be removed
3446  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3447  * this interface's works.
3448  */
3449 void radio_remove_works(struct wpa_supplicant *wpa_s,
3450                         const char *type, int remove_all)
3451 {
3452         struct wpa_radio_work *work, *tmp;
3453         struct wpa_radio *radio = wpa_s->radio;
3454
3455         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3456                               list) {
3457                 if (type && os_strcmp(type, work->type) != 0)
3458                         continue;
3459
3460                 /* skip other ifaces' works */
3461                 if (!remove_all && work->wpa_s != wpa_s)
3462                         continue;
3463
3464                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3465                         work->type, work, work->started ? " (started)" : "");
3466                 work->cb(work, 1);
3467                 radio_work_free(work);
3468         }
3469
3470         /* in case we removed the started work */
3471         radio_work_check_next(wpa_s);
3472 }
3473
3474
3475 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3476 {
3477         struct wpa_radio *radio = wpa_s->radio;
3478
3479         if (!radio)
3480                 return;
3481
3482         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3483                    wpa_s->ifname, radio->name);
3484         dl_list_del(&wpa_s->radio_list);
3485         radio_remove_works(wpa_s, NULL, 0);
3486         wpa_s->radio = NULL;
3487         if (!dl_list_empty(&radio->ifaces))
3488                 return; /* Interfaces remain for this radio */
3489
3490         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3491         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3492         os_free(radio);
3493 }
3494
3495
3496 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3497 {
3498         struct wpa_radio *radio = wpa_s->radio;
3499
3500         if (dl_list_empty(&radio->work))
3501                 return;
3502         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3503         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3504 }
3505
3506
3507 /**
3508  * radio_add_work - Add a radio work item
3509  * @wpa_s: Pointer to wpa_supplicant data
3510  * @freq: Frequency of the offchannel operation in MHz or 0
3511  * @type: Unique identifier for each type of work
3512  * @next: Force as the next work to be executed
3513  * @cb: Callback function for indicating when radio is available
3514  * @ctx: Context pointer for the work (work->ctx in cb())
3515  * Returns: 0 on success, -1 on failure
3516  *
3517  * This function is used to request time for an operation that requires
3518  * exclusive radio control. Once the radio is available, the registered callback
3519  * function will be called. radio_work_done() must be called once the exclusive
3520  * radio operation has been completed, so that the radio is freed for other
3521  * operations. The special case of deinit=1 is used to free the context data
3522  * during interface removal. That does not allow the callback function to start
3523  * the radio operation, i.e., it must free any resources allocated for the radio
3524  * work and return.
3525  *
3526  * The @freq parameter can be used to indicate a single channel on which the
3527  * offchannel operation will occur. This may allow multiple radio work
3528  * operations to be performed in parallel if they apply for the same channel.
3529  * Setting this to 0 indicates that the work item may use multiple channels or
3530  * requires exclusive control of the radio.
3531  */
3532 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3533                    const char *type, int next,
3534                    void (*cb)(struct wpa_radio_work *work, int deinit),
3535                    void *ctx)
3536 {
3537         struct wpa_radio_work *work;
3538         int was_empty;
3539
3540         work = os_zalloc(sizeof(*work));
3541         if (work == NULL)
3542                 return -1;
3543         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3544         os_get_reltime(&work->time);
3545         work->freq = freq;
3546         work->type = type;
3547         work->wpa_s = wpa_s;
3548         work->cb = cb;
3549         work->ctx = ctx;
3550
3551         was_empty = dl_list_empty(&wpa_s->radio->work);
3552         if (next)
3553                 dl_list_add(&wpa_s->radio->work, &work->list);
3554         else
3555                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3556         if (was_empty) {
3557                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3558                 radio_work_check_next(wpa_s);
3559         }
3560
3561         return 0;
3562 }
3563
3564
3565 /**
3566  * radio_work_done - Indicate that a radio work item has been completed
3567  * @work: Completed work
3568  *
3569  * This function is called once the callback function registered with
3570  * radio_add_work() has completed its work.
