wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (is_zero_ether_addr(bssid))
 196                 bssid = wpa_s->pending_bssid;
 197         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 198                 MAC2STR(bssid));
 199         wpa_blacklist_add(wpa_s, bssid);
 200         wpa_sm_notify_disassoc(wpa_s->wpa);
 201         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 202         wpa_s->reassociate = 1;
 203
 204         /*
 205          * If we timed out, the AP or the local radio may be busy.
 206          * So, wait a second until scanning again.
 207          */
 208         wpa_supplicant_req_scan(wpa_s, 1, 0);
 209 }
 210
 211
 212 /**
 213  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 214  * @wpa_s: Pointer to wpa_supplicant data
 215  * @sec: Number of seconds after which to time out authentication
 216  * @usec: Number of microseconds after which to time out authentication
 217  *
 218  * This function is used to schedule a timeout for the current authentication
 219  * attempt.
 220  */
 221 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 222                                      int sec, int usec)
 223 {
 224         if (wpa_s->conf->ap_scan == 0 &&
 225             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 226                 return;
 227
 228         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 229                 "%d usec", sec, usec);
 230         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 231         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 232 }
 233
 234
 235 /**
 236  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 237  * @wpa_s: Pointer to wpa_supplicant data
 238  *
 239  * This function is used to cancel authentication timeout scheduled with
 240  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 241  * been completed.
 242  */
 243 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 244 {
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 246         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 247         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 248 }
 249
 250
 251 /**
 252  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 253  * @wpa_s: Pointer to wpa_supplicant data
 254  *
 255  * This function is used to configure EAPOL state machine based on the selected
 256  * authentication mode.
 257  */
 258 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 259 {
 260 #ifdef IEEE8021X_EAPOL
 261         struct eapol_config eapol_conf;
 262         struct wpa_ssid *ssid = wpa_s->current_ssid;
 263
 264 #ifdef CONFIG_IBSS_RSN
 265         if (ssid->mode == WPAS_MODE_IBSS &&
 266             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 267             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 268                 /*
 269                  * RSN IBSS authentication is per-STA and we can disable the
 270                  * per-BSSID EAPOL authentication.
 271                  */
 272                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 273                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 274                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 275                 return;
 276         }
 277 #endif /* CONFIG_IBSS_RSN */
 278
 279         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 280         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 281
 282         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 283             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 284                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 285         else
 286                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 287
 288         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 289         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 290                 eapol_conf.accept_802_1x_keys = 1;
 291                 eapol_conf.required_keys = 0;
 292                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 293                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 294                 }
 295                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 296                         eapol_conf.required_keys |=
 297                                 EAPOL_REQUIRE_KEY_BROADCAST;
 298                 }
 299
 300                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 301                         eapol_conf.required_keys = 0;
 302         }
 303         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 304         eapol_conf.workaround = ssid->eap_workaround;
 305         eapol_conf.eap_disabled =
 306                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 307                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 308                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 309         eapol_conf.external_sim = wpa_s->conf->external_sim;
 310
 311 #ifdef CONFIG_WPS
 312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 313                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 314                 if (wpa_s->current_bss) {
 315                         struct wpabuf *ie;
 316                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 317                                                          WPS_IE_VENDOR_TYPE);
 318                         if (ie) {
 319                                 if (wps_is_20(ie))
 320                                         eapol_conf.wps |=
 321                                                 EAPOL_PEER_IS_WPS20_AP;
 322                                 wpabuf_free(ie);
 323                         }
 324                 }
 325         }
 326 #endif /* CONFIG_WPS */
 327
 328         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 329
 330         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 331 #endif /* IEEE8021X_EAPOL */
 332 }
 333
 334
 335 /**
 336  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 337  * @wpa_s: Pointer to wpa_supplicant data
 338  * @ssid: Configuration data for the network
 339  *
 340  * This function is used to configure WPA state machine and related parameters
 341  * to a mode where WPA is not enabled. This is called as part of the
 342  * authentication configuration when the selected network does not use WPA.
 343  */
 344 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 345                                        struct wpa_ssid *ssid)
 346 {
 347         int i;
 348
 349         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 351         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 353         else
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 355         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 356         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 357         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 359         wpa_s->group_cipher = WPA_CIPHER_NONE;
 360         wpa_s->mgmt_group_cipher = 0;
 361
 362         for (i = 0; i < NUM_WEP_KEYS; i++) {
 363                 if (ssid->wep_key_len[i] > 5) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 366                         break;
 367                 } else if (ssid->wep_key_len[i] > 0) {
 368                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 369                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 370                         break;
 371                 }
 372         }
 373
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 377                          wpa_s->pairwise_cipher);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 379 #ifdef CONFIG_IEEE80211W
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 381                          wpa_s->mgmt_group_cipher);
 382 #endif /* CONFIG_IEEE80211W */
 383
 384         pmksa_cache_clear_current(wpa_s->wpa);
 385 }
 386
 387
 388 void free_hw_features(struct wpa_supplicant *wpa_s)
 389 {
 390         int i;
 391         if (wpa_s->hw.modes == NULL)
 392                 return;
 393
 394         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 395                 os_free(wpa_s->hw.modes[i].channels);
 396                 os_free(wpa_s->hw.modes[i].rates);
 397         }
 398
 399         os_free(wpa_s->hw.modes);
 400         wpa_s->hw.modes = NULL;
 401 }
 402
 403
 404 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 405 {
 406         struct wpa_bss_tmp_disallowed *bss, *prev;
 407
 408         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 409                               struct wpa_bss_tmp_disallowed, list) {
 410                 dl_list_del(&bss->list);
 411                 os_free(bss);
 412         }
 413 }
 414
 415
 416 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 417 {
 418         int i;
 419
 420         bgscan_deinit(wpa_s);
 421         autoscan_deinit(wpa_s);
 422         scard_deinit(wpa_s->scard);
 423         wpa_s->scard = NULL;
 424         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 425         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 426         l2_packet_deinit(wpa_s->l2);
 427         wpa_s->l2 = NULL;
 428         if (wpa_s->l2_br) {
 429                 l2_packet_deinit(wpa_s->l2_br);
 430                 wpa_s->l2_br = NULL;
 431         }
 432 #ifdef CONFIG_TESTING_OPTIONS
 433         l2_packet_deinit(wpa_s->l2_test);
 434         wpa_s->l2_test = NULL;
 435 #endif /* CONFIG_TESTING_OPTIONS */
 436
 437         if (wpa_s->conf != NULL) {
 438                 struct wpa_ssid *ssid;
 439                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 440                         wpas_notify_network_removed(wpa_s, ssid);
 441         }
 442
 443         os_free(wpa_s->confname);
 444         wpa_s->confname = NULL;
 445
 446         os_free(wpa_s->confanother);
 447         wpa_s->confanother = NULL;
 448
 449         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 450         eapol_sm_deinit(wpa_s->eapol);
 451         wpa_s->eapol = NULL;
 452
 453         rsn_preauth_deinit(wpa_s->wpa);
 454
 455 #ifdef CONFIG_TDLS
 456         wpa_tdls_deinit(wpa_s->wpa);
 457 #endif /* CONFIG_TDLS */
 458
 459         wmm_ac_clear_saved_tspecs(wpa_s);
 460         pmksa_candidate_free(wpa_s->wpa);
 461         wpa_sm_deinit(wpa_s->wpa);
 462         wpa_s->wpa = NULL;
 463         wpa_blacklist_clear(wpa_s);
 464
 465         wpa_bss_deinit(wpa_s);
 466
 467         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 468         wpa_supplicant_cancel_scan(wpa_s);
 469         wpa_supplicant_cancel_auth_timeout(wpa_s);
 470         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 471 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 472         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 473                              wpa_s, NULL);
 474 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 475
 476         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 477
 478         wpas_wps_deinit(wpa_s);
 479
 480         wpabuf_free(wpa_s->pending_eapol_rx);
 481         wpa_s->pending_eapol_rx = NULL;
 482
 483 #ifdef CONFIG_IBSS_RSN
 484         ibss_rsn_deinit(wpa_s->ibss_rsn);
 485         wpa_s->ibss_rsn = NULL;
 486 #endif /* CONFIG_IBSS_RSN */
 487
 488         sme_deinit(wpa_s);
 489
 490 #ifdef CONFIG_AP
 491         wpa_supplicant_ap_deinit(wpa_s);
 492 #endif /* CONFIG_AP */
 493
 494         wpas_p2p_deinit(wpa_s);
 495
 496 #ifdef CONFIG_OFFCHANNEL
 497         offchannel_deinit(wpa_s);
 498 #endif /* CONFIG_OFFCHANNEL */
 499
 500         wpa_supplicant_cancel_sched_scan(wpa_s);
 501
 502         os_free(wpa_s->next_scan_freqs);
 503         wpa_s->next_scan_freqs = NULL;
 504
 505         os_free(wpa_s->manual_scan_freqs);
 506         wpa_s->manual_scan_freqs = NULL;
 507
 508         os_free(wpa_s->manual_sched_scan_freqs);
 509         wpa_s->manual_sched_scan_freqs = NULL;
 510
 511         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 512
 513         /*
 514          * Need to remove any pending gas-query radio work before the
 515          * gas_query_deinit() call because gas_query::work has not yet been set
 516          * for works that have not been started. gas_query_free() will be unable
 517          * to cancel such pending radio works and once the pending gas-query
 518          * radio work eventually gets removed, the deinit notification call to
 519          * gas_query_start_cb() would result in dereferencing freed memory.
 520          */
 521         if (wpa_s->radio)
 522                 radio_remove_works(wpa_s, "gas-query", 0);
 523         gas_query_deinit(wpa_s->gas);
 524         wpa_s->gas = NULL;
 525
 526         free_hw_features(wpa_s);
 527
 528         ieee802_1x_dealloc_kay_sm(wpa_s);
 529
 530         os_free(wpa_s->bssid_filter);
 531         wpa_s->bssid_filter = NULL;
 532
 533         os_free(wpa_s->disallow_aps_bssid);
 534         wpa_s->disallow_aps_bssid = NULL;
 535         os_free(wpa_s->disallow_aps_ssid);
 536         wpa_s->disallow_aps_ssid = NULL;
 537
 538         wnm_bss_keep_alive_deinit(wpa_s);
 539 #ifdef CONFIG_WNM
 540         wnm_deallocate_memory(wpa_s);
 541 #endif /* CONFIG_WNM */
 542
 543         ext_password_deinit(wpa_s->ext_pw);
 544         wpa_s->ext_pw = NULL;
 545
 546         wpabuf_free(wpa_s->last_gas_resp);
 547         wpa_s->last_gas_resp = NULL;
 548         wpabuf_free(wpa_s->prev_gas_resp);
 549         wpa_s->prev_gas_resp = NULL;
 550
 551         os_free(wpa_s->last_scan_res);
 552         wpa_s->last_scan_res = NULL;
 553
 554 #ifdef CONFIG_HS20
 555         if (wpa_s->drv_priv)
 556                 wpa_drv_configure_frame_filters(wpa_s, 0);
 557         hs20_deinit(wpa_s);
 558 #endif /* CONFIG_HS20 */
 559
 560         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 561                 wpabuf_free(wpa_s->vendor_elem[i]);
 562                 wpa_s->vendor_elem[i] = NULL;
 563         }
 564
 565         wmm_ac_notify_disassoc(wpa_s);
 566
 567         wpa_s->sched_scan_plans_num = 0;
 568         os_free(wpa_s->sched_scan_plans);
 569         wpa_s->sched_scan_plans = NULL;
 570
 571 #ifdef CONFIG_MBO
 572         wpa_s->non_pref_chan_num = 0;
 573         os_free(wpa_s->non_pref_chan);
 574         wpa_s->non_pref_chan = NULL;
 575 #endif /* CONFIG_MBO */
 576
 577         free_bss_tmp_disallowed(wpa_s);
 578
 579         wpabuf_free(wpa_s->lci);
 580         wpa_s->lci = NULL;
 581 }
 582
 583
 584 /**
 585  * wpa_clear_keys - Clear keys configured for the driver
 586  * @wpa_s: Pointer to wpa_supplicant data
 587  * @addr: Previously used BSSID or %NULL if not available
 588  *
 589  * This function clears the encryption keys that has been previously configured
 590  * for the driver.
 591  */
 592 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 593 {
 594         int i, max;
 595
 596 #ifdef CONFIG_IEEE80211W
 597         max = 6;
 598 #else /* CONFIG_IEEE80211W */
 599         max = 4;
 600 #endif /* CONFIG_IEEE80211W */
 601
 602         /* MLME-DELETEKEYS.request */
 603         for (i = 0; i < max; i++) {
 604                 if (wpa_s->keys_cleared & BIT(i))
 605                         continue;
 606                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 607                                 NULL, 0);
 608         }
 609         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 610             !is_zero_ether_addr(addr)) {
 611                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 612                                 0);
 613                 /* MLME-SETPROTECTION.request(None) */
 614                 wpa_drv_mlme_setprotection(
 615                         wpa_s, addr,
 616                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 617                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 618         }
 619         wpa_s->keys_cleared = (u32) -1;
 620 }
 621
 622
 623 /**
 624  * wpa_supplicant_state_txt - Get the connection state name as a text string
 625  * @state: State (wpa_state; WPA_*)
 626  * Returns: The state name as a printable text string
 627  */
 628 const char * wpa_supplicant_state_txt(enum wpa_states state)
 629 {
 630         switch (state) {
 631         case WPA_DISCONNECTED:
 632                 return "DISCONNECTED";
 633         case WPA_INACTIVE:
 634                 return "INACTIVE";
 635         case WPA_INTERFACE_DISABLED:
 636                 return "INTERFACE_DISABLED";
 637         case WPA_SCANNING:
 638                 return "SCANNING";
 639         case WPA_AUTHENTICATING:
 640                 return "AUTHENTICATING";
 641         case WPA_ASSOCIATING:
 642                 return "ASSOCIATING";
 643         case WPA_ASSOCIATED:
 644                 return "ASSOCIATED";
 645         case WPA_4WAY_HANDSHAKE:
 646                 return "4WAY_HANDSHAKE";
 647         case WPA_GROUP_HANDSHAKE:
 648                 return "GROUP_HANDSHAKE";
 649         case WPA_COMPLETED:
 650                 return "COMPLETED";
 651         default:
 652                 return "UNKNOWN";
 653         }
 654 }
 655
 656
 657 #ifdef CONFIG_BGSCAN
 658
 659 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 660 {
 661         const char *name;
 662
 663         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 664                 name = wpa_s->current_ssid->bgscan;
 665         else
 666                 name = wpa_s->conf->bgscan;
 667         if (name == NULL || name[0] == '\0')
 668                 return;
 669         if (wpas_driver_bss_selection(wpa_s))
 670                 return;
 671         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 672                 return;
 673 #ifdef CONFIG_P2P
 674         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 675                 return;
 676 #endif /* CONFIG_P2P */
 677
 678         bgscan_deinit(wpa_s);
 679         if (wpa_s->current_ssid) {
 680                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 681                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 682                                 "bgscan");
 683                         /*
 684                          * Live without bgscan; it is only used as a roaming
 685                          * optimization, so the initial connection is not
 686                          * affected.
 687                          */
 688                 } else {
 689                         struct wpa_scan_results *scan_res;
 690                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 691                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 692                                                                    0);
 693                         if (scan_res) {
 694                                 bgscan_notify_scan(wpa_s, scan_res);
 695                                 wpa_scan_results_free(scan_res);
 696                         }
 697                 }
 698         } else
 699                 wpa_s->bgscan_ssid = NULL;
 700 }
 701
 702
 703 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 704 {
 705         if (wpa_s->bgscan_ssid != NULL) {
 706                 bgscan_deinit(wpa_s);
 707                 wpa_s->bgscan_ssid = NULL;
 708         }
 709 }
 710
 711 #endif /* CONFIG_BGSCAN */
 712
 713
 714 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 715 {
 716         if (autoscan_init(wpa_s, 0))
 717                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 718 }
 719
 720
 721 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 722 {
 723         autoscan_deinit(wpa_s);
 724 }
 725
 726
 727 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 728 {
 729         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 730             wpa_s->wpa_state == WPA_SCANNING) {
 731                 autoscan_deinit(wpa_s);
 732                 wpa_supplicant_start_autoscan(wpa_s);
 733         }
 734 }
 735
 736
 737 /**
 738  * wpa_supplicant_set_state - Set current connection state
 739  * @wpa_s: Pointer to wpa_supplicant data
 740  * @state: The new connection state
 741  *
 742  * This function is called whenever the connection state changes, e.g.,
 743  * association is completed for WPA/WPA2 4-Way Handshake is started.
 744  */
 745 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 746                               enum wpa_states state)
 747 {
 748         enum wpa_states old_state = wpa_s->wpa_state;
 749
 750         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 751                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 752                 wpa_supplicant_state_txt(state));
 753
 754         if (state == WPA_INTERFACE_DISABLED) {
 755                 /* Assure normal scan when interface is restored */
 756                 wpa_s->normal_scans = 0;
 757         }
 758
 759         if (state == WPA_COMPLETED) {
 760                 wpas_connect_work_done(wpa_s);
 761                 /* Reinitialize normal_scan counter */
 762                 wpa_s->normal_scans = 0;
 763         }
 764
 765 #ifdef CONFIG_P2P
 766         /*
 767          * P2PS client has to reply to Probe Request frames received on the
 768          * group operating channel. Enable Probe Request frame reporting for
 769          * P2P connected client in case p2p_cli_probe configuration property is
 770          * set to 1.
 771          */
 772         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 773             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 774             wpa_s->current_ssid->p2p_group) {
 775                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 776                         wpa_dbg(wpa_s, MSG_DEBUG,
 777                                 "P2P: Enable CLI Probe Request RX reporting");
 778                         wpa_s->p2p_cli_probe =
 779                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 780                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 781                         wpa_dbg(wpa_s, MSG_DEBUG,
 782                                 "P2P: Disable CLI Probe Request RX reporting");
 783                         wpa_s->p2p_cli_probe = 0;
 784                         wpa_drv_probe_req_report(wpa_s, 0);
 785                 }
 786         }
 787 #endif /* CONFIG_P2P */
 788
 789         if (state != WPA_SCANNING)
 790                 wpa_supplicant_notify_scanning(wpa_s, 0);
 791
 792         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 793                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 794 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 795                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 796                         MACSTR " completed [id=%d id_str=%s]",
 797                         MAC2STR(wpa_s->bssid),
 798                         ssid ? ssid->id : -1,
 799                         ssid && ssid->id_str ? ssid->id_str : "");
 800 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 801                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 802                 wpa_blacklist_clear(wpa_s);
 803                 wpa_s->extra_blacklist_count = 0;
 804                 wpa_s->new_connection = 0;
 805                 wpa_drv_set_operstate(wpa_s, 1);
 806 #ifndef IEEE8021X_EAPOL
 807                 wpa_drv_set_supp_port(wpa_s, 1);
 808 #endif /* IEEE8021X_EAPOL */
 809                 wpa_s->after_wps = 0;
 810                 wpa_s->known_wps_freq = 0;
 811                 wpas_p2p_completed(wpa_s);
 812
 813                 sme_sched_obss_scan(wpa_s, 1);
 814         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 815                    state == WPA_ASSOCIATED) {
 816                 wpa_s->new_connection = 1;
 817                 wpa_drv_set_operstate(wpa_s, 0);
 818 #ifndef IEEE8021X_EAPOL
 819                 wpa_drv_set_supp_port(wpa_s, 0);
 820 #endif /* IEEE8021X_EAPOL */
 821                 sme_sched_obss_scan(wpa_s, 0);
 822         }
 823         wpa_s->wpa_state = state;
 824
 825 #ifdef CONFIG_BGSCAN
 826         if (state == WPA_COMPLETED)
 827                 wpa_supplicant_start_bgscan(wpa_s);
 828         else if (state < WPA_ASSOCIATED)
 829                 wpa_supplicant_stop_bgscan(wpa_s);
 830 #endif /* CONFIG_BGSCAN */
 831
 832         if (state == WPA_AUTHENTICATING)
 833                 wpa_supplicant_stop_autoscan(wpa_s);
 834
 835         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 836                 wpa_supplicant_start_autoscan(wpa_s);
 837
 838         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 839                 wmm_ac_notify_disassoc(wpa_s);
 840
 841         if (wpa_s->wpa_state != old_state) {
 842                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 843
 844                 /*
 845                  * Notify the P2P Device interface about a state change in one
 846                  * of the interfaces.
 847                  */
 848                 wpas_p2p_indicate_state_change(wpa_s);
 849
 850                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 851                     old_state == WPA_COMPLETED)
 852                         wpas_notify_auth_changed(wpa_s);
 853         }
 854 }
 855
 856
 857 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 858 {
 859         int pending = 0;
 860 #ifdef CONFIG_WPS
 861         struct wpa_supplicant *wpa_s = global->ifaces;
 862         while (wpa_s) {
 863                 struct wpa_supplicant *next = wpa_s->next;
 864                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 865                         pending = 1;
 866 #ifdef CONFIG_P2P
 867                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 868                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 869                         wpas_p2p_disconnect(wpa_s);
 870 #endif /* CONFIG_P2P */
 871                 wpa_s = next;
 872         }
 873 #endif /* CONFIG_WPS */
 874         if (pending)
 875                 return;
 876         eloop_terminate();
 877 }
 878
 879
 880 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 881 {
 882         struct wpa_global *global = signal_ctx;
 883         wpa_supplicant_terminate_proc(global);
 884 }
 885
 886
 887 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 888 {
 889         enum wpa_states old_state = wpa_s->wpa_state;
 890
 891         wpa_s->pairwise_cipher = 0;
 892         wpa_s->group_cipher = 0;
 893         wpa_s->mgmt_group_cipher = 0;
 894         wpa_s->key_mgmt = 0;
 895         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 896                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 897
 898         if (wpa_s->wpa_state != old_state)
 899                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 900 }
 901
 902
 903 /**
 904  * wpa_supplicant_reload_configuration - Reload configuration data
 905  * @wpa_s: Pointer to wpa_supplicant data
 906  * Returns: 0 on success or -1 if configuration parsing failed
 907  *
 908  * This function can be used to request that the configuration data is reloaded
 909  * (e.g., after configuration file change). This function is reloading
 910  * configuration only for one interface, so this may need to be called multiple
 911  * times if %wpa_supplicant is controlling multiple interfaces and all
 912  * interfaces need reconfiguration.
 913  */
 914 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 915 {
 916         struct wpa_config *conf;
 917         int reconf_ctrl;
 918         int old_ap_scan;
 919
 920         if (wpa_s->confname == NULL)
 921                 return -1;
 922         conf = wpa_config_read(wpa_s->confname, NULL);
 923         if (conf == NULL) {
 924                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 925                         "file '%s' - exiting", wpa_s->confname);
 926                 return -1;
 927         }
 928         wpa_config_read(wpa_s->confanother, conf);
 929
 930         conf->changed_parameters = (unsigned int) -1;
 931
 932         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 933                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 934                     os_strcmp(conf->ctrl_interface,
 935                               wpa_s->conf->ctrl_interface) != 0);
 936
 937         if (reconf_ctrl && wpa_s->ctrl_iface) {
 938                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 939                 wpa_s->ctrl_iface = NULL;
 940         }
 941
 942         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 943         if (wpa_s->current_ssid) {
 944                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 945                         wpa_s->own_disconnect_req = 1;
 946                 wpa_supplicant_deauthenticate(wpa_s,
 947                                               WLAN_REASON_DEAUTH_LEAVING);
 948         }
 949
 950         /*
 951          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 952          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 953          */
 954         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 955                 /*
 956                  * Clear forced success to clear EAP state for next
 957                  * authentication.
