wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 401 {
 402         struct wpa_bss_tmp_disallowed *bss, *prev;
 403
 404         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 405                               struct wpa_bss_tmp_disallowed, list) {
 406                 dl_list_del(&bss->list);
 407                 os_free(bss);
 408         }
 409 }
 410
 411
 412 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 413 {
 414         int i;
 415
 416         bgscan_deinit(wpa_s);
 417         autoscan_deinit(wpa_s);
 418         scard_deinit(wpa_s->scard);
 419         wpa_s->scard = NULL;
 420         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 421         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 422         l2_packet_deinit(wpa_s->l2);
 423         wpa_s->l2 = NULL;
 424         if (wpa_s->l2_br) {
 425                 l2_packet_deinit(wpa_s->l2_br);
 426                 wpa_s->l2_br = NULL;
 427         }
 428 #ifdef CONFIG_TESTING_OPTIONS
 429         l2_packet_deinit(wpa_s->l2_test);
 430         wpa_s->l2_test = NULL;
 431 #endif /* CONFIG_TESTING_OPTIONS */
 432
 433         if (wpa_s->conf != NULL) {
 434                 struct wpa_ssid *ssid;
 435                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 436                         wpas_notify_network_removed(wpa_s, ssid);
 437         }
 438
 439         os_free(wpa_s->confname);
 440         wpa_s->confname = NULL;
 441
 442         os_free(wpa_s->confanother);
 443         wpa_s->confanother = NULL;
 444
 445         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 446         eapol_sm_deinit(wpa_s->eapol);
 447         wpa_s->eapol = NULL;
 448
 449         rsn_preauth_deinit(wpa_s->wpa);
 450
 451 #ifdef CONFIG_TDLS
 452         wpa_tdls_deinit(wpa_s->wpa);
 453 #endif /* CONFIG_TDLS */
 454
 455         wmm_ac_clear_saved_tspecs(wpa_s);
 456         pmksa_candidate_free(wpa_s->wpa);
 457         wpa_sm_deinit(wpa_s->wpa);
 458         wpa_s->wpa = NULL;
 459         wpa_blacklist_clear(wpa_s);
 460
 461         wpa_bss_deinit(wpa_s);
 462
 463         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 464         wpa_supplicant_cancel_scan(wpa_s);
 465         wpa_supplicant_cancel_auth_timeout(wpa_s);
 466         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 467 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 468         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 469                              wpa_s, NULL);
 470 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 471
 472         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 473
 474         wpas_wps_deinit(wpa_s);
 475
 476         wpabuf_free(wpa_s->pending_eapol_rx);
 477         wpa_s->pending_eapol_rx = NULL;
 478
 479 #ifdef CONFIG_IBSS_RSN
 480         ibss_rsn_deinit(wpa_s->ibss_rsn);
 481         wpa_s->ibss_rsn = NULL;
 482 #endif /* CONFIG_IBSS_RSN */
 483
 484         sme_deinit(wpa_s);
 485
 486 #ifdef CONFIG_AP
 487         wpa_supplicant_ap_deinit(wpa_s);
 488 #endif /* CONFIG_AP */
 489
 490         wpas_p2p_deinit(wpa_s);
 491
 492 #ifdef CONFIG_OFFCHANNEL
 493         offchannel_deinit(wpa_s);
 494 #endif /* CONFIG_OFFCHANNEL */
 495
 496         wpa_supplicant_cancel_sched_scan(wpa_s);
 497
 498         os_free(wpa_s->next_scan_freqs);
 499         wpa_s->next_scan_freqs = NULL;
 500
 501         os_free(wpa_s->manual_scan_freqs);
 502         wpa_s->manual_scan_freqs = NULL;
 503
 504         os_free(wpa_s->manual_sched_scan_freqs);
 505         wpa_s->manual_sched_scan_freqs = NULL;
 506
 507         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 508
 509         /*
 510          * Need to remove any pending gas-query radio work before the
 511          * gas_query_deinit() call because gas_query::work has not yet been set
 512          * for works that have not been started. gas_query_free() will be unable
 513          * to cancel such pending radio works and once the pending gas-query
 514          * radio work eventually gets removed, the deinit notification call to
 515          * gas_query_start_cb() would result in dereferencing freed memory.
 516          */
 517         if (wpa_s->radio)
 518                 radio_remove_works(wpa_s, "gas-query", 0);
 519         gas_query_deinit(wpa_s->gas);
 520         wpa_s->gas = NULL;
 521
 522         free_hw_features(wpa_s);
 523
 524         ieee802_1x_dealloc_kay_sm(wpa_s);
 525
 526         os_free(wpa_s->bssid_filter);
 527         wpa_s->bssid_filter = NULL;
 528
 529         os_free(wpa_s->disallow_aps_bssid);
 530         wpa_s->disallow_aps_bssid = NULL;
 531         os_free(wpa_s->disallow_aps_ssid);
 532         wpa_s->disallow_aps_ssid = NULL;
 533
 534         wnm_bss_keep_alive_deinit(wpa_s);
 535 #ifdef CONFIG_WNM
 536         wnm_deallocate_memory(wpa_s);
 537 #endif /* CONFIG_WNM */
 538
 539         ext_password_deinit(wpa_s->ext_pw);
 540         wpa_s->ext_pw = NULL;
 541
 542         wpabuf_free(wpa_s->last_gas_resp);
 543         wpa_s->last_gas_resp = NULL;
 544         wpabuf_free(wpa_s->prev_gas_resp);
 545         wpa_s->prev_gas_resp = NULL;
 546
 547         os_free(wpa_s->last_scan_res);
 548         wpa_s->last_scan_res = NULL;
 549
 550 #ifdef CONFIG_HS20
 551         hs20_deinit(wpa_s);
 552 #endif /* CONFIG_HS20 */
 553
 554         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 555                 wpabuf_free(wpa_s->vendor_elem[i]);
 556                 wpa_s->vendor_elem[i] = NULL;
 557         }
 558
 559         wmm_ac_notify_disassoc(wpa_s);
 560
 561         wpa_s->sched_scan_plans_num = 0;
 562         os_free(wpa_s->sched_scan_plans);
 563         wpa_s->sched_scan_plans = NULL;
 564
 565 #ifdef CONFIG_MBO
 566         wpa_s->non_pref_chan_num = 0;
 567         os_free(wpa_s->non_pref_chan);
 568         wpa_s->non_pref_chan = NULL;
 569 #endif /* CONFIG_MBO */
 570
 571         free_bss_tmp_disallowed(wpa_s);
 572 }
 573
 574
 575 /**
 576  * wpa_clear_keys - Clear keys configured for the driver
 577  * @wpa_s: Pointer to wpa_supplicant data
 578  * @addr: Previously used BSSID or %NULL if not available
 579  *
 580  * This function clears the encryption keys that has been previously configured
 581  * for the driver.
 582  */
 583 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 584 {
 585         int i, max;
 586
 587 #ifdef CONFIG_IEEE80211W
 588         max = 6;
 589 #else /* CONFIG_IEEE80211W */
 590         max = 4;
 591 #endif /* CONFIG_IEEE80211W */
 592
 593         /* MLME-DELETEKEYS.request */
 594         for (i = 0; i < max; i++) {
 595                 if (wpa_s->keys_cleared & BIT(i))
 596                         continue;
 597                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 598                                 NULL, 0);
 599         }
 600         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 601             !is_zero_ether_addr(addr)) {
 602                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 603                                 0);
 604                 /* MLME-SETPROTECTION.request(None) */
 605                 wpa_drv_mlme_setprotection(
 606                         wpa_s, addr,
 607                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 608                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 609         }
 610         wpa_s->keys_cleared = (u32) -1;
 611 }
 612
 613
 614 /**
 615  * wpa_supplicant_state_txt - Get the connection state name as a text string
 616  * @state: State (wpa_state; WPA_*)
 617  * Returns: The state name as a printable text string
 618  */
 619 const char * wpa_supplicant_state_txt(enum wpa_states state)
 620 {
 621         switch (state) {
 622         case WPA_DISCONNECTED:
 623                 return "DISCONNECTED";
 624         case WPA_INACTIVE:
 625                 return "INACTIVE";
 626         case WPA_INTERFACE_DISABLED:
 627                 return "INTERFACE_DISABLED";
 628         case WPA_SCANNING:
 629                 return "SCANNING";
 630         case WPA_AUTHENTICATING:
 631                 return "AUTHENTICATING";
 632         case WPA_ASSOCIATING:
 633                 return "ASSOCIATING";
 634         case WPA_ASSOCIATED:
 635                 return "ASSOCIATED";
 636         case WPA_4WAY_HANDSHAKE:
 637                 return "4WAY_HANDSHAKE";
 638         case WPA_GROUP_HANDSHAKE:
 639                 return "GROUP_HANDSHAKE";
 640         case WPA_COMPLETED:
 641                 return "COMPLETED";
 642         default:
 643                 return "UNKNOWN";
 644         }
 645 }
 646
 647
 648 #ifdef CONFIG_BGSCAN
 649
 650 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 651 {
 652         const char *name;
 653
 654         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 655                 name = wpa_s->current_ssid->bgscan;
 656         else
 657                 name = wpa_s->conf->bgscan;
 658         if (name == NULL || name[0] == '\0')
 659                 return;
 660         if (wpas_driver_bss_selection(wpa_s))
 661                 return;
 662         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 663                 return;
 664 #ifdef CONFIG_P2P
 665         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 666                 return;
 667 #endif /* CONFIG_P2P */
 668
 669         bgscan_deinit(wpa_s);
 670         if (wpa_s->current_ssid) {
 671                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 672                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 673                                 "bgscan");
 674                         /*
 675                          * Live without bgscan; it is only used as a roaming
 676                          * optimization, so the initial connection is not
 677                          * affected.
 678                          */
 679                 } else {
 680                         struct wpa_scan_results *scan_res;
 681                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 682                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 683                                                                    0);
 684                         if (scan_res) {
 685                                 bgscan_notify_scan(wpa_s, scan_res);
 686                                 wpa_scan_results_free(scan_res);
 687                         }
 688                 }
 689         } else
 690                 wpa_s->bgscan_ssid = NULL;
 691 }
 692
 693
 694 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 695 {
 696         if (wpa_s->bgscan_ssid != NULL) {
 697                 bgscan_deinit(wpa_s);
 698                 wpa_s->bgscan_ssid = NULL;
 699         }
 700 }
 701
 702 #endif /* CONFIG_BGSCAN */
 703
 704
 705 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 706 {
 707         if (autoscan_init(wpa_s, 0))
 708                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 709 }
 710
 711
 712 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 713 {
 714         autoscan_deinit(wpa_s);
 715 }
 716
 717
 718 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 719 {
 720         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 721             wpa_s->wpa_state == WPA_SCANNING) {
 722                 autoscan_deinit(wpa_s);
 723                 wpa_supplicant_start_autoscan(wpa_s);
 724         }
 725 }
 726
 727
 728 /**
 729  * wpa_supplicant_set_state - Set current connection state
 730  * @wpa_s: Pointer to wpa_supplicant data
 731  * @state: The new connection state
 732  *
 733  * This function is called whenever the connection state changes, e.g.,
 734  * association is completed for WPA/WPA2 4-Way Handshake is started.
 735  */
 736 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 737                               enum wpa_states state)
 738 {
 739         enum wpa_states old_state = wpa_s->wpa_state;
 740
 741         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 742                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 743                 wpa_supplicant_state_txt(state));
 744
 745         if (state == WPA_INTERFACE_DISABLED) {
 746                 /* Assure normal scan when interface is restored */
 747                 wpa_s->normal_scans = 0;
 748         }
 749
 750         if (state == WPA_COMPLETED) {
 751                 wpas_connect_work_done(wpa_s);
 752                 /* Reinitialize normal_scan counter */
 753                 wpa_s->normal_scans = 0;
 754         }
 755
 756 #ifdef CONFIG_P2P
 757         /*
 758          * P2PS client has to reply to Probe Request frames received on the
 759          * group operating channel. Enable Probe Request frame reporting for
 760          * P2P connected client in case p2p_cli_probe configuration property is
 761          * set to 1.
 762          */
 763         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 764             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 765             wpa_s->current_ssid->p2p_group) {
 766                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 767                         wpa_dbg(wpa_s, MSG_DEBUG,
 768                                 "P2P: Enable CLI Probe Request RX reporting");
 769                         wpa_s->p2p_cli_probe =
 770                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 771                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 772                         wpa_dbg(wpa_s, MSG_DEBUG,
 773                                 "P2P: Disable CLI Probe Request RX reporting");
 774                         wpa_s->p2p_cli_probe = 0;
 775                         wpa_drv_probe_req_report(wpa_s, 0);
 776                 }
 777         }
 778 #endif /* CONFIG_P2P */
 779
 780         if (state != WPA_SCANNING)
 781                 wpa_supplicant_notify_scanning(wpa_s, 0);
 782
 783         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 784                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 785 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 786                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 787                         MACSTR " completed [id=%d id_str=%s]",
 788                         MAC2STR(wpa_s->bssid),
 789                         ssid ? ssid->id : -1,
 790                         ssid && ssid->id_str ? ssid->id_str : "");
 791 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 792                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 793                 wpa_blacklist_clear(wpa_s);
 794                 wpa_s->extra_blacklist_count = 0;
 795                 wpa_s->new_connection = 0;
 796                 wpa_drv_set_operstate(wpa_s, 1);
 797 #ifndef IEEE8021X_EAPOL
 798                 wpa_drv_set_supp_port(wpa_s, 1);
 799 #endif /* IEEE8021X_EAPOL */
 800                 wpa_s->after_wps = 0;
 801                 wpa_s->known_wps_freq = 0;
 802                 wpas_p2p_completed(wpa_s);
 803
 804                 sme_sched_obss_scan(wpa_s, 1);
 805         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 806                    state == WPA_ASSOCIATED) {
 807                 wpa_s->new_connection = 1;
 808                 wpa_drv_set_operstate(wpa_s, 0);
 809 #ifndef IEEE8021X_EAPOL
 810                 wpa_drv_set_supp_port(wpa_s, 0);
 811 #endif /* IEEE8021X_EAPOL */
 812                 sme_sched_obss_scan(wpa_s, 0);
 813         }
 814         wpa_s->wpa_state = state;
 815
 816 #ifdef CONFIG_BGSCAN
 817         if (state == WPA_COMPLETED)
 818                 wpa_supplicant_start_bgscan(wpa_s);
 819         else if (state < WPA_ASSOCIATED)
 820                 wpa_supplicant_stop_bgscan(wpa_s);
 821 #endif /* CONFIG_BGSCAN */
 822
 823         if (state == WPA_AUTHENTICATING)
 824                 wpa_supplicant_stop_autoscan(wpa_s);
 825
 826         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 827                 wpa_supplicant_start_autoscan(wpa_s);
 828
 829         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 830                 wmm_ac_notify_disassoc(wpa_s);
 831
 832         if (wpa_s->wpa_state != old_state) {
 833                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 834
 835                 /*
 836                  * Notify the P2P Device interface about a state change in one
 837                  * of the interfaces.
 838                  */
 839                 wpas_p2p_indicate_state_change(wpa_s);
 840
 841                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 842                     old_state == WPA_COMPLETED)
 843                         wpas_notify_auth_changed(wpa_s);
 844         }
 845 }
 846
 847
 848 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 849 {
 850         int pending = 0;
 851 #ifdef CONFIG_WPS
 852         struct wpa_supplicant *wpa_s = global->ifaces;
 853         while (wpa_s) {
 854                 struct wpa_supplicant *next = wpa_s->next;
 855                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 856                         pending = 1;
 857 #ifdef CONFIG_P2P
 858                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 859                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 860                         wpas_p2p_disconnect(wpa_s);
 861 #endif /* CONFIG_P2P */
 862                 wpa_s = next;
 863         }
 864 #endif /* CONFIG_WPS */
 865         if (pending)
 866                 return;
 867         eloop_terminate();
 868 }
 869
 870
 871 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 872 {
 873         struct wpa_global *global = signal_ctx;
 874         wpa_supplicant_terminate_proc(global);
 875 }
 876
 877
 878 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 879 {
 880         enum wpa_states old_state = wpa_s->wpa_state;
 881
 882         wpa_s->pairwise_cipher = 0;
 883         wpa_s->group_cipher = 0;
 884         wpa_s->mgmt_group_cipher = 0;
 885         wpa_s->key_mgmt = 0;
 886         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 887                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 888
 889         if (wpa_s->wpa_state != old_state)
 890                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 891 }
 892
 893
 894 /**
 895  * wpa_supplicant_reload_configuration - Reload configuration data
 896  * @wpa_s: Pointer to wpa_supplicant data
 897  * Returns: 0 on success or -1 if configuration parsing failed
 898  *
 899  * This function can be used to request that the configuration data is reloaded
 900  * (e.g., after configuration file change). This function is reloading
 901  * configuration only for one interface, so this may need to be called multiple
 902  * times if %wpa_supplicant is controlling multiple interfaces and all
 903  * interfaces need reconfiguration.
 904  */
 905 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 906 {
 907         struct wpa_config *conf;
 908         int reconf_ctrl;
 909         int old_ap_scan;
 910
 911         if (wpa_s->confname == NULL)
 912                 return -1;
 913         conf = wpa_config_read(wpa_s->confname, NULL);
 914         if (conf == NULL) {
 915                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 916                         "file '%s' - exiting", wpa_s->confname);
 917                 return -1;
 918         }
 919         wpa_config_read(wpa_s->confanother, conf);
 920
 921         conf->changed_parameters = (unsigned int) -1;
 922
 923         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 924                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 925                     os_strcmp(conf->ctrl_interface,
 926                               wpa_s->conf->ctrl_interface) != 0);
 927
 928         if (reconf_ctrl && wpa_s->ctrl_iface) {
 929                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 930                 wpa_s->ctrl_iface = NULL;
 931         }
 932
 933         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 934         if (wpa_s->current_ssid) {
 935                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 936                         wpa_s->own_disconnect_req = 1;
 937                 wpa_supplicant_deauthenticate(wpa_s,
 938                                               WLAN_REASON_DEAUTH_LEAVING);
 939         }
 940
 941         /*
 942          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 943          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 944          */
 945         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 946                 /*
 947                  * Clear forced success to clear EAP state for next
 948                  * authentication.
 949                  */
 950                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 951         }
 952         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 953         wpa_sm_set_config(wpa_s->wpa, NULL);
 954         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 955         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 956         rsn_preauth_deinit(wpa_s->wpa);
 957
 958         old_ap_scan = wpa_s->conf->ap_scan;
 959         wpa_config_free(wpa_s->conf);
 960         wpa_s->conf = conf;
 961         if (old_ap_scan != wpa_s->conf->ap_scan)
 962                 wpas_notify_ap_scan_changed(wpa_s);
 963
 964         if (reconf_ctrl)
 965                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 966
 967         wpa_supplicant_update_config(wpa_s);
 968
 969         wpa_supplicant_clear_status(wpa_s);
 970         if (wpa_supplicant_enabled_networks(wpa_s)) {
 971                 wpa_s->reassociate = 1;
 972                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 973         }
 974         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 975         return 0;
 976 }
 977
 978
 979 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 980 {
 981         struct wpa_global *global = signal_ctx;
 982         struct wpa_supplicant *wpa_s;
 983         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 984                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 985                         sig);
 986                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 987                         wpa_supplicant_terminate_proc(global);
 988                 }
 989         }
 990
 991         if (wpa_debug_reopen_file() < 0) {
 992                 /* Ignore errors since we cannot really do much to fix this */
 993                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 994         }
 995 }
 996
 997
 998 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 999                                          struct wpa_ssid *ssid,
1000                                          struct wpa_ie_data *ie)
1001 {
1002         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1003         if (ret) {
1004                 if (ret == -2) {
1005                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1006                                 "from association info");
1007                 }
1008                 return -1;
1009         }
1010
1011         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1012                 "cipher suites");
1013         if (!(ie->group_cipher & ssid->group_cipher)) {
1014                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1015                         "cipher 0x%x (mask 0x%x) - reject",
1016                         ie->group_cipher, ssid->group_cipher);
1017                 return -1;
1018         }
1019         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1020                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1021                         "cipher 0x%x (mask 0x%x) - reject",
1022                         ie->pairwise_cipher, ssid->pairwise_cipher);
1023                 return -1;
1024         }
1025         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1026                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1027                         "management 0x%x (mask 0x%x) - reject",
1028                         ie->key_mgmt, ssid->key_mgmt);
1029                 return -1;
1030         }
1031
1032 #ifdef CONFIG_IEEE80211W
1033         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1034             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1036                         "that does not support management frame protection - "
1037                         "reject");
1038                 return -1;
1039         }
1040 #endif /* CONFIG_IEEE80211W */
1041
1042         return 0;
1043 }
1044
1045
1046 /**
1047  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1048  * @wpa_s: Pointer to wpa_supplicant data
1049  * @bss: Scan results for the selected BSS, or %NULL if not available
1050  * @ssid: Configuration data for the selected network
1051  * @wpa_ie: Buffer for the WPA/RSN IE
1052  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1053  * used buffer length in case the functions returns success.
1054  * Returns: 0 on success or -1 on failure
1055  *
1056  * This function is used to configure authentication and encryption parameters
1057  * based on the network configuration and scan result for the selected BSS (if
1058  * available).
