wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (is_zero_ether_addr(bssid))
 196                 bssid = wpa_s->pending_bssid;
 197         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 198                 MAC2STR(bssid));
 199         wpa_blacklist_add(wpa_s, bssid);
 200         wpa_sm_notify_disassoc(wpa_s->wpa);
 201         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 202         wpa_s->reassociate = 1;
 203
 204         /*
 205          * If we timed out, the AP or the local radio may be busy.
 206          * So, wait a second until scanning again.
 207          */
 208         wpa_supplicant_req_scan(wpa_s, 1, 0);
 209 }
 210
 211
 212 /**
 213  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 214  * @wpa_s: Pointer to wpa_supplicant data
 215  * @sec: Number of seconds after which to time out authentication
 216  * @usec: Number of microseconds after which to time out authentication
 217  *
 218  * This function is used to schedule a timeout for the current authentication
 219  * attempt.
 220  */
 221 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 222                                      int sec, int usec)
 223 {
 224         if (wpa_s->conf->ap_scan == 0 &&
 225             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 226                 return;
 227
 228         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 229                 "%d usec", sec, usec);
 230         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 231         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 232 }
 233
 234
 235 /**
 236  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 237  * @wpa_s: Pointer to wpa_supplicant data
 238  *
 239  * This function is used to cancel authentication timeout scheduled with
 240  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 241  * been completed.
 242  */
 243 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 244 {
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 246         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 247         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 248 }
 249
 250
 251 /**
 252  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 253  * @wpa_s: Pointer to wpa_supplicant data
 254  *
 255  * This function is used to configure EAPOL state machine based on the selected
 256  * authentication mode.
 257  */
 258 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 259 {
 260 #ifdef IEEE8021X_EAPOL
 261         struct eapol_config eapol_conf;
 262         struct wpa_ssid *ssid = wpa_s->current_ssid;
 263
 264 #ifdef CONFIG_IBSS_RSN
 265         if (ssid->mode == WPAS_MODE_IBSS &&
 266             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 267             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 268                 /*
 269                  * RSN IBSS authentication is per-STA and we can disable the
 270                  * per-BSSID EAPOL authentication.
 271                  */
 272                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 273                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 274                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 275                 return;
 276         }
 277 #endif /* CONFIG_IBSS_RSN */
 278
 279         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 280         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 281
 282         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 283             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 284                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 285         else
 286                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 287
 288         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 289         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 290                 eapol_conf.accept_802_1x_keys = 1;
 291                 eapol_conf.required_keys = 0;
 292                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 293                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 294                 }
 295                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 296                         eapol_conf.required_keys |=
 297                                 EAPOL_REQUIRE_KEY_BROADCAST;
 298                 }
 299
 300                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 301                         eapol_conf.required_keys = 0;
 302         }
 303         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 304         eapol_conf.workaround = ssid->eap_workaround;
 305         eapol_conf.eap_disabled =
 306                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 307                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 308                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 309         eapol_conf.external_sim = wpa_s->conf->external_sim;
 310
 311 #ifdef CONFIG_WPS
 312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 313                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 314                 if (wpa_s->current_bss) {
 315                         struct wpabuf *ie;
 316                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 317                                                          WPS_IE_VENDOR_TYPE);
 318                         if (ie) {
 319                                 if (wps_is_20(ie))
 320                                         eapol_conf.wps |=
 321                                                 EAPOL_PEER_IS_WPS20_AP;
 322                                 wpabuf_free(ie);
 323                         }
 324                 }
 325         }
 326 #endif /* CONFIG_WPS */
 327
 328         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 329
 330         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 331 #endif /* IEEE8021X_EAPOL */
 332 }
 333
 334
 335 /**
 336  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 337  * @wpa_s: Pointer to wpa_supplicant data
 338  * @ssid: Configuration data for the network
 339  *
 340  * This function is used to configure WPA state machine and related parameters
 341  * to a mode where WPA is not enabled. This is called as part of the
 342  * authentication configuration when the selected network does not use WPA.
 343  */
 344 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 345                                        struct wpa_ssid *ssid)
 346 {
 347         int i;
 348
 349         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 351         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 353         else
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 355         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 356         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 357         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 359         wpa_s->group_cipher = WPA_CIPHER_NONE;
 360         wpa_s->mgmt_group_cipher = 0;
 361
 362         for (i = 0; i < NUM_WEP_KEYS; i++) {
 363                 if (ssid->wep_key_len[i] > 5) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 366                         break;
 367                 } else if (ssid->wep_key_len[i] > 0) {
 368                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 369                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 370                         break;
 371                 }
 372         }
 373
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 377                          wpa_s->pairwise_cipher);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 379 #ifdef CONFIG_IEEE80211W
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 381                          wpa_s->mgmt_group_cipher);
 382 #endif /* CONFIG_IEEE80211W */
 383
 384         pmksa_cache_clear_current(wpa_s->wpa);
 385 }
 386
 387
 388 void free_hw_features(struct wpa_supplicant *wpa_s)
 389 {
 390         int i;
 391         if (wpa_s->hw.modes == NULL)
 392                 return;
 393
 394         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 395                 os_free(wpa_s->hw.modes[i].channels);
 396                 os_free(wpa_s->hw.modes[i].rates);
 397         }
 398
 399         os_free(wpa_s->hw.modes);
 400         wpa_s->hw.modes = NULL;
 401 }
 402
 403
 404 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 405 {
 406         struct wpa_bss_tmp_disallowed *bss, *prev;
 407
 408         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 409                               struct wpa_bss_tmp_disallowed, list) {
 410                 dl_list_del(&bss->list);
 411                 os_free(bss);
 412         }
 413 }
 414
 415
 416 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 417 {
 418         int i;
 419
 420         bgscan_deinit(wpa_s);
 421         autoscan_deinit(wpa_s);
 422         scard_deinit(wpa_s->scard);
 423         wpa_s->scard = NULL;
 424         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 425         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 426         l2_packet_deinit(wpa_s->l2);
 427         wpa_s->l2 = NULL;
 428         if (wpa_s->l2_br) {
 429                 l2_packet_deinit(wpa_s->l2_br);
 430                 wpa_s->l2_br = NULL;
 431         }
 432 #ifdef CONFIG_TESTING_OPTIONS
 433         l2_packet_deinit(wpa_s->l2_test);
 434         wpa_s->l2_test = NULL;
 435 #endif /* CONFIG_TESTING_OPTIONS */
 436
 437         if (wpa_s->conf != NULL) {
 438                 struct wpa_ssid *ssid;
 439                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 440                         wpas_notify_network_removed(wpa_s, ssid);
 441         }
 442
 443         os_free(wpa_s->confname);
 444         wpa_s->confname = NULL;
 445
 446         os_free(wpa_s->confanother);
 447         wpa_s->confanother = NULL;
 448
 449         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 450         eapol_sm_deinit(wpa_s->eapol);
 451         wpa_s->eapol = NULL;
 452
 453         rsn_preauth_deinit(wpa_s->wpa);
 454
 455 #ifdef CONFIG_TDLS
 456         wpa_tdls_deinit(wpa_s->wpa);
 457 #endif /* CONFIG_TDLS */
 458
 459         wmm_ac_clear_saved_tspecs(wpa_s);
 460         pmksa_candidate_free(wpa_s->wpa);
 461         wpa_sm_deinit(wpa_s->wpa);
 462         wpa_s->wpa = NULL;
 463         wpa_blacklist_clear(wpa_s);
 464
 465         wpa_bss_deinit(wpa_s);
 466
 467         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 468         wpa_supplicant_cancel_scan(wpa_s);
 469         wpa_supplicant_cancel_auth_timeout(wpa_s);
 470         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 471 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 472         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 473                              wpa_s, NULL);
 474 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 475
 476         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 477
 478         wpas_wps_deinit(wpa_s);
 479
 480         wpabuf_free(wpa_s->pending_eapol_rx);
 481         wpa_s->pending_eapol_rx = NULL;
 482
 483 #ifdef CONFIG_IBSS_RSN
 484         ibss_rsn_deinit(wpa_s->ibss_rsn);
 485         wpa_s->ibss_rsn = NULL;
 486 #endif /* CONFIG_IBSS_RSN */
 487
 488         sme_deinit(wpa_s);
 489
 490 #ifdef CONFIG_AP
 491         wpa_supplicant_ap_deinit(wpa_s);
 492 #endif /* CONFIG_AP */
 493
 494         wpas_p2p_deinit(wpa_s);
 495
 496 #ifdef CONFIG_OFFCHANNEL
 497         offchannel_deinit(wpa_s);
 498 #endif /* CONFIG_OFFCHANNEL */
 499
 500         wpa_supplicant_cancel_sched_scan(wpa_s);
 501
 502         os_free(wpa_s->next_scan_freqs);
 503         wpa_s->next_scan_freqs = NULL;
 504
 505         os_free(wpa_s->manual_scan_freqs);
 506         wpa_s->manual_scan_freqs = NULL;
 507
 508         os_free(wpa_s->manual_sched_scan_freqs);
 509         wpa_s->manual_sched_scan_freqs = NULL;
 510
 511         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 512
 513         /*
 514          * Need to remove any pending gas-query radio work before the
 515          * gas_query_deinit() call because gas_query::work has not yet been set
 516          * for works that have not been started. gas_query_free() will be unable
 517          * to cancel such pending radio works and once the pending gas-query
 518          * radio work eventually gets removed, the deinit notification call to
 519          * gas_query_start_cb() would result in dereferencing freed memory.
 520          */
 521         if (wpa_s->radio)
 522                 radio_remove_works(wpa_s, "gas-query", 0);
 523         gas_query_deinit(wpa_s->gas);
 524         wpa_s->gas = NULL;
 525
 526         free_hw_features(wpa_s);
 527
 528         ieee802_1x_dealloc_kay_sm(wpa_s);
 529
 530         os_free(wpa_s->bssid_filter);
 531         wpa_s->bssid_filter = NULL;
 532
 533         os_free(wpa_s->disallow_aps_bssid);
 534         wpa_s->disallow_aps_bssid = NULL;
 535         os_free(wpa_s->disallow_aps_ssid);
 536         wpa_s->disallow_aps_ssid = NULL;
 537
 538         wnm_bss_keep_alive_deinit(wpa_s);
 539 #ifdef CONFIG_WNM
 540         wnm_deallocate_memory(wpa_s);
 541 #endif /* CONFIG_WNM */
 542
 543         ext_password_deinit(wpa_s->ext_pw);
 544         wpa_s->ext_pw = NULL;
 545
 546         wpabuf_free(wpa_s->last_gas_resp);
 547         wpa_s->last_gas_resp = NULL;
 548         wpabuf_free(wpa_s->prev_gas_resp);
 549         wpa_s->prev_gas_resp = NULL;
 550
 551         os_free(wpa_s->last_scan_res);
 552         wpa_s->last_scan_res = NULL;
 553
 554 #ifdef CONFIG_HS20
 555         if (wpa_s->drv_priv)
 556                 wpa_drv_configure_frame_filters(wpa_s, 0);
 557         hs20_deinit(wpa_s);
 558 #endif /* CONFIG_HS20 */
 559
 560         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 561                 wpabuf_free(wpa_s->vendor_elem[i]);
 562                 wpa_s->vendor_elem[i] = NULL;
 563         }
 564
 565         wmm_ac_notify_disassoc(wpa_s);
 566
 567         wpa_s->sched_scan_plans_num = 0;
 568         os_free(wpa_s->sched_scan_plans);
 569         wpa_s->sched_scan_plans = NULL;
 570
 571 #ifdef CONFIG_MBO
 572         wpa_s->non_pref_chan_num = 0;
 573         os_free(wpa_s->non_pref_chan);
 574         wpa_s->non_pref_chan = NULL;
 575 #endif /* CONFIG_MBO */
 576
 577         free_bss_tmp_disallowed(wpa_s);
 578 }
 579
 580
 581 /**
 582  * wpa_clear_keys - Clear keys configured for the driver
 583  * @wpa_s: Pointer to wpa_supplicant data
 584  * @addr: Previously used BSSID or %NULL if not available
 585  *
 586  * This function clears the encryption keys that has been previously configured
 587  * for the driver.
 588  */
 589 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 590 {
 591         int i, max;
 592
 593 #ifdef CONFIG_IEEE80211W
 594         max = 6;
 595 #else /* CONFIG_IEEE80211W */
 596         max = 4;
 597 #endif /* CONFIG_IEEE80211W */
 598
 599         /* MLME-DELETEKEYS.request */
 600         for (i = 0; i < max; i++) {
 601                 if (wpa_s->keys_cleared & BIT(i))
 602                         continue;
 603                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 604                                 NULL, 0);
 605         }
 606         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 607             !is_zero_ether_addr(addr)) {
 608                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 609                                 0);
 610                 /* MLME-SETPROTECTION.request(None) */
 611                 wpa_drv_mlme_setprotection(
 612                         wpa_s, addr,
 613                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 614                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 615         }
 616         wpa_s->keys_cleared = (u32) -1;
 617 }
 618
 619
 620 /**
 621  * wpa_supplicant_state_txt - Get the connection state name as a text string
 622  * @state: State (wpa_state; WPA_*)
 623  * Returns: The state name as a printable text string
 624  */
 625 const char * wpa_supplicant_state_txt(enum wpa_states state)
 626 {
 627         switch (state) {
 628         case WPA_DISCONNECTED:
 629                 return "DISCONNECTED";
 630         case WPA_INACTIVE:
 631                 return "INACTIVE";
 632         case WPA_INTERFACE_DISABLED:
 633                 return "INTERFACE_DISABLED";
 634         case WPA_SCANNING:
 635                 return "SCANNING";
 636         case WPA_AUTHENTICATING:
 637                 return "AUTHENTICATING";
 638         case WPA_ASSOCIATING:
 639                 return "ASSOCIATING";
 640         case WPA_ASSOCIATED:
 641                 return "ASSOCIATED";
 642         case WPA_4WAY_HANDSHAKE:
 643                 return "4WAY_HANDSHAKE";
 644         case WPA_GROUP_HANDSHAKE:
 645                 return "GROUP_HANDSHAKE";
 646         case WPA_COMPLETED:
 647                 return "COMPLETED";
 648         default:
 649                 return "UNKNOWN";
 650         }
 651 }
 652
 653
 654 #ifdef CONFIG_BGSCAN
 655
 656 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 657 {
 658         const char *name;
 659
 660         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 661                 name = wpa_s->current_ssid->bgscan;
 662         else
 663                 name = wpa_s->conf->bgscan;
 664         if (name == NULL || name[0] == '\0')
 665                 return;
 666         if (wpas_driver_bss_selection(wpa_s))
 667                 return;
 668         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 669                 return;
 670 #ifdef CONFIG_P2P
 671         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 672                 return;
 673 #endif /* CONFIG_P2P */
 674
 675         bgscan_deinit(wpa_s);
 676         if (wpa_s->current_ssid) {
 677                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 678                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 679                                 "bgscan");
 680                         /*
 681                          * Live without bgscan; it is only used as a roaming
 682                          * optimization, so the initial connection is not
 683                          * affected.
 684                          */
 685                 } else {
 686                         struct wpa_scan_results *scan_res;
 687                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 688                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 689                                                                    0);
 690                         if (scan_res) {
 691                                 bgscan_notify_scan(wpa_s, scan_res);
 692                                 wpa_scan_results_free(scan_res);
 693                         }
 694                 }
 695         } else
 696                 wpa_s->bgscan_ssid = NULL;
 697 }
 698
 699
 700 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 701 {
 702         if (wpa_s->bgscan_ssid != NULL) {
 703                 bgscan_deinit(wpa_s);
 704                 wpa_s->bgscan_ssid = NULL;
 705         }
 706 }
 707
 708 #endif /* CONFIG_BGSCAN */
 709
 710
 711 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 712 {
 713         if (autoscan_init(wpa_s, 0))
 714                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 715 }
 716
 717
 718 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 719 {
 720         autoscan_deinit(wpa_s);
 721 }
 722
 723
 724 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 725 {
 726         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 727             wpa_s->wpa_state == WPA_SCANNING) {
 728                 autoscan_deinit(wpa_s);
 729                 wpa_supplicant_start_autoscan(wpa_s);
 730         }
 731 }
 732
 733
 734 /**
 735  * wpa_supplicant_set_state - Set current connection state
 736  * @wpa_s: Pointer to wpa_supplicant data
 737  * @state: The new connection state
 738  *
 739  * This function is called whenever the connection state changes, e.g.,
 740  * association is completed for WPA/WPA2 4-Way Handshake is started.
 741  */
 742 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 743                               enum wpa_states state)
 744 {
 745         enum wpa_states old_state = wpa_s->wpa_state;
 746
 747         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 748                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 749                 wpa_supplicant_state_txt(state));
 750
 751         if (state == WPA_INTERFACE_DISABLED) {
 752                 /* Assure normal scan when interface is restored */
 753                 wpa_s->normal_scans = 0;
 754         }
 755
 756         if (state == WPA_COMPLETED) {
 757                 wpas_connect_work_done(wpa_s);
 758                 /* Reinitialize normal_scan counter */
 759                 wpa_s->normal_scans = 0;
 760         }
 761
 762 #ifdef CONFIG_P2P
 763         /*
 764          * P2PS client has to reply to Probe Request frames received on the
 765          * group operating channel. Enable Probe Request frame reporting for
 766          * P2P connected client in case p2p_cli_probe configuration property is
 767          * set to 1.
 768          */
 769         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 770             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 771             wpa_s->current_ssid->p2p_group) {
 772                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 773                         wpa_dbg(wpa_s, MSG_DEBUG,
 774                                 "P2P: Enable CLI Probe Request RX reporting");
 775                         wpa_s->p2p_cli_probe =
 776                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 777                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 778                         wpa_dbg(wpa_s, MSG_DEBUG,
 779                                 "P2P: Disable CLI Probe Request RX reporting");
 780                         wpa_s->p2p_cli_probe = 0;
 781                         wpa_drv_probe_req_report(wpa_s, 0);
 782                 }
 783         }
 784 #endif /* CONFIG_P2P */
 785
 786         if (state != WPA_SCANNING)
 787                 wpa_supplicant_notify_scanning(wpa_s, 0);
 788
 789         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 790                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 791 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 792                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 793                         MACSTR " completed [id=%d id_str=%s]",
 794                         MAC2STR(wpa_s->bssid),
 795                         ssid ? ssid->id : -1,
 796                         ssid && ssid->id_str ? ssid->id_str : "");
 797 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 798                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 799                 wpa_blacklist_clear(wpa_s);
 800                 wpa_s->extra_blacklist_count = 0;
 801                 wpa_s->new_connection = 0;
 802                 wpa_drv_set_operstate(wpa_s, 1);
 803 #ifndef IEEE8021X_EAPOL
 804                 wpa_drv_set_supp_port(wpa_s, 1);
 805 #endif /* IEEE8021X_EAPOL */
 806                 wpa_s->after_wps = 0;
 807                 wpa_s->known_wps_freq = 0;
 808                 wpas_p2p_completed(wpa_s);
 809
 810                 sme_sched_obss_scan(wpa_s, 1);
 811         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 812                    state == WPA_ASSOCIATED) {
 813                 wpa_s->new_connection = 1;
 814                 wpa_drv_set_operstate(wpa_s, 0);
 815 #ifndef IEEE8021X_EAPOL
 816                 wpa_drv_set_supp_port(wpa_s, 0);
 817 #endif /* IEEE8021X_EAPOL */
 818                 sme_sched_obss_scan(wpa_s, 0);
 819         }
 820         wpa_s->wpa_state = state;
 821
 822 #ifdef CONFIG_BGSCAN
 823         if (state == WPA_COMPLETED)
 824                 wpa_supplicant_start_bgscan(wpa_s);
 825         else if (state < WPA_ASSOCIATED)
 826                 wpa_supplicant_stop_bgscan(wpa_s);
 827 #endif /* CONFIG_BGSCAN */
 828
 829         if (state == WPA_AUTHENTICATING)
 830                 wpa_supplicant_stop_autoscan(wpa_s);
 831
 832         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 833                 wpa_supplicant_start_autoscan(wpa_s);
 834
 835         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 836                 wmm_ac_notify_disassoc(wpa_s);
 837
 838         if (wpa_s->wpa_state != old_state) {
 839                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 840
 841                 /*
 842                  * Notify the P2P Device interface about a state change in one
 843                  * of the interfaces.
 844                  */
 845                 wpas_p2p_indicate_state_change(wpa_s);
 846
 847                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 848                     old_state == WPA_COMPLETED)
 849                         wpas_notify_auth_changed(wpa_s);
 850         }
 851 }
 852
 853
 854 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 855 {
 856         int pending = 0;
 857 #ifdef CONFIG_WPS
 858         struct wpa_supplicant *wpa_s = global->ifaces;
 859         while (wpa_s) {
 860                 struct wpa_supplicant *next = wpa_s->next;
 861                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 862                         pending = 1;
 863 #ifdef CONFIG_P2P
 864                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 865                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 866                         wpas_p2p_disconnect(wpa_s);
 867 #endif /* CONFIG_P2P */
 868                 wpa_s = next;
 869         }
 870 #endif /* CONFIG_WPS */
 871         if (pending)
 872                 return;
 873         eloop_terminate();
 874 }
 875
 876
 877 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 878 {
 879         struct wpa_global *global = signal_ctx;
 880         wpa_supplicant_terminate_proc(global);
 881 }
 882
 883
 884 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 885 {
 886         enum wpa_states old_state = wpa_s->wpa_state;
 887
 888         wpa_s->pairwise_cipher = 0;
 889         wpa_s->group_cipher = 0;
 890         wpa_s->mgmt_group_cipher = 0;
 891         wpa_s->key_mgmt = 0;
 892         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 893                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 894
 895         if (wpa_s->wpa_state != old_state)
 896                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 897 }
 898
 899
 900 /**
 901  * wpa_supplicant_reload_configuration - Reload configuration data
 902  * @wpa_s: Pointer to wpa_supplicant data
 903  * Returns: 0 on success or -1 if configuration parsing failed
 904  *
 905  * This function can be used to request that the configuration data is reloaded
 906  * (e.g., after configuration file change). This function is reloading
 907  * configuration only for one interface, so this may need to be called multiple
 908  * times if %wpa_supplicant is controlling multiple interfaces and all
 909  * interfaces need reconfiguration.