3571  */
3572 void radio_work_done(struct wpa_radio_work *work)
3573 {
3574         struct wpa_supplicant *wpa_s = work->wpa_s;
3575         struct os_reltime now, diff;
3576         unsigned int started = work->started;
3577
3578         os_get_reltime(&now);
3579         os_reltime_sub(&now, &work->time, &diff);
3580         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3581                 work->type, work, started ? "done" : "canceled",
3582                 diff.sec, diff.usec);
3583         radio_work_free(work);
3584         if (started)
3585                 radio_work_check_next(wpa_s);
3586 }
3587
3588
3589 int radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3590 {
3591         struct wpa_radio_work *work;
3592         struct wpa_radio *radio = wpa_s->radio;
3593
3594         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3595                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3596                         return 1;
3597         }
3598
3599         return 0;
3600 }
3601
3602
3603 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3604                             struct wpa_interface *iface)
3605 {
3606         const char *ifname, *driver, *rn;
3607
3608         driver = iface->driver;
3609 next_driver:
3610         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3611                 return -1;
3612
3613         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3614         if (wpa_s->drv_priv == NULL) {
3615                 const char *pos;
3616                 pos = driver ? os_strchr(driver, ',') : NULL;
3617                 if (pos) {
3618                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3619                                 "driver interface - try next driver wrapper");
3620                         driver = pos + 1;
3621                         goto next_driver;
3622                 }
3623                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3624                         "interface");
3625                 return -1;
3626         }
3627         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3628                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3629                         "driver_param '%s'", wpa_s->conf->driver_param);
3630                 return -1;
3631         }
3632
3633         ifname = wpa_drv_get_ifname(wpa_s);
3634         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3635                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3636                         "interface name with '%s'", ifname);
3637                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3638         }
3639
3640         rn = wpa_driver_get_radio_name(wpa_s);
3641         if (rn && rn[0] == '\0')
3642                 rn = NULL;
3643
3644         wpa_s->radio = radio_add_interface(wpa_s, rn);
3645         if (wpa_s->radio == NULL)
3646                 return -1;
3647
3648         return 0;
3649 }
3650
3651
3652 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3653                                      struct wpa_interface *iface)
3654 {
3655         struct wpa_driver_capa capa;
3656         int capa_res;
3657
3658         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3659                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3660                    iface->confname ? iface->confname : "N/A",
3661                    iface->driver ? iface->driver : "default",
3662                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3663                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3664
3665         if (iface->confname) {
3666 #ifdef CONFIG_BACKEND_FILE
3667                 wpa_s->confname = os_rel2abs_path(iface->confname);
3668                 if (wpa_s->confname == NULL) {
3669                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3670                                    "for configuration file '%s'.",
3671                                    iface->confname);
3672                         return -1;
3673                 }
3674                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3675                            iface->confname, wpa_s->confname);
3676 #else /* CONFIG_BACKEND_FILE */
3677                 wpa_s->confname = os_strdup(iface->confname);
3678 #endif /* CONFIG_BACKEND_FILE */
3679                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3680                 if (wpa_s->conf == NULL) {
3681                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3682                                    "configuration '%s'.", wpa_s->confname);
3683                         return -1;
3684                 }
3685                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3686                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3687
3688                 /*
3689                  * Override ctrl_interface and driver_param if set on command
3690                  * line.
3691                  */
3692                 if (iface->ctrl_interface) {
3693                         os_free(wpa_s->conf->ctrl_interface);
3694                         wpa_s->conf->ctrl_interface =
3695                                 os_strdup(iface->ctrl_interface);
3696                 }
3697
3698                 if (iface->driver_param) {
3699                         os_free(wpa_s->conf->driver_param);
3700                         wpa_s->conf->driver_param =
3701                                 os_strdup(iface->driver_param);
3702                 }
3703
3704                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
3705                         os_free(wpa_s->conf->ctrl_interface);
3706                         wpa_s->conf->ctrl_interface = NULL;
3707                 }
3708         } else
3709                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
3710                                                      iface->driver_param);
3711
3712         if (wpa_s->conf == NULL) {
3713                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
3714                 return -1;
3715         }
3716
3717         if (iface->ifname == NULL) {
3718                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
3719                 return -1;
3720         }
3721         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
3722                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
3723                            iface->ifname);
3724                 return -1;
3725         }
3726         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
3727
3728         if (iface->bridge_ifname) {
3729                 if (os_strlen(iface->bridge_ifname) >=
3730                     sizeof(wpa_s->bridge_ifname)) {
3731                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
3732                                    "name '%s'.", iface->bridge_ifname);
3733                         return -1;
3734                 }
3735                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
3736                            sizeof(wpa_s->bridge_ifname));
3737         }
3738
3739         /* RSNA Supplicant Key Management - INITIALIZE */
3740         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
3741         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
3742
3743         /* Initialize driver interface and register driver event handler before
3744          * L2 receive handler so that association events are processed before
3745          * EAPOL-Key packets if both become available for the same select()
3746          * call. */
3747         if (wpas_init_driver(wpa_s, iface) < 0)
3748                 return -1;
3749
3750         if (wpa_supplicant_init_wpa(wpa_s) < 0)
3751                 return -1;
3752
3753         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
3754                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
3755                           NULL);
3756         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
3757
3758         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
3759             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
3760                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
3761                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3762                         "dot11RSNAConfigPMKLifetime");
3763                 return -1;
3764         }
3765
3766         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
3767             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
3768                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
3769                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3770                         "dot11RSNAConfigPMKReauthThreshold");
3771                 return -1;
3772         }
3773
3774         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
3775             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
3776                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
3777                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3778                         "dot11RSNAConfigSATimeout");
3779                 return -1;
3780         }
3781
3782         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
3783                                                       &wpa_s->hw.num_modes,
3784                                                       &wpa_s->hw.flags);
3785
3786         capa_res = wpa_drv_get_capa(wpa_s, &capa);
3787         if (capa_res == 0) {
3788                 wpa_s->drv_capa_known = 1;
3789                 wpa_s->drv_flags = capa.flags;
3790                 wpa_s->drv_enc = capa.enc;
3791                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
3792                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
3793                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
3794                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
3795                 wpa_s->max_match_sets = capa.max_match_sets;
3796                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
3797                 wpa_s->max_stations = capa.max_stations;
3798                 wpa_s->extended_capa = capa.extended_capa;
3799                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
3800                 wpa_s->extended_capa_len = capa.extended_capa_len;
3801                 wpa_s->num_multichan_concurrent =
3802                         capa.num_multichan_concurrent;
3803         }
3804         if (wpa_s->max_remain_on_chan == 0)
3805                 wpa_s->max_remain_on_chan = 1000;
3806
3807         /*
3808          * Only take p2p_mgmt parameters when P2P Device is supported.