1059  */
1060 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1061                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1062                               u8 *wpa_ie, size_t *wpa_ie_len)
1063 {
1064         struct wpa_ie_data ie;
1065         int sel, proto;
1066         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1067
1068         if (bss) {
1069                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1070                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1071                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1072         } else
1073                 bss_wpa = bss_rsn = bss_osen = NULL;
1074
1075         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1076             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1077             (ie.group_cipher & ssid->group_cipher) &&
1078             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1079             (ie.key_mgmt & ssid->key_mgmt)) {
1080                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1081                 proto = WPA_PROTO_RSN;
1082         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1083                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1084                    (ie.group_cipher & ssid->group_cipher) &&
1085                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1086                    (ie.key_mgmt & ssid->key_mgmt)) {
1087                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1088                 proto = WPA_PROTO_WPA;
1089 #ifdef CONFIG_HS20
1090         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1092                 /* TODO: parse OSEN element */
1093                 os_memset(&ie, 0, sizeof(ie));
1094                 ie.group_cipher = WPA_CIPHER_CCMP;
1095                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1096                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1097                 proto = WPA_PROTO_OSEN;
1098 #endif /* CONFIG_HS20 */
1099         } else if (bss) {
1100                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1101                 wpa_dbg(wpa_s, MSG_DEBUG,
1102                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1103                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1104                         ssid->key_mgmt);
1105                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1106                         MAC2STR(bss->bssid),
1107                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1108                         bss_wpa ? " WPA" : "",
1109                         bss_rsn ? " RSN" : "",
1110                         bss_osen ? " OSEN" : "");
1111                 if (bss_rsn) {
1112                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1113                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1114                                 wpa_dbg(wpa_s, MSG_DEBUG,
1115                                         "Could not parse RSN element");
1116                         } else {
1117                                 wpa_dbg(wpa_s, MSG_DEBUG,
1118                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1119                                         ie.pairwise_cipher, ie.group_cipher,
1120                                         ie.key_mgmt);
1121                         }
1122                 }
1123                 if (bss_wpa) {
1124                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1125                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "Could not parse WPA element");
1128                         } else {
1129                                 wpa_dbg(wpa_s, MSG_DEBUG,
1130                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1131                                         ie.pairwise_cipher, ie.group_cipher,
1132                                         ie.key_mgmt);
1133                         }
1134                 }
1135                 return -1;
1136         } else {
1137                 if (ssid->proto & WPA_PROTO_OSEN)
1138                         proto = WPA_PROTO_OSEN;
1139                 else if (ssid->proto & WPA_PROTO_RSN)
1140                         proto = WPA_PROTO_RSN;
1141                 else
1142                         proto = WPA_PROTO_WPA;
1143                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1144                         os_memset(&ie, 0, sizeof(ie));
1145                         ie.group_cipher = ssid->group_cipher;
1146                         ie.pairwise_cipher = ssid->pairwise_cipher;
1147                         ie.key_mgmt = ssid->key_mgmt;
1148 #ifdef CONFIG_IEEE80211W
1149                         ie.mgmt_group_cipher =
1150                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1151                                 WPA_CIPHER_AES_128_CMAC : 0;
1152 #endif /* CONFIG_IEEE80211W */
1153                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1154                                 "based on configuration");
1155                 } else
1156                         proto = ie.proto;
1157         }
1158
1159         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1160                 "pairwise %d key_mgmt %d proto %d",
1161                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1162 #ifdef CONFIG_IEEE80211W
1163         if (ssid->ieee80211w) {
1164                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1165                         ie.mgmt_group_cipher);
1166         }
1167 #endif /* CONFIG_IEEE80211W */
1168
1169         wpa_s->wpa_proto = proto;
1170         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1171         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1172                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1173
1174         if (bss || !wpa_s->ap_ies_from_associnfo) {
1175                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1176                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1177                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1178                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1179                         return -1;
1180         }
1181
1182 #ifdef CONFIG_NO_WPA
1183         wpa_s->group_cipher = WPA_CIPHER_NONE;
1184         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1185 #else /* CONFIG_NO_WPA */
1186         sel = ie.group_cipher & ssid->group_cipher;
1187         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1188         if (wpa_s->group_cipher < 0) {
1189                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1190                         "cipher");
1191                 return -1;
1192         }
1193         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1194                 wpa_cipher_txt(wpa_s->group_cipher));
1195
1196         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1197         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1198         if (wpa_s->pairwise_cipher < 0) {
1199                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1200                         "cipher");
1201                 return -1;
1202         }
1203         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1204                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1205 #endif /* CONFIG_NO_WPA */
1206
1207         sel = ie.key_mgmt & ssid->key_mgmt;
1208 #ifdef CONFIG_SAE
1209         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1210                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1211 #endif /* CONFIG_SAE */
1212         if (0) {
1213 #ifdef CONFIG_SUITEB192
1214         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1216                 wpa_dbg(wpa_s, MSG_DEBUG,
1217                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1218 #endif /* CONFIG_SUITEB192 */
1219 #ifdef CONFIG_SUITEB
1220         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1222                 wpa_dbg(wpa_s, MSG_DEBUG,
1223                         "WPA: using KEY_MGMT 802.1X with Suite B");
1224 #endif /* CONFIG_SUITEB */
1225 #ifdef CONFIG_IEEE80211R
1226         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1228                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1229         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1231                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1232 #endif /* CONFIG_IEEE80211R */
1233 #ifdef CONFIG_SAE
1234         } else if (sel & WPA_KEY_MGMT_SAE) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1237         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1240 #endif /* CONFIG_SAE */
1241 #ifdef CONFIG_IEEE80211W
1242         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1243                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1244                 wpa_dbg(wpa_s, MSG_DEBUG,
1245                         "WPA: using KEY_MGMT 802.1X with SHA256");
1246         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1248                 wpa_dbg(wpa_s, MSG_DEBUG,
1249                         "WPA: using KEY_MGMT PSK with SHA256");
1250 #endif /* CONFIG_IEEE80211W */
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1253                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1254         } else if (sel & WPA_KEY_MGMT_PSK) {
1255                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1256                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1257         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1258                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1259                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1260 #ifdef CONFIG_HS20
1261         } else if (sel & WPA_KEY_MGMT_OSEN) {
1262                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1264 #endif /* CONFIG_HS20 */
1265         } else {
1266                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1267                         "authenticated key management type");
1268                 return -1;
1269         }
1270
1271         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1272         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1273                          wpa_s->pairwise_cipher);
1274         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1275
1276 #ifdef CONFIG_IEEE80211W
1277         sel = ie.mgmt_group_cipher;
1278         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1279             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1280                 sel = 0;
1281         if (sel & WPA_CIPHER_AES_128_CMAC) {
1282                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1283                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1284                         "AES-128-CMAC");
1285         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1286                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1287                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1288                         "BIP-GMAC-128");
1289         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1290                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1291                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1292                         "BIP-GMAC-256");
1293         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1294                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1295                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1296                         "BIP-CMAC-256");
1297         } else {
1298                 wpa_s->mgmt_group_cipher = 0;
1299                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1300         }
1301         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1302                          wpa_s->mgmt_group_cipher);
1303         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1304                          wpas_get_ssid_pmf(wpa_s, ssid));
1305 #endif /* CONFIG_IEEE80211W */
1306
1307         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1308                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1309                 return -1;
1310         }
1311
1312         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1313                 int psk_set = 0;
1314
1315                 if (ssid->psk_set) {
1316                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1317                                        NULL);
1318                         psk_set = 1;
1319                 }
1320 #ifndef CONFIG_NO_PBKDF2
1321                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1322                     ssid->passphrase) {
1323                         u8 psk[PMK_LEN];
1324                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1325                                     4096, psk, PMK_LEN);
1326                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1327                                         psk, PMK_LEN);
1328                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1329                         psk_set = 1;
1330                         os_memset(psk, 0, sizeof(psk));
1331                 }
1332 #endif /* CONFIG_NO_PBKDF2 */
1333 #ifdef CONFIG_EXT_PASSWORD
1334                 if (ssid->ext_psk) {
1335                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1336                                                              ssid->ext_psk);
1337                         char pw_str[64 + 1];
1338                         u8 psk[PMK_LEN];
1339
1340                         if (pw == NULL) {
1341                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1342                                         "found from external storage");
1343                                 return -1;
1344                         }
1345
1346                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1347                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1348                                         "PSK length %d in external storage",
1349                                         (int) wpabuf_len(pw));
1350                                 ext_password_free(pw);
1351                                 return -1;
1352                         }
1353
1354                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1355                         pw_str[wpabuf_len(pw)] = '\0';
1356
1357 #ifndef CONFIG_NO_PBKDF2
1358                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1359                         {
1360                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1361                                             4096, psk, PMK_LEN);
1362                                 os_memset(pw_str, 0, sizeof(pw_str));
1363                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1364                                                 "external passphrase)",
1365                                                 psk, PMK_LEN);
1366                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1367                                                NULL);
1368                                 psk_set = 1;
1369                                 os_memset(psk, 0, sizeof(psk));
1370                         } else
1371 #endif /* CONFIG_NO_PBKDF2 */
1372                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1373                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1374                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1375                                                 "Invalid PSK hex string");
1376                                         os_memset(pw_str, 0, sizeof(pw_str));
1377                                         ext_password_free(pw);
1378                                         return -1;
1379                                 }
1380                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1381                                                NULL);
1382                                 psk_set = 1;
1383                                 os_memset(psk, 0, sizeof(psk));
1384                         } else {
1385                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1386                                         "PSK available");
1387                                 os_memset(pw_str, 0, sizeof(pw_str));
1388                                 ext_password_free(pw);
1389                                 return -1;
1390                         }
1391
1392                         os_memset(pw_str, 0, sizeof(pw_str));
1393                         ext_password_free(pw);
1394                 }
1395 #endif /* CONFIG_EXT_PASSWORD */
1396
1397                 if (!psk_set) {
1398                         wpa_msg(wpa_s, MSG_INFO,
1399                                 "No PSK available for association");
1400                         return -1;
1401                 }
1402         } else
1403                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1404
1405         return 0;
1406 }
1407
1408
1409 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1410 {
1411         *pos = 0x00;
1412
1413         switch (idx) {
1414         case 0: /* Bits 0-7 */
1415                 break;
1416         case 1: /* Bits 8-15 */
1417                 break;
1418         case 2: /* Bits 16-23 */
1419 #ifdef CONFIG_WNM
1420                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1421                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1422 #endif /* CONFIG_WNM */
1423                 break;
1424         case 3: /* Bits 24-31 */
1425 #ifdef CONFIG_WNM
1426                 *pos |= 0x02; /* Bit 25 - SSID List */
1427 #endif /* CONFIG_WNM */
1428 #ifdef CONFIG_INTERWORKING
1429                 if (wpa_s->conf->interworking)
1430                         *pos |= 0x80; /* Bit 31 - Interworking */
1431 #endif /* CONFIG_INTERWORKING */
1432                 break;
1433         case 4: /* Bits 32-39 */
1434 #ifdef CONFIG_INTERWORKING
1435                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1436                         *pos |= 0x01; /* Bit 32 - QoS Map */
1437 #endif /* CONFIG_INTERWORKING */
1438                 break;
1439         case 5: /* Bits 40-47 */
1440 #ifdef CONFIG_HS20
1441                 if (wpa_s->conf->hs20)
1442                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1443 #endif /* CONFIG_HS20 */
1444 #ifdef CONFIG_MBO
1445                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1446 #endif /* CONFIG_MBO */
1447                 break;
1448         case 6: /* Bits 48-55 */
1449                 break;
1450         }
1451 }
1452
1453
1454 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1455 {
1456         u8 *pos = buf;
1457         u8 len = 6, i;
1458
1459         if (len < wpa_s->extended_capa_len)
1460                 len = wpa_s->extended_capa_len;
1461         if (buflen < (size_t) len + 2) {
1462                 wpa_printf(MSG_INFO,
1463                            "Not enough room for building extended capabilities element");
1464                 return -1;
1465         }
1466
1467         *pos++ = WLAN_EID_EXT_CAPAB;
1468         *pos++ = len;
1469         for (i = 0; i < len; i++, pos++) {
1470                 wpas_ext_capab_byte(wpa_s, pos, i);
1471
1472                 if (i < wpa_s->extended_capa_len) {
1473                         *pos &= ~wpa_s->extended_capa_mask[i];
1474                         *pos |= wpa_s->extended_capa[i];
1475                 }
1476         }
1477
1478         while (len > 0 && buf[1 + len] == 0) {
1479                 len--;
1480                 buf[1] = len;
1481         }
1482         if (len == 0)
1483                 return 0;
1484
1485         return 2 + len;
1486 }
1487
1488
1489 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1490                           struct wpa_bss *test_bss)
1491 {
1492         struct wpa_bss *bss;
1493
1494         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1495                 if (bss == test_bss)
1496                         return 1;
1497         }
1498
1499         return 0;
1500 }
1501
1502
1503 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1504                            struct wpa_ssid *test_ssid)
1505 {
1506         struct wpa_ssid *ssid;
1507
1508         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1509                 if (ssid == test_ssid)
1510                         return 1;
1511         }
1512
1513         return 0;
1514 }
1515
1516
1517 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1518                         struct wpa_ssid *test_ssid)
1519 {
1520         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1521                 return 0;
1522
1523         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1524 }
1525
1526
1527 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1528 {
1529         if (cwork == NULL)
1530                 return;
1531         os_free(cwork);
1532 }
1533
1534
1535 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1536 {
1537         struct wpa_connect_work *cwork;
1538         struct wpa_radio_work *work = wpa_s->connect_work;
1539
1540         if (!work)
1541                 return;
1542
1543         wpa_s->connect_work = NULL;
1544         cwork = work->ctx;
1545         work->ctx = NULL;
1546         wpas_connect_work_free(cwork);
1547         radio_work_done(work);
1548 }
1549
1550
1551 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1552 {
1553         struct os_reltime now;
1554         u8 addr[ETH_ALEN];
1555
1556         os_get_reltime(&now);
1557         if (wpa_s->last_mac_addr_style == style &&
1558             wpa_s->last_mac_addr_change.sec != 0 &&
1559             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1560                                 wpa_s->conf->rand_addr_lifetime)) {
1561                 wpa_msg(wpa_s, MSG_DEBUG,
1562                         "Previously selected random MAC address has not yet expired");
1563                 return 0;
1564         }
1565
1566         switch (style) {
1567         case 1:
1568                 if (random_mac_addr(addr) < 0)
1569                         return -1;
1570                 break;
1571         case 2:
1572                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1573                 if (random_mac_addr_keep_oui(addr) < 0)
1574                         return -1;
1575                 break;
1576         default:
1577                 return -1;
1578         }
1579
1580         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1581                 wpa_msg(wpa_s, MSG_INFO,
1582                         "Failed to set random MAC address");
1583                 return -1;
1584         }
1585
1586         os_get_reltime(&wpa_s->last_mac_addr_change);
1587         wpa_s->mac_addr_changed = 1;
1588         wpa_s->last_mac_addr_style = style;
1589
1590         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1591                 wpa_msg(wpa_s, MSG_INFO,
1592                         "Could not update MAC address information");
1593                 return -1;
1594         }
1595
1596         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1597                 MAC2STR(addr));
1598
1599         return 0;
1600 }
1601
1602
1603 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1604 {
1605         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1606             !wpa_s->conf->preassoc_mac_addr)
1607                 return 0;
1608
1609         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1610 }
1611
1612
1613 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1614
1615 /**
1616  * wpa_supplicant_associate - Request association
1617  * @wpa_s: Pointer to wpa_supplicant data
1618  * @bss: Scan results for the selected BSS, or %NULL if not available
1619  * @ssid: Configuration data for the selected network
1620  *
1621  * This function is used to request %wpa_supplicant to associate with a BSS.
1622  */
1623 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1624                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1625 {
1626         struct wpa_connect_work *cwork;
1627         int rand_style;
1628
1629         wpa_s->own_disconnect_req = 0;
1630
1631         /*
1632          * If we are starting a new connection, any previously pending EAPOL
1633          * RX cannot be valid anymore.