 910  */
 911 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 912 {
 913         struct wpa_config *conf;
 914         int reconf_ctrl;
 915         int old_ap_scan;
 916
 917         if (wpa_s->confname == NULL)
 918                 return -1;
 919         conf = wpa_config_read(wpa_s->confname, NULL);
 920         if (conf == NULL) {
 921                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 922                         "file '%s' - exiting", wpa_s->confname);
 923                 return -1;
 924         }
 925         wpa_config_read(wpa_s->confanother, conf);
 926
 927         conf->changed_parameters = (unsigned int) -1;
 928
 929         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 930                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 931                     os_strcmp(conf->ctrl_interface,
 932                               wpa_s->conf->ctrl_interface) != 0);
 933
 934         if (reconf_ctrl && wpa_s->ctrl_iface) {
 935                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 936                 wpa_s->ctrl_iface = NULL;
 937         }
 938
 939         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 940         if (wpa_s->current_ssid) {
 941                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 942                         wpa_s->own_disconnect_req = 1;
 943                 wpa_supplicant_deauthenticate(wpa_s,
 944                                               WLAN_REASON_DEAUTH_LEAVING);
 945         }
 946
 947         /*
 948          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 949          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 950          */
 951         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 952                 /*
 953                  * Clear forced success to clear EAP state for next
 954                  * authentication.
 955                  */
 956                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 957         }
 958         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 959         wpa_sm_set_config(wpa_s->wpa, NULL);
 960         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 961         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 962         rsn_preauth_deinit(wpa_s->wpa);
 963
 964         old_ap_scan = wpa_s->conf->ap_scan;
 965         wpa_config_free(wpa_s->conf);
 966         wpa_s->conf = conf;
 967         if (old_ap_scan != wpa_s->conf->ap_scan)
 968                 wpas_notify_ap_scan_changed(wpa_s);
 969
 970         if (reconf_ctrl)
 971                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 972
 973         wpa_supplicant_update_config(wpa_s);
 974
 975         wpa_supplicant_clear_status(wpa_s);
 976         if (wpa_supplicant_enabled_networks(wpa_s)) {
 977                 wpa_s->reassociate = 1;
 978                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 979         }
 980         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 981         return 0;
 982 }
 983
 984
 985 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 986 {
 987         struct wpa_global *global = signal_ctx;
 988         struct wpa_supplicant *wpa_s;
 989         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 990                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 991                         sig);
 992                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 993                         wpa_supplicant_terminate_proc(global);
 994                 }
 995         }
 996
 997         if (wpa_debug_reopen_file() < 0) {
 998                 /* Ignore errors since we cannot really do much to fix this */
 999                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1000         }
1001 }
1002
1003
1004 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1005                                          struct wpa_ssid *ssid,
1006                                          struct wpa_ie_data *ie)
1007 {
1008         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1009         if (ret) {
1010                 if (ret == -2) {
1011                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1012                                 "from association info");
1013                 }
1014                 return -1;
1015         }
1016
1017         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1018                 "cipher suites");
1019         if (!(ie->group_cipher & ssid->group_cipher)) {
1020                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1021                         "cipher 0x%x (mask 0x%x) - reject",
1022                         ie->group_cipher, ssid->group_cipher);
1023                 return -1;
1024         }
1025         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1026                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1027                         "cipher 0x%x (mask 0x%x) - reject",
1028                         ie->pairwise_cipher, ssid->pairwise_cipher);
1029                 return -1;
1030         }
1031         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1032                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1033                         "management 0x%x (mask 0x%x) - reject",
1034                         ie->key_mgmt, ssid->key_mgmt);
1035                 return -1;
1036         }
1037
1038 #ifdef CONFIG_IEEE80211W
1039         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1040             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1041                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1042                         "that does not support management frame protection - "
1043                         "reject");
1044                 return -1;
1045         }
1046 #endif /* CONFIG_IEEE80211W */
1047
1048         return 0;
1049 }
1050
1051
1052 /**
1053  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1054  * @wpa_s: Pointer to wpa_supplicant data
1055  * @bss: Scan results for the selected BSS, or %NULL if not available
1056  * @ssid: Configuration data for the selected network
1057  * @wpa_ie: Buffer for the WPA/RSN IE
1058  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1059  * used buffer length in case the functions returns success.
1060  * Returns: 0 on success or -1 on failure
1061  *
1062  * This function is used to configure authentication and encryption parameters
1063  * based on the network configuration and scan result for the selected BSS (if
1064  * available).
1065  */
1066 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1067                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1068                               u8 *wpa_ie, size_t *wpa_ie_len)
1069 {
1070         struct wpa_ie_data ie;
1071         int sel, proto;
1072         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1073
1074         if (bss) {
1075                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1076                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1077                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1078         } else
1079                 bss_wpa = bss_rsn = bss_osen = NULL;
1080
1081         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1082             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1083             (ie.group_cipher & ssid->group_cipher) &&
1084             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1085             (ie.key_mgmt & ssid->key_mgmt)) {
1086                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1087                 proto = WPA_PROTO_RSN;
1088         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1089                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1090                    (ie.group_cipher & ssid->group_cipher) &&
1091                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1092                    (ie.key_mgmt & ssid->key_mgmt)) {
1093                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1094                 proto = WPA_PROTO_WPA;
1095 #ifdef CONFIG_HS20
1096         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1097                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1098                 /* TODO: parse OSEN element */
1099                 os_memset(&ie, 0, sizeof(ie));
1100                 ie.group_cipher = WPA_CIPHER_CCMP;
1101                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1102                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1103                 proto = WPA_PROTO_OSEN;
1104 #endif /* CONFIG_HS20 */
1105         } else if (bss) {
1106                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1107                 wpa_dbg(wpa_s, MSG_DEBUG,
1108                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1109                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1110                         ssid->key_mgmt);
1111                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1112                         MAC2STR(bss->bssid),
1113                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1114                         bss_wpa ? " WPA" : "",
1115                         bss_rsn ? " RSN" : "",
1116                         bss_osen ? " OSEN" : "");
1117                 if (bss_rsn) {
1118                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1119                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1120                                 wpa_dbg(wpa_s, MSG_DEBUG,
1121                                         "Could not parse RSN element");
1122                         } else {
1123                                 wpa_dbg(wpa_s, MSG_DEBUG,
1124                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1125                                         ie.pairwise_cipher, ie.group_cipher,
1126                                         ie.key_mgmt);
1127                         }
1128                 }
1129                 if (bss_wpa) {
1130                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1131                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1132                                 wpa_dbg(wpa_s, MSG_DEBUG,
1133                                         "Could not parse WPA element");
1134                         } else {
1135                                 wpa_dbg(wpa_s, MSG_DEBUG,
1136                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1137                                         ie.pairwise_cipher, ie.group_cipher,
1138                                         ie.key_mgmt);
1139                         }
1140                 }
1141                 return -1;
1142         } else {
1143                 if (ssid->proto & WPA_PROTO_OSEN)
1144                         proto = WPA_PROTO_OSEN;
1145                 else if (ssid->proto & WPA_PROTO_RSN)
1146                         proto = WPA_PROTO_RSN;
1147                 else
1148                         proto = WPA_PROTO_WPA;
1149                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1150                         os_memset(&ie, 0, sizeof(ie));
1151                         ie.group_cipher = ssid->group_cipher;
1152                         ie.pairwise_cipher = ssid->pairwise_cipher;
1153                         ie.key_mgmt = ssid->key_mgmt;
1154 #ifdef CONFIG_IEEE80211W
1155                         ie.mgmt_group_cipher =
1156                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1157                                 WPA_CIPHER_AES_128_CMAC : 0;
1158 #endif /* CONFIG_IEEE80211W */
1159                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1160                                 "based on configuration");
1161                 } else
1162                         proto = ie.proto;
1163         }
1164
1165         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1166                 "pairwise %d key_mgmt %d proto %d",
1167                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1168 #ifdef CONFIG_IEEE80211W
1169         if (ssid->ieee80211w) {
1170                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1171                         ie.mgmt_group_cipher);
1172         }
1173 #endif /* CONFIG_IEEE80211W */
1174
1175         wpa_s->wpa_proto = proto;
1176         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1177         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1178                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1179
1180         if (bss || !wpa_s->ap_ies_from_associnfo) {
1181                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1182                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1183                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1184                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1185                         return -1;
1186         }
1187
1188 #ifdef CONFIG_NO_WPA
1189         wpa_s->group_cipher = WPA_CIPHER_NONE;
1190         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1191 #else /* CONFIG_NO_WPA */
1192         sel = ie.group_cipher & ssid->group_cipher;
1193         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1194         if (wpa_s->group_cipher < 0) {
1195                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1196                         "cipher");
1197                 return -1;
1198         }
1199         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1200                 wpa_cipher_txt(wpa_s->group_cipher));
1201
1202         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1203         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1204         if (wpa_s->pairwise_cipher < 0) {
1205                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1206                         "cipher");
1207                 return -1;
1208         }
1209         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1210                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1211 #endif /* CONFIG_NO_WPA */
1212
1213         sel = ie.key_mgmt & ssid->key_mgmt;
1214 #ifdef CONFIG_SAE
1215         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1216                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1217 #endif /* CONFIG_SAE */
1218         if (0) {
1219 #ifdef CONFIG_SUITEB192
1220         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1222                 wpa_dbg(wpa_s, MSG_DEBUG,
1223                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1224 #endif /* CONFIG_SUITEB192 */
1225 #ifdef CONFIG_SUITEB
1226         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1228                 wpa_dbg(wpa_s, MSG_DEBUG,
1229                         "WPA: using KEY_MGMT 802.1X with Suite B");
1230 #endif /* CONFIG_SUITEB */
1231 #ifdef CONFIG_IEEE80211R
1232         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1233                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1234                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1235         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1236                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1237                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1238 #endif /* CONFIG_IEEE80211R */
1239 #ifdef CONFIG_SAE
1240         } else if (sel & WPA_KEY_MGMT_SAE) {
1241                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1242                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1243         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1244                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1245                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1246 #endif /* CONFIG_SAE */
1247 #ifdef CONFIG_IEEE80211W
1248         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1249                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1250                 wpa_dbg(wpa_s, MSG_DEBUG,
1251                         "WPA: using KEY_MGMT 802.1X with SHA256");
1252         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1253                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1254                 wpa_dbg(wpa_s, MSG_DEBUG,
1255                         "WPA: using KEY_MGMT PSK with SHA256");
1256 #endif /* CONFIG_IEEE80211W */
1257         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1258                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1259                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1260         } else if (sel & WPA_KEY_MGMT_PSK) {
1261                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1262                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1263         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1264                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1266 #ifdef CONFIG_HS20
1267         } else if (sel & WPA_KEY_MGMT_OSEN) {
1268                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1269                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1270 #endif /* CONFIG_HS20 */
1271         } else {
1272                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1273                         "authenticated key management type");
1274                 return -1;
1275         }
1276
1277         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1278         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1279                          wpa_s->pairwise_cipher);
1280         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1281
1282 #ifdef CONFIG_IEEE80211W
1283         sel = ie.mgmt_group_cipher;
1284         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1285             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1286                 sel = 0;
1287         if (sel & WPA_CIPHER_AES_128_CMAC) {
1288                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1289                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1290                         "AES-128-CMAC");
1291         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1292                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1293                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1294                         "BIP-GMAC-128");
1295         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1296                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1297                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1298                         "BIP-GMAC-256");
1299         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1300                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1301                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1302                         "BIP-CMAC-256");
1303         } else {
1304                 wpa_s->mgmt_group_cipher = 0;
1305                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1306         }
1307         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1308                          wpa_s->mgmt_group_cipher);
1309         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1310                          wpas_get_ssid_pmf(wpa_s, ssid));
1311 #endif /* CONFIG_IEEE80211W */
1312
1313         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1314                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1315                 return -1;
1316         }
1317
1318         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1319                 int psk_set = 0;
1320
1321                 if (ssid->psk_set) {
1322                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1323                                        NULL);
1324                         psk_set = 1;
1325                 }
1326 #ifndef CONFIG_NO_PBKDF2
1327                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1328                     ssid->passphrase) {
1329                         u8 psk[PMK_LEN];
1330                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1331                                     4096, psk, PMK_LEN);
1332                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1333                                         psk, PMK_LEN);
1334                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1335                         psk_set = 1;
1336                         os_memset(psk, 0, sizeof(psk));
1337                 }
1338 #endif /* CONFIG_NO_PBKDF2 */
1339 #ifdef CONFIG_EXT_PASSWORD
1340                 if (ssid->ext_psk) {
1341                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1342                                                              ssid->ext_psk);
1343                         char pw_str[64 + 1];
1344                         u8 psk[PMK_LEN];
1345
1346                         if (pw == NULL) {
1347                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1348                                         "found from external storage");
1349                                 return -1;
1350                         }
1351
1352                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1353                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1354                                         "PSK length %d in external storage",
1355                                         (int) wpabuf_len(pw));
1356                                 ext_password_free(pw);
1357                                 return -1;
1358                         }
1359
1360                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1361                         pw_str[wpabuf_len(pw)] = '\0';
1362
1363 #ifndef CONFIG_NO_PBKDF2
1364                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1365                         {
1366                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1367                                             4096, psk, PMK_LEN);
1368                                 os_memset(pw_str, 0, sizeof(pw_str));
1369                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1370                                                 "external passphrase)",
1371                                                 psk, PMK_LEN);
1372                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1373                                                NULL);
1374                                 psk_set = 1;
1375                                 os_memset(psk, 0, sizeof(psk));
1376                         } else
1377 #endif /* CONFIG_NO_PBKDF2 */
1378                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1379                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1380                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1381                                                 "Invalid PSK hex string");
1382                                         os_memset(pw_str, 0, sizeof(pw_str));
1383                                         ext_password_free(pw);
1384                                         return -1;
1385                                 }
1386                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1387                                                NULL);
1388                                 psk_set = 1;
1389                                 os_memset(psk, 0, sizeof(psk));
1390                         } else {
1391                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1392                                         "PSK available");
1393                                 os_memset(pw_str, 0, sizeof(pw_str));
1394                                 ext_password_free(pw);
1395                                 return -1;
1396                         }
1397
1398                         os_memset(pw_str, 0, sizeof(pw_str));
1399                         ext_password_free(pw);
1400                 }
1401 #endif /* CONFIG_EXT_PASSWORD */
1402
1403                 if (!psk_set) {
1404                         wpa_msg(wpa_s, MSG_INFO,
1405                                 "No PSK available for association");
1406                         return -1;
1407                 }
1408         } else
1409                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1410
1411         return 0;
1412 }
1413
1414
1415 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1416 {
1417         *pos = 0x00;
1418
1419         switch (idx) {
1420         case 0: /* Bits 0-7 */
1421                 break;
1422         case 1: /* Bits 8-15 */
1423                 break;
1424         case 2: /* Bits 16-23 */
1425 #ifdef CONFIG_WNM
1426                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1427                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1428 #endif /* CONFIG_WNM */
1429                 break;
1430         case 3: /* Bits 24-31 */
1431 #ifdef CONFIG_WNM
1432                 *pos |= 0x02; /* Bit 25 - SSID List */
1433 #endif /* CONFIG_WNM */
1434 #ifdef CONFIG_INTERWORKING
1435                 if (wpa_s->conf->interworking)
1436                         *pos |= 0x80; /* Bit 31 - Interworking */
1437 #endif /* CONFIG_INTERWORKING */
1438                 break;
1439         case 4: /* Bits 32-39 */
1440 #ifdef CONFIG_INTERWORKING
1441                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1442                         *pos |= 0x01; /* Bit 32 - QoS Map */
1443 #endif /* CONFIG_INTERWORKING */
1444                 break;
1445         case 5: /* Bits 40-47 */
1446 #ifdef CONFIG_HS20
1447                 if (wpa_s->conf->hs20)
1448                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1449 #endif /* CONFIG_HS20 */
1450 #ifdef CONFIG_MBO
1451                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1452 #endif /* CONFIG_MBO */
1453                 break;
1454         case 6: /* Bits 48-55 */
1455                 break;
1456         }
1457 }
1458
1459
1460 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1461 {
1462         u8 *pos = buf;
1463         u8 len = 6, i;
1464
1465         if (len < wpa_s->extended_capa_len)
1466                 len = wpa_s->extended_capa_len;
1467         if (buflen < (size_t) len + 2) {
1468                 wpa_printf(MSG_INFO,
1469                            "Not enough room for building extended capabilities element");
1470                 return -1;
1471         }
1472
1473         *pos++ = WLAN_EID_EXT_CAPAB;
1474         *pos++ = len;
1475         for (i = 0; i < len; i++, pos++) {
1476                 wpas_ext_capab_byte(wpa_s, pos, i);
1477
1478                 if (i < wpa_s->extended_capa_len) {
1479                         *pos &= ~wpa_s->extended_capa_mask[i];
1480                         *pos |= wpa_s->extended_capa[i];
1481                 }
1482         }
1483
1484         while (len > 0 && buf[1 + len] == 0) {
1485                 len--;
1486                 buf[1] = len;
1487         }
1488         if (len == 0)
1489                 return 0;
1490
1491         return 2 + len;
1492 }
1493
1494
1495 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1496                           struct wpa_bss *test_bss)
1497 {
1498         struct wpa_bss *bss;
1499
1500         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1501                 if (bss == test_bss)
1502                         return 1;
1503         }
1504
1505         return 0;
1506 }
1507
1508
1509 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1510                            struct wpa_ssid *test_ssid)
1511 {
1512         struct wpa_ssid *ssid;
1513
1514         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1515                 if (ssid == test_ssid)
1516                         return 1;
1517         }
1518
1519         return 0;
1520 }
1521
1522
1523 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1524                         struct wpa_ssid *test_ssid)
1525 {
1526         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1527                 return 0;
1528
1529         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1530 }
1531
1532
1533 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1534 {
1535         if (cwork == NULL)
1536                 return;
1537         os_free(cwork);
1538 }
1539
1540
1541 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1542 {
1543         struct wpa_connect_work *cwork;
1544         struct wpa_radio_work *work = wpa_s->connect_work;
1545
1546         if (!work)
1547                 return;
1548
1549         wpa_s->connect_work = NULL;
1550         cwork = work->ctx;
1551         work->ctx = NULL;
1552         wpas_connect_work_free(cwork);
1553         radio_work_done(work);
1554 }
1555
1556
1557 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1558 {
1559         struct os_reltime now;
1560         u8 addr[ETH_ALEN];
1561
1562         os_get_reltime(&now);
1563         if (wpa_s->last_mac_addr_style == style &&
1564             wpa_s->last_mac_addr_change.sec != 0 &&
1565             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1566                                 wpa_s->conf->rand_addr_lifetime)) {
1567                 wpa_msg(wpa_s, MSG_DEBUG,
1568                         "Previously selected random MAC address has not yet expired");
1569                 return 0;
1570         }
1571
1572         switch (style) {
1573         case 1:
1574                 if (random_mac_addr(addr) < 0)
1575                         return -1;
1576                 break;
1577         case 2:
1578                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1579                 if (random_mac_addr_keep_oui(addr) < 0)
1580                         return -1;
1581                 break;
1582         default:
1583                 return -1;
1584         }
1585
1586         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1587                 wpa_msg(wpa_s, MSG_INFO,
1588                         "Failed to set random MAC address");
1589                 return -1;
1590         }
1591
1592         os_get_reltime(&wpa_s->last_mac_addr_change);
1593         wpa_s->mac_addr_changed = 1;
1594         wpa_s->last_mac_addr_style = style;
1595
1596         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1597                 wpa_msg(wpa_s, MSG_INFO,
1598                         "Could not update MAC address information");
1599                 return -1;
1600         }
1601
1602         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1603                 MAC2STR(addr));
1604
1605         return 0;
1606 }
1607
1608
1609 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1610 {
1611         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1612             !wpa_s->conf->preassoc_mac_addr)
1613                 return 0;
1614
1615         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1616 }
1617
1618
1619 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1620
1621 /**
1622  * wpa_supplicant_associate - Request association
1623  * @wpa_s: Pointer to wpa_supplicant data
1624  * @bss: Scan results for the selected BSS, or %NULL if not available
1625  * @ssid: Configuration data for the selected network
1626  *
1627  * This function is used to request %wpa_supplicant to associate with a BSS.
1628  */
1629 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1630                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1631 {
1632         struct wpa_connect_work *cwork;
1633         int rand_style;
1634
1635         wpa_s->own_disconnect_req = 0;
1636
1637         /*
1638          * If we are starting a new connection, any previously pending EAPOL
1639          * RX cannot be valid anymore.