3809          * Doing it here as it determines whether l2_packet_init() will be done
3810          * during wpa_supplicant_driver_init().
3811          */
3812         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
3813                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
3814         else
3815                 iface->p2p_mgmt = 1;
3816
3817         if (wpa_s->num_multichan_concurrent == 0)
3818                 wpa_s->num_multichan_concurrent = 1;
3819
3820         if (wpa_supplicant_driver_init(wpa_s) < 0)
3821                 return -1;
3822
3823 #ifdef CONFIG_TDLS
3824         if ((!iface->p2p_mgmt ||
3825              !(wpa_s->drv_flags &
3826                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3827             wpa_tdls_init(wpa_s->wpa))
3828                 return -1;
3829 #endif /* CONFIG_TDLS */
3830
3831         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
3832             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
3833                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
3834                 return -1;
3835         }
3836
3837         if (wpas_wps_init(wpa_s))
3838                 return -1;
3839
3840         if (wpa_supplicant_init_eapol(wpa_s) < 0)
3841                 return -1;
3842         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
3843
3844         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
3845         if (wpa_s->ctrl_iface == NULL) {
3846                 wpa_printf(MSG_ERROR,
3847                            "Failed to initialize control interface '%s'.\n"
3848                            "You may have another wpa_supplicant process "
3849                            "already running or the file was\n"
3850                            "left by an unclean termination of wpa_supplicant "
3851                            "in which case you will need\n"
3852                            "to manually remove this file before starting "
3853                            "wpa_supplicant again.\n",
3854                            wpa_s->conf->ctrl_interface);
3855                 return -1;
3856         }
3857
3858         wpa_s->gas = gas_query_init(wpa_s);
3859         if (wpa_s->gas == NULL) {
3860                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
3861                 return -1;
3862         }
3863
3864         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
3865                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
3866                 return -1;
3867         }
3868
3869         if (wpa_bss_init(wpa_s) < 0)
3870                 return -1;
3871
3872         /*
3873          * Set Wake-on-WLAN triggers, if configured.
3874          * Note: We don't restore/remove the triggers on shutdown (it doesn't
3875          * have effect anyway when the interface is down).
3876          */
3877         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
3878                 return -1;
3879
3880 #ifdef CONFIG_EAP_PROXY
3881 {
3882         size_t len;
3883         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
3884                                                      &len);
3885         if (wpa_s->mnc_len > 0) {
3886                 wpa_s->imsi[len] = '\0';
3887                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
3888                            wpa_s->imsi, wpa_s->mnc_len);
3889         } else {
3890                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
3891         }
3892 }
3893 #endif /* CONFIG_EAP_PROXY */
3894
3895         if (pcsc_reader_init(wpa_s) < 0)
3896                 return -1;
3897
3898         if (wpas_init_ext_pw(wpa_s) < 0)
3899                 return -1;
3900
3901         return 0;
3902 }
3903
3904
3905 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
3906                                         int notify, int terminate)
3907 {
3908         struct wpa_global *global = wpa_s->global;
3909         struct wpa_supplicant *iface, *prev;
3910
3911         if (wpa_s == wpa_s->parent)
3912                 wpas_p2p_group_remove(wpa_s, "*");
3913
3914         iface = global->ifaces;
3915         while (iface) {
3916                 if (iface == wpa_s || iface->parent != wpa_s) {
3917                         iface = iface->next;
3918                         continue;
3919                 }
3920                 wpa_printf(MSG_DEBUG,
3921                            "Remove remaining child interface %s from parent %s",
3922                            iface->ifname, wpa_s->ifname);
3923                 prev = iface;
3924                 iface = iface->next;
3925                 wpa_supplicant_remove_iface(global, prev, terminate);
3926         }
3927
3928         wpa_s->disconnected = 1;
3929         if (wpa_s->drv_priv) {
3930                 wpa_supplicant_deauthenticate(wpa_s,
3931                                               WLAN_REASON_DEAUTH_LEAVING);
3932
3933                 wpa_drv_set_countermeasures(wpa_s, 0);
3934                 wpa_clear_keys(wpa_s, NULL);
3935         }
3936
3937         wpa_supplicant_cleanup(wpa_s);
3938         wpas_p2p_deinit_iface(wpa_s);
3939
3940         wpas_ctrl_radio_work_flush(wpa_s);
3941         radio_remove_interface(wpa_s);
3942
3943         if (wpa_s->drv_priv)
3944                 wpa_drv_deinit(wpa_s);
3945
3946         if (notify)
3947                 wpas_notify_iface_removed(wpa_s);
3948
3949         if (terminate)
3950                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
3951
3952         if (wpa_s->ctrl_iface) {
3953                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
3954                 wpa_s->ctrl_iface = NULL;
3955         }
3956
3957         if (wpa_s->conf != NULL) {
3958                 wpa_config_free(wpa_s->conf);
3959                 wpa_s->conf = NULL;
3960         }
3961
3962         os_free(wpa_s);
3963 }
3964
3965
3966 /**
3967  * wpa_supplicant_add_iface - Add a new network interface
3968  * @global: Pointer to global data from wpa_supplicant_init()
3969  * @iface: Interface configuration options
3970  * Returns: Pointer to the created interface or %NULL on failure
3971  *
3972  * This function is used to add new network interfaces for %wpa_supplicant.