1634          */
1635         wpabuf_free(wpa_s->pending_eapol_rx);
1636         wpa_s->pending_eapol_rx = NULL;
1637
1638         if (ssid->mac_addr == -1)
1639                 rand_style = wpa_s->conf->mac_addr;
1640         else
1641                 rand_style = ssid->mac_addr;
1642
1643         wmm_ac_clear_saved_tspecs(wpa_s);
1644         wpa_s->reassoc_same_bss = 0;
1645
1646         if (wpa_s->last_ssid == ssid) {
1647                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1648                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1649                         wmm_ac_save_tspecs(wpa_s);
1650                         wpa_s->reassoc_same_bss = 1;
1651                 }
1652         } else if (rand_style > 0) {
1653                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1654                         return;
1655                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1656         } else if (wpa_s->mac_addr_changed) {
1657                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1658                         wpa_msg(wpa_s, MSG_INFO,
1659                                 "Could not restore permanent MAC address");
1660                         return;
1661                 }
1662                 wpa_s->mac_addr_changed = 0;
1663                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1664                         wpa_msg(wpa_s, MSG_INFO,
1665                                 "Could not update MAC address information");
1666                         return;
1667                 }
1668                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1669         }
1670         wpa_s->last_ssid = ssid;
1671
1672 #ifdef CONFIG_IBSS_RSN
1673         ibss_rsn_deinit(wpa_s->ibss_rsn);
1674         wpa_s->ibss_rsn = NULL;
1675 #endif /* CONFIG_IBSS_RSN */
1676
1677         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1678             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1679 #ifdef CONFIG_AP
1680                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1681                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1682                                 "mode");
1683                         return;
1684                 }
1685                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1686                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1687                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1688                                 wpas_p2p_ap_setup_failed(wpa_s);
1689                         return;
1690                 }
1691                 wpa_s->current_bss = bss;
1692 #else /* CONFIG_AP */
1693                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1694                         "the build");
1695 #endif /* CONFIG_AP */
1696                 return;
1697         }
1698
1699         if (ssid->mode == WPAS_MODE_MESH) {
1700 #ifdef CONFIG_MESH
1701                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1702                         wpa_msg(wpa_s, MSG_INFO,
1703                                 "Driver does not support mesh mode");
1704                         return;
1705                 }
1706                 if (bss)
1707                         ssid->frequency = bss->freq;
1708                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1709                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1710                         return;
1711                 }
1712                 wpa_s->current_bss = bss;
1713                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1714                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1715                         ssid->id);
1716 #else /* CONFIG_MESH */
1717                 wpa_msg(wpa_s, MSG_ERROR,
1718                         "mesh mode support not included in the build");
1719 #endif /* CONFIG_MESH */
1720                 return;
1721         }
1722
1723 #ifdef CONFIG_TDLS
1724         if (bss)
1725                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1726                                 bss->ie_len);
1727 #endif /* CONFIG_TDLS */
1728
1729         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1730             ssid->mode == IEEE80211_MODE_INFRA) {
1731                 sme_authenticate(wpa_s, bss, ssid);
1732                 return;
1733         }
1734
1735         if (wpa_s->connect_work) {
1736                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1737                 return;
1738         }
1739
1740         if (radio_work_pending(wpa_s, "connect")) {
1741                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1742                 return;
1743         }
1744
1745         wpas_abort_ongoing_scan(wpa_s);
1746
1747         cwork = os_zalloc(sizeof(*cwork));
1748         if (cwork == NULL)
1749                 return;
1750
1751         cwork->bss = bss;
1752         cwork->ssid = ssid;
1753
1754         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1755                            wpas_start_assoc_cb, cwork) < 0) {
1756                 os_free(cwork);
1757         }
1758 }
1759
1760
1761 static int bss_is_ibss(struct wpa_bss *bss)
1762 {
1763         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1764                 IEEE80211_CAP_IBSS;
1765 }
1766
1767
1768 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1769                             const struct wpa_ssid *ssid)
1770 {
1771         enum hostapd_hw_mode hw_mode;
1772         struct hostapd_hw_modes *mode = NULL;
1773         u8 channel;
1774         int i;
1775
1776 #ifdef CONFIG_HT_OVERRIDES
1777         if (ssid->disable_ht)
1778                 return 0;
1779 #endif /* CONFIG_HT_OVERRIDES */
1780
1781         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1782         if (hw_mode == NUM_HOSTAPD_MODES)
1783                 return 0;
1784         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1785                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1786                         mode = &wpa_s->hw.modes[i];
1787                         break;
1788                 }
1789         }
1790
1791         if (!mode)
1792                 return 0;
1793
1794         return mode->vht_capab != 0;
1795 }
1796
1797
1798 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1799                           const struct wpa_ssid *ssid,
1800                           struct hostapd_freq_params *freq)
1801 {
1802         enum hostapd_hw_mode hw_mode;
1803         struct hostapd_hw_modes *mode = NULL;
1804         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1805                            184, 192 };
1806         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1807         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1808         u8 channel;
1809         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1810         unsigned int j, k;
1811         struct hostapd_freq_params vht_freq;
1812         int chwidth, seg0, seg1;
1813         u32 vht_caps = 0;
1814
1815         freq->freq = ssid->frequency;
1816
1817         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1818                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1819
1820                 if (ssid->mode != WPAS_MODE_IBSS)
1821                         break;
1822
1823                 /* Don't adjust control freq in case of fixed_freq */
1824                 if (ssid->fixed_freq)
1825                         break;
1826
1827                 if (!bss_is_ibss(bss))
1828                         continue;
1829
1830                 if (ssid->ssid_len == bss->ssid_len &&
1831                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1832                         wpa_printf(MSG_DEBUG,
1833                                    "IBSS already found in scan results, adjust control freq: %d",
1834                                    bss->freq);
1835                         freq->freq = bss->freq;
1836                         obss_scan = 0;
1837                         break;
1838                 }
1839         }
1840
1841         /* For IBSS check HT_IBSS flag */
1842         if (ssid->mode == WPAS_MODE_IBSS &&
1843             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1844                 return;
1845
1846         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1847             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1848             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1849                 wpa_printf(MSG_DEBUG,
1850                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1851                 return;
1852         }
1853
1854         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1855         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1856                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1857                         mode = &wpa_s->hw.modes[i];
1858                         break;
1859                 }
1860         }
1861
1862         if (!mode)
1863                 return;
1864
1865         freq->ht_enabled = ht_supported(mode);
1866         if (!freq->ht_enabled)
1867                 return;
1868
1869         /* Setup higher BW only for 5 GHz */
1870         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1871                 return;
1872
1873         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1874                 pri_chan = &mode->channels[chan_idx];
1875                 if (pri_chan->chan == channel)
1876                         break;
1877                 pri_chan = NULL;
1878         }
1879         if (!pri_chan)
1880                 return;
1881
1882         /* Check primary channel flags */
1883         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1884                 return;
1885
1886         /* Check/setup HT40+/HT40- */
1887         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1888                 if (ht40plus[j] == channel) {
1889                         ht40 = 1;
1890                         break;
1891                 }
1892         }
1893
1894         /* Find secondary channel */
1895         for (i = 0; i < mode->num_channels; i++) {
1896                 sec_chan = &mode->channels[i];
1897                 if (sec_chan->chan == channel + ht40 * 4)
1898                         break;
1899                 sec_chan = NULL;
1900         }
1901         if (!sec_chan)
1902                 return;
1903
1904         /* Check secondary channel flags */
1905         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1906                 return;
1907
1908         freq->channel = pri_chan->chan;
1909
1910         switch (ht40) {
1911         case -1:
1912                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1913                         return;
1914                 freq->sec_channel_offset = -1;
1915                 break;
1916         case 1:
1917                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1918                         return;
1919                 freq->sec_channel_offset = 1;
1920                 break;
1921         default:
1922                 break;
1923         }
1924
1925         if (freq->sec_channel_offset && obss_scan) {
1926                 struct wpa_scan_results *scan_res;
1927
1928                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1929                 if (scan_res == NULL) {
1930                         /* Back to HT20 */
1931                         freq->sec_channel_offset = 0;
1932                         return;
1933                 }
1934
1935                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1936                                      sec_chan->chan);
1937                 switch (res) {
1938                 case 0:
1939                         /* Back to HT20 */
1940                         freq->sec_channel_offset = 0;
1941                         break;
1942                 case 1:
1943                         /* Configuration allowed */
1944                         break;
1945                 case 2:
1946                         /* Switch pri/sec channels */
1947                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1948                         freq->sec_channel_offset = -freq->sec_channel_offset;
1949                         freq->channel = sec_chan->chan;
1950                         break;
1951                 default:
1952                         freq->sec_channel_offset = 0;
1953                         break;
1954                 }
1955
1956                 wpa_scan_results_free(scan_res);
1957         }
1958
1959         wpa_printf(MSG_DEBUG,
1960                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1961                    freq->channel, freq->sec_channel_offset);
1962
1963         if (!drv_supports_vht(wpa_s, ssid))
1964                 return;
1965
1966         /* For IBSS check VHT_IBSS flag */
1967         if (ssid->mode == WPAS_MODE_IBSS &&
1968             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1969                 return;
1970
1971         vht_freq = *freq;
1972
1973         vht_freq.vht_enabled = vht_supported(mode);
1974         if (!vht_freq.vht_enabled)
1975                 return;
1976
1977         /* setup center_freq1, bandwidth */
1978         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1979                 if (freq->channel >= vht80[j] &&
1980                     freq->channel < vht80[j] + 16)
1981                         break;
1982         }
1983
1984         if (j == ARRAY_SIZE(vht80))
1985                 return;
1986
1987         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1988                 struct hostapd_channel_data *chan;
1989
1990                 chan = hw_get_channel_chan(mode, i, NULL);
1991                 if (!chan)
1992                         return;
1993
1994                 /* Back to HT configuration if channel not usable */
1995                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1996                         return;
1997         }
1998
1999         chwidth = VHT_CHANWIDTH_80MHZ;
2000         seg0 = vht80[j] + 6;
2001         seg1 = 0;
2002
2003         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2004                 /* setup center_freq2, bandwidth */
2005                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2006                         /* Only accept 80 MHz segments separated by a gap */
2007                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2008                                 continue;
2009                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2010                                 struct hostapd_channel_data *chan;
2011
2012                                 chan = hw_get_channel_chan(mode, i, NULL);
2013                                 if (!chan)
2014                                         continue;
2015
2016                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2017                                                   HOSTAPD_CHAN_NO_IR |
2018                                                   HOSTAPD_CHAN_RADAR))
2019                                         continue;
2020
2021                                 /* Found a suitable second segment for 80+80 */
2022                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2023                                 vht_caps |=
2024                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2025                                 seg1 = vht80[k] + 6;
2026                         }
2027
2028                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2029                                 break;
2030                 }
2031         }
2032
2033         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2034                                     freq->channel, freq->ht_enabled,
2035                                     vht_freq.vht_enabled,
2036                                     freq->sec_channel_offset,
2037                                     chwidth, seg0, seg1, vht_caps) != 0)
2038                 return;
2039
2040         *freq = vht_freq;
2041
2042         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2043                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2044 }
2045
2046
2047 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2048 {
2049         struct wpa_connect_work *cwork = work->ctx;
2050         struct wpa_bss *bss = cwork->bss;
2051         struct wpa_ssid *ssid = cwork->ssid;
2052         struct wpa_supplicant *wpa_s = work->wpa_s;
2053         u8 wpa_ie[200];
2054         size_t wpa_ie_len;
2055         int use_crypt, ret, i, bssid_changed;
2056         int algs = WPA_AUTH_ALG_OPEN;
2057         unsigned int cipher_pairwise, cipher_group;
2058         struct wpa_driver_associate_params params;
2059         int wep_keys_set = 0;
2060         int assoc_failed = 0;
2061         struct wpa_ssid *old_ssid;
2062 #ifdef CONFIG_HT_OVERRIDES
2063         struct ieee80211_ht_capabilities htcaps;
2064         struct ieee80211_ht_capabilities htcaps_mask;
2065 #endif /* CONFIG_HT_OVERRIDES */
2066 #ifdef CONFIG_VHT_OVERRIDES
2067        struct ieee80211_vht_capabilities vhtcaps;
2068        struct ieee80211_vht_capabilities vhtcaps_mask;
2069 #endif /* CONFIG_VHT_OVERRIDES */
2070 #ifdef CONFIG_MBO
2071         const u8 *mbo = NULL;
2072 #endif /* CONFIG_MBO */
2073
2074         if (deinit) {
2075                 if (work->started) {
2076                         wpa_s->connect_work = NULL;
2077
2078                         /* cancel possible auth. timeout */
2079                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2080                                              NULL);
2081                 }
2082                 wpas_connect_work_free(cwork);
2083                 return;
2084         }
2085
2086         wpa_s->connect_work = work;
2087
2088         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2089             wpas_network_disabled(wpa_s, ssid)) {
2090                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2091                 wpas_connect_work_done(wpa_s);
2092                 return;
2093         }
2094
2095         os_memset(&params, 0, sizeof(params));
2096         wpa_s->reassociate = 0;
2097         wpa_s->eap_expected_failure = 0;
2098         if (bss &&
2099             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2100 #ifdef CONFIG_IEEE80211R
2101                 const u8 *ie, *md = NULL;
2102 #endif /* CONFIG_IEEE80211R */
2103                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2104                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2105                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2106                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2107                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2108                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2109                 if (bssid_changed)
2110                         wpas_notify_bssid_changed(wpa_s);
2111 #ifdef CONFIG_IEEE80211R
2112                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2113                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2114                         md = ie + 2;
2115                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2116                 if (md) {
2117                         /* Prepare for the next transition */
2118                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2119                 }
2120 #endif /* CONFIG_IEEE80211R */
2121 #ifdef CONFIG_WPS
2122         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2123                    wpa_s->conf->ap_scan == 2 &&
2124                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2125                 /* Use ap_scan==1 style network selection to find the network
2126                  */
2127                 wpas_connect_work_done(wpa_s);
2128                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2129                 wpa_s->reassociate = 1;
2130                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2131                 return;
2132 #endif /* CONFIG_WPS */
2133         } else {
2134                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2135                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2136                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2137         }
2138         if (!wpa_s->pno)
2139                 wpa_supplicant_cancel_sched_scan(wpa_s);
2140
2141         wpa_supplicant_cancel_scan(wpa_s);
2142
2143         /* Starting new association, so clear the possibly used WPA IE from the
2144          * previous association. */
2145         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2146
2147 #ifdef IEEE8021X_EAPOL
2148         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2149                 if (ssid->leap) {
2150                         if (ssid->non_leap == 0)
2151                                 algs = WPA_AUTH_ALG_LEAP;
2152                         else
2153                                 algs |= WPA_AUTH_ALG_LEAP;
2154                 }
2155         }
2156 #endif /* IEEE8021X_EAPOL */
2157         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2158         if (ssid->auth_alg) {
2159                 algs = ssid->auth_alg;
2160                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2161                         "0x%x", algs);
2162         }
2163
2164         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2165                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2166             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2167                 int try_opportunistic;
2168                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2169                                      wpa_s->conf->okc :
2170                                      ssid->proactive_key_caching) &&
2171                         (ssid->proto & WPA_PROTO_RSN);
2172                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2173                                             ssid, try_opportunistic) == 0)
2174                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2175                 wpa_ie_len = sizeof(wpa_ie);
2176                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2177                                               wpa_ie, &wpa_ie_len)) {
2178                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2179                                 "key management and encryption suites");
2180                         wpas_connect_work_done(wpa_s);
2181                         return;
2182                 }
2183         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2184                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2185                 /*
2186                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2187                  * use non-WPA since the scan results did not indicate that the
2188                  * AP is using WPA or WPA2.
2189                  */
2190                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2191                 wpa_ie_len = 0;
2192                 wpa_s->wpa_proto = 0;
2193         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2194                 wpa_ie_len = sizeof(wpa_ie);
2195                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2196                                               wpa_ie, &wpa_ie_len)) {
2197                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2198                                 "key management and encryption suites (no "
2199                                 "scan results)");
2200                         wpas_connect_work_done(wpa_s);
2201                         return;
2202                 }
2203 #ifdef CONFIG_WPS
2204         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2205                 struct wpabuf *wps_ie;
2206                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2207                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2208                         wpa_ie_len = wpabuf_len(wps_ie);
2209                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2210                 } else
2211                         wpa_ie_len = 0;
2212                 wpabuf_free(wps_ie);
2213                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2214                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2215                         params.wps = WPS_MODE_PRIVACY;
2216                 else
2217                         params.wps = WPS_MODE_OPEN;
2218                 wpa_s->wpa_proto = 0;
2219 #endif /* CONFIG_WPS */
2220         } else {
2221                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2222                 wpa_ie_len = 0;
2223                 wpa_s->wpa_proto = 0;
2224         }
2225
2226 #ifdef CONFIG_P2P
2227         if (wpa_s->global->p2p) {
2228                 u8 *pos;
2229                 size_t len;
2230                 int res;
2231                 pos = wpa_ie + wpa_ie_len;
2232                 len = sizeof(wpa_ie) - wpa_ie_len;
2233                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2234                                             ssid->p2p_group);
2235                 if (res >= 0)
2236                         wpa_ie_len += res;
2237         }
2238
2239         wpa_s->cross_connect_disallowed = 0;
2240         if (bss) {
2241                 struct wpabuf *p2p;
2242                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2243                 if (p2p) {
2244                         wpa_s->cross_connect_disallowed =
2245                                 p2p_get_cross_connect_disallowed(p2p);
2246                         wpabuf_free(p2p);
2247                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2248                                 "connection",
2249                                 wpa_s->cross_connect_disallowed ?
2250                                 "disallows" : "allows");
2251                 }
2252         }
2253
2254         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2255 #endif /* CONFIG_P2P */
2256
2257 #ifdef CONFIG_MBO
2258         if (bss) {
2259                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2260                 if (mbo) {
2261                         int len;
2262
2263                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2264                                                         wpa_ie + wpa_ie_len,
2265                                                         sizeof(wpa_ie) -
2266                                                         wpa_ie_len);
2267                         if (len > 0)
2268                                 wpa_ie_len += len;
2269                 }
2270         }
2271 #endif /* CONFIG_MBO */
2272
2273         /*
2274          * Workaround: Add Extended Capabilities element only if the AP
2275          * included this element in Beacon/Probe Response frames. Some older
2276          * APs seem to have interoperability issues if this element is
2277          * included, so while the standard may require us to include the
2278          * element in all cases, it is justifiable to skip it to avoid
2279          * interoperability issues.
2280          */
2281         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2282                 u8 ext_capab[18];
2283                 int ext_capab_len;
2284                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2285                                                      sizeof(ext_capab));
2286                 if (ext_capab_len > 0) {
2287                         u8 *pos = wpa_ie;
2288                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2289                                 pos += 2 + pos[1];
2290                         os_memmove(pos + ext_capab_len, pos,
2291                                    wpa_ie_len - (pos - wpa_ie));
2292                         wpa_ie_len += ext_capab_len;
2293                         os_memcpy(pos, ext_capab, ext_capab_len);
2294                 }
2295         }
2296
2297 #ifdef CONFIG_HS20
2298         if (is_hs20_network(wpa_s, ssid, bss)) {
2299                 struct wpabuf *hs20;
2300
2301                 hs20 = wpabuf_alloc(20);
2302                 if (hs20) {
2303                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2304                         size_t len;
2305
2306                         wpas_hs20_add_indication(hs20, pps_mo_id);
2307                         len = sizeof(wpa_ie) - wpa_ie_len;
2308                         if (wpabuf_len(hs20) <= len) {
2309                                 os_memcpy(wpa_ie + wpa_ie_len,
2310                                           wpabuf_head(hs20), wpabuf_len(hs20));
2311                                 wpa_ie_len += wpabuf_len(hs20);
2312                         }
2313                         wpabuf_free(hs20);
2314                 }
2315         }
2316 #endif /* CONFIG_HS20 */
2317
2318         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2319                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2320                 size_t len;
2321
2322                 len = sizeof(wpa_ie) - wpa_ie_len;
2323                 if (wpabuf_len(buf) <= len) {
2324                         os_memcpy(wpa_ie + wpa_ie_len,
2325                                   wpabuf_head(buf), wpabuf_len(buf));
2326                         wpa_ie_len += wpabuf_len(buf);
2327                 }
2328         }
2329
2330 #ifdef CONFIG_FST
2331         if (wpa_s->fst_ies) {
2332                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2333
2334                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2335                         os_memcpy(wpa_ie + wpa_ie_len,
2336                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2337                         wpa_ie_len += fst_ies_len;
2338                 }
2339         }
2340 #endif /* CONFIG_FST */
2341
2342 #ifdef CONFIG_MBO
2343         if (mbo) {
2344                 int len;
2345
2346                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2347                                   sizeof(wpa_ie) - wpa_ie_len);
2348                 if (len >= 0)
2349                         wpa_ie_len += len;
2350         }
2351 #endif /* CONFIG_MBO */
2352
2353         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2354         use_crypt = 1;
2355         cipher_pairwise = wpa_s->pairwise_cipher;
2356         cipher_group = wpa_s->group_cipher;
2357         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2358             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2359                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2360                         use_crypt = 0;
2361                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2362                         use_crypt = 1;
2363                         wep_keys_set = 1;
2364                 }
2365         }
2366         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2367                 use_crypt = 0;
2368
2369 #ifdef IEEE8021X_EAPOL
2370         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2371                 if ((ssid->eapol_flags &
2372                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2373                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2374                     !wep_keys_set) {
2375                         use_crypt = 0;
2376                 } else {
2377                         /* Assume that dynamic WEP-104 keys will be used and
2378                          * set cipher suites in order for drivers to expect
2379                          * encryption. */
2380                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2381                 }
2382         }
2383 #endif /* IEEE8021X_EAPOL */
2384
2385         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2386                 /* Set the key before (and later after) association */
2387                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2388         }
2389
2390         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2391         if (bss) {
2392                 params.ssid = bss->ssid;
2393                 params.ssid_len = bss->ssid_len;
2394                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2395                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2396                                    MACSTR " freq=%u MHz based on scan results "
2397                                    "(bssid_set=%d)",
2398                                    MAC2STR(bss->bssid), bss->freq,
2399                                    ssid->bssid_set);
2400                         params.bssid = bss->bssid;
2401                         params.freq.freq = bss->freq;
2402                 }
2403                 params.bssid_hint = bss->bssid;
2404                 params.freq_hint = bss->freq;
2405                 params.pbss = bss_is_pbss(bss);
2406         } else {
2407                 params.ssid = ssid->ssid;
2408                 params.ssid_len = ssid->ssid_len;
2409                 params.pbss = ssid->pbss;
2410         }
2411
2412         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2413             wpa_s->conf->ap_scan == 2) {
2414                 params.bssid = ssid->bssid;
2415                 params.fixed_bssid = 1;
2416         }
2417
2418         /* Initial frequency for IBSS/mesh */
2419         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2420             ssid->frequency > 0 && params.freq.freq == 0)
2421                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2422
2423         if (ssid->mode == WPAS_MODE_IBSS) {
2424                 params.fixed_freq = ssid->fixed_freq;
2425                 if (ssid->beacon_int)
2426                         params.beacon_int = ssid->beacon_int;
2427                 else
2428                         params.beacon_int = wpa_s->conf->beacon_int;
2429         }
2430
2431         params.wpa_ie = wpa_ie;
2432         params.wpa_ie_len = wpa_ie_len;
2433         params.pairwise_suite = cipher_pairwise;
2434         params.group_suite = cipher_group;
2435         params.key_mgmt_suite = wpa_s->key_mgmt;
2436         params.wpa_proto = wpa_s->wpa_proto;
2437         params.auth_alg = algs;
2438         params.mode = ssid->mode;
2439         params.bg_scan_period = ssid->bg_scan_period;
2440         for (i = 0; i < NUM_WEP_KEYS; i++) {
2441                 if (ssid->wep_key_len[i])
2442                         params.wep_key[i] = ssid->wep_key[i];
2443                 params.wep_key_len[i] = ssid->wep_key_len[i];
2444         }
2445         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2446
2447         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2448             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2449              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2450                 params.passphrase = ssid->passphrase;
2451                 if (ssid->psk_set)
2452                         params.psk = ssid->psk;
2453         }
2454
2455         if (wpa_s->conf->key_mgmt_offload) {
2456                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2457                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2458                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2459                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2460                         params.req_key_mgmt_offload =
2461                                 ssid->proactive_key_caching < 0 ?
2462                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2463                 else
2464                         params.req_key_mgmt_offload = 1;
2465
2466                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2467                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2468                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2469                     ssid->psk_set)
2470                         params.psk = ssid->psk;
2471         }
2472
2473         params.drop_unencrypted = use_crypt;
2474
2475 #ifdef CONFIG_IEEE80211W
2476         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2477         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2478                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2479                 struct wpa_ie_data ie;
2480                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2481                     ie.capabilities &
2482                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2483                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2484                                 "MFP: require MFP");
2485                         params.mgmt_frame_protection =
2486                                 MGMT_FRAME_PROTECTION_REQUIRED;
2487                 }
2488         }
2489 #endif /* CONFIG_IEEE80211W */
2490
2491         params.p2p = ssid->p2p_group;
2492
2493         if (wpa_s->p2pdev->set_sta_uapsd)
2494                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2495         else
2496                 params.uapsd = -1;
2497
2498 #ifdef CONFIG_HT_OVERRIDES
2499         os_memset(&htcaps, 0, sizeof(htcaps));
2500         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2501         params.htcaps = (u8 *) &htcaps;
2502         params.htcaps_mask = (u8 *) &htcaps_mask;
2503         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2504 #endif /* CONFIG_HT_OVERRIDES */
2505 #ifdef CONFIG_VHT_OVERRIDES
2506         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2507         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2508         params.vhtcaps = &vhtcaps;
2509         params.vhtcaps_mask = &vhtcaps_mask;
2510         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2511 #endif /* CONFIG_VHT_OVERRIDES */
2512
2513 #ifdef CONFIG_P2P
2514         /*
2515          * If multi-channel concurrency is not supported, check for any
2516          * frequency conflict. In case of any frequency conflict, remove the
2517          * least prioritized connection.
2518          */
2519         if (wpa_s->num_multichan_concurrent < 2) {
2520                 int freq, num;
2521                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2522                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2523                         wpa_printf(MSG_DEBUG,
2524                                    "Assoc conflicting freq found (%d != %d)",
2525                                    freq, params.freq.freq);
2526                         if (wpas_p2p_handle_frequency_conflicts(
2527                                     wpa_s, params.freq.freq, ssid) < 0) {
2528                                 wpas_connect_work_done(wpa_s);
2529                                 return;
2530                         }
2531                 }
2532         }
2533 #endif /* CONFIG_P2P */
2534
2535         ret = wpa_drv_associate(wpa_s, &params);
2536         if (ret < 0) {
2537                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2538                         "failed");
2539                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2540                         /*
2541                          * The driver is known to mean what is saying, so we
2542                          * can stop right here; the association will not
2543                          * succeed.
2544                          */
2545                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2546                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2547                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2548                         return;
2549                 }
2550                 /* try to continue anyway; new association will be tried again
2551                  * after timeout */
2552                 assoc_failed = 1;
2553         }
2554
2555         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2556                 /* Set the key after the association just in case association
2557                  * cleared the previously configured key. */
2558                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2559                 /* No need to timeout authentication since there is no key
2560                  * management. */
2561                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2562                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2563 #ifdef CONFIG_IBSS_RSN
2564         } else if (ssid->mode == WPAS_MODE_IBSS &&
2565                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2566                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2567                 /*
2568                  * RSN IBSS authentication is per-STA and we can disable the
2569                  * per-BSSID authentication.
