wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (is_zero_ether_addr(bssid))
 196                 bssid = wpa_s->pending_bssid;
 197         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 198                 MAC2STR(bssid));
 199         wpa_blacklist_add(wpa_s, bssid);
 200         wpa_sm_notify_disassoc(wpa_s->wpa);
 201         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 202         wpa_s->reassociate = 1;
 203
 204         /*
 205          * If we timed out, the AP or the local radio may be busy.
 206          * So, wait a second until scanning again.
 207          */
 208         wpa_supplicant_req_scan(wpa_s, 1, 0);
 209 }
 210
 211
 212 /**
 213  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 214  * @wpa_s: Pointer to wpa_supplicant data
 215  * @sec: Number of seconds after which to time out authentication
 216  * @usec: Number of microseconds after which to time out authentication
 217  *
 218  * This function is used to schedule a timeout for the current authentication
 219  * attempt.
 220  */
 221 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 222                                      int sec, int usec)
 223 {
 224         if (wpa_s->conf->ap_scan == 0 &&
 225             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 226                 return;
 227
 228         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 229                 "%d usec", sec, usec);
 230         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 231         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 232 }
 233
 234
 235 /**
 236  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 237  * @wpa_s: Pointer to wpa_supplicant data
 238  *
 239  * This function is used to cancel authentication timeout scheduled with
 240  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 241  * been completed.
 242  */
 243 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 244 {
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 246         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 247         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 248 }
 249
 250
 251 /**
 252  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 253  * @wpa_s: Pointer to wpa_supplicant data
 254  *
 255  * This function is used to configure EAPOL state machine based on the selected
 256  * authentication mode.
 257  */
 258 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 259 {
 260 #ifdef IEEE8021X_EAPOL
 261         struct eapol_config eapol_conf;
 262         struct wpa_ssid *ssid = wpa_s->current_ssid;
 263
 264 #ifdef CONFIG_IBSS_RSN
 265         if (ssid->mode == WPAS_MODE_IBSS &&
 266             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 267             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 268                 /*
 269                  * RSN IBSS authentication is per-STA and we can disable the
 270                  * per-BSSID EAPOL authentication.
 271                  */
 272                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 273                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 274                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 275                 return;
 276         }
 277 #endif /* CONFIG_IBSS_RSN */
 278
 279         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 280         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 281
 282         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 283             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 284                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 285         else
 286                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 287
 288         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 289         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 290                 eapol_conf.accept_802_1x_keys = 1;
 291                 eapol_conf.required_keys = 0;
 292                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 293                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 294                 }
 295                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 296                         eapol_conf.required_keys |=
 297                                 EAPOL_REQUIRE_KEY_BROADCAST;
 298                 }
 299
 300                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 301                         eapol_conf.required_keys = 0;
 302         }
 303         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 304         eapol_conf.workaround = ssid->eap_workaround;
 305         eapol_conf.eap_disabled =
 306                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 307                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 308                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 309         eapol_conf.external_sim = wpa_s->conf->external_sim;
 310
 311 #ifdef CONFIG_WPS
 312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 313                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 314                 if (wpa_s->current_bss) {
 315                         struct wpabuf *ie;
 316                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 317                                                          WPS_IE_VENDOR_TYPE);
 318                         if (ie) {
 319                                 if (wps_is_20(ie))
 320                                         eapol_conf.wps |=
 321                                                 EAPOL_PEER_IS_WPS20_AP;
 322                                 wpabuf_free(ie);
 323                         }
 324                 }
 325         }
 326 #endif /* CONFIG_WPS */
 327
 328         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 329
 330         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 331 #endif /* IEEE8021X_EAPOL */
 332 }
 333
 334
 335 /**
 336  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 337  * @wpa_s: Pointer to wpa_supplicant data
 338  * @ssid: Configuration data for the network
 339  *
 340  * This function is used to configure WPA state machine and related parameters
 341  * to a mode where WPA is not enabled. This is called as part of the
 342  * authentication configuration when the selected network does not use WPA.