 958                  */
 959                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 960         }
 961         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 962         wpa_sm_set_config(wpa_s->wpa, NULL);
 963         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 964         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 965         rsn_preauth_deinit(wpa_s->wpa);
 966
 967         old_ap_scan = wpa_s->conf->ap_scan;
 968         wpa_config_free(wpa_s->conf);
 969         wpa_s->conf = conf;
 970         if (old_ap_scan != wpa_s->conf->ap_scan)
 971                 wpas_notify_ap_scan_changed(wpa_s);
 972
 973         if (reconf_ctrl)
 974                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 975
 976         wpa_supplicant_update_config(wpa_s);
 977
 978         wpa_supplicant_clear_status(wpa_s);
 979         if (wpa_supplicant_enabled_networks(wpa_s)) {
 980                 wpa_s->reassociate = 1;
 981                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 982         }
 983         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 984         return 0;
 985 }
 986
 987
 988 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 989 {
 990         struct wpa_global *global = signal_ctx;
 991         struct wpa_supplicant *wpa_s;
 992         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 993                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 994                         sig);
 995                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 996                         wpa_supplicant_terminate_proc(global);
 997                 }
 998         }
 999
1000         if (wpa_debug_reopen_file() < 0) {
1001                 /* Ignore errors since we cannot really do much to fix this */
1002                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1003         }
1004 }
1005
1006
1007 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1008                                          struct wpa_ssid *ssid,
1009                                          struct wpa_ie_data *ie)
1010 {
1011         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1012         if (ret) {
1013                 if (ret == -2) {
1014                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1015                                 "from association info");
1016                 }
1017                 return -1;
1018         }
1019
1020         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1021                 "cipher suites");
1022         if (!(ie->group_cipher & ssid->group_cipher)) {
1023                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1024                         "cipher 0x%x (mask 0x%x) - reject",
1025                         ie->group_cipher, ssid->group_cipher);
1026                 return -1;
1027         }
1028         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1029                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1030                         "cipher 0x%x (mask 0x%x) - reject",
1031                         ie->pairwise_cipher, ssid->pairwise_cipher);
1032                 return -1;
1033         }
1034         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1036                         "management 0x%x (mask 0x%x) - reject",
1037                         ie->key_mgmt, ssid->key_mgmt);
1038                 return -1;
1039         }
1040
1041 #ifdef CONFIG_IEEE80211W
1042         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1043             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1044                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1045                         "that does not support management frame protection - "
1046                         "reject");
1047                 return -1;
1048         }
1049 #endif /* CONFIG_IEEE80211W */
1050
1051         return 0;
1052 }
1053
1054
1055 /**
1056  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1057  * @wpa_s: Pointer to wpa_supplicant data
1058  * @bss: Scan results for the selected BSS, or %NULL if not available
1059  * @ssid: Configuration data for the selected network
1060  * @wpa_ie: Buffer for the WPA/RSN IE
1061  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1062  * used buffer length in case the functions returns success.
1063  * Returns: 0 on success or -1 on failure
1064  *
1065  * This function is used to configure authentication and encryption parameters
1066  * based on the network configuration and scan result for the selected BSS (if
1067  * available).
1068  */
1069 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1070                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1071                               u8 *wpa_ie, size_t *wpa_ie_len)
1072 {
1073         struct wpa_ie_data ie;
1074         int sel, proto;
1075         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1076
1077         if (bss) {
1078                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1079                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1080                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1081         } else
1082                 bss_wpa = bss_rsn = bss_osen = NULL;
1083
1084         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1085             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1086             (ie.group_cipher & ssid->group_cipher) &&
1087             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1088             (ie.key_mgmt & ssid->key_mgmt)) {
1089                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1090                 proto = WPA_PROTO_RSN;
1091         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1092                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1093                    (ie.group_cipher & ssid->group_cipher) &&
1094                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1095                    (ie.key_mgmt & ssid->key_mgmt)) {
1096                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1097                 proto = WPA_PROTO_WPA;
1098 #ifdef CONFIG_HS20
1099         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1100                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1101                 /* TODO: parse OSEN element */
1102                 os_memset(&ie, 0, sizeof(ie));
1103                 ie.group_cipher = WPA_CIPHER_CCMP;
1104                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1105                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1106                 proto = WPA_PROTO_OSEN;
1107 #endif /* CONFIG_HS20 */
1108         } else if (bss) {
1109                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1110                 wpa_dbg(wpa_s, MSG_DEBUG,
1111                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1112                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1113                         ssid->key_mgmt);
1114                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1115                         MAC2STR(bss->bssid),
1116                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1117                         bss_wpa ? " WPA" : "",
1118                         bss_rsn ? " RSN" : "",
1119                         bss_osen ? " OSEN" : "");
1120                 if (bss_rsn) {
1121                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1122                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1123                                 wpa_dbg(wpa_s, MSG_DEBUG,
1124                                         "Could not parse RSN element");
1125                         } else {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1128                                         ie.pairwise_cipher, ie.group_cipher,
1129                                         ie.key_mgmt);
1130                         }
1131                 }
1132                 if (bss_wpa) {
1133                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1134                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1135                                 wpa_dbg(wpa_s, MSG_DEBUG,
1136                                         "Could not parse WPA element");
1137                         } else {
1138                                 wpa_dbg(wpa_s, MSG_DEBUG,
1139                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1140                                         ie.pairwise_cipher, ie.group_cipher,
1141                                         ie.key_mgmt);
1142                         }
1143                 }
1144                 return -1;
1145         } else {
1146                 if (ssid->proto & WPA_PROTO_OSEN)
1147                         proto = WPA_PROTO_OSEN;
1148                 else if (ssid->proto & WPA_PROTO_RSN)
1149                         proto = WPA_PROTO_RSN;
1150                 else
1151                         proto = WPA_PROTO_WPA;
1152                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1153                         os_memset(&ie, 0, sizeof(ie));
1154                         ie.group_cipher = ssid->group_cipher;
1155                         ie.pairwise_cipher = ssid->pairwise_cipher;
1156                         ie.key_mgmt = ssid->key_mgmt;
1157 #ifdef CONFIG_IEEE80211W
1158                         ie.mgmt_group_cipher =
1159                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1160                                 WPA_CIPHER_AES_128_CMAC : 0;
1161 #endif /* CONFIG_IEEE80211W */
1162                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1163                                 "based on configuration");
1164                 } else
1165                         proto = ie.proto;
1166         }
1167
1168         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1169                 "pairwise %d key_mgmt %d proto %d",
1170                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1171 #ifdef CONFIG_IEEE80211W
1172         if (ssid->ieee80211w) {
1173                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1174                         ie.mgmt_group_cipher);
1175         }
1176 #endif /* CONFIG_IEEE80211W */
1177
1178         wpa_s->wpa_proto = proto;
1179         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1180         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1181                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1182
1183         if (bss || !wpa_s->ap_ies_from_associnfo) {
1184                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1185                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1186                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1187                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1188                         return -1;
1189         }
1190
1191 #ifdef CONFIG_NO_WPA
1192         wpa_s->group_cipher = WPA_CIPHER_NONE;
1193         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1194 #else /* CONFIG_NO_WPA */
1195         sel = ie.group_cipher & ssid->group_cipher;
1196         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1197         if (wpa_s->group_cipher < 0) {
1198                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1199                         "cipher");
1200                 return -1;
1201         }
1202         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1203                 wpa_cipher_txt(wpa_s->group_cipher));
1204
1205         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1206         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1207         if (wpa_s->pairwise_cipher < 0) {
1208                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1209                         "cipher");
1210                 return -1;
1211         }
1212         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1213                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1214 #endif /* CONFIG_NO_WPA */
1215
1216         sel = ie.key_mgmt & ssid->key_mgmt;
1217 #ifdef CONFIG_SAE
1218         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1219                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1220 #endif /* CONFIG_SAE */
1221         if (0) {
1222 #ifdef CONFIG_SUITEB192
1223         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1225                 wpa_dbg(wpa_s, MSG_DEBUG,
1226                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1227 #endif /* CONFIG_SUITEB192 */
1228 #ifdef CONFIG_SUITEB
1229         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1231                 wpa_dbg(wpa_s, MSG_DEBUG,
1232                         "WPA: using KEY_MGMT 802.1X with Suite B");
1233 #endif /* CONFIG_SUITEB */
1234 #ifdef CONFIG_IEEE80211R
1235         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1236                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1237                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1238         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1239                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1240                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1241 #endif /* CONFIG_IEEE80211R */
1242 #ifdef CONFIG_SAE
1243         } else if (sel & WPA_KEY_MGMT_SAE) {
1244                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1245                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1246         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1248                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1249 #endif /* CONFIG_SAE */
1250 #ifdef CONFIG_IEEE80211W
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1253                 wpa_dbg(wpa_s, MSG_DEBUG,
1254                         "WPA: using KEY_MGMT 802.1X with SHA256");
1255         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1256                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1257                 wpa_dbg(wpa_s, MSG_DEBUG,
1258                         "WPA: using KEY_MGMT PSK with SHA256");
1259 #endif /* CONFIG_IEEE80211W */
1260         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1261                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1262                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1263         } else if (sel & WPA_KEY_MGMT_PSK) {
1264                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1266         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1267                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1268                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1269 #ifdef CONFIG_HS20
1270         } else if (sel & WPA_KEY_MGMT_OSEN) {
1271                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1272                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1273 #endif /* CONFIG_HS20 */
1274         } else {
1275                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1276                         "authenticated key management type");
1277                 return -1;
1278         }
1279
1280         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1282                          wpa_s->pairwise_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1284
1285 #ifdef CONFIG_IEEE80211W
1286         sel = ie.mgmt_group_cipher;
1287         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1288             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1289                 sel = 0;
1290         if (sel & WPA_CIPHER_AES_128_CMAC) {
1291                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1292                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1293                         "AES-128-CMAC");
1294         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1295                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1296                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1297                         "BIP-GMAC-128");
1298         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1299                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1300                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1301                         "BIP-GMAC-256");
1302         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1303                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1304                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1305                         "BIP-CMAC-256");
1306         } else {
1307                 wpa_s->mgmt_group_cipher = 0;
1308                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1309         }
1310         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1311                          wpa_s->mgmt_group_cipher);
1312         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1313                          wpas_get_ssid_pmf(wpa_s, ssid));
1314 #endif /* CONFIG_IEEE80211W */
1315
1316         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1317                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1318                 return -1;
1319         }
1320
1321         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1322                 int psk_set = 0;
1323
1324                 if (ssid->psk_set) {
1325                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1326                                        NULL);
1327                         psk_set = 1;
1328                 }
1329 #ifndef CONFIG_NO_PBKDF2
1330                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1331                     ssid->passphrase) {
1332                         u8 psk[PMK_LEN];
1333                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1334                                     4096, psk, PMK_LEN);
1335                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1336                                         psk, PMK_LEN);
1337                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1338                         psk_set = 1;
1339                         os_memset(psk, 0, sizeof(psk));
1340                 }
1341 #endif /* CONFIG_NO_PBKDF2 */
1342 #ifdef CONFIG_EXT_PASSWORD
1343                 if (ssid->ext_psk) {
1344                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1345                                                              ssid->ext_psk);
1346                         char pw_str[64 + 1];
1347                         u8 psk[PMK_LEN];
1348
1349                         if (pw == NULL) {
1350                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1351                                         "found from external storage");
1352                                 return -1;
1353                         }
1354
1355                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1356                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1357                                         "PSK length %d in external storage",
1358                                         (int) wpabuf_len(pw));
1359                                 ext_password_free(pw);
1360                                 return -1;
1361                         }
1362
1363                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1364                         pw_str[wpabuf_len(pw)] = '\0';
1365
1366 #ifndef CONFIG_NO_PBKDF2
1367                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1368                         {
1369                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1370                                             4096, psk, PMK_LEN);
1371                                 os_memset(pw_str, 0, sizeof(pw_str));
1372                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1373                                                 "external passphrase)",
1374                                                 psk, PMK_LEN);
1375                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1376                                                NULL);
1377                                 psk_set = 1;
1378                                 os_memset(psk, 0, sizeof(psk));
1379                         } else
1380 #endif /* CONFIG_NO_PBKDF2 */
1381                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1382                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1383                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1384                                                 "Invalid PSK hex string");
1385                                         os_memset(pw_str, 0, sizeof(pw_str));
1386                                         ext_password_free(pw);
1387                                         return -1;
1388                                 }
1389                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1390                                                NULL);
1391                                 psk_set = 1;
1392                                 os_memset(psk, 0, sizeof(psk));
1393                         } else {
1394                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1395                                         "PSK available");
1396                                 os_memset(pw_str, 0, sizeof(pw_str));
1397                                 ext_password_free(pw);
1398                                 return -1;
1399                         }
1400
1401                         os_memset(pw_str, 0, sizeof(pw_str));
1402                         ext_password_free(pw);
1403                 }
1404 #endif /* CONFIG_EXT_PASSWORD */
1405
1406                 if (!psk_set) {
1407                         wpa_msg(wpa_s, MSG_INFO,
1408                                 "No PSK available for association");
1409                         return -1;
1410                 }
1411         } else
1412                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1413
1414         return 0;
1415 }
1416
1417
1418 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1419 {
1420         *pos = 0x00;
1421
1422         switch (idx) {
1423         case 0: /* Bits 0-7 */
1424                 break;
1425         case 1: /* Bits 8-15 */
1426                 break;
1427         case 2: /* Bits 16-23 */
1428 #ifdef CONFIG_WNM
1429                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1430                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1431 #endif /* CONFIG_WNM */
1432                 break;
1433         case 3: /* Bits 24-31 */
1434 #ifdef CONFIG_WNM
1435                 *pos |= 0x02; /* Bit 25 - SSID List */
1436 #endif /* CONFIG_WNM */
1437 #ifdef CONFIG_INTERWORKING
1438                 if (wpa_s->conf->interworking)
1439                         *pos |= 0x80; /* Bit 31 - Interworking */
1440 #endif /* CONFIG_INTERWORKING */
1441                 break;
1442         case 4: /* Bits 32-39 */
1443 #ifdef CONFIG_INTERWORKING
1444                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1445                         *pos |= 0x01; /* Bit 32 - QoS Map */
1446 #endif /* CONFIG_INTERWORKING */
1447                 break;
1448         case 5: /* Bits 40-47 */
1449 #ifdef CONFIG_HS20
1450                 if (wpa_s->conf->hs20)
1451                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1452 #endif /* CONFIG_HS20 */
1453 #ifdef CONFIG_MBO
1454                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1455 #endif /* CONFIG_MBO */
1456                 break;
1457         case 6: /* Bits 48-55 */
1458                 break;
1459         }
1460 }
1461
1462
1463 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1464 {
1465         u8 *pos = buf;
1466         u8 len = 6, i;
1467
1468         if (len < wpa_s->extended_capa_len)
1469                 len = wpa_s->extended_capa_len;
1470         if (buflen < (size_t) len + 2) {
1471                 wpa_printf(MSG_INFO,
1472                            "Not enough room for building extended capabilities element");
1473                 return -1;
1474         }
1475
1476         *pos++ = WLAN_EID_EXT_CAPAB;
1477         *pos++ = len;
1478         for (i = 0; i < len; i++, pos++) {
1479                 wpas_ext_capab_byte(wpa_s, pos, i);
1480
1481                 if (i < wpa_s->extended_capa_len) {
1482                         *pos &= ~wpa_s->extended_capa_mask[i];
1483                         *pos |= wpa_s->extended_capa[i];
1484                 }
1485         }
1486
1487         while (len > 0 && buf[1 + len] == 0) {
1488                 len--;
1489                 buf[1] = len;
1490         }
1491         if (len == 0)
1492                 return 0;
1493
1494         return 2 + len;
1495 }
1496
1497
1498 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1499                           struct wpa_bss *test_bss)
1500 {
1501         struct wpa_bss *bss;
1502
1503         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1504                 if (bss == test_bss)
1505                         return 1;
1506         }
1507
1508         return 0;
1509 }
1510
1511
1512 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1513                            struct wpa_ssid *test_ssid)
1514 {
1515         struct wpa_ssid *ssid;
1516
1517         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1518                 if (ssid == test_ssid)
1519                         return 1;
1520         }
1521
1522         return 0;
1523 }
1524
1525
1526 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1527                         struct wpa_ssid *test_ssid)
1528 {
1529         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1530                 return 0;
1531
1532         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1533 }
1534
1535
1536 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1537 {
1538         if (cwork == NULL)
1539                 return;
1540         os_free(cwork);
1541 }
1542
1543
1544 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1545 {
1546         struct wpa_connect_work *cwork;
1547         struct wpa_radio_work *work = wpa_s->connect_work;
1548
1549         if (!work)
1550                 return;
1551
1552         wpa_s->connect_work = NULL;
1553         cwork = work->ctx;
1554         work->ctx = NULL;
1555         wpas_connect_work_free(cwork);
1556         radio_work_done(work);
1557 }
1558
1559
1560 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1561 {
1562         struct os_reltime now;
1563         u8 addr[ETH_ALEN];
1564
1565         os_get_reltime(&now);
1566         if (wpa_s->last_mac_addr_style == style &&
1567             wpa_s->last_mac_addr_change.sec != 0 &&
1568             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1569                                 wpa_s->conf->rand_addr_lifetime)) {
1570                 wpa_msg(wpa_s, MSG_DEBUG,
1571                         "Previously selected random MAC address has not yet expired");
1572                 return 0;
1573         }
1574
1575         switch (style) {
1576         case 1:
1577                 if (random_mac_addr(addr) < 0)
1578                         return -1;
1579                 break;
1580         case 2:
1581                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1582                 if (random_mac_addr_keep_oui(addr) < 0)
1583                         return -1;
1584                 break;
1585         default:
1586                 return -1;
1587         }
1588
1589         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1590                 wpa_msg(wpa_s, MSG_INFO,
1591                         "Failed to set random MAC address");
1592                 return -1;
1593         }
1594
1595         os_get_reltime(&wpa_s->last_mac_addr_change);
1596         wpa_s->mac_addr_changed = 1;
1597         wpa_s->last_mac_addr_style = style;
1598
1599         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1600                 wpa_msg(wpa_s, MSG_INFO,
1601                         "Could not update MAC address information");
1602                 return -1;
1603         }
1604
1605         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1606                 MAC2STR(addr));
1607
1608         return 0;
1609 }
1610
1611
1612 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1613 {
1614         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1615             !wpa_s->conf->preassoc_mac_addr)
1616                 return 0;
1617
1618         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1619 }
1620
1621
1622 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1623
1624 /**
1625  * wpa_supplicant_associate - Request association
1626  * @wpa_s: Pointer to wpa_supplicant data
1627  * @bss: Scan results for the selected BSS, or %NULL if not available
1628  * @ssid: Configuration data for the selected network
1629  *
1630  * This function is used to request %wpa_supplicant to associate with a BSS.
1631  */
1632 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1633                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1634 {
1635         struct wpa_connect_work *cwork;
1636         int rand_style;
1637
1638         wpa_s->own_disconnect_req = 0;
1639
1640         /*
1641          * If we are starting a new connection, any previously pending EAPOL
1642          * RX cannot be valid anymore.