3973  * This can be called before wpa_supplicant_run() to add interfaces before the
3974  * main event loop has been started. In addition, new interfaces can be added
3975  * dynamically while %wpa_supplicant is already running. This could happen,
3976  * e.g., when a hotplug network adapter is inserted.
3977  */
3978 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
3979                                                  struct wpa_interface *iface)
3980 {
3981         struct wpa_supplicant *wpa_s;
3982         struct wpa_interface t_iface;
3983         struct wpa_ssid *ssid;
3984
3985         if (global == NULL || iface == NULL)
3986                 return NULL;
3987
3988         wpa_s = wpa_supplicant_alloc();
3989         if (wpa_s == NULL)
3990                 return NULL;
3991
3992         wpa_s->global = global;
3993
3994         t_iface = *iface;
3995         if (global->params.override_driver) {
3996                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
3997                            "('%s' -> '%s')",
3998                            iface->driver, global->params.override_driver);
3999                 t_iface.driver = global->params.override_driver;
4000         }
4001         if (global->params.override_ctrl_interface) {
4002                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4003                            "ctrl_interface ('%s' -> '%s')",
4004                            iface->ctrl_interface,
4005                            global->params.override_ctrl_interface);
4006                 t_iface.ctrl_interface =
4007                         global->params.override_ctrl_interface;
4008         }
4009         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4010                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4011                            iface->ifname);
4012                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4013                 return NULL;
4014         }
4015
4016         /* Notify the control interfaces about new iface */
4017         if (wpas_notify_iface_added(wpa_s)) {
4018                 wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4019                 return NULL;
4020         }
4021
4022         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4023                 wpas_notify_network_added(wpa_s, ssid);
4024
4025         wpa_s->next = global->ifaces;
4026         global->ifaces = wpa_s;
4027
4028         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4029         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4030
4031 #ifdef CONFIG_P2P
4032         if (wpa_s->global->p2p == NULL &&
4033             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4034             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4035                 wpa_printf(MSG_INFO,
4036                            "P2P: Failed to enable P2P Device interface");
4037                 /* Try to continue without. P2P will be disabled. */
4038         }
4039 #endif /* CONFIG_P2P */
4040
4041         return wpa_s;
4042 }
4043
4044
4045 /**
4046  * wpa_supplicant_remove_iface - Remove a network interface
4047  * @global: Pointer to global data from wpa_supplicant_init()
4048  * @wpa_s: Pointer to the network interface to be removed
4049  * Returns: 0 if interface was removed, -1 if interface was not found
4050  *
4051  * This function can be used to dynamically remove network interfaces from
4052  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4053  * addition, this function is used to remove all remaining interfaces when
4054  * %wpa_supplicant is terminated.
4055  */
4056 int wpa_supplicant_remove_iface(struct wpa_global *global,
4057                                 struct wpa_supplicant *wpa_s,
4058                                 int terminate)
4059 {
4060         struct wpa_supplicant *prev;
4061
4062         /* Remove interface from the global list of interfaces */
4063         prev = global->ifaces;
4064         if (prev == wpa_s) {
4065                 global->ifaces = wpa_s->next;
4066         } else {
4067                 while (prev && prev->next != wpa_s)
4068                         prev = prev->next;
4069                 if (prev == NULL)
4070                         return -1;
4071                 prev->next = wpa_s->next;
4072         }
4073
4074         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4075
4076         if (global->p2p_group_formation == wpa_s)
4077                 global->p2p_group_formation = NULL;
4078         if (global->p2p_invite_group == wpa_s)
4079                 global->p2p_invite_group = NULL;
4080         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4081
4082         return 0;
4083 }
4084
4085
4086 /**
4087  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4088  * @wpa_s: Pointer to the network interface
4089  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4090  */
4091 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4092 {
4093         const char *eapol_method;
4094
4095         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4096             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4097                 return "NO-EAP";
4098         }
4099
4100         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4101         if (eapol_method == NULL)
4102                 return "UNKNOWN-EAP";
4103
4104         return eapol_method;
4105 }
4106
4107
4108 /**
4109  * wpa_supplicant_get_iface - Get a new network interface
4110  * @global: Pointer to global data from wpa_supplicant_init()
4111  * @ifname: Interface name
4112  * Returns: Pointer to the interface or %NULL if not found
4113  */
4114 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4115                                                  const char *ifname)
4116 {
4117         struct wpa_supplicant *wpa_s;
4118
4119         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4120                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4121                         return wpa_s;
4122         }
4123         return NULL;
4124 }
4125
4126
4127 #ifndef CONFIG_NO_WPA_MSG
4128 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4129 {
4130         struct wpa_supplicant *wpa_s = ctx;
4131         if (wpa_s == NULL)
4132                 return NULL;
4133         return wpa_s->ifname;
4134 }
4135 #endif /* CONFIG_NO_WPA_MSG */
4136
4137
4138 /**
4139  * wpa_supplicant_init - Initialize %wpa_supplicant
