wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "blacklist.h"
  39 #include "wpas_glue.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "sme.h"
  43 #include "gas_query.h"
  44 #include "ap.h"
  45 #include "p2p_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bgscan.h"
  49 #include "autoscan.h"
  50 #include "bss.h"
  51 #include "scan.h"
  52 #include "offchannel.h"
  53 #include "hs20_supplicant.h"
  54 #include "wnm_sta.h"
  55 #include "wpas_kay.h"
  56 #include "mesh.h"
  57
  58 const char *wpa_supplicant_version =
  59 "wpa_supplicant v" VERSION_STR "\n"
  60 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  61
  62 const char *wpa_supplicant_license =
  63 "This software may be distributed under the terms of the BSD license.\n"
  64 "See README for more details.\n"
  65 #ifdef EAP_TLS_OPENSSL
  66 "\nThis product includes software developed by the OpenSSL Project\n"
  67 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  68 #endif /* EAP_TLS_OPENSSL */
  69 ;
  70
  71 #ifndef CONFIG_NO_STDOUT_DEBUG
  72 /* Long text divided into parts in order to fit in C89 strings size limits. */
  73 const char *wpa_supplicant_full_license1 =
  74 "";
  75 const char *wpa_supplicant_full_license2 =
  76 "This software may be distributed under the terms of the BSD license.\n"
  77 "\n"
  78 "Redistribution and use in source and binary forms, with or without\n"
  79 "modification, are permitted provided that the following conditions are\n"
  80 "met:\n"
  81 "\n";
  82 const char *wpa_supplicant_full_license3 =
  83 "1. Redistributions of source code must retain the above copyright\n"
  84 "   notice, this list of conditions and the following disclaimer.\n"
  85 "\n"
  86 "2. Redistributions in binary form must reproduce the above copyright\n"
  87 "   notice, this list of conditions and the following disclaimer in the\n"
  88 "   documentation and/or other materials provided with the distribution.\n"
  89 "\n";
  90 const char *wpa_supplicant_full_license4 =
  91 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  92 "   names of its contributors may be used to endorse or promote products\n"
  93 "   derived from this software without specific prior written permission.\n"
  94 "\n"
  95 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  96 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  97 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  98 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  99 const char *wpa_supplicant_full_license5 =
 100 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 101 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 102 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 103 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 104 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 105 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 106 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 107 "\n";
 108 #endif /* CONFIG_NO_STDOUT_DEBUG */
 109
 110 /* Configure default/group WEP keys for static WEP */
 111 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 112 {
 113         int i, set = 0;
 114
 115         for (i = 0; i < NUM_WEP_KEYS; i++) {
 116                 if (ssid->wep_key_len[i] == 0)
 117                         continue;
 118
 119                 set = 1;
 120                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 121                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 122                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 123         }
 124
 125         return set;
 126 }
 127
 128
 129 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 130                                     struct wpa_ssid *ssid)
 131 {
 132         u8 key[32];
 133         size_t keylen;
 134         enum wpa_alg alg;
 135         u8 seq[6] = { 0 };
 136         int ret;
 137
 138         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 139          * sending unicast and multicast packets. */
 140
 141         if (ssid->mode != WPAS_MODE_IBSS) {
 142                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 143                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 144                 return -1;
 145         }
 146
 147         if (!ssid->psk_set) {
 148                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 149                         "WPA-None");
 150                 return -1;
 151         }
 152
 153         switch (wpa_s->group_cipher) {
 154         case WPA_CIPHER_CCMP:
 155                 os_memcpy(key, ssid->psk, 16);
 156                 keylen = 16;
 157                 alg = WPA_ALG_CCMP;
 158                 break;
 159         case WPA_CIPHER_GCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_GCMP;
 163                 break;
 164         case WPA_CIPHER_TKIP:
 165                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 166                 os_memcpy(key, ssid->psk, 16 + 8);
 167                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 168                 keylen = 32;
 169                 alg = WPA_ALG_TKIP;
 170                 break;
 171         default:
 172                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 173                         "WPA-None", wpa_s->group_cipher);
 174                 return -1;
 175         }
 176
 177         /* TODO: should actually remember the previously used seq#, both for TX
 178          * and RX from each STA.. */
 179
 180         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 181         os_memset(key, 0, sizeof(key));
 182         return ret;
 183 }
 184
 185
 186 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 187 {
 188         struct wpa_supplicant *wpa_s = eloop_ctx;
 189         const u8 *bssid = wpa_s->bssid;
 190         if (is_zero_ether_addr(bssid))
 191                 bssid = wpa_s->pending_bssid;
 192         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 193                 MAC2STR(bssid));
 194         wpa_blacklist_add(wpa_s, bssid);
 195         wpa_sm_notify_disassoc(wpa_s->wpa);
 196         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 197         wpa_s->reassociate = 1;
 198
 199         /*
 200          * If we timed out, the AP or the local radio may be busy.
 201          * So, wait a second until scanning again.
 202          */
 203         wpa_supplicant_req_scan(wpa_s, 1, 0);
 204 }
 205
 206
 207 /**
 208  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 209  * @wpa_s: Pointer to wpa_supplicant data
 210  * @sec: Number of seconds after which to time out authentication
 211  * @usec: Number of microseconds after which to time out authentication
 212  *
 213  * This function is used to schedule a timeout for the current authentication
 214  * attempt.
 215  */
 216 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 217                                      int sec, int usec)
 218 {
 219         if (wpa_s->conf->ap_scan == 0 &&
 220             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 221                 return;
 222
 223         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 224                 "%d usec", sec, usec);
 225         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 226         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 227 }
 228
 229
 230 /**
 231  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 232  * @wpa_s: Pointer to wpa_supplicant data
 233  *
 234  * This function is used to cancel authentication timeout scheduled with
 235  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 236  * been completed.
 237  */
 238 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 239 {
 240         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 241         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 242         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 243 }
 244
 245
 246 /**
 247  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 248  * @wpa_s: Pointer to wpa_supplicant data
 249  *
 250  * This function is used to configure EAPOL state machine based on the selected
 251  * authentication mode.
 252  */
 253 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 254 {
 255 #ifdef IEEE8021X_EAPOL
 256         struct eapol_config eapol_conf;
 257         struct wpa_ssid *ssid = wpa_s->current_ssid;
 258
 259 #ifdef CONFIG_IBSS_RSN
 260         if (ssid->mode == WPAS_MODE_IBSS &&
 261             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 263                 /*
 264                  * RSN IBSS authentication is per-STA and we can disable the
 265                  * per-BSSID EAPOL authentication.
 266                  */
 267                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 268                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 269                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 270                 return;
 271         }
 272 #endif /* CONFIG_IBSS_RSN */
 273
 274         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 275         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 276
 277         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 278             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 279                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 280         else
 281                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 282
 283         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 285                 eapol_conf.accept_802_1x_keys = 1;
 286                 eapol_conf.required_keys = 0;
 287                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 288                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 289                 }
 290                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 291                         eapol_conf.required_keys |=
 292                                 EAPOL_REQUIRE_KEY_BROADCAST;
 293                 }
 294
 295                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 296                         eapol_conf.required_keys = 0;
 297         }
 298         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 299         eapol_conf.workaround = ssid->eap_workaround;
 300         eapol_conf.eap_disabled =
 301                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 302                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 304         eapol_conf.external_sim = wpa_s->conf->external_sim;
 305
 306 #ifdef CONFIG_WPS
 307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 308                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 309                 if (wpa_s->current_bss) {
 310                         struct wpabuf *ie;
 311                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 312                                                          WPS_IE_VENDOR_TYPE);
 313                         if (ie) {
 314                                 if (wps_is_20(ie))
 315                                         eapol_conf.wps |=
 316                                                 EAPOL_PEER_IS_WPS20_AP;
 317                                 wpabuf_free(ie);
 318                         }
 319                 }
 320         }
 321 #endif /* CONFIG_WPS */
 322
 323         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 324
 325         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 326 #endif /* IEEE8021X_EAPOL */
 327 }
 328
 329
 330 /**
 331  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 332  * @wpa_s: Pointer to wpa_supplicant data
 333  * @ssid: Configuration data for the network
 334  *
 335  * This function is used to configure WPA state machine and related parameters
 336  * to a mode where WPA is not enabled. This is called as part of the
 337  * authentication configuration when the selected network does not use WPA.
 338  */
 339 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 340                                        struct wpa_ssid *ssid)
 341 {
 342         int i;
 343
 344         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 346         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 347                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 348         else
 349                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 350         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 351         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 353         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 354         wpa_s->group_cipher = WPA_CIPHER_NONE;
 355         wpa_s->mgmt_group_cipher = 0;
 356
 357         for (i = 0; i < NUM_WEP_KEYS; i++) {
 358                 if (ssid->wep_key_len[i] > 5) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 361                         break;
 362                 } else if (ssid->wep_key_len[i] > 0) {
 363                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 364                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 365                         break;
 366                 }
 367         }
 368
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 372                          wpa_s->pairwise_cipher);
 373         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 374 #ifdef CONFIG_IEEE80211W
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 376                          wpa_s->mgmt_group_cipher);
 377 #endif /* CONFIG_IEEE80211W */
 378
 379         pmksa_cache_clear_current(wpa_s->wpa);
 380 }
 381
 382
 383 void free_hw_features(struct wpa_supplicant *wpa_s)
 384 {
 385         int i;
 386         if (wpa_s->hw.modes == NULL)
 387                 return;
 388
 389         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 390                 os_free(wpa_s->hw.modes[i].channels);
 391                 os_free(wpa_s->hw.modes[i].rates);
 392         }
 393
 394         os_free(wpa_s->hw.modes);
 395         wpa_s->hw.modes = NULL;
 396 }
 397
 398
 399 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 400 {
 401         int i;
 402
 403         bgscan_deinit(wpa_s);
 404         autoscan_deinit(wpa_s);
 405         scard_deinit(wpa_s->scard);
 406         wpa_s->scard = NULL;
 407         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 408         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 409         l2_packet_deinit(wpa_s->l2);
 410         wpa_s->l2 = NULL;
 411         if (wpa_s->l2_br) {
 412                 l2_packet_deinit(wpa_s->l2_br);
 413                 wpa_s->l2_br = NULL;
 414         }
 415 #ifdef CONFIG_TESTING_OPTIONS
 416         l2_packet_deinit(wpa_s->l2_test);
 417         wpa_s->l2_test = NULL;
 418 #endif /* CONFIG_TESTING_OPTIONS */
 419
 420         if (wpa_s->conf != NULL) {
 421                 struct wpa_ssid *ssid;
 422                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 423                         wpas_notify_network_removed(wpa_s, ssid);
 424         }
 425
 426         os_free(wpa_s->confname);
 427         wpa_s->confname = NULL;
 428
 429         os_free(wpa_s->confanother);
 430         wpa_s->confanother = NULL;
 431
 432         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 433         eapol_sm_deinit(wpa_s->eapol);
 434         wpa_s->eapol = NULL;
 435
 436         rsn_preauth_deinit(wpa_s->wpa);
 437
 438 #ifdef CONFIG_TDLS
 439         wpa_tdls_deinit(wpa_s->wpa);
 440 #endif /* CONFIG_TDLS */
 441
 442         wmm_ac_clear_saved_tspecs(wpa_s);
 443         pmksa_candidate_free(wpa_s->wpa);
 444         wpa_sm_deinit(wpa_s->wpa);
 445         wpa_s->wpa = NULL;
 446         wpa_blacklist_clear(wpa_s);
 447
 448         wpa_bss_deinit(wpa_s);
 449
 450         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 451         wpa_supplicant_cancel_scan(wpa_s);
 452         wpa_supplicant_cancel_auth_timeout(wpa_s);
 453         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 454 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 455         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 456                              wpa_s, NULL);
 457 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 458
 459         wpas_wps_deinit(wpa_s);
 460
 461         wpabuf_free(wpa_s->pending_eapol_rx);
 462         wpa_s->pending_eapol_rx = NULL;
 463
 464 #ifdef CONFIG_IBSS_RSN
 465         ibss_rsn_deinit(wpa_s->ibss_rsn);
 466         wpa_s->ibss_rsn = NULL;
 467 #endif /* CONFIG_IBSS_RSN */
 468
 469         sme_deinit(wpa_s);
 470
 471 #ifdef CONFIG_AP
 472         wpa_supplicant_ap_deinit(wpa_s);
 473 #endif /* CONFIG_AP */
 474
 475         wpas_p2p_deinit(wpa_s);
 476
 477 #ifdef CONFIG_OFFCHANNEL
 478         offchannel_deinit(wpa_s);
 479 #endif /* CONFIG_OFFCHANNEL */
 480
 481         wpa_supplicant_cancel_sched_scan(wpa_s);
 482
 483         os_free(wpa_s->next_scan_freqs);
 484         wpa_s->next_scan_freqs = NULL;
 485
 486         os_free(wpa_s->manual_scan_freqs);
 487         wpa_s->manual_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_sched_scan_freqs);
 490         wpa_s->manual_sched_scan_freqs = NULL;
 491
 492         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 493
 494         gas_query_deinit(wpa_s->gas);
 495         wpa_s->gas = NULL;
 496
 497         free_hw_features(wpa_s);
 498
 499         ieee802_1x_dealloc_kay_sm(wpa_s);
 500
 501         os_free(wpa_s->bssid_filter);
 502         wpa_s->bssid_filter = NULL;
 503
 504         os_free(wpa_s->disallow_aps_bssid);
 505         wpa_s->disallow_aps_bssid = NULL;
 506         os_free(wpa_s->disallow_aps_ssid);
 507         wpa_s->disallow_aps_ssid = NULL;
 508
 509         wnm_bss_keep_alive_deinit(wpa_s);
 510 #ifdef CONFIG_WNM
 511         wnm_deallocate_memory(wpa_s);
 512 #endif /* CONFIG_WNM */
 513
 514         ext_password_deinit(wpa_s->ext_pw);
 515         wpa_s->ext_pw = NULL;
 516
 517         wpabuf_free(wpa_s->last_gas_resp);
 518         wpa_s->last_gas_resp = NULL;
 519         wpabuf_free(wpa_s->prev_gas_resp);
 520         wpa_s->prev_gas_resp = NULL;
 521
 522         os_free(wpa_s->last_scan_res);
 523         wpa_s->last_scan_res = NULL;
 524
 525 #ifdef CONFIG_HS20
 526         hs20_deinit(wpa_s);
 527 #endif /* CONFIG_HS20 */
 528
 529         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 530                 wpabuf_free(wpa_s->vendor_elem[i]);
 531                 wpa_s->vendor_elem[i] = NULL;
 532         }
 533
 534         wmm_ac_notify_disassoc(wpa_s);
 535 }
 536
 537
 538 /**
 539  * wpa_clear_keys - Clear keys configured for the driver
 540  * @wpa_s: Pointer to wpa_supplicant data
 541  * @addr: Previously used BSSID or %NULL if not available
 542  *
 543  * This function clears the encryption keys that has been previously configured
 544  * for the driver.
 545  */
 546 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 547 {
 548         int i, max;
 549
 550 #ifdef CONFIG_IEEE80211W
 551         max = 6;
 552 #else /* CONFIG_IEEE80211W */
 553         max = 4;
 554 #endif /* CONFIG_IEEE80211W */
 555
 556         /* MLME-DELETEKEYS.request */
 557         for (i = 0; i < max; i++) {
 558                 if (wpa_s->keys_cleared & BIT(i))
 559                         continue;
 560                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 561                                 NULL, 0);
 562         }
 563         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 564             !is_zero_ether_addr(addr)) {
 565                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 566                                 0);
 567                 /* MLME-SETPROTECTION.request(None) */
 568                 wpa_drv_mlme_setprotection(
 569                         wpa_s, addr,
 570                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 571                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 572         }
 573         wpa_s->keys_cleared = (u32) -1;
 574 }
 575
 576
 577 /**
 578  * wpa_supplicant_state_txt - Get the connection state name as a text string
 579  * @state: State (wpa_state; WPA_*)
 580  * Returns: The state name as a printable text string
 581  */
 582 const char * wpa_supplicant_state_txt(enum wpa_states state)
 583 {
 584         switch (state) {
 585         case WPA_DISCONNECTED:
 586                 return "DISCONNECTED";
 587         case WPA_INACTIVE:
 588                 return "INACTIVE";
 589         case WPA_INTERFACE_DISABLED:
 590                 return "INTERFACE_DISABLED";
 591         case WPA_SCANNING:
 592                 return "SCANNING";
 593         case WPA_AUTHENTICATING:
 594                 return "AUTHENTICATING";
 595         case WPA_ASSOCIATING:
 596                 return "ASSOCIATING";
 597         case WPA_ASSOCIATED:
 598                 return "ASSOCIATED";
 599         case WPA_4WAY_HANDSHAKE:
 600                 return "4WAY_HANDSHAKE";
 601         case WPA_GROUP_HANDSHAKE:
 602                 return "GROUP_HANDSHAKE";
 603         case WPA_COMPLETED:
 604                 return "COMPLETED";
 605         default:
 606                 return "UNKNOWN";
 607         }
 608 }
 609
 610
 611 #ifdef CONFIG_BGSCAN
 612
 613 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 614 {
 615         const char *name;
 616
 617         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 618                 name = wpa_s->current_ssid->bgscan;
 619         else
 620                 name = wpa_s->conf->bgscan;
 621         if (name == NULL || name[0] == '\0')
 622                 return;
 623         if (wpas_driver_bss_selection(wpa_s))
 624                 return;
 625         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 626                 return;
 627 #ifdef CONFIG_P2P
 628         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 629                 return;
 630 #endif /* CONFIG_P2P */
 631
 632         bgscan_deinit(wpa_s);
 633         if (wpa_s->current_ssid) {
 634                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 635                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 636                                 "bgscan");
 637                         /*
 638                          * Live without bgscan; it is only used as a roaming
 639                          * optimization, so the initial connection is not
 640                          * affected.
 641                          */
 642                 } else {
 643                         struct wpa_scan_results *scan_res;
 644                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 645                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 646                                                                    0);
 647                         if (scan_res) {
 648                                 bgscan_notify_scan(wpa_s, scan_res);
 649                                 wpa_scan_results_free(scan_res);
 650                         }
 651                 }
 652         } else
 653                 wpa_s->bgscan_ssid = NULL;
 654 }
 655
 656
 657 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 658 {
 659         if (wpa_s->bgscan_ssid != NULL) {
 660                 bgscan_deinit(wpa_s);
 661                 wpa_s->bgscan_ssid = NULL;
 662         }
 663 }
 664
 665 #endif /* CONFIG_BGSCAN */
 666
 667
 668 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 669 {
 670         if (autoscan_init(wpa_s, 0))
 671                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 672 }
 673
 674
 675 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 676 {
 677         autoscan_deinit(wpa_s);
 678 }
 679
 680
 681 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 684             wpa_s->wpa_state == WPA_SCANNING) {
 685                 autoscan_deinit(wpa_s);
 686                 wpa_supplicant_start_autoscan(wpa_s);
 687         }
 688 }
 689
 690
 691 /**
 692  * wpa_supplicant_set_state - Set current connection state
 693  * @wpa_s: Pointer to wpa_supplicant data
 694  * @state: The new connection state
 695  *
 696  * This function is called whenever the connection state changes, e.g.,
 697  * association is completed for WPA/WPA2 4-Way Handshake is started.