1643          */
1644         wpabuf_free(wpa_s->pending_eapol_rx);
1645         wpa_s->pending_eapol_rx = NULL;
1646
1647         if (ssid->mac_addr == -1)
1648                 rand_style = wpa_s->conf->mac_addr;
1649         else
1650                 rand_style = ssid->mac_addr;
1651
1652         wmm_ac_clear_saved_tspecs(wpa_s);
1653         wpa_s->reassoc_same_bss = 0;
1654         wpa_s->reassoc_same_ess = 0;
1655
1656         if (wpa_s->last_ssid == ssid) {
1657                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1658                 wpa_s->reassoc_same_ess = 1;
1659                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1660                         wmm_ac_save_tspecs(wpa_s);
1661                         wpa_s->reassoc_same_bss = 1;
1662                 }
1663         } else if (rand_style > 0) {
1664                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1665                         return;
1666                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1667         } else if (wpa_s->mac_addr_changed) {
1668                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1669                         wpa_msg(wpa_s, MSG_INFO,
1670                                 "Could not restore permanent MAC address");
1671                         return;
1672                 }
1673                 wpa_s->mac_addr_changed = 0;
1674                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1675                         wpa_msg(wpa_s, MSG_INFO,
1676                                 "Could not update MAC address information");
1677                         return;
1678                 }
1679                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1680         }
1681         wpa_s->last_ssid = ssid;
1682
1683 #ifdef CONFIG_IBSS_RSN
1684         ibss_rsn_deinit(wpa_s->ibss_rsn);
1685         wpa_s->ibss_rsn = NULL;
1686 #endif /* CONFIG_IBSS_RSN */
1687
1688         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1689             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1690 #ifdef CONFIG_AP
1691                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1692                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1693                                 "mode");
1694                         return;
1695                 }
1696                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1697                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1698                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1699                                 wpas_p2p_ap_setup_failed(wpa_s);
1700                         return;
1701                 }
1702                 wpa_s->current_bss = bss;
1703 #else /* CONFIG_AP */
1704                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1705                         "the build");
1706 #endif /* CONFIG_AP */
1707                 return;
1708         }
1709
1710         if (ssid->mode == WPAS_MODE_MESH) {
1711 #ifdef CONFIG_MESH
1712                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1713                         wpa_msg(wpa_s, MSG_INFO,
1714                                 "Driver does not support mesh mode");
1715                         return;
1716                 }
1717                 if (bss)
1718                         ssid->frequency = bss->freq;
1719                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1720                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1721                         return;
1722                 }
1723                 wpa_s->current_bss = bss;
1724                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1725                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1726                         ssid->id);
1727 #else /* CONFIG_MESH */
1728                 wpa_msg(wpa_s, MSG_ERROR,
1729                         "mesh mode support not included in the build");
1730 #endif /* CONFIG_MESH */
1731                 return;
1732         }
1733
1734 #ifdef CONFIG_TDLS
1735         if (bss)
1736                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1737                                 bss->ie_len);
1738 #endif /* CONFIG_TDLS */
1739
1740         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1741             ssid->mode == IEEE80211_MODE_INFRA) {
1742                 sme_authenticate(wpa_s, bss, ssid);
1743                 return;
1744         }
1745
1746         if (wpa_s->connect_work) {
1747                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1748                 return;
1749         }
1750
1751         if (radio_work_pending(wpa_s, "connect")) {
1752                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1753                 return;
1754         }
1755
1756         wpas_abort_ongoing_scan(wpa_s);
1757
1758         cwork = os_zalloc(sizeof(*cwork));
1759         if (cwork == NULL)
1760                 return;
1761
1762         cwork->bss = bss;
1763         cwork->ssid = ssid;
1764
1765         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1766                            wpas_start_assoc_cb, cwork) < 0) {
1767                 os_free(cwork);
1768         }
1769 }
1770
1771
1772 static int bss_is_ibss(struct wpa_bss *bss)
1773 {
1774         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1775                 IEEE80211_CAP_IBSS;
1776 }
1777
1778
1779 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1780                             const struct wpa_ssid *ssid)
1781 {
1782         enum hostapd_hw_mode hw_mode;
1783         struct hostapd_hw_modes *mode = NULL;
1784         u8 channel;
1785         int i;
1786
1787 #ifdef CONFIG_HT_OVERRIDES
1788         if (ssid->disable_ht)
1789                 return 0;
1790 #endif /* CONFIG_HT_OVERRIDES */
1791
1792         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1793         if (hw_mode == NUM_HOSTAPD_MODES)
1794                 return 0;
1795         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1796                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1797                         mode = &wpa_s->hw.modes[i];
1798                         break;
1799                 }
1800         }
1801
1802         if (!mode)
1803                 return 0;
1804
1805         return mode->vht_capab != 0;
1806 }
1807
1808
1809 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1810                           const struct wpa_ssid *ssid,
1811                           struct hostapd_freq_params *freq)
1812 {
1813         enum hostapd_hw_mode hw_mode;
1814         struct hostapd_hw_modes *mode = NULL;
1815         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1816                            184, 192 };
1817         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1818         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1819         u8 channel;
1820         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1821         unsigned int j, k;
1822         struct hostapd_freq_params vht_freq;
1823         int chwidth, seg0, seg1;
1824         u32 vht_caps = 0;
1825
1826         freq->freq = ssid->frequency;
1827
1828         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1829                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1830
1831                 if (ssid->mode != WPAS_MODE_IBSS)
1832                         break;
1833
1834                 /* Don't adjust control freq in case of fixed_freq */
1835                 if (ssid->fixed_freq)
1836                         break;
1837
1838                 if (!bss_is_ibss(bss))
1839                         continue;
1840
1841                 if (ssid->ssid_len == bss->ssid_len &&
1842                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1843                         wpa_printf(MSG_DEBUG,
1844                                    "IBSS already found in scan results, adjust control freq: %d",
1845                                    bss->freq);
1846                         freq->freq = bss->freq;
1847                         obss_scan = 0;
1848                         break;
1849                 }
1850         }
1851
1852         /* For IBSS check HT_IBSS flag */
1853         if (ssid->mode == WPAS_MODE_IBSS &&
1854             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1855                 return;
1856
1857         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1858             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1859             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1860                 wpa_printf(MSG_DEBUG,
1861                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1862                 return;
1863         }
1864
1865         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1866         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1867                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1868                         mode = &wpa_s->hw.modes[i];
1869                         break;
1870                 }
1871         }
1872
1873         if (!mode)
1874                 return;
1875
1876 #ifdef CONFIG_HT_OVERRIDES
1877         if (ssid->disable_ht) {
1878                 freq->ht_enabled = 0;
1879                 return;
1880         }
1881 #endif /* CONFIG_HT_OVERRIDES */
1882
1883         freq->ht_enabled = ht_supported(mode);
1884         if (!freq->ht_enabled)
1885                 return;
1886
1887         /* Setup higher BW only for 5 GHz */
1888         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1889                 return;
1890
1891         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1892                 pri_chan = &mode->channels[chan_idx];
1893                 if (pri_chan->chan == channel)
1894                         break;
1895                 pri_chan = NULL;
1896         }
1897         if (!pri_chan)
1898                 return;
1899
1900         /* Check primary channel flags */
1901         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1902                 return;
1903
1904 #ifdef CONFIG_HT_OVERRIDES
1905         if (ssid->disable_ht40)
1906                 return;
1907 #endif /* CONFIG_HT_OVERRIDES */
1908
1909         /* Check/setup HT40+/HT40- */
1910         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1911                 if (ht40plus[j] == channel) {
1912                         ht40 = 1;
1913                         break;
1914                 }
1915         }
1916
1917         /* Find secondary channel */
1918         for (i = 0; i < mode->num_channels; i++) {
1919                 sec_chan = &mode->channels[i];
1920                 if (sec_chan->chan == channel + ht40 * 4)
1921                         break;
1922                 sec_chan = NULL;
1923         }
1924         if (!sec_chan)
1925                 return;
1926
1927         /* Check secondary channel flags */
1928         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1929                 return;
1930
1931         freq->channel = pri_chan->chan;
1932
1933         if (ht40 == -1) {
1934                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1935                         return;
1936         } else {
1937                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1938                         return;
1939         }
1940         freq->sec_channel_offset = ht40;
1941
1942         if (obss_scan) {
1943                 struct wpa_scan_results *scan_res;
1944
1945                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1946                 if (scan_res == NULL) {
1947                         /* Back to HT20 */
1948                         freq->sec_channel_offset = 0;
1949                         return;
1950                 }
1951
1952                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1953                                      sec_chan->chan);
1954                 switch (res) {
1955                 case 0:
1956                         /* Back to HT20 */
1957                         freq->sec_channel_offset = 0;
1958                         break;
1959                 case 1:
1960                         /* Configuration allowed */
1961                         break;
1962                 case 2:
1963                         /* Switch pri/sec channels */
1964                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1965                         freq->sec_channel_offset = -freq->sec_channel_offset;
1966                         freq->channel = sec_chan->chan;
1967                         break;
1968                 default:
1969                         freq->sec_channel_offset = 0;
1970                         break;
1971                 }
1972
1973                 wpa_scan_results_free(scan_res);
1974         }
1975
1976         wpa_printf(MSG_DEBUG,
1977                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1978                    freq->channel, freq->sec_channel_offset);
1979
1980         if (!drv_supports_vht(wpa_s, ssid))
1981                 return;
1982
1983         /* For IBSS check VHT_IBSS flag */
1984         if (ssid->mode == WPAS_MODE_IBSS &&
1985             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1986                 return;
1987
1988         vht_freq = *freq;
1989
1990         vht_freq.vht_enabled = vht_supported(mode);
1991         if (!vht_freq.vht_enabled)
1992                 return;
1993
1994         /* setup center_freq1, bandwidth */
1995         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1996                 if (freq->channel >= vht80[j] &&
1997                     freq->channel < vht80[j] + 16)
1998                         break;
1999         }
2000
2001         if (j == ARRAY_SIZE(vht80))
2002                 return;
2003
2004         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
2005                 struct hostapd_channel_data *chan;
2006
2007                 chan = hw_get_channel_chan(mode, i, NULL);
2008                 if (!chan)
2009                         return;
2010
2011                 /* Back to HT configuration if channel not usable */
2012                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2013                         return;
2014         }
2015
2016         chwidth = VHT_CHANWIDTH_80MHZ;
2017         seg0 = vht80[j] + 6;
2018         seg1 = 0;
2019
2020         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2021                 /* setup center_freq2, bandwidth */
2022                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2023                         /* Only accept 80 MHz segments separated by a gap */
2024                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2025                                 continue;
2026                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2027                                 struct hostapd_channel_data *chan;
2028
2029                                 chan = hw_get_channel_chan(mode, i, NULL);
2030                                 if (!chan)
2031                                         continue;
2032
2033                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2034                                                   HOSTAPD_CHAN_NO_IR |
2035                                                   HOSTAPD_CHAN_RADAR))
2036                                         continue;
2037
2038                                 /* Found a suitable second segment for 80+80 */
2039                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2040                                 vht_caps |=
2041                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2042                                 seg1 = vht80[k] + 6;
2043                         }
2044
2045                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2046                                 break;
2047                 }
2048         } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_160MHZ) {
2049                 if (freq->freq == 5180) {
2050                         chwidth = VHT_CHANWIDTH_160MHZ;
2051                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2052                         seg0 = 50;
2053                 } else if (freq->freq == 5520) {
2054                         chwidth = VHT_CHANWIDTH_160MHZ;
2055                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2056                         seg0 = 114;
2057                 }
2058         }
2059
2060         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2061                                     freq->channel, freq->ht_enabled,
2062                                     vht_freq.vht_enabled,
2063                                     freq->sec_channel_offset,
2064                                     chwidth, seg0, seg1, vht_caps) != 0)
2065                 return;
2066
2067         *freq = vht_freq;
2068
2069         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2070                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2071 }
2072
2073
2074 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2075 {
2076         struct wpa_connect_work *cwork = work->ctx;
2077         struct wpa_bss *bss = cwork->bss;
2078         struct wpa_ssid *ssid = cwork->ssid;
2079         struct wpa_supplicant *wpa_s = work->wpa_s;
2080         u8 wpa_ie[200];
2081         size_t wpa_ie_len;
2082         int use_crypt, ret, i, bssid_changed;
2083         int algs = WPA_AUTH_ALG_OPEN;
2084         unsigned int cipher_pairwise, cipher_group;
2085         struct wpa_driver_associate_params params;
2086         int wep_keys_set = 0;
2087         int assoc_failed = 0;
2088         struct wpa_ssid *old_ssid;
2089         u8 prev_bssid[ETH_ALEN];
2090 #ifdef CONFIG_HT_OVERRIDES
2091         struct ieee80211_ht_capabilities htcaps;
2092         struct ieee80211_ht_capabilities htcaps_mask;
2093 #endif /* CONFIG_HT_OVERRIDES */
2094 #ifdef CONFIG_VHT_OVERRIDES
2095        struct ieee80211_vht_capabilities vhtcaps;
2096        struct ieee80211_vht_capabilities vhtcaps_mask;
2097 #endif /* CONFIG_VHT_OVERRIDES */
2098 #ifdef CONFIG_MBO
2099         const u8 *mbo = NULL;
2100 #endif /* CONFIG_MBO */
2101
2102         if (deinit) {
2103                 if (work->started) {
2104                         wpa_s->connect_work = NULL;
2105
2106                         /* cancel possible auth. timeout */
2107                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2108                                              NULL);
2109                 }
2110                 wpas_connect_work_free(cwork);
2111                 return;
2112         }
2113
2114         wpa_s->connect_work = work;
2115
2116         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2117             wpas_network_disabled(wpa_s, ssid)) {
2118                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2119                 wpas_connect_work_done(wpa_s);
2120                 return;
2121         }
2122
2123         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2124         os_memset(&params, 0, sizeof(params));
2125         wpa_s->reassociate = 0;
2126         wpa_s->eap_expected_failure = 0;
2127         if (bss &&
2128             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2129 #ifdef CONFIG_IEEE80211R
2130                 const u8 *ie, *md = NULL;
2131 #endif /* CONFIG_IEEE80211R */
2132                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2133                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2134                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2135                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2136                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2137                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2138                 if (bssid_changed)
2139                         wpas_notify_bssid_changed(wpa_s);
2140 #ifdef CONFIG_IEEE80211R
2141                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2142                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2143                         md = ie + 2;
2144                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2145                 if (md) {
2146                         /* Prepare for the next transition */
2147                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2148                 }
2149 #endif /* CONFIG_IEEE80211R */
2150 #ifdef CONFIG_WPS
2151         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2152                    wpa_s->conf->ap_scan == 2 &&
2153                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2154                 /* Use ap_scan==1 style network selection to find the network
2155                  */
2156                 wpas_connect_work_done(wpa_s);
2157                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2158                 wpa_s->reassociate = 1;
2159                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2160                 return;
2161 #endif /* CONFIG_WPS */
2162         } else {
2163                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2164                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2165                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2166         }
2167         if (!wpa_s->pno)
2168                 wpa_supplicant_cancel_sched_scan(wpa_s);
2169
2170         wpa_supplicant_cancel_scan(wpa_s);
2171
2172         /* Starting new association, so clear the possibly used WPA IE from the
2173          * previous association. */
2174         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2175
2176 #ifdef IEEE8021X_EAPOL
2177         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2178                 if (ssid->leap) {
2179                         if (ssid->non_leap == 0)
2180                                 algs = WPA_AUTH_ALG_LEAP;
2181                         else
2182                                 algs |= WPA_AUTH_ALG_LEAP;
2183                 }
2184         }
2185 #endif /* IEEE8021X_EAPOL */
2186         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2187         if (ssid->auth_alg) {
2188                 algs = ssid->auth_alg;
2189                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2190                         "0x%x", algs);
2191         }
2192
2193         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2194                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2195             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2196                 int try_opportunistic;
2197                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2198                                      wpa_s->conf->okc :
2199                                      ssid->proactive_key_caching) &&
2200                         (ssid->proto & WPA_PROTO_RSN);
2201                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2202                                             ssid, try_opportunistic) == 0)
2203                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2204                 wpa_ie_len = sizeof(wpa_ie);
2205                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2206                                               wpa_ie, &wpa_ie_len)) {
2207                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2208                                 "key management and encryption suites");
2209                         wpas_connect_work_done(wpa_s);
2210                         return;
2211                 }
2212         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2213                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2214                 /*
2215                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2216                  * use non-WPA since the scan results did not indicate that the
2217                  * AP is using WPA or WPA2.
2218                  */
2219                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2220                 wpa_ie_len = 0;
2221                 wpa_s->wpa_proto = 0;
2222         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2223                 wpa_ie_len = sizeof(wpa_ie);
2224                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2225                                               wpa_ie, &wpa_ie_len)) {
2226                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2227                                 "key management and encryption suites (no "
2228                                 "scan results)");
2229                         wpas_connect_work_done(wpa_s);
2230                         return;
2231                 }
2232 #ifdef CONFIG_WPS
2233         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2234                 struct wpabuf *wps_ie;
2235                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2236                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2237                         wpa_ie_len = wpabuf_len(wps_ie);
2238                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2239                 } else
2240                         wpa_ie_len = 0;
2241                 wpabuf_free(wps_ie);
2242                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2243                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2244                         params.wps = WPS_MODE_PRIVACY;
2245                 else
2246                         params.wps = WPS_MODE_OPEN;
2247                 wpa_s->wpa_proto = 0;
2248 #endif /* CONFIG_WPS */
2249         } else {
2250                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2251                 wpa_ie_len = 0;
2252                 wpa_s->wpa_proto = 0;
2253         }
2254
2255 #ifdef CONFIG_P2P
2256         if (wpa_s->global->p2p) {
2257                 u8 *pos;
2258                 size_t len;
2259                 int res;
2260                 pos = wpa_ie + wpa_ie_len;
2261                 len = sizeof(wpa_ie) - wpa_ie_len;
2262                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2263                                             ssid->p2p_group);
2264                 if (res >= 0)
2265                         wpa_ie_len += res;
2266         }
2267
2268         wpa_s->cross_connect_disallowed = 0;
2269         if (bss) {
2270                 struct wpabuf *p2p;
2271                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2272                 if (p2p) {
2273                         wpa_s->cross_connect_disallowed =
2274                                 p2p_get_cross_connect_disallowed(p2p);
2275                         wpabuf_free(p2p);
2276                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2277                                 "connection",
2278                                 wpa_s->cross_connect_disallowed ?
2279                                 "disallows" : "allows");
2280                 }
2281         }
2282
2283         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2284 #endif /* CONFIG_P2P */
2285
2286 #ifdef CONFIG_MBO
2287         if (bss) {
2288                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2289                 if (mbo) {
2290                         int len;
2291
2292                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2293                                                         wpa_ie + wpa_ie_len,
2294                                                         sizeof(wpa_ie) -
2295                                                         wpa_ie_len);
2296                         if (len > 0)
2297                                 wpa_ie_len += len;
2298                 }
2299         }
2300 #endif /* CONFIG_MBO */
2301
2302         /*
2303          * Workaround: Add Extended Capabilities element only if the AP
2304          * included this element in Beacon/Probe Response frames. Some older
2305          * APs seem to have interoperability issues if this element is
2306          * included, so while the standard may require us to include the
2307          * element in all cases, it is justifiable to skip it to avoid
2308          * interoperability issues.
2309          */
2310         if (ssid->p2p_group)
2311                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
2312         else
2313                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
2314
2315         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2316                 u8 ext_capab[18];
2317                 int ext_capab_len;
2318                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2319                                                      sizeof(ext_capab));
2320                 if (ext_capab_len > 0) {
2321                         u8 *pos = wpa_ie;
2322                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2323                                 pos += 2 + pos[1];
2324                         os_memmove(pos + ext_capab_len, pos,
2325                                    wpa_ie_len - (pos - wpa_ie));
2326                         wpa_ie_len += ext_capab_len;
2327                         os_memcpy(pos, ext_capab, ext_capab_len);
2328                 }
2329         }
2330
2331 #ifdef CONFIG_HS20
2332         if (is_hs20_network(wpa_s, ssid, bss)) {
2333                 struct wpabuf *hs20;
2334
2335                 hs20 = wpabuf_alloc(20);
2336                 if (hs20) {
2337                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2338                         size_t len;
2339
2340                         wpas_hs20_add_indication(hs20, pps_mo_id);
2341                         len = sizeof(wpa_ie) - wpa_ie_len;
2342                         if (wpabuf_len(hs20) <= len) {
2343                                 os_memcpy(wpa_ie + wpa_ie_len,
2344                                           wpabuf_head(hs20), wpabuf_len(hs20));
2345                                 wpa_ie_len += wpabuf_len(hs20);
2346                         }
2347                         wpabuf_free(hs20);
2348
2349                         hs20_configure_frame_filters(wpa_s);
2350                 }
2351         }
2352 #endif /* CONFIG_HS20 */
2353
2354         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2355                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2356                 size_t len;
2357
2358                 len = sizeof(wpa_ie) - wpa_ie_len;
2359                 if (wpabuf_len(buf) <= len) {
2360                         os_memcpy(wpa_ie + wpa_ie_len,
2361                                   wpabuf_head(buf), wpabuf_len(buf));
2362                         wpa_ie_len += wpabuf_len(buf);
2363                 }
2364         }
2365
2366 #ifdef CONFIG_FST
2367         if (wpa_s->fst_ies) {
2368                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2369
2370                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2371                         os_memcpy(wpa_ie + wpa_ie_len,
2372                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2373                         wpa_ie_len += fst_ies_len;
2374                 }
2375         }
2376 #endif /* CONFIG_FST */
2377
2378 #ifdef CONFIG_MBO
2379         if (mbo) {
2380                 int len;
2381
2382                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2383                                   sizeof(wpa_ie) - wpa_ie_len);
2384                 if (len >= 0)
2385                         wpa_ie_len += len;
2386         }
2387 #endif /* CONFIG_MBO */
2388
2389         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2390         use_crypt = 1;
2391         cipher_pairwise = wpa_s->pairwise_cipher;
2392         cipher_group = wpa_s->group_cipher;
2393         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2394             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2395                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2396                         use_crypt = 0;
2397                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2398                         use_crypt = 1;
2399                         wep_keys_set = 1;
2400                 }
2401         }
2402         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2403                 use_crypt = 0;
2404
2405 #ifdef IEEE8021X_EAPOL
2406         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2407                 if ((ssid->eapol_flags &
2408                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2409                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2410                     !wep_keys_set) {
2411                         use_crypt = 0;
2412                 } else {
2413                         /* Assume that dynamic WEP-104 keys will be used and
2414                          * set cipher suites in order for drivers to expect
2415                          * encryption. */
2416                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2417                 }
2418         }
2419 #endif /* IEEE8021X_EAPOL */
2420
2421         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2422                 /* Set the key before (and later after) association */
2423                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2424         }
2425
2426         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2427         if (bss) {
2428                 params.ssid = bss->ssid;
2429                 params.ssid_len = bss->ssid_len;
2430                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2431                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2432                                    MACSTR " freq=%u MHz based on scan results "
2433                                    "(bssid_set=%d)",
2434                                    MAC2STR(bss->bssid), bss->freq,
2435                                    ssid->bssid_set);
2436                         params.bssid = bss->bssid;
2437                         params.freq.freq = bss->freq;
2438                 }
2439                 params.bssid_hint = bss->bssid;
2440                 params.freq_hint = bss->freq;
2441                 params.pbss = bss_is_pbss(bss);
2442         } else {
2443                 params.ssid = ssid->ssid;
2444                 params.ssid_len = ssid->ssid_len;
2445                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2446         }
2447
2448         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2449             wpa_s->conf->ap_scan == 2) {
2450                 params.bssid = ssid->bssid;
2451                 params.fixed_bssid = 1;
2452         }
2453
2454         /* Initial frequency for IBSS/mesh */
2455         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2456             ssid->frequency > 0 && params.freq.freq == 0)
2457                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2458
2459         if (ssid->mode == WPAS_MODE_IBSS) {
2460                 params.fixed_freq = ssid->fixed_freq;
2461                 if (ssid->beacon_int)
2462                         params.beacon_int = ssid->beacon_int;
2463                 else
2464                         params.beacon_int = wpa_s->conf->beacon_int;
2465         }
2466
2467         params.wpa_ie = wpa_ie;
2468         params.wpa_ie_len = wpa_ie_len;
2469         params.pairwise_suite = cipher_pairwise;
2470         params.group_suite = cipher_group;
2471         params.key_mgmt_suite = wpa_s->key_mgmt;
2472         params.wpa_proto = wpa_s->wpa_proto;
2473         params.auth_alg = algs;
2474         params.mode = ssid->mode;
2475         params.bg_scan_period = ssid->bg_scan_period;
2476         for (i = 0; i < NUM_WEP_KEYS; i++) {
2477                 if (ssid->wep_key_len[i])
2478                         params.wep_key[i] = ssid->wep_key[i];
2479                 params.wep_key_len[i] = ssid->wep_key_len[i];
2480         }
2481         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2482
2483         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2484             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2485              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2486                 params.passphrase = ssid->passphrase;
2487                 if (ssid->psk_set)
2488                         params.psk = ssid->psk;
2489         }
2490
2491         if (wpa_s->conf->key_mgmt_offload) {
2492                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2493                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2494                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2495                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2496                         params.req_key_mgmt_offload =
2497                                 ssid->proactive_key_caching < 0 ?
2498                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2499                 else
2500                         params.req_key_mgmt_offload = 1;
2501
2502                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2503                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2504                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2505                     ssid->psk_set)
2506                         params.psk = ssid->psk;
2507         }
2508
2509         params.drop_unencrypted = use_crypt;
2510
2511 #ifdef CONFIG_IEEE80211W
2512         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2513         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2514                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2515                 struct wpa_ie_data ie;
2516                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2517                     ie.capabilities &
2518                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2519                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2520                                 "MFP: require MFP");
2521                         params.mgmt_frame_protection =
2522                                 MGMT_FRAME_PROTECTION_REQUIRED;
2523                 }
2524         }
2525 #endif /* CONFIG_IEEE80211W */
2526
2527         params.p2p = ssid->p2p_group;
2528
2529         if (wpa_s->p2pdev->set_sta_uapsd)
2530                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2531         else
2532                 params.uapsd = -1;
2533
2534 #ifdef CONFIG_HT_OVERRIDES
2535         os_memset(&htcaps, 0, sizeof(htcaps));
2536         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2537         params.htcaps = (u8 *) &htcaps;
2538         params.htcaps_mask = (u8 *) &htcaps_mask;
2539         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2540 #endif /* CONFIG_HT_OVERRIDES */
2541 #ifdef CONFIG_VHT_OVERRIDES
2542         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2543         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2544         params.vhtcaps = &vhtcaps;
2545         params.vhtcaps_mask = &vhtcaps_mask;
2546         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2547 #endif /* CONFIG_VHT_OVERRIDES */
2548
2549 #ifdef CONFIG_P2P
2550         /*
2551          * If multi-channel concurrency is not supported, check for any
2552          * frequency conflict. In case of any frequency conflict, remove the
2553          * least prioritized connection.
2554          */
2555         if (wpa_s->num_multichan_concurrent < 2) {
2556                 int freq, num;
2557                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2558                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2559                         wpa_printf(MSG_DEBUG,
2560                                    "Assoc conflicting freq found (%d != %d)",
2561                                    freq, params.freq.freq);
2562                         if (wpas_p2p_handle_frequency_conflicts(
2563                                     wpa_s, params.freq.freq, ssid) < 0) {
2564                                 wpas_connect_work_done(wpa_s);
2565                                 return;
2566                         }
2567                 }
2568         }
2569 #endif /* CONFIG_P2P */
2570
2571         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2572             wpa_s->current_ssid)
2573                 params.prev_bssid = prev_bssid;
2574
2575         ret = wpa_drv_associate(wpa_s, &params);
2576         if (ret < 0) {
2577                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2578                         "failed");
2579                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2580                         /*
2581                          * The driver is known to mean what is saying, so we
2582                          * can stop right here; the association will not
2583                          * succeed.
2584                          */
2585                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2586                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2587                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2588                         return;
2589                 }
2590                 /* try to continue anyway; new association will be tried again
2591                  * after timeout */
2592                 assoc_failed = 1;
2593         }
2594
2595         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2596                 /* Set the key after the association just in case association
2597                  * cleared the previously configured key. */
2598                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2599                 /* No need to timeout authentication since there is no key
2600                  * management. */
2601                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2602                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2603 #ifdef CONFIG_IBSS_RSN
2604         } else if (ssid->mode == WPAS_MODE_IBSS &&
2605                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2606                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2607                 /*
2608                  * RSN IBSS authentication is per-STA and we can disable the
2609                  * per-BSSID authentication.