1640          */
1641         wpabuf_free(wpa_s->pending_eapol_rx);
1642         wpa_s->pending_eapol_rx = NULL;
1643
1644         if (ssid->mac_addr == -1)
1645                 rand_style = wpa_s->conf->mac_addr;
1646         else
1647                 rand_style = ssid->mac_addr;
1648
1649         wmm_ac_clear_saved_tspecs(wpa_s);
1650         wpa_s->reassoc_same_bss = 0;
1651         wpa_s->reassoc_same_ess = 0;
1652
1653         if (wpa_s->last_ssid == ssid) {
1654                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1655                 wpa_s->reassoc_same_ess = 1;
1656                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1657                         wmm_ac_save_tspecs(wpa_s);
1658                         wpa_s->reassoc_same_bss = 1;
1659                 }
1660         } else if (rand_style > 0) {
1661                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1662                         return;
1663                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1664         } else if (wpa_s->mac_addr_changed) {
1665                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1666                         wpa_msg(wpa_s, MSG_INFO,
1667                                 "Could not restore permanent MAC address");
1668                         return;
1669                 }
1670                 wpa_s->mac_addr_changed = 0;
1671                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1672                         wpa_msg(wpa_s, MSG_INFO,
1673                                 "Could not update MAC address information");
1674                         return;
1675                 }
1676                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1677         }
1678         wpa_s->last_ssid = ssid;
1679
1680 #ifdef CONFIG_IBSS_RSN
1681         ibss_rsn_deinit(wpa_s->ibss_rsn);
1682         wpa_s->ibss_rsn = NULL;
1683 #endif /* CONFIG_IBSS_RSN */
1684
1685         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1686             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1687 #ifdef CONFIG_AP
1688                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1689                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1690                                 "mode");
1691                         return;
1692                 }
1693                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1694                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1695                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1696                                 wpas_p2p_ap_setup_failed(wpa_s);
1697                         return;
1698                 }
1699                 wpa_s->current_bss = bss;
1700 #else /* CONFIG_AP */
1701                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1702                         "the build");
1703 #endif /* CONFIG_AP */
1704                 return;
1705         }
1706
1707         if (ssid->mode == WPAS_MODE_MESH) {
1708 #ifdef CONFIG_MESH
1709                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1710                         wpa_msg(wpa_s, MSG_INFO,
1711                                 "Driver does not support mesh mode");
1712                         return;
1713                 }
1714                 if (bss)
1715                         ssid->frequency = bss->freq;
1716                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1717                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1718                         return;
1719                 }
1720                 wpa_s->current_bss = bss;
1721                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1722                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1723                         ssid->id);
1724 #else /* CONFIG_MESH */
1725                 wpa_msg(wpa_s, MSG_ERROR,
1726                         "mesh mode support not included in the build");
1727 #endif /* CONFIG_MESH */
1728                 return;
1729         }
1730
1731 #ifdef CONFIG_TDLS
1732         if (bss)
1733                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1734                                 bss->ie_len);
1735 #endif /* CONFIG_TDLS */
1736
1737         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1738             ssid->mode == IEEE80211_MODE_INFRA) {
1739                 sme_authenticate(wpa_s, bss, ssid);
1740                 return;
1741         }
1742
1743         if (wpa_s->connect_work) {
1744                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1745                 return;
1746         }
1747
1748         if (radio_work_pending(wpa_s, "connect")) {
1749                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1750                 return;
1751         }
1752
1753         wpas_abort_ongoing_scan(wpa_s);
1754
1755         cwork = os_zalloc(sizeof(*cwork));
1756         if (cwork == NULL)
1757                 return;
1758
1759         cwork->bss = bss;
1760         cwork->ssid = ssid;
1761
1762         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1763                            wpas_start_assoc_cb, cwork) < 0) {
1764                 os_free(cwork);
1765         }
1766 }
1767
1768
1769 static int bss_is_ibss(struct wpa_bss *bss)
1770 {
1771         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1772                 IEEE80211_CAP_IBSS;
1773 }
1774
1775
1776 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1777                             const struct wpa_ssid *ssid)
1778 {
1779         enum hostapd_hw_mode hw_mode;
1780         struct hostapd_hw_modes *mode = NULL;
1781         u8 channel;
1782         int i;
1783
1784 #ifdef CONFIG_HT_OVERRIDES
1785         if (ssid->disable_ht)
1786                 return 0;
1787 #endif /* CONFIG_HT_OVERRIDES */
1788
1789         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1790         if (hw_mode == NUM_HOSTAPD_MODES)
1791                 return 0;
1792         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1793                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1794                         mode = &wpa_s->hw.modes[i];
1795                         break;
1796                 }
1797         }
1798
1799         if (!mode)
1800                 return 0;
1801
1802         return mode->vht_capab != 0;
1803 }
1804
1805
1806 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1807                           const struct wpa_ssid *ssid,
1808                           struct hostapd_freq_params *freq)
1809 {
1810         enum hostapd_hw_mode hw_mode;
1811         struct hostapd_hw_modes *mode = NULL;
1812         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1813                            184, 192 };
1814         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1815         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1816         u8 channel;
1817         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1818         unsigned int j, k;
1819         struct hostapd_freq_params vht_freq;
1820         int chwidth, seg0, seg1;
1821         u32 vht_caps = 0;
1822
1823         freq->freq = ssid->frequency;
1824
1825         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1826                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1827
1828                 if (ssid->mode != WPAS_MODE_IBSS)
1829                         break;
1830
1831                 /* Don't adjust control freq in case of fixed_freq */
1832                 if (ssid->fixed_freq)
1833                         break;
1834
1835                 if (!bss_is_ibss(bss))
1836                         continue;
1837
1838                 if (ssid->ssid_len == bss->ssid_len &&
1839                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1840                         wpa_printf(MSG_DEBUG,
1841                                    "IBSS already found in scan results, adjust control freq: %d",
1842                                    bss->freq);
1843                         freq->freq = bss->freq;
1844                         obss_scan = 0;
1845                         break;
1846                 }
1847         }
1848
1849         /* For IBSS check HT_IBSS flag */
1850         if (ssid->mode == WPAS_MODE_IBSS &&
1851             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1852                 return;
1853
1854         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1855             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1856             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1857                 wpa_printf(MSG_DEBUG,
1858                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1859                 return;
1860         }
1861
1862         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1863         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1864                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1865                         mode = &wpa_s->hw.modes[i];
1866                         break;
1867                 }
1868         }
1869
1870         if (!mode)
1871                 return;
1872
1873         freq->ht_enabled = ht_supported(mode);
1874         if (!freq->ht_enabled)
1875                 return;
1876
1877         /* Setup higher BW only for 5 GHz */
1878         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1879                 return;
1880
1881         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1882                 pri_chan = &mode->channels[chan_idx];
1883                 if (pri_chan->chan == channel)
1884                         break;
1885                 pri_chan = NULL;
1886         }
1887         if (!pri_chan)
1888                 return;
1889
1890         /* Check primary channel flags */
1891         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1892                 return;
1893
1894         /* Check/setup HT40+/HT40- */
1895         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1896                 if (ht40plus[j] == channel) {
1897                         ht40 = 1;
1898                         break;
1899                 }
1900         }
1901
1902         /* Find secondary channel */
1903         for (i = 0; i < mode->num_channels; i++) {
1904                 sec_chan = &mode->channels[i];
1905                 if (sec_chan->chan == channel + ht40 * 4)
1906                         break;
1907                 sec_chan = NULL;
1908         }
1909         if (!sec_chan)
1910                 return;
1911
1912         /* Check secondary channel flags */
1913         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1914                 return;
1915
1916         freq->channel = pri_chan->chan;
1917
1918         switch (ht40) {
1919         case -1:
1920                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1921                         return;
1922                 freq->sec_channel_offset = -1;
1923                 break;
1924         case 1:
1925                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1926                         return;
1927                 freq->sec_channel_offset = 1;
1928                 break;
1929         default:
1930                 break;
1931         }
1932
1933         if (freq->sec_channel_offset && obss_scan) {
1934                 struct wpa_scan_results *scan_res;
1935
1936                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1937                 if (scan_res == NULL) {
1938                         /* Back to HT20 */
1939                         freq->sec_channel_offset = 0;
1940                         return;
1941                 }
1942
1943                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1944                                      sec_chan->chan);
1945                 switch (res) {
1946                 case 0:
1947                         /* Back to HT20 */
1948                         freq->sec_channel_offset = 0;
1949                         break;
1950                 case 1:
1951                         /* Configuration allowed */
1952                         break;
1953                 case 2:
1954                         /* Switch pri/sec channels */
1955                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1956                         freq->sec_channel_offset = -freq->sec_channel_offset;
1957                         freq->channel = sec_chan->chan;
1958                         break;
1959                 default:
1960                         freq->sec_channel_offset = 0;
1961                         break;
1962                 }
1963
1964                 wpa_scan_results_free(scan_res);
1965         }
1966
1967         wpa_printf(MSG_DEBUG,
1968                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1969                    freq->channel, freq->sec_channel_offset);
1970
1971         if (!drv_supports_vht(wpa_s, ssid))
1972                 return;
1973
1974         /* For IBSS check VHT_IBSS flag */
1975         if (ssid->mode == WPAS_MODE_IBSS &&
1976             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1977                 return;
1978
1979         vht_freq = *freq;
1980
1981         vht_freq.vht_enabled = vht_supported(mode);
1982         if (!vht_freq.vht_enabled)
1983                 return;
1984
1985         /* setup center_freq1, bandwidth */
1986         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1987                 if (freq->channel >= vht80[j] &&
1988                     freq->channel < vht80[j] + 16)
1989                         break;
1990         }
1991
1992         if (j == ARRAY_SIZE(vht80))
1993                 return;
1994
1995         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1996                 struct hostapd_channel_data *chan;
1997
1998                 chan = hw_get_channel_chan(mode, i, NULL);
1999                 if (!chan)
2000                         return;
2001
2002                 /* Back to HT configuration if channel not usable */
2003                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2004                         return;
2005         }
2006
2007         chwidth = VHT_CHANWIDTH_80MHZ;
2008         seg0 = vht80[j] + 6;
2009         seg1 = 0;
2010
2011         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2012                 /* setup center_freq2, bandwidth */
2013                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2014                         /* Only accept 80 MHz segments separated by a gap */
2015                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2016                                 continue;
2017                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2018                                 struct hostapd_channel_data *chan;
2019
2020                                 chan = hw_get_channel_chan(mode, i, NULL);
2021                                 if (!chan)
2022                                         continue;
2023
2024                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2025                                                   HOSTAPD_CHAN_NO_IR |
2026                                                   HOSTAPD_CHAN_RADAR))
2027                                         continue;
2028
2029                                 /* Found a suitable second segment for 80+80 */
2030                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2031                                 vht_caps |=
2032                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2033                                 seg1 = vht80[k] + 6;
2034                         }
2035
2036                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2037                                 break;
2038                 }
2039         }
2040
2041         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2042                                     freq->channel, freq->ht_enabled,
2043                                     vht_freq.vht_enabled,
2044                                     freq->sec_channel_offset,
2045                                     chwidth, seg0, seg1, vht_caps) != 0)
2046                 return;
2047
2048         *freq = vht_freq;
2049
2050         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2051                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2052 }
2053
2054
2055 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2056 {
2057         struct wpa_connect_work *cwork = work->ctx;
2058         struct wpa_bss *bss = cwork->bss;
2059         struct wpa_ssid *ssid = cwork->ssid;
2060         struct wpa_supplicant *wpa_s = work->wpa_s;
2061         u8 wpa_ie[200];
2062         size_t wpa_ie_len;
2063         int use_crypt, ret, i, bssid_changed;
2064         int algs = WPA_AUTH_ALG_OPEN;
2065         unsigned int cipher_pairwise, cipher_group;
2066         struct wpa_driver_associate_params params;
2067         int wep_keys_set = 0;
2068         int assoc_failed = 0;
2069         struct wpa_ssid *old_ssid;
2070         u8 prev_bssid[ETH_ALEN];
2071 #ifdef CONFIG_HT_OVERRIDES
2072         struct ieee80211_ht_capabilities htcaps;
2073         struct ieee80211_ht_capabilities htcaps_mask;
2074 #endif /* CONFIG_HT_OVERRIDES */
2075 #ifdef CONFIG_VHT_OVERRIDES
2076        struct ieee80211_vht_capabilities vhtcaps;
2077        struct ieee80211_vht_capabilities vhtcaps_mask;
2078 #endif /* CONFIG_VHT_OVERRIDES */
2079 #ifdef CONFIG_MBO
2080         const u8 *mbo = NULL;
2081 #endif /* CONFIG_MBO */
2082
2083         if (deinit) {
2084                 if (work->started) {
2085                         wpa_s->connect_work = NULL;
2086
2087                         /* cancel possible auth. timeout */
2088                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2089                                              NULL);
2090                 }
2091                 wpas_connect_work_free(cwork);
2092                 return;
2093         }
2094
2095         wpa_s->connect_work = work;
2096
2097         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2098             wpas_network_disabled(wpa_s, ssid)) {
2099                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2100                 wpas_connect_work_done(wpa_s);
2101                 return;
2102         }
2103
2104         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2105         os_memset(&params, 0, sizeof(params));
2106         wpa_s->reassociate = 0;
2107         wpa_s->eap_expected_failure = 0;
2108         if (bss &&
2109             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2110 #ifdef CONFIG_IEEE80211R
2111                 const u8 *ie, *md = NULL;
2112 #endif /* CONFIG_IEEE80211R */
2113                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2114                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2115                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2116                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2117                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2118                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2119                 if (bssid_changed)
2120                         wpas_notify_bssid_changed(wpa_s);
2121 #ifdef CONFIG_IEEE80211R
2122                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2123                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2124                         md = ie + 2;
2125                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2126                 if (md) {
2127                         /* Prepare for the next transition */
2128                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2129                 }
2130 #endif /* CONFIG_IEEE80211R */
2131 #ifdef CONFIG_WPS
2132         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2133                    wpa_s->conf->ap_scan == 2 &&
2134                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2135                 /* Use ap_scan==1 style network selection to find the network
2136                  */
2137                 wpas_connect_work_done(wpa_s);
2138                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2139                 wpa_s->reassociate = 1;
2140                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2141                 return;
2142 #endif /* CONFIG_WPS */
2143         } else {
2144                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2145                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2146                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2147         }
2148         if (!wpa_s->pno)
2149                 wpa_supplicant_cancel_sched_scan(wpa_s);
2150
2151         wpa_supplicant_cancel_scan(wpa_s);
2152
2153         /* Starting new association, so clear the possibly used WPA IE from the
2154          * previous association. */
2155         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2156
2157 #ifdef IEEE8021X_EAPOL
2158         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2159                 if (ssid->leap) {
2160                         if (ssid->non_leap == 0)
2161                                 algs = WPA_AUTH_ALG_LEAP;
2162                         else
2163                                 algs |= WPA_AUTH_ALG_LEAP;
2164                 }
2165         }
2166 #endif /* IEEE8021X_EAPOL */
2167         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2168         if (ssid->auth_alg) {
2169                 algs = ssid->auth_alg;
2170                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2171                         "0x%x", algs);
2172         }
2173
2174         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2175                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2176             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2177                 int try_opportunistic;
2178                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2179                                      wpa_s->conf->okc :
2180                                      ssid->proactive_key_caching) &&
2181                         (ssid->proto & WPA_PROTO_RSN);
2182                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2183                                             ssid, try_opportunistic) == 0)
2184                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2185                 wpa_ie_len = sizeof(wpa_ie);
2186                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2187                                               wpa_ie, &wpa_ie_len)) {
2188                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2189                                 "key management and encryption suites");
2190                         wpas_connect_work_done(wpa_s);
2191                         return;
2192                 }
2193         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2194                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2195                 /*
2196                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2197                  * use non-WPA since the scan results did not indicate that the
2198                  * AP is using WPA or WPA2.
2199                  */
2200                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2201                 wpa_ie_len = 0;
2202                 wpa_s->wpa_proto = 0;
2203         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2204                 wpa_ie_len = sizeof(wpa_ie);
2205                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2206                                               wpa_ie, &wpa_ie_len)) {
2207                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2208                                 "key management and encryption suites (no "
2209                                 "scan results)");
2210                         wpas_connect_work_done(wpa_s);
2211                         return;
2212                 }
2213 #ifdef CONFIG_WPS
2214         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2215                 struct wpabuf *wps_ie;
2216                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2217                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2218                         wpa_ie_len = wpabuf_len(wps_ie);
2219                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2220                 } else
2221                         wpa_ie_len = 0;
2222                 wpabuf_free(wps_ie);
2223                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2224                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2225                         params.wps = WPS_MODE_PRIVACY;
2226                 else
2227                         params.wps = WPS_MODE_OPEN;
2228                 wpa_s->wpa_proto = 0;
2229 #endif /* CONFIG_WPS */
2230         } else {
2231                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2232                 wpa_ie_len = 0;
2233                 wpa_s->wpa_proto = 0;
2234         }
2235
2236 #ifdef CONFIG_P2P
2237         if (wpa_s->global->p2p) {
2238                 u8 *pos;
2239                 size_t len;
2240                 int res;
2241                 pos = wpa_ie + wpa_ie_len;
2242                 len = sizeof(wpa_ie) - wpa_ie_len;
2243                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2244                                             ssid->p2p_group);
2245                 if (res >= 0)
2246                         wpa_ie_len += res;
2247         }
2248
2249         wpa_s->cross_connect_disallowed = 0;
2250         if (bss) {
2251                 struct wpabuf *p2p;
2252                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2253                 if (p2p) {
2254                         wpa_s->cross_connect_disallowed =
2255                                 p2p_get_cross_connect_disallowed(p2p);
2256                         wpabuf_free(p2p);
2257                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2258                                 "connection",
2259                                 wpa_s->cross_connect_disallowed ?
2260                                 "disallows" : "allows");
2261                 }
2262         }
2263
2264         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2265 #endif /* CONFIG_P2P */
2266
2267 #ifdef CONFIG_MBO
2268         if (bss) {
2269                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2270                 if (mbo) {
2271                         int len;
2272
2273                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2274                                                         wpa_ie + wpa_ie_len,
2275                                                         sizeof(wpa_ie) -
2276                                                         wpa_ie_len);
2277                         if (len > 0)
2278                                 wpa_ie_len += len;
2279                 }
2280         }
2281 #endif /* CONFIG_MBO */
2282
2283         /*
2284          * Workaround: Add Extended Capabilities element only if the AP
2285          * included this element in Beacon/Probe Response frames. Some older
2286          * APs seem to have interoperability issues if this element is
2287          * included, so while the standard may require us to include the
2288          * element in all cases, it is justifiable to skip it to avoid
2289          * interoperability issues.
2290          */
2291         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2292                 u8 ext_capab[18];
2293                 int ext_capab_len;
2294                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2295                                                      sizeof(ext_capab));
2296                 if (ext_capab_len > 0) {
2297                         u8 *pos = wpa_ie;
2298                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2299                                 pos += 2 + pos[1];
2300                         os_memmove(pos + ext_capab_len, pos,
2301                                    wpa_ie_len - (pos - wpa_ie));
2302                         wpa_ie_len += ext_capab_len;
2303                         os_memcpy(pos, ext_capab, ext_capab_len);
2304                 }
2305         }
2306
2307 #ifdef CONFIG_HS20
2308         if (is_hs20_network(wpa_s, ssid, bss)) {
2309                 struct wpabuf *hs20;
2310
2311                 hs20 = wpabuf_alloc(20);
2312                 if (hs20) {
2313                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2314                         size_t len;
2315
2316                         wpas_hs20_add_indication(hs20, pps_mo_id);
2317                         len = sizeof(wpa_ie) - wpa_ie_len;
2318                         if (wpabuf_len(hs20) <= len) {
2319                                 os_memcpy(wpa_ie + wpa_ie_len,
2320                                           wpabuf_head(hs20), wpabuf_len(hs20));
2321                                 wpa_ie_len += wpabuf_len(hs20);
2322                         }
2323                         wpabuf_free(hs20);
2324
2325                         hs20_configure_frame_filters(wpa_s);
2326                 }
2327         }
2328 #endif /* CONFIG_HS20 */
2329
2330         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2331                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2332                 size_t len;
2333
2334                 len = sizeof(wpa_ie) - wpa_ie_len;
2335                 if (wpabuf_len(buf) <= len) {
2336                         os_memcpy(wpa_ie + wpa_ie_len,
2337                                   wpabuf_head(buf), wpabuf_len(buf));
2338                         wpa_ie_len += wpabuf_len(buf);
2339                 }
2340         }
2341
2342 #ifdef CONFIG_FST
2343         if (wpa_s->fst_ies) {
2344                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2345
2346                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2347                         os_memcpy(wpa_ie + wpa_ie_len,
2348                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2349                         wpa_ie_len += fst_ies_len;
2350                 }
2351         }
2352 #endif /* CONFIG_FST */
2353
2354 #ifdef CONFIG_MBO
2355         if (mbo) {
2356                 int len;
2357
2358                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2359                                   sizeof(wpa_ie) - wpa_ie_len);
2360                 if (len >= 0)
2361                         wpa_ie_len += len;
2362         }
2363 #endif /* CONFIG_MBO */
2364
2365         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2366         use_crypt = 1;
2367         cipher_pairwise = wpa_s->pairwise_cipher;
2368         cipher_group = wpa_s->group_cipher;
2369         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2370             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2371                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2372                         use_crypt = 0;
2373                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2374                         use_crypt = 1;
2375                         wep_keys_set = 1;
2376                 }
2377         }
2378         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2379                 use_crypt = 0;
2380
2381 #ifdef IEEE8021X_EAPOL
2382         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2383                 if ((ssid->eapol_flags &
2384                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2385                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2386                     !wep_keys_set) {
2387                         use_crypt = 0;
2388                 } else {
2389                         /* Assume that dynamic WEP-104 keys will be used and
2390                          * set cipher suites in order for drivers to expect
2391                          * encryption. */
2392                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2393                 }
2394         }
2395 #endif /* IEEE8021X_EAPOL */
2396
2397         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2398                 /* Set the key before (and later after) association */
2399                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2400         }
2401
2402         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2403         if (bss) {
2404                 params.ssid = bss->ssid;
2405                 params.ssid_len = bss->ssid_len;
2406                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2407                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2408                                    MACSTR " freq=%u MHz based on scan results "
2409                                    "(bssid_set=%d)",
2410                                    MAC2STR(bss->bssid), bss->freq,
2411                                    ssid->bssid_set);
2412                         params.bssid = bss->bssid;
2413                         params.freq.freq = bss->freq;
2414                 }
2415                 params.bssid_hint = bss->bssid;
2416                 params.freq_hint = bss->freq;
2417                 params.pbss = bss_is_pbss(bss);
2418         } else {
2419                 params.ssid = ssid->ssid;
2420                 params.ssid_len = ssid->ssid_len;
2421                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2422         }
2423
2424         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2425             wpa_s->conf->ap_scan == 2) {
2426                 params.bssid = ssid->bssid;
2427                 params.fixed_bssid = 1;
2428         }
2429
2430         /* Initial frequency for IBSS/mesh */
2431         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2432             ssid->frequency > 0 && params.freq.freq == 0)
2433                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2434
2435         if (ssid->mode == WPAS_MODE_IBSS) {
2436                 params.fixed_freq = ssid->fixed_freq;
2437                 if (ssid->beacon_int)
2438                         params.beacon_int = ssid->beacon_int;
2439                 else
2440                         params.beacon_int = wpa_s->conf->beacon_int;
2441         }
2442
2443         params.wpa_ie = wpa_ie;
2444         params.wpa_ie_len = wpa_ie_len;
2445         params.pairwise_suite = cipher_pairwise;
2446         params.group_suite = cipher_group;
2447         params.key_mgmt_suite = wpa_s->key_mgmt;
2448         params.wpa_proto = wpa_s->wpa_proto;
2449         params.auth_alg = algs;
2450         params.mode = ssid->mode;
2451         params.bg_scan_period = ssid->bg_scan_period;
2452         for (i = 0; i < NUM_WEP_KEYS; i++) {
2453                 if (ssid->wep_key_len[i])
2454                         params.wep_key[i] = ssid->wep_key[i];
2455                 params.wep_key_len[i] = ssid->wep_key_len[i];
2456         }
2457         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2458
2459         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2460             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2461              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2462                 params.passphrase = ssid->passphrase;
2463                 if (ssid->psk_set)
2464                         params.psk = ssid->psk;
2465         }
2466
2467         if (wpa_s->conf->key_mgmt_offload) {
2468                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2469                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2470                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2471                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2472                         params.req_key_mgmt_offload =
2473                                 ssid->proactive_key_caching < 0 ?