 698  */
 699 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 700                               enum wpa_states state)
 701 {
 702         enum wpa_states old_state = wpa_s->wpa_state;
 703
 704         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 705                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 706                 wpa_supplicant_state_txt(state));
 707
 708         if (state == WPA_INTERFACE_DISABLED) {
 709                 /* Assure normal scan when interface is restored */
 710                 wpa_s->normal_scans = 0;
 711         }
 712
 713         if (state == WPA_COMPLETED) {
 714                 wpas_connect_work_done(wpa_s);
 715                 /* Reinitialize normal_scan counter */
 716                 wpa_s->normal_scans = 0;
 717         }
 718
 719         if (state != WPA_SCANNING)
 720                 wpa_supplicant_notify_scanning(wpa_s, 0);
 721
 722         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 723                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 724 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 725                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 726                         MACSTR " completed [id=%d id_str=%s]",
 727                         MAC2STR(wpa_s->bssid),
 728                         ssid ? ssid->id : -1,
 729                         ssid && ssid->id_str ? ssid->id_str : "");
 730 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 731                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 732                 wpa_s->extra_blacklist_count = 0;
 733                 wpa_s->new_connection = 0;
 734                 wpa_drv_set_operstate(wpa_s, 1);
 735 #ifndef IEEE8021X_EAPOL
 736                 wpa_drv_set_supp_port(wpa_s, 1);
 737 #endif /* IEEE8021X_EAPOL */
 738                 wpa_s->after_wps = 0;
 739                 wpa_s->known_wps_freq = 0;
 740                 wpas_p2p_completed(wpa_s);
 741
 742                 sme_sched_obss_scan(wpa_s, 1);
 743         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 744                    state == WPA_ASSOCIATED) {
 745                 wpa_s->new_connection = 1;
 746                 wpa_drv_set_operstate(wpa_s, 0);
 747 #ifndef IEEE8021X_EAPOL
 748                 wpa_drv_set_supp_port(wpa_s, 0);
 749 #endif /* IEEE8021X_EAPOL */
 750                 sme_sched_obss_scan(wpa_s, 0);
 751         }
 752         wpa_s->wpa_state = state;
 753
 754 #ifdef CONFIG_BGSCAN
 755         if (state == WPA_COMPLETED)
 756                 wpa_supplicant_start_bgscan(wpa_s);
 757         else if (state < WPA_ASSOCIATED)
 758                 wpa_supplicant_stop_bgscan(wpa_s);
 759 #endif /* CONFIG_BGSCAN */
 760
 761         if (state == WPA_AUTHENTICATING)
 762                 wpa_supplicant_stop_autoscan(wpa_s);
 763
 764         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 765                 wpa_supplicant_start_autoscan(wpa_s);
 766
 767         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 768                 wmm_ac_notify_disassoc(wpa_s);
 769
 770         if (wpa_s->wpa_state != old_state) {
 771                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 772
 773                 /*
 774                  * Notify the P2P Device interface about a state change in one
 775                  * of the interfaces.
 776                  */
 777                 wpas_p2p_indicate_state_change(wpa_s);
 778
 779                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 780                     old_state == WPA_COMPLETED)
 781                         wpas_notify_auth_changed(wpa_s);
 782         }
 783 }
 784
 785
 786 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 787 {
 788         int pending = 0;
 789 #ifdef CONFIG_WPS
 790         struct wpa_supplicant *wpa_s = global->ifaces;
 791         while (wpa_s) {
 792                 struct wpa_supplicant *next = wpa_s->next;
 793                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 794                         pending = 1;
 795 #ifdef CONFIG_P2P
 796                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 797                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 798                         wpas_p2p_disconnect(wpa_s);
 799 #endif /* CONFIG_P2P */
 800                 wpa_s = next;
 801         }
 802 #endif /* CONFIG_WPS */
 803         if (pending)
 804                 return;
 805         eloop_terminate();
 806 }
 807
 808
 809 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 810 {
 811         struct wpa_global *global = signal_ctx;
 812         wpa_supplicant_terminate_proc(global);
 813 }
 814
 815
 816 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 817 {
 818         enum wpa_states old_state = wpa_s->wpa_state;
 819
 820         wpa_s->pairwise_cipher = 0;
 821         wpa_s->group_cipher = 0;
 822         wpa_s->mgmt_group_cipher = 0;
 823         wpa_s->key_mgmt = 0;
 824         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 825                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 826
 827         if (wpa_s->wpa_state != old_state)
 828                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 829 }
 830
 831
 832 /**
 833  * wpa_supplicant_reload_configuration - Reload configuration data
 834  * @wpa_s: Pointer to wpa_supplicant data
 835  * Returns: 0 on success or -1 if configuration parsing failed
 836  *
 837  * This function can be used to request that the configuration data is reloaded
 838  * (e.g., after configuration file change). This function is reloading
 839  * configuration only for one interface, so this may need to be called multiple
 840  * times if %wpa_supplicant is controlling multiple interfaces and all
 841  * interfaces need reconfiguration.
 842  */
 843 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 844 {
 845         struct wpa_config *conf;
 846         int reconf_ctrl;
 847         int old_ap_scan;
 848
 849         if (wpa_s->confname == NULL)
 850                 return -1;
 851         conf = wpa_config_read(wpa_s->confname, NULL);
 852         if (conf == NULL) {
 853                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 854                         "file '%s' - exiting", wpa_s->confname);
 855                 return -1;
 856         }
 857         wpa_config_read(wpa_s->confanother, conf);
 858
 859         conf->changed_parameters = (unsigned int) -1;
 860
 861         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 862                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 863                     os_strcmp(conf->ctrl_interface,
 864                               wpa_s->conf->ctrl_interface) != 0);
 865
 866         if (reconf_ctrl && wpa_s->ctrl_iface) {
 867                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 868                 wpa_s->ctrl_iface = NULL;
 869         }
 870
 871         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 872         if (wpa_s->current_ssid) {
 873                 wpa_supplicant_deauthenticate(wpa_s,
 874                                               WLAN_REASON_DEAUTH_LEAVING);
 875         }
 876
 877         /*
 878          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 879          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 880          */
 881         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 882                 /*
 883                  * Clear forced success to clear EAP state for next
 884                  * authentication.
 885                  */
 886                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 887         }
 888         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 889         wpa_sm_set_config(wpa_s->wpa, NULL);
 890         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 891         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 892         rsn_preauth_deinit(wpa_s->wpa);
 893
 894         old_ap_scan = wpa_s->conf->ap_scan;
 895         wpa_config_free(wpa_s->conf);
 896         wpa_s->conf = conf;
 897         if (old_ap_scan != wpa_s->conf->ap_scan)
 898                 wpas_notify_ap_scan_changed(wpa_s);
 899
 900         if (reconf_ctrl)
 901                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 902
 903         wpa_supplicant_update_config(wpa_s);
 904
 905         wpa_supplicant_clear_status(wpa_s);
 906         if (wpa_supplicant_enabled_networks(wpa_s)) {
 907                 wpa_s->reassociate = 1;
 908                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 909         }
 910         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 911         return 0;
 912 }
 913
 914
 915 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 916 {
 917         struct wpa_global *global = signal_ctx;
 918         struct wpa_supplicant *wpa_s;
 919         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 920                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 921                         sig);
 922                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 923                         wpa_supplicant_terminate_proc(global);
 924                 }
 925         }
 926 }
 927
 928
 929 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 930                                          struct wpa_ssid *ssid,
 931                                          struct wpa_ie_data *ie)
 932 {
 933         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 934         if (ret) {
 935                 if (ret == -2) {
 936                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 937                                 "from association info");
 938                 }
 939                 return -1;
 940         }
 941
 942         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 943                 "cipher suites");
 944         if (!(ie->group_cipher & ssid->group_cipher)) {
 945                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 946                         "cipher 0x%x (mask 0x%x) - reject",
 947                         ie->group_cipher, ssid->group_cipher);
 948                 return -1;
 949         }
 950         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 951                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 952                         "cipher 0x%x (mask 0x%x) - reject",
 953                         ie->pairwise_cipher, ssid->pairwise_cipher);
 954                 return -1;
 955         }
 956         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 957                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 958                         "management 0x%x (mask 0x%x) - reject",
 959                         ie->key_mgmt, ssid->key_mgmt);
 960                 return -1;
 961         }
 962
 963 #ifdef CONFIG_IEEE80211W
 964         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 965             (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
 966              wpa_s->conf->pmf : ssid->ieee80211w) ==
 967             MGMT_FRAME_PROTECTION_REQUIRED) {
 968                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 969                         "that does not support management frame protection - "
 970                         "reject");
 971                 return -1;
 972         }
 973 #endif /* CONFIG_IEEE80211W */
 974
 975         return 0;
 976 }
 977
 978
 979 /**
 980  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 981  * @wpa_s: Pointer to wpa_supplicant data
 982  * @bss: Scan results for the selected BSS, or %NULL if not available
 983  * @ssid: Configuration data for the selected network
 984  * @wpa_ie: Buffer for the WPA/RSN IE
 985  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 986  * used buffer length in case the functions returns success.
 987  * Returns: 0 on success or -1 on failure
 988  *
 989  * This function is used to configure authentication and encryption parameters
 990  * based on the network configuration and scan result for the selected BSS (if
 991  * available).
 992  */
 993 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 994                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 995                               u8 *wpa_ie, size_t *wpa_ie_len)
 996 {
 997         struct wpa_ie_data ie;
 998         int sel, proto;
 999         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1000
1001         if (bss) {
1002                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1003                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1004                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1005         } else
1006                 bss_wpa = bss_rsn = bss_osen = NULL;
1007
1008         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1009             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1010             (ie.group_cipher & ssid->group_cipher) &&
1011             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1012             (ie.key_mgmt & ssid->key_mgmt)) {
1013                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1014                 proto = WPA_PROTO_RSN;
1015         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1016                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1017                    (ie.group_cipher & ssid->group_cipher) &&
1018                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1019                    (ie.key_mgmt & ssid->key_mgmt)) {
1020                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1021                 proto = WPA_PROTO_WPA;
1022 #ifdef CONFIG_HS20
1023         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1024                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1025                 /* TODO: parse OSEN element */
1026                 os_memset(&ie, 0, sizeof(ie));
1027                 ie.group_cipher = WPA_CIPHER_CCMP;
1028                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1029                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1030                 proto = WPA_PROTO_OSEN;
1031 #endif /* CONFIG_HS20 */
1032         } else if (bss) {
1033                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1034                 wpa_dbg(wpa_s, MSG_DEBUG,
1035                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1036                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1037                         ssid->key_mgmt);
1038                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1039                         MAC2STR(bss->bssid),
1040                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1041                         bss_wpa ? " WPA" : "",
1042                         bss_rsn ? " RSN" : "",
1043                         bss_osen ? " OSEN" : "");
1044                 if (bss_rsn) {
1045                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1046                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1047                                 wpa_dbg(wpa_s, MSG_DEBUG,
1048                                         "Could not parse RSN element");
1049                         } else {
1050                                 wpa_dbg(wpa_s, MSG_DEBUG,
1051                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1052                                         ie.pairwise_cipher, ie.group_cipher,
1053                                         ie.key_mgmt);
1054                         }
1055                 }
1056                 if (bss_wpa) {
1057                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1058                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1059                                 wpa_dbg(wpa_s, MSG_DEBUG,
1060                                         "Could not parse WPA element");
1061                         } else {
1062                                 wpa_dbg(wpa_s, MSG_DEBUG,
1063                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1064                                         ie.pairwise_cipher, ie.group_cipher,
1065                                         ie.key_mgmt);
1066                         }
1067                 }
1068                 return -1;
1069         } else {
1070                 if (ssid->proto & WPA_PROTO_OSEN)
1071                         proto = WPA_PROTO_OSEN;
1072                 else if (ssid->proto & WPA_PROTO_RSN)
1073                         proto = WPA_PROTO_RSN;
1074                 else
1075                         proto = WPA_PROTO_WPA;
1076                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1077                         os_memset(&ie, 0, sizeof(ie));
1078                         ie.group_cipher = ssid->group_cipher;
1079                         ie.pairwise_cipher = ssid->pairwise_cipher;
1080                         ie.key_mgmt = ssid->key_mgmt;
1081 #ifdef CONFIG_IEEE80211W
1082                         ie.mgmt_group_cipher =
1083                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1084                                 WPA_CIPHER_AES_128_CMAC : 0;
1085 #endif /* CONFIG_IEEE80211W */
1086                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1087                                 "based on configuration");
1088                 } else
1089                         proto = ie.proto;
1090         }
1091
1092         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1093                 "pairwise %d key_mgmt %d proto %d",
1094                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1095 #ifdef CONFIG_IEEE80211W
1096         if (ssid->ieee80211w) {
1097                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1098                         ie.mgmt_group_cipher);
1099         }
1100 #endif /* CONFIG_IEEE80211W */
1101
1102         wpa_s->wpa_proto = proto;
1103         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1104         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1105                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1106
1107         if (bss || !wpa_s->ap_ies_from_associnfo) {
1108                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1109                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1110                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1111                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1112                         return -1;
1113         }
1114
1115         sel = ie.group_cipher & ssid->group_cipher;
1116         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1117         if (wpa_s->group_cipher < 0) {
1118                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1119                         "cipher");
1120                 return -1;
1121         }
1122         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1123                 wpa_cipher_txt(wpa_s->group_cipher));
1124
1125         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1126         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1127         if (wpa_s->pairwise_cipher < 0) {
1128                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1129                         "cipher");
1130                 return -1;
1131         }
1132         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1133                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1134
1135         sel = ie.key_mgmt & ssid->key_mgmt;
1136 #ifdef CONFIG_SAE
1137         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1138                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1139 #endif /* CONFIG_SAE */
1140         if (0) {
1141 #ifdef CONFIG_SUITEB192
1142         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1143                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1144                 wpa_dbg(wpa_s, MSG_DEBUG,
1145                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1146 #endif /* CONFIG_SUITEB192 */
1147 #ifdef CONFIG_SUITEB
1148         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1149                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1150                 wpa_dbg(wpa_s, MSG_DEBUG,
1151                         "WPA: using KEY_MGMT 802.1X with Suite B");
1152 #endif /* CONFIG_SUITEB */
1153 #ifdef CONFIG_IEEE80211R
1154         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1155                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1156                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1157         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1158                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1159                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1160 #endif /* CONFIG_IEEE80211R */
1161 #ifdef CONFIG_SAE
1162         } else if (sel & WPA_KEY_MGMT_SAE) {
1163                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1164                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1165         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1166                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1167                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1168 #endif /* CONFIG_SAE */
1169 #ifdef CONFIG_IEEE80211W
1170         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1171                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1172                 wpa_dbg(wpa_s, MSG_DEBUG,
1173                         "WPA: using KEY_MGMT 802.1X with SHA256");
1174         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1175                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1176                 wpa_dbg(wpa_s, MSG_DEBUG,
1177                         "WPA: using KEY_MGMT PSK with SHA256");
1178 #endif /* CONFIG_IEEE80211W */
1179         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1180                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1181                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1182         } else if (sel & WPA_KEY_MGMT_PSK) {
1183                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1184                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1185         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1186                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1187                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1188 #ifdef CONFIG_HS20
1189         } else if (sel & WPA_KEY_MGMT_OSEN) {
1190                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1191                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1192 #endif /* CONFIG_HS20 */
1193         } else {
1194                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1195                         "authenticated key management type");
1196                 return -1;
1197         }
1198
1199         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1200         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1201                          wpa_s->pairwise_cipher);
1202         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1203
1204 #ifdef CONFIG_IEEE80211W
1205         sel = ie.mgmt_group_cipher;
1206         if ((ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1207              wpa_s->conf->pmf : ssid->ieee80211w) == NO_MGMT_FRAME_PROTECTION ||
1208             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1209                 sel = 0;
1210         if (sel & WPA_CIPHER_AES_128_CMAC) {
1211                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1212                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1213                         "AES-128-CMAC");
1214         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1215                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1217                         "BIP-GMAC-128");
1218         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1219                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1220                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1221                         "BIP-GMAC-256");
1222         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1223                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1225                         "BIP-CMAC-256");
1226         } else {
1227                 wpa_s->mgmt_group_cipher = 0;
1228                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1229         }
1230         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1231                          wpa_s->mgmt_group_cipher);
1232         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1233                          (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1234                           wpa_s->conf->pmf : ssid->ieee80211w));
1235 #endif /* CONFIG_IEEE80211W */
1236
1237         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1238                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1239                 return -1;
1240         }
1241
1242         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1243                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1244 #ifndef CONFIG_NO_PBKDF2
1245                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1246                     ssid->passphrase) {
1247                         u8 psk[PMK_LEN];
1248                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1249                                     4096, psk, PMK_LEN);
1250                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1251                                         psk, PMK_LEN);
1252                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1253                         os_memset(psk, 0, sizeof(psk));
1254                 }
1255 #endif /* CONFIG_NO_PBKDF2 */
1256 #ifdef CONFIG_EXT_PASSWORD
1257                 if (ssid->ext_psk) {
1258                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1259                                                              ssid->ext_psk);
1260                         char pw_str[64 + 1];
1261                         u8 psk[PMK_LEN];
1262
1263                         if (pw == NULL) {
1264                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1265                                         "found from external storage");
1266                                 return -1;
1267                         }
1268
1269                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1270                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1271                                         "PSK length %d in external storage",
1272                                         (int) wpabuf_len(pw));
1273                                 ext_password_free(pw);
1274                                 return -1;
1275                         }
1276
1277                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1278                         pw_str[wpabuf_len(pw)] = '\0';
1279
1280 #ifndef CONFIG_NO_PBKDF2
1281                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1282                         {
1283                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1284                                             4096, psk, PMK_LEN);
1285                                 os_memset(pw_str, 0, sizeof(pw_str));
1286                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1287                                                 "external passphrase)",
1288                                                 psk, PMK_LEN);
1289                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1290                                 os_memset(psk, 0, sizeof(psk));
1291                         } else
1292 #endif /* CONFIG_NO_PBKDF2 */
1293                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1294                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1295                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1296                                                 "Invalid PSK hex string");
1297                                         os_memset(pw_str, 0, sizeof(pw_str));
1298                                         ext_password_free(pw);
1299                                         return -1;
1300                                 }
1301                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1302                                 os_memset(psk, 0, sizeof(psk));
1303                         } else {
1304                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1305                                         "PSK available");
1306                                 os_memset(pw_str, 0, sizeof(pw_str));
1307                                 ext_password_free(pw);
1308                                 return -1;
1309                         }
1310
1311                         os_memset(pw_str, 0, sizeof(pw_str));
1312                         ext_password_free(pw);
1313                 }
1314 #endif /* CONFIG_EXT_PASSWORD */
1315         } else
1316                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1317
1318         return 0;
1319 }
1320
1321
1322 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1323 {
1324         *pos = 0x00;
1325
1326         switch (idx) {
1327         case 0: /* Bits 0-7 */
1328                 break;
1329         case 1: /* Bits 8-15 */
1330                 break;
1331         case 2: /* Bits 16-23 */
1332 #ifdef CONFIG_WNM
1333                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1334                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1335 #endif /* CONFIG_WNM */
1336                 break;
1337         case 3: /* Bits 24-31 */
1338 #ifdef CONFIG_WNM
1339                 *pos |= 0x02; /* Bit 25 - SSID List */
1340 #endif /* CONFIG_WNM */
1341 #ifdef CONFIG_INTERWORKING
1342                 if (wpa_s->conf->interworking)
1343                         *pos |= 0x80; /* Bit 31 - Interworking */
1344 #endif /* CONFIG_INTERWORKING */
1345                 break;
1346         case 4: /* Bits 32-39 */
1347 #ifdef CONFIG_INTERWORKING
1348                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1349                         *pos |= 0x01; /* Bit 32 - QoS Map */
1350 #endif /* CONFIG_INTERWORKING */
1351                 break;
1352         case 5: /* Bits 40-47 */
1353 #ifdef CONFIG_HS20
1354                 if (wpa_s->conf->hs20)
1355                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1356 #endif /* CONFIG_HS20 */
1357                 break;
1358         case 6: /* Bits 48-55 */
1359                 break;
1360         }
1361 }
1362
1363
1364 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1365 {
1366         u8 *pos = buf;
1367         u8 len = 6, i;
1368
1369         if (len < wpa_s->extended_capa_len)
1370                 len = wpa_s->extended_capa_len;
1371         if (buflen < (size_t) len + 2) {
1372                 wpa_printf(MSG_INFO,
1373                            "Not enough room for building extended capabilities element");
1374                 return -1;
1375         }
1376
1377         *pos++ = WLAN_EID_EXT_CAPAB;
1378         *pos++ = len;
1379         for (i = 0; i < len; i++, pos++) {
1380                 wpas_ext_capab_byte(wpa_s, pos, i);
1381
1382                 if (i < wpa_s->extended_capa_len) {
1383                         *pos &= ~wpa_s->extended_capa_mask[i];
1384                         *pos |= wpa_s->extended_capa[i];
1385                 }
1386         }
1387
1388         while (len > 0 && buf[1 + len] == 0) {
1389                 len--;
1390                 buf[1] = len;
1391         }
1392         if (len == 0)
1393                 return 0;
1394
1395         return 2 + len;
1396 }
1397
1398
1399 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1400                           struct wpa_bss *test_bss)
1401 {
1402         struct wpa_bss *bss;
1403
1404         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1405                 if (bss == test_bss)
1406                         return 1;
1407         }
1408
1409         return 0;
1410 }
1411
1412
1413 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1414                            struct wpa_ssid *test_ssid)
1415 {
1416         struct wpa_ssid *ssid;
1417
1418         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1419                 if (ssid == test_ssid)
1420                         return 1;
1421         }
1422
1423         return 0;
1424 }
1425
1426
1427 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1428                         struct wpa_ssid *test_ssid)
1429 {
1430         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1431                 return 0;
1432
1433         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1434 }
1435
1436
1437 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1438 {
1439         if (cwork == NULL)
1440                 return;
1441         os_free(cwork);
1442 }
1443
1444
1445 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1446 {
1447         struct wpa_connect_work *cwork;
1448         struct wpa_radio_work *work = wpa_s->connect_work;
1449
1450         if (!work)
1451                 return;
1452
1453         wpa_s->connect_work = NULL;
1454         cwork = work->ctx;
1455         work->ctx = NULL;
1456         wpas_connect_work_free(cwork);
1457         radio_work_done(work);
1458 }
1459
1460
1461 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1462 {
1463         struct os_reltime now;
1464         u8 addr[ETH_ALEN];
1465
1466         os_get_reltime(&now);
1467         if (wpa_s->last_mac_addr_style == style &&
1468             wpa_s->last_mac_addr_change.sec != 0 &&
1469             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1470                                 wpa_s->conf->rand_addr_lifetime)) {
1471                 wpa_msg(wpa_s, MSG_DEBUG,
1472                         "Previously selected random MAC address has not yet expired");
1473                 return 0;
1474         }
1475
1476         switch (style) {
1477         case 1:
1478                 if (random_mac_addr(addr) < 0)
1479                         return -1;
1480                 break;
1481         case 2:
1482                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1483                 if (random_mac_addr_keep_oui(addr) < 0)
1484                         return -1;
1485                 break;
1486         default:
1487                 return -1;
1488         }
1489
1490         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1491                 wpa_msg(wpa_s, MSG_INFO,
1492                         "Failed to set random MAC address");
1493                 return -1;
1494         }
1495
1496         os_get_reltime(&wpa_s->last_mac_addr_change);
1497         wpa_s->mac_addr_changed = 1;
1498         wpa_s->last_mac_addr_style = style;
1499
1500         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1501                 wpa_msg(wpa_s, MSG_INFO,
1502                         "Could not update MAC address information");
1503                 return -1;
1504         }
1505
1506         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1507                 MAC2STR(addr));
1508
1509         return 0;
1510 }
1511
1512
1513 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1514 {
1515         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1516             !wpa_s->conf->preassoc_mac_addr)
1517                 return 0;
1518
1519         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1520 }
1521
1522
1523 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1524
1525 /**
1526  * wpa_supplicant_associate - Request association
1527  * @wpa_s: Pointer to wpa_supplicant data
1528  * @bss: Scan results for the selected BSS, or %NULL if not available
1529  * @ssid: Configuration data for the selected network
1530  *
1531  * This function is used to request %wpa_supplicant to associate with a BSS.