2610                  */
2611                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2612 #endif /* CONFIG_IBSS_RSN */
2613         } else {
2614                 /* Timeout for IEEE 802.11 authentication and association */
2615                 int timeout = 60;
2616
2617                 if (assoc_failed) {
2618                         /* give IBSS a bit more time */
2619                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2620                 } else if (wpa_s->conf->ap_scan == 1) {
2621                         /* give IBSS a bit more time */
2622                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2623                 }
2624                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2625         }
2626
2627         if (wep_keys_set &&
2628             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2629                 /* Set static WEP keys again */
2630                 wpa_set_wep_keys(wpa_s, ssid);
2631         }
2632
2633         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2634                 /*
2635                  * Do not allow EAP session resumption between different
2636                  * network configurations.
2637                  */
2638                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2639         }
2640         old_ssid = wpa_s->current_ssid;
2641         wpa_s->current_ssid = ssid;
2642
2643         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2644                 wpa_s->current_bss = bss;
2645 #ifdef CONFIG_HS20
2646                 hs20_configure_frame_filters(wpa_s);
2647 #endif /* CONFIG_HS20 */
2648         }
2649
2650         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2651         wpa_supplicant_initiate_eapol(wpa_s);
2652         if (old_ssid != wpa_s->current_ssid)
2653                 wpas_notify_network_changed(wpa_s);
2654 }
2655
2656
2657 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2658                                             const u8 *addr)
2659 {
2660         struct wpa_ssid *old_ssid;
2661
2662         wpas_connect_work_done(wpa_s);
2663         wpa_clear_keys(wpa_s, addr);
2664         old_ssid = wpa_s->current_ssid;
2665         wpa_supplicant_mark_disassoc(wpa_s);
2666         wpa_sm_set_config(wpa_s->wpa, NULL);
2667         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2668         if (old_ssid != wpa_s->current_ssid)
2669                 wpas_notify_network_changed(wpa_s);
2670         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2671 }
2672
2673
2674 /**
2675  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2676  * @wpa_s: Pointer to wpa_supplicant data
2677  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2678  *
2679  * This function is used to request %wpa_supplicant to deauthenticate from the
2680  * current AP.
2681  */
2682 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2683                                    int reason_code)
2684 {
2685         u8 *addr = NULL;
2686         union wpa_event_data event;
2687         int zero_addr = 0;
2688
2689         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2690                 " pending_bssid=" MACSTR " reason=%d state=%s",
2691                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2692                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2693
2694         if (!is_zero_ether_addr(wpa_s->bssid))
2695                 addr = wpa_s->bssid;
2696         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2697                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2698                   wpa_s->wpa_state == WPA_ASSOCIATING))
2699                 addr = wpa_s->pending_bssid;
2700         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2701                 /*
2702                  * When using driver-based BSS selection, we may not know the
2703                  * BSSID with which we are currently trying to associate. We
2704                  * need to notify the driver of this disconnection even in such
2705                  * a case, so use the all zeros address here.
2706                  */
2707                 addr = wpa_s->bssid;
2708                 zero_addr = 1;
2709         }
2710
2711 #ifdef CONFIG_TDLS
2712         wpa_tdls_teardown_peers(wpa_s->wpa);
2713 #endif /* CONFIG_TDLS */
2714
2715 #ifdef CONFIG_MESH
2716         if (wpa_s->ifmsh) {
2717                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2718                         wpa_s->ifname);
2719                 wpa_supplicant_leave_mesh(wpa_s);
2720         }
2721 #endif /* CONFIG_MESH */
2722
2723         if (addr) {
2724                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2725                 os_memset(&event, 0, sizeof(event));
2726                 event.deauth_info.reason_code = (u16) reason_code;
2727                 event.deauth_info.locally_generated = 1;
2728                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2729                 if (zero_addr)
2730                         addr = NULL;
2731         }
2732
2733         wpa_supplicant_clear_connection(wpa_s, addr);
2734 }
2735
2736 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2737                                               struct wpa_ssid *ssid)
2738 {
2739         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2740                 return;
2741
2742         ssid->disabled = 0;
2743         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2744         wpas_notify_network_enabled_changed(wpa_s, ssid);
2745
2746         /*
2747          * Try to reassociate since there is no current configuration and a new
2748          * network was made available.
2749          */
2750         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2751                 wpa_s->reassociate = 1;
2752 }
2753
2754
2755 /**
2756  * wpa_supplicant_enable_network - Mark a configured network as enabled
2757  * @wpa_s: wpa_supplicant structure for a network interface
2758  * @ssid: wpa_ssid structure for a configured network or %NULL
2759  *
2760  * Enables the specified network or all networks if no network specified.
2761  */
2762 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2763                                    struct wpa_ssid *ssid)
2764 {
2765         if (ssid == NULL) {
2766                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2767                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2768         } else
2769                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2770
2771         if (wpa_s->reassociate && !wpa_s->disconnected &&
2772             (!wpa_s->current_ssid ||
2773              wpa_s->wpa_state == WPA_DISCONNECTED ||
2774              wpa_s->wpa_state == WPA_SCANNING)) {
2775                 if (wpa_s->sched_scanning) {
2776                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2777                                    "new network to scan filters");
2778                         wpa_supplicant_cancel_sched_scan(wpa_s);
2779                 }
2780
2781                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2782                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2783                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2784                 }
2785         }
2786 }
2787
2788
2789 /**
2790  * wpa_supplicant_disable_network - Mark a configured network as disabled
2791  * @wpa_s: wpa_supplicant structure for a network interface
2792  * @ssid: wpa_ssid structure for a configured network or %NULL
2793  *
2794  * Disables the specified network or all networks if no network specified.
2795  */
2796 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2797                                     struct wpa_ssid *ssid)
2798 {
2799         struct wpa_ssid *other_ssid;
2800         int was_disabled;
2801
2802         if (ssid == NULL) {
2803                 if (wpa_s->sched_scanning)
2804                         wpa_supplicant_cancel_sched_scan(wpa_s);
2805
2806                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2807                      other_ssid = other_ssid->next) {
2808                         was_disabled = other_ssid->disabled;
2809                         if (was_disabled == 2)
2810                                 continue; /* do not change persistent P2P group
2811                                            * data */
2812
2813                         other_ssid->disabled = 1;
2814
2815                         if (was_disabled != other_ssid->disabled)
2816                                 wpas_notify_network_enabled_changed(
2817                                         wpa_s, other_ssid);
2818                 }
2819                 if (wpa_s->current_ssid)
2820                         wpa_supplicant_deauthenticate(
2821                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2822         } else if (ssid->disabled != 2) {
2823                 if (ssid == wpa_s->current_ssid)
2824                         wpa_supplicant_deauthenticate(
2825                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2826
2827                 was_disabled = ssid->disabled;
2828
2829                 ssid->disabled = 1;
2830
2831                 if (was_disabled != ssid->disabled) {
2832                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2833                         if (wpa_s->sched_scanning) {
2834                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2835                                            "to remove network from filters");
2836                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2837                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2838                         }
2839                 }
2840         }
2841 }
2842
2843
2844 /**
2845  * wpa_supplicant_select_network - Attempt association with a network
2846  * @wpa_s: wpa_supplicant structure for a network interface
2847  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2848  */
2849 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2850                                    struct wpa_ssid *ssid)
2851 {
2852
2853         struct wpa_ssid *other_ssid;
2854         int disconnected = 0;
2855
2856         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2857                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2858                         wpa_s->own_disconnect_req = 1;
2859                 wpa_supplicant_deauthenticate(
2860                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2861                 disconnected = 1;
2862         }
2863
2864         if (ssid)
2865                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2866
2867         /*
2868          * Mark all other networks disabled or mark all networks enabled if no
2869          * network specified.
2870          */
2871         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2872              other_ssid = other_ssid->next) {
2873                 int was_disabled = other_ssid->disabled;
2874                 if (was_disabled == 2)
2875                         continue; /* do not change persistent P2P group data */
2876
2877                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2878                 if (was_disabled && !other_ssid->disabled)
2879                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2880
2881                 if (was_disabled != other_ssid->disabled)
2882                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2883         }
2884
2885         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2886             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2887                 /* We are already associated with the selected network */
2888                 wpa_printf(MSG_DEBUG, "Already associated with the "
2889                            "selected network - do nothing");
2890                 return;
2891         }
2892
2893         if (ssid) {
2894                 wpa_s->current_ssid = ssid;
2895                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2896                 wpa_s->connect_without_scan =
2897                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2898
2899                 /*
2900                  * Don't optimize next scan freqs since a new ESS has been
2901                  * selected.
2902                  */
2903                 os_free(wpa_s->next_scan_freqs);
2904                 wpa_s->next_scan_freqs = NULL;
2905         } else {
2906                 wpa_s->connect_without_scan = NULL;
2907         }
2908
2909         wpa_s->disconnected = 0;
2910         wpa_s->reassociate = 1;
2911
2912         if (wpa_s->connect_without_scan ||
2913             wpa_supplicant_fast_associate(wpa_s) != 1) {
2914                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2915                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2916         }
2917
2918         if (ssid)
2919                 wpas_notify_network_selected(wpa_s, ssid);
2920 }
2921
2922
2923 /**
2924  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2925  * @wpa_s: wpa_supplicant structure for a network interface
2926  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2927  * @pkcs11_module_path: PKCS #11 module path or NULL
2928  * Returns: 0 on success; -1 on failure
2929  *
2930  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2931  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2932  * module path fails the paths will be reset to the default value (NULL).
2933  */
2934 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2935                                            const char *pkcs11_engine_path,
2936                                            const char *pkcs11_module_path)
2937 {
2938         char *pkcs11_engine_path_copy = NULL;
2939         char *pkcs11_module_path_copy = NULL;
2940
2941         if (pkcs11_engine_path != NULL) {
2942                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2943                 if (pkcs11_engine_path_copy == NULL)
2944                         return -1;
2945         }
2946         if (pkcs11_module_path != NULL) {
2947                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2948                 if (pkcs11_module_path_copy == NULL) {
2949                         os_free(pkcs11_engine_path_copy);
2950                         return -1;
2951                 }
2952         }
2953
2954         os_free(wpa_s->conf->pkcs11_engine_path);
2955         os_free(wpa_s->conf->pkcs11_module_path);
2956         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2957         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2958
2959         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2960         eapol_sm_deinit(wpa_s->eapol);
2961         wpa_s->eapol = NULL;
2962         if (wpa_supplicant_init_eapol(wpa_s)) {
2963                 /* Error -> Reset paths to the default value (NULL) once. */
2964                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2965                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2966                                                                NULL);
2967
2968                 return -1;
2969         }
2970         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2971
2972         return 0;
2973 }
2974
2975
2976 /**
2977  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2978  * @wpa_s: wpa_supplicant structure for a network interface
2979  * @ap_scan: AP scan mode
2980  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2981  *
2982  */
2983 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2984 {
2985
2986         int old_ap_scan;
2987
2988         if (ap_scan < 0 || ap_scan > 2)
2989                 return -1;
2990
2991         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2992                 wpa_printf(MSG_INFO,
2993                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2994         }
2995
2996 #ifdef ANDROID
2997         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2998             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2999             wpa_s->wpa_state < WPA_COMPLETED) {
3000                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
3001                            "associating", wpa_s->conf->ap_scan, ap_scan);
3002                 return 0;
3003         }
3004 #endif /* ANDROID */
3005
3006         old_ap_scan = wpa_s->conf->ap_scan;
3007         wpa_s->conf->ap_scan = ap_scan;
3008
3009         if (old_ap_scan != wpa_s->conf->ap_scan)
3010                 wpas_notify_ap_scan_changed(wpa_s);
3011
3012         return 0;
3013 }
3014
3015
3016 /**
3017  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
3018  * @wpa_s: wpa_supplicant structure for a network interface
3019  * @expire_age: Expiration age in seconds
3020  * Returns: 0 if succeed or -1 if expire_age has an invalid value
3021  *
3022  */
3023 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3024                                           unsigned int bss_expire_age)
3025 {
3026         if (bss_expire_age < 10) {
3027                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3028                         bss_expire_age);
3029                 return -1;
3030         }
3031         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3032                 bss_expire_age);
3033         wpa_s->conf->bss_expiration_age = bss_expire_age;
3034
3035         return 0;
3036 }
3037
3038
3039 /**
3040  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3041  * @wpa_s: wpa_supplicant structure for a network interface
3042  * @expire_count: number of scans after which an unseen BSS is reclaimed
3043  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3044  *
3045  */
3046 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3047                                             unsigned int bss_expire_count)
3048 {
3049         if (bss_expire_count < 1) {
3050                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3051                         bss_expire_count);
3052                 return -1;
3053         }
3054         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3055                 bss_expire_count);
3056         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3057
3058         return 0;
3059 }
3060
3061
3062 /**
3063  * wpa_supplicant_set_scan_interval - Set scan interval
3064  * @wpa_s: wpa_supplicant structure for a network interface
3065  * @scan_interval: scan interval in seconds
3066  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3067  *
3068  */
3069 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3070                                      int scan_interval)
3071 {
3072         if (scan_interval < 0) {
3073                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3074                         scan_interval);
3075                 return -1;
3076         }
3077         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3078                 scan_interval);
3079         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3080
3081         return 0;
3082 }
3083
3084
3085 /**
3086  * wpa_supplicant_set_debug_params - Set global debug params
3087  * @global: wpa_global structure
3088  * @debug_level: debug level
3089  * @debug_timestamp: determines if show timestamp in debug data
3090  * @debug_show_keys: determines if show keys in debug data
3091  * Returns: 0 if succeed or -1 if debug_level has wrong value
3092  */
3093 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3094                                     int debug_timestamp, int debug_show_keys)
3095 {
3096
3097         int old_level, old_timestamp, old_show_keys;
3098
3099         /* check for allowed debuglevels */
3100         if (debug_level != MSG_EXCESSIVE &&
3101             debug_level != MSG_MSGDUMP &&
3102             debug_level != MSG_DEBUG &&
3103             debug_level != MSG_INFO &&
3104             debug_level != MSG_WARNING &&
3105             debug_level != MSG_ERROR)
3106                 return -1;
3107
3108         old_level = wpa_debug_level;
3109         old_timestamp = wpa_debug_timestamp;
3110         old_show_keys = wpa_debug_show_keys;
3111
3112         wpa_debug_level = debug_level;
3113         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3114         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3115
3116         if (wpa_debug_level != old_level)
3117                 wpas_notify_debug_level_changed(global);
3118         if (wpa_debug_timestamp != old_timestamp)
3119                 wpas_notify_debug_timestamp_changed(global);
3120         if (wpa_debug_show_keys != old_show_keys)
3121                 wpas_notify_debug_show_keys_changed(global);
3122
3123         return 0;
3124 }
3125
3126
3127 /**
3128  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3129  * @wpa_s: Pointer to wpa_supplicant data
3130  * Returns: A pointer to the current network structure or %NULL on failure
3131  */
3132 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3133 {
3134         struct wpa_ssid *entry;
3135         u8 ssid[SSID_MAX_LEN];
3136         int res;
3137         size_t ssid_len;
3138         u8 bssid[ETH_ALEN];
3139         int wired;
3140
3141         res = wpa_drv_get_ssid(wpa_s, ssid);
3142         if (res < 0) {
3143                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3144                         "driver");
3145                 return NULL;
3146         }
3147         ssid_len = res;
3148
3149         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3150                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3151                         "driver");
3152                 return NULL;
3153         }
3154
3155         wired = wpa_s->conf->ap_scan == 0 &&
3156                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3157
3158         entry = wpa_s->conf->ssid;
3159         while (entry) {
3160                 if (!wpas_network_disabled(wpa_s, entry) &&
3161                     ((ssid_len == entry->ssid_len &&
3162                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3163                     (!entry->bssid_set ||
3164                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3165                         return entry;
3166 #ifdef CONFIG_WPS
3167                 if (!wpas_network_disabled(wpa_s, entry) &&
3168                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3169                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3170                     (!entry->bssid_set ||
3171                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3172                         return entry;
3173 #endif /* CONFIG_WPS */
3174
3175                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3176                     entry->ssid_len == 0 &&
3177                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3178                         return entry;
3179
3180                 entry = entry->next;
3181         }
3182
3183         return NULL;
3184 }
3185
3186
3187 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3188 {
3189         struct wpa_global *global = wpa_s->global;
3190
3191         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3192                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3193                 if (global->drv_priv[i] == NULL) {
3194                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3195                                    "'%s'", wpa_drivers[i]->name);
3196                         return -1;
3197                 }
3198         }
3199
3200         wpa_s->driver = wpa_drivers[i];
3201         wpa_s->global_drv_priv = global->drv_priv[i];
3202
3203         return 0;
3204 }
3205
3206
3207 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3208                                      const char *name)
3209 {
3210         int i;
3211         size_t len;
3212         const char *pos, *driver = name;
3213
3214         if (wpa_s == NULL)
3215                 return -1;
3216
3217         if (wpa_drivers[0] == NULL) {
3218                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3219                         "wpa_supplicant");
3220                 return -1;
3221         }
3222
3223         if (name == NULL) {
3224                 /* default to first driver in the list */
3225                 return select_driver(wpa_s, 0);
3226         }
3227
3228         do {
3229                 pos = os_strchr(driver, ',');
3230                 if (pos)
3231                         len = pos - driver;
3232                 else
3233                         len = os_strlen(driver);
3234
3235                 for (i = 0; wpa_drivers[i]; i++) {
3236                         if (os_strlen(wpa_drivers[i]->name) == len &&
3237                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3238                             0) {
3239                                 /* First driver that succeeds wins */
3240                                 if (select_driver(wpa_s, i) == 0)
3241                                         return 0;
3242                         }
3243                 }
3244
3245                 driver = pos + 1;
3246         } while (pos);
3247
3248         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3249         return -1;
3250 }
3251
3252
3253 /**
3254  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3255  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3256  *      with struct wpa_driver_ops::init()
3257  * @src_addr: Source address of the EAPOL frame
3258  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3259  * @len: Length of the EAPOL data
3260  *
3261  * This function is called for each received EAPOL frame. Most driver
3262  * interfaces rely on more generic OS mechanism for receiving frames through
3263  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3264  * take care of received EAPOL frames and deliver them to the core supplicant
3265  * code by calling this function.
3266  */
3267 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3268                              const u8 *buf, size_t len)
3269 {
3270         struct wpa_supplicant *wpa_s = ctx;
3271
3272         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3273         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3274
3275 #ifdef CONFIG_PEERKEY
3276         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3277             wpa_s->current_ssid->peerkey &&
3278             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3279             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3280                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3281                 return;
3282         }
3283 #endif /* CONFIG_PEERKEY */
3284
3285         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3286             (wpa_s->last_eapol_matches_bssid &&
3287 #ifdef CONFIG_AP
3288              !wpa_s->ap_iface &&
3289 #endif /* CONFIG_AP */
3290              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3291                 /*
3292                  * There is possible race condition between receiving the
3293                  * association event and the EAPOL frame since they are coming
3294                  * through different paths from the driver. In order to avoid
3295                  * issues in trying to process the EAPOL frame before receiving
3296                  * association information, lets queue it for processing until
3297                  * the association event is received. This may also be needed in
3298                  * driver-based roaming case, so also use src_addr != BSSID as a
3299                  * trigger if we have previously confirmed that the
3300                  * Authenticator uses BSSID as the src_addr (which is not the
3301                  * case with wired IEEE 802.1X).
3302                  */
3303                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3304                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3305                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3306                         MAC2STR(wpa_s->bssid));
3307                 wpabuf_free(wpa_s->pending_eapol_rx);
3308                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3309                 if (wpa_s->pending_eapol_rx) {
3310                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3311                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3312                                   ETH_ALEN);
3313                 }
3314                 return;
3315         }
3316
3317         wpa_s->last_eapol_matches_bssid =
3318                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3319
3320 #ifdef CONFIG_AP
3321         if (wpa_s->ap_iface) {
3322                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3323                 return;
3324         }
3325 #endif /* CONFIG_AP */
3326
3327         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3328                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3329                         "no key management is configured");
3330                 return;
3331         }
3332
3333         if (wpa_s->eapol_received == 0 &&
3334             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3335              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3336              wpa_s->wpa_state != WPA_COMPLETED) &&
3337             (wpa_s->current_ssid == NULL ||
3338              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3339                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3340                 int timeout = 10;
3341
3342                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3343                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3344                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3345                         /* Use longer timeout for IEEE 802.1X/EAP */
3346                         timeout = 70;
3347                 }
3348
3349 #ifdef CONFIG_WPS
3350                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3351                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3352                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3353                         /*
3354                          * Use shorter timeout if going through WPS AP iteration
3355                          * for PIN config method with an AP that does not
3356                          * advertise Selected Registrar.
3357                          */
3358                         struct wpabuf *wps_ie;
3359
3360                         wps_ie = wpa_bss_get_vendor_ie_multi(
3361                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3362                         if (wps_ie &&
3363                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3364                                 timeout = 10;
3365                         wpabuf_free(wps_ie);
3366                 }
3367 #endif /* CONFIG_WPS */
3368
3369                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3370         }
3371         wpa_s->eapol_received++;
3372
3373         if (wpa_s->countermeasures) {
3374                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3375                         "EAPOL packet");
3376                 return;
3377         }
3378
3379 #ifdef CONFIG_IBSS_RSN
3380         if (wpa_s->current_ssid &&
3381             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3382                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3383                 return;
3384         }
3385 #endif /* CONFIG_IBSS_RSN */
3386
3387         /* Source address of the incoming EAPOL frame could be compared to the
3388          * current BSSID. However, it is possible that a centralized
3389          * Authenticator could be using another MAC address than the BSSID of
3390          * an AP, so just allow any address to be used for now. The replies are
3391          * still sent to the current BSSID (if available), though. */
3392
3393         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3394         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3395             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3396                 return;
3397         wpa_drv_poll(wpa_s);
3398         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3399                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3400         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3401                 /*
3402                  * Set portValid = TRUE here since we are going to skip 4-way
3403                  * handshake processing which would normally set portValid. We
3404                  * need this to allow the EAPOL state machines to be completed
3405                  * without going through EAPOL-Key handshake.
3406                  */
3407                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3408         }
3409 }
3410
3411
3412 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3413 {
3414         if ((!wpa_s->p2p_mgmt ||
3415              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3416             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3417                 l2_packet_deinit(wpa_s->l2);
3418                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3419                                            wpa_drv_get_mac_addr(wpa_s),
3420                                            ETH_P_EAPOL,
3421                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3422                 if (wpa_s->l2 == NULL)
3423                         return -1;
3424         } else {
3425                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3426                 if (addr)
3427                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3428         }
3429
3430         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3431                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3432                 return -1;
3433         }
3434
3435         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3436
3437         return 0;
3438 }
3439
3440
3441 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3442                                            const u8 *buf, size_t len)
3443 {
3444         struct wpa_supplicant *wpa_s = ctx;
3445         const struct l2_ethhdr *eth;
3446
3447         if (len < sizeof(*eth))
3448                 return;
3449         eth = (const struct l2_ethhdr *) buf;
3450
3451         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3452             !(eth->h_dest[0] & 0x01)) {
3453                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3454                         " (bridge - not for this interface - ignore)",
3455                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3456                 return;
3457         }
3458
3459         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3460                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3461         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3462                                 len - sizeof(*eth));
3463 }
3464
3465
3466 /**
3467  * wpa_supplicant_driver_init - Initialize driver interface parameters
3468  * @wpa_s: Pointer to wpa_supplicant data
3469  * Returns: 0 on success, -1 on failure
3470  *
3471  * This function is called to initialize driver interface parameters.
3472  * wpa_drv_init() must have been called before this function to initialize the
3473  * driver interface.