2474                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2475                 else
2476                         params.req_key_mgmt_offload = 1;
2477
2478                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2479                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2480                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2481                     ssid->psk_set)
2482                         params.psk = ssid->psk;
2483         }
2484
2485         params.drop_unencrypted = use_crypt;
2486
2487 #ifdef CONFIG_IEEE80211W
2488         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2489         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2490                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2491                 struct wpa_ie_data ie;
2492                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2493                     ie.capabilities &
2494                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2495                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2496                                 "MFP: require MFP");
2497                         params.mgmt_frame_protection =
2498                                 MGMT_FRAME_PROTECTION_REQUIRED;
2499                 }
2500         }
2501 #endif /* CONFIG_IEEE80211W */
2502
2503         params.p2p = ssid->p2p_group;
2504
2505         if (wpa_s->p2pdev->set_sta_uapsd)
2506                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2507         else
2508                 params.uapsd = -1;
2509
2510 #ifdef CONFIG_HT_OVERRIDES
2511         os_memset(&htcaps, 0, sizeof(htcaps));
2512         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2513         params.htcaps = (u8 *) &htcaps;
2514         params.htcaps_mask = (u8 *) &htcaps_mask;
2515         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2516 #endif /* CONFIG_HT_OVERRIDES */
2517 #ifdef CONFIG_VHT_OVERRIDES
2518         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2519         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2520         params.vhtcaps = &vhtcaps;
2521         params.vhtcaps_mask = &vhtcaps_mask;
2522         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2523 #endif /* CONFIG_VHT_OVERRIDES */
2524
2525 #ifdef CONFIG_P2P
2526         /*
2527          * If multi-channel concurrency is not supported, check for any
2528          * frequency conflict. In case of any frequency conflict, remove the
2529          * least prioritized connection.
2530          */
2531         if (wpa_s->num_multichan_concurrent < 2) {
2532                 int freq, num;
2533                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2534                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2535                         wpa_printf(MSG_DEBUG,
2536                                    "Assoc conflicting freq found (%d != %d)",
2537                                    freq, params.freq.freq);
2538                         if (wpas_p2p_handle_frequency_conflicts(
2539                                     wpa_s, params.freq.freq, ssid) < 0) {
2540                                 wpas_connect_work_done(wpa_s);
2541                                 return;
2542                         }
2543                 }
2544         }
2545 #endif /* CONFIG_P2P */
2546
2547         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2548             wpa_s->current_ssid)
2549                 params.prev_bssid = prev_bssid;
2550
2551         ret = wpa_drv_associate(wpa_s, &params);
2552         if (ret < 0) {
2553                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2554                         "failed");
2555                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2556                         /*
2557                          * The driver is known to mean what is saying, so we
2558                          * can stop right here; the association will not
2559                          * succeed.
2560                          */
2561                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2562                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2563                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2564                         return;
2565                 }
2566                 /* try to continue anyway; new association will be tried again
2567                  * after timeout */
2568                 assoc_failed = 1;
2569         }
2570
2571         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2572                 /* Set the key after the association just in case association
2573                  * cleared the previously configured key. */
2574                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2575                 /* No need to timeout authentication since there is no key
2576                  * management. */
2577                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2578                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2579 #ifdef CONFIG_IBSS_RSN
2580         } else if (ssid->mode == WPAS_MODE_IBSS &&
2581                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2582                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2583                 /*
2584                  * RSN IBSS authentication is per-STA and we can disable the
2585                  * per-BSSID authentication.
2586                  */
2587                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2588 #endif /* CONFIG_IBSS_RSN */
2589         } else {
2590                 /* Timeout for IEEE 802.11 authentication and association */
2591                 int timeout = 60;
2592
2593                 if (assoc_failed) {
2594                         /* give IBSS a bit more time */
2595                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2596                 } else if (wpa_s->conf->ap_scan == 1) {
2597                         /* give IBSS a bit more time */
2598                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2599                 }
2600                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2601         }
2602
2603         if (wep_keys_set &&
2604             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2605                 /* Set static WEP keys again */
2606                 wpa_set_wep_keys(wpa_s, ssid);
2607         }
2608
2609         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2610                 /*
2611                  * Do not allow EAP session resumption between different
2612                  * network configurations.
2613                  */
2614                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2615         }
2616         old_ssid = wpa_s->current_ssid;
2617         wpa_s->current_ssid = ssid;
2618
2619         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2620                 wpa_s->current_bss = bss;
2621 #ifdef CONFIG_HS20
2622                 hs20_configure_frame_filters(wpa_s);
2623 #endif /* CONFIG_HS20 */
2624         }
2625
2626         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2627         wpa_supplicant_initiate_eapol(wpa_s);
2628         if (old_ssid != wpa_s->current_ssid)
2629                 wpas_notify_network_changed(wpa_s);
2630 }
2631
2632
2633 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2634                                             const u8 *addr)
2635 {
2636         struct wpa_ssid *old_ssid;
2637
2638         wpas_connect_work_done(wpa_s);
2639         wpa_clear_keys(wpa_s, addr);
2640         old_ssid = wpa_s->current_ssid;
2641         wpa_supplicant_mark_disassoc(wpa_s);
2642         wpa_sm_set_config(wpa_s->wpa, NULL);
2643         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2644         if (old_ssid != wpa_s->current_ssid)
2645                 wpas_notify_network_changed(wpa_s);
2646         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2647 }
2648
2649
2650 /**
2651  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2652  * @wpa_s: Pointer to wpa_supplicant data
2653  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2654  *
2655  * This function is used to request %wpa_supplicant to deauthenticate from the
2656  * current AP.
2657  */
2658 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2659                                    int reason_code)
2660 {
2661         u8 *addr = NULL;
2662         union wpa_event_data event;
2663         int zero_addr = 0;
2664
2665         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2666                 " pending_bssid=" MACSTR " reason=%d state=%s",
2667                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2668                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2669
2670         if (!is_zero_ether_addr(wpa_s->bssid))
2671                 addr = wpa_s->bssid;
2672         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2673                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2674                   wpa_s->wpa_state == WPA_ASSOCIATING))
2675                 addr = wpa_s->pending_bssid;
2676         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2677                 /*
2678                  * When using driver-based BSS selection, we may not know the
2679                  * BSSID with which we are currently trying to associate. We
2680                  * need to notify the driver of this disconnection even in such
2681                  * a case, so use the all zeros address here.
2682                  */
2683                 addr = wpa_s->bssid;
2684                 zero_addr = 1;
2685         }
2686
2687 #ifdef CONFIG_TDLS
2688         wpa_tdls_teardown_peers(wpa_s->wpa);
2689 #endif /* CONFIG_TDLS */
2690
2691 #ifdef CONFIG_MESH
2692         if (wpa_s->ifmsh) {
2693                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2694                         wpa_s->ifname);
2695                 wpa_supplicant_leave_mesh(wpa_s);
2696         }
2697 #endif /* CONFIG_MESH */
2698
2699         if (addr) {
2700                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2701                 os_memset(&event, 0, sizeof(event));
2702                 event.deauth_info.reason_code = (u16) reason_code;
2703                 event.deauth_info.locally_generated = 1;
2704                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2705                 if (zero_addr)
2706                         addr = NULL;
2707         }
2708
2709         wpa_supplicant_clear_connection(wpa_s, addr);
2710 }
2711
2712 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2713                                               struct wpa_ssid *ssid)
2714 {
2715         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2716                 return;
2717
2718         ssid->disabled = 0;
2719         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2720         wpas_notify_network_enabled_changed(wpa_s, ssid);
2721
2722         /*
2723          * Try to reassociate since there is no current configuration and a new
2724          * network was made available.
2725          */
2726         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2727                 wpa_s->reassociate = 1;
2728 }
2729
2730
2731 /**
2732  * wpa_supplicant_enable_network - Mark a configured network as enabled
2733  * @wpa_s: wpa_supplicant structure for a network interface
2734  * @ssid: wpa_ssid structure for a configured network or %NULL
2735  *
2736  * Enables the specified network or all networks if no network specified.
2737  */
2738 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2739                                    struct wpa_ssid *ssid)
2740 {
2741         if (ssid == NULL) {
2742                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2743                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2744         } else
2745                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2746
2747         if (wpa_s->reassociate && !wpa_s->disconnected &&
2748             (!wpa_s->current_ssid ||
2749              wpa_s->wpa_state == WPA_DISCONNECTED ||
2750              wpa_s->wpa_state == WPA_SCANNING)) {
2751                 if (wpa_s->sched_scanning) {
2752                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2753                                    "new network to scan filters");
2754                         wpa_supplicant_cancel_sched_scan(wpa_s);
2755                 }
2756
2757                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2758                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2759                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2760                 }
2761         }
2762 }
2763
2764
2765 /**
2766  * wpa_supplicant_disable_network - Mark a configured network as disabled
2767  * @wpa_s: wpa_supplicant structure for a network interface
2768  * @ssid: wpa_ssid structure for a configured network or %NULL
2769  *
2770  * Disables the specified network or all networks if no network specified.
2771  */
2772 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2773                                     struct wpa_ssid *ssid)
2774 {
2775         struct wpa_ssid *other_ssid;
2776         int was_disabled;
2777
2778         if (ssid == NULL) {
2779                 if (wpa_s->sched_scanning)
2780                         wpa_supplicant_cancel_sched_scan(wpa_s);
2781
2782                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2783                      other_ssid = other_ssid->next) {
2784                         was_disabled = other_ssid->disabled;
2785                         if (was_disabled == 2)
2786                                 continue; /* do not change persistent P2P group
2787                                            * data */
2788
2789                         other_ssid->disabled = 1;
2790
2791                         if (was_disabled != other_ssid->disabled)
2792                                 wpas_notify_network_enabled_changed(
2793                                         wpa_s, other_ssid);
2794                 }
2795                 if (wpa_s->current_ssid)
2796                         wpa_supplicant_deauthenticate(
2797                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2798         } else if (ssid->disabled != 2) {
2799                 if (ssid == wpa_s->current_ssid)
2800                         wpa_supplicant_deauthenticate(
2801                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2802
2803                 was_disabled = ssid->disabled;
2804
2805                 ssid->disabled = 1;
2806
2807                 if (was_disabled != ssid->disabled) {
2808                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2809                         if (wpa_s->sched_scanning) {
2810                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2811                                            "to remove network from filters");
2812                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2813                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2814                         }
2815                 }
2816         }
2817 }
2818
2819
2820 /**
2821  * wpa_supplicant_select_network - Attempt association with a network
2822  * @wpa_s: wpa_supplicant structure for a network interface
2823  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2824  */
2825 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2826                                    struct wpa_ssid *ssid)
2827 {
2828
2829         struct wpa_ssid *other_ssid;
2830         int disconnected = 0;
2831
2832         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2833                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2834                         wpa_s->own_disconnect_req = 1;
2835                 wpa_supplicant_deauthenticate(
2836                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2837                 disconnected = 1;
2838         }
2839
2840         if (ssid)
2841                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2842
2843         /*
2844          * Mark all other networks disabled or mark all networks enabled if no
2845          * network specified.
2846          */
2847         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2848              other_ssid = other_ssid->next) {
2849                 int was_disabled = other_ssid->disabled;
2850                 if (was_disabled == 2)
2851                         continue; /* do not change persistent P2P group data */
2852
2853                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2854                 if (was_disabled && !other_ssid->disabled)
2855                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2856
2857                 if (was_disabled != other_ssid->disabled)
2858                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2859         }
2860
2861         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2862             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2863                 /* We are already associated with the selected network */
2864                 wpa_printf(MSG_DEBUG, "Already associated with the "
2865                            "selected network - do nothing");
2866                 return;
2867         }
2868
2869         if (ssid) {
2870                 wpa_s->current_ssid = ssid;
2871                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2872                 wpa_s->connect_without_scan =
2873                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2874
2875                 /*
2876                  * Don't optimize next scan freqs since a new ESS has been
2877                  * selected.
2878                  */
2879                 os_free(wpa_s->next_scan_freqs);
2880                 wpa_s->next_scan_freqs = NULL;
2881         } else {
2882                 wpa_s->connect_without_scan = NULL;
2883         }
2884
2885         wpa_s->disconnected = 0;
2886         wpa_s->reassociate = 1;
2887
2888         if (wpa_s->connect_without_scan ||
2889             wpa_supplicant_fast_associate(wpa_s) != 1) {
2890                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2891                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2892         }
2893
2894         if (ssid)
2895                 wpas_notify_network_selected(wpa_s, ssid);
2896 }
2897
2898
2899 /**
2900  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2901  * @wpa_s: wpa_supplicant structure for a network interface
2902  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2903  * @pkcs11_module_path: PKCS #11 module path or NULL
2904  * Returns: 0 on success; -1 on failure
2905  *
2906  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2907  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2908  * module path fails the paths will be reset to the default value (NULL).
2909  */
2910 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2911                                            const char *pkcs11_engine_path,
2912                                            const char *pkcs11_module_path)
2913 {
2914         char *pkcs11_engine_path_copy = NULL;
2915         char *pkcs11_module_path_copy = NULL;
2916
2917         if (pkcs11_engine_path != NULL) {
2918                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2919                 if (pkcs11_engine_path_copy == NULL)
2920                         return -1;
2921         }
2922         if (pkcs11_module_path != NULL) {
2923                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2924                 if (pkcs11_module_path_copy == NULL) {
2925                         os_free(pkcs11_engine_path_copy);
2926                         return -1;
2927                 }
2928         }
2929
2930         os_free(wpa_s->conf->pkcs11_engine_path);
2931         os_free(wpa_s->conf->pkcs11_module_path);
2932         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2933         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2934
2935         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2936         eapol_sm_deinit(wpa_s->eapol);
2937         wpa_s->eapol = NULL;
2938         if (wpa_supplicant_init_eapol(wpa_s)) {
2939                 /* Error -> Reset paths to the default value (NULL) once. */
2940                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2941                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2942                                                                NULL);
2943
2944                 return -1;
2945         }
2946         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2947
2948         return 0;
2949 }
2950
2951
2952 /**
2953  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2954  * @wpa_s: wpa_supplicant structure for a network interface
2955  * @ap_scan: AP scan mode
2956  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2957  *
2958  */
2959 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2960 {
2961
2962         int old_ap_scan;
2963
2964         if (ap_scan < 0 || ap_scan > 2)
2965                 return -1;
2966
2967         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2968                 wpa_printf(MSG_INFO,
2969                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2970         }
2971
2972 #ifdef ANDROID
2973         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2974             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2975             wpa_s->wpa_state < WPA_COMPLETED) {
2976                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2977                            "associating", wpa_s->conf->ap_scan, ap_scan);
2978                 return 0;
2979         }
2980 #endif /* ANDROID */
2981
2982         old_ap_scan = wpa_s->conf->ap_scan;
2983         wpa_s->conf->ap_scan = ap_scan;
2984
2985         if (old_ap_scan != wpa_s->conf->ap_scan)
2986                 wpas_notify_ap_scan_changed(wpa_s);
2987
2988         return 0;
2989 }
2990
2991
2992 /**
2993  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2994  * @wpa_s: wpa_supplicant structure for a network interface
2995  * @expire_age: Expiration age in seconds
2996  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2997  *
2998  */
2999 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3000                                           unsigned int bss_expire_age)
3001 {
3002         if (bss_expire_age < 10) {
3003                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3004                         bss_expire_age);
3005                 return -1;
3006         }
3007         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3008                 bss_expire_age);
3009         wpa_s->conf->bss_expiration_age = bss_expire_age;
3010
3011         return 0;
3012 }
3013
3014
3015 /**
3016  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3017  * @wpa_s: wpa_supplicant structure for a network interface
3018  * @expire_count: number of scans after which an unseen BSS is reclaimed
3019  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3020  *
3021  */
3022 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3023                                             unsigned int bss_expire_count)
3024 {
3025         if (bss_expire_count < 1) {
3026                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3027                         bss_expire_count);
3028                 return -1;
3029         }
3030         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3031                 bss_expire_count);
3032         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3033
3034         return 0;
3035 }
3036
3037
3038 /**
3039  * wpa_supplicant_set_scan_interval - Set scan interval
3040  * @wpa_s: wpa_supplicant structure for a network interface
3041  * @scan_interval: scan interval in seconds
3042  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3043  *
3044  */
3045 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3046                                      int scan_interval)
3047 {
3048         if (scan_interval < 0) {
3049                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3050                         scan_interval);
3051                 return -1;
3052         }
3053         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3054                 scan_interval);
3055         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3056
3057         return 0;
3058 }
3059
3060
3061 /**
3062  * wpa_supplicant_set_debug_params - Set global debug params
3063  * @global: wpa_global structure
3064  * @debug_level: debug level
3065  * @debug_timestamp: determines if show timestamp in debug data
3066  * @debug_show_keys: determines if show keys in debug data
3067  * Returns: 0 if succeed or -1 if debug_level has wrong value
3068  */
3069 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3070                                     int debug_timestamp, int debug_show_keys)
3071 {
3072
3073         int old_level, old_timestamp, old_show_keys;
3074
3075         /* check for allowed debuglevels */
3076         if (debug_level != MSG_EXCESSIVE &&
3077             debug_level != MSG_MSGDUMP &&
3078             debug_level != MSG_DEBUG &&
3079             debug_level != MSG_INFO &&
3080             debug_level != MSG_WARNING &&
3081             debug_level != MSG_ERROR)
3082                 return -1;
3083
3084         old_level = wpa_debug_level;
3085         old_timestamp = wpa_debug_timestamp;
3086         old_show_keys = wpa_debug_show_keys;
3087
3088         wpa_debug_level = debug_level;
3089         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3090         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3091
3092         if (wpa_debug_level != old_level)
3093                 wpas_notify_debug_level_changed(global);
3094         if (wpa_debug_timestamp != old_timestamp)
3095                 wpas_notify_debug_timestamp_changed(global);
3096         if (wpa_debug_show_keys != old_show_keys)
3097                 wpas_notify_debug_show_keys_changed(global);
3098
3099         return 0;
3100 }
3101
3102
3103 /**
3104  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3105  * @wpa_s: Pointer to wpa_supplicant data
3106  * Returns: A pointer to the current network structure or %NULL on failure
3107  */
3108 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3109 {
3110         struct wpa_ssid *entry;
3111         u8 ssid[SSID_MAX_LEN];
3112         int res;
3113         size_t ssid_len;
3114         u8 bssid[ETH_ALEN];
3115         int wired;
3116
3117         res = wpa_drv_get_ssid(wpa_s, ssid);
3118         if (res < 0) {
3119                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3120                         "driver");
3121                 return NULL;
3122         }
3123         ssid_len = res;
3124
3125         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3126                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3127                         "driver");
3128                 return NULL;
3129         }
3130
3131         wired = wpa_s->conf->ap_scan == 0 &&
3132                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3133
3134         entry = wpa_s->conf->ssid;
3135         while (entry) {
3136                 if (!wpas_network_disabled(wpa_s, entry) &&
3137                     ((ssid_len == entry->ssid_len &&
3138                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3139                     (!entry->bssid_set ||
3140                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3141                         return entry;
3142 #ifdef CONFIG_WPS
3143                 if (!wpas_network_disabled(wpa_s, entry) &&
3144                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3145                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3146                     (!entry->bssid_set ||
3147                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3148                         return entry;
3149 #endif /* CONFIG_WPS */
3150
3151                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3152                     entry->ssid_len == 0 &&
3153                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3154                         return entry;
3155
3156                 entry = entry->next;
3157         }
3158
3159         return NULL;
3160 }
3161
3162
3163 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3164 {
3165         struct wpa_global *global = wpa_s->global;
3166
3167         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3168                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3169                 if (global->drv_priv[i] == NULL) {
3170                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3171                                    "'%s'", wpa_drivers[i]->name);
3172                         return -1;
3173                 }
3174         }
3175
3176         wpa_s->driver = wpa_drivers[i];
3177         wpa_s->global_drv_priv = global->drv_priv[i];
3178
3179         return 0;
3180 }
3181
3182
3183 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3184                                      const char *name)
3185 {
3186         int i;
3187         size_t len;
3188         const char *pos, *driver = name;
3189
3190         if (wpa_s == NULL)
3191                 return -1;
3192
3193         if (wpa_drivers[0] == NULL) {
3194                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3195                         "wpa_supplicant");
3196                 return -1;
3197         }
3198
3199         if (name == NULL) {
3200                 /* default to first driver in the list */
3201                 return select_driver(wpa_s, 0);
3202         }
3203
3204         do {
3205                 pos = os_strchr(driver, ',');
3206                 if (pos)
3207                         len = pos - driver;
3208                 else
3209                         len = os_strlen(driver);
3210
3211                 for (i = 0; wpa_drivers[i]; i++) {
3212                         if (os_strlen(wpa_drivers[i]->name) == len &&
3213                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3214                             0) {
3215                                 /* First driver that succeeds wins */
3216                                 if (select_driver(wpa_s, i) == 0)
3217                                         return 0;
3218                         }
3219                 }
3220
3221                 driver = pos + 1;
3222         } while (pos);
3223
3224         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3225         return -1;
3226 }
3227
3228
3229 /**
3230  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3231  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3232  *      with struct wpa_driver_ops::init()
3233  * @src_addr: Source address of the EAPOL frame
3234  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3235  * @len: Length of the EAPOL data
3236  *
3237  * This function is called for each received EAPOL frame. Most driver
3238  * interfaces rely on more generic OS mechanism for receiving frames through
3239  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3240  * take care of received EAPOL frames and deliver them to the core supplicant
3241  * code by calling this function.
3242  */
3243 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3244                              const u8 *buf, size_t len)
3245 {
3246         struct wpa_supplicant *wpa_s = ctx;
3247
3248         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3249         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3250
3251 #ifdef CONFIG_PEERKEY
3252         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3253             wpa_s->current_ssid->peerkey &&
3254             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3255             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3256                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3257                 return;
3258         }
3259 #endif /* CONFIG_PEERKEY */
3260
3261         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3262             (wpa_s->last_eapol_matches_bssid &&
3263 #ifdef CONFIG_AP
3264              !wpa_s->ap_iface &&
3265 #endif /* CONFIG_AP */
3266              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3267                 /*
3268                  * There is possible race condition between receiving the
3269                  * association event and the EAPOL frame since they are coming
3270                  * through different paths from the driver. In order to avoid
3271                  * issues in trying to process the EAPOL frame before receiving
3272                  * association information, lets queue it for processing until
3273                  * the association event is received. This may also be needed in
3274                  * driver-based roaming case, so also use src_addr != BSSID as a
3275                  * trigger if we have previously confirmed that the
3276                  * Authenticator uses BSSID as the src_addr (which is not the
3277                  * case with wired IEEE 802.1X).
3278                  */
3279                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3280                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3281                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3282                         MAC2STR(wpa_s->bssid));
3283                 wpabuf_free(wpa_s->pending_eapol_rx);
3284                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3285                 if (wpa_s->pending_eapol_rx) {
3286                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3287                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3288                                   ETH_ALEN);
3289                 }
3290                 return;
3291         }
3292
3293         wpa_s->last_eapol_matches_bssid =
3294                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3295
3296 #ifdef CONFIG_AP
3297         if (wpa_s->ap_iface) {
3298                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3299                 return;
3300         }
3301 #endif /* CONFIG_AP */
3302
3303         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3304                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3305                         "no key management is configured");
3306                 return;
3307         }
3308
3309         if (wpa_s->eapol_received == 0 &&
3310             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3311              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3312              wpa_s->wpa_state != WPA_COMPLETED) &&
3313             (wpa_s->current_ssid == NULL ||
3314              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3315                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3316                 int timeout = 10;
3317
3318                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3319                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3320                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3321                         /* Use longer timeout for IEEE 802.1X/EAP */
3322                         timeout = 70;
3323                 }
3324
3325 #ifdef CONFIG_WPS
3326                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3327                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3328                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3329                         /*
3330                          * Use shorter timeout if going through WPS AP iteration
3331                          * for PIN config method with an AP that does not
3332                          * advertise Selected Registrar.