4140  * @params: Parameters for %wpa_supplicant
4141  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4142  *
4143  * This function is used to initialize %wpa_supplicant. After successful
4144  * initialization, the returned data pointer can be used to add and remove
4145  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4146  */
4147 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4148 {
4149         struct wpa_global *global;
4150         int ret, i;
4151
4152         if (params == NULL)
4153                 return NULL;
4154
4155 #ifdef CONFIG_DRIVER_NDIS
4156         {
4157                 void driver_ndis_init_ops(void);
4158                 driver_ndis_init_ops();
4159         }
4160 #endif /* CONFIG_DRIVER_NDIS */
4161
4162 #ifndef CONFIG_NO_WPA_MSG
4163         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4164 #endif /* CONFIG_NO_WPA_MSG */
4165
4166         wpa_debug_open_file(params->wpa_debug_file_path);
4167         if (params->wpa_debug_syslog)
4168                 wpa_debug_open_syslog();
4169         if (params->wpa_debug_tracing) {
4170                 ret = wpa_debug_open_linux_tracing();
4171                 if (ret) {
4172                         wpa_printf(MSG_ERROR,
4173                                    "Failed to enable trace logging");
4174                         return NULL;
4175                 }
4176         }
4177
4178         ret = eap_register_methods();
4179         if (ret) {
4180                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4181                 if (ret == -2)
4182                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4183                                    "the same EAP type.");
4184                 return NULL;
4185         }
4186
4187         global = os_zalloc(sizeof(*global));
4188         if (global == NULL)
4189                 return NULL;
4190         dl_list_init(&global->p2p_srv_bonjour);
4191         dl_list_init(&global->p2p_srv_upnp);
4192         global->params.daemonize = params->daemonize;
4193         global->params.wait_for_monitor = params->wait_for_monitor;
4194         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4195         if (params->pid_file)
4196                 global->params.pid_file = os_strdup(params->pid_file);
4197         if (params->ctrl_interface)
4198                 global->params.ctrl_interface =
4199                         os_strdup(params->ctrl_interface);
4200         if (params->ctrl_interface_group)
4201                 global->params.ctrl_interface_group =
4202                         os_strdup(params->ctrl_interface_group);
4203         if (params->override_driver)
4204                 global->params.override_driver =
4205                         os_strdup(params->override_driver);
4206         if (params->override_ctrl_interface)
4207                 global->params.override_ctrl_interface =
4208                         os_strdup(params->override_ctrl_interface);
4209         wpa_debug_level = global->params.wpa_debug_level =
4210                 params->wpa_debug_level;
4211         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4212                 params->wpa_debug_show_keys;
4213         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4214                 params->wpa_debug_timestamp;
4215
4216         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4217
4218         if (eloop_init()) {
4219                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4220                 wpa_supplicant_deinit(global);
4221                 return NULL;
4222         }
4223
4224         random_init(params->entropy_file);
4225
4226         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4227         if (global->ctrl_iface == NULL) {
4228                 wpa_supplicant_deinit(global);
4229                 return NULL;
4230         }
4231
4232         if (wpas_notify_supplicant_initialized(global)) {
4233                 wpa_supplicant_deinit(global);
4234                 return NULL;
4235         }
4236
4237         for (i = 0; wpa_drivers[i]; i++)
4238                 global->drv_count++;
4239         if (global->drv_count == 0) {
4240                 wpa_printf(MSG_ERROR, "No drivers enabled");
4241                 wpa_supplicant_deinit(global);
4242                 return NULL;
4243         }
4244         global->drv_priv = os_zalloc(global->drv_count * sizeof(void *));
4245         if (global->drv_priv == NULL) {
4246                 wpa_supplicant_deinit(global);
4247                 return NULL;
4248         }
4249
4250 #ifdef CONFIG_WIFI_DISPLAY
4251         if (wifi_display_init(global) < 0) {
4252                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4253                 wpa_supplicant_deinit(global);
4254                 return NULL;
4255         }
4256 #endif /* CONFIG_WIFI_DISPLAY */
4257
4258         return global;
4259 }
4260
4261
4262 /**
4263  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4264  * @global: Pointer to global data from wpa_supplicant_init()
4265  * Returns: 0 after successful event loop run, -1 on failure
4266  *
4267  * This function starts the main event loop and continues running as long as
4268  * there are any remaining events. In most cases, this function is running as
4269  * long as the %wpa_supplicant process in still in use.
4270  */
4271 int wpa_supplicant_run(struct wpa_global *global)
4272 {
4273         struct wpa_supplicant *wpa_s;
4274
4275         if (global->params.daemonize &&
4276             wpa_supplicant_daemon(global->params.pid_file))
4277                 return -1;
4278
4279         if (global->params.wait_for_monitor) {
4280                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4281                         if (wpa_s->ctrl_iface)
4282                                 wpa_supplicant_ctrl_iface_wait(
4283                                         wpa_s->ctrl_iface);
4284         }
4285
4286         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4287         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4288
4289         eloop_run();
4290
4291         return 0;
4292 }
4293
4294
4295 /**
4296  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4297  * @global: Pointer to global data from wpa_supplicant_init()
4298  *
4299  * This function is called to deinitialize %wpa_supplicant and to free all
4300  * allocated resources. Remaining network interfaces will also be removed.