 343  */
 344 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 345                                        struct wpa_ssid *ssid)
 346 {
 347         int i;
 348
 349         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 351         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 353         else
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 355         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 356         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 357         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 359         wpa_s->group_cipher = WPA_CIPHER_NONE;
 360         wpa_s->mgmt_group_cipher = 0;
 361
 362         for (i = 0; i < NUM_WEP_KEYS; i++) {
 363                 if (ssid->wep_key_len[i] > 5) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 366                         break;
 367                 } else if (ssid->wep_key_len[i] > 0) {
 368                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 369                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 370                         break;
 371                 }
 372         }
 373
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 377                          wpa_s->pairwise_cipher);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 379 #ifdef CONFIG_IEEE80211W
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 381                          wpa_s->mgmt_group_cipher);
 382 #endif /* CONFIG_IEEE80211W */
 383
 384         pmksa_cache_clear_current(wpa_s->wpa);
 385 }
 386
 387
 388 void free_hw_features(struct wpa_supplicant *wpa_s)
 389 {
 390         int i;
 391         if (wpa_s->hw.modes == NULL)
 392                 return;
 393
 394         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 395                 os_free(wpa_s->hw.modes[i].channels);
 396                 os_free(wpa_s->hw.modes[i].rates);
 397         }
 398
 399         os_free(wpa_s->hw.modes);
 400         wpa_s->hw.modes = NULL;
 401 }
 402
 403
 404 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 405 {
 406         struct wpa_bss_tmp_disallowed *bss, *prev;
 407
 408         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 409                               struct wpa_bss_tmp_disallowed, list) {
 410                 dl_list_del(&bss->list);
 411                 os_free(bss);
 412         }
 413 }
 414
 415
 416 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 417 {
 418         int i;
 419
 420         bgscan_deinit(wpa_s);
 421         autoscan_deinit(wpa_s);
 422         scard_deinit(wpa_s->scard);
 423         wpa_s->scard = NULL;
 424         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 425         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 426         l2_packet_deinit(wpa_s->l2);
 427         wpa_s->l2 = NULL;
 428         if (wpa_s->l2_br) {
 429                 l2_packet_deinit(wpa_s->l2_br);
 430                 wpa_s->l2_br = NULL;
 431         }
 432 #ifdef CONFIG_TESTING_OPTIONS
 433         l2_packet_deinit(wpa_s->l2_test);
 434         wpa_s->l2_test = NULL;
 435 #endif /* CONFIG_TESTING_OPTIONS */
 436
 437         if (wpa_s->conf != NULL) {
 438                 struct wpa_ssid *ssid;
 439                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 440                         wpas_notify_network_removed(wpa_s, ssid);
 441         }
 442
 443         os_free(wpa_s->confname);
 444         wpa_s->confname = NULL;
 445
 446         os_free(wpa_s->confanother);
 447         wpa_s->confanother = NULL;
 448
 449         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 450         eapol_sm_deinit(wpa_s->eapol);
 451         wpa_s->eapol = NULL;
 452
 453         rsn_preauth_deinit(wpa_s->wpa);
 454
 455 #ifdef CONFIG_TDLS
 456         wpa_tdls_deinit(wpa_s->wpa);
 457 #endif /* CONFIG_TDLS */
 458
 459         wmm_ac_clear_saved_tspecs(wpa_s);
 460         pmksa_candidate_free(wpa_s->wpa);
 461         wpa_sm_deinit(wpa_s->wpa);
 462         wpa_s->wpa = NULL;
 463         wpa_blacklist_clear(wpa_s);
 464
 465         wpa_bss_deinit(wpa_s);
 466
 467         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 468         wpa_supplicant_cancel_scan(wpa_s);
 469         wpa_supplicant_cancel_auth_timeout(wpa_s);
 470         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 471 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 472         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 473                              wpa_s, NULL);
 474 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 475
 476         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 477
 478         wpas_wps_deinit(wpa_s);
 479
 480         wpabuf_free(wpa_s->pending_eapol_rx);
 481         wpa_s->pending_eapol_rx = NULL;
 482
 483 #ifdef CONFIG_IBSS_RSN
 484         ibss_rsn_deinit(wpa_s->ibss_rsn);
 485         wpa_s->ibss_rsn = NULL;
 486 #endif /* CONFIG_IBSS_RSN */
 487
 488         sme_deinit(wpa_s);
 489
 490 #ifdef CONFIG_AP
 491         wpa_supplicant_ap_deinit(wpa_s);
 492 #endif /* CONFIG_AP */
 493
 494         wpas_p2p_deinit(wpa_s);
 495
 496 #ifdef CONFIG_OFFCHANNEL
 497         offchannel_deinit(wpa_s);
 498 #endif /* CONFIG_OFFCHANNEL */
 499
 500         wpa_supplicant_cancel_sched_scan(wpa_s);
 501
 502         os_free(wpa_s->next_scan_freqs);
 503         wpa_s->next_scan_freqs = NULL;
 504
 505         os_free(wpa_s->manual_scan_freqs);
 506         wpa_s->manual_scan_freqs = NULL;
 507
 508         os_free(wpa_s->manual_sched_scan_freqs);
 509         wpa_s->manual_sched_scan_freqs = NULL;
 510
 511         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 512
 513         /*
 514          * Need to remove any pending gas-query radio work before the
 515          * gas_query_deinit() call because gas_query::work has not yet been set
 516          * for works that have not been started. gas_query_free() will be unable
 517          * to cancel such pending radio works and once the pending gas-query
 518          * radio work eventually gets removed, the deinit notification call to
 519          * gas_query_start_cb() would result in dereferencing freed memory.