2570                  */
2571                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2572 #endif /* CONFIG_IBSS_RSN */
2573         } else {
2574                 /* Timeout for IEEE 802.11 authentication and association */
2575                 int timeout = 60;
2576
2577                 if (assoc_failed) {
2578                         /* give IBSS a bit more time */
2579                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2580                 } else if (wpa_s->conf->ap_scan == 1) {
2581                         /* give IBSS a bit more time */
2582                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2583                 }
2584                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2585         }
2586
2587         if (wep_keys_set &&
2588             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2589                 /* Set static WEP keys again */
2590                 wpa_set_wep_keys(wpa_s, ssid);
2591         }
2592
2593         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2594                 /*
2595                  * Do not allow EAP session resumption between different
2596                  * network configurations.
2597                  */
2598                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2599         }
2600         old_ssid = wpa_s->current_ssid;
2601         wpa_s->current_ssid = ssid;
2602         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2603                 wpa_s->current_bss = bss;
2604         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2605         wpa_supplicant_initiate_eapol(wpa_s);
2606         if (old_ssid != wpa_s->current_ssid)
2607                 wpas_notify_network_changed(wpa_s);
2608 }
2609
2610
2611 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2612                                             const u8 *addr)
2613 {
2614         struct wpa_ssid *old_ssid;
2615
2616         wpas_connect_work_done(wpa_s);
2617         wpa_clear_keys(wpa_s, addr);
2618         old_ssid = wpa_s->current_ssid;
2619         wpa_supplicant_mark_disassoc(wpa_s);
2620         wpa_sm_set_config(wpa_s->wpa, NULL);
2621         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2622         if (old_ssid != wpa_s->current_ssid)
2623                 wpas_notify_network_changed(wpa_s);
2624         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2625 }
2626
2627
2628 /**
2629  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2630  * @wpa_s: Pointer to wpa_supplicant data
2631  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2632  *
2633  * This function is used to request %wpa_supplicant to deauthenticate from the
2634  * current AP.
2635  */
2636 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2637                                    int reason_code)
2638 {
2639         u8 *addr = NULL;
2640         union wpa_event_data event;
2641         int zero_addr = 0;
2642
2643         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2644                 " pending_bssid=" MACSTR " reason=%d state=%s",
2645                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2646                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2647
2648         if (!is_zero_ether_addr(wpa_s->bssid))
2649                 addr = wpa_s->bssid;
2650         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2651                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2652                   wpa_s->wpa_state == WPA_ASSOCIATING))
2653                 addr = wpa_s->pending_bssid;
2654         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2655                 /*
2656                  * When using driver-based BSS selection, we may not know the
2657                  * BSSID with which we are currently trying to associate. We
2658                  * need to notify the driver of this disconnection even in such
2659                  * a case, so use the all zeros address here.
2660                  */
2661                 addr = wpa_s->bssid;
2662                 zero_addr = 1;
2663         }
2664
2665 #ifdef CONFIG_TDLS
2666         wpa_tdls_teardown_peers(wpa_s->wpa);
2667 #endif /* CONFIG_TDLS */
2668
2669 #ifdef CONFIG_MESH
2670         if (wpa_s->ifmsh) {
2671                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2672                         wpa_s->ifname);
2673                 wpa_supplicant_leave_mesh(wpa_s);
2674         }
2675 #endif /* CONFIG_MESH */
2676
2677         if (addr) {
2678                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2679                 os_memset(&event, 0, sizeof(event));
2680                 event.deauth_info.reason_code = (u16) reason_code;
2681                 event.deauth_info.locally_generated = 1;
2682                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2683                 if (zero_addr)
2684                         addr = NULL;
2685         }
2686
2687         wpa_supplicant_clear_connection(wpa_s, addr);
2688 }
2689
2690 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2691                                               struct wpa_ssid *ssid)
2692 {
2693         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2694                 return;
2695
2696         ssid->disabled = 0;
2697         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2698         wpas_notify_network_enabled_changed(wpa_s, ssid);
2699
2700         /*
2701          * Try to reassociate since there is no current configuration and a new
2702          * network was made available.
2703          */
2704         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2705                 wpa_s->reassociate = 1;
2706 }
2707
2708
2709 /**
2710  * wpa_supplicant_enable_network - Mark a configured network as enabled
2711  * @wpa_s: wpa_supplicant structure for a network interface
2712  * @ssid: wpa_ssid structure for a configured network or %NULL
2713  *
2714  * Enables the specified network or all networks if no network specified.
2715  */
2716 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2717                                    struct wpa_ssid *ssid)
2718 {
2719         if (ssid == NULL) {
2720                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2721                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2722         } else
2723                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2724
2725         if (wpa_s->reassociate && !wpa_s->disconnected &&
2726             (!wpa_s->current_ssid ||
2727              wpa_s->wpa_state == WPA_DISCONNECTED ||
2728              wpa_s->wpa_state == WPA_SCANNING)) {
2729                 if (wpa_s->sched_scanning) {
2730                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2731                                    "new network to scan filters");
2732                         wpa_supplicant_cancel_sched_scan(wpa_s);
2733                 }
2734
2735                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2736                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2737                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2738                 }
2739         }
2740 }
2741
2742
2743 /**
2744  * wpa_supplicant_disable_network - Mark a configured network as disabled
2745  * @wpa_s: wpa_supplicant structure for a network interface
2746  * @ssid: wpa_ssid structure for a configured network or %NULL
2747  *
2748  * Disables the specified network or all networks if no network specified.
2749  */
2750 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2751                                     struct wpa_ssid *ssid)
2752 {
2753         struct wpa_ssid *other_ssid;
2754         int was_disabled;
2755
2756         if (ssid == NULL) {
2757                 if (wpa_s->sched_scanning)
2758                         wpa_supplicant_cancel_sched_scan(wpa_s);
2759
2760                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2761                      other_ssid = other_ssid->next) {
2762                         was_disabled = other_ssid->disabled;
2763                         if (was_disabled == 2)
2764                                 continue; /* do not change persistent P2P group
2765                                            * data */
2766
2767                         other_ssid->disabled = 1;
2768
2769                         if (was_disabled != other_ssid->disabled)
2770                                 wpas_notify_network_enabled_changed(
2771                                         wpa_s, other_ssid);
2772                 }
2773                 if (wpa_s->current_ssid)
2774                         wpa_supplicant_deauthenticate(
2775                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2776         } else if (ssid->disabled != 2) {
2777                 if (ssid == wpa_s->current_ssid)
2778                         wpa_supplicant_deauthenticate(
2779                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2780
2781                 was_disabled = ssid->disabled;
2782
2783                 ssid->disabled = 1;
2784
2785                 if (was_disabled != ssid->disabled) {
2786                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2787                         if (wpa_s->sched_scanning) {
2788                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2789                                            "to remove network from filters");
2790                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2791                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2792                         }
2793                 }
2794         }
2795 }
2796
2797
2798 /**
2799  * wpa_supplicant_select_network - Attempt association with a network
2800  * @wpa_s: wpa_supplicant structure for a network interface
2801  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2802  */
2803 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2804                                    struct wpa_ssid *ssid)
2805 {
2806
2807         struct wpa_ssid *other_ssid;
2808         int disconnected = 0;
2809
2810         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2811                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2812                         wpa_s->own_disconnect_req = 1;
2813                 wpa_supplicant_deauthenticate(
2814                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2815                 disconnected = 1;
2816         }
2817
2818         if (ssid)
2819                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2820
2821         /*
2822          * Mark all other networks disabled or mark all networks enabled if no
2823          * network specified.
2824          */
2825         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2826              other_ssid = other_ssid->next) {
2827                 int was_disabled = other_ssid->disabled;
2828                 if (was_disabled == 2)
2829                         continue; /* do not change persistent P2P group data */
2830
2831                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2832                 if (was_disabled && !other_ssid->disabled)
2833                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2834
2835                 if (was_disabled != other_ssid->disabled)
2836                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2837         }
2838
2839         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2840             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2841                 /* We are already associated with the selected network */
2842                 wpa_printf(MSG_DEBUG, "Already associated with the "
2843                            "selected network - do nothing");
2844                 return;
2845         }
2846
2847         if (ssid) {
2848                 wpa_s->current_ssid = ssid;
2849                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2850                 wpa_s->connect_without_scan =
2851                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2852
2853                 /*
2854                  * Don't optimize next scan freqs since a new ESS has been
2855                  * selected.
2856                  */
2857                 os_free(wpa_s->next_scan_freqs);
2858                 wpa_s->next_scan_freqs = NULL;
2859         } else {
2860                 wpa_s->connect_without_scan = NULL;
2861         }
2862
2863         wpa_s->disconnected = 0;
2864         wpa_s->reassociate = 1;
2865
2866         if (wpa_s->connect_without_scan ||
2867             wpa_supplicant_fast_associate(wpa_s) != 1) {
2868                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2869                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2870         }
2871
2872         if (ssid)
2873                 wpas_notify_network_selected(wpa_s, ssid);
2874 }
2875
2876
2877 /**
2878  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2879  * @wpa_s: wpa_supplicant structure for a network interface
2880  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2881  * @pkcs11_module_path: PKCS #11 module path or NULL
2882  * Returns: 0 on success; -1 on failure
2883  *
2884  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2885  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2886  * module path fails the paths will be reset to the default value (NULL).
2887  */
2888 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2889                                            const char *pkcs11_engine_path,
2890                                            const char *pkcs11_module_path)
2891 {
2892         char *pkcs11_engine_path_copy = NULL;
2893         char *pkcs11_module_path_copy = NULL;
2894
2895         if (pkcs11_engine_path != NULL) {
2896                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2897                 if (pkcs11_engine_path_copy == NULL)
2898                         return -1;
2899         }
2900         if (pkcs11_module_path != NULL) {
2901                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2902                 if (pkcs11_module_path_copy == NULL) {
2903                         os_free(pkcs11_engine_path_copy);
2904                         return -1;
2905                 }
2906         }
2907
2908         os_free(wpa_s->conf->pkcs11_engine_path);
2909         os_free(wpa_s->conf->pkcs11_module_path);
2910         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2911         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2912
2913         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2914         eapol_sm_deinit(wpa_s->eapol);
2915         wpa_s->eapol = NULL;
2916         if (wpa_supplicant_init_eapol(wpa_s)) {
2917                 /* Error -> Reset paths to the default value (NULL) once. */
2918                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2919                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2920                                                                NULL);
2921
2922                 return -1;
2923         }
2924         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2925
2926         return 0;
2927 }
2928
2929
2930 /**
2931  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2932  * @wpa_s: wpa_supplicant structure for a network interface
2933  * @ap_scan: AP scan mode
2934  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2935  *
2936  */
2937 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2938 {
2939
2940         int old_ap_scan;
2941
2942         if (ap_scan < 0 || ap_scan > 2)
2943                 return -1;
2944
2945         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2946                 wpa_printf(MSG_INFO,
2947                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2948         }
2949
2950 #ifdef ANDROID
2951         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2952             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2953             wpa_s->wpa_state < WPA_COMPLETED) {
2954                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2955                            "associating", wpa_s->conf->ap_scan, ap_scan);
2956                 return 0;
2957         }
2958 #endif /* ANDROID */
2959
2960         old_ap_scan = wpa_s->conf->ap_scan;
2961         wpa_s->conf->ap_scan = ap_scan;
2962
2963         if (old_ap_scan != wpa_s->conf->ap_scan)
2964                 wpas_notify_ap_scan_changed(wpa_s);
2965
2966         return 0;
2967 }
2968
2969
2970 /**
2971  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2972  * @wpa_s: wpa_supplicant structure for a network interface
2973  * @expire_age: Expiration age in seconds
2974  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2975  *
2976  */
2977 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2978                                           unsigned int bss_expire_age)
2979 {
2980         if (bss_expire_age < 10) {
2981                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2982                         bss_expire_age);
2983                 return -1;
2984         }
2985         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2986                 bss_expire_age);
2987         wpa_s->conf->bss_expiration_age = bss_expire_age;
2988
2989         return 0;
2990 }
2991
2992
2993 /**
2994  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2995  * @wpa_s: wpa_supplicant structure for a network interface
2996  * @expire_count: number of scans after which an unseen BSS is reclaimed
2997  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2998  *
2999  */
3000 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3001                                             unsigned int bss_expire_count)
3002 {
3003         if (bss_expire_count < 1) {
3004                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3005                         bss_expire_count);
3006                 return -1;
3007         }
3008         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3009                 bss_expire_count);
3010         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3011
3012         return 0;
3013 }
3014
3015
3016 /**
3017  * wpa_supplicant_set_scan_interval - Set scan interval
3018  * @wpa_s: wpa_supplicant structure for a network interface
3019  * @scan_interval: scan interval in seconds
3020  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3021  *
3022  */
3023 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3024                                      int scan_interval)
3025 {
3026         if (scan_interval < 0) {
3027                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3028                         scan_interval);
3029                 return -1;
3030         }
3031         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3032                 scan_interval);
3033         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3034
3035         return 0;
3036 }
3037
3038
3039 /**
3040  * wpa_supplicant_set_debug_params - Set global debug params
3041  * @global: wpa_global structure
3042  * @debug_level: debug level
3043  * @debug_timestamp: determines if show timestamp in debug data
3044  * @debug_show_keys: determines if show keys in debug data
3045  * Returns: 0 if succeed or -1 if debug_level has wrong value
3046  */
3047 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3048                                     int debug_timestamp, int debug_show_keys)
3049 {
3050
3051         int old_level, old_timestamp, old_show_keys;
3052
3053         /* check for allowed debuglevels */
3054         if (debug_level != MSG_EXCESSIVE &&
3055             debug_level != MSG_MSGDUMP &&
3056             debug_level != MSG_DEBUG &&
3057             debug_level != MSG_INFO &&
3058             debug_level != MSG_WARNING &&
3059             debug_level != MSG_ERROR)
3060                 return -1;
3061
3062         old_level = wpa_debug_level;
3063         old_timestamp = wpa_debug_timestamp;
3064         old_show_keys = wpa_debug_show_keys;
3065
3066         wpa_debug_level = debug_level;
3067         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3068         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3069
3070         if (wpa_debug_level != old_level)
3071                 wpas_notify_debug_level_changed(global);
3072         if (wpa_debug_timestamp != old_timestamp)
3073                 wpas_notify_debug_timestamp_changed(global);
3074         if (wpa_debug_show_keys != old_show_keys)
3075                 wpas_notify_debug_show_keys_changed(global);
3076
3077         return 0;
3078 }
3079
3080
3081 /**
3082  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3083  * @wpa_s: Pointer to wpa_supplicant data
3084  * Returns: A pointer to the current network structure or %NULL on failure
3085  */
3086 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3087 {
3088         struct wpa_ssid *entry;
3089         u8 ssid[SSID_MAX_LEN];
3090         int res;
3091         size_t ssid_len;
3092         u8 bssid[ETH_ALEN];
3093         int wired;
3094
3095         res = wpa_drv_get_ssid(wpa_s, ssid);
3096         if (res < 0) {
3097                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3098                         "driver");
3099                 return NULL;
3100         }
3101         ssid_len = res;
3102
3103         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3104                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3105                         "driver");
3106                 return NULL;
3107         }
3108
3109         wired = wpa_s->conf->ap_scan == 0 &&
3110                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3111
3112         entry = wpa_s->conf->ssid;
3113         while (entry) {
3114                 if (!wpas_network_disabled(wpa_s, entry) &&
3115                     ((ssid_len == entry->ssid_len &&
3116                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3117                     (!entry->bssid_set ||
3118                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3119                         return entry;
3120 #ifdef CONFIG_WPS
3121                 if (!wpas_network_disabled(wpa_s, entry) &&
3122                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3123                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3124                     (!entry->bssid_set ||
3125                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3126                         return entry;
3127 #endif /* CONFIG_WPS */
3128
3129                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3130                     entry->ssid_len == 0 &&
3131                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3132                         return entry;
3133
3134                 entry = entry->next;
3135         }
3136
3137         return NULL;
3138 }
3139
3140
3141 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3142 {
3143         struct wpa_global *global = wpa_s->global;
3144
3145         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3146                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3147                 if (global->drv_priv[i] == NULL) {
3148                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3149                                    "'%s'", wpa_drivers[i]->name);
3150                         return -1;
3151                 }
3152         }
3153
3154         wpa_s->driver = wpa_drivers[i];
3155         wpa_s->global_drv_priv = global->drv_priv[i];
3156
3157         return 0;
3158 }
3159
3160
3161 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3162                                      const char *name)
3163 {
3164         int i;
3165         size_t len;
3166         const char *pos, *driver = name;
3167
3168         if (wpa_s == NULL)
3169                 return -1;
3170
3171         if (wpa_drivers[0] == NULL) {
3172                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3173                         "wpa_supplicant");
3174                 return -1;
3175         }
3176
3177         if (name == NULL) {
3178                 /* default to first driver in the list */
3179                 return select_driver(wpa_s, 0);
3180         }
3181
3182         do {
3183                 pos = os_strchr(driver, ',');
3184                 if (pos)
3185                         len = pos - driver;
3186                 else
3187                         len = os_strlen(driver);
3188
3189                 for (i = 0; wpa_drivers[i]; i++) {
3190                         if (os_strlen(wpa_drivers[i]->name) == len &&
3191                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3192                             0) {
3193                                 /* First driver that succeeds wins */
3194                                 if (select_driver(wpa_s, i) == 0)
3195                                         return 0;
3196                         }
3197                 }
3198
3199                 driver = pos + 1;
3200         } while (pos);
3201
3202         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3203         return -1;
3204 }
3205
3206
3207 /**
3208  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3209  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3210  *      with struct wpa_driver_ops::init()
3211  * @src_addr: Source address of the EAPOL frame
3212  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3213  * @len: Length of the EAPOL data
3214  *
3215  * This function is called for each received EAPOL frame. Most driver
3216  * interfaces rely on more generic OS mechanism for receiving frames through
3217  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3218  * take care of received EAPOL frames and deliver them to the core supplicant
3219  * code by calling this function.
3220  */
3221 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3222                              const u8 *buf, size_t len)
3223 {
3224         struct wpa_supplicant *wpa_s = ctx;
3225
3226         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3227         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3228
3229 #ifdef CONFIG_PEERKEY
3230         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3231             wpa_s->current_ssid->peerkey &&
3232             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3233             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3234                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3235                 return;
3236         }
3237 #endif /* CONFIG_PEERKEY */
3238
3239         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3240             (wpa_s->last_eapol_matches_bssid &&
3241 #ifdef CONFIG_AP
3242              !wpa_s->ap_iface &&
3243 #endif /* CONFIG_AP */
3244              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3245                 /*
3246                  * There is possible race condition between receiving the
3247                  * association event and the EAPOL frame since they are coming
3248                  * through different paths from the driver. In order to avoid
3249                  * issues in trying to process the EAPOL frame before receiving
3250                  * association information, lets queue it for processing until
3251                  * the association event is received. This may also be needed in
3252                  * driver-based roaming case, so also use src_addr != BSSID as a
3253                  * trigger if we have previously confirmed that the
3254                  * Authenticator uses BSSID as the src_addr (which is not the
3255                  * case with wired IEEE 802.1X).
3256                  */
3257                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3258                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3259                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3260                         MAC2STR(wpa_s->bssid));
3261                 wpabuf_free(wpa_s->pending_eapol_rx);
3262                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3263                 if (wpa_s->pending_eapol_rx) {
3264                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3265                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3266                                   ETH_ALEN);
3267                 }
3268                 return;
3269         }
3270
3271         wpa_s->last_eapol_matches_bssid =
3272                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3273
3274 #ifdef CONFIG_AP
3275         if (wpa_s->ap_iface) {
3276                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3277                 return;
3278         }
3279 #endif /* CONFIG_AP */
3280
3281         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3282                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3283                         "no key management is configured");
3284                 return;
3285         }
3286
3287         if (wpa_s->eapol_received == 0 &&
3288             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3289              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3290              wpa_s->wpa_state != WPA_COMPLETED) &&
3291             (wpa_s->current_ssid == NULL ||
3292              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3293                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3294                 int timeout = 10;
3295
3296                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3297                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3298                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3299                         /* Use longer timeout for IEEE 802.1X/EAP */
3300                         timeout = 70;
3301                 }
3302
3303 #ifdef CONFIG_WPS
3304                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3305                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3306                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3307                         /*
3308                          * Use shorter timeout if going through WPS AP iteration
3309                          * for PIN config method with an AP that does not
3310                          * advertise Selected Registrar.
3311                          */
3312                         struct wpabuf *wps_ie;
3313
3314                         wps_ie = wpa_bss_get_vendor_ie_multi(
3315                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3316                         if (wps_ie &&
3317                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3318                                 timeout = 10;
3319                         wpabuf_free(wps_ie);
3320                 }
3321 #endif /* CONFIG_WPS */
3322
3323                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3324         }
3325         wpa_s->eapol_received++;
3326
3327         if (wpa_s->countermeasures) {
3328                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3329                         "EAPOL packet");
3330                 return;
3331         }
3332
3333 #ifdef CONFIG_IBSS_RSN
3334         if (wpa_s->current_ssid &&
3335             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3336                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3337                 return;
3338         }
3339 #endif /* CONFIG_IBSS_RSN */
3340
3341         /* Source address of the incoming EAPOL frame could be compared to the
3342          * current BSSID. However, it is possible that a centralized
3343          * Authenticator could be using another MAC address than the BSSID of
3344          * an AP, so just allow any address to be used for now. The replies are
3345          * still sent to the current BSSID (if available), though. */
3346
3347         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3348         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3349             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3350                 return;
3351         wpa_drv_poll(wpa_s);
3352         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3353                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3354         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3355                 /*
3356                  * Set portValid = TRUE here since we are going to skip 4-way
3357                  * handshake processing which would normally set portValid. We
3358                  * need this to allow the EAPOL state machines to be completed
3359                  * without going through EAPOL-Key handshake.