3474  */
3475 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3476 {
3477         static int interface_count = 0;
3478
3479         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3480                 return -1;
3481
3482         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3483                 MAC2STR(wpa_s->own_addr));
3484         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3485         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3486
3487         if (wpa_s->bridge_ifname[0]) {
3488                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3489                         "interface '%s'", wpa_s->bridge_ifname);
3490                 wpa_s->l2_br = l2_packet_init_bridge(
3491                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3492                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3493                 if (wpa_s->l2_br == NULL) {
3494                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3495                                 "connection for the bridge interface '%s'",
3496                                 wpa_s->bridge_ifname);
3497                         return -1;
3498                 }
3499         }
3500
3501         if (wpa_s->conf->ap_scan == 2 &&
3502             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3503                 wpa_printf(MSG_INFO,
3504                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3505         }
3506
3507         wpa_clear_keys(wpa_s, NULL);
3508
3509         /* Make sure that TKIP countermeasures are not left enabled (could
3510          * happen if wpa_supplicant is killed during countermeasures. */
3511         wpa_drv_set_countermeasures(wpa_s, 0);
3512
3513         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3514         wpa_drv_flush_pmkid(wpa_s);
3515
3516         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3517         wpa_s->prev_scan_wildcard = 0;
3518
3519         if (wpa_supplicant_enabled_networks(wpa_s)) {
3520                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3521                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3522                         interface_count = 0;
3523                 }
3524 #ifndef ANDROID
3525                 if (!wpa_s->p2p_mgmt &&
3526                     wpa_supplicant_delayed_sched_scan(wpa_s,
3527                                                       interface_count % 3,
3528                                                       100000))
3529                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3530                                                 100000);
3531 #endif /* ANDROID */
3532                 interface_count++;
3533         } else
3534                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3535
3536         return 0;
3537 }
3538
3539
3540 static int wpa_supplicant_daemon(const char *pid_file)
3541 {
3542         wpa_printf(MSG_DEBUG, "Daemonize..");
3543         return os_daemonize(pid_file);
3544 }
3545
3546
3547 static struct wpa_supplicant *
3548 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3549 {
3550         struct wpa_supplicant *wpa_s;
3551
3552         wpa_s = os_zalloc(sizeof(*wpa_s));
3553         if (wpa_s == NULL)
3554                 return NULL;
3555         wpa_s->scan_req = INITIAL_SCAN_REQ;
3556         wpa_s->scan_interval = 5;
3557         wpa_s->new_connection = 1;
3558         wpa_s->parent = parent ? parent : wpa_s;
3559         wpa_s->p2pdev = wpa_s->parent;
3560         wpa_s->sched_scanning = 0;
3561
3562         dl_list_init(&wpa_s->bss_tmp_disallowed);
3563
3564         return wpa_s;
3565 }
3566
3567
3568 #ifdef CONFIG_HT_OVERRIDES
3569
3570 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3571                              struct ieee80211_ht_capabilities *htcaps,
3572                              struct ieee80211_ht_capabilities *htcaps_mask,
3573                              const char *ht_mcs)
3574 {
3575         /* parse ht_mcs into hex array */
3576         int i;
3577         const char *tmp = ht_mcs;
3578         char *end = NULL;
3579
3580         /* If ht_mcs is null, do not set anything */
3581         if (!ht_mcs)
3582                 return 0;
3583
3584         /* This is what we are setting in the kernel */
3585         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3586
3587         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3588
3589         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3590                 errno = 0;
3591                 long v = strtol(tmp, &end, 16);
3592                 if (errno == 0) {
3593                         wpa_msg(wpa_s, MSG_DEBUG,
3594                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3595                                 i, v, end, tmp);
3596                         if (end == tmp)
3597                                 break;
3598
3599                         htcaps->supported_mcs_set[i] = v;
3600                         tmp = end;
3601                 } else {
3602                         wpa_msg(wpa_s, MSG_ERROR,
3603                                 "Failed to parse ht-mcs: %s, error: %s\n",
3604                                 ht_mcs, strerror(errno));
3605                         return -1;
3606                 }
3607         }
3608
3609         /*
3610          * If we were able to parse any values, then set mask for the MCS set.
3611          */
3612         if (i) {
3613                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3614                           IEEE80211_HT_MCS_MASK_LEN - 1);
3615                 /* skip the 3 reserved bits */
3616                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3617                         0x1f;
3618         }
3619
3620         return 0;
3621 }
3622
3623
3624 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3625                                  struct ieee80211_ht_capabilities *htcaps,
3626                                  struct ieee80211_ht_capabilities *htcaps_mask,
3627                                  int disabled)
3628 {
3629         le16 msk;
3630
3631         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3632
3633         if (disabled == -1)
3634                 return 0;
3635
3636         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3637         htcaps_mask->ht_capabilities_info |= msk;
3638         if (disabled)
3639                 htcaps->ht_capabilities_info &= msk;
3640         else
3641                 htcaps->ht_capabilities_info |= msk;
3642
3643         return 0;
3644 }
3645
3646
3647 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3648                                 struct ieee80211_ht_capabilities *htcaps,
3649                                 struct ieee80211_ht_capabilities *htcaps_mask,
3650                                 int factor)
3651 {
3652         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3653
3654         if (factor == -1)
3655                 return 0;
3656
3657         if (factor < 0 || factor > 3) {
3658                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3659                         "Must be 0-3 or -1", factor);
3660                 return -EINVAL;
3661         }
3662
3663         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3664         htcaps->a_mpdu_params &= ~0x3;
3665         htcaps->a_mpdu_params |= factor & 0x3;
3666
3667         return 0;
3668 }
3669
3670
3671 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3672                                  struct ieee80211_ht_capabilities *htcaps,
3673                                  struct ieee80211_ht_capabilities *htcaps_mask,
3674                                  int density)
3675 {
3676         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3677
3678         if (density == -1)
3679                 return 0;
3680
3681         if (density < 0 || density > 7) {
3682                 wpa_msg(wpa_s, MSG_ERROR,
3683                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3684                         density);
3685                 return -EINVAL;
3686         }
3687
3688         htcaps_mask->a_mpdu_params |= 0x1C;
3689         htcaps->a_mpdu_params &= ~(0x1C);
3690         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3691
3692         return 0;
3693 }
3694
3695
3696 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3697                                 struct ieee80211_ht_capabilities *htcaps,
3698                                 struct ieee80211_ht_capabilities *htcaps_mask,
3699                                 int disabled)
3700 {
3701         /* Masking these out disables HT40 */
3702         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3703                                 HT_CAP_INFO_SHORT_GI40MHZ);
3704
3705         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3706
3707         if (disabled)
3708                 htcaps->ht_capabilities_info &= ~msk;
3709         else
3710                 htcaps->ht_capabilities_info |= msk;
3711
3712         htcaps_mask->ht_capabilities_info |= msk;
3713
3714         return 0;
3715 }
3716
3717
3718 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3719                                struct ieee80211_ht_capabilities *htcaps,
3720                                struct ieee80211_ht_capabilities *htcaps_mask,
3721                                int disabled)
3722 {
3723         /* Masking these out disables SGI */
3724         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3725                                 HT_CAP_INFO_SHORT_GI40MHZ);
3726
3727         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3728
3729         if (disabled)
3730                 htcaps->ht_capabilities_info &= ~msk;
3731         else
3732                 htcaps->ht_capabilities_info |= msk;
3733
3734         htcaps_mask->ht_capabilities_info |= msk;
3735
3736         return 0;
3737 }
3738
3739
3740 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3741                                struct ieee80211_ht_capabilities *htcaps,
3742                                struct ieee80211_ht_capabilities *htcaps_mask,
3743                                int disabled)
3744 {
3745         /* Masking these out disables LDPC */
3746         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3747
3748         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3749
3750         if (disabled)
3751                 htcaps->ht_capabilities_info &= ~msk;
3752         else
3753                 htcaps->ht_capabilities_info |= msk;
3754
3755         htcaps_mask->ht_capabilities_info |= msk;
3756
3757         return 0;
3758 }
3759
3760
3761 void wpa_supplicant_apply_ht_overrides(
3762         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3763         struct wpa_driver_associate_params *params)
3764 {
3765         struct ieee80211_ht_capabilities *htcaps;
3766         struct ieee80211_ht_capabilities *htcaps_mask;
3767
3768         if (!ssid)
3769                 return;
3770
3771         params->disable_ht = ssid->disable_ht;
3772         if (!params->htcaps || !params->htcaps_mask)
3773                 return;
3774
3775         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3776         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3777         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3778         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3779                               ssid->disable_max_amsdu);
3780         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3781         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3782         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3783         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3784         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3785
3786         if (ssid->ht40_intolerant) {
3787                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3788                 htcaps->ht_capabilities_info |= bit;
3789                 htcaps_mask->ht_capabilities_info |= bit;
3790         }
3791 }
3792
3793 #endif /* CONFIG_HT_OVERRIDES */
3794
3795
3796 #ifdef CONFIG_VHT_OVERRIDES
3797 void wpa_supplicant_apply_vht_overrides(
3798         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3799         struct wpa_driver_associate_params *params)
3800 {
3801         struct ieee80211_vht_capabilities *vhtcaps;
3802         struct ieee80211_vht_capabilities *vhtcaps_mask;
3803
3804         if (!ssid)
3805                 return;
3806
3807         params->disable_vht = ssid->disable_vht;
3808
3809         vhtcaps = (void *) params->vhtcaps;
3810         vhtcaps_mask = (void *) params->vhtcaps_mask;
3811
3812         if (!vhtcaps || !vhtcaps_mask)
3813                 return;
3814
3815         vhtcaps->vht_capabilities_info = host_to_le32(ssid->vht_capa);
3816         vhtcaps_mask->vht_capabilities_info = host_to_le32(ssid->vht_capa_mask);
3817
3818 #ifdef CONFIG_HT_OVERRIDES
3819         /* if max ampdu is <= 3, we have to make the HT cap the same */
3820         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3821                 int max_ampdu;
3822
3823                 max_ampdu = (ssid->vht_capa &
3824                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3825                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3826
3827                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3828                 wpa_set_ampdu_factor(wpa_s,
3829                                      (void *) params->htcaps,
3830                                      (void *) params->htcaps_mask,
3831                                      max_ampdu);
3832         }
3833 #endif /* CONFIG_HT_OVERRIDES */
3834
3835 #define OVERRIDE_MCS(i)                                                 \
3836         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3837                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3838                         host_to_le16(3 << 2 * (i - 1));                 \
3839                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3840                         host_to_le16(ssid->vht_tx_mcs_nss_ ##i <<       \
3841                                      2 * (i - 1));                      \
3842         }                                                               \
3843         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3844                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3845                         host_to_le16(3 << 2 * (i - 1));                 \
3846                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3847                         host_to_le16(ssid->vht_rx_mcs_nss_ ##i <<       \
3848                                      2 * (i - 1));                      \
3849         }
3850
3851         OVERRIDE_MCS(1);
3852         OVERRIDE_MCS(2);
3853         OVERRIDE_MCS(3);
3854         OVERRIDE_MCS(4);
3855         OVERRIDE_MCS(5);
3856         OVERRIDE_MCS(6);
3857         OVERRIDE_MCS(7);
3858         OVERRIDE_MCS(8);
3859 }
3860 #endif /* CONFIG_VHT_OVERRIDES */
3861
3862
3863 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3864 {
3865 #ifdef PCSC_FUNCS
3866         size_t len;
3867
3868         if (!wpa_s->conf->pcsc_reader)
3869                 return 0;
3870
3871         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3872         if (!wpa_s->scard)
3873                 return 1;
3874
3875         if (wpa_s->conf->pcsc_pin &&
3876             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3877                 scard_deinit(wpa_s->scard);
3878                 wpa_s->scard = NULL;
3879                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3880                 return -1;
3881         }
3882
3883         len = sizeof(wpa_s->imsi) - 1;
3884         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3885                 scard_deinit(wpa_s->scard);
3886                 wpa_s->scard = NULL;
3887                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3888                 return -1;
3889         }
3890         wpa_s->imsi[len] = '\0';
3891
3892         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3893
3894         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3895                    wpa_s->imsi, wpa_s->mnc_len);
3896
3897         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3898         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3899 #endif /* PCSC_FUNCS */
3900
3901         return 0;
3902 }
3903
3904
3905 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3906 {
3907         char *val, *pos;
3908
3909         ext_password_deinit(wpa_s->ext_pw);
3910         wpa_s->ext_pw = NULL;
3911         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3912
3913         if (!wpa_s->conf->ext_password_backend)
3914                 return 0;
3915
3916         val = os_strdup(wpa_s->conf->ext_password_backend);
3917         if (val == NULL)
3918                 return -1;
3919         pos = os_strchr(val, ':');
3920         if (pos)
3921                 *pos++ = '\0';
3922
3923         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3924
3925         wpa_s->ext_pw = ext_password_init(val, pos);
3926         os_free(val);
3927         if (wpa_s->ext_pw == NULL) {
3928                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3929                 return -1;
3930         }
3931         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3932
3933         return 0;
3934 }
3935
3936
3937 #ifdef CONFIG_FST
3938
3939 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3940 {
3941         struct wpa_supplicant *wpa_s = ctx;
3942
3943         return (is_zero_ether_addr(wpa_s->bssid) ||
3944                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3945 }
3946
3947
3948 static void wpas_fst_get_channel_info_cb(void *ctx,
3949                                          enum hostapd_hw_mode *hw_mode,
3950                                          u8 *channel)
3951 {
3952         struct wpa_supplicant *wpa_s = ctx;
3953
3954         if (wpa_s->current_bss) {
3955                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3956                                                   channel);
3957         } else if (wpa_s->hw.num_modes) {
3958                 *hw_mode = wpa_s->hw.modes[0].mode;
3959         } else {
3960                 WPA_ASSERT(0);
3961                 *hw_mode = 0;
3962         }
3963 }
3964
3965
3966 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3967 {
3968         struct wpa_supplicant *wpa_s = ctx;
3969
3970         *modes = wpa_s->hw.modes;
3971         return wpa_s->hw.num_modes;
3972 }
3973
3974
3975 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3976 {
3977         struct wpa_supplicant *wpa_s = ctx;
3978
3979         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3980         wpa_s->fst_ies = fst_ies;
3981 }
3982
3983
3984 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3985 {
3986         struct wpa_supplicant *wpa_s = ctx;
3987
3988         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3989         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3990                                           wpa_s->own_addr, wpa_s->bssid,
3991                                           wpabuf_head(data), wpabuf_len(data),
3992                                    0);
3993 }
3994
3995
3996 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3997 {
3998         struct wpa_supplicant *wpa_s = ctx;
3999
4000         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4001         return wpa_s->received_mb_ies;
4002 }
4003
4004
4005 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
4006                                      const u8 *buf, size_t size)
4007 {
4008         struct wpa_supplicant *wpa_s = ctx;
4009         struct mb_ies_info info;
4010
4011         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4012
4013         if (!mb_ies_info_by_ies(&info, buf, size)) {
4014                 wpabuf_free(wpa_s->received_mb_ies);
4015                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
4016         }
4017 }
4018
4019
4020 static const u8 * wpas_fst_get_peer_first(void *ctx,
4021                                           struct fst_get_peer_ctx **get_ctx,
4022                                           Boolean mb_only)
4023 {
4024         struct wpa_supplicant *wpa_s = ctx;
4025
4026         *get_ctx = NULL;
4027         if (!is_zero_ether_addr(wpa_s->bssid))
4028                 return (wpa_s->received_mb_ies || !mb_only) ?
4029                         wpa_s->bssid : NULL;
4030         return NULL;
4031 }
4032
4033
4034 static const u8 * wpas_fst_get_peer_next(void *ctx,
4035                                          struct fst_get_peer_ctx **get_ctx,
4036                                          Boolean mb_only)
4037 {
4038         return NULL;
4039 }
4040
4041 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4042                                        struct fst_wpa_obj *iface_obj)
4043 {
4044         iface_obj->ctx              = wpa_s;
4045         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4046         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4047         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4048         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4049         iface_obj->send_action      = wpas_fst_send_action_cb;
4050         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4051         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4052         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4053         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4054 }
4055 #endif /* CONFIG_FST */
4056
4057 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4058                                     const struct wpa_driver_capa *capa)
4059 {
4060         struct wowlan_triggers *triggers;
4061         int ret = 0;
4062
4063         if (!wpa_s->conf->wowlan_triggers)
4064                 return 0;
4065
4066         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4067         if (triggers) {
4068                 ret = wpa_drv_wowlan(wpa_s, triggers);
4069                 os_free(triggers);
4070         }
4071         return ret;
4072 }
4073
4074
4075 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4076 {
4077         if (freq < 3000)
4078                 return BAND_2_4_GHZ;
4079         if (freq > 50000)
4080                 return BAND_60_GHZ;
4081         return BAND_5_GHZ;
4082 }
4083
4084
4085 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4086 {
4087         int i;
4088         unsigned int band = 0;
4089
4090         if (freqs) {
4091                 /* freqs are specified for the radio work */
4092                 for (i = 0; freqs[i]; i++)
4093                         band |= wpas_freq_to_band(freqs[i]);
4094         } else {
4095                 /*
4096                  * freqs are not specified, implies all
4097                  * the supported freqs by HW
4098                  */
4099                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4100                         if (wpa_s->hw.modes[i].num_channels != 0) {
4101                                 if (wpa_s->hw.modes[i].mode ==
4102                                     HOSTAPD_MODE_IEEE80211B ||
4103                                     wpa_s->hw.modes[i].mode ==
4104                                     HOSTAPD_MODE_IEEE80211G)
4105                                         band |= BAND_2_4_GHZ;
4106                                 else if (wpa_s->hw.modes[i].mode ==
4107                                          HOSTAPD_MODE_IEEE80211A)
4108                                         band |= BAND_5_GHZ;
4109                                 else if (wpa_s->hw.modes[i].mode ==
4110                                          HOSTAPD_MODE_IEEE80211AD)
4111                                         band |= BAND_60_GHZ;
4112                                 else if (wpa_s->hw.modes[i].mode ==
4113                                          HOSTAPD_MODE_IEEE80211ANY)
4114                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4115                                                 BAND_60_GHZ;
4116                         }
4117                 }
4118         }
4119
4120         return band;
4121 }
4122
4123
4124 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4125                                               const char *rn)
4126 {
4127         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4128         struct wpa_radio *radio;
4129
4130         while (rn && iface) {
4131                 radio = iface->radio;
4132                 if (radio && os_strcmp(rn, radio->name) == 0) {
4133                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4134                                    wpa_s->ifname, rn);
4135                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4136                         return radio;
4137                 }
4138
4139                 iface = iface->next;
4140         }
4141
4142         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4143                    wpa_s->ifname, rn ? rn : "N/A");
4144         radio = os_zalloc(sizeof(*radio));
4145         if (radio == NULL)
4146                 return NULL;
4147
4148         if (rn)
4149                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4150         dl_list_init(&radio->ifaces);
4151         dl_list_init(&radio->work);
4152         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4153
4154         return radio;
4155 }
4156
4157
4158 static void radio_work_free(struct wpa_radio_work *work)
4159 {
4160         if (work->wpa_s->scan_work == work) {
4161                 /* This should not really happen. */
4162                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4163                         work->type, work, work->started);
4164                 work->wpa_s->scan_work = NULL;
4165         }
4166
4167 #ifdef CONFIG_P2P
4168         if (work->wpa_s->p2p_scan_work == work) {
4169                 /* This should not really happen. */
4170                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4171                         work->type, work, work->started);
4172                 work->wpa_s->p2p_scan_work = NULL;
4173         }
4174 #endif /* CONFIG_P2P */
4175
4176         if (work->started) {
4177                 work->wpa_s->radio->num_active_works--;
4178                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4179                         "radio_work_free('%s'@%p: num_active_works --> %u",
4180                         work->type, work,
4181                         work->wpa_s->radio->num_active_works);
4182         }
4183
4184         dl_list_del(&work->list);
4185         os_free(work);
4186 }
4187
4188
4189 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4190 {
4191         struct wpa_radio_work *active_work = NULL;
4192         struct wpa_radio_work *tmp;
4193
4194         /* Get the active work to know the type and band. */
4195         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4196                 if (tmp->started) {
4197                         active_work = tmp;
4198                         break;
4199                 }
4200         }
4201
4202         if (!active_work) {
4203                 /* No active work, start one */
4204                 radio->num_active_works = 0;
4205                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4206                                  list) {
4207                         if (os_strcmp(tmp->type, "scan") == 0 &&
4208                             radio->external_scan_running &&
4209                             (((struct wpa_driver_scan_params *)
4210                               tmp->ctx)->only_new_results ||
4211                              tmp->wpa_s->clear_driver_scan_cache))
4212                                 continue;
4213                         return tmp;
4214                 }
4215                 return NULL;
4216         }
4217
4218         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4219             os_strcmp(active_work->type, "connect") == 0) {
4220                 /*
4221                  * If the active work is either connect or sme-connect,
4222                  * do not parallelize them with other radio works.
4223                  */
4224                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4225                         "Do not parallelize radio work with %s",
4226                         active_work->type);
4227                 return NULL;
4228         }
4229
4230         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4231                 if (tmp->started)
4232                         continue;
4233
4234                 /*
4235                  * If connect or sme-connect are enqueued, parallelize only
4236                  * those operations ahead of them in the queue.
4237                  */
4238                 if (os_strcmp(tmp->type, "connect") == 0 ||
4239                     os_strcmp(tmp->type, "sme-connect") == 0)
4240                         break;
4241
4242                 /*
4243                  * Check that the radio works are distinct and
4244                  * on different bands.
4245                  */
4246                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4247                     (active_work->bands != tmp->bands)) {
4248                         /*
4249                          * If a scan has to be scheduled through nl80211 scan
4250                          * interface and if an external scan is already running,
4251                          * do not schedule the scan since it is likely to get
4252                          * rejected by kernel.
4253                          */
4254                         if (os_strcmp(tmp->type, "scan") == 0 &&
4255                             radio->external_scan_running &&
4256                             (((struct wpa_driver_scan_params *)
4257                               tmp->ctx)->only_new_results ||
4258                              tmp->wpa_s->clear_driver_scan_cache))
4259                                 continue;
4260
4261                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4262                                 "active_work:%s new_work:%s",
4263                                 active_work->type, tmp->type);
4264                         return tmp;
4265                 }
4266         }
4267
4268         /* Did not find a radio work to schedule in parallel. */
4269         return NULL;
4270 }
4271
4272
4273 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4274 {
4275         struct wpa_radio *radio = eloop_ctx;
4276         struct wpa_radio_work *work;
4277         struct os_reltime now, diff;
4278         struct wpa_supplicant *wpa_s;
4279
4280         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4281         if (work == NULL) {
4282                 radio->num_active_works = 0;
4283                 return;
4284         }
4285
4286         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4287                               radio_list);
4288
4289         if (!(wpa_s &&
4290               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4291                 if (work->started)
4292                         return; /* already started and still in progress */
4293
4294                 if (wpa_s && wpa_s->radio->external_scan_running) {
4295                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4296                         return;
4297                 }
4298         } else {
4299                 work = NULL;
4300                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4301                         /* get the work to schedule next */
4302                         work = radio_work_get_next_work(radio);
4303                 }
4304                 if (!work)
4305                         return;
4306         }
4307
4308         wpa_s = work->wpa_s;
4309         os_get_reltime(&now);
4310         os_reltime_sub(&now, &work->time, &diff);
4311         wpa_dbg(wpa_s, MSG_DEBUG,
4312                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4313                 work->type, work, diff.sec, diff.usec);
4314         work->started = 1;
4315         work->time = now;
4316         radio->num_active_works++;
4317
4318         work->cb(work, 0);
4319
4320         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4321             radio->num_active_works < MAX_ACTIVE_WORKS)
4322                 radio_work_check_next(wpa_s);
4323 }
4324
4325
4326 /*
4327  * This function removes both started and pending radio works running on
4328  * the provided interface's radio.
4329  * Prior to the removal of the radio work, its callback (cb) is called with
4330  * deinit set to be 1. Each work's callback is responsible for clearing its
4331  * internal data and restoring to a correct state.
4332  * @wpa_s: wpa_supplicant data
4333  * @type: type of works to be removed
4334  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4335  * this interface's works.