3333                          */
3334                         struct wpabuf *wps_ie;
3335
3336                         wps_ie = wpa_bss_get_vendor_ie_multi(
3337                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3338                         if (wps_ie &&
3339                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3340                                 timeout = 10;
3341                         wpabuf_free(wps_ie);
3342                 }
3343 #endif /* CONFIG_WPS */
3344
3345                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3346         }
3347         wpa_s->eapol_received++;
3348
3349         if (wpa_s->countermeasures) {
3350                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3351                         "EAPOL packet");
3352                 return;
3353         }
3354
3355 #ifdef CONFIG_IBSS_RSN
3356         if (wpa_s->current_ssid &&
3357             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3358                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3359                 return;
3360         }
3361 #endif /* CONFIG_IBSS_RSN */
3362
3363         /* Source address of the incoming EAPOL frame could be compared to the
3364          * current BSSID. However, it is possible that a centralized
3365          * Authenticator could be using another MAC address than the BSSID of
3366          * an AP, so just allow any address to be used for now. The replies are
3367          * still sent to the current BSSID (if available), though. */
3368
3369         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3370         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3371             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3372                 return;
3373         wpa_drv_poll(wpa_s);
3374         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3375                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3376         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3377                 /*
3378                  * Set portValid = TRUE here since we are going to skip 4-way
3379                  * handshake processing which would normally set portValid. We
3380                  * need this to allow the EAPOL state machines to be completed
3381                  * without going through EAPOL-Key handshake.
3382                  */
3383                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3384         }
3385 }
3386
3387
3388 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3389 {
3390         if ((!wpa_s->p2p_mgmt ||
3391              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3392             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3393                 l2_packet_deinit(wpa_s->l2);
3394                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3395                                            wpa_drv_get_mac_addr(wpa_s),
3396                                            ETH_P_EAPOL,
3397                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3398                 if (wpa_s->l2 == NULL)
3399                         return -1;
3400         } else {
3401                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3402                 if (addr)
3403                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3404         }
3405
3406         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3407                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3408                 return -1;
3409         }
3410
3411         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3412
3413         return 0;
3414 }
3415
3416
3417 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3418                                            const u8 *buf, size_t len)
3419 {
3420         struct wpa_supplicant *wpa_s = ctx;
3421         const struct l2_ethhdr *eth;
3422
3423         if (len < sizeof(*eth))
3424                 return;
3425         eth = (const struct l2_ethhdr *) buf;
3426
3427         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3428             !(eth->h_dest[0] & 0x01)) {
3429                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3430                         " (bridge - not for this interface - ignore)",
3431                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3432                 return;
3433         }
3434
3435         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3436                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3437         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3438                                 len - sizeof(*eth));
3439 }
3440
3441
3442 /**
3443  * wpa_supplicant_driver_init - Initialize driver interface parameters
3444  * @wpa_s: Pointer to wpa_supplicant data
3445  * Returns: 0 on success, -1 on failure
3446  *
3447  * This function is called to initialize driver interface parameters.
3448  * wpa_drv_init() must have been called before this function to initialize the
3449  * driver interface.
3450  */
3451 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3452 {
3453         static int interface_count = 0;
3454
3455         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3456                 return -1;
3457
3458         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3459                 MAC2STR(wpa_s->own_addr));
3460         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3461         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3462
3463         if (wpa_s->bridge_ifname[0]) {
3464                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3465                         "interface '%s'", wpa_s->bridge_ifname);
3466                 wpa_s->l2_br = l2_packet_init_bridge(
3467                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3468                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3469                 if (wpa_s->l2_br == NULL) {
3470                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3471                                 "connection for the bridge interface '%s'",
3472                                 wpa_s->bridge_ifname);
3473                         return -1;
3474                 }
3475         }
3476
3477         if (wpa_s->conf->ap_scan == 2 &&
3478             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3479                 wpa_printf(MSG_INFO,
3480                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3481         }
3482
3483         wpa_clear_keys(wpa_s, NULL);
3484
3485         /* Make sure that TKIP countermeasures are not left enabled (could
3486          * happen if wpa_supplicant is killed during countermeasures. */
3487         wpa_drv_set_countermeasures(wpa_s, 0);
3488
3489         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3490         wpa_drv_flush_pmkid(wpa_s);
3491
3492         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3493         wpa_s->prev_scan_wildcard = 0;
3494
3495         if (wpa_supplicant_enabled_networks(wpa_s)) {
3496                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3497                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3498                         interface_count = 0;
3499                 }
3500 #ifndef ANDROID
3501                 if (!wpa_s->p2p_mgmt &&
3502                     wpa_supplicant_delayed_sched_scan(wpa_s,
3503                                                       interface_count % 3,
3504                                                       100000))
3505                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3506                                                 100000);
3507 #endif /* ANDROID */
3508                 interface_count++;
3509         } else
3510                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3511
3512         return 0;
3513 }
3514
3515
3516 static int wpa_supplicant_daemon(const char *pid_file)
3517 {
3518         wpa_printf(MSG_DEBUG, "Daemonize..");
3519         return os_daemonize(pid_file);
3520 }
3521
3522
3523 static struct wpa_supplicant *
3524 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3525 {
3526         struct wpa_supplicant *wpa_s;
3527
3528         wpa_s = os_zalloc(sizeof(*wpa_s));
3529         if (wpa_s == NULL)
3530                 return NULL;
3531         wpa_s->scan_req = INITIAL_SCAN_REQ;
3532         wpa_s->scan_interval = 5;
3533         wpa_s->new_connection = 1;
3534         wpa_s->parent = parent ? parent : wpa_s;
3535         wpa_s->p2pdev = wpa_s->parent;
3536         wpa_s->sched_scanning = 0;
3537
3538         dl_list_init(&wpa_s->bss_tmp_disallowed);
3539
3540         return wpa_s;
3541 }
3542
3543
3544 #ifdef CONFIG_HT_OVERRIDES
3545
3546 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3547                              struct ieee80211_ht_capabilities *htcaps,
3548                              struct ieee80211_ht_capabilities *htcaps_mask,
3549                              const char *ht_mcs)
3550 {
3551         /* parse ht_mcs into hex array */
3552         int i;
3553         const char *tmp = ht_mcs;
3554         char *end = NULL;
3555
3556         /* If ht_mcs is null, do not set anything */
3557         if (!ht_mcs)
3558                 return 0;
3559
3560         /* This is what we are setting in the kernel */
3561         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3562
3563         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3564
3565         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3566                 errno = 0;
3567                 long v = strtol(tmp, &end, 16);
3568                 if (errno == 0) {
3569                         wpa_msg(wpa_s, MSG_DEBUG,
3570                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3571                                 i, v, end, tmp);
3572                         if (end == tmp)
3573                                 break;
3574
3575                         htcaps->supported_mcs_set[i] = v;
3576                         tmp = end;
3577                 } else {
3578                         wpa_msg(wpa_s, MSG_ERROR,
3579                                 "Failed to parse ht-mcs: %s, error: %s\n",
3580                                 ht_mcs, strerror(errno));
3581                         return -1;
3582                 }
3583         }
3584
3585         /*
3586          * If we were able to parse any values, then set mask for the MCS set.
3587          */
3588         if (i) {
3589                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3590                           IEEE80211_HT_MCS_MASK_LEN - 1);
3591                 /* skip the 3 reserved bits */
3592                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3593                         0x1f;
3594         }
3595
3596         return 0;
3597 }
3598
3599
3600 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3601                                  struct ieee80211_ht_capabilities *htcaps,
3602                                  struct ieee80211_ht_capabilities *htcaps_mask,
3603                                  int disabled)
3604 {
3605         le16 msk;
3606
3607         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3608
3609         if (disabled == -1)
3610                 return 0;
3611
3612         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3613         htcaps_mask->ht_capabilities_info |= msk;
3614         if (disabled)
3615                 htcaps->ht_capabilities_info &= msk;
3616         else
3617                 htcaps->ht_capabilities_info |= msk;
3618
3619         return 0;
3620 }
3621
3622
3623 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3624                                 struct ieee80211_ht_capabilities *htcaps,
3625                                 struct ieee80211_ht_capabilities *htcaps_mask,
3626                                 int factor)
3627 {
3628         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3629
3630         if (factor == -1)
3631                 return 0;
3632
3633         if (factor < 0 || factor > 3) {
3634                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3635                         "Must be 0-3 or -1", factor);
3636                 return -EINVAL;
3637         }
3638
3639         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3640         htcaps->a_mpdu_params &= ~0x3;
3641         htcaps->a_mpdu_params |= factor & 0x3;
3642
3643         return 0;
3644 }
3645
3646
3647 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3648                                  struct ieee80211_ht_capabilities *htcaps,
3649                                  struct ieee80211_ht_capabilities *htcaps_mask,
3650                                  int density)
3651 {
3652         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3653
3654         if (density == -1)
3655                 return 0;
3656
3657         if (density < 0 || density > 7) {
3658                 wpa_msg(wpa_s, MSG_ERROR,
3659                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3660                         density);
3661                 return -EINVAL;
3662         }
3663
3664         htcaps_mask->a_mpdu_params |= 0x1C;
3665         htcaps->a_mpdu_params &= ~(0x1C);
3666         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3667
3668         return 0;
3669 }
3670
3671
3672 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3673                                 struct ieee80211_ht_capabilities *htcaps,
3674                                 struct ieee80211_ht_capabilities *htcaps_mask,
3675                                 int disabled)
3676 {
3677         /* Masking these out disables HT40 */
3678         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3679                                 HT_CAP_INFO_SHORT_GI40MHZ);
3680
3681         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3682
3683         if (disabled)
3684                 htcaps->ht_capabilities_info &= ~msk;
3685         else
3686                 htcaps->ht_capabilities_info |= msk;
3687
3688         htcaps_mask->ht_capabilities_info |= msk;
3689
3690         return 0;
3691 }
3692
3693
3694 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3695                                struct ieee80211_ht_capabilities *htcaps,
3696                                struct ieee80211_ht_capabilities *htcaps_mask,
3697                                int disabled)
3698 {
3699         /* Masking these out disables SGI */
3700         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3701                                 HT_CAP_INFO_SHORT_GI40MHZ);
3702
3703         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3704
3705         if (disabled)
3706                 htcaps->ht_capabilities_info &= ~msk;
3707         else
3708                 htcaps->ht_capabilities_info |= msk;
3709
3710         htcaps_mask->ht_capabilities_info |= msk;
3711
3712         return 0;
3713 }
3714
3715
3716 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3717                                struct ieee80211_ht_capabilities *htcaps,
3718                                struct ieee80211_ht_capabilities *htcaps_mask,
3719                                int disabled)
3720 {
3721         /* Masking these out disables LDPC */
3722         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3723
3724         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3725
3726         if (disabled)
3727                 htcaps->ht_capabilities_info &= ~msk;
3728         else
3729                 htcaps->ht_capabilities_info |= msk;
3730
3731         htcaps_mask->ht_capabilities_info |= msk;
3732
3733         return 0;
3734 }
3735
3736
3737 void wpa_supplicant_apply_ht_overrides(
3738         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3739         struct wpa_driver_associate_params *params)
3740 {
3741         struct ieee80211_ht_capabilities *htcaps;
3742         struct ieee80211_ht_capabilities *htcaps_mask;
3743
3744         if (!ssid)
3745                 return;
3746
3747         params->disable_ht = ssid->disable_ht;
3748         if (!params->htcaps || !params->htcaps_mask)
3749                 return;
3750
3751         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3752         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3753         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3754         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3755                               ssid->disable_max_amsdu);
3756         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3757         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3758         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3759         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3760         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3761
3762         if (ssid->ht40_intolerant) {
3763                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3764                 htcaps->ht_capabilities_info |= bit;
3765                 htcaps_mask->ht_capabilities_info |= bit;
3766         }
3767 }
3768
3769 #endif /* CONFIG_HT_OVERRIDES */
3770
3771
3772 #ifdef CONFIG_VHT_OVERRIDES
3773 void wpa_supplicant_apply_vht_overrides(
3774         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3775         struct wpa_driver_associate_params *params)
3776 {
3777         struct ieee80211_vht_capabilities *vhtcaps;
3778         struct ieee80211_vht_capabilities *vhtcaps_mask;
3779
3780         if (!ssid)
3781                 return;
3782
3783         params->disable_vht = ssid->disable_vht;
3784
3785         vhtcaps = (void *) params->vhtcaps;
3786         vhtcaps_mask = (void *) params->vhtcaps_mask;
3787
3788         if (!vhtcaps || !vhtcaps_mask)
3789                 return;
3790
3791         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3792         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3793
3794 #ifdef CONFIG_HT_OVERRIDES
3795         /* if max ampdu is <= 3, we have to make the HT cap the same */
3796         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3797                 int max_ampdu;
3798
3799                 max_ampdu = (ssid->vht_capa &
3800                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3801                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3802
3803                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3804                 wpa_set_ampdu_factor(wpa_s,
3805                                      (void *) params->htcaps,
3806                                      (void *) params->htcaps_mask,
3807                                      max_ampdu);
3808         }
3809 #endif /* CONFIG_HT_OVERRIDES */
3810
3811 #define OVERRIDE_MCS(i)                                                 \
3812         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3813                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3814                         3 << 2 * (i - 1);                               \
3815                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3816                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3817         }                                                               \
3818         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3819                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3820                         3 << 2 * (i - 1);                               \
3821                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3822                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3823         }
3824
3825         OVERRIDE_MCS(1);
3826         OVERRIDE_MCS(2);
3827         OVERRIDE_MCS(3);
3828         OVERRIDE_MCS(4);
3829         OVERRIDE_MCS(5);
3830         OVERRIDE_MCS(6);
3831         OVERRIDE_MCS(7);
3832         OVERRIDE_MCS(8);
3833 }
3834 #endif /* CONFIG_VHT_OVERRIDES */
3835
3836
3837 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3838 {
3839 #ifdef PCSC_FUNCS
3840         size_t len;
3841
3842         if (!wpa_s->conf->pcsc_reader)
3843                 return 0;
3844
3845         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3846         if (!wpa_s->scard)
3847                 return 1;
3848
3849         if (wpa_s->conf->pcsc_pin &&
3850             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3851                 scard_deinit(wpa_s->scard);
3852                 wpa_s->scard = NULL;
3853                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3854                 return -1;
3855         }
3856
3857         len = sizeof(wpa_s->imsi) - 1;
3858         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3859                 scard_deinit(wpa_s->scard);
3860                 wpa_s->scard = NULL;
3861                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3862                 return -1;
3863         }
3864         wpa_s->imsi[len] = '\0';
3865
3866         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3867
3868         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3869                    wpa_s->imsi, wpa_s->mnc_len);
3870
3871         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3872         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3873 #endif /* PCSC_FUNCS */
3874
3875         return 0;
3876 }
3877
3878
3879 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3880 {
3881         char *val, *pos;
3882
3883         ext_password_deinit(wpa_s->ext_pw);
3884         wpa_s->ext_pw = NULL;
3885         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3886
3887         if (!wpa_s->conf->ext_password_backend)
3888                 return 0;
3889
3890         val = os_strdup(wpa_s->conf->ext_password_backend);
3891         if (val == NULL)
3892                 return -1;
3893         pos = os_strchr(val, ':');
3894         if (pos)
3895                 *pos++ = '\0';
3896
3897         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3898
3899         wpa_s->ext_pw = ext_password_init(val, pos);
3900         os_free(val);
3901         if (wpa_s->ext_pw == NULL) {
3902                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3903                 return -1;
3904         }
3905         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3906
3907         return 0;
3908 }
3909
3910
3911 #ifdef CONFIG_FST
3912
3913 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3914 {
3915         struct wpa_supplicant *wpa_s = ctx;
3916
3917         return (is_zero_ether_addr(wpa_s->bssid) ||
3918                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3919 }
3920
3921
3922 static void wpas_fst_get_channel_info_cb(void *ctx,
3923                                          enum hostapd_hw_mode *hw_mode,
3924                                          u8 *channel)
3925 {
3926         struct wpa_supplicant *wpa_s = ctx;
3927
3928         if (wpa_s->current_bss) {
3929                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3930                                                   channel);
3931         } else if (wpa_s->hw.num_modes) {
3932                 *hw_mode = wpa_s->hw.modes[0].mode;
3933         } else {
3934                 WPA_ASSERT(0);
3935                 *hw_mode = 0;
3936         }
3937 }
3938
3939
3940 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3941 {
3942         struct wpa_supplicant *wpa_s = ctx;
3943
3944         *modes = wpa_s->hw.modes;
3945         return wpa_s->hw.num_modes;
3946 }
3947
3948
3949 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3950 {
3951         struct wpa_supplicant *wpa_s = ctx;
3952
3953         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3954         wpa_s->fst_ies = fst_ies;
3955 }
3956
3957
3958 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3959 {
3960         struct wpa_supplicant *wpa_s = ctx;
3961
3962         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3963         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3964                                           wpa_s->own_addr, wpa_s->bssid,
3965                                           wpabuf_head(data), wpabuf_len(data),
3966                                    0);
3967 }
3968
3969
3970 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3971 {
3972         struct wpa_supplicant *wpa_s = ctx;
3973
3974         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3975         return wpa_s->received_mb_ies;
3976 }
3977
3978
3979 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3980                                      const u8 *buf, size_t size)
3981 {
3982         struct wpa_supplicant *wpa_s = ctx;
3983         struct mb_ies_info info;
3984
3985         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3986
3987         if (!mb_ies_info_by_ies(&info, buf, size)) {
3988                 wpabuf_free(wpa_s->received_mb_ies);
3989                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3990         }
3991 }
3992
3993
3994 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3995                                    Boolean mb_only)
3996 {
3997         struct wpa_supplicant *wpa_s = ctx;
3998
3999         *get_ctx = NULL;
4000         if (!is_zero_ether_addr(wpa_s->bssid))
4001                 return (wpa_s->received_mb_ies || !mb_only) ?
4002                         wpa_s->bssid : NULL;
4003         return NULL;
4004 }
4005
4006
4007 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
4008                                   Boolean mb_only)
4009 {
4010         return NULL;
4011 }
4012
4013 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4014                                        struct fst_wpa_obj *iface_obj)
4015 {
4016         iface_obj->ctx              = wpa_s;
4017         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4018         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4019         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4020         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4021         iface_obj->send_action      = wpas_fst_send_action_cb;
4022         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4023         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4024         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4025         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4026 }
4027 #endif /* CONFIG_FST */
4028
4029 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4030                                     const struct wpa_driver_capa *capa)
4031 {
4032         struct wowlan_triggers *triggers;
4033         int ret = 0;
4034
4035         if (!wpa_s->conf->wowlan_triggers)
4036                 return 0;
4037
4038         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4039         if (triggers) {
4040                 ret = wpa_drv_wowlan(wpa_s, triggers);
4041                 os_free(triggers);
4042         }
4043         return ret;
4044 }
4045
4046
4047 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4048 {
4049         if (freq < 3000)
4050                 return BAND_2_4_GHZ;
4051         if (freq > 50000)
4052                 return BAND_60_GHZ;
4053         return BAND_5_GHZ;
4054 }
4055
4056
4057 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4058 {
4059         int i;
4060         unsigned int band = 0;
4061
4062         if (freqs) {
4063                 /* freqs are specified for the radio work */
4064                 for (i = 0; freqs[i]; i++)
4065                         band |= wpas_freq_to_band(freqs[i]);
4066         } else {
4067                 /*
4068                  * freqs are not specified, implies all
4069                  * the supported freqs by HW
4070                  */
4071                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4072                         if (wpa_s->hw.modes[i].num_channels != 0) {
4073                                 if (wpa_s->hw.modes[i].mode ==
4074                                     HOSTAPD_MODE_IEEE80211B ||
4075                                     wpa_s->hw.modes[i].mode ==
4076                                     HOSTAPD_MODE_IEEE80211G)
4077                                         band |= BAND_2_4_GHZ;
4078                                 else if (wpa_s->hw.modes[i].mode ==
4079                                          HOSTAPD_MODE_IEEE80211A)
4080                                         band |= BAND_5_GHZ;
4081                                 else if (wpa_s->hw.modes[i].mode ==
4082                                          HOSTAPD_MODE_IEEE80211AD)
4083                                         band |= BAND_60_GHZ;
4084                                 else if (wpa_s->hw.modes[i].mode ==
4085                                          HOSTAPD_MODE_IEEE80211ANY)
4086                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4087                                                 BAND_60_GHZ;
4088                         }
4089                 }
4090         }
4091
4092         return band;
4093 }
4094
4095
4096 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4097                                               const char *rn)
4098 {
4099         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4100         struct wpa_radio *radio;
4101
4102         while (rn && iface) {
4103                 radio = iface->radio;
4104                 if (radio && os_strcmp(rn, radio->name) == 0) {
4105                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4106                                    wpa_s->ifname, rn);
4107                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4108                         return radio;
4109                 }
4110
4111                 iface = iface->next;
4112         }
4113
4114         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4115                    wpa_s->ifname, rn ? rn : "N/A");
4116         radio = os_zalloc(sizeof(*radio));
4117         if (radio == NULL)
4118                 return NULL;
4119
4120         if (rn)
4121                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4122         dl_list_init(&radio->ifaces);
4123         dl_list_init(&radio->work);
4124         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4125
4126         return radio;
4127 }
4128
4129
4130 static void radio_work_free(struct wpa_radio_work *work)
4131 {
4132         if (work->wpa_s->scan_work == work) {
4133                 /* This should not really happen. */
4134                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4135                         work->type, work, work->started);
4136                 work->wpa_s->scan_work = NULL;
4137         }
4138
4139 #ifdef CONFIG_P2P
4140         if (work->wpa_s->p2p_scan_work == work) {
4141                 /* This should not really happen. */
4142                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4143                         work->type, work, work->started);
4144                 work->wpa_s->p2p_scan_work = NULL;
4145         }
4146 #endif /* CONFIG_P2P */
4147
4148         if (work->started) {
4149                 work->wpa_s->radio->num_active_works--;
4150                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4151                         "radio_work_free('%s'@%p: num_active_works --> %u",
4152                         work->type, work,
4153                         work->wpa_s->radio->num_active_works);
4154         }
4155
4156         dl_list_del(&work->list);
4157         os_free(work);
4158 }
4159
4160
4161 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4162 {
4163         struct wpa_radio_work *active_work = NULL;
4164         struct wpa_radio_work *tmp;
4165
4166         /* Get the active work to know the type and band. */
4167         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4168                 if (tmp->started) {
4169                         active_work = tmp;
4170                         break;
4171                 }
4172         }
4173
4174         if (!active_work) {
4175                 /* No active work, start one */
4176                 radio->num_active_works = 0;
4177                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4178                                  list) {
4179                         if (os_strcmp(tmp->type, "scan") == 0 &&
4180                             radio->external_scan_running &&
4181                             (((struct wpa_driver_scan_params *)
4182                               tmp->ctx)->only_new_results ||
4183                              tmp->wpa_s->clear_driver_scan_cache))
4184                                 continue;
4185                         return tmp;
4186                 }
4187                 return NULL;
4188         }
4189
4190         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4191             os_strcmp(active_work->type, "connect") == 0) {
4192                 /*
4193                  * If the active work is either connect or sme-connect,
4194                  * do not parallelize them with other radio works.