 520          */
 521         if (wpa_s->radio)
 522                 radio_remove_works(wpa_s, "gas-query", 0);
 523         gas_query_deinit(wpa_s->gas);
 524         wpa_s->gas = NULL;
 525
 526         free_hw_features(wpa_s);
 527
 528         ieee802_1x_dealloc_kay_sm(wpa_s);
 529
 530         os_free(wpa_s->bssid_filter);
 531         wpa_s->bssid_filter = NULL;
 532
 533         os_free(wpa_s->disallow_aps_bssid);
 534         wpa_s->disallow_aps_bssid = NULL;
 535         os_free(wpa_s->disallow_aps_ssid);
 536         wpa_s->disallow_aps_ssid = NULL;
 537
 538         wnm_bss_keep_alive_deinit(wpa_s);
 539 #ifdef CONFIG_WNM
 540         wnm_deallocate_memory(wpa_s);
 541 #endif /* CONFIG_WNM */
 542
 543         ext_password_deinit(wpa_s->ext_pw);
 544         wpa_s->ext_pw = NULL;
 545
 546         wpabuf_free(wpa_s->last_gas_resp);
 547         wpa_s->last_gas_resp = NULL;
 548         wpabuf_free(wpa_s->prev_gas_resp);
 549         wpa_s->prev_gas_resp = NULL;
 550
 551         os_free(wpa_s->last_scan_res);
 552         wpa_s->last_scan_res = NULL;
 553
 554 #ifdef CONFIG_HS20
 555         if (wpa_s->drv_priv)
 556                 wpa_drv_configure_frame_filters(wpa_s, 0);
 557         hs20_deinit(wpa_s);
 558 #endif /* CONFIG_HS20 */
 559
 560         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 561                 wpabuf_free(wpa_s->vendor_elem[i]);
 562                 wpa_s->vendor_elem[i] = NULL;
 563         }
 564
 565         wmm_ac_notify_disassoc(wpa_s);
 566
 567         wpa_s->sched_scan_plans_num = 0;
 568         os_free(wpa_s->sched_scan_plans);
 569         wpa_s->sched_scan_plans = NULL;
 570
 571 #ifdef CONFIG_MBO
 572         wpa_s->non_pref_chan_num = 0;
 573         os_free(wpa_s->non_pref_chan);
 574         wpa_s->non_pref_chan = NULL;
 575 #endif /* CONFIG_MBO */
 576
 577         free_bss_tmp_disallowed(wpa_s);
 578
 579         wpabuf_free(wpa_s->lci);
 580         wpa_s->lci = NULL;
 581 }
 582
 583
 584 /**
 585  * wpa_clear_keys - Clear keys configured for the driver
 586  * @wpa_s: Pointer to wpa_supplicant data
 587  * @addr: Previously used BSSID or %NULL if not available
 588  *
 589  * This function clears the encryption keys that has been previously configured
 590  * for the driver.