1532  */
1533 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1534                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1535 {
1536         struct wpa_connect_work *cwork;
1537         int rand_style;
1538
1539         if (ssid->mac_addr == -1)
1540                 rand_style = wpa_s->conf->mac_addr;
1541         else
1542                 rand_style = ssid->mac_addr;
1543
1544         wmm_ac_clear_saved_tspecs(wpa_s);
1545         wpa_s->reassoc_same_bss = 0;
1546
1547         if (wpa_s->last_ssid == ssid) {
1548                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1549                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1550                         wmm_ac_save_tspecs(wpa_s);
1551                         wpa_s->reassoc_same_bss = 1;
1552                 }
1553         } else if (rand_style > 0) {
1554                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1555                         return;
1556                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1557         } else if (wpa_s->mac_addr_changed) {
1558                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1559                         wpa_msg(wpa_s, MSG_INFO,
1560                                 "Could not restore permanent MAC address");
1561                         return;
1562                 }
1563                 wpa_s->mac_addr_changed = 0;
1564                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1565                         wpa_msg(wpa_s, MSG_INFO,
1566                                 "Could not update MAC address information");
1567                         return;
1568                 }
1569                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1570         }
1571         wpa_s->last_ssid = ssid;
1572
1573 #ifdef CONFIG_IBSS_RSN
1574         ibss_rsn_deinit(wpa_s->ibss_rsn);
1575         wpa_s->ibss_rsn = NULL;
1576 #endif /* CONFIG_IBSS_RSN */
1577
1578         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1579             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1580 #ifdef CONFIG_AP
1581                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1582                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1583                                 "mode");
1584                         return;
1585                 }
1586                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1587                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1588                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1589                                 wpas_p2p_ap_setup_failed(wpa_s);
1590                         return;
1591                 }
1592                 wpa_s->current_bss = bss;
1593 #else /* CONFIG_AP */
1594                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1595                         "the build");
1596 #endif /* CONFIG_AP */
1597                 return;
1598         }
1599
1600         if (ssid->mode == WPAS_MODE_MESH) {
1601 #ifdef CONFIG_MESH
1602                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1603                         wpa_msg(wpa_s, MSG_INFO,
1604                                 "Driver does not support mesh mode");
1605                         return;
1606                 }
1607                 if (bss)
1608                         ssid->frequency = bss->freq;
1609                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1610                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1611                         return;
1612                 }
1613                 wpa_s->current_bss = bss;
1614                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1615                              "ssid=\"%s\" id=%d",
1616                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1617                              ssid->id);
1618 #else /* CONFIG_MESH */
1619                 wpa_msg(wpa_s, MSG_ERROR,
1620                         "mesh mode support not included in the build");
1621 #endif /* CONFIG_MESH */
1622                 return;
1623         }
1624
1625 #ifdef CONFIG_TDLS
1626         if (bss)
1627                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1628                                 bss->ie_len);
1629 #endif /* CONFIG_TDLS */
1630
1631         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1632             ssid->mode == IEEE80211_MODE_INFRA) {
1633                 sme_authenticate(wpa_s, bss, ssid);
1634                 return;
1635         }
1636
1637         if (wpa_s->connect_work) {
1638                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1639                 return;
1640         }
1641
1642         if (radio_work_pending(wpa_s, "connect")) {
1643                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1644                 return;
1645         }
1646
1647         cwork = os_zalloc(sizeof(*cwork));
1648         if (cwork == NULL)
1649                 return;
1650
1651         cwork->bss = bss;
1652         cwork->ssid = ssid;
1653
1654         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1655                            wpas_start_assoc_cb, cwork) < 0) {
1656                 os_free(cwork);
1657         }
1658 }
1659
1660
1661 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1662                           const struct wpa_ssid *ssid,
1663                           struct hostapd_freq_params *freq)
1664 {
1665         enum hostapd_hw_mode hw_mode;
1666         struct hostapd_hw_modes *mode = NULL;
1667         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1668                            184, 192 };
1669         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1670         u8 channel;
1671         int i, chan_idx, ht40 = -1, res;
1672         unsigned int j;
1673
1674         freq->freq = ssid->frequency;
1675
1676         /* For IBSS check HT_IBSS flag */
1677         if (ssid->mode == WPAS_MODE_IBSS &&
1678             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1679                 return;
1680
1681         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1682         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1683                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1684                         mode = &wpa_s->hw.modes[i];
1685                         break;
1686                 }
1687         }
1688
1689         if (!mode)
1690                 return;
1691
1692         freq->ht_enabled = ht_supported(mode);
1693         if (!freq->ht_enabled)
1694                 return;
1695
1696         /* Setup higher BW only for 5 GHz */
1697         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1698                 return;
1699
1700         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1701                 pri_chan = &mode->channels[chan_idx];
1702                 if (pri_chan->chan == channel)
1703                         break;
1704                 pri_chan = NULL;
1705         }
1706         if (!pri_chan)
1707                 return;
1708
1709         /* Check primary channel flags */
1710         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1711                 return;
1712
1713         /* Check/setup HT40+/HT40- */
1714         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1715                 if (ht40plus[j] == channel) {
1716                         ht40 = 1;
1717                         break;
1718                 }
1719         }
1720
1721         /* Find secondary channel */
1722         for (i = 0; i < mode->num_channels; i++) {
1723                 sec_chan = &mode->channels[i];
1724                 if (sec_chan->chan == channel + ht40 * 4)
1725                         break;
1726                 sec_chan = NULL;
1727         }
1728         if (!sec_chan)
1729                 return;
1730
1731         /* Check secondary channel flags */
1732         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1733                 return;
1734
1735         freq->channel = pri_chan->chan;
1736
1737         switch (ht40) {
1738         case -1:
1739                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1740                         return;
1741                 freq->sec_channel_offset = -1;
1742                 break;
1743         case 1:
1744                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1745                         return;
1746                 freq->sec_channel_offset = 1;
1747                 break;
1748         default:
1749                 break;
1750         }
1751
1752         if (freq->sec_channel_offset) {
1753                 struct wpa_scan_results *scan_res;
1754
1755                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1756                 if (scan_res == NULL) {
1757                         /* Back to HT20 */
1758                         freq->sec_channel_offset = 0;
1759                         return;
1760                 }
1761
1762                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1763                                      sec_chan->chan);
1764                 switch (res) {
1765                 case 0:
1766                         /* Back to HT20 */
1767                         freq->sec_channel_offset = 0;
1768                         break;
1769                 case 1:
1770                         /* Configuration allowed */
1771                         break;
1772                 case 2:
1773                         /* Switch pri/sec channels */
1774                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1775                         freq->sec_channel_offset = -freq->sec_channel_offset;
1776                         freq->channel = sec_chan->chan;
1777                         break;
1778                 default:
1779                         freq->sec_channel_offset = 0;
1780                         break;
1781                 }
1782
1783                 wpa_scan_results_free(scan_res);
1784         }
1785
1786         wpa_printf(MSG_DEBUG,
1787                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1788                    freq->channel, freq->sec_channel_offset);
1789 }
1790
1791
1792 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1793 {
1794         struct wpa_connect_work *cwork = work->ctx;
1795         struct wpa_bss *bss = cwork->bss;
1796         struct wpa_ssid *ssid = cwork->ssid;
1797         struct wpa_supplicant *wpa_s = work->wpa_s;
1798         u8 wpa_ie[200];
1799         size_t wpa_ie_len;
1800         int use_crypt, ret, i, bssid_changed;
1801         int algs = WPA_AUTH_ALG_OPEN;
1802         unsigned int cipher_pairwise, cipher_group;
1803         struct wpa_driver_associate_params params;
1804         int wep_keys_set = 0;
1805         int assoc_failed = 0;
1806         struct wpa_ssid *old_ssid;
1807 #ifdef CONFIG_HT_OVERRIDES
1808         struct ieee80211_ht_capabilities htcaps;
1809         struct ieee80211_ht_capabilities htcaps_mask;
1810 #endif /* CONFIG_HT_OVERRIDES */
1811 #ifdef CONFIG_VHT_OVERRIDES
1812        struct ieee80211_vht_capabilities vhtcaps;
1813        struct ieee80211_vht_capabilities vhtcaps_mask;
1814 #endif /* CONFIG_VHT_OVERRIDES */
1815
1816         if (deinit) {
1817                 if (work->started) {
1818                         wpa_s->connect_work = NULL;
1819
1820                         /* cancel possible auth. timeout */
1821                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1822                                              NULL);
1823                 }
1824                 wpas_connect_work_free(cwork);
1825                 return;
1826         }
1827
1828         wpa_s->connect_work = work;
1829
1830         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1831                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1832                 wpas_connect_work_done(wpa_s);
1833                 return;
1834         }
1835
1836         os_memset(&params, 0, sizeof(params));
1837         wpa_s->reassociate = 0;
1838         wpa_s->eap_expected_failure = 0;
1839         if (bss &&
1840             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1841 #ifdef CONFIG_IEEE80211R
1842                 const u8 *ie, *md = NULL;
1843 #endif /* CONFIG_IEEE80211R */
1844                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1845                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1846                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1847                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1848                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1849                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1850                 if (bssid_changed)
1851                         wpas_notify_bssid_changed(wpa_s);
1852 #ifdef CONFIG_IEEE80211R
1853                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1854                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1855                         md = ie + 2;
1856                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1857                 if (md) {
1858                         /* Prepare for the next transition */
1859                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1860                 }
1861 #endif /* CONFIG_IEEE80211R */
1862 #ifdef CONFIG_WPS
1863         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1864                    wpa_s->conf->ap_scan == 2 &&
1865                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1866                 /* Use ap_scan==1 style network selection to find the network
1867                  */
1868                 wpas_connect_work_done(wpa_s);
1869                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1870                 wpa_s->reassociate = 1;
1871                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1872                 return;
1873 #endif /* CONFIG_WPS */
1874         } else {
1875                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1876                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1877                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1878         }
1879         wpa_supplicant_cancel_sched_scan(wpa_s);
1880         wpa_supplicant_cancel_scan(wpa_s);
1881
1882         /* Starting new association, so clear the possibly used WPA IE from the
1883          * previous association. */
1884         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1885
1886 #ifdef IEEE8021X_EAPOL
1887         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1888                 if (ssid->leap) {
1889                         if (ssid->non_leap == 0)
1890                                 algs = WPA_AUTH_ALG_LEAP;
1891                         else
1892                                 algs |= WPA_AUTH_ALG_LEAP;
1893                 }
1894         }
1895 #endif /* IEEE8021X_EAPOL */
1896         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1897         if (ssid->auth_alg) {
1898                 algs = ssid->auth_alg;
1899                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1900                         "0x%x", algs);
1901         }
1902
1903         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1904                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1905             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1906                 int try_opportunistic;
1907                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1908                                      wpa_s->conf->okc :
1909                                      ssid->proactive_key_caching) &&
1910                         (ssid->proto & WPA_PROTO_RSN);
1911                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
1912                                             ssid, try_opportunistic) == 0)
1913                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
1914                 wpa_ie_len = sizeof(wpa_ie);
1915                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1916                                               wpa_ie, &wpa_ie_len)) {
1917                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1918                                 "key management and encryption suites");
1919                         wpas_connect_work_done(wpa_s);
1920                         return;
1921                 }
1922         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
1923                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1924                 /*
1925                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1926                  * use non-WPA since the scan results did not indicate that the
1927                  * AP is using WPA or WPA2.
1928                  */
1929                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1930                 wpa_ie_len = 0;
1931                 wpa_s->wpa_proto = 0;
1932         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1933                 wpa_ie_len = sizeof(wpa_ie);
1934                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1935                                               wpa_ie, &wpa_ie_len)) {
1936                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1937                                 "key management and encryption suites (no "
1938                                 "scan results)");
1939                         wpas_connect_work_done(wpa_s);
1940                         return;
1941                 }
1942 #ifdef CONFIG_WPS
1943         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1944                 struct wpabuf *wps_ie;
1945                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1946                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
1947                         wpa_ie_len = wpabuf_len(wps_ie);
1948                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
1949                 } else
1950                         wpa_ie_len = 0;
1951                 wpabuf_free(wps_ie);
1952                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1953                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
1954                         params.wps = WPS_MODE_PRIVACY;
1955                 else
1956                         params.wps = WPS_MODE_OPEN;
1957                 wpa_s->wpa_proto = 0;
1958 #endif /* CONFIG_WPS */
1959         } else {
1960                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1961                 wpa_ie_len = 0;
1962                 wpa_s->wpa_proto = 0;
1963         }
1964
1965 #ifdef CONFIG_P2P
1966         if (wpa_s->global->p2p) {
1967                 u8 *pos;
1968                 size_t len;
1969                 int res;
1970                 pos = wpa_ie + wpa_ie_len;
1971                 len = sizeof(wpa_ie) - wpa_ie_len;
1972                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
1973                                             ssid->p2p_group);
1974                 if (res >= 0)
1975                         wpa_ie_len += res;
1976         }
1977
1978         wpa_s->cross_connect_disallowed = 0;
1979         if (bss) {
1980                 struct wpabuf *p2p;
1981                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
1982                 if (p2p) {
1983                         wpa_s->cross_connect_disallowed =
1984                                 p2p_get_cross_connect_disallowed(p2p);
1985                         wpabuf_free(p2p);
1986                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
1987                                 "connection",
1988                                 wpa_s->cross_connect_disallowed ?
1989                                 "disallows" : "allows");
1990                 }
1991         }
1992
1993         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
1994 #endif /* CONFIG_P2P */
1995
1996 #ifdef CONFIG_HS20
1997         if (is_hs20_network(wpa_s, ssid, bss)) {
1998                 struct wpabuf *hs20;
1999                 hs20 = wpabuf_alloc(20);
2000                 if (hs20) {
2001                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2002                         size_t len;
2003
2004                         wpas_hs20_add_indication(hs20, pps_mo_id);
2005                         len = sizeof(wpa_ie) - wpa_ie_len;
2006                         if (wpabuf_len(hs20) <= len) {
2007                                 os_memcpy(wpa_ie + wpa_ie_len,
2008                                           wpabuf_head(hs20), wpabuf_len(hs20));
2009                                 wpa_ie_len += wpabuf_len(hs20);
2010                         }
2011                         wpabuf_free(hs20);
2012                 }
2013         }
2014 #endif /* CONFIG_HS20 */
2015
2016         /*
2017          * Workaround: Add Extended Capabilities element only if the AP
2018          * included this element in Beacon/Probe Response frames. Some older
2019          * APs seem to have interoperability issues if this element is
2020          * included, so while the standard may require us to include the
2021          * element in all cases, it is justifiable to skip it to avoid
2022          * interoperability issues.