3360                  */
3361                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3362         }
3363 }
3364
3365
3366 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3367 {
3368         if ((!wpa_s->p2p_mgmt ||
3369              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3370             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3371                 l2_packet_deinit(wpa_s->l2);
3372                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3373                                            wpa_drv_get_mac_addr(wpa_s),
3374                                            ETH_P_EAPOL,
3375                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3376                 if (wpa_s->l2 == NULL)
3377                         return -1;
3378         } else {
3379                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3380                 if (addr)
3381                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3382         }
3383
3384         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3385                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3386                 return -1;
3387         }
3388
3389         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3390
3391         return 0;
3392 }
3393
3394
3395 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3396                                            const u8 *buf, size_t len)
3397 {
3398         struct wpa_supplicant *wpa_s = ctx;
3399         const struct l2_ethhdr *eth;
3400
3401         if (len < sizeof(*eth))
3402                 return;
3403         eth = (const struct l2_ethhdr *) buf;
3404
3405         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3406             !(eth->h_dest[0] & 0x01)) {
3407                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3408                         " (bridge - not for this interface - ignore)",
3409                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3410                 return;
3411         }
3412
3413         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3414                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3415         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3416                                 len - sizeof(*eth));
3417 }
3418
3419
3420 /**
3421  * wpa_supplicant_driver_init - Initialize driver interface parameters
3422  * @wpa_s: Pointer to wpa_supplicant data
3423  * Returns: 0 on success, -1 on failure
3424  *
3425  * This function is called to initialize driver interface parameters.
3426  * wpa_drv_init() must have been called before this function to initialize the
3427  * driver interface.
3428  */
3429 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3430 {
3431         static int interface_count = 0;
3432
3433         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3434                 return -1;
3435
3436         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3437                 MAC2STR(wpa_s->own_addr));
3438         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3439         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3440
3441         if (wpa_s->bridge_ifname[0]) {
3442                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3443                         "interface '%s'", wpa_s->bridge_ifname);
3444                 wpa_s->l2_br = l2_packet_init_bridge(
3445                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3446                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3447                 if (wpa_s->l2_br == NULL) {
3448                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3449                                 "connection for the bridge interface '%s'",
3450                                 wpa_s->bridge_ifname);
3451                         return -1;
3452                 }
3453         }
3454
3455         if (wpa_s->conf->ap_scan == 2 &&
3456             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3457                 wpa_printf(MSG_INFO,
3458                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3459         }
3460
3461         wpa_clear_keys(wpa_s, NULL);
3462
3463         /* Make sure that TKIP countermeasures are not left enabled (could
3464          * happen if wpa_supplicant is killed during countermeasures. */
3465         wpa_drv_set_countermeasures(wpa_s, 0);
3466
3467         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3468         wpa_drv_flush_pmkid(wpa_s);
3469
3470         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3471         wpa_s->prev_scan_wildcard = 0;
3472
3473         if (wpa_supplicant_enabled_networks(wpa_s)) {
3474                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3475                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3476                         interface_count = 0;
3477                 }
3478 #ifndef ANDROID
3479                 if (!wpa_s->p2p_mgmt &&
3480                     wpa_supplicant_delayed_sched_scan(wpa_s,
3481                                                       interface_count % 3,
3482                                                       100000))
3483                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3484                                                 100000);
3485 #endif /* ANDROID */
3486                 interface_count++;
3487         } else
3488                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3489
3490         return 0;
3491 }
3492
3493
3494 static int wpa_supplicant_daemon(const char *pid_file)
3495 {
3496         wpa_printf(MSG_DEBUG, "Daemonize..");
3497         return os_daemonize(pid_file);
3498 }
3499
3500
3501 static struct wpa_supplicant *
3502 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3503 {
3504         struct wpa_supplicant *wpa_s;
3505
3506         wpa_s = os_zalloc(sizeof(*wpa_s));
3507         if (wpa_s == NULL)
3508                 return NULL;
3509         wpa_s->scan_req = INITIAL_SCAN_REQ;
3510         wpa_s->scan_interval = 5;
3511         wpa_s->new_connection = 1;
3512         wpa_s->parent = parent ? parent : wpa_s;
3513         wpa_s->p2pdev = wpa_s->parent;
3514         wpa_s->sched_scanning = 0;
3515
3516         dl_list_init(&wpa_s->bss_tmp_disallowed);
3517
3518         return wpa_s;
3519 }
3520
3521
3522 #ifdef CONFIG_HT_OVERRIDES
3523
3524 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3525                              struct ieee80211_ht_capabilities *htcaps,
3526                              struct ieee80211_ht_capabilities *htcaps_mask,
3527                              const char *ht_mcs)
3528 {
3529         /* parse ht_mcs into hex array */
3530         int i;
3531         const char *tmp = ht_mcs;
3532         char *end = NULL;
3533
3534         /* If ht_mcs is null, do not set anything */
3535         if (!ht_mcs)
3536                 return 0;
3537
3538         /* This is what we are setting in the kernel */
3539         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3540
3541         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3542
3543         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3544                 errno = 0;
3545                 long v = strtol(tmp, &end, 16);
3546                 if (errno == 0) {
3547                         wpa_msg(wpa_s, MSG_DEBUG,
3548                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3549                                 i, v, end, tmp);
3550                         if (end == tmp)
3551                                 break;
3552
3553                         htcaps->supported_mcs_set[i] = v;
3554                         tmp = end;
3555                 } else {
3556                         wpa_msg(wpa_s, MSG_ERROR,
3557                                 "Failed to parse ht-mcs: %s, error: %s\n",
3558                                 ht_mcs, strerror(errno));
3559                         return -1;
3560                 }
3561         }
3562
3563         /*
3564          * If we were able to parse any values, then set mask for the MCS set.
3565          */
3566         if (i) {
3567                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3568                           IEEE80211_HT_MCS_MASK_LEN - 1);
3569                 /* skip the 3 reserved bits */
3570                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3571                         0x1f;
3572         }
3573
3574         return 0;
3575 }
3576
3577
3578 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3579                                  struct ieee80211_ht_capabilities *htcaps,
3580                                  struct ieee80211_ht_capabilities *htcaps_mask,
3581                                  int disabled)
3582 {
3583         le16 msk;
3584
3585         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3586
3587         if (disabled == -1)
3588                 return 0;
3589
3590         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3591         htcaps_mask->ht_capabilities_info |= msk;
3592         if (disabled)
3593                 htcaps->ht_capabilities_info &= msk;
3594         else
3595                 htcaps->ht_capabilities_info |= msk;
3596
3597         return 0;
3598 }
3599
3600
3601 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3602                                 struct ieee80211_ht_capabilities *htcaps,
3603                                 struct ieee80211_ht_capabilities *htcaps_mask,
3604                                 int factor)
3605 {
3606         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3607
3608         if (factor == -1)
3609                 return 0;
3610
3611         if (factor < 0 || factor > 3) {
3612                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3613                         "Must be 0-3 or -1", factor);
3614                 return -EINVAL;
3615         }
3616
3617         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3618         htcaps->a_mpdu_params &= ~0x3;
3619         htcaps->a_mpdu_params |= factor & 0x3;
3620
3621         return 0;
3622 }
3623
3624
3625 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3626                                  struct ieee80211_ht_capabilities *htcaps,
3627                                  struct ieee80211_ht_capabilities *htcaps_mask,
3628                                  int density)
3629 {
3630         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3631
3632         if (density == -1)
3633                 return 0;
3634
3635         if (density < 0 || density > 7) {
3636                 wpa_msg(wpa_s, MSG_ERROR,
3637                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3638                         density);
3639                 return -EINVAL;
3640         }
3641
3642         htcaps_mask->a_mpdu_params |= 0x1C;
3643         htcaps->a_mpdu_params &= ~(0x1C);
3644         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3645
3646         return 0;
3647 }
3648
3649
3650 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3651                                 struct ieee80211_ht_capabilities *htcaps,
3652                                 struct ieee80211_ht_capabilities *htcaps_mask,
3653                                 int disabled)
3654 {
3655         /* Masking these out disables HT40 */
3656         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3657                                 HT_CAP_INFO_SHORT_GI40MHZ);
3658
3659         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3660
3661         if (disabled)
3662                 htcaps->ht_capabilities_info &= ~msk;
3663         else
3664                 htcaps->ht_capabilities_info |= msk;
3665
3666         htcaps_mask->ht_capabilities_info |= msk;
3667
3668         return 0;
3669 }
3670
3671
3672 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3673                                struct ieee80211_ht_capabilities *htcaps,
3674                                struct ieee80211_ht_capabilities *htcaps_mask,
3675                                int disabled)
3676 {
3677         /* Masking these out disables SGI */
3678         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3679                                 HT_CAP_INFO_SHORT_GI40MHZ);
3680
3681         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3682
3683         if (disabled)
3684                 htcaps->ht_capabilities_info &= ~msk;
3685         else
3686                 htcaps->ht_capabilities_info |= msk;
3687
3688         htcaps_mask->ht_capabilities_info |= msk;
3689
3690         return 0;
3691 }
3692
3693
3694 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3695                                struct ieee80211_ht_capabilities *htcaps,
3696                                struct ieee80211_ht_capabilities *htcaps_mask,
3697                                int disabled)
3698 {
3699         /* Masking these out disables LDPC */
3700         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3701
3702         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3703
3704         if (disabled)
3705                 htcaps->ht_capabilities_info &= ~msk;
3706         else
3707                 htcaps->ht_capabilities_info |= msk;
3708
3709         htcaps_mask->ht_capabilities_info |= msk;
3710
3711         return 0;
3712 }
3713
3714
3715 void wpa_supplicant_apply_ht_overrides(
3716         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3717         struct wpa_driver_associate_params *params)
3718 {
3719         struct ieee80211_ht_capabilities *htcaps;
3720         struct ieee80211_ht_capabilities *htcaps_mask;
3721
3722         if (!ssid)
3723                 return;
3724
3725         params->disable_ht = ssid->disable_ht;
3726         if (!params->htcaps || !params->htcaps_mask)
3727                 return;
3728
3729         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3730         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3731         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3732         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3733                               ssid->disable_max_amsdu);
3734         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3735         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3736         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3737         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3738         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3739
3740         if (ssid->ht40_intolerant) {
3741                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3742                 htcaps->ht_capabilities_info |= bit;
3743                 htcaps_mask->ht_capabilities_info |= bit;
3744         }
3745 }
3746
3747 #endif /* CONFIG_HT_OVERRIDES */
3748
3749
3750 #ifdef CONFIG_VHT_OVERRIDES
3751 void wpa_supplicant_apply_vht_overrides(
3752         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3753         struct wpa_driver_associate_params *params)
3754 {
3755         struct ieee80211_vht_capabilities *vhtcaps;
3756         struct ieee80211_vht_capabilities *vhtcaps_mask;
3757
3758         if (!ssid)
3759                 return;
3760
3761         params->disable_vht = ssid->disable_vht;
3762
3763         vhtcaps = (void *) params->vhtcaps;
3764         vhtcaps_mask = (void *) params->vhtcaps_mask;
3765
3766         if (!vhtcaps || !vhtcaps_mask)
3767                 return;
3768
3769         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3770         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3771
3772 #ifdef CONFIG_HT_OVERRIDES
3773         /* if max ampdu is <= 3, we have to make the HT cap the same */
3774         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3775                 int max_ampdu;
3776
3777                 max_ampdu = (ssid->vht_capa &
3778                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3779                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3780
3781                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3782                 wpa_set_ampdu_factor(wpa_s,
3783                                      (void *) params->htcaps,
3784                                      (void *) params->htcaps_mask,
3785                                      max_ampdu);
3786         }
3787 #endif /* CONFIG_HT_OVERRIDES */
3788
3789 #define OVERRIDE_MCS(i)                                                 \
3790         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3791                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3792                         3 << 2 * (i - 1);                               \
3793                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3794                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3795         }                                                               \
3796         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3797                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3798                         3 << 2 * (i - 1);                               \
3799                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3800                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3801         }
3802
3803         OVERRIDE_MCS(1);
3804         OVERRIDE_MCS(2);
3805         OVERRIDE_MCS(3);
3806         OVERRIDE_MCS(4);
3807         OVERRIDE_MCS(5);
3808         OVERRIDE_MCS(6);
3809         OVERRIDE_MCS(7);
3810         OVERRIDE_MCS(8);
3811 }
3812 #endif /* CONFIG_VHT_OVERRIDES */
3813
3814
3815 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3816 {
3817 #ifdef PCSC_FUNCS
3818         size_t len;
3819
3820         if (!wpa_s->conf->pcsc_reader)
3821                 return 0;
3822
3823         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3824         if (!wpa_s->scard)
3825                 return 1;
3826
3827         if (wpa_s->conf->pcsc_pin &&
3828             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3829                 scard_deinit(wpa_s->scard);
3830                 wpa_s->scard = NULL;
3831                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3832                 return -1;
3833         }
3834
3835         len = sizeof(wpa_s->imsi) - 1;
3836         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3837                 scard_deinit(wpa_s->scard);
3838                 wpa_s->scard = NULL;
3839                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3840                 return -1;
3841         }
3842         wpa_s->imsi[len] = '\0';
3843
3844         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3845
3846         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3847                    wpa_s->imsi, wpa_s->mnc_len);
3848
3849         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3850         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3851 #endif /* PCSC_FUNCS */
3852
3853         return 0;
3854 }
3855
3856
3857 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3858 {
3859         char *val, *pos;
3860
3861         ext_password_deinit(wpa_s->ext_pw);
3862         wpa_s->ext_pw = NULL;
3863         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3864
3865         if (!wpa_s->conf->ext_password_backend)
3866                 return 0;
3867
3868         val = os_strdup(wpa_s->conf->ext_password_backend);
3869         if (val == NULL)
3870                 return -1;
3871         pos = os_strchr(val, ':');
3872         if (pos)
3873                 *pos++ = '\0';
3874
3875         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3876
3877         wpa_s->ext_pw = ext_password_init(val, pos);
3878         os_free(val);
3879         if (wpa_s->ext_pw == NULL) {
3880                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3881                 return -1;
3882         }
3883         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3884
3885         return 0;
3886 }
3887
3888
3889 #ifdef CONFIG_FST
3890
3891 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3892 {
3893         struct wpa_supplicant *wpa_s = ctx;
3894
3895         return (is_zero_ether_addr(wpa_s->bssid) ||
3896                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3897 }
3898
3899
3900 static void wpas_fst_get_channel_info_cb(void *ctx,
3901                                          enum hostapd_hw_mode *hw_mode,
3902                                          u8 *channel)
3903 {
3904         struct wpa_supplicant *wpa_s = ctx;
3905
3906         if (wpa_s->current_bss) {
3907                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3908                                                   channel);
3909         } else if (wpa_s->hw.num_modes) {
3910                 *hw_mode = wpa_s->hw.modes[0].mode;
3911         } else {
3912                 WPA_ASSERT(0);
3913                 *hw_mode = 0;
3914         }
3915 }
3916
3917
3918 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3919 {
3920         struct wpa_supplicant *wpa_s = ctx;
3921
3922         *modes = wpa_s->hw.modes;
3923         return wpa_s->hw.num_modes;
3924 }
3925
3926
3927 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3928 {
3929         struct wpa_supplicant *wpa_s = ctx;
3930
3931         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3932         wpa_s->fst_ies = fst_ies;
3933 }
3934
3935
3936 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3937 {
3938         struct wpa_supplicant *wpa_s = ctx;
3939
3940         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3941         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3942                                           wpa_s->own_addr, wpa_s->bssid,
3943                                           wpabuf_head(data), wpabuf_len(data),
3944                                    0);
3945 }
3946
3947
3948 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3949 {
3950         struct wpa_supplicant *wpa_s = ctx;
3951
3952         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3953         return wpa_s->received_mb_ies;
3954 }
3955
3956
3957 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3958                                      const u8 *buf, size_t size)
3959 {
3960         struct wpa_supplicant *wpa_s = ctx;
3961         struct mb_ies_info info;
3962
3963         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3964
3965         if (!mb_ies_info_by_ies(&info, buf, size)) {
3966                 wpabuf_free(wpa_s->received_mb_ies);
3967                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3968         }
3969 }
3970
3971
3972 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3973                                    Boolean mb_only)
3974 {
3975         struct wpa_supplicant *wpa_s = ctx;
3976
3977         *get_ctx = NULL;
3978         if (!is_zero_ether_addr(wpa_s->bssid))
3979                 return (wpa_s->received_mb_ies || !mb_only) ?
3980                         wpa_s->bssid : NULL;
3981         return NULL;
3982 }
3983
3984
3985 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3986                                   Boolean mb_only)
3987 {
3988         return NULL;
3989 }
3990
3991 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3992                                        struct fst_wpa_obj *iface_obj)
3993 {
3994         iface_obj->ctx              = wpa_s;
3995         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3996         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3997         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3998         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3999         iface_obj->send_action      = wpas_fst_send_action_cb;
4000         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4001         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4002         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4003         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4004 }
4005 #endif /* CONFIG_FST */
4006
4007 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4008                                     const struct wpa_driver_capa *capa)
4009 {
4010         struct wowlan_triggers *triggers;
4011         int ret = 0;
4012
4013         if (!wpa_s->conf->wowlan_triggers)
4014                 return 0;
4015
4016         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4017         if (triggers) {
4018                 ret = wpa_drv_wowlan(wpa_s, triggers);
4019                 os_free(triggers);
4020         }
4021         return ret;
4022 }
4023
4024
4025 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
4026 {
4027         if (freq < 3000)
4028                 return BAND_2_4_GHZ;
4029         if (freq > 50000)
4030                 return BAND_60_GHZ;
4031         return BAND_5_GHZ;
4032 }
4033
4034
4035 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
4036                                    const int *freqs)
4037 {
4038         int i;
4039         unsigned int band = 0;
4040
4041         if (freqs) {
4042                 /* freqs are specified for the radio work */
4043                 for (i = 0; freqs[i]; i++)
4044                         band |= wpas_freq_to_band(freqs[i]);
4045         } else {
4046                 /*
4047                  * freqs are not specified, implies all
4048                  * the supported freqs by HW
4049                  */
4050                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4051                         if (wpa_s->hw.modes[i].num_channels != 0) {
4052                                 if (wpa_s->hw.modes[i].mode ==
4053                                     HOSTAPD_MODE_IEEE80211B ||
4054                                     wpa_s->hw.modes[i].mode ==
4055                                     HOSTAPD_MODE_IEEE80211G)
4056                                         band |= BAND_2_4_GHZ;
4057                                 else if (wpa_s->hw.modes[i].mode ==
4058                                          HOSTAPD_MODE_IEEE80211A)
4059                                         band |= BAND_5_GHZ;
4060                                 else if (wpa_s->hw.modes[i].mode ==
4061                                          HOSTAPD_MODE_IEEE80211AD)
4062                                         band |= BAND_60_GHZ;
4063                                 else if (wpa_s->hw.modes[i].mode ==
4064                                          HOSTAPD_MODE_IEEE80211ANY)
4065                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4066                                                 BAND_60_GHZ;
4067                         }
4068                 }
4069         }
4070
4071         return band;
4072 }
4073
4074
4075 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4076                                               const char *rn)
4077 {
4078         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4079         struct wpa_radio *radio;
4080
4081         while (rn && iface) {
4082                 radio = iface->radio;
4083                 if (radio && os_strcmp(rn, radio->name) == 0) {
4084                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4085                                    wpa_s->ifname, rn);
4086                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4087                         return radio;
4088                 }
4089
4090                 iface = iface->next;
4091         }
4092
4093         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4094                    wpa_s->ifname, rn ? rn : "N/A");
4095         radio = os_zalloc(sizeof(*radio));
4096         if (radio == NULL)
4097                 return NULL;
4098
4099         if (rn)
4100                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4101         dl_list_init(&radio->ifaces);
4102         dl_list_init(&radio->work);
4103         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4104
4105         return radio;
4106 }
4107
4108
4109 static void radio_work_free(struct wpa_radio_work *work)
4110 {
4111         if (work->wpa_s->scan_work == work) {
4112                 /* This should not really happen. */
4113                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4114                         work->type, work, work->started);
4115                 work->wpa_s->scan_work = NULL;
4116         }
4117
4118 #ifdef CONFIG_P2P
4119         if (work->wpa_s->p2p_scan_work == work) {
4120                 /* This should not really happen. */
4121                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4122                         work->type, work, work->started);
4123                 work->wpa_s->p2p_scan_work = NULL;
4124         }
4125 #endif /* CONFIG_P2P */
4126
4127         if (work->started) {
4128                 work->wpa_s->radio->num_active_works--;
4129                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4130                         "radio_work_free('%s'@%p: num_active_works --> %u",
4131                         work->type, work,
4132                         work->wpa_s->radio->num_active_works);
4133         }
4134
4135         dl_list_del(&work->list);
4136         os_free(work);
4137 }
4138
4139
4140 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4141 {
4142         struct wpa_radio_work *active_work = NULL;
4143         struct wpa_radio_work *tmp;
4144
4145         /* Get the active work to know the type and band. */
4146         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4147                 if (tmp->started) {
4148                         active_work = tmp;
4149                         break;
4150                 }
4151         }
4152
4153         if (!active_work) {
4154                 /* No active work, start one */
4155                 radio->num_active_works = 0;
4156                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4157                                  list) {
4158                         if (os_strcmp(tmp->type, "scan") == 0 &&
4159                             radio->external_scan_running &&
4160                             (((struct wpa_driver_scan_params *)
4161                               tmp->ctx)->only_new_results ||
4162                              tmp->wpa_s->clear_driver_scan_cache))
4163                                 continue;
4164                         return tmp;
4165                 }
4166                 return NULL;
4167         }
4168
4169         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4170             os_strcmp(active_work->type, "connect") == 0) {
4171                 /*
4172                  * If the active work is either connect or sme-connect,
4173                  * do not parallelize them with other radio works.