4336  */
4337 void radio_remove_works(struct wpa_supplicant *wpa_s,
4338                         const char *type, int remove_all)
4339 {
4340         struct wpa_radio_work *work, *tmp;
4341         struct wpa_radio *radio = wpa_s->radio;
4342
4343         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4344                               list) {
4345                 if (type && os_strcmp(type, work->type) != 0)
4346                         continue;
4347
4348                 /* skip other ifaces' works */
4349                 if (!remove_all && work->wpa_s != wpa_s)
4350                         continue;
4351
4352                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4353                         work->type, work, work->started ? " (started)" : "");
4354                 work->cb(work, 1);
4355                 radio_work_free(work);
4356         }
4357
4358         /* in case we removed the started work */
4359         radio_work_check_next(wpa_s);
4360 }
4361
4362
4363 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4364 {
4365         struct wpa_radio *radio = wpa_s->radio;
4366
4367         if (!radio)
4368                 return;
4369
4370         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4371                    wpa_s->ifname, radio->name);
4372         dl_list_del(&wpa_s->radio_list);
4373         radio_remove_works(wpa_s, NULL, 0);
4374         wpa_s->radio = NULL;
4375         if (!dl_list_empty(&radio->ifaces))
4376                 return; /* Interfaces remain for this radio */
4377
4378         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4379         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4380         os_free(radio);
4381 }
4382
4383
4384 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4385 {
4386         struct wpa_radio *radio = wpa_s->radio;
4387
4388         if (dl_list_empty(&radio->work))
4389                 return;
4390         if (wpa_s->ext_work_in_progress) {
4391                 wpa_printf(MSG_DEBUG,
4392                            "External radio work in progress - delay start of pending item");
4393                 return;
4394         }
4395         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4396         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4397 }
4398
4399
4400 /**
4401  * radio_add_work - Add a radio work item
4402  * @wpa_s: Pointer to wpa_supplicant data
4403  * @freq: Frequency of the offchannel operation in MHz or 0
4404  * @type: Unique identifier for each type of work
4405  * @next: Force as the next work to be executed
4406  * @cb: Callback function for indicating when radio is available
4407  * @ctx: Context pointer for the work (work->ctx in cb())
4408  * Returns: 0 on success, -1 on failure
4409  *
4410  * This function is used to request time for an operation that requires
4411  * exclusive radio control. Once the radio is available, the registered callback
4412  * function will be called. radio_work_done() must be called once the exclusive
4413  * radio operation has been completed, so that the radio is freed for other
4414  * operations. The special case of deinit=1 is used to free the context data
4415  * during interface removal. That does not allow the callback function to start
4416  * the radio operation, i.e., it must free any resources allocated for the radio
4417  * work and return.
4418  *
4419  * The @freq parameter can be used to indicate a single channel on which the
4420  * offchannel operation will occur. This may allow multiple radio work
4421  * operations to be performed in parallel if they apply for the same channel.
4422  * Setting this to 0 indicates that the work item may use multiple channels or
4423  * requires exclusive control of the radio.
4424  */
4425 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4426                    const char *type, int next,
4427                    void (*cb)(struct wpa_radio_work *work, int deinit),
4428                    void *ctx)
4429 {
4430         struct wpa_radio *radio = wpa_s->radio;
4431         struct wpa_radio_work *work;
4432         int was_empty;
4433
4434         work = os_zalloc(sizeof(*work));
4435         if (work == NULL)
4436                 return -1;
4437         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4438         os_get_reltime(&work->time);
4439         work->freq = freq;
4440         work->type = type;
4441         work->wpa_s = wpa_s;
4442         work->cb = cb;
4443         work->ctx = ctx;
4444
4445         if (freq)
4446                 work->bands = wpas_freq_to_band(freq);
4447         else if (os_strcmp(type, "scan") == 0 ||
4448                  os_strcmp(type, "p2p-scan") == 0)
4449                 work->bands = wpas_get_bands(wpa_s,
4450                                              ((struct wpa_driver_scan_params *)
4451                                               ctx)->freqs);
4452         else
4453                 work->bands = wpas_get_bands(wpa_s, NULL);
4454
4455         was_empty = dl_list_empty(&wpa_s->radio->work);
4456         if (next)
4457                 dl_list_add(&wpa_s->radio->work, &work->list);
4458         else
4459                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4460         if (was_empty) {
4461                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4462                 radio_work_check_next(wpa_s);
4463         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4464                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4465                 wpa_dbg(wpa_s, MSG_DEBUG,
4466                         "Try to schedule a radio work (num_active_works=%u)",
4467                         radio->num_active_works);
4468                 radio_work_check_next(wpa_s);
4469         }
4470
4471         return 0;
4472 }
4473
4474
4475 /**
4476  * radio_work_done - Indicate that a radio work item has been completed
4477  * @work: Completed work
4478  *
4479  * This function is called once the callback function registered with
4480  * radio_add_work() has completed its work.
4481  */
4482 void radio_work_done(struct wpa_radio_work *work)
4483 {
4484         struct wpa_supplicant *wpa_s = work->wpa_s;
4485         struct os_reltime now, diff;
4486         unsigned int started = work->started;
4487
4488         os_get_reltime(&now);
4489         os_reltime_sub(&now, &work->time, &diff);
4490         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4491                 work->type, work, started ? "done" : "canceled",
4492                 diff.sec, diff.usec);
4493         radio_work_free(work);
4494         if (started)
4495                 radio_work_check_next(wpa_s);
4496 }
4497
4498
4499 struct wpa_radio_work *
4500 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4501 {
4502         struct wpa_radio_work *work;
4503         struct wpa_radio *radio = wpa_s->radio;
4504
4505         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4506                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4507                         return work;
4508         }
4509
4510         return NULL;
4511 }
4512
4513
4514 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4515                             struct wpa_interface *iface)
4516 {
4517         const char *ifname, *driver, *rn;
4518
4519         driver = iface->driver;
4520 next_driver:
4521         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4522                 return -1;
4523
4524         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4525         if (wpa_s->drv_priv == NULL) {
4526                 const char *pos;
4527                 pos = driver ? os_strchr(driver, ',') : NULL;
4528                 if (pos) {
4529                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4530                                 "driver interface - try next driver wrapper");
4531                         driver = pos + 1;
4532                         goto next_driver;
4533                 }
4534                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4535                         "interface");
4536                 return -1;
4537         }
4538         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4539                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4540                         "driver_param '%s'", wpa_s->conf->driver_param);
4541                 return -1;
4542         }
4543
4544         ifname = wpa_drv_get_ifname(wpa_s);
4545         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4546                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4547                         "interface name with '%s'", ifname);
4548                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4549         }
4550
4551         rn = wpa_driver_get_radio_name(wpa_s);
4552         if (rn && rn[0] == '\0')
4553                 rn = NULL;
4554
4555         wpa_s->radio = radio_add_interface(wpa_s, rn);
4556         if (wpa_s->radio == NULL)
4557                 return -1;
4558
4559         return 0;
4560 }
4561
4562
4563 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4564                                      struct wpa_interface *iface)
4565 {
4566         struct wpa_driver_capa capa;
4567         int capa_res;
4568
4569         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4570                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4571                    iface->confname ? iface->confname : "N/A",
4572                    iface->driver ? iface->driver : "default",
4573                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4574                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4575
4576         if (iface->confname) {
4577 #ifdef CONFIG_BACKEND_FILE
4578                 wpa_s->confname = os_rel2abs_path(iface->confname);
4579                 if (wpa_s->confname == NULL) {
4580                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4581                                    "for configuration file '%s'.",
4582                                    iface->confname);
4583                         return -1;
4584                 }
4585                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4586                            iface->confname, wpa_s->confname);
4587 #else /* CONFIG_BACKEND_FILE */
4588                 wpa_s->confname = os_strdup(iface->confname);
4589 #endif /* CONFIG_BACKEND_FILE */
4590                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4591                 if (wpa_s->conf == NULL) {
4592                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4593                                    "configuration '%s'.", wpa_s->confname);
4594                         return -1;
4595                 }
4596                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4597                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4598
4599                 /*
4600                  * Override ctrl_interface and driver_param if set on command
4601                  * line.
4602                  */
4603                 if (iface->ctrl_interface) {
4604                         os_free(wpa_s->conf->ctrl_interface);
4605                         wpa_s->conf->ctrl_interface =
4606                                 os_strdup(iface->ctrl_interface);
4607                 }
4608
4609                 if (iface->driver_param) {
4610                         os_free(wpa_s->conf->driver_param);
4611                         wpa_s->conf->driver_param =
4612                                 os_strdup(iface->driver_param);
4613                 }
4614
4615                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4616                         os_free(wpa_s->conf->ctrl_interface);
4617                         wpa_s->conf->ctrl_interface = NULL;
4618                 }
4619         } else
4620                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4621                                                      iface->driver_param);
4622
4623         if (wpa_s->conf == NULL) {
4624                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4625                 return -1;
4626         }
4627
4628         if (iface->ifname == NULL) {
4629                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4630                 return -1;
4631         }
4632         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4633                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4634                            iface->ifname);
4635                 return -1;
4636         }
4637         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4638
4639         if (iface->bridge_ifname) {
4640                 if (os_strlen(iface->bridge_ifname) >=
4641                     sizeof(wpa_s->bridge_ifname)) {
4642                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4643                                    "name '%s'.", iface->bridge_ifname);
4644                         return -1;
4645                 }
4646                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4647                            sizeof(wpa_s->bridge_ifname));
4648         }
4649
4650         /* RSNA Supplicant Key Management - INITIALIZE */
4651         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4652         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4653
4654         /* Initialize driver interface and register driver event handler before
4655          * L2 receive handler so that association events are processed before
4656          * EAPOL-Key packets if both become available for the same select()
4657          * call. */
4658         if (wpas_init_driver(wpa_s, iface) < 0)
4659                 return -1;
4660
4661         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4662                 return -1;
4663
4664         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4665                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4666                           NULL);
4667         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4668
4669         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4670             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4671                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4672                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4673                         "dot11RSNAConfigPMKLifetime");
4674                 return -1;
4675         }
4676
4677         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4678             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4679                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4680                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4681                         "dot11RSNAConfigPMKReauthThreshold");
4682                 return -1;
4683         }
4684
4685         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4686             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4687                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4688                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4689                         "dot11RSNAConfigSATimeout");
4690                 return -1;
4691         }
4692
4693         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4694                                                       &wpa_s->hw.num_modes,
4695                                                       &wpa_s->hw.flags);
4696         if (wpa_s->hw.modes) {
4697                 u16 i;
4698
4699                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4700                         if (wpa_s->hw.modes[i].vht_capab) {
4701                                 wpa_s->hw_capab = CAPAB_VHT;
4702                                 break;
4703                         }
4704
4705                         if (wpa_s->hw.modes[i].ht_capab &
4706                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4707                                 wpa_s->hw_capab = CAPAB_HT40;
4708                         else if (wpa_s->hw.modes[i].ht_capab &&
4709                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4710                                 wpa_s->hw_capab = CAPAB_HT;
4711                 }
4712         }
4713
4714         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4715         if (capa_res == 0) {
4716                 wpa_s->drv_capa_known = 1;
4717                 wpa_s->drv_flags = capa.flags;
4718                 wpa_s->drv_enc = capa.enc;
4719                 wpa_s->drv_smps_modes = capa.smps_modes;
4720                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4721                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4722                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4723                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4724                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4725                 wpa_s->max_sched_scan_plan_interval =
4726                         capa.max_sched_scan_plan_interval;
4727                 wpa_s->max_sched_scan_plan_iterations =
4728                         capa.max_sched_scan_plan_iterations;
4729                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4730                 wpa_s->max_match_sets = capa.max_match_sets;
4731                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4732                 wpa_s->max_stations = capa.max_stations;
4733                 wpa_s->extended_capa = capa.extended_capa;
4734                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4735                 wpa_s->extended_capa_len = capa.extended_capa_len;
4736                 wpa_s->num_multichan_concurrent =
4737                         capa.num_multichan_concurrent;
4738                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4739
4740                 if (capa.mac_addr_rand_scan_supported)
4741                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4742                 if (wpa_s->sched_scan_supported &&
4743                     capa.mac_addr_rand_sched_scan_supported)
4744                         wpa_s->mac_addr_rand_supported |=
4745                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4746         }
4747         if (wpa_s->max_remain_on_chan == 0)
4748                 wpa_s->max_remain_on_chan = 1000;
4749
4750         /*
4751          * Only take p2p_mgmt parameters when P2P Device is supported.
4752          * Doing it here as it determines whether l2_packet_init() will be done
4753          * during wpa_supplicant_driver_init().
4754          */
4755         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4756                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4757         else
4758                 iface->p2p_mgmt = 1;
4759
4760         if (wpa_s->num_multichan_concurrent == 0)
4761                 wpa_s->num_multichan_concurrent = 1;
4762
4763         if (wpa_supplicant_driver_init(wpa_s) < 0)
4764                 return -1;
4765
4766 #ifdef CONFIG_TDLS
4767         if ((!iface->p2p_mgmt ||
4768              !(wpa_s->drv_flags &
4769                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4770             wpa_tdls_init(wpa_s->wpa))
4771                 return -1;
4772 #endif /* CONFIG_TDLS */
4773
4774         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4775             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4776                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4777                 return -1;
4778         }
4779
4780 #ifdef CONFIG_FST
4781         if (wpa_s->conf->fst_group_id) {
4782                 struct fst_iface_cfg cfg;
4783                 struct fst_wpa_obj iface_obj;
4784
4785                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4786                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4787                            sizeof(cfg.group_id));
4788                 cfg.priority = wpa_s->conf->fst_priority;
4789                 cfg.llt = wpa_s->conf->fst_llt;
4790
4791                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4792                                         &iface_obj, &cfg);
4793                 if (!wpa_s->fst) {
4794                         wpa_msg(wpa_s, MSG_ERROR,
4795                                 "FST: Cannot attach iface %s to group %s",
4796                                 wpa_s->ifname, cfg.group_id);
4797                         return -1;
4798                 }
4799         }
4800 #endif /* CONFIG_FST */
4801
4802         if (wpas_wps_init(wpa_s))
4803                 return -1;
4804
4805         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4806                 return -1;
4807         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4808
4809         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4810         if (wpa_s->ctrl_iface == NULL) {
4811                 wpa_printf(MSG_ERROR,
4812                            "Failed to initialize control interface '%s'.\n"
4813                            "You may have another wpa_supplicant process "
4814                            "already running or the file was\n"
4815                            "left by an unclean termination of wpa_supplicant "
4816                            "in which case you will need\n"
4817                            "to manually remove this file before starting "
4818                            "wpa_supplicant again.\n",
4819                            wpa_s->conf->ctrl_interface);
4820                 return -1;
4821         }
4822
4823         wpa_s->gas = gas_query_init(wpa_s);
4824         if (wpa_s->gas == NULL) {
4825                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4826                 return -1;
4827         }
4828
4829         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4830                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4831                 return -1;
4832         }
4833
4834         if (wpa_bss_init(wpa_s) < 0)
4835                 return -1;
4836
4837         /*
4838          * Set Wake-on-WLAN triggers, if configured.
4839          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4840          * have effect anyway when the interface is down).
4841          */
4842         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4843                 return -1;
4844
4845 #ifdef CONFIG_EAP_PROXY
4846 {
4847         size_t len;
4848         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4849                                                      &len);
4850         if (wpa_s->mnc_len > 0) {
4851                 wpa_s->imsi[len] = '\0';
4852                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4853                            wpa_s->imsi, wpa_s->mnc_len);
4854         } else {
4855                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4856         }
4857 }
4858 #endif /* CONFIG_EAP_PROXY */
4859
4860         if (pcsc_reader_init(wpa_s) < 0)
4861                 return -1;
4862
4863         if (wpas_init_ext_pw(wpa_s) < 0)
4864                 return -1;
4865
4866         wpas_rrm_reset(wpa_s);
4867
4868         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4869
4870 #ifdef CONFIG_HS20
4871         hs20_init(wpa_s);
4872 #endif /* CONFIG_HS20 */
4873 #ifdef CONFIG_MBO
4874         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4875 #endif /* CONFIG_MBO */
4876
4877         wpa_supplicant_set_default_scan_ies(wpa_s);
4878
4879         return 0;
4880 }
4881
4882
4883 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4884                                         int notify, int terminate)
4885 {
4886         struct wpa_global *global = wpa_s->global;
4887         struct wpa_supplicant *iface, *prev;
4888
4889         if (wpa_s == wpa_s->parent)
4890                 wpas_p2p_group_remove(wpa_s, "*");
4891
4892         iface = global->ifaces;
4893         while (iface) {
4894                 if (iface->p2pdev == wpa_s)
4895                         iface->p2pdev = iface->parent;
4896                 if (iface == wpa_s || iface->parent != wpa_s) {
4897                         iface = iface->next;
4898                         continue;
4899                 }
4900                 wpa_printf(MSG_DEBUG,
4901                            "Remove remaining child interface %s from parent %s",
4902                            iface->ifname, wpa_s->ifname);
4903                 prev = iface;
4904                 iface = iface->next;
4905                 wpa_supplicant_remove_iface(global, prev, terminate);
4906         }
4907
4908         wpa_s->disconnected = 1;
4909         if (wpa_s->drv_priv) {
4910                 wpa_supplicant_deauthenticate(wpa_s,
4911                                               WLAN_REASON_DEAUTH_LEAVING);
4912
4913                 wpa_drv_set_countermeasures(wpa_s, 0);
4914                 wpa_clear_keys(wpa_s, NULL);
4915         }
4916
4917         wpa_supplicant_cleanup(wpa_s);
4918         wpas_p2p_deinit_iface(wpa_s);
4919
4920         wpas_ctrl_radio_work_flush(wpa_s);
4921         radio_remove_interface(wpa_s);
4922
4923 #ifdef CONFIG_FST
4924         if (wpa_s->fst) {
4925                 fst_detach(wpa_s->fst);
4926                 wpa_s->fst = NULL;
4927         }
4928         if (wpa_s->received_mb_ies) {
4929                 wpabuf_free(wpa_s->received_mb_ies);
4930                 wpa_s->received_mb_ies = NULL;
4931         }
4932 #endif /* CONFIG_FST */
4933
4934         if (wpa_s->drv_priv)
4935                 wpa_drv_deinit(wpa_s);
4936
4937         if (notify)
4938                 wpas_notify_iface_removed(wpa_s);
4939
4940         if (terminate)
4941                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4942
4943         if (wpa_s->ctrl_iface) {
4944                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4945                 wpa_s->ctrl_iface = NULL;
4946         }
4947
4948 #ifdef CONFIG_MESH
4949         if (wpa_s->ifmsh) {
4950                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4951                 wpa_s->ifmsh = NULL;
4952         }
4953 #endif /* CONFIG_MESH */
4954
4955         if (wpa_s->conf != NULL) {
4956                 wpa_config_free(wpa_s->conf);
4957                 wpa_s->conf = NULL;
4958         }
4959
4960         os_free(wpa_s->ssids_from_scan_req);
4961
4962         os_free(wpa_s);
4963 }
4964
4965
4966 #ifdef CONFIG_MATCH_IFACE
4967
4968 /**
4969  * wpa_supplicant_match_iface - Match an interface description to a name
4970  * @global: Pointer to global data from wpa_supplicant_init()
4971  * @ifname: Name of the interface to match
4972  * Returns: Pointer to the created interface description or %NULL on failure
4973  */
4974 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
4975                                                   const char *ifname)
4976 {
4977         int i;
4978         struct wpa_interface *iface, *miface;
4979
4980         for (i = 0; i < global->params.match_iface_count; i++) {
4981                 miface = &global->params.match_ifaces[i];
4982                 if (!miface->ifname ||
4983                     fnmatch(miface->ifname, ifname, 0) == 0) {
4984                         iface = os_zalloc(sizeof(*iface));
4985                         if (!iface)
4986                                 return NULL;
4987                         *iface = *miface;
4988                         iface->ifname = ifname;
4989                         return iface;
4990                 }
4991         }
4992
4993         return NULL;
4994 }
4995
4996
4997 /**
4998  * wpa_supplicant_match_existing - Match existing interfaces
4999  * @global: Pointer to global data from wpa_supplicant_init()
5000  * Returns: 0 on success, -1 on failure
5001  */
5002 static int wpa_supplicant_match_existing(struct wpa_global *global)
5003 {
5004         struct if_nameindex *ifi, *ifp;
5005         struct wpa_supplicant *wpa_s;
5006         struct wpa_interface *iface;
5007
5008         ifp = if_nameindex();
5009         if (!ifp) {
5010                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
5011                 return -1;
5012         }
5013
5014         for (ifi = ifp; ifi->if_name; ifi++) {
5015                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
5016                 if (wpa_s)
5017                         continue;
5018                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
5019                 if (iface) {
5020                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
5021                         os_free(iface);
5022                         if (wpa_s)
5023                                 wpa_s->matched = 1;
5024                 }
5025         }
5026
5027         if_freenameindex(ifp);
5028         return 0;
5029 }
5030
5031 #endif /* CONFIG_MATCH_IFACE */
5032
5033
5034 /**
5035  * wpa_supplicant_add_iface - Add a new network interface
5036  * @global: Pointer to global data from wpa_supplicant_init()
5037  * @iface: Interface configuration options
5038  * @parent: Parent interface or %NULL to assign new interface as parent
5039  * Returns: Pointer to the created interface or %NULL on failure
5040  *
5041  * This function is used to add new network interfaces for %wpa_supplicant.
5042  * This can be called before wpa_supplicant_run() to add interfaces before the
5043  * main event loop has been started. In addition, new interfaces can be added
5044  * dynamically while %wpa_supplicant is already running. This could happen,
5045  * e.g., when a hotplug network adapter is inserted.
5046  */
5047 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5048                                                  struct wpa_interface *iface,
5049                                                  struct wpa_supplicant *parent)
5050 {
5051         struct wpa_supplicant *wpa_s;
5052         struct wpa_interface t_iface;
5053         struct wpa_ssid *ssid;
5054
5055         if (global == NULL || iface == NULL)
5056                 return NULL;
5057
5058         wpa_s = wpa_supplicant_alloc(parent);
5059         if (wpa_s == NULL)
5060                 return NULL;
5061
5062         wpa_s->global = global;
5063
5064         t_iface = *iface;
5065         if (global->params.override_driver) {
5066                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5067                            "('%s' -> '%s')",
5068                            iface->driver, global->params.override_driver);
5069                 t_iface.driver = global->params.override_driver;
5070         }
5071         if (global->params.override_ctrl_interface) {
5072                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5073                            "ctrl_interface ('%s' -> '%s')",
5074                            iface->ctrl_interface,
5075                            global->params.override_ctrl_interface);
5076                 t_iface.ctrl_interface =
5077                         global->params.override_ctrl_interface;
5078         }
5079         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5080                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5081                            iface->ifname);
5082                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5083                 return NULL;
5084         }
5085
5086         if (iface->p2p_mgmt == 0) {
5087                 /* Notify the control interfaces about new iface */
5088                 if (wpas_notify_iface_added(wpa_s)) {
5089                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5090                         return NULL;
5091                 }
5092
5093                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5094                         wpas_notify_network_added(wpa_s, ssid);
5095         }
5096
5097         wpa_s->next = global->ifaces;
5098         global->ifaces = wpa_s;
5099
5100         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5101         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5102
5103 #ifdef CONFIG_P2P
5104         if (wpa_s->global->p2p == NULL &&
5105             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5106             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5107             wpas_p2p_add_p2pdev_interface(
5108                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5109                 wpa_printf(MSG_INFO,
5110                            "P2P: Failed to enable P2P Device interface");
5111                 /* Try to continue without. P2P will be disabled. */
5112         }
5113 #endif /* CONFIG_P2P */
5114
5115         return wpa_s;
5116 }
5117
5118
5119 /**
5120  * wpa_supplicant_remove_iface - Remove a network interface
5121  * @global: Pointer to global data from wpa_supplicant_init()
5122  * @wpa_s: Pointer to the network interface to be removed
5123  * Returns: 0 if interface was removed, -1 if interface was not found
5124  *
5125  * This function can be used to dynamically remove network interfaces from
5126  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5127  * addition, this function is used to remove all remaining interfaces when
5128  * %wpa_supplicant is terminated.