 591  */
 592 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 593 {
 594         int i, max;
 595
 596 #ifdef CONFIG_IEEE80211W
 597         max = 6;
 598 #else /* CONFIG_IEEE80211W */
 599         max = 4;
 600 #endif /* CONFIG_IEEE80211W */
 601
 602         /* MLME-DELETEKEYS.request */
 603         for (i = 0; i < max; i++) {
 604                 if (wpa_s->keys_cleared & BIT(i))
 605                         continue;
 606                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 607                                 NULL, 0);
 608         }
 609         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 610             !is_zero_ether_addr(addr)) {
 611                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 612                                 0);
 613                 /* MLME-SETPROTECTION.request(None) */
 614                 wpa_drv_mlme_setprotection(
 615                         wpa_s, addr,
 616                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 617                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 618         }
 619         wpa_s->keys_cleared = (u32) -1;
 620 }
 621
 622
 623 /**
 624  * wpa_supplicant_state_txt - Get the connection state name as a text string
 625  * @state: State (wpa_state; WPA_*)
 626  * Returns: The state name as a printable text string
 627  */
 628 const char * wpa_supplicant_state_txt(enum wpa_states state)
 629 {
 630         switch (state) {
 631         case WPA_DISCONNECTED:
 632                 return "DISCONNECTED";
 633         case WPA_INACTIVE:
 634                 return "INACTIVE";
 635         case WPA_INTERFACE_DISABLED:
 636                 return "INTERFACE_DISABLED";
 637         case WPA_SCANNING:
 638                 return "SCANNING";
 639         case WPA_AUTHENTICATING:
 640                 return "AUTHENTICATING";
 641         case WPA_ASSOCIATING:
 642                 return "ASSOCIATING";
 643         case WPA_ASSOCIATED:
 644                 return "ASSOCIATED";
 645         case WPA_4WAY_HANDSHAKE:
 646                 return "4WAY_HANDSHAKE";
 647         case WPA_GROUP_HANDSHAKE:
 648                 return "GROUP_HANDSHAKE";
 649         case WPA_COMPLETED:
 650                 return "COMPLETED";
 651         default:
 652                 return "UNKNOWN";
 653         }
 654 }
 655
 656
 657 #ifdef CONFIG_BGSCAN
 658
 659 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 660 {
 661         const char *name;
 662
 663         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 664                 name = wpa_s->current_ssid->bgscan;
 665         else
 666                 name = wpa_s->conf->bgscan;
 667         if (name == NULL || name[0] == '\0')
 668                 return;
 669         if (wpas_driver_bss_selection(wpa_s))
 670                 return;
 671         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 672                 return;
 673 #ifdef CONFIG_P2P
 674         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 675                 return;
 676 #endif /* CONFIG_P2P */
 677
 678         bgscan_deinit(wpa_s);
 679         if (wpa_s->current_ssid) {
 680                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 681                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 682                                 "bgscan");
 683                         /*
 684                          * Live without bgscan; it is only used as a roaming
 685                          * optimization, so the initial connection is not
 686                          * affected.
 687                          */
 688                 } else {
 689                         struct wpa_scan_results *scan_res;
 690                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 691                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 692                                                                    0);
 693                         if (scan_res) {
 694                                 bgscan_notify_scan(wpa_s, scan_res);
 695                                 wpa_scan_results_free(scan_res);
 696                         }
 697                 }
 698         } else
 699                 wpa_s->bgscan_ssid = NULL;
 700 }
 701
 702
 703 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 704 {
 705         if (wpa_s->bgscan_ssid != NULL) {
 706                 bgscan_deinit(wpa_s);
 707                 wpa_s->bgscan_ssid = NULL;
 708         }
 709 }
 710
 711 #endif /* CONFIG_BGSCAN */
 712
 713
 714 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 715 {
 716         if (autoscan_init(wpa_s, 0))
 717                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 718 }
 719
 720
 721 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 722 {
 723         autoscan_deinit(wpa_s);
 724 }
 725
 726
 727 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 728 {
 729         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 730             wpa_s->wpa_state == WPA_SCANNING) {
 731                 autoscan_deinit(wpa_s);
 732                 wpa_supplicant_start_autoscan(wpa_s);
 733         }
 734 }
 735
 736
 737 /**
 738  * wpa_supplicant_set_state - Set current connection state
 739  * @wpa_s: Pointer to wpa_supplicant data
 740  * @state: The new connection state
 741  *
 742  * This function is called whenever the connection state changes, e.g.,
 743  * association is completed for WPA/WPA2 4-Way Handshake is started.