2023          */
2024         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2025                 u8 ext_capab[18];
2026                 int ext_capab_len;
2027                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2028                                                      sizeof(ext_capab));
2029                 if (ext_capab_len > 0) {
2030                         u8 *pos = wpa_ie;
2031                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2032                                 pos += 2 + pos[1];
2033                         os_memmove(pos + ext_capab_len, pos,
2034                                    wpa_ie_len - (pos - wpa_ie));
2035                         wpa_ie_len += ext_capab_len;
2036                         os_memcpy(pos, ext_capab, ext_capab_len);
2037                 }
2038         }
2039
2040         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2041                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2042                 size_t len;
2043
2044                 len = sizeof(wpa_ie) - wpa_ie_len;
2045                 if (wpabuf_len(buf) <= len) {
2046                         os_memcpy(wpa_ie + wpa_ie_len,
2047                                   wpabuf_head(buf), wpabuf_len(buf));
2048                         wpa_ie_len += wpabuf_len(buf);
2049                 }
2050         }
2051
2052         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2053         use_crypt = 1;
2054         cipher_pairwise = wpa_s->pairwise_cipher;
2055         cipher_group = wpa_s->group_cipher;
2056         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2057             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2058                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2059                         use_crypt = 0;
2060                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2061                         use_crypt = 1;
2062                         wep_keys_set = 1;
2063                 }
2064         }
2065         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2066                 use_crypt = 0;
2067
2068 #ifdef IEEE8021X_EAPOL
2069         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2070                 if ((ssid->eapol_flags &
2071                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2072                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2073                     !wep_keys_set) {
2074                         use_crypt = 0;
2075                 } else {
2076                         /* Assume that dynamic WEP-104 keys will be used and
2077                          * set cipher suites in order for drivers to expect
2078                          * encryption. */
2079                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2080                 }
2081         }
2082 #endif /* IEEE8021X_EAPOL */
2083
2084         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2085                 /* Set the key before (and later after) association */
2086                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2087         }
2088
2089         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2090         if (bss) {
2091                 params.ssid = bss->ssid;
2092                 params.ssid_len = bss->ssid_len;
2093                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2094                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2095                                    MACSTR " freq=%u MHz based on scan results "
2096                                    "(bssid_set=%d)",
2097                                    MAC2STR(bss->bssid), bss->freq,
2098                                    ssid->bssid_set);
2099                         params.bssid = bss->bssid;
2100                         params.freq.freq = bss->freq;
2101                 }
2102                 params.bssid_hint = bss->bssid;
2103                 params.freq_hint = bss->freq;
2104         } else {
2105                 params.ssid = ssid->ssid;
2106                 params.ssid_len = ssid->ssid_len;
2107         }
2108
2109         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2110             wpa_s->conf->ap_scan == 2) {
2111                 params.bssid = ssid->bssid;
2112                 params.fixed_bssid = 1;
2113         }
2114
2115         /* Initial frequency for IBSS/mesh */
2116         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2117             ssid->frequency > 0 && params.freq.freq == 0)
2118                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2119
2120         if (ssid->mode == WPAS_MODE_IBSS) {
2121                 if (ssid->beacon_int)
2122                         params.beacon_int = ssid->beacon_int;
2123                 else
2124                         params.beacon_int = wpa_s->conf->beacon_int;
2125         }
2126
2127         params.wpa_ie = wpa_ie;
2128         params.wpa_ie_len = wpa_ie_len;
2129         params.pairwise_suite = cipher_pairwise;
2130         params.group_suite = cipher_group;
2131         params.key_mgmt_suite = wpa_s->key_mgmt;
2132         params.wpa_proto = wpa_s->wpa_proto;
2133         params.auth_alg = algs;
2134         params.mode = ssid->mode;
2135         params.bg_scan_period = ssid->bg_scan_period;
2136         for (i = 0; i < NUM_WEP_KEYS; i++) {
2137                 if (ssid->wep_key_len[i])
2138                         params.wep_key[i] = ssid->wep_key[i];
2139                 params.wep_key_len[i] = ssid->wep_key_len[i];
2140         }
2141         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2142
2143         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2144             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2145              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2146                 params.passphrase = ssid->passphrase;
2147                 if (ssid->psk_set)
2148                         params.psk = ssid->psk;
2149         }
2150
2151         if (wpa_s->conf->key_mgmt_offload) {
2152                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2153                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2154                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2155                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2156                         params.req_key_mgmt_offload =
2157                                 ssid->proactive_key_caching < 0 ?
2158                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2159                 else
2160                         params.req_key_mgmt_offload = 1;
2161
2162                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2163                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2164                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2165                     ssid->psk_set)
2166                         params.psk = ssid->psk;
2167         }
2168
2169         params.drop_unencrypted = use_crypt;
2170
2171 #ifdef CONFIG_IEEE80211W
2172         params.mgmt_frame_protection =
2173                 ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
2174                 wpa_s->conf->pmf : ssid->ieee80211w;
2175         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2176                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2177                 struct wpa_ie_data ie;
2178                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2179                     ie.capabilities &
2180                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2181                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2182                                 "MFP: require MFP");
2183                         params.mgmt_frame_protection =
2184                                 MGMT_FRAME_PROTECTION_REQUIRED;
2185                 }
2186         }
2187 #endif /* CONFIG_IEEE80211W */
2188
2189         params.p2p = ssid->p2p_group;
2190
2191         if (wpa_s->parent->set_sta_uapsd)
2192                 params.uapsd = wpa_s->parent->sta_uapsd;
2193         else
2194                 params.uapsd = -1;
2195
2196 #ifdef CONFIG_HT_OVERRIDES
2197         os_memset(&htcaps, 0, sizeof(htcaps));
2198         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2199         params.htcaps = (u8 *) &htcaps;
2200         params.htcaps_mask = (u8 *) &htcaps_mask;
2201         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2202 #endif /* CONFIG_HT_OVERRIDES */
2203 #ifdef CONFIG_VHT_OVERRIDES
2204         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2205         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2206         params.vhtcaps = &vhtcaps;
2207         params.vhtcaps_mask = &vhtcaps_mask;
2208         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2209 #endif /* CONFIG_VHT_OVERRIDES */
2210
2211 #ifdef CONFIG_P2P
2212         /*
2213          * If multi-channel concurrency is not supported, check for any
2214          * frequency conflict. In case of any frequency conflict, remove the
2215          * least prioritized connection.
2216          */
2217         if (wpa_s->num_multichan_concurrent < 2) {
2218                 int freq, num;
2219                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2220                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2221                         wpa_printf(MSG_DEBUG,
2222                                    "Assoc conflicting freq found (%d != %d)",
2223                                    freq, params.freq.freq);
2224                         if (wpas_p2p_handle_frequency_conflicts(
2225                                     wpa_s, params.freq.freq, ssid) < 0) {
2226                                 wpas_connect_work_done(wpa_s);
2227                                 return;
2228                         }
2229                 }
2230         }
2231 #endif /* CONFIG_P2P */
2232
2233         ret = wpa_drv_associate(wpa_s, &params);
2234         if (ret < 0) {
2235                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2236                         "failed");
2237                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2238                         /*
2239                          * The driver is known to mean what is saying, so we
2240                          * can stop right here; the association will not
2241                          * succeed.
2242                          */
2243                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2244                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2245                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2246                         return;
2247                 }
2248                 /* try to continue anyway; new association will be tried again
2249                  * after timeout */
2250                 assoc_failed = 1;
2251         }
2252
2253         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2254                 /* Set the key after the association just in case association
2255                  * cleared the previously configured key. */
2256                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2257                 /* No need to timeout authentication since there is no key
2258                  * management. */
2259                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2260                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2261 #ifdef CONFIG_IBSS_RSN
2262         } else if (ssid->mode == WPAS_MODE_IBSS &&
2263                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2264                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2265                 /*
2266                  * RSN IBSS authentication is per-STA and we can disable the
2267                  * per-BSSID authentication.
2268                  */
2269                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2270 #endif /* CONFIG_IBSS_RSN */
2271         } else {
2272                 /* Timeout for IEEE 802.11 authentication and association */
2273                 int timeout = 60;
2274
2275                 if (assoc_failed) {
2276                         /* give IBSS a bit more time */
2277                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2278                 } else if (wpa_s->conf->ap_scan == 1) {
2279                         /* give IBSS a bit more time */
2280                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2281                 }
2282                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2283         }
2284
2285         if (wep_keys_set &&
2286             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2287                 /* Set static WEP keys again */
2288                 wpa_set_wep_keys(wpa_s, ssid);
2289         }
2290
2291         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2292                 /*
2293                  * Do not allow EAP session resumption between different
2294                  * network configurations.
2295                  */
2296                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2297         }
2298         old_ssid = wpa_s->current_ssid;
2299         wpa_s->current_ssid = ssid;
2300         wpa_s->current_bss = bss;
2301         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2302         wpa_supplicant_initiate_eapol(wpa_s);
2303         if (old_ssid != wpa_s->current_ssid)
2304                 wpas_notify_network_changed(wpa_s);
2305 }
2306
2307
2308 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2309                                             const u8 *addr)
2310 {
2311         struct wpa_ssid *old_ssid;
2312
2313         wpas_connect_work_done(wpa_s);
2314         wpa_clear_keys(wpa_s, addr);
2315         old_ssid = wpa_s->current_ssid;
2316         wpa_supplicant_mark_disassoc(wpa_s);
2317         wpa_sm_set_config(wpa_s->wpa, NULL);
2318         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2319         if (old_ssid != wpa_s->current_ssid)
2320                 wpas_notify_network_changed(wpa_s);
2321         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2322 }
2323
2324
2325 /**
2326  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2327  * @wpa_s: Pointer to wpa_supplicant data
2328  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2329  *
2330  * This function is used to request %wpa_supplicant to deauthenticate from the
2331  * current AP.
2332  */
2333 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2334                                    int reason_code)
2335 {
2336         u8 *addr = NULL;
2337         union wpa_event_data event;
2338         int zero_addr = 0;
2339
2340         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2341                 " pending_bssid=" MACSTR " reason=%d state=%s",
2342                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2343                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2344
2345         if (!is_zero_ether_addr(wpa_s->bssid))
2346                 addr = wpa_s->bssid;
2347         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2348                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2349                   wpa_s->wpa_state == WPA_ASSOCIATING))
2350                 addr = wpa_s->pending_bssid;
2351         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2352                 /*
2353                  * When using driver-based BSS selection, we may not know the
2354                  * BSSID with which we are currently trying to associate. We
2355                  * need to notify the driver of this disconnection even in such
2356                  * a case, so use the all zeros address here.
2357                  */
2358                 addr = wpa_s->bssid;
2359                 zero_addr = 1;
2360         }
2361
2362 #ifdef CONFIG_TDLS
2363         wpa_tdls_teardown_peers(wpa_s->wpa);
2364 #endif /* CONFIG_TDLS */
2365
2366 #ifdef CONFIG_MESH
2367         if (wpa_s->ifmsh) {
2368                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2369                              wpa_s->ifname);
2370                 wpa_supplicant_leave_mesh(wpa_s);
2371         }
2372 #endif /* CONFIG_MESH */
2373
2374         if (addr) {
2375                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2376                 os_memset(&event, 0, sizeof(event));
2377                 event.deauth_info.reason_code = (u16) reason_code;
2378                 event.deauth_info.locally_generated = 1;
2379                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2380                 if (zero_addr)
2381                         addr = NULL;
2382         }
2383
2384         wpa_supplicant_clear_connection(wpa_s, addr);
2385 }
2386
2387 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2388                                               struct wpa_ssid *ssid)
2389 {
2390         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2391                 return;
2392
2393         ssid->disabled = 0;
2394         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2395         wpas_notify_network_enabled_changed(wpa_s, ssid);
2396
2397         /*
2398          * Try to reassociate since there is no current configuration and a new
2399          * network was made available.
2400          */
2401         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2402                 wpa_s->reassociate = 1;
2403 }
2404
2405
2406 /**
2407  * wpa_supplicant_enable_network - Mark a configured network as enabled
2408  * @wpa_s: wpa_supplicant structure for a network interface
2409  * @ssid: wpa_ssid structure for a configured network or %NULL
2410  *
2411  * Enables the specified network or all networks if no network specified.
2412  */
2413 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2414                                    struct wpa_ssid *ssid)
2415 {
2416         if (ssid == NULL) {
2417                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2418                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2419         } else
2420                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2421
2422         if (wpa_s->reassociate && !wpa_s->disconnected) {
2423                 if (wpa_s->sched_scanning) {
2424                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2425                                    "new network to scan filters");
2426                         wpa_supplicant_cancel_sched_scan(wpa_s);
2427                 }
2428
2429                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2430                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2431         }
2432 }
2433
2434
2435 /**
2436  * wpa_supplicant_disable_network - Mark a configured network as disabled
2437  * @wpa_s: wpa_supplicant structure for a network interface
2438  * @ssid: wpa_ssid structure for a configured network or %NULL
2439  *
2440  * Disables the specified network or all networks if no network specified.
2441  */
2442 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2443                                     struct wpa_ssid *ssid)
2444 {
2445         struct wpa_ssid *other_ssid;
2446         int was_disabled;
2447
2448         if (ssid == NULL) {
2449                 if (wpa_s->sched_scanning)
2450                         wpa_supplicant_cancel_sched_scan(wpa_s);
2451
2452                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2453                      other_ssid = other_ssid->next) {
2454                         was_disabled = other_ssid->disabled;
2455                         if (was_disabled == 2)
2456                                 continue; /* do not change persistent P2P group
2457                                            * data */
2458
2459                         other_ssid->disabled = 1;
2460
2461                         if (was_disabled != other_ssid->disabled)
2462                                 wpas_notify_network_enabled_changed(
2463                                         wpa_s, other_ssid);
2464                 }
2465                 if (wpa_s->current_ssid)
2466                         wpa_supplicant_deauthenticate(
2467                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2468         } else if (ssid->disabled != 2) {
2469                 if (ssid == wpa_s->current_ssid)
2470                         wpa_supplicant_deauthenticate(
2471                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2472
2473                 was_disabled = ssid->disabled;
2474
2475                 ssid->disabled = 1;
2476
2477                 if (was_disabled != ssid->disabled) {
2478                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2479                         if (wpa_s->sched_scanning) {
2480                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2481                                            "to remove network from filters");
2482                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2483                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2484                         }
2485                 }
2486         }
2487 }
2488
2489
2490 /**
2491  * wpa_supplicant_select_network - Attempt association with a network
2492  * @wpa_s: wpa_supplicant structure for a network interface
2493  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2494  */
2495 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2496                                    struct wpa_ssid *ssid)
2497 {
2498
2499         struct wpa_ssid *other_ssid;
2500         int disconnected = 0;
2501
2502         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2503                 wpa_supplicant_deauthenticate(
2504                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2505                 disconnected = 1;
2506         }
2507
2508         if (ssid)
2509                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2510
2511         /*
2512          * Mark all other networks disabled or mark all networks enabled if no
2513          * network specified.
2514          */
2515         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2516              other_ssid = other_ssid->next) {
2517                 int was_disabled = other_ssid->disabled;
2518                 if (was_disabled == 2)
2519                         continue; /* do not change persistent P2P group data */
2520
2521                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2522                 if (was_disabled && !other_ssid->disabled)
2523                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2524
2525                 if (was_disabled != other_ssid->disabled)
2526                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2527         }
2528
2529         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2530                 /* We are already associated with the selected network */
2531                 wpa_printf(MSG_DEBUG, "Already associated with the "
2532                            "selected network - do nothing");
2533                 return;
2534         }
2535
2536         if (ssid) {
2537                 wpa_s->current_ssid = ssid;
2538                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2539                 wpa_s->connect_without_scan =
2540                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2541         } else {
2542                 wpa_s->connect_without_scan = NULL;
2543         }
2544
2545         wpa_s->disconnected = 0;
2546         wpa_s->reassociate = 1;
2547
2548         if (wpa_s->connect_without_scan ||
2549             wpa_supplicant_fast_associate(wpa_s) != 1)
2550                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2551
2552         if (ssid)
2553                 wpas_notify_network_selected(wpa_s, ssid);
2554 }
2555
2556
2557 /**
2558  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2559  * @wpa_s: wpa_supplicant structure for a network interface
2560  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2561  * @pkcs11_module_path: PKCS #11 module path or NULL
2562  * Returns: 0 on success; -1 on failure
2563  *
2564  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2565  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2566  * module path fails the paths will be reset to the default value (NULL).