4195                  */
4196                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4197                         "Do not parallelize radio work with %s",
4198                         active_work->type);
4199                 return NULL;
4200         }
4201
4202         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4203                 if (tmp->started)
4204                         continue;
4205
4206                 /*
4207                  * If connect or sme-connect are enqueued, parallelize only
4208                  * those operations ahead of them in the queue.
4209                  */
4210                 if (os_strcmp(tmp->type, "connect") == 0 ||
4211                     os_strcmp(tmp->type, "sme-connect") == 0)
4212                         break;
4213
4214                 /*
4215                  * Check that the radio works are distinct and
4216                  * on different bands.
4217                  */
4218                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4219                     (active_work->bands != tmp->bands)) {
4220                         /*
4221                          * If a scan has to be scheduled through nl80211 scan
4222                          * interface and if an external scan is already running,
4223                          * do not schedule the scan since it is likely to get
4224                          * rejected by kernel.
4225                          */
4226                         if (os_strcmp(tmp->type, "scan") == 0 &&
4227                             radio->external_scan_running &&
4228                             (((struct wpa_driver_scan_params *)
4229                               tmp->ctx)->only_new_results ||
4230                              tmp->wpa_s->clear_driver_scan_cache))
4231                                 continue;
4232
4233                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4234                                 "active_work:%s new_work:%s",
4235                                 active_work->type, tmp->type);
4236                         return tmp;
4237                 }
4238         }
4239
4240         /* Did not find a radio work to schedule in parallel. */
4241         return NULL;
4242 }
4243
4244
4245 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4246 {
4247         struct wpa_radio *radio = eloop_ctx;
4248         struct wpa_radio_work *work;
4249         struct os_reltime now, diff;
4250         struct wpa_supplicant *wpa_s;
4251
4252         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4253         if (work == NULL) {
4254                 radio->num_active_works = 0;
4255                 return;
4256         }
4257
4258         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4259                               radio_list);
4260
4261         if (!(wpa_s &&
4262               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4263                 if (work->started)
4264                         return; /* already started and still in progress */
4265
4266                 if (wpa_s && wpa_s->radio->external_scan_running) {
4267                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4268                         return;
4269                 }
4270         } else {
4271                 work = NULL;
4272                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4273                         /* get the work to schedule next */
4274                         work = radio_work_get_next_work(radio);
4275                 }
4276                 if (!work)
4277                         return;
4278         }
4279
4280         wpa_s = work->wpa_s;
4281         os_get_reltime(&now);
4282         os_reltime_sub(&now, &work->time, &diff);
4283         wpa_dbg(wpa_s, MSG_DEBUG,
4284                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4285                 work->type, work, diff.sec, diff.usec);
4286         work->started = 1;
4287         work->time = now;
4288         radio->num_active_works++;
4289
4290         work->cb(work, 0);
4291
4292         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4293             radio->num_active_works < MAX_ACTIVE_WORKS)
4294                 radio_work_check_next(wpa_s);
4295 }
4296
4297
4298 /*
4299  * This function removes both started and pending radio works running on
4300  * the provided interface's radio.
4301  * Prior to the removal of the radio work, its callback (cb) is called with
4302  * deinit set to be 1. Each work's callback is responsible for clearing its
4303  * internal data and restoring to a correct state.
4304  * @wpa_s: wpa_supplicant data
4305  * @type: type of works to be removed
4306  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4307  * this interface's works.
4308  */
4309 void radio_remove_works(struct wpa_supplicant *wpa_s,
4310                         const char *type, int remove_all)
4311 {
4312         struct wpa_radio_work *work, *tmp;
4313         struct wpa_radio *radio = wpa_s->radio;
4314
4315         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4316                               list) {
4317                 if (type && os_strcmp(type, work->type) != 0)
4318                         continue;
4319
4320                 /* skip other ifaces' works */
4321                 if (!remove_all && work->wpa_s != wpa_s)
4322                         continue;
4323
4324                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4325                         work->type, work, work->started ? " (started)" : "");
4326                 work->cb(work, 1);
4327                 radio_work_free(work);
4328         }
4329
4330         /* in case we removed the started work */
4331         radio_work_check_next(wpa_s);
4332 }
4333
4334
4335 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4336 {
4337         struct wpa_radio *radio = wpa_s->radio;
4338
4339         if (!radio)
4340                 return;
4341
4342         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4343                    wpa_s->ifname, radio->name);
4344         dl_list_del(&wpa_s->radio_list);
4345         radio_remove_works(wpa_s, NULL, 0);
4346         wpa_s->radio = NULL;
4347         if (!dl_list_empty(&radio->ifaces))
4348                 return; /* Interfaces remain for this radio */
4349
4350         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4351         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4352         os_free(radio);
4353 }
4354
4355
4356 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4357 {
4358         struct wpa_radio *radio = wpa_s->radio;
4359
4360         if (dl_list_empty(&radio->work))
4361                 return;
4362         if (wpa_s->ext_work_in_progress) {
4363                 wpa_printf(MSG_DEBUG,
4364                            "External radio work in progress - delay start of pending item");
4365                 return;
4366         }
4367         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4368         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4369 }
4370
4371
4372 /**
4373  * radio_add_work - Add a radio work item
4374  * @wpa_s: Pointer to wpa_supplicant data
4375  * @freq: Frequency of the offchannel operation in MHz or 0
4376  * @type: Unique identifier for each type of work
4377  * @next: Force as the next work to be executed
4378  * @cb: Callback function for indicating when radio is available
4379  * @ctx: Context pointer for the work (work->ctx in cb())
4380  * Returns: 0 on success, -1 on failure
4381  *
4382  * This function is used to request time for an operation that requires
4383  * exclusive radio control. Once the radio is available, the registered callback
4384  * function will be called. radio_work_done() must be called once the exclusive
4385  * radio operation has been completed, so that the radio is freed for other
4386  * operations. The special case of deinit=1 is used to free the context data
4387  * during interface removal. That does not allow the callback function to start
4388  * the radio operation, i.e., it must free any resources allocated for the radio
4389  * work and return.
4390  *
4391  * The @freq parameter can be used to indicate a single channel on which the
4392  * offchannel operation will occur. This may allow multiple radio work
4393  * operations to be performed in parallel if they apply for the same channel.
4394  * Setting this to 0 indicates that the work item may use multiple channels or
4395  * requires exclusive control of the radio.
4396  */
4397 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4398                    const char *type, int next,
4399                    void (*cb)(struct wpa_radio_work *work, int deinit),
4400                    void *ctx)
4401 {
4402         struct wpa_radio *radio = wpa_s->radio;
4403         struct wpa_radio_work *work;
4404         int was_empty;
4405
4406         work = os_zalloc(sizeof(*work));
4407         if (work == NULL)
4408                 return -1;
4409         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4410         os_get_reltime(&work->time);
4411         work->freq = freq;
4412         work->type = type;
4413         work->wpa_s = wpa_s;
4414         work->cb = cb;
4415         work->ctx = ctx;
4416
4417         if (freq)
4418                 work->bands = wpas_freq_to_band(freq);
4419         else if (os_strcmp(type, "scan") == 0 ||
4420                  os_strcmp(type, "p2p-scan") == 0)
4421                 work->bands = wpas_get_bands(wpa_s,
4422                                              ((struct wpa_driver_scan_params *)
4423                                               ctx)->freqs);
4424         else
4425                 work->bands = wpas_get_bands(wpa_s, NULL);
4426
4427         was_empty = dl_list_empty(&wpa_s->radio->work);
4428         if (next)
4429                 dl_list_add(&wpa_s->radio->work, &work->list);
4430         else
4431                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4432         if (was_empty) {
4433                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4434                 radio_work_check_next(wpa_s);
4435         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4436                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4437                 wpa_dbg(wpa_s, MSG_DEBUG,
4438                         "Try to schedule a radio work (num_active_works=%u)",
4439                         radio->num_active_works);
4440                 radio_work_check_next(wpa_s);
4441         }
4442
4443         return 0;
4444 }
4445
4446
4447 /**
4448  * radio_work_done - Indicate that a radio work item has been completed
4449  * @work: Completed work
4450  *
4451  * This function is called once the callback function registered with
4452  * radio_add_work() has completed its work.
4453  */
4454 void radio_work_done(struct wpa_radio_work *work)
4455 {
4456         struct wpa_supplicant *wpa_s = work->wpa_s;
4457         struct os_reltime now, diff;
4458         unsigned int started = work->started;
4459
4460         os_get_reltime(&now);
4461         os_reltime_sub(&now, &work->time, &diff);
4462         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4463                 work->type, work, started ? "done" : "canceled",
4464                 diff.sec, diff.usec);
4465         radio_work_free(work);
4466         if (started)
4467                 radio_work_check_next(wpa_s);
4468 }
4469
4470
4471 struct wpa_radio_work *
4472 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4473 {
4474         struct wpa_radio_work *work;
4475         struct wpa_radio *radio = wpa_s->radio;
4476
4477         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4478                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4479                         return work;
4480         }
4481
4482         return NULL;
4483 }
4484
4485
4486 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4487                             struct wpa_interface *iface)
4488 {
4489         const char *ifname, *driver, *rn;
4490
4491         driver = iface->driver;
4492 next_driver:
4493         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4494                 return -1;
4495
4496         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4497         if (wpa_s->drv_priv == NULL) {
4498                 const char *pos;
4499                 pos = driver ? os_strchr(driver, ',') : NULL;
4500                 if (pos) {
4501                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4502                                 "driver interface - try next driver wrapper");
4503                         driver = pos + 1;
4504                         goto next_driver;
4505                 }
4506                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4507                         "interface");
4508                 return -1;
4509         }
4510         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4511                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4512                         "driver_param '%s'", wpa_s->conf->driver_param);
4513                 return -1;
4514         }
4515
4516         ifname = wpa_drv_get_ifname(wpa_s);
4517         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4518                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4519                         "interface name with '%s'", ifname);
4520                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4521         }
4522
4523         rn = wpa_driver_get_radio_name(wpa_s);
4524         if (rn && rn[0] == '\0')
4525                 rn = NULL;
4526
4527         wpa_s->radio = radio_add_interface(wpa_s, rn);
4528         if (wpa_s->radio == NULL)
4529                 return -1;
4530
4531         return 0;
4532 }
4533
4534
4535 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4536                                      struct wpa_interface *iface)
4537 {
4538         struct wpa_driver_capa capa;
4539         int capa_res;
4540
4541         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4542                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4543                    iface->confname ? iface->confname : "N/A",
4544                    iface->driver ? iface->driver : "default",
4545                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4546                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4547
4548         if (iface->confname) {
4549 #ifdef CONFIG_BACKEND_FILE
4550                 wpa_s->confname = os_rel2abs_path(iface->confname);
4551                 if (wpa_s->confname == NULL) {
4552                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4553                                    "for configuration file '%s'.",
4554                                    iface->confname);
4555                         return -1;
4556                 }
4557                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4558                            iface->confname, wpa_s->confname);
4559 #else /* CONFIG_BACKEND_FILE */
4560                 wpa_s->confname = os_strdup(iface->confname);
4561 #endif /* CONFIG_BACKEND_FILE */
4562                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4563                 if (wpa_s->conf == NULL) {
4564                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4565                                    "configuration '%s'.", wpa_s->confname);
4566                         return -1;
4567                 }
4568                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4569                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4570
4571                 /*
4572                  * Override ctrl_interface and driver_param if set on command
4573                  * line.
4574                  */
4575                 if (iface->ctrl_interface) {
4576                         os_free(wpa_s->conf->ctrl_interface);
4577                         wpa_s->conf->ctrl_interface =
4578                                 os_strdup(iface->ctrl_interface);
4579                 }
4580
4581                 if (iface->driver_param) {
4582                         os_free(wpa_s->conf->driver_param);
4583                         wpa_s->conf->driver_param =
4584                                 os_strdup(iface->driver_param);
4585                 }
4586
4587                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4588                         os_free(wpa_s->conf->ctrl_interface);
4589                         wpa_s->conf->ctrl_interface = NULL;
4590                 }
4591         } else
4592                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4593                                                      iface->driver_param);
4594
4595         if (wpa_s->conf == NULL) {
4596                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4597                 return -1;
4598         }
4599
4600         if (iface->ifname == NULL) {
4601                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4602                 return -1;
4603         }
4604         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4605                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4606                            iface->ifname);
4607                 return -1;
4608         }
4609         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4610
4611         if (iface->bridge_ifname) {
4612                 if (os_strlen(iface->bridge_ifname) >=
4613                     sizeof(wpa_s->bridge_ifname)) {
4614                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4615                                    "name '%s'.", iface->bridge_ifname);
4616                         return -1;
4617                 }
4618                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4619                            sizeof(wpa_s->bridge_ifname));
4620         }
4621
4622         /* RSNA Supplicant Key Management - INITIALIZE */
4623         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4624         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4625
4626         /* Initialize driver interface and register driver event handler before
4627          * L2 receive handler so that association events are processed before
4628          * EAPOL-Key packets if both become available for the same select()
4629          * call. */
4630         if (wpas_init_driver(wpa_s, iface) < 0)
4631                 return -1;
4632
4633         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4634                 return -1;
4635
4636         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4637                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4638                           NULL);
4639         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4640
4641         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4642             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4643                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4644                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4645                         "dot11RSNAConfigPMKLifetime");
4646                 return -1;
4647         }
4648
4649         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4650             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4651                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4652                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4653                         "dot11RSNAConfigPMKReauthThreshold");
4654                 return -1;
4655         }
4656
4657         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4658             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4659                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4660                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4661                         "dot11RSNAConfigSATimeout");
4662                 return -1;
4663         }
4664
4665         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4666                                                       &wpa_s->hw.num_modes,
4667                                                       &wpa_s->hw.flags);
4668         if (wpa_s->hw.modes) {
4669                 u16 i;
4670
4671                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4672                         if (wpa_s->hw.modes[i].vht_capab) {
4673                                 wpa_s->hw_capab = CAPAB_VHT;
4674                                 break;
4675                         }
4676
4677                         if (wpa_s->hw.modes[i].ht_capab &
4678                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4679                                 wpa_s->hw_capab = CAPAB_HT40;
4680                         else if (wpa_s->hw.modes[i].ht_capab &&
4681                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4682                                 wpa_s->hw_capab = CAPAB_HT;
4683                 }
4684         }
4685
4686         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4687         if (capa_res == 0) {
4688                 wpa_s->drv_capa_known = 1;
4689                 wpa_s->drv_flags = capa.flags;
4690                 wpa_s->drv_enc = capa.enc;
4691                 wpa_s->drv_smps_modes = capa.smps_modes;
4692                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4693                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4694                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4695                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4696                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4697                 wpa_s->max_sched_scan_plan_interval =
4698                         capa.max_sched_scan_plan_interval;
4699                 wpa_s->max_sched_scan_plan_iterations =
4700                         capa.max_sched_scan_plan_iterations;
4701                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4702                 wpa_s->max_match_sets = capa.max_match_sets;
4703                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4704                 wpa_s->max_stations = capa.max_stations;
4705                 wpa_s->extended_capa = capa.extended_capa;
4706                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4707                 wpa_s->extended_capa_len = capa.extended_capa_len;
4708                 wpa_s->num_multichan_concurrent =
4709                         capa.num_multichan_concurrent;
4710                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4711
4712                 if (capa.mac_addr_rand_scan_supported)
4713                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4714                 if (wpa_s->sched_scan_supported &&
4715                     capa.mac_addr_rand_sched_scan_supported)
4716                         wpa_s->mac_addr_rand_supported |=
4717                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4718         }
4719         if (wpa_s->max_remain_on_chan == 0)
4720                 wpa_s->max_remain_on_chan = 1000;
4721
4722         /*
4723          * Only take p2p_mgmt parameters when P2P Device is supported.
4724          * Doing it here as it determines whether l2_packet_init() will be done
4725          * during wpa_supplicant_driver_init().
4726          */
4727         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4728                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4729         else
4730                 iface->p2p_mgmt = 1;
4731
4732         if (wpa_s->num_multichan_concurrent == 0)
4733                 wpa_s->num_multichan_concurrent = 1;
4734
4735         if (wpa_supplicant_driver_init(wpa_s) < 0)
4736                 return -1;
4737
4738 #ifdef CONFIG_TDLS
4739         if ((!iface->p2p_mgmt ||
4740              !(wpa_s->drv_flags &
4741                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4742             wpa_tdls_init(wpa_s->wpa))
4743                 return -1;
4744 #endif /* CONFIG_TDLS */
4745
4746         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4747             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4748                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4749                 return -1;
4750         }
4751
4752 #ifdef CONFIG_FST
4753         if (wpa_s->conf->fst_group_id) {
4754                 struct fst_iface_cfg cfg;
4755                 struct fst_wpa_obj iface_obj;
4756
4757                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4758                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4759                            sizeof(cfg.group_id));
4760                 cfg.priority = wpa_s->conf->fst_priority;
4761                 cfg.llt = wpa_s->conf->fst_llt;
4762
4763                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4764                                         &iface_obj, &cfg);
4765                 if (!wpa_s->fst) {
4766                         wpa_msg(wpa_s, MSG_ERROR,
4767                                 "FST: Cannot attach iface %s to group %s",
4768                                 wpa_s->ifname, cfg.group_id);
4769                         return -1;
4770                 }
4771         }
4772 #endif /* CONFIG_FST */
4773
4774         if (wpas_wps_init(wpa_s))
4775                 return -1;
4776
4777         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4778                 return -1;
4779         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4780
4781         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4782         if (wpa_s->ctrl_iface == NULL) {
4783                 wpa_printf(MSG_ERROR,
4784                            "Failed to initialize control interface '%s'.\n"
4785                            "You may have another wpa_supplicant process "
4786                            "already running or the file was\n"
4787                            "left by an unclean termination of wpa_supplicant "
4788                            "in which case you will need\n"
4789                            "to manually remove this file before starting "
4790                            "wpa_supplicant again.\n",
4791                            wpa_s->conf->ctrl_interface);
4792                 return -1;
4793         }
4794
4795         wpa_s->gas = gas_query_init(wpa_s);
4796         if (wpa_s->gas == NULL) {
4797                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4798                 return -1;
4799         }
4800
4801         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4802                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4803                 return -1;
4804         }
4805
4806         if (wpa_bss_init(wpa_s) < 0)
4807                 return -1;
4808
4809         /*
4810          * Set Wake-on-WLAN triggers, if configured.
4811          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4812          * have effect anyway when the interface is down).
4813          */
4814         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4815                 return -1;
4816
4817 #ifdef CONFIG_EAP_PROXY
4818 {
4819         size_t len;
4820         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4821                                                      &len);
4822         if (wpa_s->mnc_len > 0) {
4823                 wpa_s->imsi[len] = '\0';
4824                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4825                            wpa_s->imsi, wpa_s->mnc_len);
4826         } else {
4827                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4828         }
4829 }
4830 #endif /* CONFIG_EAP_PROXY */
4831
4832         if (pcsc_reader_init(wpa_s) < 0)
4833                 return -1;
4834
4835         if (wpas_init_ext_pw(wpa_s) < 0)
4836                 return -1;
4837
4838         wpas_rrm_reset(wpa_s);
4839
4840         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4841
4842 #ifdef CONFIG_HS20
4843         hs20_init(wpa_s);
4844 #endif /* CONFIG_HS20 */
4845 #ifdef CONFIG_MBO
4846         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4847 #endif /* CONFIG_MBO */
4848
4849         return 0;
4850 }
4851
4852
4853 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4854                                         int notify, int terminate)
4855 {
4856         struct wpa_global *global = wpa_s->global;
4857         struct wpa_supplicant *iface, *prev;
4858
4859         if (wpa_s == wpa_s->parent)
4860                 wpas_p2p_group_remove(wpa_s, "*");
4861
4862         iface = global->ifaces;
4863         while (iface) {
4864                 if (iface->p2pdev == wpa_s)
4865                         iface->p2pdev = iface->parent;
4866                 if (iface == wpa_s || iface->parent != wpa_s) {
4867                         iface = iface->next;
4868                         continue;
4869                 }
4870                 wpa_printf(MSG_DEBUG,
4871                            "Remove remaining child interface %s from parent %s",
4872                            iface->ifname, wpa_s->ifname);
4873                 prev = iface;
4874                 iface = iface->next;
4875                 wpa_supplicant_remove_iface(global, prev, terminate);
4876         }
4877
4878         wpa_s->disconnected = 1;
4879         if (wpa_s->drv_priv) {
4880                 wpa_supplicant_deauthenticate(wpa_s,
4881                                               WLAN_REASON_DEAUTH_LEAVING);
4882
4883                 wpa_drv_set_countermeasures(wpa_s, 0);
4884                 wpa_clear_keys(wpa_s, NULL);
4885         }
4886
4887         wpa_supplicant_cleanup(wpa_s);
4888         wpas_p2p_deinit_iface(wpa_s);
4889
4890         wpas_ctrl_radio_work_flush(wpa_s);
4891         radio_remove_interface(wpa_s);
4892
4893 #ifdef CONFIG_FST
4894         if (wpa_s->fst) {
4895                 fst_detach(wpa_s->fst);
4896                 wpa_s->fst = NULL;
4897         }
4898         if (wpa_s->received_mb_ies) {
4899                 wpabuf_free(wpa_s->received_mb_ies);
4900                 wpa_s->received_mb_ies = NULL;
4901         }
4902 #endif /* CONFIG_FST */
4903
4904         if (wpa_s->drv_priv)
4905                 wpa_drv_deinit(wpa_s);
4906
4907         if (notify)
4908                 wpas_notify_iface_removed(wpa_s);
4909
4910         if (terminate)
4911                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4912
4913         if (wpa_s->ctrl_iface) {
4914                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4915                 wpa_s->ctrl_iface = NULL;
4916         }
4917
4918 #ifdef CONFIG_MESH
4919         if (wpa_s->ifmsh) {
4920                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4921                 wpa_s->ifmsh = NULL;
4922         }
4923 #endif /* CONFIG_MESH */
4924
4925         if (wpa_s->conf != NULL) {
4926                 wpa_config_free(wpa_s->conf);
4927                 wpa_s->conf = NULL;
4928         }
4929
4930         os_free(wpa_s->ssids_from_scan_req);
4931
4932         os_free(wpa_s);
4933 }
4934
4935
4936 #ifdef CONFIG_MATCH_IFACE
4937
4938 /**
4939  * wpa_supplicant_match_iface - Match an interface description to a name
4940  * @global: Pointer to global data from wpa_supplicant_init()
4941  * @ifname: Name of the interface to match
4942  * Returns: Pointer to the created interface description or %NULL on failure
4943  */
4944 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
4945                                                   const char *ifname)
4946 {
4947         int i;
4948         struct wpa_interface *iface, *miface;
4949
4950         for (i = 0; i < global->params.match_iface_count; i++) {
4951                 miface = &global->params.match_ifaces[i];
4952                 if (!miface->ifname ||
4953                     fnmatch(miface->ifname, ifname, 0) == 0) {
4954                         iface = os_zalloc(sizeof(*iface));
4955                         if (!iface)
4956                                 return NULL;
4957                         *iface = *miface;
4958                         iface->ifname = ifname;
4959                         return iface;
4960                 }
4961         }
4962
4963         return NULL;
4964 }
4965
4966
4967 /**
4968  * wpa_supplicant_match_existing - Match existing interfaces
4969  * @global: Pointer to global data from wpa_supplicant_init()
4970  * Returns: 0 on success, -1 on failure
4971  */
4972 static int wpa_supplicant_match_existing(struct wpa_global *global)
4973 {
4974         struct if_nameindex *ifi, *ifp;
4975         struct wpa_supplicant *wpa_s;
4976         struct wpa_interface *iface;
4977
4978         ifp = if_nameindex();
4979         if (!ifp) {
4980                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
4981                 return -1;
4982         }
4983
4984         for (ifi = ifp; ifi->if_name; ifi++) {
4985                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
4986                 if (wpa_s)
4987                         continue;
4988                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
4989                 if (iface) {
4990                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
4991                         os_free(iface);
4992                         if (wpa_s)
4993                                 wpa_s->matched = 1;
4994                 }
4995         }
4996
4997         if_freenameindex(ifp);
4998         return 0;
4999 }
5000
5001 #endif /* CONFIG_MATCH_IFACE */
5002
5003
5004 /**
5005  * wpa_supplicant_add_iface - Add a new network interface
5006  * @global: Pointer to global data from wpa_supplicant_init()
5007  * @iface: Interface configuration options
5008  * @parent: Parent interface or %NULL to assign new interface as parent
5009  * Returns: Pointer to the created interface or %NULL on failure
5010  *
5011  * This function is used to add new network interfaces for %wpa_supplicant.