5129  */
5130 int wpa_supplicant_remove_iface(struct wpa_global *global,
5131                                 struct wpa_supplicant *wpa_s,
5132                                 int terminate)
5133 {
5134         struct wpa_supplicant *prev;
5135 #ifdef CONFIG_MESH
5136         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5137         char *ifname = NULL;
5138 #endif /* CONFIG_MESH */
5139
5140         /* Remove interface from the global list of interfaces */
5141         prev = global->ifaces;
5142         if (prev == wpa_s) {
5143                 global->ifaces = wpa_s->next;
5144         } else {
5145                 while (prev && prev->next != wpa_s)
5146                         prev = prev->next;
5147                 if (prev == NULL)
5148                         return -1;
5149                 prev->next = wpa_s->next;
5150         }
5151
5152         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5153
5154 #ifdef CONFIG_MESH
5155         if (mesh_if_created) {
5156                 ifname = os_strdup(wpa_s->ifname);
5157                 if (ifname == NULL) {
5158                         wpa_dbg(wpa_s, MSG_ERROR,
5159                                 "mesh: Failed to malloc ifname");
5160                         return -1;
5161                 }
5162         }
5163 #endif /* CONFIG_MESH */
5164
5165         if (global->p2p_group_formation == wpa_s)
5166                 global->p2p_group_formation = NULL;
5167         if (global->p2p_invite_group == wpa_s)
5168                 global->p2p_invite_group = NULL;
5169         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5170
5171 #ifdef CONFIG_MESH
5172         if (mesh_if_created) {
5173                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5174                 os_free(ifname);
5175         }
5176 #endif /* CONFIG_MESH */
5177
5178         return 0;
5179 }
5180
5181
5182 /**
5183  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5184  * @wpa_s: Pointer to the network interface
5185  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5186  */
5187 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5188 {
5189         const char *eapol_method;
5190
5191         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5192             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5193                 return "NO-EAP";
5194         }
5195
5196         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5197         if (eapol_method == NULL)
5198                 return "UNKNOWN-EAP";
5199
5200         return eapol_method;
5201 }
5202
5203
5204 /**
5205  * wpa_supplicant_get_iface - Get a new network interface
5206  * @global: Pointer to global data from wpa_supplicant_init()
5207  * @ifname: Interface name
5208  * Returns: Pointer to the interface or %NULL if not found
5209  */
5210 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5211                                                  const char *ifname)
5212 {
5213         struct wpa_supplicant *wpa_s;
5214
5215         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5216                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5217                         return wpa_s;
5218         }
5219         return NULL;
5220 }
5221
5222
5223 #ifndef CONFIG_NO_WPA_MSG
5224 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5225 {
5226         struct wpa_supplicant *wpa_s = ctx;
5227         if (wpa_s == NULL)
5228                 return NULL;
5229         return wpa_s->ifname;
5230 }
5231 #endif /* CONFIG_NO_WPA_MSG */
5232
5233
5234 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5235 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5236 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5237
5238 /* Periodic cleanup tasks */
5239 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5240 {
5241         struct wpa_global *global = eloop_ctx;
5242         struct wpa_supplicant *wpa_s;
5243
5244         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5245                                wpas_periodic, global, NULL);
5246
5247 #ifdef CONFIG_P2P
5248         if (global->p2p)
5249                 p2p_expire_peers(global->p2p);
5250 #endif /* CONFIG_P2P */
5251
5252         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5253                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5254 #ifdef CONFIG_AP
5255                 ap_periodic(wpa_s);
5256 #endif /* CONFIG_AP */
5257         }
5258 }
5259
5260
5261 /**
5262  * wpa_supplicant_init - Initialize %wpa_supplicant
5263  * @params: Parameters for %wpa_supplicant
5264  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5265  *
5266  * This function is used to initialize %wpa_supplicant. After successful
5267  * initialization, the returned data pointer can be used to add and remove
5268  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5269  */
5270 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5271 {
5272         struct wpa_global *global;
5273         int ret, i;
5274
5275         if (params == NULL)
5276                 return NULL;
5277
5278 #ifdef CONFIG_DRIVER_NDIS
5279         {
5280                 void driver_ndis_init_ops(void);
5281                 driver_ndis_init_ops();
5282         }
5283 #endif /* CONFIG_DRIVER_NDIS */
5284
5285 #ifndef CONFIG_NO_WPA_MSG
5286         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5287 #endif /* CONFIG_NO_WPA_MSG */
5288
5289         if (params->wpa_debug_file_path)
5290                 wpa_debug_open_file(params->wpa_debug_file_path);
5291         else
5292                 wpa_debug_setup_stdout();
5293         if (params->wpa_debug_syslog)
5294                 wpa_debug_open_syslog();
5295         if (params->wpa_debug_tracing) {
5296                 ret = wpa_debug_open_linux_tracing();
5297                 if (ret) {
5298                         wpa_printf(MSG_ERROR,
5299                                    "Failed to enable trace logging");
5300                         return NULL;
5301                 }
5302         }
5303
5304         ret = eap_register_methods();
5305         if (ret) {
5306                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5307                 if (ret == -2)
5308                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5309                                    "the same EAP type.");
5310                 return NULL;
5311         }
5312
5313         global = os_zalloc(sizeof(*global));
5314         if (global == NULL)
5315                 return NULL;
5316         dl_list_init(&global->p2p_srv_bonjour);
5317         dl_list_init(&global->p2p_srv_upnp);
5318         global->params.daemonize = params->daemonize;
5319         global->params.wait_for_monitor = params->wait_for_monitor;
5320         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5321         if (params->pid_file)
5322                 global->params.pid_file = os_strdup(params->pid_file);
5323         if (params->ctrl_interface)
5324                 global->params.ctrl_interface =
5325                         os_strdup(params->ctrl_interface);
5326         if (params->ctrl_interface_group)
5327                 global->params.ctrl_interface_group =
5328                         os_strdup(params->ctrl_interface_group);
5329         if (params->override_driver)
5330                 global->params.override_driver =
5331                         os_strdup(params->override_driver);
5332         if (params->override_ctrl_interface)
5333                 global->params.override_ctrl_interface =
5334                         os_strdup(params->override_ctrl_interface);
5335 #ifdef CONFIG_MATCH_IFACE
5336         global->params.match_iface_count = params->match_iface_count;
5337         if (params->match_iface_count) {
5338                 global->params.match_ifaces =
5339                         os_calloc(params->match_iface_count,
5340                                   sizeof(struct wpa_interface));
5341                 os_memcpy(global->params.match_ifaces,
5342                           params->match_ifaces,
5343                           params->match_iface_count *
5344                           sizeof(struct wpa_interface));
5345         }
5346 #endif /* CONFIG_MATCH_IFACE */
5347 #ifdef CONFIG_P2P
5348         if (params->conf_p2p_dev)
5349                 global->params.conf_p2p_dev =
5350                         os_strdup(params->conf_p2p_dev);
5351 #endif /* CONFIG_P2P */
5352         wpa_debug_level = global->params.wpa_debug_level =
5353                 params->wpa_debug_level;
5354         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5355                 params->wpa_debug_show_keys;
5356         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5357                 params->wpa_debug_timestamp;
5358
5359         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5360
5361         if (eloop_init()) {
5362                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5363                 wpa_supplicant_deinit(global);
5364                 return NULL;
5365         }
5366
5367         random_init(params->entropy_file);
5368
5369         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5370         if (global->ctrl_iface == NULL) {
5371                 wpa_supplicant_deinit(global);
5372                 return NULL;
5373         }
5374
5375         if (wpas_notify_supplicant_initialized(global)) {
5376                 wpa_supplicant_deinit(global);
5377                 return NULL;
5378         }
5379
5380         for (i = 0; wpa_drivers[i]; i++)
5381                 global->drv_count++;
5382         if (global->drv_count == 0) {
5383                 wpa_printf(MSG_ERROR, "No drivers enabled");
5384                 wpa_supplicant_deinit(global);
5385                 return NULL;
5386         }
5387         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5388         if (global->drv_priv == NULL) {
5389                 wpa_supplicant_deinit(global);
5390                 return NULL;
5391         }
5392
5393 #ifdef CONFIG_WIFI_DISPLAY
5394         if (wifi_display_init(global) < 0) {
5395                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5396                 wpa_supplicant_deinit(global);
5397                 return NULL;
5398         }
5399 #endif /* CONFIG_WIFI_DISPLAY */
5400
5401         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5402                                wpas_periodic, global, NULL);
5403
5404         return global;
5405 }
5406
5407
5408 /**
5409  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5410  * @global: Pointer to global data from wpa_supplicant_init()
5411  * Returns: 0 after successful event loop run, -1 on failure
5412  *
5413  * This function starts the main event loop and continues running as long as
5414  * there are any remaining events. In most cases, this function is running as
5415  * long as the %wpa_supplicant process in still in use.
5416  */
5417 int wpa_supplicant_run(struct wpa_global *global)
5418 {
5419         struct wpa_supplicant *wpa_s;
5420
5421         if (global->params.daemonize &&
5422             (wpa_supplicant_daemon(global->params.pid_file) ||
5423              eloop_sock_requeue()))
5424                 return -1;
5425
5426 #ifdef CONFIG_MATCH_IFACE
5427         if (wpa_supplicant_match_existing(global))
5428                 return -1;
5429 #endif
5430
5431         if (global->params.wait_for_monitor) {
5432                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5433                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5434                                 wpa_supplicant_ctrl_iface_wait(
5435                                         wpa_s->ctrl_iface);
5436         }
5437
5438         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5439         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5440
5441         eloop_run();
5442
5443         return 0;
5444 }
5445
5446
5447 /**
5448  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5449  * @global: Pointer to global data from wpa_supplicant_init()
5450  *
5451  * This function is called to deinitialize %wpa_supplicant and to free all
5452  * allocated resources. Remaining network interfaces will also be removed.
5453  */
5454 void wpa_supplicant_deinit(struct wpa_global *global)
5455 {
5456         int i;
5457
5458         if (global == NULL)
5459                 return;
5460
5461         eloop_cancel_timeout(wpas_periodic, global, NULL);
5462
5463 #ifdef CONFIG_WIFI_DISPLAY
5464         wifi_display_deinit(global);
5465 #endif /* CONFIG_WIFI_DISPLAY */
5466
5467         while (global->ifaces)
5468                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5469
5470         if (global->ctrl_iface)
5471                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5472
5473         wpas_notify_supplicant_deinitialized(global);
5474
5475         eap_peer_unregister_methods();
5476 #ifdef CONFIG_AP
5477         eap_server_unregister_methods();
5478 #endif /* CONFIG_AP */
5479
5480         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5481                 if (!global->drv_priv[i])
5482                         continue;
5483                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5484         }
5485         os_free(global->drv_priv);
5486
5487         random_deinit();
5488
5489         eloop_destroy();
5490
5491         if (global->params.pid_file) {
5492                 os_daemonize_terminate(global->params.pid_file);
5493                 os_free(global->params.pid_file);
5494         }
5495         os_free(global->params.ctrl_interface);
5496         os_free(global->params.ctrl_interface_group);
5497         os_free(global->params.override_driver);
5498         os_free(global->params.override_ctrl_interface);
5499 #ifdef CONFIG_MATCH_IFACE
5500         os_free(global->params.match_ifaces);
5501 #endif /* CONFIG_MATCH_IFACE */
5502 #ifdef CONFIG_P2P
5503         os_free(global->params.conf_p2p_dev);
5504 #endif /* CONFIG_P2P */
5505
5506         os_free(global->p2p_disallow_freq.range);
5507         os_free(global->p2p_go_avoid_freq.range);
5508         os_free(global->add_psk);
5509
5510         os_free(global);
5511         wpa_debug_close_syslog();
5512         wpa_debug_close_file();
5513         wpa_debug_close_linux_tracing();
5514 }
5515
5516
5517 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5518 {
5519         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5520             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5521                 char country[3];
5522                 country[0] = wpa_s->conf->country[0];
5523                 country[1] = wpa_s->conf->country[1];
5524                 country[2] = '\0';
5525                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5526                         wpa_printf(MSG_ERROR, "Failed to set country code "
5527                                    "'%s'", country);
5528                 }
5529         }
5530
5531         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5532                 wpas_init_ext_pw(wpa_s);
5533
5534         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5535                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5536
5537 #ifdef CONFIG_WPS
5538         wpas_wps_update_config(wpa_s);
5539 #endif /* CONFIG_WPS */
5540         wpas_p2p_update_config(wpa_s);
5541         wpa_s->conf->changed_parameters = 0;
5542 }
5543
5544
5545 void add_freq(int *freqs, int *num_freqs, int freq)
5546 {
5547         int i;
5548
5549         for (i = 0; i < *num_freqs; i++) {
5550                 if (freqs[i] == freq)
5551                         return;
5552         }
5553
5554         freqs[*num_freqs] = freq;
5555         (*num_freqs)++;
5556 }
5557
5558
5559 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5560 {
5561         struct wpa_bss *bss, *cbss;
5562         const int max_freqs = 10;
5563         int *freqs;
5564         int num_freqs = 0;
5565
5566         freqs = os_calloc(max_freqs + 1, sizeof(int));
5567         if (freqs == NULL)
5568                 return NULL;
5569
5570         cbss = wpa_s->current_bss;
5571
5572         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5573                 if (bss == cbss)
5574                         continue;
5575                 if (bss->ssid_len == cbss->ssid_len &&
5576                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5577                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5578                         add_freq(freqs, &num_freqs, bss->freq);
5579                         if (num_freqs == max_freqs)
5580                                 break;
5581                 }
5582         }
5583
5584         if (num_freqs == 0) {
5585                 os_free(freqs);
5586                 freqs = NULL;
5587         }
5588
5589         return freqs;
5590 }
5591
5592
5593 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5594 {
5595         int timeout;
5596         int count;
5597         int *freqs = NULL;
5598
5599         wpas_connect_work_done(wpa_s);
5600
5601         /*
5602          * Remove possible authentication timeout since the connection failed.
5603          */
5604         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5605
5606         /*
5607          * There is no point in blacklisting the AP if this event is
5608          * generated based on local request to disconnect.
5609          */
5610         if (wpa_s->own_disconnect_req) {
5611                 wpa_s->own_disconnect_req = 0;
5612                 wpa_dbg(wpa_s, MSG_DEBUG,
5613                         "Ignore connection failure due to local request to disconnect");
5614                 return;
5615         }
5616         if (wpa_s->disconnected) {
5617                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5618                         "indication since interface has been put into "
5619                         "disconnected state");
5620                 return;
5621         }
5622
5623         /*
5624          * Add the failed BSSID into the blacklist and speed up next scan
5625          * attempt if there could be other APs that could accept association.
5626          * The current blacklist count indicates how many times we have tried
5627          * connecting to this AP and multiple attempts mean that other APs are
5628          * either not available or has already been tried, so that we can start
5629          * increasing the delay here to avoid constant scanning.
5630          */
5631         count = wpa_blacklist_add(wpa_s, bssid);
5632         if (count == 1 && wpa_s->current_bss) {
5633                 /*
5634                  * This BSS was not in the blacklist before. If there is
5635                  * another BSS available for the same ESS, we should try that
5636                  * next. Otherwise, we may as well try this one once more
5637                  * before allowing other, likely worse, ESSes to be considered.
5638                  */
5639                 freqs = get_bss_freqs_in_ess(wpa_s);
5640                 if (freqs) {
5641                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5642                                 "has been seen; try it next");
5643                         wpa_blacklist_add(wpa_s, bssid);
5644                         /*
5645                          * On the next scan, go through only the known channels
5646                          * used in this ESS based on previous scans to speed up
5647                          * common load balancing use case.
5648                          */
5649                         os_free(wpa_s->next_scan_freqs);
5650                         wpa_s->next_scan_freqs = freqs;
5651                 }
5652         }
5653
5654         /*
5655          * Add previous failure count in case the temporary blacklist was
5656          * cleared due to no other BSSes being available.
5657          */
5658         count += wpa_s->extra_blacklist_count;
5659
5660         if (count > 3 && wpa_s->current_ssid) {
5661                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5662                            "consider temporary network disabling");
5663                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5664         }
5665
5666         switch (count) {
5667         case 1:
5668                 timeout = 100;
5669                 break;
5670         case 2:
5671                 timeout = 500;
5672                 break;
5673         case 3:
5674                 timeout = 1000;
5675                 break;
5676         case 4:
5677                 timeout = 5000;
5678                 break;
5679         default:
5680                 timeout = 10000;
5681                 break;
5682         }
5683
5684         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5685                 "ms", count, timeout);
5686
5687         /*
5688          * TODO: if more than one possible AP is available in scan results,
5689          * could try the other ones before requesting a new scan.
5690          */
5691         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5692                                 1000 * (timeout % 1000));
5693 }
5694
5695
5696 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5697 {
5698         return wpa_s->conf->ap_scan == 2 ||
5699                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5700 }
5701
5702
5703 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5704 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5705                                               struct wpa_ssid *ssid,
5706                                               const char *field,
5707                                               const char *value)
5708 {
5709 #ifdef IEEE8021X_EAPOL
5710         struct eap_peer_config *eap = &ssid->eap;
5711
5712         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5713         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5714                               (const u8 *) value, os_strlen(value));
5715
5716         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5717         case WPA_CTRL_REQ_EAP_IDENTITY:
5718                 os_free(eap->identity);
5719                 eap->identity = (u8 *) os_strdup(value);
5720                 eap->identity_len = os_strlen(value);
5721                 eap->pending_req_identity = 0;
5722                 if (ssid == wpa_s->current_ssid)
5723                         wpa_s->reassociate = 1;
5724                 break;
5725         case WPA_CTRL_REQ_EAP_PASSWORD:
5726                 bin_clear_free(eap->password, eap->password_len);
5727                 eap->password = (u8 *) os_strdup(value);
5728                 eap->password_len = os_strlen(value);
5729                 eap->pending_req_password = 0;
5730                 if (ssid == wpa_s->current_ssid)
5731                         wpa_s->reassociate = 1;
5732                 break;
5733         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5734                 bin_clear_free(eap->new_password, eap->new_password_len);
5735                 eap->new_password = (u8 *) os_strdup(value);
5736                 eap->new_password_len = os_strlen(value);
5737                 eap->pending_req_new_password = 0;
5738                 if (ssid == wpa_s->current_ssid)
5739                         wpa_s->reassociate = 1;
5740                 break;
5741         case WPA_CTRL_REQ_EAP_PIN:
5742                 str_clear_free(eap->pin);
5743                 eap->pin = os_strdup(value);
5744                 eap->pending_req_pin = 0;
5745                 if (ssid == wpa_s->current_ssid)
5746                         wpa_s->reassociate = 1;
5747                 break;
5748         case WPA_CTRL_REQ_EAP_OTP:
5749                 bin_clear_free(eap->otp, eap->otp_len);
5750                 eap->otp = (u8 *) os_strdup(value);
5751                 eap->otp_len = os_strlen(value);
5752                 os_free(eap->pending_req_otp);
5753                 eap->pending_req_otp = NULL;
5754                 eap->pending_req_otp_len = 0;
5755                 break;
5756         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5757                 str_clear_free(eap->private_key_passwd);
5758                 eap->private_key_passwd = os_strdup(value);
5759                 eap->pending_req_passphrase = 0;
5760                 if (ssid == wpa_s->current_ssid)
5761                         wpa_s->reassociate = 1;
5762                 break;
5763         case WPA_CTRL_REQ_SIM:
5764                 str_clear_free(eap->external_sim_resp);
5765                 eap->external_sim_resp = os_strdup(value);
5766                 break;
5767         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5768                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5769                         return -1;
5770                 ssid->mem_only_psk = 1;
5771                 if (ssid->passphrase)
5772                         wpa_config_update_psk(ssid);
5773                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5774                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5775                 break;
5776         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5777                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5778                         return -1;
5779                 if (os_strcmp(value, "good") == 0)
5780                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5781                 else if (os_strcmp(value, "bad") == 0)
5782                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5783                 else
5784                         return -1;
5785                 break;
5786         default:
5787                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5788                 return -1;
5789         }
5790
5791         return 0;
5792 #else /* IEEE8021X_EAPOL */
5793         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5794         return -1;
5795 #endif /* IEEE8021X_EAPOL */
5796 }
5797 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5798
5799
5800 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5801 {
5802         int i;
5803         unsigned int drv_enc;
5804
5805         if (wpa_s->p2p_mgmt)
5806                 return 1; /* no normal network profiles on p2p_mgmt interface */
5807
5808         if (ssid == NULL)
5809                 return 1;
5810
5811         if (ssid->disabled)
5812                 return 1;
5813
5814         if (wpa_s->drv_capa_known)
5815                 drv_enc = wpa_s->drv_enc;
5816         else
5817                 drv_enc = (unsigned int) -1;
5818
5819         for (i = 0; i < NUM_WEP_KEYS; i++) {
5820                 size_t len = ssid->wep_key_len[i];
5821                 if (len == 0)
5822                         continue;
5823                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5824                         continue;
5825                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5826                         continue;
5827                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5828                         continue;
5829                 return 1; /* invalid WEP key */
5830         }
5831
5832         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5833             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5834             !ssid->mem_only_psk)
5835                 return 1;
5836
5837         return 0;
5838 }
5839
5840
5841 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5842 {
5843 #ifdef CONFIG_IEEE80211W
5844         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5845                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5846                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5847                         /*
5848                          * Driver does not support BIP -- ignore pmf=1 default
5849                          * since the connection with PMF would fail and the
5850                          * configuration does not require PMF to be enabled.
5851                          */
5852                         return NO_MGMT_FRAME_PROTECTION;
5853                 }
5854
5855                 if (ssid &&
5856                     (ssid->key_mgmt &
5857                      ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
5858                        WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
5859                         /*
5860                          * Do not use the default PMF value for non-RSN networks
5861                          * since PMF is available only with RSN and pmf=2
5862                          * configuration would otherwise prevent connections to
5863                          * all open networks.
5864                          */
5865                         return NO_MGMT_FRAME_PROTECTION;
5866                 }
5867
5868                 return wpa_s->conf->pmf;
5869         }
5870
5871         return ssid->ieee80211w;
5872 #else /* CONFIG_IEEE80211W */
5873         return NO_MGMT_FRAME_PROTECTION;
5874 #endif /* CONFIG_IEEE80211W */
5875 }
5876
5877
5878 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5879 {
5880         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5881                 return 1;
5882         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5883                 return 0;
5884         return -1;
5885 }
5886
5887
5888 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5889 {
5890         struct wpa_ssid *ssid = wpa_s->current_ssid;
5891         int dur;
5892         struct os_reltime now;
5893
5894         if (ssid == NULL) {
5895                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5896                            "SSID block");
5897                 return;
5898         }
5899
5900         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5901                 return;
5902
5903         ssid->auth_failures++;
5904
5905 #ifdef CONFIG_P2P
5906         if (ssid->p2p_group &&
5907             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5908                 /*
5909                  * Skip the wait time since there is a short timeout on the
5910                  * connection to a P2P group.