2567  */
2568 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2569                                            const char *pkcs11_engine_path,
2570                                            const char *pkcs11_module_path)
2571 {
2572         char *pkcs11_engine_path_copy = NULL;
2573         char *pkcs11_module_path_copy = NULL;
2574
2575         if (pkcs11_engine_path != NULL) {
2576                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2577                 if (pkcs11_engine_path_copy == NULL)
2578                         return -1;
2579         }
2580         if (pkcs11_module_path != NULL) {
2581                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2582                 if (pkcs11_module_path_copy == NULL) {
2583                         os_free(pkcs11_engine_path_copy);
2584                         return -1;
2585                 }
2586         }
2587
2588         os_free(wpa_s->conf->pkcs11_engine_path);
2589         os_free(wpa_s->conf->pkcs11_module_path);
2590         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2591         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2592
2593         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2594         eapol_sm_deinit(wpa_s->eapol);
2595         wpa_s->eapol = NULL;
2596         if (wpa_supplicant_init_eapol(wpa_s)) {
2597                 /* Error -> Reset paths to the default value (NULL) once. */
2598                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2599                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2600                                                                NULL);
2601
2602                 return -1;
2603         }
2604         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2605
2606         return 0;
2607 }
2608
2609
2610 /**
2611  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2612  * @wpa_s: wpa_supplicant structure for a network interface
2613  * @ap_scan: AP scan mode
2614  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2615  *
2616  */
2617 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2618 {
2619
2620         int old_ap_scan;
2621
2622         if (ap_scan < 0 || ap_scan > 2)
2623                 return -1;
2624
2625 #ifdef ANDROID
2626         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2627             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2628             wpa_s->wpa_state < WPA_COMPLETED) {
2629                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2630                            "associating", wpa_s->conf->ap_scan, ap_scan);
2631                 return 0;
2632         }
2633 #endif /* ANDROID */
2634
2635         old_ap_scan = wpa_s->conf->ap_scan;
2636         wpa_s->conf->ap_scan = ap_scan;
2637
2638         if (old_ap_scan != wpa_s->conf->ap_scan)
2639                 wpas_notify_ap_scan_changed(wpa_s);
2640
2641         return 0;
2642 }
2643
2644
2645 /**
2646  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2647  * @wpa_s: wpa_supplicant structure for a network interface
2648  * @expire_age: Expiration age in seconds
2649  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2650  *
2651  */
2652 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2653                                           unsigned int bss_expire_age)
2654 {
2655         if (bss_expire_age < 10) {
2656                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2657                         bss_expire_age);
2658                 return -1;
2659         }
2660         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2661                 bss_expire_age);
2662         wpa_s->conf->bss_expiration_age = bss_expire_age;
2663
2664         return 0;
2665 }
2666
2667
2668 /**
2669  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2670  * @wpa_s: wpa_supplicant structure for a network interface
2671  * @expire_count: number of scans after which an unseen BSS is reclaimed
2672  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2673  *
2674  */
2675 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2676                                             unsigned int bss_expire_count)
2677 {
2678         if (bss_expire_count < 1) {
2679                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2680                         bss_expire_count);
2681                 return -1;
2682         }
2683         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2684                 bss_expire_count);
2685         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2686
2687         return 0;
2688 }
2689
2690
2691 /**
2692  * wpa_supplicant_set_scan_interval - Set scan interval
2693  * @wpa_s: wpa_supplicant structure for a network interface
2694  * @scan_interval: scan interval in seconds
2695  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2696  *
2697  */
2698 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2699                                      int scan_interval)
2700 {
2701         if (scan_interval < 0) {
2702                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2703                         scan_interval);
2704                 return -1;
2705         }
2706         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2707                 scan_interval);
2708         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2709
2710         return 0;
2711 }
2712
2713
2714 /**
2715  * wpa_supplicant_set_debug_params - Set global debug params
2716  * @global: wpa_global structure
2717  * @debug_level: debug level
2718  * @debug_timestamp: determines if show timestamp in debug data
2719  * @debug_show_keys: determines if show keys in debug data
2720  * Returns: 0 if succeed or -1 if debug_level has wrong value
2721  */
2722 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2723                                     int debug_timestamp, int debug_show_keys)
2724 {
2725
2726         int old_level, old_timestamp, old_show_keys;
2727
2728         /* check for allowed debuglevels */
2729         if (debug_level != MSG_EXCESSIVE &&
2730             debug_level != MSG_MSGDUMP &&
2731             debug_level != MSG_DEBUG &&
2732             debug_level != MSG_INFO &&
2733             debug_level != MSG_WARNING &&
2734             debug_level != MSG_ERROR)
2735                 return -1;
2736
2737         old_level = wpa_debug_level;
2738         old_timestamp = wpa_debug_timestamp;
2739         old_show_keys = wpa_debug_show_keys;
2740
2741         wpa_debug_level = debug_level;
2742         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2743         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2744
2745         if (wpa_debug_level != old_level)
2746                 wpas_notify_debug_level_changed(global);
2747         if (wpa_debug_timestamp != old_timestamp)
2748                 wpas_notify_debug_timestamp_changed(global);
2749         if (wpa_debug_show_keys != old_show_keys)
2750                 wpas_notify_debug_show_keys_changed(global);
2751
2752         return 0;
2753 }
2754
2755
2756 /**
2757  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2758  * @wpa_s: Pointer to wpa_supplicant data
2759  * Returns: A pointer to the current network structure or %NULL on failure
2760  */
2761 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2762 {
2763         struct wpa_ssid *entry;
2764         u8 ssid[MAX_SSID_LEN];
2765         int res;
2766         size_t ssid_len;
2767         u8 bssid[ETH_ALEN];
2768         int wired;
2769
2770         res = wpa_drv_get_ssid(wpa_s, ssid);
2771         if (res < 0) {
2772                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2773                         "driver");
2774                 return NULL;
2775         }
2776         ssid_len = res;
2777
2778         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2779                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2780                         "driver");
2781                 return NULL;
2782         }
2783
2784         wired = wpa_s->conf->ap_scan == 0 &&
2785                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2786
2787         entry = wpa_s->conf->ssid;
2788         while (entry) {
2789                 if (!wpas_network_disabled(wpa_s, entry) &&
2790                     ((ssid_len == entry->ssid_len &&
2791                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2792                     (!entry->bssid_set ||
2793                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2794                         return entry;
2795 #ifdef CONFIG_WPS
2796                 if (!wpas_network_disabled(wpa_s, entry) &&
2797                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2798                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2799                     (!entry->bssid_set ||
2800                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2801                         return entry;
2802 #endif /* CONFIG_WPS */
2803
2804                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2805                     entry->ssid_len == 0 &&
2806                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2807                         return entry;
2808
2809                 entry = entry->next;
2810         }
2811
2812         return NULL;
2813 }
2814
2815
2816 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2817 {
2818         struct wpa_global *global = wpa_s->global;
2819
2820         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2821                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2822                 if (global->drv_priv[i] == NULL) {
2823                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2824                                    "'%s'", wpa_drivers[i]->name);
2825                         return -1;
2826                 }
2827         }
2828
2829         wpa_s->driver = wpa_drivers[i];
2830         wpa_s->global_drv_priv = global->drv_priv[i];
2831
2832         return 0;
2833 }
2834
2835
2836 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2837                                      const char *name)
2838 {
2839         int i;
2840         size_t len;
2841         const char *pos, *driver = name;
2842
2843         if (wpa_s == NULL)
2844                 return -1;
2845
2846         if (wpa_drivers[0] == NULL) {
2847                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2848                         "wpa_supplicant");
2849                 return -1;
2850         }
2851
2852         if (name == NULL) {
2853                 /* default to first driver in the list */
2854                 return select_driver(wpa_s, 0);
2855         }
2856
2857         do {
2858                 pos = os_strchr(driver, ',');
2859                 if (pos)
2860                         len = pos - driver;
2861                 else
2862                         len = os_strlen(driver);
2863
2864                 for (i = 0; wpa_drivers[i]; i++) {
2865                         if (os_strlen(wpa_drivers[i]->name) == len &&
2866                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2867                             0) {
2868                                 /* First driver that succeeds wins */
2869                                 if (select_driver(wpa_s, i) == 0)
2870                                         return 0;
2871                         }
2872                 }
2873
2874                 driver = pos + 1;
2875         } while (pos);
2876
2877         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2878         return -1;
2879 }
2880
2881
2882 /**
2883  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2884  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2885  *      with struct wpa_driver_ops::init()
2886  * @src_addr: Source address of the EAPOL frame
2887  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2888  * @len: Length of the EAPOL data
2889  *
2890  * This function is called for each received EAPOL frame. Most driver
2891  * interfaces rely on more generic OS mechanism for receiving frames through
2892  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2893  * take care of received EAPOL frames and deliver them to the core supplicant
2894  * code by calling this function.
2895  */
2896 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2897                              const u8 *buf, size_t len)
2898 {
2899         struct wpa_supplicant *wpa_s = ctx;
2900
2901         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2902         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2903
2904 #ifdef CONFIG_PEERKEY
2905         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
2906             wpa_s->current_ssid->peerkey &&
2907             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2908             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
2909                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
2910                 return;
2911         }
2912 #endif /* CONFIG_PEERKEY */
2913
2914         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
2915             (wpa_s->last_eapol_matches_bssid &&
2916 #ifdef CONFIG_AP
2917              !wpa_s->ap_iface &&
2918 #endif /* CONFIG_AP */
2919              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
2920                 /*
2921                  * There is possible race condition between receiving the
2922                  * association event and the EAPOL frame since they are coming
2923                  * through different paths from the driver. In order to avoid
2924                  * issues in trying to process the EAPOL frame before receiving
2925                  * association information, lets queue it for processing until
2926                  * the association event is received. This may also be needed in
2927                  * driver-based roaming case, so also use src_addr != BSSID as a
2928                  * trigger if we have previously confirmed that the
2929                  * Authenticator uses BSSID as the src_addr (which is not the
2930                  * case with wired IEEE 802.1X).
2931                  */
2932                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
2933                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
2934                         wpa_supplicant_state_txt(wpa_s->wpa_state),
2935                         MAC2STR(wpa_s->bssid));
2936                 wpabuf_free(wpa_s->pending_eapol_rx);
2937                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
2938                 if (wpa_s->pending_eapol_rx) {
2939                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
2940                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
2941                                   ETH_ALEN);
2942                 }
2943                 return;
2944         }
2945
2946         wpa_s->last_eapol_matches_bssid =
2947                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
2948
2949 #ifdef CONFIG_AP
2950         if (wpa_s->ap_iface) {
2951                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
2952                 return;
2953         }
2954 #endif /* CONFIG_AP */
2955
2956         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2957                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
2958                         "no key management is configured");
2959                 return;
2960         }
2961
2962         if (wpa_s->eapol_received == 0 &&
2963             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
2964              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
2965              wpa_s->wpa_state != WPA_COMPLETED) &&
2966             (wpa_s->current_ssid == NULL ||
2967              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
2968                 /* Timeout for completing IEEE 802.1X and WPA authentication */
2969                 wpa_supplicant_req_auth_timeout(
2970                         wpa_s,
2971                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2972                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
2973                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
2974                         70 : 10, 0);
2975         }
2976         wpa_s->eapol_received++;
2977
2978         if (wpa_s->countermeasures) {
2979                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
2980                         "EAPOL packet");
2981                 return;
2982         }
2983
2984 #ifdef CONFIG_IBSS_RSN
2985         if (wpa_s->current_ssid &&
2986             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
2987                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
2988                 return;
2989         }
2990 #endif /* CONFIG_IBSS_RSN */
2991
2992         /* Source address of the incoming EAPOL frame could be compared to the
2993          * current BSSID. However, it is possible that a centralized
2994          * Authenticator could be using another MAC address than the BSSID of
2995          * an AP, so just allow any address to be used for now. The replies are
2996          * still sent to the current BSSID (if available), though. */
2997
2998         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
2999         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3000             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3001                 return;
3002         wpa_drv_poll(wpa_s);
3003         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3004                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3005         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3006                 /*
3007                  * Set portValid = TRUE here since we are going to skip 4-way
3008                  * handshake processing which would normally set portValid. We
3009                  * need this to allow the EAPOL state machines to be completed
3010                  * without going through EAPOL-Key handshake.
3011                  */
3012                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3013         }
3014 }
3015
3016
3017 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3018 {
3019         if ((!wpa_s->p2p_mgmt ||
3020              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3021             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3022                 l2_packet_deinit(wpa_s->l2);
3023                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3024                                            wpa_drv_get_mac_addr(wpa_s),
3025                                            ETH_P_EAPOL,
3026                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3027                 if (wpa_s->l2 == NULL)
3028                         return -1;
3029         } else {
3030                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3031                 if (addr)
3032                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3033         }
3034
3035         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3036                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3037                 return -1;
3038         }
3039
3040         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3041
3042         return 0;
3043 }
3044
3045
3046 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3047                                            const u8 *buf, size_t len)
3048 {
3049         struct wpa_supplicant *wpa_s = ctx;
3050         const struct l2_ethhdr *eth;
3051
3052         if (len < sizeof(*eth))
3053                 return;
3054         eth = (const struct l2_ethhdr *) buf;
3055
3056         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3057             !(eth->h_dest[0] & 0x01)) {
3058                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3059                         " (bridge - not for this interface - ignore)",
3060                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3061                 return;
3062         }
3063
3064         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3065                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3066         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3067                                 len - sizeof(*eth));
3068 }
3069
3070
3071 /**
3072  * wpa_supplicant_driver_init - Initialize driver interface parameters
3073  * @wpa_s: Pointer to wpa_supplicant data
3074  * Returns: 0 on success, -1 on failure
3075  *
3076  * This function is called to initialize driver interface parameters.
3077  * wpa_drv_init() must have been called before this function to initialize the
3078  * driver interface.
3079  */
3080 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3081 {
3082         static int interface_count = 0;
3083
3084         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3085                 return -1;
3086
3087         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3088                 MAC2STR(wpa_s->own_addr));
3089         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3090         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3091
3092         if (wpa_s->bridge_ifname[0]) {
3093                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3094                         "interface '%s'", wpa_s->bridge_ifname);
3095                 wpa_s->l2_br = l2_packet_init(wpa_s->bridge_ifname,
3096                                               wpa_s->own_addr,
3097                                               ETH_P_EAPOL,
3098                                               wpa_supplicant_rx_eapol_bridge,
3099                                               wpa_s, 1);
3100                 if (wpa_s->l2_br == NULL) {
3101                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3102                                 "connection for the bridge interface '%s'",
3103                                 wpa_s->bridge_ifname);
3104                         return -1;
3105                 }
3106         }
3107
3108         wpa_clear_keys(wpa_s, NULL);
3109
3110         /* Make sure that TKIP countermeasures are not left enabled (could
3111          * happen if wpa_supplicant is killed during countermeasures. */
3112         wpa_drv_set_countermeasures(wpa_s, 0);
3113
3114         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3115         wpa_drv_flush_pmkid(wpa_s);
3116
3117         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3118         wpa_s->prev_scan_wildcard = 0;
3119
3120         if (wpa_supplicant_enabled_networks(wpa_s)) {
3121                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3122                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3123                         interface_count = 0;
3124                 }
3125 #ifndef ANDROID
3126                 if (!wpa_s->p2p_mgmt &&
3127                     wpa_supplicant_delayed_sched_scan(wpa_s,
3128                                                       interface_count % 3,
3129                                                       100000))
3130                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3131                                                 100000);
3132 #endif /* ANDROID */
3133                 interface_count++;
3134         } else
3135                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3136
3137         return 0;
3138 }
3139
3140
3141 static int wpa_supplicant_daemon(const char *pid_file)
3142 {
3143         wpa_printf(MSG_DEBUG, "Daemonize..");
3144         return os_daemonize(pid_file);
3145 }
3146
3147
3148 static struct wpa_supplicant * wpa_supplicant_alloc(void)
3149 {
3150         struct wpa_supplicant *wpa_s;
3151
3152         wpa_s = os_zalloc(sizeof(*wpa_s));
3153         if (wpa_s == NULL)
3154                 return NULL;
3155         wpa_s->scan_req = INITIAL_SCAN_REQ;
3156         wpa_s->scan_interval = 5;
3157         wpa_s->new_connection = 1;
3158         wpa_s->parent = wpa_s;
3159         wpa_s->sched_scanning = 0;
3160
3161         return wpa_s;
3162 }
3163
3164
3165 #ifdef CONFIG_HT_OVERRIDES
3166
3167 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3168                              struct ieee80211_ht_capabilities *htcaps,
3169                              struct ieee80211_ht_capabilities *htcaps_mask,
3170                              const char *ht_mcs)
3171 {
3172         /* parse ht_mcs into hex array */
3173         int i;
3174         const char *tmp = ht_mcs;
3175         char *end = NULL;
3176
3177         /* If ht_mcs is null, do not set anything */
3178         if (!ht_mcs)
3179                 return 0;
3180
3181         /* This is what we are setting in the kernel */
3182         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3183
3184         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3185
3186         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3187                 errno = 0;
3188                 long v = strtol(tmp, &end, 16);
3189                 if (errno == 0) {
3190                         wpa_msg(wpa_s, MSG_DEBUG,
3191                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3192                                 i, v, end, tmp);
3193                         if (end == tmp)
3194                                 break;
3195
3196                         htcaps->supported_mcs_set[i] = v;
3197                         tmp = end;
3198                 } else {
3199                         wpa_msg(wpa_s, MSG_ERROR,
3200                                 "Failed to parse ht-mcs: %s, error: %s\n",
3201                                 ht_mcs, strerror(errno));
3202                         return -1;
3203                 }
3204         }
3205
3206         /*
3207          * If we were able to parse any values, then set mask for the MCS set.