 744  */
 745 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 746                               enum wpa_states state)
 747 {
 748         enum wpa_states old_state = wpa_s->wpa_state;
 749
 750         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 751                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 752                 wpa_supplicant_state_txt(state));
 753
 754         if (state == WPA_INTERFACE_DISABLED) {
 755                 /* Assure normal scan when interface is restored */
 756                 wpa_s->normal_scans = 0;
 757         }
 758
 759         if (state == WPA_COMPLETED) {
 760                 wpas_connect_work_done(wpa_s);
 761                 /* Reinitialize normal_scan counter */
 762                 wpa_s->normal_scans = 0;
 763         }
 764
 765 #ifdef CONFIG_P2P
 766         /*
 767          * P2PS client has to reply to Probe Request frames received on the
 768          * group operating channel. Enable Probe Request frame reporting for
 769          * P2P connected client in case p2p_cli_probe configuration property is
 770          * set to 1.
 771          */
 772         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 773             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 774             wpa_s->current_ssid->p2p_group) {
 775                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 776                         wpa_dbg(wpa_s, MSG_DEBUG,
 777                                 "P2P: Enable CLI Probe Request RX reporting");
 778                         wpa_s->p2p_cli_probe =
 779                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 780                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 781                         wpa_dbg(wpa_s, MSG_DEBUG,
 782                                 "P2P: Disable CLI Probe Request RX reporting");
 783                         wpa_s->p2p_cli_probe = 0;
 784                         wpa_drv_probe_req_report(wpa_s, 0);
 785                 }
 786         }
 787 #endif /* CONFIG_P2P */
 788
 789         if (state != WPA_SCANNING)
 790                 wpa_supplicant_notify_scanning(wpa_s, 0);
 791
 792         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 793                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 794 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 795                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 796                         MACSTR " completed [id=%d id_str=%s]",
 797                         MAC2STR(wpa_s->bssid),
 798                         ssid ? ssid->id : -1,
 799                         ssid && ssid->id_str ? ssid->id_str : "");
 800 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 801                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 802                 wpa_blacklist_clear(wpa_s);
 803                 wpa_s->extra_blacklist_count = 0;
 804                 wpa_s->new_connection = 0;
 805                 wpa_drv_set_operstate(wpa_s, 1);
 806 #ifndef IEEE8021X_EAPOL
 807                 wpa_drv_set_supp_port(wpa_s, 1);
 808 #endif /* IEEE8021X_EAPOL */
 809                 wpa_s->after_wps = 0;
 810                 wpa_s->known_wps_freq = 0;
 811                 wpas_p2p_completed(wpa_s);
 812
 813                 sme_sched_obss_scan(wpa_s, 1);
 814         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 815                    state == WPA_ASSOCIATED) {
 816                 wpa_s->new_connection = 1;
 817                 wpa_drv_set_operstate(wpa_s, 0);
 818 #ifndef IEEE8021X_EAPOL
 819                 wpa_drv_set_supp_port(wpa_s, 0);
 820 #endif /* IEEE8021X_EAPOL */
 821                 sme_sched_obss_scan(wpa_s, 0);
 822         }
 823         wpa_s->wpa_state = state;
 824
 825 #ifdef CONFIG_BGSCAN
 826         if (state == WPA_COMPLETED)
 827                 wpa_supplicant_start_bgscan(wpa_s);
 828         else if (state < WPA_ASSOCIATED)
 829                 wpa_supplicant_stop_bgscan(wpa_s);
 830 #endif /* CONFIG_BGSCAN */
 831
 832         if (state == WPA_AUTHENTICATING)
 833                 wpa_supplicant_stop_autoscan(wpa_s);
 834
 835         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 836                 wpa_supplicant_start_autoscan(wpa_s);
 837
 838         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 839                 wmm_ac_notify_disassoc(wpa_s);
 840
 841         if (wpa_s->wpa_state != old_state) {
 842                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 843
 844                 /*
 845                  * Notify the P2P Device interface about a state change in one
 846                  * of the interfaces.