5911                  */
5912                 return;
5913         }
5914 #endif /* CONFIG_P2P */
5915
5916         if (ssid->auth_failures > 50)
5917                 dur = 300;
5918         else if (ssid->auth_failures > 10)
5919                 dur = 120;
5920         else if (ssid->auth_failures > 5)
5921                 dur = 90;
5922         else if (ssid->auth_failures > 3)
5923                 dur = 60;
5924         else if (ssid->auth_failures > 2)
5925                 dur = 30;
5926         else if (ssid->auth_failures > 1)
5927                 dur = 20;
5928         else
5929                 dur = 10;
5930
5931         if (ssid->auth_failures > 1 &&
5932             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5933                 dur += os_random() % (ssid->auth_failures * 10);
5934
5935         os_get_reltime(&now);
5936         if (now.sec + dur <= ssid->disabled_until.sec)
5937                 return;
5938
5939         ssid->disabled_until.sec = now.sec + dur;
5940
5941         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5942                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5943                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5944                 ssid->auth_failures, dur, reason);
5945 }
5946
5947
5948 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5949                               struct wpa_ssid *ssid, int clear_failures)
5950 {
5951         if (ssid == NULL)
5952                 return;
5953
5954         if (ssid->disabled_until.sec) {
5955                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5956                         "id=%d ssid=\"%s\"",
5957                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5958         }
5959         ssid->disabled_until.sec = 0;
5960         ssid->disabled_until.usec = 0;
5961         if (clear_failures)
5962                 ssid->auth_failures = 0;
5963 }
5964
5965
5966 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5967 {
5968         size_t i;
5969
5970         if (wpa_s->disallow_aps_bssid == NULL)
5971                 return 0;
5972
5973         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5974                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5975                               bssid, ETH_ALEN) == 0)
5976                         return 1;
5977         }
5978
5979         return 0;
5980 }
5981
5982
5983 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5984                     size_t ssid_len)
5985 {
5986         size_t i;
5987
5988         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5989                 return 0;
5990
5991         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5992                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5993                 if (ssid_len == s->ssid_len &&
5994                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5995                         return 1;
5996         }
5997
5998         return 0;
5999 }
6000
6001
6002 /**
6003  * wpas_request_connection - Request a new connection
6004  * @wpa_s: Pointer to the network interface
6005  *
6006  * This function is used to request a new connection to be found. It will mark
6007  * the interface to allow reassociation and request a new scan to find a
6008  * suitable network to connect to.
6009  */
6010 void wpas_request_connection(struct wpa_supplicant *wpa_s)
6011 {
6012         wpa_s->normal_scans = 0;
6013         wpa_s->scan_req = NORMAL_SCAN_REQ;
6014         wpa_supplicant_reinit_autoscan(wpa_s);
6015         wpa_s->extra_blacklist_count = 0;
6016         wpa_s->disconnected = 0;
6017         wpa_s->reassociate = 1;
6018
6019         if (wpa_supplicant_fast_associate(wpa_s) != 1)
6020                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6021         else
6022                 wpa_s->reattach = 0;
6023 }
6024
6025
6026 /**
6027  * wpas_request_disconnection - Request disconnection
6028  * @wpa_s: Pointer to the network interface
6029  *
6030  * This function is used to request disconnection from the currently connected
6031  * network. This will stop any ongoing scans and initiate deauthentication.
6032  */
6033 void wpas_request_disconnection(struct wpa_supplicant *wpa_s)
6034 {
6035 #ifdef CONFIG_SME
6036         wpa_s->sme.prev_bssid_set = 0;
6037 #endif /* CONFIG_SME */
6038         wpa_s->reassociate = 0;
6039         wpa_s->disconnected = 1;
6040         wpa_supplicant_cancel_sched_scan(wpa_s);
6041         wpa_supplicant_cancel_scan(wpa_s);
6042         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
6043         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
6044 }
6045
6046
6047 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
6048                     struct wpa_used_freq_data *freqs_data,
6049                     unsigned int len)
6050 {
6051         unsigned int i;
6052
6053         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
6054                 len, title);
6055         for (i = 0; i < len; i++) {
6056                 struct wpa_used_freq_data *cur = &freqs_data[i];
6057                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
6058                         i, cur->freq, cur->flags);
6059         }
6060 }
6061
6062
6063 /*
6064  * Find the operating frequencies of any of the virtual interfaces that
6065  * are using the same radio as the current interface, and in addition, get
6066  * information about the interface types that are using the frequency.
6067  */
6068 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6069                                 struct wpa_used_freq_data *freqs_data,
6070                                 unsigned int len)
6071 {
6072         struct wpa_supplicant *ifs;
6073         u8 bssid[ETH_ALEN];
6074         int freq;
6075         unsigned int idx = 0, i;
6076
6077         wpa_dbg(wpa_s, MSG_DEBUG,
6078                 "Determining shared radio frequencies (max len %u)", len);
6079         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6080
6081         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6082                          radio_list) {
6083                 if (idx == len)
6084                         break;
6085
6086                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6087                         continue;
6088
6089                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6090                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6091                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6092                         freq = ifs->current_ssid->frequency;
6093                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6094                         freq = ifs->assoc_freq;
6095                 else
6096                         continue;
6097
6098                 /* Hold only distinct freqs */
6099                 for (i = 0; i < idx; i++)
6100                         if (freqs_data[i].freq == freq)
6101                                 break;
6102
6103                 if (i == idx)
6104                         freqs_data[idx++].freq = freq;
6105
6106                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6107                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6108                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6109                                 WPA_FREQ_USED_BY_INFRA_STATION;
6110                 }
6111         }
6112
6113         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6114         return idx;
6115 }
6116
6117
6118 /*
6119  * Find the operating frequencies of any of the virtual interfaces that
6120  * are using the same radio as the current interface.
6121  */
6122 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6123                            int *freq_array, unsigned int len)
6124 {
6125         struct wpa_used_freq_data *freqs_data;
6126         int num, i;
6127
6128         os_memset(freq_array, 0, sizeof(int) * len);
6129
6130         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6131         if (!freqs_data)
6132                 return -1;
6133
6134         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6135         for (i = 0; i < num; i++)
6136                 freq_array[i] = freqs_data[i].freq;
6137
6138         os_free(freqs_data);
6139
6140         return num;
6141 }
6142
6143
6144 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6145 {
6146         struct rrm_data *rrm = data;
6147
6148         if (!rrm->notify_neighbor_rep) {
6149                 wpa_printf(MSG_ERROR,
6150                            "RRM: Unexpected neighbor report timeout");
6151                 return;
6152         }
6153
6154         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6155         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6156
6157         rrm->notify_neighbor_rep = NULL;
6158         rrm->neighbor_rep_cb_ctx = NULL;
6159 }
6160
6161
6162 /*
6163  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6164  * @wpa_s: Pointer to wpa_supplicant
6165  */
6166 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6167 {
6168         wpa_s->rrm.rrm_used = 0;
6169
6170         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6171                              NULL);
6172         if (wpa_s->rrm.notify_neighbor_rep)
6173                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6174         wpa_s->rrm.next_neighbor_rep_token = 1;
6175 }
6176
6177
6178 /*
6179  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6180  * @wpa_s: Pointer to wpa_supplicant
6181  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6182  * @report_len: Length of neighbor report buffer
6183  */
6184 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6185                                    const u8 *report, size_t report_len)
6186 {
6187         struct wpabuf *neighbor_rep;
6188
6189         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6190         if (report_len < 1)
6191                 return;
6192
6193         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6194                 wpa_printf(MSG_DEBUG,
6195                            "RRM: Discarding neighbor report with token %d (expected %d)",
6196                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6197                 return;
6198         }
6199
6200         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6201                              NULL);
6202
6203         if (!wpa_s->rrm.notify_neighbor_rep) {
6204                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6205                 return;
6206         }
6207
6208         /* skipping the first byte, which is only an id (dialog token) */
6209         neighbor_rep = wpabuf_alloc(report_len - 1);
6210         if (neighbor_rep == NULL)
6211                 return;
6212         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6213         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6214                    report[0]);
6215         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6216                                        neighbor_rep);
6217         wpa_s->rrm.notify_neighbor_rep = NULL;
6218         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6219 }
6220
6221
6222 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6223 /* Workaround different, undefined for Windows, error codes used here */
6224 #define ENOTCONN -1
6225 #define EOPNOTSUPP -1
6226 #define ECANCELED -1
6227 #endif
6228
6229 /* Measurement Request element + Location Subject + Maximum Age subelement */
6230 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
6231 /* Measurement Request element + Location Civic Request */
6232 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
6233
6234
6235 /**
6236  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6237  * @wpa_s: Pointer to wpa_supplicant
6238  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6239  *        is sent in the request.
6240  * @lci: if set, neighbor request will include LCI request
6241  * @civic: if set, neighbor request will include civic location request
6242  * @cb: Callback function to be called once the requested report arrives, or
6243  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6244  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6245  *      the requester's responsibility to free it.
6246  *      In the latter case NULL will be sent in 'neighbor_rep'.
6247  * @cb_ctx: Context value to send the callback function
6248  * Returns: 0 in case of success, negative error code otherwise
6249  *
6250  * In case there is a previous request which has not been answered yet, the
6251  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6252  * Request must contain a callback function.
6253  */
6254 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6255                                        const struct wpa_ssid_value *ssid,
6256                                        int lci, int civic,
6257                                        void (*cb)(void *ctx,
6258                                                   struct wpabuf *neighbor_rep),
6259                                        void *cb_ctx)
6260 {
6261         struct wpabuf *buf;
6262         const u8 *rrm_ie;
6263
6264         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6265                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6266                 return -ENOTCONN;
6267         }
6268
6269         if (!wpa_s->rrm.rrm_used) {
6270                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6271                 return -EOPNOTSUPP;
6272         }
6273
6274         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6275                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6276         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6277             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6278                 wpa_printf(MSG_DEBUG,
6279                            "RRM: No network support for Neighbor Report.");
6280                 return -EOPNOTSUPP;
6281         }
6282
6283         if (!cb) {
6284                 wpa_printf(MSG_DEBUG,
6285                            "RRM: Neighbor Report request must provide a callback.");
6286                 return -EINVAL;
6287         }
6288
6289         /* Refuse if there's a live request */
6290         if (wpa_s->rrm.notify_neighbor_rep) {
6291                 wpa_printf(MSG_DEBUG,
6292                            "RRM: Currently handling previous Neighbor Report.");
6293                 return -EBUSY;
6294         }
6295
6296         /* 3 = action category + action code + dialog token */
6297         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
6298                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
6299                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
6300         if (buf == NULL) {
6301                 wpa_printf(MSG_DEBUG,
6302                            "RRM: Failed to allocate Neighbor Report Request");
6303                 return -ENOMEM;
6304         }
6305
6306         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6307                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6308                    wpa_s->rrm.next_neighbor_rep_token);
6309
6310         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6311         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6312         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6313         if (ssid) {
6314                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6315                 wpabuf_put_u8(buf, ssid->ssid_len);
6316                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6317         }
6318
6319         if (lci) {
6320                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6321                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6322                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
6323
6324                 /*
6325                  * Measurement token; nonzero number that is unique among the
6326                  * Measurement Request elements in a particular frame.
6327                  */
6328                 wpabuf_put_u8(buf, 1); /* Measurement Token */
6329
6330                 /*
6331                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6332                  * reserved.
6333                  */
6334                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6335                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
6336
6337                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
6338                 /* Location Subject */
6339                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6340
6341                 /* Optional Subelements */
6342                 /*
6343                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
6344                  * The Maximum Age subelement is required, otherwise the AP can
6345                  * send only data that was determined after receiving the
6346                  * request. Setting it here to unlimited age.
6347                  */
6348                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
6349                 wpabuf_put_u8(buf, 2);
6350                 wpabuf_put_le16(buf, 0xffff);
6351         }
6352
6353         if (civic) {
6354                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6355                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6356                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
6357
6358                 /*
6359                  * Measurement token; nonzero number that is unique among the
6360                  * Measurement Request elements in a particular frame.
6361                  */
6362                 wpabuf_put_u8(buf, 2); /* Measurement Token */
6363
6364                 /*
6365                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6366                  * reserved.
6367                  */
6368                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6369                 /* Measurement Type */
6370                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
6371
6372                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
6373                  * Location Civic request */
6374                 /* Location Subject */
6375                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6376                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
6377                 /* Location Service Interval Units: Seconds */
6378                 wpabuf_put_u8(buf, 0);
6379                 /* Location Service Interval: 0 - Only one report is requested
6380                  */
6381                 wpabuf_put_le16(buf, 0);
6382                 /* No optional subelements */
6383         }
6384
6385         wpa_s->rrm.next_neighbor_rep_token++;
6386
6387         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6388                                 wpa_s->own_addr, wpa_s->bssid,
6389                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6390                 wpa_printf(MSG_DEBUG,
6391                            "RRM: Failed to send Neighbor Report Request");
6392                 wpabuf_free(buf);
6393                 return -ECANCELED;
6394         }
6395
6396         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6397         wpa_s->rrm.notify_neighbor_rep = cb;
6398         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6399                                wpas_rrm_neighbor_rep_timeout_handler,
6400                                &wpa_s->rrm, NULL);
6401
6402         wpabuf_free(buf);
6403         return 0;
6404 }
6405
6406
6407 static struct wpabuf * wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
6408                                                  const u8 *request, size_t len,
6409                                                  struct wpabuf *report)
6410 {
6411         u8 token, type, subject;
6412         u16 max_age = 0;
6413         struct os_reltime t, diff;
6414         unsigned long diff_l;
6415         u8 *ptoken;
6416         const u8 *subelem;
6417
6418         if (!wpa_s->lci || len < 3 + 4)
6419                 return report;
6420
6421         token = *request++;
6422         /* Measurement request mode isn't used */
6423         request++;
6424         type = *request++;
6425         subject = *request++;
6426
6427         wpa_printf(MSG_DEBUG,
6428                    "Measurement request token %u type %u location subject %u",
6429                    token, type, subject);
6430
6431         if (type != MEASURE_TYPE_LCI || subject != LOCATION_SUBJECT_REMOTE) {
6432                 wpa_printf(MSG_INFO,
6433                            "Not building LCI report - bad type or location subject");
6434                 return report;
6435         }
6436
6437         /* Subelements are formatted exactly like elements */
6438         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
6439         if (subelem && subelem[1] == 2)
6440                 max_age = WPA_GET_LE16(subelem + 2);
6441
6442         if (os_get_reltime(&t))
6443                 return report;
6444
6445         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
6446         /* LCI age is calculated in 10th of a second units. */
6447         diff_l = diff.sec * 10 + diff.usec / 100000;
6448
6449         if (max_age != 0xffff && max_age < diff_l)
6450                 return report;
6451
6452         if (wpabuf_resize(&report, 2 + wpabuf_len(wpa_s->lci)))
6453                 return report;
6454
6455         wpabuf_put_u8(report, WLAN_EID_MEASURE_REPORT);
6456         wpabuf_put_u8(report, wpabuf_len(wpa_s->lci));
6457         /* We'll override user's measurement token */
6458         ptoken = wpabuf_put(report, 0);
6459         wpabuf_put_buf(report, wpa_s->lci);
6460         *ptoken = token;
6461
6462         return report;
6463 }
6464
6465
6466 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
6467                                                const u8 *src,
6468                                                const u8 *frame, size_t len)
6469 {
6470         struct wpabuf *buf, *report;
6471         u8 token;
6472         const u8 *ie, *end;
6473
6474         if (wpa_s->wpa_state != WPA_COMPLETED) {
6475                 wpa_printf(MSG_INFO,
6476                            "RRM: Ignoring radio measurement request: Not associated");
6477                 return;
6478         }
6479
6480         if (!wpa_s->rrm.rrm_used) {
6481                 wpa_printf(MSG_INFO,
6482                            "RRM: Ignoring radio measurement request: Not RRM network");
6483                 return;
6484         }
6485
6486         if (len < 3) {
6487                 wpa_printf(MSG_INFO,
6488                            "RRM: Ignoring too short radio measurement request");
6489                 return;
6490         }
6491
6492         end = frame + len;
6493
6494         token = *frame++;
6495
6496         /* Ignore number of repetitions because it's not used in LCI request */
6497         frame += 2;
6498
6499         report = NULL;
6500         while ((ie = get_ie(frame, end - frame, WLAN_EID_MEASURE_REQUEST)) &&
6501                ie[1] >= 3) {
6502                 u8 msmt_type;
6503
6504                 msmt_type = ie[4];
6505                 wpa_printf(MSG_DEBUG, "RRM request %d", msmt_type);
6506
6507                 switch (msmt_type) {
6508                 case MEASURE_TYPE_LCI:
6509                         report = wpas_rrm_build_lci_report(wpa_s, ie + 2, ie[1],
6510                                                            report);
6511                         break;
6512                 default:
6513                         wpa_printf(MSG_INFO,
6514                                    "RRM: Unsupported radio measurement request %d",
6515                                    msmt_type);
6516                         break;
6517                 }
6518
6519                 frame = ie + ie[1] + 2;
6520         }
6521
6522         if (!report)
6523                 return;
6524
6525         buf = wpabuf_alloc(3 + wpabuf_len(report));
6526         if (!buf) {
6527                 wpabuf_free(report);
6528                 return;
6529         }
6530
6531         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6532         wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
6533         wpabuf_put_u8(buf, token);
6534
6535         wpabuf_put_buf(buf, report);
6536         wpabuf_free(report);
6537
6538         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6539                                 wpa_s->own_addr, wpa_s->bssid,
6540                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6541                 wpa_printf(MSG_ERROR,
6542                            "RRM: Radio measurement report failed: Sending Action frame failed");
6543         }
6544         wpabuf_free(buf);
6545 }
6546
6547
6548 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6549                                               const u8 *src,
6550                                               const u8 *frame, size_t len,
6551                                               int rssi)
6552 {
6553         struct wpabuf *buf;
6554         const struct rrm_link_measurement_request *req;
6555         struct rrm_link_measurement_report report;
6556
6557         if (wpa_s->wpa_state != WPA_COMPLETED) {
6558                 wpa_printf(MSG_INFO,
6559                            "RRM: Ignoring link measurement request. Not associated");
6560                 return;
6561         }
6562
6563         if (!wpa_s->rrm.rrm_used) {
6564                 wpa_printf(MSG_INFO,
6565                            "RRM: Ignoring link measurement request. Not RRM network");
6566                 return;
6567         }
6568
6569         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6570                 wpa_printf(MSG_INFO,
6571                            "RRM: Measurement report failed. TX power insertion not supported");
6572                 return;
6573         }
6574
6575         req = (const struct rrm_link_measurement_request *) frame;
6576         if (len < sizeof(*req)) {
6577                 wpa_printf(MSG_INFO,
6578                            "RRM: Link measurement report failed. Request too short");
6579                 return;
6580         }
6581
6582         os_memset(&report, 0, sizeof(report));
6583         report.tpc.eid = WLAN_EID_TPC_REPORT;
6584         report.tpc.len = 2;
6585         report.rsni = 255; /* 255 indicates that RSNI is not available */
6586         report.dialog_token = req->dialog_token;
6587
6588         /*
6589          * It's possible to estimate RCPI based on RSSI in dBm. This
6590          * calculation will not reflect the correct value for high rates,
6591          * but it's good enough for Action frames which are transmitted
6592          * with up to 24 Mbps rates.
6593          */
6594         if (!rssi)
6595                 report.rcpi = 255; /* not available */
6596         else if (rssi < -110)
6597                 report.rcpi = 0;
6598         else if (rssi > 0)
6599                 report.rcpi = 220;
6600         else
6601                 report.rcpi = (rssi + 110) * 2;
6602
6603         /* action_category + action_code */
6604         buf = wpabuf_alloc(2 + sizeof(report));
6605         if (buf == NULL) {
6606                 wpa_printf(MSG_ERROR,
6607                            "RRM: Link measurement report failed. Buffer allocation failed");
6608                 return;
6609         }
6610
6611         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6612         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6613         wpabuf_put_data(buf, &report, sizeof(report));
6614         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6615                     wpabuf_head(buf), wpabuf_len(buf));
6616
6617         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6618                                 wpa_s->own_addr, wpa_s->bssid,
6619                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6620                 wpa_printf(MSG_ERROR,
6621                            "RRM: Link measurement report failed. Send action failed");
6622         }
6623         wpabuf_free(buf);
6624 }
6625
6626
6627 struct wpa_supplicant *
6628 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6629 {
6630         switch (frame) {
6631 #ifdef CONFIG_P2P
6632         case VENDOR_ELEM_PROBE_REQ_P2P:
6633         case VENDOR_ELEM_PROBE_RESP_P2P:
6634         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6635         case VENDOR_ELEM_BEACON_P2P_GO:
6636         case VENDOR_ELEM_P2P_PD_REQ:
6637         case VENDOR_ELEM_P2P_PD_RESP:
6638         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6639         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6640         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6641         case VENDOR_ELEM_P2P_INV_REQ:
6642         case VENDOR_ELEM_P2P_INV_RESP:
6643         case VENDOR_ELEM_P2P_ASSOC_REQ:
6644         case VENDOR_ELEM_P2P_ASSOC_RESP:
6645                 return wpa_s->p2pdev;
6646 #endif /* CONFIG_P2P */
6647         default:
6648                 return wpa_s;
6649         }
6650 }
6651
6652
6653 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6654 {
6655         unsigned int i;
6656         char buf[30];
6657
6658         wpa_printf(MSG_DEBUG, "Update vendor elements");
6659
6660         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6661                 if (wpa_s->vendor_elem[i]) {
6662                         int res;
6663
6664                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6665                         if (!os_snprintf_error(sizeof(buf), res)) {
6666                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6667                                                 wpa_s->vendor_elem[i]);
6668                         }
6669                 }
6670         }
6671
6672 #ifdef CONFIG_P2P
6673         if (wpa_s->parent == wpa_s &&
6674             wpa_s->global->p2p &&
6675             !wpa_s->global->p2p_disabled)
6676                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6677 #endif /* CONFIG_P2P */
6678 }
6679
6680
6681 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6682                             const u8 *elem, size_t len)
6683 {
6684         u8 *ie, *end;
6685
6686         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6687         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6688
6689         for (; ie + 1 < end; ie += 2 + ie[1]) {
6690                 if (ie + len > end)
6691                         break;
6692                 if (os_memcmp(ie, elem, len) != 0)
6693                         continue;
6694
6695                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6696                         wpabuf_free(wpa_s->vendor_elem[frame]);
6697                         wpa_s->vendor_elem[frame] = NULL;
6698                 } else {
6699                         os_memmove(ie, ie + len, end - (ie + len));
6700                         wpa_s->vendor_elem[frame]->used -= len;
6701                 }
6702                 wpas_vendor_elem_update(wpa_s);
6703                 return 0;
6704         }
6705
6706         return -1;
6707 }
6708
6709
6710 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6711                                    u16 num_modes, enum hostapd_hw_mode mode)
6712 {
6713         u16 i;
6714
6715         for (i = 0; i < num_modes; i++) {
6716                 if (modes[i].mode == mode)
6717                         return &modes[i];
6718         }
6719
6720         return NULL;
6721 }
6722
6723
6724 static struct
6725 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6726                                                  const u8 *bssid)
6727 {
6728         struct wpa_bss_tmp_disallowed *bss;
6729
6730         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6731                          struct wpa_bss_tmp_disallowed, list) {
6732                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6733                         return bss;
6734         }
6735
6736         return NULL;
6737 }
6738
6739
6740 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6741                           unsigned int sec)
6742 {
6743         struct wpa_bss_tmp_disallowed *bss;
6744         struct os_reltime until;
6745
6746         os_get_reltime(&until);
6747         until.sec += sec;
6748
6749         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6750         if (bss) {
6751                 bss->disallowed_until = until;
6752                 return;
6753         }
6754
6755         bss = os_malloc(sizeof(*bss));
6756         if (!bss) {
6757                 wpa_printf(MSG_DEBUG,
6758                            "Failed to allocate memory for temp disallow BSS");
6759                 return;
6760         }
6761
6762         bss->disallowed_until = until;
6763         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6764         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6765 }
6766
6767
6768 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6769 {
6770         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6771         struct os_reltime now, age;
6772
6773         os_get_reltime(&now);
6774
6775         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6776                          struct wpa_bss_tmp_disallowed, list) {
6777                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6778                         /* This BSS is not disallowed anymore */
6779                         dl_list_del(&tmp->list);
6780                         os_free(tmp);
6781                         continue;
6782                 }
6783                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6784                         bss = tmp;
6785                         break;
6786                 }
6787         }
6788         if (!bss)
6789                 return 0;
6790
6791         os_reltime_sub(&bss->disallowed_until, &now, &age);
6792         wpa_printf(MSG_DEBUG,
6793                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6794                    MAC2STR(bss->bssid), age.sec, age.usec);
6795         return 1;
6796 }