3208          */
3209         if (i) {
3210                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3211                           IEEE80211_HT_MCS_MASK_LEN - 1);
3212                 /* skip the 3 reserved bits */
3213                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3214                         0x1f;
3215         }
3216
3217         return 0;
3218 }
3219
3220
3221 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3222                                  struct ieee80211_ht_capabilities *htcaps,
3223                                  struct ieee80211_ht_capabilities *htcaps_mask,
3224                                  int disabled)
3225 {
3226         le16 msk;
3227
3228         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3229
3230         if (disabled == -1)
3231                 return 0;
3232
3233         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3234         htcaps_mask->ht_capabilities_info |= msk;
3235         if (disabled)
3236                 htcaps->ht_capabilities_info &= msk;
3237         else
3238                 htcaps->ht_capabilities_info |= msk;
3239
3240         return 0;
3241 }
3242
3243
3244 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3245                                 struct ieee80211_ht_capabilities *htcaps,
3246                                 struct ieee80211_ht_capabilities *htcaps_mask,
3247                                 int factor)
3248 {
3249         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3250
3251         if (factor == -1)
3252                 return 0;
3253
3254         if (factor < 0 || factor > 3) {
3255                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3256                         "Must be 0-3 or -1", factor);
3257                 return -EINVAL;
3258         }
3259
3260         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3261         htcaps->a_mpdu_params &= ~0x3;
3262         htcaps->a_mpdu_params |= factor & 0x3;
3263
3264         return 0;
3265 }
3266
3267
3268 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3269                                  struct ieee80211_ht_capabilities *htcaps,
3270                                  struct ieee80211_ht_capabilities *htcaps_mask,
3271                                  int density)
3272 {
3273         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3274
3275         if (density == -1)
3276                 return 0;
3277
3278         if (density < 0 || density > 7) {
3279                 wpa_msg(wpa_s, MSG_ERROR,
3280                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3281                         density);
3282                 return -EINVAL;
3283         }
3284
3285         htcaps_mask->a_mpdu_params |= 0x1C;
3286         htcaps->a_mpdu_params &= ~(0x1C);
3287         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3288
3289         return 0;
3290 }
3291
3292
3293 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3294                                 struct ieee80211_ht_capabilities *htcaps,
3295                                 struct ieee80211_ht_capabilities *htcaps_mask,
3296                                 int disabled)
3297 {
3298         /* Masking these out disables HT40 */
3299         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3300                                 HT_CAP_INFO_SHORT_GI40MHZ);
3301
3302         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3303
3304         if (disabled)
3305                 htcaps->ht_capabilities_info &= ~msk;
3306         else
3307                 htcaps->ht_capabilities_info |= msk;
3308
3309         htcaps_mask->ht_capabilities_info |= msk;
3310
3311         return 0;
3312 }
3313
3314
3315 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3316                                struct ieee80211_ht_capabilities *htcaps,
3317                                struct ieee80211_ht_capabilities *htcaps_mask,
3318                                int disabled)
3319 {
3320         /* Masking these out disables SGI */
3321         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3322                                 HT_CAP_INFO_SHORT_GI40MHZ);
3323
3324         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3325
3326         if (disabled)
3327                 htcaps->ht_capabilities_info &= ~msk;
3328         else
3329                 htcaps->ht_capabilities_info |= msk;
3330
3331         htcaps_mask->ht_capabilities_info |= msk;
3332
3333         return 0;
3334 }
3335
3336
3337 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3338                                struct ieee80211_ht_capabilities *htcaps,
3339                                struct ieee80211_ht_capabilities *htcaps_mask,
3340                                int disabled)
3341 {
3342         /* Masking these out disables LDPC */
3343         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3344
3345         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3346
3347         if (disabled)
3348                 htcaps->ht_capabilities_info &= ~msk;
3349         else
3350                 htcaps->ht_capabilities_info |= msk;
3351
3352         htcaps_mask->ht_capabilities_info |= msk;
3353
3354         return 0;
3355 }
3356
3357
3358 void wpa_supplicant_apply_ht_overrides(
3359         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3360         struct wpa_driver_associate_params *params)
3361 {
3362         struct ieee80211_ht_capabilities *htcaps;
3363         struct ieee80211_ht_capabilities *htcaps_mask;
3364
3365         if (!ssid)
3366                 return;
3367
3368         params->disable_ht = ssid->disable_ht;
3369         if (!params->htcaps || !params->htcaps_mask)
3370                 return;
3371
3372         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3373         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3374         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3375         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3376                               ssid->disable_max_amsdu);
3377         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3378         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3379         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3380         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3381         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3382
3383         if (ssid->ht40_intolerant) {
3384                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3385                 htcaps->ht_capabilities_info |= bit;
3386                 htcaps_mask->ht_capabilities_info |= bit;
3387         }
3388 }
3389
3390 #endif /* CONFIG_HT_OVERRIDES */
3391
3392
3393 #ifdef CONFIG_VHT_OVERRIDES
3394 void wpa_supplicant_apply_vht_overrides(
3395         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3396         struct wpa_driver_associate_params *params)
3397 {
3398         struct ieee80211_vht_capabilities *vhtcaps;
3399         struct ieee80211_vht_capabilities *vhtcaps_mask;
3400
3401         if (!ssid)
3402                 return;
3403
3404         params->disable_vht = ssid->disable_vht;
3405
3406         vhtcaps = (void *) params->vhtcaps;
3407         vhtcaps_mask = (void *) params->vhtcaps_mask;
3408
3409         if (!vhtcaps || !vhtcaps_mask)
3410                 return;
3411
3412         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3413         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3414
3415 #ifdef CONFIG_HT_OVERRIDES
3416         /* if max ampdu is <= 3, we have to make the HT cap the same */
3417         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3418                 int max_ampdu;
3419
3420                 max_ampdu = (ssid->vht_capa &
3421                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3422                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3423
3424                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3425                 wpa_set_ampdu_factor(wpa_s,
3426                                      (void *) params->htcaps,
3427                                      (void *) params->htcaps_mask,
3428                                      max_ampdu);
3429         }
3430 #endif /* CONFIG_HT_OVERRIDES */
3431
3432 #define OVERRIDE_MCS(i)                                                 \
3433         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3434                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3435                         3 << 2 * (i - 1);                               \
3436                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3437                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3438         }                                                               \
3439         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3440                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3441                         3 << 2 * (i - 1);                               \
3442                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3443                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3444         }
3445
3446         OVERRIDE_MCS(1);
3447         OVERRIDE_MCS(2);
3448         OVERRIDE_MCS(3);
3449         OVERRIDE_MCS(4);
3450         OVERRIDE_MCS(5);
3451         OVERRIDE_MCS(6);
3452         OVERRIDE_MCS(7);
3453         OVERRIDE_MCS(8);
3454 }
3455 #endif /* CONFIG_VHT_OVERRIDES */
3456
3457
3458 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3459 {
3460 #ifdef PCSC_FUNCS
3461         size_t len;
3462
3463         if (!wpa_s->conf->pcsc_reader)
3464                 return 0;
3465
3466         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3467         if (!wpa_s->scard)
3468                 return 1;
3469
3470         if (wpa_s->conf->pcsc_pin &&
3471             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3472                 scard_deinit(wpa_s->scard);
3473                 wpa_s->scard = NULL;
3474                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3475                 return -1;
3476         }
3477
3478         len = sizeof(wpa_s->imsi) - 1;
3479         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3480                 scard_deinit(wpa_s->scard);
3481                 wpa_s->scard = NULL;
3482                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3483                 return -1;
3484         }
3485         wpa_s->imsi[len] = '\0';
3486
3487         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3488
3489         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3490                    wpa_s->imsi, wpa_s->mnc_len);
3491
3492         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3493         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3494 #endif /* PCSC_FUNCS */
3495
3496         return 0;
3497 }
3498
3499
3500 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3501 {
3502         char *val, *pos;
3503
3504         ext_password_deinit(wpa_s->ext_pw);
3505         wpa_s->ext_pw = NULL;
3506         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3507
3508         if (!wpa_s->conf->ext_password_backend)
3509                 return 0;
3510
3511         val = os_strdup(wpa_s->conf->ext_password_backend);
3512         if (val == NULL)
3513                 return -1;
3514         pos = os_strchr(val, ':');
3515         if (pos)
3516                 *pos++ = '\0';
3517
3518         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3519
3520         wpa_s->ext_pw = ext_password_init(val, pos);
3521         os_free(val);
3522         if (wpa_s->ext_pw == NULL) {
3523                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3524                 return -1;
3525         }
3526         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3527
3528         return 0;
3529 }
3530
3531
3532 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3533                                     const struct wpa_driver_capa *capa)
3534 {
3535         struct wowlan_triggers *triggers;
3536         int ret = 0;
3537
3538         if (!wpa_s->conf->wowlan_triggers)
3539                 return 0;
3540
3541         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3542         if (triggers) {
3543                 ret = wpa_drv_wowlan(wpa_s, triggers);
3544                 os_free(triggers);
3545         }
3546         return ret;
3547 }
3548
3549
3550 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3551                                               const char *rn)
3552 {
3553         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3554         struct wpa_radio *radio;
3555
3556         while (rn && iface) {
3557                 radio = iface->radio;
3558                 if (radio && os_strcmp(rn, radio->name) == 0) {
3559                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3560                                    wpa_s->ifname, rn);
3561                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3562                         return radio;
3563                 }
3564
3565                 iface = iface->next;
3566         }
3567
3568         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3569                    wpa_s->ifname, rn ? rn : "N/A");
3570         radio = os_zalloc(sizeof(*radio));
3571         if (radio == NULL)
3572                 return NULL;
3573
3574         if (rn)
3575                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3576         dl_list_init(&radio->ifaces);
3577         dl_list_init(&radio->work);
3578         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3579
3580         return radio;
3581 }
3582
3583
3584 static void radio_work_free(struct wpa_radio_work *work)
3585 {
3586         if (work->wpa_s->scan_work == work) {
3587                 /* This should not really happen. */
3588                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3589                         work->type, work, work->started);
3590                 work->wpa_s->scan_work = NULL;
3591         }
3592
3593 #ifdef CONFIG_P2P
3594         if (work->wpa_s->p2p_scan_work == work) {
3595                 /* This should not really happen. */
3596                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3597                         work->type, work, work->started);
3598                 work->wpa_s->p2p_scan_work = NULL;
3599         }
3600 #endif /* CONFIG_P2P */
3601
3602         dl_list_del(&work->list);
3603         os_free(work);
3604 }
3605
3606
3607 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3608 {
3609         struct wpa_radio *radio = eloop_ctx;
3610         struct wpa_radio_work *work;
3611         struct os_reltime now, diff;
3612         struct wpa_supplicant *wpa_s;
3613
3614         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3615         if (work == NULL)
3616                 return;
3617
3618         if (work->started)
3619                 return; /* already started and still in progress */
3620
3621         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3622                               radio_list);
3623         if (wpa_s && wpa_s->radio->external_scan_running) {
3624                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3625                 return;
3626         }
3627
3628         os_get_reltime(&now);
3629         os_reltime_sub(&now, &work->time, &diff);
3630         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3631                 work->type, work, diff.sec, diff.usec);
3632         work->started = 1;
3633         work->time = now;
3634         work->cb(work, 0);
3635 }
3636
3637
3638 /*
3639  * This function removes both started and pending radio works running on
3640  * the provided interface's radio.
3641  * Prior to the removal of the radio work, its callback (cb) is called with
3642  * deinit set to be 1. Each work's callback is responsible for clearing its
3643  * internal data and restoring to a correct state.
3644  * @wpa_s: wpa_supplicant data
3645  * @type: type of works to be removed
3646  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3647  * this interface's works.
3648  */
3649 void radio_remove_works(struct wpa_supplicant *wpa_s,
3650                         const char *type, int remove_all)
3651 {
3652         struct wpa_radio_work *work, *tmp;
3653         struct wpa_radio *radio = wpa_s->radio;
3654
3655         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3656                               list) {
3657                 if (type && os_strcmp(type, work->type) != 0)
3658                         continue;
3659
3660                 /* skip other ifaces' works */
3661                 if (!remove_all && work->wpa_s != wpa_s)
3662                         continue;
3663
3664                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3665                         work->type, work, work->started ? " (started)" : "");
3666                 work->cb(work, 1);
3667                 radio_work_free(work);
3668         }
3669
3670         /* in case we removed the started work */
3671         radio_work_check_next(wpa_s);
3672 }
3673
3674
3675 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3676 {
3677         struct wpa_radio *radio = wpa_s->radio;
3678
3679         if (!radio)
3680                 return;
3681
3682         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3683                    wpa_s->ifname, radio->name);
3684         dl_list_del(&wpa_s->radio_list);
3685         radio_remove_works(wpa_s, NULL, 0);
3686         wpa_s->radio = NULL;
3687         if (!dl_list_empty(&radio->ifaces))
3688                 return; /* Interfaces remain for this radio */
3689
3690         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3691         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3692         os_free(radio);
3693 }
3694
3695
3696 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3697 {
3698         struct wpa_radio *radio = wpa_s->radio;
3699
3700         if (dl_list_empty(&radio->work))
3701                 return;
3702         if (wpa_s->ext_work_in_progress) {
3703                 wpa_printf(MSG_DEBUG,
3704                            "External radio work in progress - delay start of pending item");
3705                 return;
3706         }
3707         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3708         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3709 }
3710
3711
3712 /**
3713  * radio_add_work - Add a radio work item
3714  * @wpa_s: Pointer to wpa_supplicant data
3715  * @freq: Frequency of the offchannel operation in MHz or 0
3716  * @type: Unique identifier for each type of work
3717  * @next: Force as the next work to be executed
3718  * @cb: Callback function for indicating when radio is available
3719  * @ctx: Context pointer for the work (work->ctx in cb())
3720  * Returns: 0 on success, -1 on failure
3721  *
3722  * This function is used to request time for an operation that requires
3723  * exclusive radio control. Once the radio is available, the registered callback
3724  * function will be called. radio_work_done() must be called once the exclusive
3725  * radio operation has been completed, so that the radio is freed for other
3726  * operations. The special case of deinit=1 is used to free the context data
3727  * during interface removal. That does not allow the callback function to start
3728  * the radio operation, i.e., it must free any resources allocated for the radio
3729  * work and return.
3730  *
3731  * The @freq parameter can be used to indicate a single channel on which the
3732  * offchannel operation will occur. This may allow multiple radio work
3733  * operations to be performed in parallel if they apply for the same channel.
3734  * Setting this to 0 indicates that the work item may use multiple channels or
3735  * requires exclusive control of the radio.
3736  */
3737 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3738                    const char *type, int next,
3739                    void (*cb)(struct wpa_radio_work *work, int deinit),
3740                    void *ctx)
3741 {
3742         struct wpa_radio_work *work;
3743         int was_empty;
3744
3745         work = os_zalloc(sizeof(*work));
3746         if (work == NULL)
3747                 return -1;
3748         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3749         os_get_reltime(&work->time);
3750         work->freq = freq;
3751         work->type = type;
3752         work->wpa_s = wpa_s;
3753         work->cb = cb;
3754         work->ctx = ctx;
3755
3756         was_empty = dl_list_empty(&wpa_s->radio->work);
3757         if (next)
3758                 dl_list_add(&wpa_s->radio->work, &work->list);
3759         else
3760                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3761         if (was_empty) {
3762                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3763                 radio_work_check_next(wpa_s);
3764         }
3765
3766         return 0;
3767 }
3768
3769
3770 /**
3771  * radio_work_done - Indicate that a radio work item has been completed
3772  * @work: Completed work
3773  *
3774  * This function is called once the callback function registered with
3775  * radio_add_work() has completed its work.
3776  */
3777 void radio_work_done(struct wpa_radio_work *work)
3778 {
3779         struct wpa_supplicant *wpa_s = work->wpa_s;
3780         struct os_reltime now, diff;
3781         unsigned int started = work->started;
3782
3783         os_get_reltime(&now);
3784         os_reltime_sub(&now, &work->time, &diff);
3785         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3786                 work->type, work, started ? "done" : "canceled",
3787                 diff.sec, diff.usec);
3788         radio_work_free(work);
3789         if (started)
3790                 radio_work_check_next(wpa_s);
3791 }
3792
3793
3794 struct wpa_radio_work *
3795 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3796 {
3797         struct wpa_radio_work *work;
3798         struct wpa_radio *radio = wpa_s->radio;
3799
3800         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3801                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3802                         return work;
3803         }
3804
3805         return NULL;
3806 }
3807
3808
3809 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3810                             struct wpa_interface *iface)
3811 {
3812         const char *ifname, *driver, *rn;
3813
3814         driver = iface->driver;
3815 next_driver:
3816         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3817                 return -1;
3818
3819         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3820         if (wpa_s->drv_priv == NULL) {
3821                 const char *pos;
3822                 pos = driver ? os_strchr(driver, ',') : NULL;
3823                 if (pos) {
3824                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3825                                 "driver interface - try next driver wrapper");
3826                         driver = pos + 1;
3827                         goto next_driver;
3828                 }
3829                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3830                         "interface");
3831                 return -1;
3832         }
3833         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3834                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3835                         "driver_param '%s'", wpa_s->conf->driver_param);
3836                 return -1;
3837         }
3838
3839         ifname = wpa_drv_get_ifname(wpa_s);
3840         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3841                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3842                         "interface name with '%s'", ifname);
3843                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3844         }
3845
3846         rn = wpa_driver_get_radio_name(wpa_s);
3847         if (rn && rn[0] == '\0')
3848                 rn = NULL;
3849
3850         wpa_s->radio = radio_add_interface(wpa_s, rn);
3851         if (wpa_s->radio == NULL)
3852                 return -1;
3853
3854         return 0;
3855 }
3856
3857
3858 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3859                                      struct wpa_interface *iface)
3860 {
3861         struct wpa_driver_capa capa;
3862         int capa_res;
3863
3864         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3865                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3866                    iface->confname ? iface->confname : "N/A",
3867                    iface->driver ? iface->driver : "default",
3868                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3869                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3870
3871         if (iface->confname) {
3872 #ifdef CONFIG_BACKEND_FILE
3873                 wpa_s->confname = os_rel2abs_path(iface->confname);
3874                 if (wpa_s->confname == NULL) {
3875                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3876                                    "for configuration file '%s'.",
3877                                    iface->confname);
3878                         return -1;
3879                 }
3880                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3881                            iface->confname, wpa_s->confname);
3882 #else /* CONFIG_BACKEND_FILE */
3883                 wpa_s->confname = os_strdup(iface->confname);
3884 #endif /* CONFIG_BACKEND_FILE */
3885                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3886                 if (wpa_s->conf == NULL) {
3887                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3888                                    "configuration '%s'.", wpa_s->confname);
3889                         return -1;
3890                 }
3891                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3892                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3893
3894                 /*
3895                  * Override ctrl_interface and driver_param if set on command
3896                  * line.
3897                  */
3898                 if (iface->ctrl_interface) {
3899                         os_free(wpa_s->conf->ctrl_interface);
3900                         wpa_s->conf->ctrl_interface =
3901                                 os_strdup(iface->ctrl_interface);
3902                 }
3903
3904                 if (iface->driver_param) {
3905                         os_free(wpa_s->conf->driver_param);
3906                         wpa_s->conf->driver_param =
3907                                 os_strdup(iface->driver_param);
3908                 }
3909
3910                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
3911                         os_free(wpa_s->conf->ctrl_interface);
3912                         wpa_s->conf->ctrl_interface = NULL;
3913                 }
3914         } else
3915                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
3916                                                      iface->driver_param);
3917
3918         if (wpa_s->conf == NULL) {
3919                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
3920                 return -1;
3921         }
3922
3923         if (iface->ifname == NULL) {
3924                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
3925                 return -1;
3926         }
3927         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
3928                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
3929                            iface->ifname);
3930                 return -1;
3931         }
3932         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
3933
3934         if (iface->bridge_ifname) {
3935                 if (os_strlen(iface->bridge_ifname) >=
3936                     sizeof(wpa_s->bridge_ifname)) {
3937                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
3938                                    "name '%s'.", iface->bridge_ifname);
3939                         return -1;
3940                 }
3941                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
3942                            sizeof(wpa_s->bridge_ifname));
3943         }
3944
3945         /* RSNA Supplicant Key Management - INITIALIZE */
3946         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
3947         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
3948
3949         /* Initialize driver interface and register driver event handler before
3950          * L2 receive handler so that association events are processed before
3951          * EAPOL-Key packets if both become available for the same select()
3952          * call. */
3953         if (wpas_init_driver(wpa_s, iface) < 0)
3954                 return -1;
3955
3956         if (wpa_supplicant_init_wpa(wpa_s) < 0)
3957                 return -1;
3958
3959         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
3960                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
3961                           NULL);
3962         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
3963
3964         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
3965             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
3966                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
3967                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3968                         "dot11RSNAConfigPMKLifetime");
3969                 return -1;
3970         }
3971
3972         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
3973             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
3974                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
3975                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3976                         "dot11RSNAConfigPMKReauthThreshold");
3977                 return -1;
3978         }
3979
3980         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
3981             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
3982                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
3983                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3984                         "dot11RSNAConfigSATimeout");
3985                 return -1;
3986         }
3987
3988         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
3989                                                       &wpa_s->hw.num_modes,
3990                                                       &wpa_s->hw.flags);
3991
3992         capa_res = wpa_drv_get_capa(wpa_s, &capa);
3993         if (capa_res == 0) {
3994                 wpa_s->drv_capa_known = 1;
3995                 wpa_s->drv_flags = capa.flags;
3996                 wpa_s->drv_enc = capa.enc;
3997                 wpa_s->drv_smps_modes = capa.smps_modes;
3998                 wpa_s->drv_rrm_flags = capa.rrm_flags;
3999                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4000                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4001                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4002                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4003                 wpa_s->max_match_sets = capa.max_match_sets;
4004                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4005                 wpa_s->max_stations = capa.max_stations;
4006                 wpa_s->extended_capa = capa.extended_capa;
4007                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4008                 wpa_s->extended_capa_len = capa.extended_capa_len;
4009                 wpa_s->num_multichan_concurrent =
4010                         capa.num_multichan_concurrent;
4011                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4012
4013                 if (capa.mac_addr_rand_scan_supported)
4014                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4015                 if (wpa_s->sched_scan_supported &&
4016                     capa.mac_addr_rand_sched_scan_supported)
4017                         wpa_s->mac_addr_rand_supported |=
4018                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4019         }
4020         if (wpa_s->max_remain_on_chan == 0)
4021                 wpa_s->max_remain_on_chan = 1000;
4022
4023         /*
4024          * Only take p2p_mgmt parameters when P2P Device is supported.
4025          * Doing it here as it determines whether l2_packet_init() will be done
4026          * during wpa_supplicant_driver_init().
4027          */
4028         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4029                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4030         else
4031                 iface->p2p_mgmt = 1;
4032
4033         if (wpa_s->num_multichan_concurrent == 0)
4034                 wpa_s->num_multichan_concurrent = 1;
4035
4036         if (wpa_supplicant_driver_init(wpa_s) < 0)
4037                 return -1;
4038
4039 #ifdef CONFIG_TDLS
4040         if ((!iface->p2p_mgmt ||
4041              !(wpa_s->drv_flags &
4042                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4043             wpa_tdls_init(wpa_s->wpa))
4044                 return -1;
4045 #endif /* CONFIG_TDLS */
4046
4047         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4048             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4049                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4050                 return -1;
4051         }
4052
4053         if (wpas_wps_init(wpa_s))
4054                 return -1;
4055
4056         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4057                 return -1;
4058         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4059
4060         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4061         if (wpa_s->ctrl_iface == NULL) {
4062                 wpa_printf(MSG_ERROR,
4063                            "Failed to initialize control interface '%s'.\n"
4064                            "You may have another wpa_supplicant process "
4065                            "already running or the file was\n"
4066                            "left by an unclean termination of wpa_supplicant "
4067                            "in which case you will need\n"
4068                            "to manually remove this file before starting "
4069                            "wpa_supplicant again.\n",
4070                            wpa_s->conf->ctrl_interface);
4071                 return -1;
4072         }
4073
4074         wpa_s->gas = gas_query_init(wpa_s);
4075         if (wpa_s->gas == NULL) {
4076                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4077                 return -1;
4078         }
4079
4080         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4081                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4082                 return -1;
4083         }
4084
4085         if (wpa_bss_init(wpa_s) < 0)
4086                 return -1;
4087
4088         /*
4089          * Set Wake-on-WLAN triggers, if configured.