 847                  */
 848                 wpas_p2p_indicate_state_change(wpa_s);
 849
 850                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 851                     old_state == WPA_COMPLETED)
 852                         wpas_notify_auth_changed(wpa_s);
 853         }
 854 }
 855
 856
 857 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 858 {
 859         int pending = 0;
 860 #ifdef CONFIG_WPS
 861         struct wpa_supplicant *wpa_s = global->ifaces;
 862         while (wpa_s) {
 863                 struct wpa_supplicant *next = wpa_s->next;
 864                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 865                         pending = 1;
 866 #ifdef CONFIG_P2P
 867                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 868                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 869                         wpas_p2p_disconnect(wpa_s);
 870 #endif /* CONFIG_P2P */
 871                 wpa_s = next;
 872         }
 873 #endif /* CONFIG_WPS */
 874         if (pending)
 875                 return;
 876         eloop_terminate();
 877 }
 878
 879
 880 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 881 {
 882         struct wpa_global *global = signal_ctx;
 883         wpa_supplicant_terminate_proc(global);
 884 }
 885
 886
 887 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 888 {
 889         enum wpa_states old_state = wpa_s->wpa_state;
 890
 891         wpa_s->pairwise_cipher = 0;
 892         wpa_s->group_cipher = 0;
 893         wpa_s->mgmt_group_cipher = 0;
 894         wpa_s->key_mgmt = 0;
 895         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 896                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 897
 898         if (wpa_s->wpa_state != old_state)
 899                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 900 }
 901
 902
 903 /**
 904  * wpa_supplicant_reload_configuration - Reload configuration data
 905  * @wpa_s: Pointer to wpa_supplicant data
 906  * Returns: 0 on success or -1 if configuration parsing failed
 907  *
 908  * This function can be used to request that the configuration data is reloaded
 909  * (e.g., after configuration file change). This function is reloading
 910  * configuration only for one interface, so this may need to be called multiple
 911  * times if %wpa_supplicant is controlling multiple interfaces and all
 912  * interfaces need reconfiguration.
 913  */
 914 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 915 {
 916         struct wpa_config *conf;
 917         int reconf_ctrl;
 918         int old_ap_scan;
 919
 920         if (wpa_s->confname == NULL)
 921                 return -1;
 922         conf = wpa_config_read(wpa_s->confname, NULL);
 923         if (conf == NULL) {
 924                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 925                         "file '%s' - exiting", wpa_s->confname);
 926                 return -1;
 927         }
 928         wpa_config_read(wpa_s->confanother, conf);
 929
 930         conf->changed_parameters = (unsigned int) -1;
 931
 932         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 933                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 934                     os_strcmp(conf->ctrl_interface,
 935                               wpa_s->conf->ctrl_interface) != 0);
 936
 937         if (reconf_ctrl && wpa_s->ctrl_iface) {
 938                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 939                 wpa_s->ctrl_iface = NULL;
 940         }
 941
 942         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 943         if (wpa_s->current_ssid) {
 944                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 945                         wpa_s->own_disconnect_req = 1;
 946                 wpa_supplicant_deauthenticate(wpa_s,
 947                                               WLAN_REASON_DEAUTH_LEAVING);
 948         }
 949
 950         /*
 951          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 952          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 953          */
 954         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 955                 /*
 956                  * Clear forced success to clear EAP state for next
 957                  * authentication.
 958                  */
 959                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 960         }
 961         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 962         wpa_sm_set_config(wpa_s->wpa, NULL);
 963         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 964         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 965         rsn_preauth_deinit(wpa_s->wpa);
 966
 967         old_ap_scan = wpa_s->conf->ap_scan;
 968         wpa_config_free(wpa_s->conf);
 969         wpa_s->conf = conf;
 970         if (old_ap_scan != wpa_s->conf->ap_scan)
 971                 wpas_notify_ap_scan_changed(wpa_s);
 972
 973         if (reconf_ctrl)
 974                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 975
 976         wpa_supplicant_update_config(wpa_s);
 977
 978         wpa_supplicant_clear_status(wpa_s);
 979         if (wpa_supplicant_enabled_networks(wpa_s)) {
 980                 wpa_s->reassociate = 1;
 981                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 982         }
 983         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 984         return 0;
 985 }
 986
 987
 988 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 989 {
 990         struct wpa_global *global = signal_ctx;
 991         struct wpa_supplicant *wpa_s;
 992         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 993                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 994                         sig);
 995                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 996                         wpa_supplicant_terminate_proc(global);
 997                 }
 998         }
 999
1000         if (wpa_debug_reopen_file() < 0) {
1001                 /* Ignore errors since we cannot really do much to fix this */
1002                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1003         }
1004 }
1005
1006
1007 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1008                                          struct wpa_ssid *ssid,
1009                                          struct wpa_ie_data *ie)
1010 {
1011         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1012         if (ret) {
1013                 if (ret == -2) {
1014                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1015                                 "from association info");