4301  */
4302 void wpa_supplicant_deinit(struct wpa_global *global)
4303 {
4304         int i;
4305
4306         if (global == NULL)
4307                 return;
4308
4309 #ifdef CONFIG_WIFI_DISPLAY
4310         wifi_display_deinit(global);
4311 #endif /* CONFIG_WIFI_DISPLAY */
4312
4313         while (global->ifaces)
4314                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4315
4316         if (global->ctrl_iface)
4317                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4318
4319         wpas_notify_supplicant_deinitialized(global);
4320
4321         eap_peer_unregister_methods();
4322 #ifdef CONFIG_AP
4323         eap_server_unregister_methods();
4324 #endif /* CONFIG_AP */
4325
4326         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4327                 if (!global->drv_priv[i])
4328                         continue;
4329                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4330         }
4331         os_free(global->drv_priv);
4332
4333         random_deinit();
4334
4335         eloop_destroy();
4336
4337         if (global->params.pid_file) {
4338                 os_daemonize_terminate(global->params.pid_file);
4339                 os_free(global->params.pid_file);
4340         }
4341         os_free(global->params.ctrl_interface);
4342         os_free(global->params.ctrl_interface_group);
4343         os_free(global->params.override_driver);
4344         os_free(global->params.override_ctrl_interface);
4345
4346         os_free(global->p2p_disallow_freq.range);
4347         os_free(global->p2p_go_avoid_freq.range);
4348         os_free(global->add_psk);
4349
4350         os_free(global);
4351         wpa_debug_close_syslog();
4352         wpa_debug_close_file();
4353         wpa_debug_close_linux_tracing();
4354 }
4355
4356
4357 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4358 {
4359         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4360             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4361                 char country[3];
4362                 country[0] = wpa_s->conf->country[0];
4363                 country[1] = wpa_s->conf->country[1];
4364                 country[2] = '\0';
4365                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4366                         wpa_printf(MSG_ERROR, "Failed to set country code "
4367                                    "'%s'", country);
4368                 }
4369         }
4370
4371         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4372                 wpas_init_ext_pw(wpa_s);
4373
4374 #ifdef CONFIG_WPS
4375         wpas_wps_update_config(wpa_s);
4376 #endif /* CONFIG_WPS */
4377         wpas_p2p_update_config(wpa_s);
4378         wpa_s->conf->changed_parameters = 0;
4379 }
4380
4381
4382 static void add_freq(int *freqs, int *num_freqs, int freq)
4383 {
4384         int i;
4385
4386         for (i = 0; i < *num_freqs; i++) {
4387                 if (freqs[i] == freq)
4388                         return;
4389         }
4390
4391         freqs[*num_freqs] = freq;
4392         (*num_freqs)++;
4393 }
4394
4395
4396 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4397 {
4398         struct wpa_bss *bss, *cbss;
4399         const int max_freqs = 10;
4400         int *freqs;
4401         int num_freqs = 0;
4402
4403         freqs = os_zalloc(sizeof(int) * (max_freqs + 1));
4404         if (freqs == NULL)
4405                 return NULL;
4406
4407         cbss = wpa_s->current_bss;
4408
4409         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4410                 if (bss == cbss)
4411                         continue;
4412                 if (bss->ssid_len == cbss->ssid_len &&
4413                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4414                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4415                         add_freq(freqs, &num_freqs, bss->freq);
4416                         if (num_freqs == max_freqs)
4417                                 break;
4418                 }
4419         }
4420
4421         if (num_freqs == 0) {
4422                 os_free(freqs);
4423                 freqs = NULL;
4424         }
4425
4426         return freqs;
4427 }
4428
4429
4430 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4431 {
4432         int timeout;
4433         int count;
4434         int *freqs = NULL;
4435
4436         wpas_connect_work_done(wpa_s);
4437
4438         /*
4439          * Remove possible authentication timeout since the connection failed.
4440          */
4441         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4442
4443         if (wpa_s->disconnected) {
4444                 /*
4445                  * There is no point in blacklisting the AP if this event is
4446                  * generated based on local request to disconnect.
4447                  */
4448                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4449                         "indication since interface has been put into "
4450                         "disconnected state");
4451                 return;
4452         }
4453
4454         /*
4455          * Add the failed BSSID into the blacklist and speed up next scan
4456          * attempt if there could be other APs that could accept association.
4457          * The current blacklist count indicates how many times we have tried
4458          * connecting to this AP and multiple attempts mean that other APs are
4459          * either not available or has already been tried, so that we can start
4460          * increasing the delay here to avoid constant scanning.
4461          */
4462         count = wpa_blacklist_add(wpa_s, bssid);
4463         if (count == 1 && wpa_s->current_bss) {
4464                 /*
4465                  * This BSS was not in the blacklist before. If there is
4466                  * another BSS available for the same ESS, we should try that
4467                  * next. Otherwise, we may as well try this one once more
4468                  * before allowing other, likely worse, ESSes to be considered.
4469                  */
4470                 freqs = get_bss_freqs_in_ess(wpa_s);
4471                 if (freqs) {
4472                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4473                                 "has been seen; try it next");
4474                         wpa_blacklist_add(wpa_s, bssid);
4475                         /*
4476                          * On the next scan, go through only the known channels
4477                          * used in this ESS based on previous scans to speed up
4478                          * common load balancing use case.
4479                          */
4480                         os_free(wpa_s->next_scan_freqs);
4481                         wpa_s->next_scan_freqs = freqs;
4482                 }
4483         }
4484
4485         /*
4486          * Add previous failure count in case the temporary blacklist was
4487          * cleared due to no other BSSes being available.
4488          */
4489         count += wpa_s->extra_blacklist_count;
4490
4491         if (count > 3 && wpa_s->current_ssid) {
4492                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4493                            "consider temporary network disabling");
4494                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4495         }
4496
4497         switch (count) {
4498         case 1:
4499                 timeout = 100;
4500                 break;
4501         case 2:
4502                 timeout = 500;
4503                 break;
4504         case 3:
4505                 timeout = 1000;
4506                 break;
4507         case 4:
4508                 timeout = 5000;
4509                 break;
4510         default:
4511                 timeout = 10000;
4512                 break;
4513         }
4514
4515         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4516                 "ms", count, timeout);
4517
4518         /*
4519          * TODO: if more than one possible AP is available in scan results,
4520          * could try the other ones before requesting a new scan.