4090          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4091          * have effect anyway when the interface is down).
4092          */
4093         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4094                 return -1;
4095
4096 #ifdef CONFIG_EAP_PROXY
4097 {
4098         size_t len;
4099         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4100                                                      &len);
4101         if (wpa_s->mnc_len > 0) {
4102                 wpa_s->imsi[len] = '\0';
4103                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4104                            wpa_s->imsi, wpa_s->mnc_len);
4105         } else {
4106                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4107         }
4108 }
4109 #endif /* CONFIG_EAP_PROXY */
4110
4111         if (pcsc_reader_init(wpa_s) < 0)
4112                 return -1;
4113
4114         if (wpas_init_ext_pw(wpa_s) < 0)
4115                 return -1;
4116
4117         wpas_rrm_reset(wpa_s);
4118
4119         return 0;
4120 }
4121
4122
4123 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4124                                         int notify, int terminate)
4125 {
4126         struct wpa_global *global = wpa_s->global;
4127         struct wpa_supplicant *iface, *prev;
4128
4129         if (wpa_s == wpa_s->parent)
4130                 wpas_p2p_group_remove(wpa_s, "*");
4131
4132         iface = global->ifaces;
4133         while (iface) {
4134                 if (iface == wpa_s || iface->parent != wpa_s) {
4135                         iface = iface->next;
4136                         continue;
4137                 }
4138                 wpa_printf(MSG_DEBUG,
4139                            "Remove remaining child interface %s from parent %s",
4140                            iface->ifname, wpa_s->ifname);
4141                 prev = iface;
4142                 iface = iface->next;
4143                 wpa_supplicant_remove_iface(global, prev, terminate);
4144         }
4145
4146         wpa_s->disconnected = 1;
4147         if (wpa_s->drv_priv) {
4148                 wpa_supplicant_deauthenticate(wpa_s,
4149                                               WLAN_REASON_DEAUTH_LEAVING);
4150
4151                 wpa_drv_set_countermeasures(wpa_s, 0);
4152                 wpa_clear_keys(wpa_s, NULL);
4153         }
4154
4155         wpa_supplicant_cleanup(wpa_s);
4156         wpas_p2p_deinit_iface(wpa_s);
4157
4158         wpas_ctrl_radio_work_flush(wpa_s);
4159         radio_remove_interface(wpa_s);
4160
4161         if (wpa_s->drv_priv)
4162                 wpa_drv_deinit(wpa_s);
4163
4164         if (notify)
4165                 wpas_notify_iface_removed(wpa_s);
4166
4167         if (terminate)
4168                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4169
4170         if (wpa_s->ctrl_iface) {
4171                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4172                 wpa_s->ctrl_iface = NULL;
4173         }
4174
4175 #ifdef CONFIG_MESH
4176         if (wpa_s->ifmsh) {
4177                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4178                 wpa_s->ifmsh = NULL;
4179         }
4180 #endif /* CONFIG_MESH */
4181
4182         if (wpa_s->conf != NULL) {
4183                 wpa_config_free(wpa_s->conf);
4184                 wpa_s->conf = NULL;
4185         }
4186
4187         os_free(wpa_s);
4188 }
4189
4190
4191 /**
4192  * wpa_supplicant_add_iface - Add a new network interface
4193  * @global: Pointer to global data from wpa_supplicant_init()
4194  * @iface: Interface configuration options
4195  * Returns: Pointer to the created interface or %NULL on failure
4196  *
4197  * This function is used to add new network interfaces for %wpa_supplicant.
4198  * This can be called before wpa_supplicant_run() to add interfaces before the
4199  * main event loop has been started. In addition, new interfaces can be added
4200  * dynamically while %wpa_supplicant is already running. This could happen,
4201  * e.g., when a hotplug network adapter is inserted.
4202  */
4203 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4204                                                  struct wpa_interface *iface)
4205 {
4206         struct wpa_supplicant *wpa_s;
4207         struct wpa_interface t_iface;
4208         struct wpa_ssid *ssid;
4209
4210         if (global == NULL || iface == NULL)
4211                 return NULL;
4212
4213         wpa_s = wpa_supplicant_alloc();
4214         if (wpa_s == NULL)
4215                 return NULL;
4216
4217         wpa_s->global = global;
4218
4219         t_iface = *iface;
4220         if (global->params.override_driver) {
4221                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4222                            "('%s' -> '%s')",
4223                            iface->driver, global->params.override_driver);
4224                 t_iface.driver = global->params.override_driver;
4225         }
4226         if (global->params.override_ctrl_interface) {
4227                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4228                            "ctrl_interface ('%s' -> '%s')",
4229                            iface->ctrl_interface,
4230                            global->params.override_ctrl_interface);
4231                 t_iface.ctrl_interface =
4232                         global->params.override_ctrl_interface;
4233         }
4234         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4235                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4236                            iface->ifname);
4237                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4238                 return NULL;
4239         }
4240
4241         if (iface->p2p_mgmt == 0) {
4242                 /* Notify the control interfaces about new iface */
4243                 if (wpas_notify_iface_added(wpa_s)) {
4244                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4245                         return NULL;
4246                 }
4247
4248                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4249                         wpas_notify_network_added(wpa_s, ssid);
4250         }
4251
4252         wpa_s->next = global->ifaces;
4253         global->ifaces = wpa_s;
4254
4255         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4256         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4257
4258 #ifdef CONFIG_P2P
4259         if (wpa_s->global->p2p == NULL &&
4260             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4261             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4262                 wpa_printf(MSG_INFO,
4263                            "P2P: Failed to enable P2P Device interface");
4264                 /* Try to continue without. P2P will be disabled. */
4265         }
4266 #endif /* CONFIG_P2P */
4267
4268         return wpa_s;
4269 }
4270
4271
4272 /**
4273  * wpa_supplicant_remove_iface - Remove a network interface
4274  * @global: Pointer to global data from wpa_supplicant_init()
4275  * @wpa_s: Pointer to the network interface to be removed
4276  * Returns: 0 if interface was removed, -1 if interface was not found
4277  *
4278  * This function can be used to dynamically remove network interfaces from
4279  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4280  * addition, this function is used to remove all remaining interfaces when
4281  * %wpa_supplicant is terminated.
4282  */
4283 int wpa_supplicant_remove_iface(struct wpa_global *global,
4284                                 struct wpa_supplicant *wpa_s,
4285                                 int terminate)
4286 {
4287         struct wpa_supplicant *prev;
4288 #ifdef CONFIG_MESH
4289         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4290         char *ifname = NULL;
4291 #endif /* CONFIG_MESH */
4292
4293         /* Remove interface from the global list of interfaces */
4294         prev = global->ifaces;
4295         if (prev == wpa_s) {
4296                 global->ifaces = wpa_s->next;
4297         } else {
4298                 while (prev && prev->next != wpa_s)
4299                         prev = prev->next;
4300                 if (prev == NULL)
4301                         return -1;
4302                 prev->next = wpa_s->next;
4303         }
4304
4305         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4306
4307 #ifdef CONFIG_MESH
4308         if (mesh_if_created) {
4309                 ifname = os_strdup(wpa_s->ifname);
4310                 if (ifname == NULL) {
4311                         wpa_dbg(wpa_s, MSG_ERROR,
4312                                 "mesh: Failed to malloc ifname");
4313                         return -1;
4314                 }
4315         }
4316 #endif /* CONFIG_MESH */
4317
4318         if (global->p2p_group_formation == wpa_s)
4319                 global->p2p_group_formation = NULL;
4320         if (global->p2p_invite_group == wpa_s)
4321                 global->p2p_invite_group = NULL;
4322         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4323
4324 #ifdef CONFIG_MESH
4325         if (mesh_if_created) {
4326                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4327                 os_free(ifname);
4328         }
4329 #endif /* CONFIG_MESH */
4330
4331         return 0;
4332 }
4333
4334
4335 /**
4336  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4337  * @wpa_s: Pointer to the network interface
4338  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4339  */
4340 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4341 {
4342         const char *eapol_method;
4343
4344         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4345             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4346                 return "NO-EAP";
4347         }
4348
4349         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4350         if (eapol_method == NULL)
4351                 return "UNKNOWN-EAP";
4352
4353         return eapol_method;
4354 }
4355
4356
4357 /**
4358  * wpa_supplicant_get_iface - Get a new network interface
4359  * @global: Pointer to global data from wpa_supplicant_init()
4360  * @ifname: Interface name
4361  * Returns: Pointer to the interface or %NULL if not found
4362  */
4363 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4364                                                  const char *ifname)
4365 {
4366         struct wpa_supplicant *wpa_s;
4367
4368         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4369                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4370                         return wpa_s;
4371         }
4372         return NULL;
4373 }
4374
4375
4376 #ifndef CONFIG_NO_WPA_MSG
4377 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4378 {
4379         struct wpa_supplicant *wpa_s = ctx;
4380         if (wpa_s == NULL)
4381                 return NULL;
4382         return wpa_s->ifname;
4383 }
4384 #endif /* CONFIG_NO_WPA_MSG */
4385
4386
4387 /**
4388  * wpa_supplicant_init - Initialize %wpa_supplicant
4389  * @params: Parameters for %wpa_supplicant
4390  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4391  *
4392  * This function is used to initialize %wpa_supplicant. After successful
4393  * initialization, the returned data pointer can be used to add and remove
4394  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4395  */
4396 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4397 {
4398         struct wpa_global *global;
4399         int ret, i;
4400
4401         if (params == NULL)
4402                 return NULL;
4403
4404 #ifdef CONFIG_DRIVER_NDIS
4405         {
4406                 void driver_ndis_init_ops(void);
4407                 driver_ndis_init_ops();
4408         }
4409 #endif /* CONFIG_DRIVER_NDIS */
4410
4411 #ifndef CONFIG_NO_WPA_MSG
4412         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4413 #endif /* CONFIG_NO_WPA_MSG */
4414
4415         if (params->wpa_debug_file_path)
4416                 wpa_debug_open_file(params->wpa_debug_file_path);
4417         else
4418                 wpa_debug_setup_stdout();
4419         if (params->wpa_debug_syslog)
4420                 wpa_debug_open_syslog();
4421         if (params->wpa_debug_tracing) {
4422                 ret = wpa_debug_open_linux_tracing();
4423                 if (ret) {
4424                         wpa_printf(MSG_ERROR,
4425                                    "Failed to enable trace logging");
4426                         return NULL;
4427                 }
4428         }
4429
4430         ret = eap_register_methods();
4431         if (ret) {
4432                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4433                 if (ret == -2)
4434                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4435                                    "the same EAP type.");
4436                 return NULL;
4437         }
4438
4439         global = os_zalloc(sizeof(*global));
4440         if (global == NULL)
4441                 return NULL;
4442         dl_list_init(&global->p2p_srv_bonjour);
4443         dl_list_init(&global->p2p_srv_upnp);
4444         global->params.daemonize = params->daemonize;
4445         global->params.wait_for_monitor = params->wait_for_monitor;
4446         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4447         if (params->pid_file)
4448                 global->params.pid_file = os_strdup(params->pid_file);
4449         if (params->ctrl_interface)
4450                 global->params.ctrl_interface =
4451                         os_strdup(params->ctrl_interface);
4452         if (params->ctrl_interface_group)
4453                 global->params.ctrl_interface_group =
4454                         os_strdup(params->ctrl_interface_group);
4455         if (params->override_driver)
4456                 global->params.override_driver =
4457                         os_strdup(params->override_driver);
4458         if (params->override_ctrl_interface)
4459                 global->params.override_ctrl_interface =
4460                         os_strdup(params->override_ctrl_interface);
4461         wpa_debug_level = global->params.wpa_debug_level =
4462                 params->wpa_debug_level;
4463         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4464                 params->wpa_debug_show_keys;
4465         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4466                 params->wpa_debug_timestamp;
4467
4468         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4469
4470         if (eloop_init()) {
4471                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4472                 wpa_supplicant_deinit(global);
4473                 return NULL;
4474         }
4475
4476         random_init(params->entropy_file);
4477
4478         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4479         if (global->ctrl_iface == NULL) {
4480                 wpa_supplicant_deinit(global);
4481                 return NULL;
4482         }
4483
4484         if (wpas_notify_supplicant_initialized(global)) {
4485                 wpa_supplicant_deinit(global);
4486                 return NULL;
4487         }
4488
4489         for (i = 0; wpa_drivers[i]; i++)
4490                 global->drv_count++;
4491         if (global->drv_count == 0) {
4492                 wpa_printf(MSG_ERROR, "No drivers enabled");
4493                 wpa_supplicant_deinit(global);
4494                 return NULL;
4495         }
4496         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4497         if (global->drv_priv == NULL) {
4498                 wpa_supplicant_deinit(global);
4499                 return NULL;
4500         }
4501
4502 #ifdef CONFIG_WIFI_DISPLAY
4503         if (wifi_display_init(global) < 0) {
4504                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4505                 wpa_supplicant_deinit(global);
4506                 return NULL;
4507         }
4508 #endif /* CONFIG_WIFI_DISPLAY */
4509
4510         return global;
4511 }
4512
4513
4514 /**
4515  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4516  * @global: Pointer to global data from wpa_supplicant_init()
4517  * Returns: 0 after successful event loop run, -1 on failure
4518  *
4519  * This function starts the main event loop and continues running as long as
4520  * there are any remaining events. In most cases, this function is running as
4521  * long as the %wpa_supplicant process in still in use.
4522  */
4523 int wpa_supplicant_run(struct wpa_global *global)
4524 {
4525         struct wpa_supplicant *wpa_s;
4526
4527         if (global->params.daemonize &&
4528             wpa_supplicant_daemon(global->params.pid_file))
4529                 return -1;
4530
4531         if (global->params.wait_for_monitor) {
4532                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4533                         if (wpa_s->ctrl_iface)
4534                                 wpa_supplicant_ctrl_iface_wait(
4535                                         wpa_s->ctrl_iface);
4536         }
4537
4538         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4539         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4540
4541         eloop_run();
4542
4543         return 0;
4544 }
4545
4546
4547 /**
4548  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4549  * @global: Pointer to global data from wpa_supplicant_init()
4550  *
4551  * This function is called to deinitialize %wpa_supplicant and to free all
4552  * allocated resources. Remaining network interfaces will also be removed.
4553  */
4554 void wpa_supplicant_deinit(struct wpa_global *global)
4555 {
4556         int i;
4557
4558         if (global == NULL)
4559                 return;
4560
4561 #ifdef CONFIG_WIFI_DISPLAY
4562         wifi_display_deinit(global);
4563 #endif /* CONFIG_WIFI_DISPLAY */
4564
4565         while (global->ifaces)
4566                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4567
4568         if (global->ctrl_iface)
4569                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4570
4571         wpas_notify_supplicant_deinitialized(global);
4572
4573         eap_peer_unregister_methods();
4574 #ifdef CONFIG_AP
4575         eap_server_unregister_methods();
4576 #endif /* CONFIG_AP */
4577
4578         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4579                 if (!global->drv_priv[i])
4580                         continue;
4581                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4582         }
4583         os_free(global->drv_priv);
4584
4585         random_deinit();
4586
4587         eloop_destroy();
4588
4589         if (global->params.pid_file) {
4590                 os_daemonize_terminate(global->params.pid_file);
4591                 os_free(global->params.pid_file);
4592         }
4593         os_free(global->params.ctrl_interface);
4594         os_free(global->params.ctrl_interface_group);
4595         os_free(global->params.override_driver);
4596         os_free(global->params.override_ctrl_interface);
4597
4598         os_free(global->p2p_disallow_freq.range);
4599         os_free(global->p2p_go_avoid_freq.range);
4600         os_free(global->add_psk);
4601
4602         os_free(global);
4603         wpa_debug_close_syslog();
4604         wpa_debug_close_file();
4605         wpa_debug_close_linux_tracing();
4606 }
4607
4608
4609 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4610 {
4611         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4612             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4613                 char country[3];
4614                 country[0] = wpa_s->conf->country[0];
4615                 country[1] = wpa_s->conf->country[1];
4616                 country[2] = '\0';
4617                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4618                         wpa_printf(MSG_ERROR, "Failed to set country code "
4619                                    "'%s'", country);
4620                 }
4621         }
4622
4623         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4624                 wpas_init_ext_pw(wpa_s);
4625
4626 #ifdef CONFIG_WPS
4627         wpas_wps_update_config(wpa_s);
4628 #endif /* CONFIG_WPS */
4629         wpas_p2p_update_config(wpa_s);
4630         wpa_s->conf->changed_parameters = 0;
4631 }
4632
4633
4634 void add_freq(int *freqs, int *num_freqs, int freq)
4635 {
4636         int i;
4637
4638         for (i = 0; i < *num_freqs; i++) {
4639                 if (freqs[i] == freq)
4640                         return;
4641         }
4642
4643         freqs[*num_freqs] = freq;
4644         (*num_freqs)++;
4645 }
4646
4647
4648 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4649 {
4650         struct wpa_bss *bss, *cbss;
4651         const int max_freqs = 10;
4652         int *freqs;
4653         int num_freqs = 0;
4654
4655         freqs = os_calloc(max_freqs + 1, sizeof(int));
4656         if (freqs == NULL)
4657                 return NULL;
4658
4659         cbss = wpa_s->current_bss;
4660
4661         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4662                 if (bss == cbss)
4663                         continue;
4664                 if (bss->ssid_len == cbss->ssid_len &&
4665                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4666                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4667                         add_freq(freqs, &num_freqs, bss->freq);
4668                         if (num_freqs == max_freqs)
4669                                 break;
4670                 }
4671         }
4672
4673         if (num_freqs == 0) {
4674                 os_free(freqs);
4675                 freqs = NULL;
4676         }
4677
4678         return freqs;
4679 }
4680
4681
4682 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4683 {
4684         int timeout;
4685         int count;
4686         int *freqs = NULL;
4687
4688         wpas_connect_work_done(wpa_s);
4689
4690         /*
4691          * Remove possible authentication timeout since the connection failed.
4692          */
4693         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4694
4695         if (wpa_s->disconnected) {
4696                 /*
4697                  * There is no point in blacklisting the AP if this event is
4698                  * generated based on local request to disconnect.
4699                  */
4700                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4701                         "indication since interface has been put into "
4702                         "disconnected state");
4703                 return;
4704         }
4705
4706         /*
4707          * Add the failed BSSID into the blacklist and speed up next scan
4708          * attempt if there could be other APs that could accept association.
4709          * The current blacklist count indicates how many times we have tried
4710          * connecting to this AP and multiple attempts mean that other APs are
4711          * either not available or has already been tried, so that we can start
4712          * increasing the delay here to avoid constant scanning.