1016                 }
1017                 return -1;
1018         }
1019
1020         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1021                 "cipher suites");
1022         if (!(ie->group_cipher & ssid->group_cipher)) {
1023                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1024                         "cipher 0x%x (mask 0x%x) - reject",
1025                         ie->group_cipher, ssid->group_cipher);
1026                 return -1;
1027         }
1028         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1029                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1030                         "cipher 0x%x (mask 0x%x) - reject",
1031                         ie->pairwise_cipher, ssid->pairwise_cipher);
1032                 return -1;
1033         }
1034         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1036                         "management 0x%x (mask 0x%x) - reject",
1037                         ie->key_mgmt, ssid->key_mgmt);
1038                 return -1;
1039         }
1040
1041 #ifdef CONFIG_IEEE80211W
1042         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1043             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1044                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1045                         "that does not support management frame protection - "
1046                         "reject");
1047                 return -1;
1048         }
1049 #endif /* CONFIG_IEEE80211W */
1050
1051         return 0;
1052 }
1053
1054
1055 /**
1056  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1057  * @wpa_s: Pointer to wpa_supplicant data
1058  * @bss: Scan results for the selected BSS, or %NULL if not available
1059  * @ssid: Configuration data for the selected network
1060  * @wpa_ie: Buffer for the WPA/RSN IE
1061  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1062  * used buffer length in case the functions returns success.
1063  * Returns: 0 on success or -1 on failure
1064  *
1065  * This function is used to configure authentication and encryption parameters
1066  * based on the network configuration and scan result for the selected BSS (if
1067  * available).
1068  */
1069 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1070                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1071                               u8 *wpa_ie, size_t *wpa_ie_len)
1072 {
1073         struct wpa_ie_data ie;
1074         int sel, proto;
1075         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1076
1077         if (bss) {
1078                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1079                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1080                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1081         } else
1082                 bss_wpa = bss_rsn = bss_osen = NULL;
1083
1084         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1085             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1086             (ie.group_cipher & ssid->group_cipher) &&
1087             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1088             (ie.key_mgmt & ssid->key_mgmt)) {
1089                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1090                 proto = WPA_PROTO_RSN;
1091         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1092                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1093                    (ie.group_cipher & ssid->group_cipher) &&
1094                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1095                    (ie.key_mgmt & ssid->key_mgmt)) {
1096                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1097                 proto = WPA_PROTO_WPA;
1098 #ifdef CONFIG_HS20
1099         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1100                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1101                 /* TODO: parse OSEN element */
1102                 os_memset(&ie, 0, sizeof(ie));
1103                 ie.group_cipher = WPA_CIPHER_CCMP;
1104                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1105                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1106                 proto = WPA_PROTO_OSEN;
1107 #endif /* CONFIG_HS20 */
1108         } else if (bss) {
1109                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1110                 wpa_dbg(wpa_s, MSG_DEBUG,
1111                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1112                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1113                         ssid->key_mgmt);
1114                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1115                         MAC2STR(bss->bssid),
1116                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1117                         bss_wpa ? " WPA" : "",
1118                         bss_rsn ? " RSN" : "",
1119                         bss_osen ? " OSEN" : "");
1120                 if (bss_rsn) {
1121                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1122                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1123                                 wpa_dbg(wpa_s, MSG_DEBUG,
1124                                         "Could not parse RSN element");
1125                         } else {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1128                                         ie.pairwise_cipher, ie.group_cipher,
1129                                         ie.key_mgmt);
1130                         }
1131                 }
1132                 if (bss_wpa) {
1133                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1134                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1135                                 wpa_dbg(wpa_s, MSG_DEBUG,
1136                                         "Could not parse WPA element");
1137                         } else {
1138                                 wpa_dbg(wpa_s, MSG_DEBUG,
1139                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1140                                         ie.pairwise_cipher, ie.group_cipher,
1141                                         ie.key_mgmt);
1142                         }
1143                 }
1144                 return -1;
1145         } else {
1146                 if (ssid->proto & WPA_PROTO_OSEN)
1147                         proto = WPA_PROTO_OSEN;
1148                 else if (ssid->proto & WPA_PROTO_RSN)
1149                         proto = WPA_PROTO_RSN;
1150                 else
1151                         proto = WPA_PROTO_WPA;