4174                  */
4175                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4176                         "Do not parallelize radio work with %s",
4177                         active_work->type);
4178                 return NULL;
4179         }
4180
4181         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4182                 if (tmp->started)
4183                         continue;
4184
4185                 /*
4186                  * If connect or sme-connect are enqueued, parallelize only
4187                  * those operations ahead of them in the queue.
4188                  */
4189                 if (os_strcmp(tmp->type, "connect") == 0 ||
4190                     os_strcmp(tmp->type, "sme-connect") == 0)
4191                         break;
4192
4193                 /*
4194                  * Check that the radio works are distinct and
4195                  * on different bands.
4196                  */
4197                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4198                     (active_work->bands != tmp->bands)) {
4199                         /*
4200                          * If a scan has to be scheduled through nl80211 scan
4201                          * interface and if an external scan is already running,
4202                          * do not schedule the scan since it is likely to get
4203                          * rejected by kernel.
4204                          */
4205                         if (os_strcmp(tmp->type, "scan") == 0 &&
4206                             radio->external_scan_running &&
4207                             (((struct wpa_driver_scan_params *)
4208                               tmp->ctx)->only_new_results ||
4209                              tmp->wpa_s->clear_driver_scan_cache))
4210                                 continue;
4211
4212                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4213                                 "active_work:%s new_work:%s",
4214                                 active_work->type, tmp->type);
4215                         return tmp;
4216                 }
4217         }
4218
4219         /* Did not find a radio work to schedule in parallel. */
4220         return NULL;
4221 }
4222
4223
4224 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4225 {
4226         struct wpa_radio *radio = eloop_ctx;
4227         struct wpa_radio_work *work;
4228         struct os_reltime now, diff;
4229         struct wpa_supplicant *wpa_s;
4230
4231         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4232         if (work == NULL) {
4233                 radio->num_active_works = 0;
4234                 return;
4235         }
4236
4237         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4238                               radio_list);
4239
4240         if (!(wpa_s &&
4241               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4242                 if (work->started)
4243                         return; /* already started and still in progress */
4244
4245                 if (wpa_s && wpa_s->radio->external_scan_running) {
4246                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4247                         return;
4248                 }
4249         } else {
4250                 work = NULL;
4251                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4252                         /* get the work to schedule next */
4253                         work = radio_work_get_next_work(radio);
4254                 }
4255                 if (!work)
4256                         return;
4257         }
4258
4259         wpa_s = work->wpa_s;
4260         os_get_reltime(&now);
4261         os_reltime_sub(&now, &work->time, &diff);
4262         wpa_dbg(wpa_s, MSG_DEBUG,
4263                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4264                 work->type, work, diff.sec, diff.usec);
4265         work->started = 1;
4266         work->time = now;
4267         radio->num_active_works++;
4268
4269         work->cb(work, 0);
4270
4271         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4272             radio->num_active_works < MAX_ACTIVE_WORKS)
4273                 radio_work_check_next(wpa_s);
4274 }
4275
4276
4277 /*
4278  * This function removes both started and pending radio works running on
4279  * the provided interface's radio.
4280  * Prior to the removal of the radio work, its callback (cb) is called with
4281  * deinit set to be 1. Each work's callback is responsible for clearing its
4282  * internal data and restoring to a correct state.
4283  * @wpa_s: wpa_supplicant data
4284  * @type: type of works to be removed
4285  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4286  * this interface's works.
4287  */
4288 void radio_remove_works(struct wpa_supplicant *wpa_s,
4289                         const char *type, int remove_all)
4290 {
4291         struct wpa_radio_work *work, *tmp;
4292         struct wpa_radio *radio = wpa_s->radio;
4293
4294         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4295                               list) {
4296                 if (type && os_strcmp(type, work->type) != 0)
4297                         continue;
4298
4299                 /* skip other ifaces' works */
4300                 if (!remove_all && work->wpa_s != wpa_s)
4301                         continue;
4302
4303                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4304                         work->type, work, work->started ? " (started)" : "");
4305                 work->cb(work, 1);
4306                 radio_work_free(work);
4307         }
4308
4309         /* in case we removed the started work */
4310         radio_work_check_next(wpa_s);
4311 }
4312
4313
4314 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4315 {
4316         struct wpa_radio *radio = wpa_s->radio;
4317
4318         if (!radio)
4319                 return;
4320
4321         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4322                    wpa_s->ifname, radio->name);
4323         dl_list_del(&wpa_s->radio_list);
4324         radio_remove_works(wpa_s, NULL, 0);
4325         wpa_s->radio = NULL;
4326         if (!dl_list_empty(&radio->ifaces))
4327                 return; /* Interfaces remain for this radio */
4328
4329         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4330         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4331         os_free(radio);
4332 }
4333
4334
4335 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4336 {
4337         struct wpa_radio *radio = wpa_s->radio;
4338
4339         if (dl_list_empty(&radio->work))
4340                 return;
4341         if (wpa_s->ext_work_in_progress) {
4342                 wpa_printf(MSG_DEBUG,
4343                            "External radio work in progress - delay start of pending item");
4344                 return;
4345         }
4346         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4347         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4348 }
4349
4350
4351 /**
4352  * radio_add_work - Add a radio work item
4353  * @wpa_s: Pointer to wpa_supplicant data
4354  * @freq: Frequency of the offchannel operation in MHz or 0
4355  * @type: Unique identifier for each type of work
4356  * @next: Force as the next work to be executed
4357  * @cb: Callback function for indicating when radio is available
4358  * @ctx: Context pointer for the work (work->ctx in cb())
4359  * Returns: 0 on success, -1 on failure
4360  *
4361  * This function is used to request time for an operation that requires
4362  * exclusive radio control. Once the radio is available, the registered callback
4363  * function will be called. radio_work_done() must be called once the exclusive
4364  * radio operation has been completed, so that the radio is freed for other
4365  * operations. The special case of deinit=1 is used to free the context data
4366  * during interface removal. That does not allow the callback function to start
4367  * the radio operation, i.e., it must free any resources allocated for the radio
4368  * work and return.
4369  *
4370  * The @freq parameter can be used to indicate a single channel on which the
4371  * offchannel operation will occur. This may allow multiple radio work
4372  * operations to be performed in parallel if they apply for the same channel.
4373  * Setting this to 0 indicates that the work item may use multiple channels or
4374  * requires exclusive control of the radio.
4375  */
4376 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4377                    const char *type, int next,
4378                    void (*cb)(struct wpa_radio_work *work, int deinit),
4379                    void *ctx)
4380 {
4381         struct wpa_radio *radio = wpa_s->radio;
4382         struct wpa_radio_work *work;
4383         int was_empty;
4384
4385         work = os_zalloc(sizeof(*work));
4386         if (work == NULL)
4387                 return -1;
4388         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4389         os_get_reltime(&work->time);
4390         work->freq = freq;
4391         work->type = type;
4392         work->wpa_s = wpa_s;
4393         work->cb = cb;
4394         work->ctx = ctx;
4395
4396         if (freq)
4397                 work->bands = wpas_freq_to_band(freq);
4398         else if (os_strcmp(type, "scan") == 0 ||
4399                  os_strcmp(type, "p2p-scan") == 0)
4400                 work->bands = wpas_get_bands(wpa_s,
4401                                              ((struct wpa_driver_scan_params *)
4402                                               ctx)->freqs);
4403         else
4404                 work->bands = wpas_get_bands(wpa_s, NULL);
4405
4406         was_empty = dl_list_empty(&wpa_s->radio->work);
4407         if (next)
4408                 dl_list_add(&wpa_s->radio->work, &work->list);
4409         else
4410                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4411         if (was_empty) {
4412                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4413                 radio_work_check_next(wpa_s);
4414         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4415                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4416                 wpa_dbg(wpa_s, MSG_DEBUG,
4417                         "Try to schedule a radio work (num_active_works=%u)",
4418                         radio->num_active_works);
4419                 radio_work_check_next(wpa_s);
4420         }
4421
4422         return 0;
4423 }
4424
4425
4426 /**
4427  * radio_work_done - Indicate that a radio work item has been completed
4428  * @work: Completed work
4429  *
4430  * This function is called once the callback function registered with
4431  * radio_add_work() has completed its work.
4432  */
4433 void radio_work_done(struct wpa_radio_work *work)
4434 {
4435         struct wpa_supplicant *wpa_s = work->wpa_s;
4436         struct os_reltime now, diff;
4437         unsigned int started = work->started;
4438
4439         os_get_reltime(&now);
4440         os_reltime_sub(&now, &work->time, &diff);
4441         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4442                 work->type, work, started ? "done" : "canceled",
4443                 diff.sec, diff.usec);
4444         radio_work_free(work);
4445         if (started)
4446                 radio_work_check_next(wpa_s);
4447 }
4448
4449
4450 struct wpa_radio_work *
4451 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4452 {
4453         struct wpa_radio_work *work;
4454         struct wpa_radio *radio = wpa_s->radio;
4455
4456         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4457                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4458                         return work;
4459         }
4460
4461         return NULL;
4462 }
4463
4464
4465 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4466                             struct wpa_interface *iface)
4467 {
4468         const char *ifname, *driver, *rn;
4469
4470         driver = iface->driver;
4471 next_driver:
4472         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4473                 return -1;
4474
4475         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4476         if (wpa_s->drv_priv == NULL) {
4477                 const char *pos;
4478                 pos = driver ? os_strchr(driver, ',') : NULL;
4479                 if (pos) {
4480                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4481                                 "driver interface - try next driver wrapper");
4482                         driver = pos + 1;
4483                         goto next_driver;
4484                 }
4485                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4486                         "interface");
4487                 return -1;
4488         }
4489         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4490                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4491                         "driver_param '%s'", wpa_s->conf->driver_param);
4492                 return -1;
4493         }
4494
4495         ifname = wpa_drv_get_ifname(wpa_s);
4496         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4497                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4498                         "interface name with '%s'", ifname);
4499                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4500         }
4501
4502         rn = wpa_driver_get_radio_name(wpa_s);
4503         if (rn && rn[0] == '\0')
4504                 rn = NULL;
4505
4506         wpa_s->radio = radio_add_interface(wpa_s, rn);
4507         if (wpa_s->radio == NULL)
4508                 return -1;
4509
4510         return 0;
4511 }
4512
4513
4514 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4515                                      struct wpa_interface *iface)
4516 {
4517         struct wpa_driver_capa capa;
4518         int capa_res;
4519
4520         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4521                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4522                    iface->confname ? iface->confname : "N/A",
4523                    iface->driver ? iface->driver : "default",
4524                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4525                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4526
4527         if (iface->confname) {
4528 #ifdef CONFIG_BACKEND_FILE
4529                 wpa_s->confname = os_rel2abs_path(iface->confname);
4530                 if (wpa_s->confname == NULL) {
4531                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4532                                    "for configuration file '%s'.",
4533                                    iface->confname);
4534                         return -1;
4535                 }
4536                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4537                            iface->confname, wpa_s->confname);
4538 #else /* CONFIG_BACKEND_FILE */
4539                 wpa_s->confname = os_strdup(iface->confname);
4540 #endif /* CONFIG_BACKEND_FILE */
4541                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4542                 if (wpa_s->conf == NULL) {
4543                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4544                                    "configuration '%s'.", wpa_s->confname);
4545                         return -1;
4546                 }
4547                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4548                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4549
4550                 /*
4551                  * Override ctrl_interface and driver_param if set on command
4552                  * line.
4553                  */
4554                 if (iface->ctrl_interface) {
4555                         os_free(wpa_s->conf->ctrl_interface);
4556                         wpa_s->conf->ctrl_interface =
4557                                 os_strdup(iface->ctrl_interface);
4558                 }
4559
4560                 if (iface->driver_param) {
4561                         os_free(wpa_s->conf->driver_param);
4562                         wpa_s->conf->driver_param =
4563                                 os_strdup(iface->driver_param);
4564                 }
4565
4566                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4567                         os_free(wpa_s->conf->ctrl_interface);
4568                         wpa_s->conf->ctrl_interface = NULL;
4569                 }
4570         } else
4571                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4572                                                      iface->driver_param);
4573
4574         if (wpa_s->conf == NULL) {
4575                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4576                 return -1;
4577         }
4578
4579         if (iface->ifname == NULL) {
4580                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4581                 return -1;
4582         }
4583         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4584                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4585                            iface->ifname);
4586                 return -1;
4587         }
4588         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4589
4590         if (iface->bridge_ifname) {
4591                 if (os_strlen(iface->bridge_ifname) >=
4592                     sizeof(wpa_s->bridge_ifname)) {
4593                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4594                                    "name '%s'.", iface->bridge_ifname);
4595                         return -1;
4596                 }
4597                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4598                            sizeof(wpa_s->bridge_ifname));
4599         }
4600
4601         /* RSNA Supplicant Key Management - INITIALIZE */
4602         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4603         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4604
4605         /* Initialize driver interface and register driver event handler before
4606          * L2 receive handler so that association events are processed before
4607          * EAPOL-Key packets if both become available for the same select()
4608          * call. */
4609         if (wpas_init_driver(wpa_s, iface) < 0)
4610                 return -1;
4611
4612         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4613                 return -1;
4614
4615         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4616                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4617                           NULL);
4618         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4619
4620         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4621             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4622                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4623                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4624                         "dot11RSNAConfigPMKLifetime");
4625                 return -1;
4626         }
4627
4628         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4629             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4630                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4631                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4632                         "dot11RSNAConfigPMKReauthThreshold");
4633                 return -1;
4634         }
4635
4636         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4637             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4638                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4639                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4640                         "dot11RSNAConfigSATimeout");
4641                 return -1;
4642         }
4643
4644         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4645                                                       &wpa_s->hw.num_modes,
4646                                                       &wpa_s->hw.flags);
4647         if (wpa_s->hw.modes) {
4648                 u16 i;
4649
4650                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4651                         if (wpa_s->hw.modes[i].vht_capab) {
4652                                 wpa_s->hw_capab = CAPAB_VHT;
4653                                 break;
4654                         }
4655
4656                         if (wpa_s->hw.modes[i].ht_capab &
4657                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4658                                 wpa_s->hw_capab = CAPAB_HT40;
4659                         else if (wpa_s->hw.modes[i].ht_capab &&
4660                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4661                                 wpa_s->hw_capab = CAPAB_HT;
4662                 }
4663         }
4664
4665         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4666         if (capa_res == 0) {
4667                 wpa_s->drv_capa_known = 1;
4668                 wpa_s->drv_flags = capa.flags;
4669                 wpa_s->drv_enc = capa.enc;
4670                 wpa_s->drv_smps_modes = capa.smps_modes;
4671                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4672                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4673                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4674                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4675                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4676                 wpa_s->max_sched_scan_plan_interval =
4677                         capa.max_sched_scan_plan_interval;
4678                 wpa_s->max_sched_scan_plan_iterations =
4679                         capa.max_sched_scan_plan_iterations;
4680                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4681                 wpa_s->max_match_sets = capa.max_match_sets;
4682                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4683                 wpa_s->max_stations = capa.max_stations;
4684                 wpa_s->extended_capa = capa.extended_capa;
4685                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4686                 wpa_s->extended_capa_len = capa.extended_capa_len;
4687                 wpa_s->num_multichan_concurrent =
4688                         capa.num_multichan_concurrent;
4689                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4690
4691                 if (capa.mac_addr_rand_scan_supported)
4692                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4693                 if (wpa_s->sched_scan_supported &&
4694                     capa.mac_addr_rand_sched_scan_supported)
4695                         wpa_s->mac_addr_rand_supported |=
4696                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4697         }
4698         if (wpa_s->max_remain_on_chan == 0)
4699                 wpa_s->max_remain_on_chan = 1000;
4700
4701         /*
4702          * Only take p2p_mgmt parameters when P2P Device is supported.
4703          * Doing it here as it determines whether l2_packet_init() will be done
4704          * during wpa_supplicant_driver_init().
4705          */
4706         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4707                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4708         else
4709                 iface->p2p_mgmt = 1;
4710
4711         if (wpa_s->num_multichan_concurrent == 0)
4712                 wpa_s->num_multichan_concurrent = 1;
4713
4714         if (wpa_supplicant_driver_init(wpa_s) < 0)
4715                 return -1;
4716
4717 #ifdef CONFIG_TDLS
4718         if ((!iface->p2p_mgmt ||
4719              !(wpa_s->drv_flags &
4720                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4721             wpa_tdls_init(wpa_s->wpa))
4722                 return -1;
4723 #endif /* CONFIG_TDLS */
4724
4725         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4726             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4727                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4728                 return -1;
4729         }
4730
4731 #ifdef CONFIG_FST
4732         if (wpa_s->conf->fst_group_id) {
4733                 struct fst_iface_cfg cfg;
4734                 struct fst_wpa_obj iface_obj;
4735
4736                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4737                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4738                            sizeof(cfg.group_id));
4739                 cfg.priority = wpa_s->conf->fst_priority;
4740                 cfg.llt = wpa_s->conf->fst_llt;
4741
4742                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4743                                         &iface_obj, &cfg);
4744                 if (!wpa_s->fst) {
4745                         wpa_msg(wpa_s, MSG_ERROR,
4746                                 "FST: Cannot attach iface %s to group %s",
4747                                 wpa_s->ifname, cfg.group_id);
4748                         return -1;
4749                 }
4750         }
4751 #endif /* CONFIG_FST */
4752
4753         if (wpas_wps_init(wpa_s))
4754                 return -1;
4755
4756         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4757                 return -1;
4758         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4759
4760         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4761         if (wpa_s->ctrl_iface == NULL) {
4762                 wpa_printf(MSG_ERROR,
4763                            "Failed to initialize control interface '%s'.\n"
4764                            "You may have another wpa_supplicant process "
4765                            "already running or the file was\n"
4766                            "left by an unclean termination of wpa_supplicant "
4767                            "in which case you will need\n"
4768                            "to manually remove this file before starting "
4769                            "wpa_supplicant again.\n",
4770                            wpa_s->conf->ctrl_interface);
4771                 return -1;
4772         }
4773
4774         wpa_s->gas = gas_query_init(wpa_s);
4775         if (wpa_s->gas == NULL) {
4776                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4777                 return -1;
4778         }
4779
4780         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4781                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4782                 return -1;
4783         }
4784
4785         if (wpa_bss_init(wpa_s) < 0)
4786                 return -1;
4787
4788         /*
4789          * Set Wake-on-WLAN triggers, if configured.
4790          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4791          * have effect anyway when the interface is down).
4792          */
4793         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4794                 return -1;
4795
4796 #ifdef CONFIG_EAP_PROXY
4797 {
4798         size_t len;
4799         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4800                                                      &len);
4801         if (wpa_s->mnc_len > 0) {
4802                 wpa_s->imsi[len] = '\0';
4803                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4804                            wpa_s->imsi, wpa_s->mnc_len);
4805         } else {
4806                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4807         }
4808 }
4809 #endif /* CONFIG_EAP_PROXY */
4810
4811         if (pcsc_reader_init(wpa_s) < 0)
4812                 return -1;
4813
4814         if (wpas_init_ext_pw(wpa_s) < 0)
4815                 return -1;
4816
4817         wpas_rrm_reset(wpa_s);
4818
4819         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4820
4821 #ifdef CONFIG_HS20
4822         hs20_init(wpa_s);
4823 #endif /* CONFIG_HS20 */
4824 #ifdef CONFIG_MBO
4825         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4826 #endif /* CONFIG_MBO */
4827
4828         return 0;
4829 }
4830
4831
4832 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4833                                         int notify, int terminate)
4834 {
4835         struct wpa_global *global = wpa_s->global;
4836         struct wpa_supplicant *iface, *prev;
4837
4838         if (wpa_s == wpa_s->parent)
4839                 wpas_p2p_group_remove(wpa_s, "*");
4840
4841         iface = global->ifaces;
4842         while (iface) {
4843                 if (iface == wpa_s || iface->parent != wpa_s) {
4844                         iface = iface->next;
4845                         continue;
4846                 }
4847                 wpa_printf(MSG_DEBUG,
4848                            "Remove remaining child interface %s from parent %s",
4849                            iface->ifname, wpa_s->ifname);
4850                 prev = iface;
4851                 iface = iface->next;
4852                 wpa_supplicant_remove_iface(global, prev, terminate);
4853         }
4854
4855         wpa_s->disconnected = 1;
4856         if (wpa_s->drv_priv) {
4857                 wpa_supplicant_deauthenticate(wpa_s,
4858                                               WLAN_REASON_DEAUTH_LEAVING);
4859
4860                 wpa_drv_set_countermeasures(wpa_s, 0);
4861                 wpa_clear_keys(wpa_s, NULL);
4862         }
4863
4864         wpa_supplicant_cleanup(wpa_s);
4865         wpas_p2p_deinit_iface(wpa_s);
4866
4867         wpas_ctrl_radio_work_flush(wpa_s);
4868         radio_remove_interface(wpa_s);
4869
4870 #ifdef CONFIG_FST
4871         if (wpa_s->fst) {
4872                 fst_detach(wpa_s->fst);
4873                 wpa_s->fst = NULL;
4874         }
4875         if (wpa_s->received_mb_ies) {
4876                 wpabuf_free(wpa_s->received_mb_ies);
4877                 wpa_s->received_mb_ies = NULL;
4878         }
4879 #endif /* CONFIG_FST */
4880
4881         if (wpa_s->drv_priv)
4882                 wpa_drv_deinit(wpa_s);
4883
4884         if (notify)
4885                 wpas_notify_iface_removed(wpa_s);
4886
4887         if (terminate)
4888                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4889
4890         if (wpa_s->ctrl_iface) {
4891                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4892                 wpa_s->ctrl_iface = NULL;
4893         }
4894
4895 #ifdef CONFIG_MESH
4896         if (wpa_s->ifmsh) {
4897                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4898                 wpa_s->ifmsh = NULL;
4899         }
4900 #endif /* CONFIG_MESH */
4901
4902         if (wpa_s->conf != NULL) {
4903                 wpa_config_free(wpa_s->conf);
4904                 wpa_s->conf = NULL;
4905         }
4906
4907         os_free(wpa_s->ssids_from_scan_req);
4908
4909         os_free(wpa_s);
4910 }
4911
4912
4913 /**
4914  * wpa_supplicant_add_iface - Add a new network interface
4915  * @global: Pointer to global data from wpa_supplicant_init()
4916  * @iface: Interface configuration options
4917  * @parent: Parent interface or %NULL to assign new interface as parent
4918  * Returns: Pointer to the created interface or %NULL on failure
4919  *
4920  * This function is used to add new network interfaces for %wpa_supplicant.