4713          */
4714         count = wpa_blacklist_add(wpa_s, bssid);
4715         if (count == 1 && wpa_s->current_bss) {
4716                 /*
4717                  * This BSS was not in the blacklist before. If there is
4718                  * another BSS available for the same ESS, we should try that
4719                  * next. Otherwise, we may as well try this one once more
4720                  * before allowing other, likely worse, ESSes to be considered.
4721                  */
4722                 freqs = get_bss_freqs_in_ess(wpa_s);
4723                 if (freqs) {
4724                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4725                                 "has been seen; try it next");
4726                         wpa_blacklist_add(wpa_s, bssid);
4727                         /*
4728                          * On the next scan, go through only the known channels
4729                          * used in this ESS based on previous scans to speed up
4730                          * common load balancing use case.
4731                          */
4732                         os_free(wpa_s->next_scan_freqs);
4733                         wpa_s->next_scan_freqs = freqs;
4734                 }
4735         }
4736
4737         /*
4738          * Add previous failure count in case the temporary blacklist was
4739          * cleared due to no other BSSes being available.
4740          */
4741         count += wpa_s->extra_blacklist_count;
4742
4743         if (count > 3 && wpa_s->current_ssid) {
4744                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4745                            "consider temporary network disabling");
4746                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4747         }
4748
4749         switch (count) {
4750         case 1:
4751                 timeout = 100;
4752                 break;
4753         case 2:
4754                 timeout = 500;
4755                 break;
4756         case 3:
4757                 timeout = 1000;
4758                 break;
4759         case 4:
4760                 timeout = 5000;
4761                 break;
4762         default:
4763                 timeout = 10000;
4764                 break;
4765         }
4766
4767         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4768                 "ms", count, timeout);
4769
4770         /*
4771          * TODO: if more than one possible AP is available in scan results,
4772          * could try the other ones before requesting a new scan.
4773          */
4774         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4775                                 1000 * (timeout % 1000));
4776 }
4777
4778
4779 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4780 {
4781         return wpa_s->conf->ap_scan == 2 ||
4782                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4783 }
4784
4785
4786 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4787 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4788                                               struct wpa_ssid *ssid,
4789                                               const char *field,
4790                                               const char *value)
4791 {
4792 #ifdef IEEE8021X_EAPOL
4793         struct eap_peer_config *eap = &ssid->eap;
4794
4795         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4796         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4797                               (const u8 *) value, os_strlen(value));
4798
4799         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4800         case WPA_CTRL_REQ_EAP_IDENTITY:
4801                 os_free(eap->identity);
4802                 eap->identity = (u8 *) os_strdup(value);
4803                 eap->identity_len = os_strlen(value);
4804                 eap->pending_req_identity = 0;
4805                 if (ssid == wpa_s->current_ssid)
4806                         wpa_s->reassociate = 1;
4807                 break;
4808         case WPA_CTRL_REQ_EAP_PASSWORD:
4809                 bin_clear_free(eap->password, eap->password_len);
4810                 eap->password = (u8 *) os_strdup(value);
4811                 eap->password_len = os_strlen(value);
4812                 eap->pending_req_password = 0;
4813                 if (ssid == wpa_s->current_ssid)
4814                         wpa_s->reassociate = 1;
4815                 break;
4816         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4817                 bin_clear_free(eap->new_password, eap->new_password_len);
4818                 eap->new_password = (u8 *) os_strdup(value);
4819                 eap->new_password_len = os_strlen(value);
4820                 eap->pending_req_new_password = 0;
4821                 if (ssid == wpa_s->current_ssid)
4822                         wpa_s->reassociate = 1;
4823                 break;
4824         case WPA_CTRL_REQ_EAP_PIN:
4825                 str_clear_free(eap->pin);
4826                 eap->pin = os_strdup(value);
4827                 eap->pending_req_pin = 0;
4828                 if (ssid == wpa_s->current_ssid)
4829                         wpa_s->reassociate = 1;
4830                 break;
4831         case WPA_CTRL_REQ_EAP_OTP:
4832                 bin_clear_free(eap->otp, eap->otp_len);
4833                 eap->otp = (u8 *) os_strdup(value);
4834                 eap->otp_len = os_strlen(value);
4835                 os_free(eap->pending_req_otp);
4836                 eap->pending_req_otp = NULL;
4837                 eap->pending_req_otp_len = 0;
4838                 break;
4839         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4840                 str_clear_free(eap->private_key_passwd);
4841                 eap->private_key_passwd = os_strdup(value);
4842                 eap->pending_req_passphrase = 0;
4843                 if (ssid == wpa_s->current_ssid)
4844                         wpa_s->reassociate = 1;
4845                 break;
4846         case WPA_CTRL_REQ_SIM:
4847                 str_clear_free(eap->external_sim_resp);
4848                 eap->external_sim_resp = os_strdup(value);
4849                 break;
4850         default:
4851                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4852                 return -1;
4853         }
4854
4855         return 0;
4856 #else /* IEEE8021X_EAPOL */
4857         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4858         return -1;
4859 #endif /* IEEE8021X_EAPOL */
4860 }
4861 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4862
4863
4864 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4865 {
4866         int i;
4867         unsigned int drv_enc;
4868
4869         if (ssid == NULL)
4870                 return 1;
4871
4872         if (ssid->disabled)
4873                 return 1;
4874
4875         if (wpa_s && wpa_s->drv_capa_known)
4876                 drv_enc = wpa_s->drv_enc;
4877         else
4878                 drv_enc = (unsigned int) -1;
4879
4880         for (i = 0; i < NUM_WEP_KEYS; i++) {
4881                 size_t len = ssid->wep_key_len[i];
4882                 if (len == 0)
4883                         continue;
4884                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
4885                         continue;
4886                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
4887                         continue;
4888                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
4889                         continue;
4890                 return 1; /* invalid WEP key */
4891         }
4892
4893         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
4894             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
4895                 return 1;
4896
4897         return 0;
4898 }
4899
4900
4901 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
4902 {
4903         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
4904                 return 1;
4905         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
4906                 return 0;
4907         return -1;
4908 }
4909
4910
4911 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
4912 {
4913         struct wpa_ssid *ssid = wpa_s->current_ssid;
4914         int dur;
4915         struct os_reltime now;
4916
4917         if (ssid == NULL) {
4918                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
4919                            "SSID block");
4920                 return;
4921         }
4922
4923         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
4924                 return;
4925
4926         ssid->auth_failures++;
4927
4928 #ifdef CONFIG_P2P
4929         if (ssid->p2p_group &&
4930             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
4931                 /*
4932                  * Skip the wait time since there is a short timeout on the
4933                  * connection to a P2P group.
4934                  */
4935                 return;
4936         }
4937 #endif /* CONFIG_P2P */
4938
4939         if (ssid->auth_failures > 50)
4940                 dur = 300;
4941         else if (ssid->auth_failures > 10)
4942                 dur = 120;
4943         else if (ssid->auth_failures > 5)
4944                 dur = 90;
4945         else if (ssid->auth_failures > 3)
4946                 dur = 60;
4947         else if (ssid->auth_failures > 2)
4948                 dur = 30;
4949         else if (ssid->auth_failures > 1)
4950                 dur = 20;
4951         else
4952                 dur = 10;
4953
4954         if (ssid->auth_failures > 1 &&
4955             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
4956                 dur += os_random() % (ssid->auth_failures * 10);
4957
4958         os_get_reltime(&now);
4959         if (now.sec + dur <= ssid->disabled_until.sec)
4960                 return;
4961
4962         ssid->disabled_until.sec = now.sec + dur;
4963
4964         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
4965                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
4966                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
4967                 ssid->auth_failures, dur, reason);
4968 }
4969
4970
4971 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
4972                               struct wpa_ssid *ssid, int clear_failures)
4973 {
4974         if (ssid == NULL)
4975                 return;
4976
4977         if (ssid->disabled_until.sec) {
4978                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
4979                         "id=%d ssid=\"%s\"",
4980                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
4981         }
4982         ssid->disabled_until.sec = 0;
4983         ssid->disabled_until.usec = 0;
4984         if (clear_failures)
4985                 ssid->auth_failures = 0;
4986 }
4987
4988
4989 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
4990 {
4991         size_t i;
4992
4993         if (wpa_s->disallow_aps_bssid == NULL)
4994                 return 0;
4995
4996         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
4997                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
4998                               bssid, ETH_ALEN) == 0)
4999                         return 1;
5000         }
5001
5002         return 0;
5003 }
5004
5005
5006 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5007                     size_t ssid_len)
5008 {
5009         size_t i;
5010
5011         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5012                 return 0;
5013
5014         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5015                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5016                 if (ssid_len == s->ssid_len &&
5017                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5018                         return 1;
5019         }
5020
5021         return 0;
5022 }
5023
5024
5025 /**
5026  * wpas_request_connection - Request a new connection
5027  * @wpa_s: Pointer to the network interface
5028  *
5029  * This function is used to request a new connection to be found. It will mark
5030  * the interface to allow reassociation and request a new scan to find a
5031  * suitable network to connect to.
5032  */
5033 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5034 {
5035         wpa_s->normal_scans = 0;
5036         wpa_s->scan_req = NORMAL_SCAN_REQ;
5037         wpa_supplicant_reinit_autoscan(wpa_s);
5038         wpa_s->extra_blacklist_count = 0;
5039         wpa_s->disconnected = 0;
5040         wpa_s->reassociate = 1;
5041
5042         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5043                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5044         else
5045                 wpa_s->reattach = 0;
5046 }
5047
5048
5049 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5050                     struct wpa_used_freq_data *freqs_data,
5051                     unsigned int len)
5052 {
5053         unsigned int i;
5054
5055         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5056                 len, title);
5057         for (i = 0; i < len; i++) {
5058                 struct wpa_used_freq_data *cur = &freqs_data[i];
5059                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5060                         i, cur->freq, cur->flags);
5061         }
5062 }
5063
5064
5065 /*
5066  * Find the operating frequencies of any of the virtual interfaces that
5067  * are using the same radio as the current interface, and in addition, get
5068  * information about the interface types that are using the frequency.
5069  */
5070 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5071                                 struct wpa_used_freq_data *freqs_data,
5072                                 unsigned int len)
5073 {
5074         struct wpa_supplicant *ifs;
5075         u8 bssid[ETH_ALEN];
5076         int freq;
5077         unsigned int idx = 0, i;
5078
5079         wpa_dbg(wpa_s, MSG_DEBUG,
5080                 "Determining shared radio frequencies (max len %u)", len);
5081         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5082
5083         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5084                          radio_list) {
5085                 if (idx == len)
5086                         break;
5087
5088                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5089                         continue;
5090
5091                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5092                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5093                         freq = ifs->current_ssid->frequency;
5094                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5095                         freq = ifs->assoc_freq;
5096                 else
5097                         continue;
5098
5099                 /* Hold only distinct freqs */
5100                 for (i = 0; i < idx; i++)
5101                         if (freqs_data[i].freq == freq)
5102                                 break;
5103
5104                 if (i == idx)
5105                         freqs_data[idx++].freq = freq;
5106
5107                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5108                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5109                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5110                                 WPA_FREQ_USED_BY_INFRA_STATION;
5111                 }
5112         }
5113
5114         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5115         return idx;
5116 }
5117
5118
5119 /*
5120  * Find the operating frequencies of any of the virtual interfaces that
5121  * are using the same radio as the current interface.
5122  */
5123 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5124                            int *freq_array, unsigned int len)
5125 {
5126         struct wpa_used_freq_data *freqs_data;
5127         int num, i;
5128
5129         os_memset(freq_array, 0, sizeof(int) * len);
5130
5131         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5132         if (!freqs_data)
5133                 return -1;
5134
5135         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5136         for (i = 0; i < num; i++)
5137                 freq_array[i] = freqs_data[i].freq;
5138
5139         os_free(freqs_data);
5140
5141         return num;
5142 }
5143
5144
5145 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5146 {
5147         struct rrm_data *rrm = data;
5148
5149         if (!rrm->notify_neighbor_rep) {
5150                 wpa_printf(MSG_ERROR,
5151                            "RRM: Unexpected neighbor report timeout");
5152                 return;
5153         }
5154
5155         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5156         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5157
5158         rrm->notify_neighbor_rep = NULL;
5159         rrm->neighbor_rep_cb_ctx = NULL;
5160 }
5161
5162
5163 /*
5164  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5165  * @wpa_s: Pointer to wpa_supplicant
5166  */
5167 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5168 {
5169         wpa_s->rrm.rrm_used = 0;
5170
5171         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5172                              NULL);
5173         if (wpa_s->rrm.notify_neighbor_rep)
5174                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5175         wpa_s->rrm.next_neighbor_rep_token = 1;
5176 }
5177
5178
5179 /*
5180  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5181  * @wpa_s: Pointer to wpa_supplicant
5182  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5183  * @report_len: Length of neighbor report buffer
5184  */
5185 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5186                                    const u8 *report, size_t report_len)
5187 {
5188         struct wpabuf *neighbor_rep;
5189
5190         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5191         if (report_len < 1)
5192                 return;
5193
5194         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5195                 wpa_printf(MSG_DEBUG,
5196                            "RRM: Discarding neighbor report with token %d (expected %d)",
5197                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5198                 return;
5199         }
5200
5201         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5202                              NULL);
5203
5204         if (!wpa_s->rrm.notify_neighbor_rep) {
5205                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5206                 return;
5207         }
5208
5209         /* skipping the first byte, which is only an id (dialog token) */
5210         neighbor_rep = wpabuf_alloc(report_len - 1);
5211         if (neighbor_rep == NULL)
5212                 return;
5213         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5214         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5215                    report[0]);
5216         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5217                                        neighbor_rep);
5218         wpa_s->rrm.notify_neighbor_rep = NULL;
5219         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5220 }
5221
5222
5223 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5224 /* Workaround different, undefined for Windows, error codes used here */
5225 #define ENOTCONN -1
5226 #define EOPNOTSUPP -1
5227 #define ECANCELED -1
5228 #endif
5229
5230 /**
5231  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5232  * @wpa_s: Pointer to wpa_supplicant
5233  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5234  *        is sent in the request.
5235  * @cb: Callback function to be called once the requested report arrives, or
5236  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5237  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5238  *      the requester's responsibility to free it.
5239  *      In the latter case NULL will be sent in 'neighbor_rep'.
5240  * @cb_ctx: Context value to send the callback function
5241  * Returns: 0 in case of success, negative error code otherwise
5242  *
5243  * In case there is a previous request which has not been answered yet, the
5244  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5245  * Request must contain a callback function.
5246  */
5247 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5248                                        const struct wpa_ssid *ssid,
5249                                        void (*cb)(void *ctx,
5250                                                   struct wpabuf *neighbor_rep),
5251                                        void *cb_ctx)
5252 {
5253         struct wpabuf *buf;
5254         const u8 *rrm_ie;
5255
5256         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5257                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5258                 return -ENOTCONN;
5259         }
5260
5261         if (!wpa_s->rrm.rrm_used) {
5262                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5263                 return -EOPNOTSUPP;
5264         }
5265
5266         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5267                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5268         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5269             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5270                 wpa_printf(MSG_DEBUG,
5271                            "RRM: No network support for Neighbor Report.");
5272                 return -EOPNOTSUPP;
5273         }
5274
5275         if (!cb) {
5276                 wpa_printf(MSG_DEBUG,
5277                            "RRM: Neighbor Report request must provide a callback.");
5278                 return -EINVAL;
5279         }
5280
5281         /* Refuse if there's a live request */
5282         if (wpa_s->rrm.notify_neighbor_rep) {
5283                 wpa_printf(MSG_DEBUG,
5284                            "RRM: Currently handling previous Neighbor Report.");
5285                 return -EBUSY;
5286         }
5287
5288         /* 3 = action category + action code + dialog token */
5289         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5290         if (buf == NULL) {
5291                 wpa_printf(MSG_DEBUG,
5292                            "RRM: Failed to allocate Neighbor Report Request");
5293                 return -ENOMEM;
5294         }
5295
5296         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5297                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5298                    wpa_s->rrm.next_neighbor_rep_token);
5299
5300         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5301         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5302         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5303         if (ssid) {
5304                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5305                 wpabuf_put_u8(buf, ssid->ssid_len);
5306                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5307         }
5308
5309         wpa_s->rrm.next_neighbor_rep_token++;
5310
5311         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5312                                 wpa_s->own_addr, wpa_s->bssid,
5313                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5314                 wpa_printf(MSG_DEBUG,
5315                            "RRM: Failed to send Neighbor Report Request");
5316                 wpabuf_free(buf);
5317                 return -ECANCELED;
5318         }
5319
5320         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5321         wpa_s->rrm.notify_neighbor_rep = cb;
5322         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5323                                wpas_rrm_neighbor_rep_timeout_handler,
5324                                &wpa_s->rrm, NULL);
5325
5326         wpabuf_free(buf);
5327         return 0;
5328 }
5329
5330
5331 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5332                                               const u8 *src,
5333                                               const u8 *frame, size_t len,
5334                                               int rssi)
5335 {
5336         struct wpabuf *buf;
5337         const struct rrm_link_measurement_request *req;
5338         struct rrm_link_measurement_report report;
5339
5340         if (wpa_s->wpa_state != WPA_COMPLETED) {
5341                 wpa_printf(MSG_INFO,
5342                            "RRM: Ignoring link measurement request. Not associated");
5343                 return;
5344         }
5345
5346         if (!wpa_s->rrm.rrm_used) {
5347                 wpa_printf(MSG_INFO,
5348                            "RRM: Ignoring link measurement request. Not RRM network");
5349                 return;
5350         }
5351
5352         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5353                 wpa_printf(MSG_INFO,
5354                            "RRM: Measurement report failed. TX power insertion not supported");
5355                 return;
5356         }
5357
5358         req = (const struct rrm_link_measurement_request *) frame;
5359         if (len < sizeof(*req)) {
5360                 wpa_printf(MSG_INFO,
5361                            "RRM: Link measurement report failed. Request too short");
5362                 return;
5363         }
5364
5365         os_memset(&report, 0, sizeof(report));
5366         report.tpc.eid = WLAN_EID_TPC_REPORT;
5367         report.tpc.len = 2;
5368         report.rsni = 255; /* 255 indicates that RSNI is not available */
5369         report.dialog_token = req->dialog_token;
5370
5371         /*
5372          * It's possible to estimate RCPI based on RSSI in dBm. This
5373          * calculation will not reflect the correct value for high rates,
5374          * but it's good enough for Action frames which are transmitted
5375          * with up to 24 Mbps rates.
5376          */
5377         if (!rssi)
5378                 report.rcpi = 255; /* not available */
5379         else if (rssi < -110)
5380                 report.rcpi = 0;
5381         else if (rssi > 0)
5382                 report.rcpi = 220;
5383         else
5384                 report.rcpi = (rssi + 110) * 2;
5385
5386         /* action_category + action_code */
5387         buf = wpabuf_alloc(2 + sizeof(report));
5388         if (buf == NULL) {
5389                 wpa_printf(MSG_ERROR,
5390                            "RRM: Link measurement report failed. Buffer allocation failed");
5391                 return;
5392         }
5393
5394         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5395         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5396         wpabuf_put_data(buf, &report, sizeof(report));
5397         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5398                     wpabuf_head(buf), wpabuf_len(buf));
5399
5400         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5401                                 wpa_s->own_addr, wpa_s->bssid,
5402                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5403                 wpa_printf(MSG_ERROR,
5404                            "RRM: Link measurement report failed. Send action failed");
5405         }
5406         wpabuf_free(buf);
5407 }