5012  * This can be called before wpa_supplicant_run() to add interfaces before the
5013  * main event loop has been started. In addition, new interfaces can be added
5014  * dynamically while %wpa_supplicant is already running. This could happen,
5015  * e.g., when a hotplug network adapter is inserted.
5016  */
5017 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5018                                                  struct wpa_interface *iface,
5019                                                  struct wpa_supplicant *parent)
5020 {
5021         struct wpa_supplicant *wpa_s;
5022         struct wpa_interface t_iface;
5023         struct wpa_ssid *ssid;
5024
5025         if (global == NULL || iface == NULL)
5026                 return NULL;
5027
5028         wpa_s = wpa_supplicant_alloc(parent);
5029         if (wpa_s == NULL)
5030                 return NULL;
5031
5032         wpa_s->global = global;
5033
5034         t_iface = *iface;
5035         if (global->params.override_driver) {
5036                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5037                            "('%s' -> '%s')",
5038                            iface->driver, global->params.override_driver);
5039                 t_iface.driver = global->params.override_driver;
5040         }
5041         if (global->params.override_ctrl_interface) {
5042                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5043                            "ctrl_interface ('%s' -> '%s')",
5044                            iface->ctrl_interface,
5045                            global->params.override_ctrl_interface);
5046                 t_iface.ctrl_interface =
5047                         global->params.override_ctrl_interface;
5048         }
5049         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5050                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5051                            iface->ifname);
5052                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5053                 return NULL;
5054         }
5055
5056         if (iface->p2p_mgmt == 0) {
5057                 /* Notify the control interfaces about new iface */
5058                 if (wpas_notify_iface_added(wpa_s)) {
5059                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5060                         return NULL;
5061                 }
5062
5063                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5064                         wpas_notify_network_added(wpa_s, ssid);
5065         }
5066
5067         wpa_s->next = global->ifaces;
5068         global->ifaces = wpa_s;
5069
5070         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5071         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5072
5073 #ifdef CONFIG_P2P
5074         if (wpa_s->global->p2p == NULL &&
5075             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5076             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5077             wpas_p2p_add_p2pdev_interface(
5078                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5079                 wpa_printf(MSG_INFO,
5080                            "P2P: Failed to enable P2P Device interface");
5081                 /* Try to continue without. P2P will be disabled. */
5082         }
5083 #endif /* CONFIG_P2P */
5084
5085         return wpa_s;
5086 }
5087
5088
5089 /**
5090  * wpa_supplicant_remove_iface - Remove a network interface
5091  * @global: Pointer to global data from wpa_supplicant_init()
5092  * @wpa_s: Pointer to the network interface to be removed
5093  * Returns: 0 if interface was removed, -1 if interface was not found
5094  *
5095  * This function can be used to dynamically remove network interfaces from
5096  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5097  * addition, this function is used to remove all remaining interfaces when
5098  * %wpa_supplicant is terminated.
5099  */
5100 int wpa_supplicant_remove_iface(struct wpa_global *global,
5101                                 struct wpa_supplicant *wpa_s,
5102                                 int terminate)
5103 {
5104         struct wpa_supplicant *prev;
5105 #ifdef CONFIG_MESH
5106         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5107         char *ifname = NULL;
5108 #endif /* CONFIG_MESH */
5109
5110         /* Remove interface from the global list of interfaces */
5111         prev = global->ifaces;
5112         if (prev == wpa_s) {
5113                 global->ifaces = wpa_s->next;
5114         } else {
5115                 while (prev && prev->next != wpa_s)
5116                         prev = prev->next;
5117                 if (prev == NULL)
5118                         return -1;
5119                 prev->next = wpa_s->next;
5120         }
5121
5122         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5123
5124 #ifdef CONFIG_MESH
5125         if (mesh_if_created) {
5126                 ifname = os_strdup(wpa_s->ifname);
5127                 if (ifname == NULL) {
5128                         wpa_dbg(wpa_s, MSG_ERROR,
5129                                 "mesh: Failed to malloc ifname");
5130                         return -1;
5131                 }
5132         }
5133 #endif /* CONFIG_MESH */
5134
5135         if (global->p2p_group_formation == wpa_s)
5136                 global->p2p_group_formation = NULL;
5137         if (global->p2p_invite_group == wpa_s)
5138                 global->p2p_invite_group = NULL;
5139         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5140
5141 #ifdef CONFIG_MESH
5142         if (mesh_if_created) {
5143                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5144                 os_free(ifname);
5145         }
5146 #endif /* CONFIG_MESH */
5147
5148         return 0;
5149 }
5150
5151
5152 /**
5153  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5154  * @wpa_s: Pointer to the network interface
5155  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5156  */
5157 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5158 {
5159         const char *eapol_method;
5160
5161         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5162             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5163                 return "NO-EAP";
5164         }
5165
5166         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5167         if (eapol_method == NULL)
5168                 return "UNKNOWN-EAP";
5169
5170         return eapol_method;
5171 }
5172
5173
5174 /**
5175  * wpa_supplicant_get_iface - Get a new network interface
5176  * @global: Pointer to global data from wpa_supplicant_init()
5177  * @ifname: Interface name
5178  * Returns: Pointer to the interface or %NULL if not found
5179  */
5180 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5181                                                  const char *ifname)
5182 {
5183         struct wpa_supplicant *wpa_s;
5184
5185         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5186                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5187                         return wpa_s;
5188         }
5189         return NULL;
5190 }
5191
5192
5193 #ifndef CONFIG_NO_WPA_MSG
5194 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5195 {
5196         struct wpa_supplicant *wpa_s = ctx;
5197         if (wpa_s == NULL)
5198                 return NULL;
5199         return wpa_s->ifname;
5200 }
5201 #endif /* CONFIG_NO_WPA_MSG */
5202
5203
5204 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5205 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5206 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5207
5208 /* Periodic cleanup tasks */
5209 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5210 {
5211         struct wpa_global *global = eloop_ctx;
5212         struct wpa_supplicant *wpa_s;
5213
5214         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5215                                wpas_periodic, global, NULL);
5216
5217 #ifdef CONFIG_P2P
5218         if (global->p2p)
5219                 p2p_expire_peers(global->p2p);
5220 #endif /* CONFIG_P2P */
5221
5222         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5223                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5224 #ifdef CONFIG_AP
5225                 ap_periodic(wpa_s);
5226 #endif /* CONFIG_AP */
5227         }
5228 }
5229
5230
5231 /**
5232  * wpa_supplicant_init - Initialize %wpa_supplicant
5233  * @params: Parameters for %wpa_supplicant
5234  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5235  *
5236  * This function is used to initialize %wpa_supplicant. After successful
5237  * initialization, the returned data pointer can be used to add and remove
5238  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5239  */
5240 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5241 {
5242         struct wpa_global *global;
5243         int ret, i;
5244
5245         if (params == NULL)
5246                 return NULL;
5247
5248 #ifdef CONFIG_DRIVER_NDIS
5249         {
5250                 void driver_ndis_init_ops(void);
5251                 driver_ndis_init_ops();
5252         }
5253 #endif /* CONFIG_DRIVER_NDIS */
5254
5255 #ifndef CONFIG_NO_WPA_MSG
5256         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5257 #endif /* CONFIG_NO_WPA_MSG */
5258
5259         if (params->wpa_debug_file_path)
5260                 wpa_debug_open_file(params->wpa_debug_file_path);
5261         else
5262                 wpa_debug_setup_stdout();
5263         if (params->wpa_debug_syslog)
5264                 wpa_debug_open_syslog();
5265         if (params->wpa_debug_tracing) {
5266                 ret = wpa_debug_open_linux_tracing();
5267                 if (ret) {
5268                         wpa_printf(MSG_ERROR,
5269                                    "Failed to enable trace logging");
5270                         return NULL;
5271                 }
5272         }
5273
5274         ret = eap_register_methods();
5275         if (ret) {
5276                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5277                 if (ret == -2)
5278                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5279                                    "the same EAP type.");
5280                 return NULL;
5281         }
5282
5283         global = os_zalloc(sizeof(*global));
5284         if (global == NULL)
5285                 return NULL;
5286         dl_list_init(&global->p2p_srv_bonjour);
5287         dl_list_init(&global->p2p_srv_upnp);
5288         global->params.daemonize = params->daemonize;
5289         global->params.wait_for_monitor = params->wait_for_monitor;
5290         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5291         if (params->pid_file)
5292                 global->params.pid_file = os_strdup(params->pid_file);
5293         if (params->ctrl_interface)
5294                 global->params.ctrl_interface =
5295                         os_strdup(params->ctrl_interface);
5296         if (params->ctrl_interface_group)
5297                 global->params.ctrl_interface_group =
5298                         os_strdup(params->ctrl_interface_group);
5299         if (params->override_driver)
5300                 global->params.override_driver =
5301                         os_strdup(params->override_driver);
5302         if (params->override_ctrl_interface)
5303                 global->params.override_ctrl_interface =
5304                         os_strdup(params->override_ctrl_interface);
5305 #ifdef CONFIG_MATCH_IFACE
5306         global->params.match_iface_count = params->match_iface_count;
5307         if (params->match_iface_count) {
5308                 global->params.match_ifaces =
5309                         os_calloc(params->match_iface_count,
5310                                   sizeof(struct wpa_interface));
5311                 os_memcpy(global->params.match_ifaces,
5312                           params->match_ifaces,
5313                           params->match_iface_count *
5314                           sizeof(struct wpa_interface));
5315         }
5316 #endif /* CONFIG_MATCH_IFACE */
5317 #ifdef CONFIG_P2P
5318         if (params->conf_p2p_dev)
5319                 global->params.conf_p2p_dev =
5320                         os_strdup(params->conf_p2p_dev);
5321 #endif /* CONFIG_P2P */
5322         wpa_debug_level = global->params.wpa_debug_level =
5323                 params->wpa_debug_level;
5324         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5325                 params->wpa_debug_show_keys;
5326         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5327                 params->wpa_debug_timestamp;
5328
5329         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5330
5331         if (eloop_init()) {
5332                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5333                 wpa_supplicant_deinit(global);
5334                 return NULL;
5335         }
5336
5337         random_init(params->entropy_file);
5338
5339         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5340         if (global->ctrl_iface == NULL) {
5341                 wpa_supplicant_deinit(global);
5342                 return NULL;
5343         }
5344
5345         if (wpas_notify_supplicant_initialized(global)) {
5346                 wpa_supplicant_deinit(global);
5347                 return NULL;
5348         }
5349
5350         for (i = 0; wpa_drivers[i]; i++)
5351                 global->drv_count++;
5352         if (global->drv_count == 0) {
5353                 wpa_printf(MSG_ERROR, "No drivers enabled");
5354                 wpa_supplicant_deinit(global);
5355                 return NULL;
5356         }
5357         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5358         if (global->drv_priv == NULL) {
5359                 wpa_supplicant_deinit(global);
5360                 return NULL;
5361         }
5362
5363 #ifdef CONFIG_WIFI_DISPLAY
5364         if (wifi_display_init(global) < 0) {
5365                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5366                 wpa_supplicant_deinit(global);
5367                 return NULL;
5368         }
5369 #endif /* CONFIG_WIFI_DISPLAY */
5370
5371         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5372                                wpas_periodic, global, NULL);
5373
5374         return global;
5375 }
5376
5377
5378 /**
5379  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5380  * @global: Pointer to global data from wpa_supplicant_init()
5381  * Returns: 0 after successful event loop run, -1 on failure
5382  *
5383  * This function starts the main event loop and continues running as long as
5384  * there are any remaining events. In most cases, this function is running as
5385  * long as the %wpa_supplicant process in still in use.
5386  */
5387 int wpa_supplicant_run(struct wpa_global *global)
5388 {
5389         struct wpa_supplicant *wpa_s;
5390
5391         if (global->params.daemonize &&
5392             (wpa_supplicant_daemon(global->params.pid_file) ||
5393              eloop_sock_requeue()))
5394                 return -1;
5395
5396 #ifdef CONFIG_MATCH_IFACE
5397         if (wpa_supplicant_match_existing(global))
5398                 return -1;
5399 #endif
5400
5401         if (global->params.wait_for_monitor) {
5402                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5403                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5404                                 wpa_supplicant_ctrl_iface_wait(
5405                                         wpa_s->ctrl_iface);
5406         }
5407
5408         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5409         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5410
5411         eloop_run();
5412
5413         return 0;
5414 }
5415
5416
5417 /**
5418  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5419  * @global: Pointer to global data from wpa_supplicant_init()
5420  *
5421  * This function is called to deinitialize %wpa_supplicant and to free all
5422  * allocated resources. Remaining network interfaces will also be removed.
5423  */
5424 void wpa_supplicant_deinit(struct wpa_global *global)
5425 {
5426         int i;
5427
5428         if (global == NULL)
5429                 return;
5430
5431         eloop_cancel_timeout(wpas_periodic, global, NULL);
5432
5433 #ifdef CONFIG_WIFI_DISPLAY
5434         wifi_display_deinit(global);
5435 #endif /* CONFIG_WIFI_DISPLAY */
5436
5437         while (global->ifaces)
5438                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5439
5440         if (global->ctrl_iface)
5441                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5442
5443         wpas_notify_supplicant_deinitialized(global);
5444
5445         eap_peer_unregister_methods();
5446 #ifdef CONFIG_AP
5447         eap_server_unregister_methods();
5448 #endif /* CONFIG_AP */
5449
5450         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5451                 if (!global->drv_priv[i])
5452                         continue;
5453                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5454         }
5455         os_free(global->drv_priv);
5456
5457         random_deinit();
5458
5459         eloop_destroy();
5460
5461         if (global->params.pid_file) {
5462                 os_daemonize_terminate(global->params.pid_file);
5463                 os_free(global->params.pid_file);
5464         }
5465         os_free(global->params.ctrl_interface);
5466         os_free(global->params.ctrl_interface_group);
5467         os_free(global->params.override_driver);
5468         os_free(global->params.override_ctrl_interface);
5469 #ifdef CONFIG_MATCH_IFACE
5470         os_free(global->params.match_ifaces);
5471 #endif /* CONFIG_MATCH_IFACE */
5472 #ifdef CONFIG_P2P
5473         os_free(global->params.conf_p2p_dev);
5474 #endif /* CONFIG_P2P */
5475
5476         os_free(global->p2p_disallow_freq.range);
5477         os_free(global->p2p_go_avoid_freq.range);
5478         os_free(global->add_psk);
5479
5480         os_free(global);
5481         wpa_debug_close_syslog();
5482         wpa_debug_close_file();
5483         wpa_debug_close_linux_tracing();
5484 }
5485
5486
5487 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5488 {
5489         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5490             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5491                 char country[3];
5492                 country[0] = wpa_s->conf->country[0];
5493                 country[1] = wpa_s->conf->country[1];
5494                 country[2] = '\0';
5495                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5496                         wpa_printf(MSG_ERROR, "Failed to set country code "
5497                                    "'%s'", country);
5498                 }
5499         }
5500
5501         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5502                 wpas_init_ext_pw(wpa_s);
5503
5504         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5505                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5506
5507 #ifdef CONFIG_WPS
5508         wpas_wps_update_config(wpa_s);
5509 #endif /* CONFIG_WPS */
5510         wpas_p2p_update_config(wpa_s);
5511         wpa_s->conf->changed_parameters = 0;
5512 }
5513
5514
5515 void add_freq(int *freqs, int *num_freqs, int freq)
5516 {
5517         int i;
5518
5519         for (i = 0; i < *num_freqs; i++) {
5520                 if (freqs[i] == freq)
5521                         return;
5522         }
5523
5524         freqs[*num_freqs] = freq;
5525         (*num_freqs)++;
5526 }
5527
5528
5529 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5530 {
5531         struct wpa_bss *bss, *cbss;
5532         const int max_freqs = 10;
5533         int *freqs;
5534         int num_freqs = 0;
5535
5536         freqs = os_calloc(max_freqs + 1, sizeof(int));
5537         if (freqs == NULL)
5538                 return NULL;
5539
5540         cbss = wpa_s->current_bss;
5541
5542         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5543                 if (bss == cbss)
5544                         continue;
5545                 if (bss->ssid_len == cbss->ssid_len &&
5546                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5547                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5548                         add_freq(freqs, &num_freqs, bss->freq);
5549                         if (num_freqs == max_freqs)
5550                                 break;
5551                 }
5552         }
5553
5554         if (num_freqs == 0) {
5555                 os_free(freqs);
5556                 freqs = NULL;
5557         }
5558
5559         return freqs;
5560 }
5561
5562
5563 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5564 {
5565         int timeout;
5566         int count;
5567         int *freqs = NULL;
5568
5569         wpas_connect_work_done(wpa_s);
5570
5571         /*
5572          * Remove possible authentication timeout since the connection failed.
5573          */
5574         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5575
5576         /*
5577          * There is no point in blacklisting the AP if this event is
5578          * generated based on local request to disconnect.
5579          */
5580         if (wpa_s->own_disconnect_req) {
5581                 wpa_s->own_disconnect_req = 0;
5582                 wpa_dbg(wpa_s, MSG_DEBUG,
5583                         "Ignore connection failure due to local request to disconnect");
5584                 return;
5585         }
5586         if (wpa_s->disconnected) {
5587                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5588                         "indication since interface has been put into "
5589                         "disconnected state");
5590                 return;
5591         }
5592
5593         /*
5594          * Add the failed BSSID into the blacklist and speed up next scan
5595          * attempt if there could be other APs that could accept association.
5596          * The current blacklist count indicates how many times we have tried
5597          * connecting to this AP and multiple attempts mean that other APs are
5598          * either not available or has already been tried, so that we can start
5599          * increasing the delay here to avoid constant scanning.
5600          */
5601         count = wpa_blacklist_add(wpa_s, bssid);
5602         if (count == 1 && wpa_s->current_bss) {
5603                 /*
5604                  * This BSS was not in the blacklist before. If there is
5605                  * another BSS available for the same ESS, we should try that
5606                  * next. Otherwise, we may as well try this one once more
5607                  * before allowing other, likely worse, ESSes to be considered.
5608                  */
5609                 freqs = get_bss_freqs_in_ess(wpa_s);
5610                 if (freqs) {
5611                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5612                                 "has been seen; try it next");
5613                         wpa_blacklist_add(wpa_s, bssid);
5614                         /*
5615                          * On the next scan, go through only the known channels
5616                          * used in this ESS based on previous scans to speed up
5617                          * common load balancing use case.
5618                          */
5619                         os_free(wpa_s->next_scan_freqs);
5620                         wpa_s->next_scan_freqs = freqs;
5621                 }
5622         }
5623
5624         /*
5625          * Add previous failure count in case the temporary blacklist was
5626          * cleared due to no other BSSes being available.
5627          */
5628         count += wpa_s->extra_blacklist_count;
5629
5630         if (count > 3 && wpa_s->current_ssid) {
5631                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5632                            "consider temporary network disabling");
5633                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5634         }
5635
5636         switch (count) {
5637         case 1:
5638                 timeout = 100;
5639                 break;
5640         case 2:
5641                 timeout = 500;
5642                 break;
5643         case 3:
5644                 timeout = 1000;
5645                 break;
5646         case 4:
5647                 timeout = 5000;
5648                 break;
5649         default:
5650                 timeout = 10000;
5651                 break;
5652         }
5653
5654         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5655                 "ms", count, timeout);
5656
5657         /*
5658          * TODO: if more than one possible AP is available in scan results,
5659          * could try the other ones before requesting a new scan.