4521          */
4522         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4523                                 1000 * (timeout % 1000));
4524 }
4525
4526
4527 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4528 {
4529         return wpa_s->conf->ap_scan == 2 ||
4530                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4531 }
4532
4533
4534 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4535 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4536                                               struct wpa_ssid *ssid,
4537                                               const char *field,
4538                                               const char *value)
4539 {
4540 #ifdef IEEE8021X_EAPOL
4541         struct eap_peer_config *eap = &ssid->eap;
4542
4543         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4544         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4545                               (const u8 *) value, os_strlen(value));
4546
4547         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4548         case WPA_CTRL_REQ_EAP_IDENTITY:
4549                 os_free(eap->identity);
4550                 eap->identity = (u8 *) os_strdup(value);
4551                 eap->identity_len = os_strlen(value);
4552                 eap->pending_req_identity = 0;
4553                 if (ssid == wpa_s->current_ssid)
4554                         wpa_s->reassociate = 1;
4555                 break;
4556         case WPA_CTRL_REQ_EAP_PASSWORD:
4557                 bin_clear_free(eap->password, eap->password_len);
4558                 eap->password = (u8 *) os_strdup(value);
4559                 eap->password_len = os_strlen(value);
4560                 eap->pending_req_password = 0;
4561                 if (ssid == wpa_s->current_ssid)
4562                         wpa_s->reassociate = 1;
4563                 break;
4564         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4565                 bin_clear_free(eap->new_password, eap->new_password_len);
4566                 eap->new_password = (u8 *) os_strdup(value);
4567                 eap->new_password_len = os_strlen(value);
4568                 eap->pending_req_new_password = 0;
4569                 if (ssid == wpa_s->current_ssid)
4570                         wpa_s->reassociate = 1;
4571                 break;
4572         case WPA_CTRL_REQ_EAP_PIN:
4573                 str_clear_free(eap->pin);
4574                 eap->pin = os_strdup(value);
4575                 eap->pending_req_pin = 0;
4576                 if (ssid == wpa_s->current_ssid)
4577                         wpa_s->reassociate = 1;
4578                 break;
4579         case WPA_CTRL_REQ_EAP_OTP:
4580                 bin_clear_free(eap->otp, eap->otp_len);
4581                 eap->otp = (u8 *) os_strdup(value);
4582                 eap->otp_len = os_strlen(value);
4583                 os_free(eap->pending_req_otp);
4584                 eap->pending_req_otp = NULL;
4585                 eap->pending_req_otp_len = 0;
4586                 break;
4587         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4588                 str_clear_free(eap->private_key_passwd);
4589                 eap->private_key_passwd = os_strdup(value);
4590                 eap->pending_req_passphrase = 0;
4591                 if (ssid == wpa_s->current_ssid)
4592                         wpa_s->reassociate = 1;
4593                 break;
4594         case WPA_CTRL_REQ_SIM:
4595                 str_clear_free(eap->external_sim_resp);
4596                 eap->external_sim_resp = os_strdup(value);
4597                 break;
4598         default:
4599                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4600                 return -1;
4601         }
4602
4603         return 0;
4604 #else /* IEEE8021X_EAPOL */
4605         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4606         return -1;
4607 #endif /* IEEE8021X_EAPOL */
4608 }
4609 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4610
4611
4612 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4613 {
4614         int i;
4615         unsigned int drv_enc;
4616
4617         if (ssid == NULL)
4618                 return 1;
4619
4620         if (ssid->disabled)
4621                 return 1;
4622
4623         if (wpa_s && wpa_s->drv_capa_known)
4624                 drv_enc = wpa_s->drv_enc;
4625         else
4626                 drv_enc = (unsigned int) -1;
4627
4628         for (i = 0; i < NUM_WEP_KEYS; i++) {
4629                 size_t len = ssid->wep_key_len[i];
4630                 if (len == 0)
4631                         continue;
4632                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
4633                         continue;
4634                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
4635                         continue;
4636                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
4637                         continue;
4638                 return 1; /* invalid WEP key */
4639         }
4640
4641         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
4642             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
4643                 return 1;
4644
4645         return 0;
4646 }
4647
4648
4649 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
4650 {
4651         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
4652                 return 1;
4653         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
4654                 return 0;
4655         return -1;
4656 }
4657
4658
4659 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
4660 {
4661         struct wpa_ssid *ssid = wpa_s->current_ssid;
4662         int dur;
4663         struct os_reltime now;
4664
4665         if (ssid == NULL) {
4666                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
4667                            "SSID block");
4668                 return;
4669         }
4670
4671         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
4672                 return;
4673
4674         ssid->auth_failures++;
4675
4676 #ifdef CONFIG_P2P
4677         if (ssid->p2p_group &&
4678             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
4679                 /*
4680                  * Skip the wait time since there is a short timeout on the
4681                  * connection to a P2P group.