4921  * This can be called before wpa_supplicant_run() to add interfaces before the
4922  * main event loop has been started. In addition, new interfaces can be added
4923  * dynamically while %wpa_supplicant is already running. This could happen,
4924  * e.g., when a hotplug network adapter is inserted.
4925  */
4926 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4927                                                  struct wpa_interface *iface,
4928                                                  struct wpa_supplicant *parent)
4929 {
4930         struct wpa_supplicant *wpa_s;
4931         struct wpa_interface t_iface;
4932         struct wpa_ssid *ssid;
4933
4934         if (global == NULL || iface == NULL)
4935                 return NULL;
4936
4937         wpa_s = wpa_supplicant_alloc(parent);
4938         if (wpa_s == NULL)
4939                 return NULL;
4940
4941         wpa_s->global = global;
4942
4943         t_iface = *iface;
4944         if (global->params.override_driver) {
4945                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4946                            "('%s' -> '%s')",
4947                            iface->driver, global->params.override_driver);
4948                 t_iface.driver = global->params.override_driver;
4949         }
4950         if (global->params.override_ctrl_interface) {
4951                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4952                            "ctrl_interface ('%s' -> '%s')",
4953                            iface->ctrl_interface,
4954                            global->params.override_ctrl_interface);
4955                 t_iface.ctrl_interface =
4956                         global->params.override_ctrl_interface;
4957         }
4958         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4959                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4960                            iface->ifname);
4961                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4962                 return NULL;
4963         }
4964
4965         if (iface->p2p_mgmt == 0) {
4966                 /* Notify the control interfaces about new iface */
4967                 if (wpas_notify_iface_added(wpa_s)) {
4968                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4969                         return NULL;
4970                 }
4971
4972                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4973                         wpas_notify_network_added(wpa_s, ssid);
4974         }
4975
4976         wpa_s->next = global->ifaces;
4977         global->ifaces = wpa_s;
4978
4979         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4980         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4981
4982 #ifdef CONFIG_P2P
4983         if (wpa_s->global->p2p == NULL &&
4984             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4985             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4986             wpas_p2p_add_p2pdev_interface(
4987                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4988                 wpa_printf(MSG_INFO,
4989                            "P2P: Failed to enable P2P Device interface");
4990                 /* Try to continue without. P2P will be disabled. */
4991         }
4992 #endif /* CONFIG_P2P */
4993
4994         return wpa_s;
4995 }
4996
4997
4998 /**
4999  * wpa_supplicant_remove_iface - Remove a network interface
5000  * @global: Pointer to global data from wpa_supplicant_init()
5001  * @wpa_s: Pointer to the network interface to be removed
5002  * Returns: 0 if interface was removed, -1 if interface was not found
5003  *
5004  * This function can be used to dynamically remove network interfaces from
5005  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5006  * addition, this function is used to remove all remaining interfaces when
5007  * %wpa_supplicant is terminated.
5008  */
5009 int wpa_supplicant_remove_iface(struct wpa_global *global,
5010                                 struct wpa_supplicant *wpa_s,
5011                                 int terminate)
5012 {
5013         struct wpa_supplicant *prev;
5014 #ifdef CONFIG_MESH
5015         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5016         char *ifname = NULL;
5017 #endif /* CONFIG_MESH */
5018
5019         /* Remove interface from the global list of interfaces */
5020         prev = global->ifaces;
5021         if (prev == wpa_s) {
5022                 global->ifaces = wpa_s->next;
5023         } else {
5024                 while (prev && prev->next != wpa_s)
5025                         prev = prev->next;
5026                 if (prev == NULL)
5027                         return -1;
5028                 prev->next = wpa_s->next;
5029         }
5030
5031         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5032
5033 #ifdef CONFIG_MESH
5034         if (mesh_if_created) {
5035                 ifname = os_strdup(wpa_s->ifname);
5036                 if (ifname == NULL) {
5037                         wpa_dbg(wpa_s, MSG_ERROR,
5038                                 "mesh: Failed to malloc ifname");
5039                         return -1;
5040                 }
5041         }
5042 #endif /* CONFIG_MESH */
5043
5044         if (global->p2p_group_formation == wpa_s)
5045                 global->p2p_group_formation = NULL;
5046         if (global->p2p_invite_group == wpa_s)
5047                 global->p2p_invite_group = NULL;
5048         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5049
5050 #ifdef CONFIG_MESH
5051         if (mesh_if_created) {
5052                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5053                 os_free(ifname);
5054         }
5055 #endif /* CONFIG_MESH */
5056
5057         return 0;
5058 }
5059
5060
5061 /**
5062  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5063  * @wpa_s: Pointer to the network interface
5064  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5065  */
5066 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5067 {
5068         const char *eapol_method;
5069
5070         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5071             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5072                 return "NO-EAP";
5073         }
5074
5075         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5076         if (eapol_method == NULL)
5077                 return "UNKNOWN-EAP";
5078
5079         return eapol_method;
5080 }
5081
5082
5083 /**
5084  * wpa_supplicant_get_iface - Get a new network interface
5085  * @global: Pointer to global data from wpa_supplicant_init()
5086  * @ifname: Interface name
5087  * Returns: Pointer to the interface or %NULL if not found
5088  */
5089 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5090                                                  const char *ifname)
5091 {
5092         struct wpa_supplicant *wpa_s;
5093
5094         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5095                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5096                         return wpa_s;
5097         }
5098         return NULL;
5099 }
5100
5101
5102 #ifndef CONFIG_NO_WPA_MSG
5103 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5104 {
5105         struct wpa_supplicant *wpa_s = ctx;
5106         if (wpa_s == NULL)
5107                 return NULL;
5108         return wpa_s->ifname;
5109 }
5110 #endif /* CONFIG_NO_WPA_MSG */
5111
5112
5113 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5114 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5115 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5116
5117 /* Periodic cleanup tasks */
5118 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5119 {
5120         struct wpa_global *global = eloop_ctx;
5121         struct wpa_supplicant *wpa_s;
5122
5123         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5124                                wpas_periodic, global, NULL);
5125
5126 #ifdef CONFIG_P2P
5127         if (global->p2p)
5128                 p2p_expire_peers(global->p2p);
5129 #endif /* CONFIG_P2P */
5130
5131         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5132                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5133 #ifdef CONFIG_AP
5134                 ap_periodic(wpa_s);
5135 #endif /* CONFIG_AP */
5136         }
5137 }
5138
5139
5140 /**
5141  * wpa_supplicant_init - Initialize %wpa_supplicant
5142  * @params: Parameters for %wpa_supplicant
5143  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5144  *
5145  * This function is used to initialize %wpa_supplicant. After successful
5146  * initialization, the returned data pointer can be used to add and remove
5147  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5148  */
5149 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5150 {
5151         struct wpa_global *global;
5152         int ret, i;
5153
5154         if (params == NULL)
5155                 return NULL;
5156
5157 #ifdef CONFIG_DRIVER_NDIS
5158         {
5159                 void driver_ndis_init_ops(void);
5160                 driver_ndis_init_ops();
5161         }
5162 #endif /* CONFIG_DRIVER_NDIS */
5163
5164 #ifndef CONFIG_NO_WPA_MSG
5165         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5166 #endif /* CONFIG_NO_WPA_MSG */
5167
5168         if (params->wpa_debug_file_path)
5169                 wpa_debug_open_file(params->wpa_debug_file_path);
5170         else
5171                 wpa_debug_setup_stdout();
5172         if (params->wpa_debug_syslog)
5173                 wpa_debug_open_syslog();
5174         if (params->wpa_debug_tracing) {
5175                 ret = wpa_debug_open_linux_tracing();
5176                 if (ret) {
5177                         wpa_printf(MSG_ERROR,
5178                                    "Failed to enable trace logging");
5179                         return NULL;
5180                 }
5181         }
5182
5183         ret = eap_register_methods();
5184         if (ret) {
5185                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5186                 if (ret == -2)
5187                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5188                                    "the same EAP type.");
5189                 return NULL;
5190         }
5191
5192         global = os_zalloc(sizeof(*global));
5193         if (global == NULL)
5194                 return NULL;
5195         dl_list_init(&global->p2p_srv_bonjour);
5196         dl_list_init(&global->p2p_srv_upnp);
5197         global->params.daemonize = params->daemonize;
5198         global->params.wait_for_monitor = params->wait_for_monitor;
5199         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5200         if (params->pid_file)
5201                 global->params.pid_file = os_strdup(params->pid_file);
5202         if (params->ctrl_interface)
5203                 global->params.ctrl_interface =
5204                         os_strdup(params->ctrl_interface);
5205         if (params->ctrl_interface_group)
5206                 global->params.ctrl_interface_group =
5207                         os_strdup(params->ctrl_interface_group);
5208         if (params->override_driver)
5209                 global->params.override_driver =
5210                         os_strdup(params->override_driver);
5211         if (params->override_ctrl_interface)
5212                 global->params.override_ctrl_interface =
5213                         os_strdup(params->override_ctrl_interface);
5214 #ifdef CONFIG_P2P
5215         if (params->conf_p2p_dev)
5216                 global->params.conf_p2p_dev =
5217                         os_strdup(params->conf_p2p_dev);
5218 #endif /* CONFIG_P2P */
5219         wpa_debug_level = global->params.wpa_debug_level =
5220                 params->wpa_debug_level;
5221         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5222                 params->wpa_debug_show_keys;
5223         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5224                 params->wpa_debug_timestamp;
5225
5226         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5227
5228         if (eloop_init()) {
5229                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5230                 wpa_supplicant_deinit(global);
5231                 return NULL;
5232         }
5233
5234         random_init(params->entropy_file);
5235
5236         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5237         if (global->ctrl_iface == NULL) {
5238                 wpa_supplicant_deinit(global);
5239                 return NULL;
5240         }
5241
5242         if (wpas_notify_supplicant_initialized(global)) {
5243                 wpa_supplicant_deinit(global);
5244                 return NULL;
5245         }
5246
5247         for (i = 0; wpa_drivers[i]; i++)
5248                 global->drv_count++;
5249         if (global->drv_count == 0) {
5250                 wpa_printf(MSG_ERROR, "No drivers enabled");
5251                 wpa_supplicant_deinit(global);
5252                 return NULL;
5253         }
5254         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5255         if (global->drv_priv == NULL) {
5256                 wpa_supplicant_deinit(global);
5257                 return NULL;
5258         }
5259
5260 #ifdef CONFIG_WIFI_DISPLAY
5261         if (wifi_display_init(global) < 0) {
5262                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5263                 wpa_supplicant_deinit(global);
5264                 return NULL;
5265         }
5266 #endif /* CONFIG_WIFI_DISPLAY */
5267
5268         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5269                                wpas_periodic, global, NULL);
5270
5271         return global;
5272 }
5273
5274
5275 /**
5276  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5277  * @global: Pointer to global data from wpa_supplicant_init()
5278  * Returns: 0 after successful event loop run, -1 on failure
5279  *
5280  * This function starts the main event loop and continues running as long as
5281  * there are any remaining events. In most cases, this function is running as
5282  * long as the %wpa_supplicant process in still in use.
5283  */
5284 int wpa_supplicant_run(struct wpa_global *global)
5285 {
5286         struct wpa_supplicant *wpa_s;
5287
5288         if (global->params.daemonize &&
5289             (wpa_supplicant_daemon(global->params.pid_file) ||
5290              eloop_sock_requeue()))
5291                 return -1;
5292
5293         if (global->params.wait_for_monitor) {
5294                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5295                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5296                                 wpa_supplicant_ctrl_iface_wait(
5297                                         wpa_s->ctrl_iface);
5298         }
5299
5300         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5301         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5302
5303         eloop_run();
5304
5305         return 0;
5306 }
5307
5308
5309 /**
5310  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5311  * @global: Pointer to global data from wpa_supplicant_init()
5312  *
5313  * This function is called to deinitialize %wpa_supplicant and to free all
5314  * allocated resources. Remaining network interfaces will also be removed.
5315  */
5316 void wpa_supplicant_deinit(struct wpa_global *global)
5317 {
5318         int i;
5319
5320         if (global == NULL)
5321                 return;
5322
5323         eloop_cancel_timeout(wpas_periodic, global, NULL);
5324
5325 #ifdef CONFIG_WIFI_DISPLAY
5326         wifi_display_deinit(global);
5327 #endif /* CONFIG_WIFI_DISPLAY */
5328
5329         while (global->ifaces)
5330                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5331
5332         if (global->ctrl_iface)
5333                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5334
5335         wpas_notify_supplicant_deinitialized(global);
5336
5337         eap_peer_unregister_methods();
5338 #ifdef CONFIG_AP
5339         eap_server_unregister_methods();
5340 #endif /* CONFIG_AP */
5341
5342         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5343                 if (!global->drv_priv[i])
5344                         continue;
5345                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5346         }
5347         os_free(global->drv_priv);
5348
5349         random_deinit();
5350
5351         eloop_destroy();
5352
5353         if (global->params.pid_file) {
5354                 os_daemonize_terminate(global->params.pid_file);
5355                 os_free(global->params.pid_file);
5356         }
5357         os_free(global->params.ctrl_interface);
5358         os_free(global->params.ctrl_interface_group);
5359         os_free(global->params.override_driver);
5360         os_free(global->params.override_ctrl_interface);
5361 #ifdef CONFIG_P2P
5362         os_free(global->params.conf_p2p_dev);
5363 #endif /* CONFIG_P2P */
5364
5365         os_free(global->p2p_disallow_freq.range);
5366         os_free(global->p2p_go_avoid_freq.range);
5367         os_free(global->add_psk);
5368
5369         os_free(global);
5370         wpa_debug_close_syslog();
5371         wpa_debug_close_file();
5372         wpa_debug_close_linux_tracing();
5373 }
5374
5375
5376 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5377 {
5378         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5379             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5380                 char country[3];
5381                 country[0] = wpa_s->conf->country[0];
5382                 country[1] = wpa_s->conf->country[1];
5383                 country[2] = '\0';
5384                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5385                         wpa_printf(MSG_ERROR, "Failed to set country code "
5386                                    "'%s'", country);
5387                 }
5388         }
5389
5390         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5391                 wpas_init_ext_pw(wpa_s);
5392
5393         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5394                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5395
5396 #ifdef CONFIG_WPS
5397         wpas_wps_update_config(wpa_s);
5398 #endif /* CONFIG_WPS */
5399         wpas_p2p_update_config(wpa_s);
5400         wpa_s->conf->changed_parameters = 0;
5401 }
5402
5403
5404 void add_freq(int *freqs, int *num_freqs, int freq)
5405 {
5406         int i;
5407
5408         for (i = 0; i < *num_freqs; i++) {
5409                 if (freqs[i] == freq)
5410                         return;
5411         }
5412
5413         freqs[*num_freqs] = freq;
5414         (*num_freqs)++;
5415 }
5416
5417
5418 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5419 {
5420         struct wpa_bss *bss, *cbss;
5421         const int max_freqs = 10;
5422         int *freqs;
5423         int num_freqs = 0;
5424
5425         freqs = os_calloc(max_freqs + 1, sizeof(int));
5426         if (freqs == NULL)
5427                 return NULL;
5428
5429         cbss = wpa_s->current_bss;
5430
5431         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5432                 if (bss == cbss)
5433                         continue;
5434                 if (bss->ssid_len == cbss->ssid_len &&
5435                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5436                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5437                         add_freq(freqs, &num_freqs, bss->freq);
5438                         if (num_freqs == max_freqs)
5439                                 break;
5440                 }
5441         }
5442
5443         if (num_freqs == 0) {
5444                 os_free(freqs);
5445                 freqs = NULL;
5446         }
5447
5448         return freqs;
5449 }
5450
5451
5452 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5453 {
5454         int timeout;
5455         int count;
5456         int *freqs = NULL;
5457
5458         wpas_connect_work_done(wpa_s);
5459
5460         /*
5461          * Remove possible authentication timeout since the connection failed.
5462          */
5463         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5464
5465         /*
5466          * There is no point in blacklisting the AP if this event is
5467          * generated based on local request to disconnect.
5468          */
5469         if (wpa_s->own_disconnect_req) {
5470                 wpa_s->own_disconnect_req = 0;
5471                 wpa_dbg(wpa_s, MSG_DEBUG,
5472                         "Ignore connection failure due to local request to disconnect");
5473                 return;
5474         }
5475         if (wpa_s->disconnected) {
5476                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5477                         "indication since interface has been put into "
5478                         "disconnected state");
5479                 return;
5480         }
5481
5482         /*
5483          * Add the failed BSSID into the blacklist and speed up next scan
5484          * attempt if there could be other APs that could accept association.
5485          * The current blacklist count indicates how many times we have tried
5486          * connecting to this AP and multiple attempts mean that other APs are
5487          * either not available or has already been tried, so that we can start
5488          * increasing the delay here to avoid constant scanning.
5489          */
5490         count = wpa_blacklist_add(wpa_s, bssid);
5491         if (count == 1 && wpa_s->current_bss) {
5492                 /*
5493                  * This BSS was not in the blacklist before. If there is
5494                  * another BSS available for the same ESS, we should try that
5495                  * next. Otherwise, we may as well try this one once more
5496                  * before allowing other, likely worse, ESSes to be considered.
5497                  */
5498                 freqs = get_bss_freqs_in_ess(wpa_s);
5499                 if (freqs) {
5500                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5501                                 "has been seen; try it next");
5502                         wpa_blacklist_add(wpa_s, bssid);
5503                         /*
5504                          * On the next scan, go through only the known channels
5505                          * used in this ESS based on previous scans to speed up
5506                          * common load balancing use case.
5507                          */
5508                         os_free(wpa_s->next_scan_freqs);
5509                         wpa_s->next_scan_freqs = freqs;
5510                 }
5511         }
5512
5513         /*
5514          * Add previous failure count in case the temporary blacklist was
5515          * cleared due to no other BSSes being available.
5516          */
5517         count += wpa_s->extra_blacklist_count;
5518
5519         if (count > 3 && wpa_s->current_ssid) {
5520                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5521                            "consider temporary network disabling");
5522                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5523         }
5524
5525         switch (count) {
5526         case 1:
5527                 timeout = 100;
5528                 break;
5529         case 2:
5530                 timeout = 500;
5531                 break;
5532         case 3:
5533                 timeout = 1000;
5534                 break;
5535         case 4:
5536                 timeout = 5000;
5537                 break;
5538         default:
5539                 timeout = 10000;
5540                 break;
5541         }
5542
5543         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5544                 "ms", count, timeout);
5545
5546         /*
5547          * TODO: if more than one possible AP is available in scan results,
5548          * could try the other ones before requesting a new scan.