5660          */
5661         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5662                                 1000 * (timeout % 1000));
5663 }
5664
5665
5666 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5667 {
5668         return wpa_s->conf->ap_scan == 2 ||
5669                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5670 }
5671
5672
5673 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5674 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5675                                               struct wpa_ssid *ssid,
5676                                               const char *field,
5677                                               const char *value)
5678 {
5679 #ifdef IEEE8021X_EAPOL
5680         struct eap_peer_config *eap = &ssid->eap;
5681
5682         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5683         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5684                               (const u8 *) value, os_strlen(value));
5685
5686         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5687         case WPA_CTRL_REQ_EAP_IDENTITY:
5688                 os_free(eap->identity);
5689                 eap->identity = (u8 *) os_strdup(value);
5690                 eap->identity_len = os_strlen(value);
5691                 eap->pending_req_identity = 0;
5692                 if (ssid == wpa_s->current_ssid)
5693                         wpa_s->reassociate = 1;
5694                 break;
5695         case WPA_CTRL_REQ_EAP_PASSWORD:
5696                 bin_clear_free(eap->password, eap->password_len);
5697                 eap->password = (u8 *) os_strdup(value);
5698                 eap->password_len = os_strlen(value);
5699                 eap->pending_req_password = 0;
5700                 if (ssid == wpa_s->current_ssid)
5701                         wpa_s->reassociate = 1;
5702                 break;
5703         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5704                 bin_clear_free(eap->new_password, eap->new_password_len);
5705                 eap->new_password = (u8 *) os_strdup(value);
5706                 eap->new_password_len = os_strlen(value);
5707                 eap->pending_req_new_password = 0;
5708                 if (ssid == wpa_s->current_ssid)
5709                         wpa_s->reassociate = 1;
5710                 break;
5711         case WPA_CTRL_REQ_EAP_PIN:
5712                 str_clear_free(eap->pin);
5713                 eap->pin = os_strdup(value);
5714                 eap->pending_req_pin = 0;
5715                 if (ssid == wpa_s->current_ssid)
5716                         wpa_s->reassociate = 1;
5717                 break;
5718         case WPA_CTRL_REQ_EAP_OTP:
5719                 bin_clear_free(eap->otp, eap->otp_len);
5720                 eap->otp = (u8 *) os_strdup(value);
5721                 eap->otp_len = os_strlen(value);
5722                 os_free(eap->pending_req_otp);
5723                 eap->pending_req_otp = NULL;
5724                 eap->pending_req_otp_len = 0;
5725                 break;
5726         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5727                 str_clear_free(eap->private_key_passwd);
5728                 eap->private_key_passwd = os_strdup(value);
5729                 eap->pending_req_passphrase = 0;
5730                 if (ssid == wpa_s->current_ssid)
5731                         wpa_s->reassociate = 1;
5732                 break;
5733         case WPA_CTRL_REQ_SIM:
5734                 str_clear_free(eap->external_sim_resp);
5735                 eap->external_sim_resp = os_strdup(value);
5736                 break;
5737         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5738                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5739                         return -1;
5740                 ssid->mem_only_psk = 1;
5741                 if (ssid->passphrase)
5742                         wpa_config_update_psk(ssid);
5743                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5744                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5745                 break;
5746         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5747                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5748                         return -1;
5749                 if (os_strcmp(value, "good") == 0)
5750                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5751                 else if (os_strcmp(value, "bad") == 0)
5752                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5753                 else
5754                         return -1;
5755                 break;
5756         default:
5757                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5758                 return -1;
5759         }
5760
5761         return 0;
5762 #else /* IEEE8021X_EAPOL */
5763         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5764         return -1;
5765 #endif /* IEEE8021X_EAPOL */
5766 }
5767 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5768
5769
5770 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5771 {
5772         int i;
5773         unsigned int drv_enc;
5774
5775         if (wpa_s->p2p_mgmt)
5776                 return 1; /* no normal network profiles on p2p_mgmt interface */
5777
5778         if (ssid == NULL)
5779                 return 1;
5780
5781         if (ssid->disabled)
5782                 return 1;
5783
5784         if (wpa_s->drv_capa_known)
5785                 drv_enc = wpa_s->drv_enc;
5786         else
5787                 drv_enc = (unsigned int) -1;
5788
5789         for (i = 0; i < NUM_WEP_KEYS; i++) {
5790                 size_t len = ssid->wep_key_len[i];
5791                 if (len == 0)
5792                         continue;
5793                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5794                         continue;
5795                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5796                         continue;
5797                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5798                         continue;
5799                 return 1; /* invalid WEP key */
5800         }
5801
5802         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5803             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5804             !ssid->mem_only_psk)
5805                 return 1;
5806
5807         return 0;
5808 }
5809
5810
5811 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5812 {
5813 #ifdef CONFIG_IEEE80211W
5814         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5815                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5816                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5817                         /*
5818                          * Driver does not support BIP -- ignore pmf=1 default
5819                          * since the connection with PMF would fail and the
5820                          * configuration does not require PMF to be enabled.
5821                          */
5822                         return NO_MGMT_FRAME_PROTECTION;
5823                 }
5824
5825                 return wpa_s->conf->pmf;
5826         }
5827
5828         return ssid->ieee80211w;
5829 #else /* CONFIG_IEEE80211W */
5830         return NO_MGMT_FRAME_PROTECTION;
5831 #endif /* CONFIG_IEEE80211W */
5832 }
5833
5834
5835 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5836 {
5837         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5838                 return 1;
5839         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5840                 return 0;
5841         return -1;
5842 }
5843
5844
5845 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5846 {
5847         struct wpa_ssid *ssid = wpa_s->current_ssid;
5848         int dur;
5849         struct os_reltime now;
5850
5851         if (ssid == NULL) {
5852                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5853                            "SSID block");
5854                 return;
5855         }
5856
5857         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5858                 return;
5859
5860         ssid->auth_failures++;
5861
5862 #ifdef CONFIG_P2P
5863         if (ssid->p2p_group &&
5864             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5865                 /*
5866                  * Skip the wait time since there is a short timeout on the
5867                  * connection to a P2P group.
5868                  */
5869                 return;
5870         }
5871 #endif /* CONFIG_P2P */
5872
5873         if (ssid->auth_failures > 50)
5874                 dur = 300;
5875         else if (ssid->auth_failures > 10)
5876                 dur = 120;
5877         else if (ssid->auth_failures > 5)
5878                 dur = 90;
5879         else if (ssid->auth_failures > 3)
5880                 dur = 60;
5881         else if (ssid->auth_failures > 2)
5882                 dur = 30;
5883         else if (ssid->auth_failures > 1)
5884                 dur = 20;
5885         else
5886                 dur = 10;
5887
5888         if (ssid->auth_failures > 1 &&
5889             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5890                 dur += os_random() % (ssid->auth_failures * 10);
5891
5892         os_get_reltime(&now);
5893         if (now.sec + dur <= ssid->disabled_until.sec)
5894                 return;
5895
5896         ssid->disabled_until.sec = now.sec + dur;
5897
5898         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5899                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5900                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5901                 ssid->auth_failures, dur, reason);
5902 }
5903
5904
5905 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5906                               struct wpa_ssid *ssid, int clear_failures)
5907 {
5908         if (ssid == NULL)
5909                 return;
5910
5911         if (ssid->disabled_until.sec) {
5912                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5913                         "id=%d ssid=\"%s\"",
5914                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5915         }
5916         ssid->disabled_until.sec = 0;
5917         ssid->disabled_until.usec = 0;
5918         if (clear_failures)
5919                 ssid->auth_failures = 0;
5920 }
5921
5922
5923 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5924 {
5925         size_t i;
5926
5927         if (wpa_s->disallow_aps_bssid == NULL)
5928                 return 0;
5929
5930         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5931                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5932                               bssid, ETH_ALEN) == 0)
5933                         return 1;
5934         }
5935
5936         return 0;
5937 }
5938
5939
5940 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5941                     size_t ssid_len)
5942 {
5943         size_t i;
5944
5945         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5946                 return 0;
5947
5948         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5949                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5950                 if (ssid_len == s->ssid_len &&
5951                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5952                         return 1;
5953         }
5954
5955         return 0;
5956 }
5957
5958
5959 /**
5960  * wpas_request_connection - Request a new connection
5961  * @wpa_s: Pointer to the network interface
5962  *
5963  * This function is used to request a new connection to be found. It will mark
5964  * the interface to allow reassociation and request a new scan to find a
5965  * suitable network to connect to.
5966  */
5967 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5968 {
5969         wpa_s->normal_scans = 0;
5970         wpa_s->scan_req = NORMAL_SCAN_REQ;
5971         wpa_supplicant_reinit_autoscan(wpa_s);
5972         wpa_s->extra_blacklist_count = 0;
5973         wpa_s->disconnected = 0;
5974         wpa_s->reassociate = 1;
5975
5976         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5977                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5978         else
5979                 wpa_s->reattach = 0;
5980 }
5981
5982
5983 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5984                     struct wpa_used_freq_data *freqs_data,
5985                     unsigned int len)
5986 {
5987         unsigned int i;
5988
5989         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5990                 len, title);
5991         for (i = 0; i < len; i++) {
5992                 struct wpa_used_freq_data *cur = &freqs_data[i];
5993                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5994                         i, cur->freq, cur->flags);
5995         }
5996 }
5997
5998
5999 /*
6000  * Find the operating frequencies of any of the virtual interfaces that
6001  * are using the same radio as the current interface, and in addition, get
6002  * information about the interface types that are using the frequency.
6003  */
6004 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6005                                 struct wpa_used_freq_data *freqs_data,
6006                                 unsigned int len)
6007 {
6008         struct wpa_supplicant *ifs;
6009         u8 bssid[ETH_ALEN];
6010         int freq;
6011         unsigned int idx = 0, i;
6012
6013         wpa_dbg(wpa_s, MSG_DEBUG,
6014                 "Determining shared radio frequencies (max len %u)", len);
6015         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6016
6017         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6018                          radio_list) {
6019                 if (idx == len)
6020                         break;
6021
6022                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6023                         continue;
6024
6025                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6026                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6027                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6028                         freq = ifs->current_ssid->frequency;
6029                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6030                         freq = ifs->assoc_freq;
6031                 else
6032                         continue;
6033
6034                 /* Hold only distinct freqs */
6035                 for (i = 0; i < idx; i++)
6036                         if (freqs_data[i].freq == freq)
6037                                 break;
6038
6039                 if (i == idx)
6040                         freqs_data[idx++].freq = freq;
6041
6042                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6043                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6044                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6045                                 WPA_FREQ_USED_BY_INFRA_STATION;
6046                 }
6047         }
6048
6049         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6050         return idx;
6051 }
6052
6053
6054 /*
6055  * Find the operating frequencies of any of the virtual interfaces that
6056  * are using the same radio as the current interface.
6057  */
6058 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6059                            int *freq_array, unsigned int len)
6060 {
6061         struct wpa_used_freq_data *freqs_data;
6062         int num, i;
6063
6064         os_memset(freq_array, 0, sizeof(int) * len);
6065
6066         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6067         if (!freqs_data)
6068                 return -1;
6069
6070         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6071         for (i = 0; i < num; i++)
6072                 freq_array[i] = freqs_data[i].freq;
6073
6074         os_free(freqs_data);
6075
6076         return num;
6077 }
6078
6079
6080 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6081 {
6082         struct rrm_data *rrm = data;
6083
6084         if (!rrm->notify_neighbor_rep) {
6085                 wpa_printf(MSG_ERROR,
6086                            "RRM: Unexpected neighbor report timeout");
6087                 return;
6088         }
6089
6090         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6091         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6092
6093         rrm->notify_neighbor_rep = NULL;
6094         rrm->neighbor_rep_cb_ctx = NULL;
6095 }
6096
6097
6098 /*
6099  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6100  * @wpa_s: Pointer to wpa_supplicant
6101  */
6102 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6103 {
6104         wpa_s->rrm.rrm_used = 0;
6105
6106         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6107                              NULL);
6108         if (wpa_s->rrm.notify_neighbor_rep)
6109                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6110         wpa_s->rrm.next_neighbor_rep_token = 1;
6111 }
6112
6113
6114 /*
6115  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6116  * @wpa_s: Pointer to wpa_supplicant
6117  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6118  * @report_len: Length of neighbor report buffer
6119  */
6120 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6121                                    const u8 *report, size_t report_len)
6122 {
6123         struct wpabuf *neighbor_rep;
6124
6125         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6126         if (report_len < 1)
6127                 return;
6128
6129         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6130                 wpa_printf(MSG_DEBUG,
6131                            "RRM: Discarding neighbor report with token %d (expected %d)",
6132                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6133                 return;
6134         }
6135
6136         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6137                              NULL);
6138
6139         if (!wpa_s->rrm.notify_neighbor_rep) {
6140                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6141                 return;
6142         }
6143
6144         /* skipping the first byte, which is only an id (dialog token) */
6145         neighbor_rep = wpabuf_alloc(report_len - 1);
6146         if (neighbor_rep == NULL)
6147                 return;
6148         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6149         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6150                    report[0]);
6151         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6152                                        neighbor_rep);
6153         wpa_s->rrm.notify_neighbor_rep = NULL;
6154         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6155 }
6156
6157
6158 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6159 /* Workaround different, undefined for Windows, error codes used here */
6160 #define ENOTCONN -1
6161 #define EOPNOTSUPP -1
6162 #define ECANCELED -1
6163 #endif
6164
6165 /**
6166  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6167  * @wpa_s: Pointer to wpa_supplicant
6168  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6169  *        is sent in the request.
6170  * @cb: Callback function to be called once the requested report arrives, or
6171  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6172  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6173  *      the requester's responsibility to free it.
6174  *      In the latter case NULL will be sent in 'neighbor_rep'.
6175  * @cb_ctx: Context value to send the callback function
6176  * Returns: 0 in case of success, negative error code otherwise
6177  *
6178  * In case there is a previous request which has not been answered yet, the
6179  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6180  * Request must contain a callback function.
6181  */
6182 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6183                                        const struct wpa_ssid *ssid,
6184                                        void (*cb)(void *ctx,
6185                                                   struct wpabuf *neighbor_rep),
6186                                        void *cb_ctx)
6187 {
6188         struct wpabuf *buf;
6189         const u8 *rrm_ie;
6190
6191         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6192                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6193                 return -ENOTCONN;
6194         }
6195
6196         if (!wpa_s->rrm.rrm_used) {
6197                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6198                 return -EOPNOTSUPP;
6199         }
6200
6201         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6202                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6203         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6204             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6205                 wpa_printf(MSG_DEBUG,
6206                            "RRM: No network support for Neighbor Report.");
6207                 return -EOPNOTSUPP;
6208         }
6209
6210         if (!cb) {
6211                 wpa_printf(MSG_DEBUG,
6212                            "RRM: Neighbor Report request must provide a callback.");
6213                 return -EINVAL;
6214         }
6215
6216         /* Refuse if there's a live request */
6217         if (wpa_s->rrm.notify_neighbor_rep) {
6218                 wpa_printf(MSG_DEBUG,
6219                            "RRM: Currently handling previous Neighbor Report.");
6220                 return -EBUSY;
6221         }
6222
6223         /* 3 = action category + action code + dialog token */
6224         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6225         if (buf == NULL) {
6226                 wpa_printf(MSG_DEBUG,
6227                            "RRM: Failed to allocate Neighbor Report Request");
6228                 return -ENOMEM;
6229         }
6230
6231         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6232                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6233                    wpa_s->rrm.next_neighbor_rep_token);
6234
6235         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6236         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6237         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6238         if (ssid) {
6239                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6240                 wpabuf_put_u8(buf, ssid->ssid_len);
6241                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6242         }
6243
6244         wpa_s->rrm.next_neighbor_rep_token++;
6245
6246         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6247                                 wpa_s->own_addr, wpa_s->bssid,
6248                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6249                 wpa_printf(MSG_DEBUG,
6250                            "RRM: Failed to send Neighbor Report Request");
6251                 wpabuf_free(buf);
6252                 return -ECANCELED;
6253         }
6254
6255         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6256         wpa_s->rrm.notify_neighbor_rep = cb;
6257         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6258                                wpas_rrm_neighbor_rep_timeout_handler,
6259                                &wpa_s->rrm, NULL);
6260
6261         wpabuf_free(buf);
6262         return 0;
6263 }
6264
6265
6266 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6267                                               const u8 *src,
6268                                               const u8 *frame, size_t len,
6269                                               int rssi)
6270 {
6271         struct wpabuf *buf;
6272         const struct rrm_link_measurement_request *req;
6273         struct rrm_link_measurement_report report;
6274
6275         if (wpa_s->wpa_state != WPA_COMPLETED) {
6276                 wpa_printf(MSG_INFO,
6277                            "RRM: Ignoring link measurement request. Not associated");
6278                 return;
6279         }
6280
6281         if (!wpa_s->rrm.rrm_used) {
6282                 wpa_printf(MSG_INFO,
6283                            "RRM: Ignoring link measurement request. Not RRM network");
6284                 return;
6285         }
6286
6287         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6288                 wpa_printf(MSG_INFO,
6289                            "RRM: Measurement report failed. TX power insertion not supported");
6290                 return;
6291         }
6292
6293         req = (const struct rrm_link_measurement_request *) frame;
6294         if (len < sizeof(*req)) {
6295                 wpa_printf(MSG_INFO,
6296                            "RRM: Link measurement report failed. Request too short");
6297                 return;
6298         }
6299
6300         os_memset(&report, 0, sizeof(report));
6301         report.tpc.eid = WLAN_EID_TPC_REPORT;
6302         report.tpc.len = 2;
6303         report.rsni = 255; /* 255 indicates that RSNI is not available */
6304         report.dialog_token = req->dialog_token;
6305
6306         /*
6307          * It's possible to estimate RCPI based on RSSI in dBm. This
6308          * calculation will not reflect the correct value for high rates,
6309          * but it's good enough for Action frames which are transmitted
6310          * with up to 24 Mbps rates.
6311          */
6312         if (!rssi)
6313                 report.rcpi = 255; /* not available */
6314         else if (rssi < -110)
6315                 report.rcpi = 0;
6316         else if (rssi > 0)
6317                 report.rcpi = 220;
6318         else
6319                 report.rcpi = (rssi + 110) * 2;
6320
6321         /* action_category + action_code */
6322         buf = wpabuf_alloc(2 + sizeof(report));
6323         if (buf == NULL) {
6324                 wpa_printf(MSG_ERROR,
6325                            "RRM: Link measurement report failed. Buffer allocation failed");
6326                 return;
6327         }
6328
6329         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6330         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6331         wpabuf_put_data(buf, &report, sizeof(report));
6332         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6333                     wpabuf_head(buf), wpabuf_len(buf));
6334
6335         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6336                                 wpa_s->own_addr, wpa_s->bssid,
6337                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6338                 wpa_printf(MSG_ERROR,
6339                            "RRM: Link measurement report failed. Send action failed");
6340         }
6341         wpabuf_free(buf);
6342 }
6343
6344
6345 struct wpa_supplicant *
6346 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6347 {
6348         switch (frame) {
6349 #ifdef CONFIG_P2P
6350         case VENDOR_ELEM_PROBE_REQ_P2P:
6351         case VENDOR_ELEM_PROBE_RESP_P2P:
6352         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6353         case VENDOR_ELEM_BEACON_P2P_GO:
6354         case VENDOR_ELEM_P2P_PD_REQ:
6355         case VENDOR_ELEM_P2P_PD_RESP:
6356         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6357         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6358         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6359         case VENDOR_ELEM_P2P_INV_REQ:
6360         case VENDOR_ELEM_P2P_INV_RESP:
6361         case VENDOR_ELEM_P2P_ASSOC_REQ:
6362         case VENDOR_ELEM_P2P_ASSOC_RESP:
6363                 return wpa_s->p2pdev;
6364 #endif /* CONFIG_P2P */
6365         default:
6366                 return wpa_s;
6367         }
6368 }
6369
6370
6371 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6372 {
6373         unsigned int i;
6374         char buf[30];
6375
6376         wpa_printf(MSG_DEBUG, "Update vendor elements");
6377
6378         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6379                 if (wpa_s->vendor_elem[i]) {
6380                         int res;
6381
6382                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6383                         if (!os_snprintf_error(sizeof(buf), res)) {
6384                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6385                                                 wpa_s->vendor_elem[i]);
6386                         }
6387                 }
6388         }
6389
6390 #ifdef CONFIG_P2P
6391         if (wpa_s->parent == wpa_s &&
6392             wpa_s->global->p2p &&
6393             !wpa_s->global->p2p_disabled)
6394                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6395 #endif /* CONFIG_P2P */
6396 }
6397
6398
6399 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6400                             const u8 *elem, size_t len)
6401 {
6402         u8 *ie, *end;
6403
6404         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6405         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6406
6407         for (; ie + 1 < end; ie += 2 + ie[1]) {
6408                 if (ie + len > end)
6409                         break;
6410                 if (os_memcmp(ie, elem, len) != 0)
6411                         continue;
6412
6413                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6414                         wpabuf_free(wpa_s->vendor_elem[frame]);
6415                         wpa_s->vendor_elem[frame] = NULL;
6416                 } else {
6417                         os_memmove(ie, ie + len, end - (ie + len));
6418                         wpa_s->vendor_elem[frame]->used -= len;
6419                 }
6420                 wpas_vendor_elem_update(wpa_s);
6421                 return 0;
6422         }
6423
6424         return -1;
6425 }
6426
6427
6428 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6429                                    u16 num_modes, enum hostapd_hw_mode mode)
6430 {
6431         u16 i;
6432
6433         for (i = 0; i < num_modes; i++) {
6434                 if (modes[i].mode == mode)
6435                         return &modes[i];
6436         }
6437
6438         return NULL;
6439 }
6440
6441
6442 static struct
6443 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6444                                                  const u8 *bssid)
6445 {
6446         struct wpa_bss_tmp_disallowed *bss;
6447
6448         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6449                          struct wpa_bss_tmp_disallowed, list) {
6450                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6451                         return bss;
6452         }
6453
6454         return NULL;
6455 }
6456
6457
6458 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6459                           unsigned int sec)
6460 {
6461         struct wpa_bss_tmp_disallowed *bss;
6462         struct os_reltime until;
6463
6464         os_get_reltime(&until);
6465         until.sec += sec;
6466
6467         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6468         if (bss) {
6469                 bss->disallowed_until = until;
6470                 return;
6471         }
6472
6473         bss = os_malloc(sizeof(*bss));
6474         if (!bss) {
6475                 wpa_printf(MSG_DEBUG,
6476                            "Failed to allocate memory for temp disallow BSS");
6477                 return;
6478         }
6479
6480         bss->disallowed_until = until;
6481         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6482         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6483 }
6484
6485
6486 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6487 {
6488         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6489         struct os_reltime now, age;
6490
6491         os_get_reltime(&now);
6492
6493         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6494                          struct wpa_bss_tmp_disallowed, list) {
6495                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6496                         /* This BSS is not disallowed anymore */
6497                         dl_list_del(&tmp->list);
6498                         os_free(tmp);
6499                         continue;
6500                 }
6501                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6502                         bss = tmp;
6503                         break;
6504                 }
6505         }
6506         if (!bss)
6507                 return 0;
6508
6509         os_reltime_sub(&bss->disallowed_until, &now, &age);
6510         wpa_printf(MSG_DEBUG,
6511                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6512                    MAC2STR(bss->bssid), age.sec, age.usec);
6513         return 1;
6514 }