4682                  */
4683                 return;
4684         }
4685 #endif /* CONFIG_P2P */
4686
4687         if (ssid->auth_failures > 50)
4688                 dur = 300;
4689         else if (ssid->auth_failures > 10)
4690                 dur = 120;
4691         else if (ssid->auth_failures > 5)
4692                 dur = 90;
4693         else if (ssid->auth_failures > 3)
4694                 dur = 60;
4695         else if (ssid->auth_failures > 2)
4696                 dur = 30;
4697         else if (ssid->auth_failures > 1)
4698                 dur = 20;
4699         else
4700                 dur = 10;
4701
4702         if (ssid->auth_failures > 1 &&
4703             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
4704                 dur += os_random() % (ssid->auth_failures * 10);
4705
4706         os_get_reltime(&now);
4707         if (now.sec + dur <= ssid->disabled_until.sec)
4708                 return;
4709
4710         ssid->disabled_until.sec = now.sec + dur;
4711
4712         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
4713                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
4714                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
4715                 ssid->auth_failures, dur, reason);
4716 }
4717
4718
4719 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
4720                               struct wpa_ssid *ssid, int clear_failures)
4721 {
4722         if (ssid == NULL)
4723                 return;
4724
4725         if (ssid->disabled_until.sec) {
4726                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
4727                         "id=%d ssid=\"%s\"",
4728                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
4729         }
4730         ssid->disabled_until.sec = 0;
4731         ssid->disabled_until.usec = 0;
4732         if (clear_failures)
4733                 ssid->auth_failures = 0;
4734 }
4735
4736
4737 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
4738 {
4739         size_t i;
4740
4741         if (wpa_s->disallow_aps_bssid == NULL)
4742                 return 0;
4743
4744         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
4745                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
4746                               bssid, ETH_ALEN) == 0)
4747                         return 1;
4748         }
4749
4750         return 0;
4751 }
4752
4753
4754 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
4755                     size_t ssid_len)
4756 {
4757         size_t i;
4758
4759         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
4760                 return 0;
4761
4762         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
4763                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
4764                 if (ssid_len == s->ssid_len &&
4765                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
4766                         return 1;
4767         }
4768
4769         return 0;
4770 }
4771
4772
4773 /**
4774  * wpas_request_connection - Request a new connection
4775  * @wpa_s: Pointer to the network interface
4776  *
4777  * This function is used to request a new connection to be found. It will mark
4778  * the interface to allow reassociation and request a new scan to find a
4779  * suitable network to connect to.
4780  */
4781 void wpas_request_connection(struct wpa_supplicant *wpa_s)
4782 {
4783         wpa_s->normal_scans = 0;
4784         wpa_supplicant_reinit_autoscan(wpa_s);
4785         wpa_s->extra_blacklist_count = 0;
4786         wpa_s->disconnected = 0;
4787         wpa_s->reassociate = 1;
4788
4789         if (wpa_supplicant_fast_associate(wpa_s) != 1)
4790                 wpa_supplicant_req_scan(wpa_s, 0, 0);
4791 }
4792
4793
4794 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
4795                     struct wpa_used_freq_data *freqs_data,
4796                     unsigned int len)
4797 {
4798         unsigned int i;
4799
4800         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
4801                 len, title);
4802         for (i = 0; i < len; i++) {
4803                 struct wpa_used_freq_data *cur = &freqs_data[i];
4804                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
4805                         i, cur->freq, cur->flags);
4806         }
4807 }
4808
4809
4810 /*
4811  * Find the operating frequencies of any of the virtual interfaces that
4812  * are using the same radio as the current interface, and in addition, get
4813  * information about the interface types that are using the frequency.
4814  */
4815 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
4816                                 struct wpa_used_freq_data *freqs_data,
4817                                 unsigned int len)
4818 {
4819         struct wpa_supplicant *ifs;
4820         u8 bssid[ETH_ALEN];
4821         int freq;
4822         unsigned int idx = 0, i;
4823
4824         wpa_dbg(wpa_s, MSG_DEBUG,
4825                 "Determining shared radio frequencies (max len %u)", len);
4826         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
4827
4828         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
4829                          radio_list) {
4830                 if (idx == len)
4831                         break;
4832
4833                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
4834                         continue;
4835
4836                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
4837                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
4838                         freq = ifs->current_ssid->frequency;
4839                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
4840                         freq = ifs->assoc_freq;
4841                 else
4842                         continue;
4843
4844                 /* Hold only distinct freqs */
4845                 for (i = 0; i < idx; i++)
4846                         if (freqs_data[i].freq == freq)
4847                                 break;
4848
4849                 if (i == idx)
4850                         freqs_data[idx++].freq = freq;
4851
4852                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
4853                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
4854                                 WPA_FREQ_USED_BY_P2P_CLIENT :
4855                                 WPA_FREQ_USED_BY_INFRA_STATION;
4856                 }
4857         }
4858
4859         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
4860         return idx;
4861 }
4862
4863
4864 /*
4865  * Find the operating frequencies of any of the virtual interfaces that
4866  * are using the same radio as the current interface.
4867  */
4868 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
4869                            int *freq_array, unsigned int len)
4870 {
4871         struct wpa_used_freq_data *freqs_data;
4872         int num, i;
4873
4874         os_memset(freq_array, 0, sizeof(int) * len);
4875
4876         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
4877         if (!freqs_data)
4878                 return -1;
4879
4880         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
4881         for (i = 0; i < num; i++)
4882                 freq_array[i] = freqs_data[i].freq;
4883
4884         os_free(freqs_data);
4885
4886         return num;
4887 }