5549          */
5550         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5551                                 1000 * (timeout % 1000));
5552 }
5553
5554
5555 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5556 {
5557         return wpa_s->conf->ap_scan == 2 ||
5558                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5559 }
5560
5561
5562 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5563 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5564                                               struct wpa_ssid *ssid,
5565                                               const char *field,
5566                                               const char *value)
5567 {
5568 #ifdef IEEE8021X_EAPOL
5569         struct eap_peer_config *eap = &ssid->eap;
5570
5571         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5572         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5573                               (const u8 *) value, os_strlen(value));
5574
5575         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5576         case WPA_CTRL_REQ_EAP_IDENTITY:
5577                 os_free(eap->identity);
5578                 eap->identity = (u8 *) os_strdup(value);
5579                 eap->identity_len = os_strlen(value);
5580                 eap->pending_req_identity = 0;
5581                 if (ssid == wpa_s->current_ssid)
5582                         wpa_s->reassociate = 1;
5583                 break;
5584         case WPA_CTRL_REQ_EAP_PASSWORD:
5585                 bin_clear_free(eap->password, eap->password_len);
5586                 eap->password = (u8 *) os_strdup(value);
5587                 eap->password_len = os_strlen(value);
5588                 eap->pending_req_password = 0;
5589                 if (ssid == wpa_s->current_ssid)
5590                         wpa_s->reassociate = 1;
5591                 break;
5592         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5593                 bin_clear_free(eap->new_password, eap->new_password_len);
5594                 eap->new_password = (u8 *) os_strdup(value);
5595                 eap->new_password_len = os_strlen(value);
5596                 eap->pending_req_new_password = 0;
5597                 if (ssid == wpa_s->current_ssid)
5598                         wpa_s->reassociate = 1;
5599                 break;
5600         case WPA_CTRL_REQ_EAP_PIN:
5601                 str_clear_free(eap->pin);
5602                 eap->pin = os_strdup(value);
5603                 eap->pending_req_pin = 0;
5604                 if (ssid == wpa_s->current_ssid)
5605                         wpa_s->reassociate = 1;
5606                 break;
5607         case WPA_CTRL_REQ_EAP_OTP:
5608                 bin_clear_free(eap->otp, eap->otp_len);
5609                 eap->otp = (u8 *) os_strdup(value);
5610                 eap->otp_len = os_strlen(value);
5611                 os_free(eap->pending_req_otp);
5612                 eap->pending_req_otp = NULL;
5613                 eap->pending_req_otp_len = 0;
5614                 break;
5615         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5616                 str_clear_free(eap->private_key_passwd);
5617                 eap->private_key_passwd = os_strdup(value);
5618                 eap->pending_req_passphrase = 0;
5619                 if (ssid == wpa_s->current_ssid)
5620                         wpa_s->reassociate = 1;
5621                 break;
5622         case WPA_CTRL_REQ_SIM:
5623                 str_clear_free(eap->external_sim_resp);
5624                 eap->external_sim_resp = os_strdup(value);
5625                 break;
5626         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5627                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5628                         return -1;
5629                 ssid->mem_only_psk = 1;
5630                 if (ssid->passphrase)
5631                         wpa_config_update_psk(ssid);
5632                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5633                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5634                 break;
5635         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5636                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5637                         return -1;
5638                 if (os_strcmp(value, "good") == 0)
5639                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5640                 else if (os_strcmp(value, "bad") == 0)
5641                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5642                 else
5643                         return -1;
5644                 break;
5645         default:
5646                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5647                 return -1;
5648         }
5649
5650         return 0;
5651 #else /* IEEE8021X_EAPOL */
5652         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5653         return -1;
5654 #endif /* IEEE8021X_EAPOL */
5655 }
5656 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5657
5658
5659 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5660 {
5661         int i;
5662         unsigned int drv_enc;
5663
5664         if (wpa_s->p2p_mgmt)
5665                 return 1; /* no normal network profiles on p2p_mgmt interface */
5666
5667         if (ssid == NULL)
5668                 return 1;
5669
5670         if (ssid->disabled)
5671                 return 1;
5672
5673         if (wpa_s->drv_capa_known)
5674                 drv_enc = wpa_s->drv_enc;
5675         else
5676                 drv_enc = (unsigned int) -1;
5677
5678         for (i = 0; i < NUM_WEP_KEYS; i++) {
5679                 size_t len = ssid->wep_key_len[i];
5680                 if (len == 0)
5681                         continue;
5682                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5683                         continue;
5684                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5685                         continue;
5686                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5687                         continue;
5688                 return 1; /* invalid WEP key */
5689         }
5690
5691         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5692             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5693             !ssid->mem_only_psk)
5694                 return 1;
5695
5696         return 0;
5697 }
5698
5699
5700 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5701 {
5702 #ifdef CONFIG_IEEE80211W
5703         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5704                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5705                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5706                         /*
5707                          * Driver does not support BIP -- ignore pmf=1 default
5708                          * since the connection with PMF would fail and the
5709                          * configuration does not require PMF to be enabled.
5710                          */
5711                         return NO_MGMT_FRAME_PROTECTION;
5712                 }
5713
5714                 return wpa_s->conf->pmf;
5715         }
5716
5717         return ssid->ieee80211w;
5718 #else /* CONFIG_IEEE80211W */
5719         return NO_MGMT_FRAME_PROTECTION;
5720 #endif /* CONFIG_IEEE80211W */
5721 }
5722
5723
5724 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5725 {
5726         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5727                 return 1;
5728         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5729                 return 0;
5730         return -1;
5731 }
5732
5733
5734 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5735 {
5736         struct wpa_ssid *ssid = wpa_s->current_ssid;
5737         int dur;
5738         struct os_reltime now;
5739
5740         if (ssid == NULL) {
5741                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5742                            "SSID block");
5743                 return;
5744         }
5745
5746         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5747                 return;
5748
5749         ssid->auth_failures++;
5750
5751 #ifdef CONFIG_P2P
5752         if (ssid->p2p_group &&
5753             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5754                 /*
5755                  * Skip the wait time since there is a short timeout on the
5756                  * connection to a P2P group.
5757                  */
5758                 return;
5759         }
5760 #endif /* CONFIG_P2P */
5761
5762         if (ssid->auth_failures > 50)
5763                 dur = 300;
5764         else if (ssid->auth_failures > 10)
5765                 dur = 120;
5766         else if (ssid->auth_failures > 5)
5767                 dur = 90;
5768         else if (ssid->auth_failures > 3)
5769                 dur = 60;
5770         else if (ssid->auth_failures > 2)
5771                 dur = 30;
5772         else if (ssid->auth_failures > 1)
5773                 dur = 20;
5774         else
5775                 dur = 10;
5776
5777         if (ssid->auth_failures > 1 &&
5778             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5779                 dur += os_random() % (ssid->auth_failures * 10);
5780
5781         os_get_reltime(&now);
5782         if (now.sec + dur <= ssid->disabled_until.sec)
5783                 return;
5784
5785         ssid->disabled_until.sec = now.sec + dur;
5786
5787         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5788                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5789                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5790                 ssid->auth_failures, dur, reason);
5791 }
5792
5793
5794 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5795                               struct wpa_ssid *ssid, int clear_failures)
5796 {
5797         if (ssid == NULL)
5798                 return;
5799
5800         if (ssid->disabled_until.sec) {
5801                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5802                         "id=%d ssid=\"%s\"",
5803                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5804         }
5805         ssid->disabled_until.sec = 0;
5806         ssid->disabled_until.usec = 0;
5807         if (clear_failures)
5808                 ssid->auth_failures = 0;
5809 }
5810
5811
5812 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5813 {
5814         size_t i;
5815
5816         if (wpa_s->disallow_aps_bssid == NULL)
5817                 return 0;
5818
5819         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5820                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5821                               bssid, ETH_ALEN) == 0)
5822                         return 1;
5823         }
5824
5825         return 0;
5826 }
5827
5828
5829 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5830                     size_t ssid_len)
5831 {
5832         size_t i;
5833
5834         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5835                 return 0;
5836
5837         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5838                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5839                 if (ssid_len == s->ssid_len &&
5840                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5841                         return 1;
5842         }
5843
5844         return 0;
5845 }
5846
5847
5848 /**
5849  * wpas_request_connection - Request a new connection
5850  * @wpa_s: Pointer to the network interface
5851  *
5852  * This function is used to request a new connection to be found. It will mark
5853  * the interface to allow reassociation and request a new scan to find a
5854  * suitable network to connect to.
5855  */
5856 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5857 {
5858         wpa_s->normal_scans = 0;
5859         wpa_s->scan_req = NORMAL_SCAN_REQ;
5860         wpa_supplicant_reinit_autoscan(wpa_s);
5861         wpa_s->extra_blacklist_count = 0;
5862         wpa_s->disconnected = 0;
5863         wpa_s->reassociate = 1;
5864
5865         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5866                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5867         else
5868                 wpa_s->reattach = 0;
5869 }
5870
5871
5872 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5873                     struct wpa_used_freq_data *freqs_data,
5874                     unsigned int len)
5875 {
5876         unsigned int i;
5877
5878         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5879                 len, title);
5880         for (i = 0; i < len; i++) {
5881                 struct wpa_used_freq_data *cur = &freqs_data[i];
5882                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5883                         i, cur->freq, cur->flags);
5884         }
5885 }
5886
5887
5888 /*
5889  * Find the operating frequencies of any of the virtual interfaces that
5890  * are using the same radio as the current interface, and in addition, get
5891  * information about the interface types that are using the frequency.
5892  */
5893 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5894                                 struct wpa_used_freq_data *freqs_data,
5895                                 unsigned int len)
5896 {
5897         struct wpa_supplicant *ifs;
5898         u8 bssid[ETH_ALEN];
5899         int freq;
5900         unsigned int idx = 0, i;
5901
5902         wpa_dbg(wpa_s, MSG_DEBUG,
5903                 "Determining shared radio frequencies (max len %u)", len);
5904         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5905
5906         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5907                          radio_list) {
5908                 if (idx == len)
5909                         break;
5910
5911                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5912                         continue;
5913
5914                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5915                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5916                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5917                         freq = ifs->current_ssid->frequency;
5918                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5919                         freq = ifs->assoc_freq;
5920                 else
5921                         continue;
5922
5923                 /* Hold only distinct freqs */
5924                 for (i = 0; i < idx; i++)
5925                         if (freqs_data[i].freq == freq)
5926                                 break;
5927
5928                 if (i == idx)
5929                         freqs_data[idx++].freq = freq;
5930
5931                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5932                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5933                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5934                                 WPA_FREQ_USED_BY_INFRA_STATION;
5935                 }
5936         }
5937
5938         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5939         return idx;
5940 }
5941
5942
5943 /*
5944  * Find the operating frequencies of any of the virtual interfaces that
5945  * are using the same radio as the current interface.
5946  */
5947 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5948                            int *freq_array, unsigned int len)
5949 {
5950         struct wpa_used_freq_data *freqs_data;
5951         int num, i;
5952
5953         os_memset(freq_array, 0, sizeof(int) * len);
5954
5955         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5956         if (!freqs_data)
5957                 return -1;
5958
5959         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5960         for (i = 0; i < num; i++)
5961                 freq_array[i] = freqs_data[i].freq;
5962
5963         os_free(freqs_data);
5964
5965         return num;
5966 }
5967
5968
5969 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5970 {
5971         struct rrm_data *rrm = data;
5972
5973         if (!rrm->notify_neighbor_rep) {
5974                 wpa_printf(MSG_ERROR,
5975                            "RRM: Unexpected neighbor report timeout");
5976                 return;
5977         }
5978
5979         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5980         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5981
5982         rrm->notify_neighbor_rep = NULL;
5983         rrm->neighbor_rep_cb_ctx = NULL;
5984 }
5985
5986
5987 /*
5988  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5989  * @wpa_s: Pointer to wpa_supplicant
5990  */
5991 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5992 {
5993         wpa_s->rrm.rrm_used = 0;
5994
5995         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5996                              NULL);
5997         if (wpa_s->rrm.notify_neighbor_rep)
5998                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5999         wpa_s->rrm.next_neighbor_rep_token = 1;
6000 }
6001
6002
6003 /*
6004  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6005  * @wpa_s: Pointer to wpa_supplicant
6006  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6007  * @report_len: Length of neighbor report buffer
6008  */
6009 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6010                                    const u8 *report, size_t report_len)
6011 {
6012         struct wpabuf *neighbor_rep;
6013
6014         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6015         if (report_len < 1)
6016                 return;
6017
6018         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6019                 wpa_printf(MSG_DEBUG,
6020                            "RRM: Discarding neighbor report with token %d (expected %d)",
6021                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6022                 return;
6023         }
6024
6025         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6026                              NULL);
6027
6028         if (!wpa_s->rrm.notify_neighbor_rep) {
6029                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6030                 return;
6031         }
6032
6033         /* skipping the first byte, which is only an id (dialog token) */
6034         neighbor_rep = wpabuf_alloc(report_len - 1);
6035         if (neighbor_rep == NULL)
6036                 return;
6037         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6038         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6039                    report[0]);
6040         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6041                                        neighbor_rep);
6042         wpa_s->rrm.notify_neighbor_rep = NULL;
6043         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6044 }
6045
6046
6047 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6048 /* Workaround different, undefined for Windows, error codes used here */
6049 #define ENOTCONN -1
6050 #define EOPNOTSUPP -1
6051 #define ECANCELED -1
6052 #endif
6053
6054 /**
6055  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6056  * @wpa_s: Pointer to wpa_supplicant
6057  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6058  *        is sent in the request.
6059  * @cb: Callback function to be called once the requested report arrives, or
6060  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6061  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6062  *      the requester's responsibility to free it.
6063  *      In the latter case NULL will be sent in 'neighbor_rep'.
6064  * @cb_ctx: Context value to send the callback function
6065  * Returns: 0 in case of success, negative error code otherwise
6066  *
6067  * In case there is a previous request which has not been answered yet, the
6068  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6069  * Request must contain a callback function.
6070  */
6071 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6072                                        const struct wpa_ssid *ssid,
6073                                        void (*cb)(void *ctx,
6074                                                   struct wpabuf *neighbor_rep),
6075                                        void *cb_ctx)
6076 {
6077         struct wpabuf *buf;
6078         const u8 *rrm_ie;
6079
6080         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6081                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6082                 return -ENOTCONN;
6083         }
6084
6085         if (!wpa_s->rrm.rrm_used) {
6086                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6087                 return -EOPNOTSUPP;
6088         }
6089
6090         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6091                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6092         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6093             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6094                 wpa_printf(MSG_DEBUG,
6095                            "RRM: No network support for Neighbor Report.");
6096                 return -EOPNOTSUPP;
6097         }
6098
6099         if (!cb) {
6100                 wpa_printf(MSG_DEBUG,
6101                            "RRM: Neighbor Report request must provide a callback.");
6102                 return -EINVAL;
6103         }
6104
6105         /* Refuse if there's a live request */
6106         if (wpa_s->rrm.notify_neighbor_rep) {
6107                 wpa_printf(MSG_DEBUG,
6108                            "RRM: Currently handling previous Neighbor Report.");
6109                 return -EBUSY;
6110         }
6111
6112         /* 3 = action category + action code + dialog token */
6113         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6114         if (buf == NULL) {
6115                 wpa_printf(MSG_DEBUG,
6116                            "RRM: Failed to allocate Neighbor Report Request");
6117                 return -ENOMEM;
6118         }
6119
6120         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6121                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6122                    wpa_s->rrm.next_neighbor_rep_token);
6123
6124         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6125         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6126         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6127         if (ssid) {
6128                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6129                 wpabuf_put_u8(buf, ssid->ssid_len);
6130                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6131         }
6132
6133         wpa_s->rrm.next_neighbor_rep_token++;
6134
6135         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6136                                 wpa_s->own_addr, wpa_s->bssid,
6137                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6138                 wpa_printf(MSG_DEBUG,
6139                            "RRM: Failed to send Neighbor Report Request");
6140                 wpabuf_free(buf);
6141                 return -ECANCELED;
6142         }
6143
6144         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6145         wpa_s->rrm.notify_neighbor_rep = cb;
6146         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6147                                wpas_rrm_neighbor_rep_timeout_handler,
6148                                &wpa_s->rrm, NULL);
6149
6150         wpabuf_free(buf);
6151         return 0;
6152 }
6153
6154
6155 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6156                                               const u8 *src,
6157                                               const u8 *frame, size_t len,
6158                                               int rssi)
6159 {
6160         struct wpabuf *buf;
6161         const struct rrm_link_measurement_request *req;
6162         struct rrm_link_measurement_report report;
6163
6164         if (wpa_s->wpa_state != WPA_COMPLETED) {
6165                 wpa_printf(MSG_INFO,
6166                            "RRM: Ignoring link measurement request. Not associated");
6167                 return;
6168         }
6169
6170         if (!wpa_s->rrm.rrm_used) {
6171                 wpa_printf(MSG_INFO,
6172                            "RRM: Ignoring link measurement request. Not RRM network");
6173                 return;
6174         }
6175
6176         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6177                 wpa_printf(MSG_INFO,
6178                            "RRM: Measurement report failed. TX power insertion not supported");
6179                 return;
6180         }
6181
6182         req = (const struct rrm_link_measurement_request *) frame;
6183         if (len < sizeof(*req)) {
6184                 wpa_printf(MSG_INFO,
6185                            "RRM: Link measurement report failed. Request too short");
6186                 return;
6187         }
6188
6189         os_memset(&report, 0, sizeof(report));
6190         report.tpc.eid = WLAN_EID_TPC_REPORT;
6191         report.tpc.len = 2;
6192         report.rsni = 255; /* 255 indicates that RSNI is not available */
6193         report.dialog_token = req->dialog_token;
6194
6195         /*
6196          * It's possible to estimate RCPI based on RSSI in dBm. This
6197          * calculation will not reflect the correct value for high rates,
6198          * but it's good enough for Action frames which are transmitted
6199          * with up to 24 Mbps rates.
6200          */
6201         if (!rssi)
6202                 report.rcpi = 255; /* not available */
6203         else if (rssi < -110)
6204                 report.rcpi = 0;
6205         else if (rssi > 0)
6206                 report.rcpi = 220;
6207         else
6208                 report.rcpi = (rssi + 110) * 2;
6209
6210         /* action_category + action_code */
6211         buf = wpabuf_alloc(2 + sizeof(report));
6212         if (buf == NULL) {
6213                 wpa_printf(MSG_ERROR,
6214                            "RRM: Link measurement report failed. Buffer allocation failed");
6215                 return;
6216         }
6217
6218         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6219         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6220         wpabuf_put_data(buf, &report, sizeof(report));
6221         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6222                     wpabuf_head(buf), wpabuf_len(buf));
6223
6224         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6225                                 wpa_s->own_addr, wpa_s->bssid,
6226                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6227                 wpa_printf(MSG_ERROR,
6228                            "RRM: Link measurement report failed. Send action failed");
6229         }
6230         wpabuf_free(buf);
6231 }
6232
6233
6234 struct wpa_supplicant *
6235 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6236 {
6237         switch (frame) {
6238 #ifdef CONFIG_P2P
6239         case VENDOR_ELEM_PROBE_REQ_P2P:
6240         case VENDOR_ELEM_PROBE_RESP_P2P:
6241         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6242         case VENDOR_ELEM_BEACON_P2P_GO:
6243         case VENDOR_ELEM_P2P_PD_REQ:
6244         case VENDOR_ELEM_P2P_PD_RESP:
6245         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6246         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6247         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6248         case VENDOR_ELEM_P2P_INV_REQ:
6249         case VENDOR_ELEM_P2P_INV_RESP:
6250         case VENDOR_ELEM_P2P_ASSOC_REQ:
6251         case VENDOR_ELEM_P2P_ASSOC_RESP:
6252                 return wpa_s->p2pdev;
6253 #endif /* CONFIG_P2P */
6254         default:
6255                 return wpa_s;
6256         }
6257 }
6258
6259
6260 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6261 {
6262         unsigned int i;
6263         char buf[30];
6264
6265         wpa_printf(MSG_DEBUG, "Update vendor elements");
6266
6267         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6268                 if (wpa_s->vendor_elem[i]) {
6269                         int res;
6270
6271                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6272                         if (!os_snprintf_error(sizeof(buf), res)) {
6273                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6274                                                 wpa_s->vendor_elem[i]);
6275                         }
6276                 }
6277         }
6278
6279 #ifdef CONFIG_P2P
6280         if (wpa_s->parent == wpa_s &&
6281             wpa_s->global->p2p &&
6282             !wpa_s->global->p2p_disabled)
6283                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6284 #endif /* CONFIG_P2P */
6285 }
6286
6287
6288 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6289                             const u8 *elem, size_t len)
6290 {
6291         u8 *ie, *end;
6292
6293         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6294         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6295
6296         for (; ie + 1 < end; ie += 2 + ie[1]) {
6297                 if (ie + len > end)
6298                         break;
6299                 if (os_memcmp(ie, elem, len) != 0)
6300                         continue;
6301
6302                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6303                         wpabuf_free(wpa_s->vendor_elem[frame]);
6304                         wpa_s->vendor_elem[frame] = NULL;
6305                 } else {
6306                         os_memmove(ie, ie + len, end - (ie + len));
6307                         wpa_s->vendor_elem[frame]->used -= len;
6308                 }
6309                 wpas_vendor_elem_update(wpa_s);
6310                 return 0;
6311         }
6312
6313         return -1;
6314 }
6315
6316
6317 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6318                                    u16 num_modes, enum hostapd_hw_mode mode)
6319 {
6320         u16 i;
6321
6322         for (i = 0; i < num_modes; i++) {
6323                 if (modes[i].mode == mode)
6324                         return &modes[i];
6325         }
6326
6327         return NULL;
6328 }
6329
6330
6331 static struct
6332 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6333                                                  const u8 *bssid)
6334 {
6335         struct wpa_bss_tmp_disallowed *bss;
6336
6337         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6338                          struct wpa_bss_tmp_disallowed, list) {
6339                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6340                         return bss;
6341         }
6342
6343         return NULL;
6344 }
6345
6346
6347 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6348                           unsigned int sec)
6349 {
6350         struct wpa_bss_tmp_disallowed *bss;
6351         struct os_reltime until;
6352
6353         os_get_reltime(&until);
6354         until.sec += sec;
6355
6356         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6357         if (bss) {
6358                 bss->disallowed_until = until;
6359                 return;
6360         }
6361
6362         bss = os_malloc(sizeof(*bss));
6363         if (!bss) {
6364                 wpa_printf(MSG_DEBUG,
6365                            "Failed to allocate memory for temp disallow BSS");
6366                 return;
6367         }
6368
6369         bss->disallowed_until = until;
6370         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6371         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6372 }
6373
6374
6375 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6376 {
6377         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6378         struct os_reltime now, age;
6379
6380         os_get_reltime(&now);
6381
6382         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6383                          struct wpa_bss_tmp_disallowed, list) {
6384                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6385                         /* This BSS is not disallowed anymore */
6386                         dl_list_del(&tmp->list);
6387                         os_free(tmp);
6388                         continue;
6389                 }
6390                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6391                         bss = tmp;
6392                         break;
6393                 }
6394         }
6395         if (!bss)
6396                 return 0;
6397
6398         os_reltime_sub(&bss->disallowed_until, &now, &age);
6399         wpa_printf(MSG_DEBUG,
6400                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6401                    MAC2STR(bss->bssid), age.sec, age.usec);
6402         return 1;
6403 }