1152                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1153                         os_memset(&ie, 0, sizeof(ie));
1154                         ie.group_cipher = ssid->group_cipher;
1155                         ie.pairwise_cipher = ssid->pairwise_cipher;
1156                         ie.key_mgmt = ssid->key_mgmt;
1157 #ifdef CONFIG_IEEE80211W
1158                         ie.mgmt_group_cipher =
1159                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1160                                 WPA_CIPHER_AES_128_CMAC : 0;
1161 #endif /* CONFIG_IEEE80211W */
1162                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1163                                 "based on configuration");
1164                 } else
1165                         proto = ie.proto;
1166         }
1167
1168         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1169                 "pairwise %d key_mgmt %d proto %d",
1170                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1171 #ifdef CONFIG_IEEE80211W
1172         if (ssid->ieee80211w) {
1173                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1174                         ie.mgmt_group_cipher);
1175         }
1176 #endif /* CONFIG_IEEE80211W */
1177
1178         wpa_s->wpa_proto = proto;
1179         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1180         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1181                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1182
1183         if (bss || !wpa_s->ap_ies_from_associnfo) {
1184                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1185                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1186                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1187                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1188                         return -1;
1189         }
1190
1191 #ifdef CONFIG_NO_WPA
1192         wpa_s->group_cipher = WPA_CIPHER_NONE;
1193         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1194 #else /* CONFIG_NO_WPA */
1195         sel = ie.group_cipher & ssid->group_cipher;
1196         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1197         if (wpa_s->group_cipher < 0) {
1198                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1199                         "cipher");
1200                 return -1;
1201         }
1202         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1203                 wpa_cipher_txt(wpa_s->group_cipher));
1204
1205         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1206         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1207         if (wpa_s->pairwise_cipher < 0) {
1208                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1209                         "cipher");
1210                 return -1;
1211         }
1212         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1213                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1214 #endif /* CONFIG_NO_WPA */
1215
1216         sel = ie.key_mgmt & ssid->key_mgmt;
1217 #ifdef CONFIG_SAE
1218         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1219                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1220 #endif /* CONFIG_SAE */
1221         if (0) {
1222 #ifdef CONFIG_SUITEB192
1223         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1225                 wpa_dbg(wpa_s, MSG_DEBUG,
1226                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1227 #endif /* CONFIG_SUITEB192 */
1228 #ifdef CONFIG_SUITEB
1229         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1231                 wpa_dbg(wpa_s, MSG_DEBUG,
1232                         "WPA: using KEY_MGMT 802.1X with Suite B");
1233 #endif /* CONFIG_SUITEB */
1234 #ifdef CONFIG_IEEE80211R
1235         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1236                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1237                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1238         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1239                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1240                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1241 #endif /* CONFIG_IEEE80211R */
1242 #ifdef CONFIG_SAE
1243         } else if (sel & WPA_KEY_MGMT_SAE) {
1244                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1245                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1246         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1248                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1249 #endif /* CONFIG_SAE */
1250 #ifdef CONFIG_IEEE80211W
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1253                 wpa_dbg(wpa_s, MSG_DEBUG,
1254                         "WPA: using KEY_MGMT 802.1X with SHA256");
1255         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1256                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1257                 wpa_dbg(wpa_s, MSG_DEBUG,
1258                         "WPA: using KEY_MGMT PSK with SHA256");
1259 #endif /* CONFIG_IEEE80211W */
1260         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1261                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1262                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1263         } else if (sel & WPA_KEY_MGMT_PSK) {
1264                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1266         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1267                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1268                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1269 #ifdef CONFIG_HS20
1270         } else if (sel & WPA_KEY_MGMT_OSEN) {
1271                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1272                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1273 #endif /* CONFIG_HS20 */
1274         } else {
1275                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1276                         "authenticated key management type");
1277                 return -1;
1278         }
1279
1280         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1282                          wpa_s->pairwise_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1284
1285 #ifdef CONFIG_IEEE80211W
1286         sel = ie.mgmt_group_cipher;
1287         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1288             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1289                 sel = 0;
1290         if (sel & WPA_CIPHER_AES_128_CMAC) {
1291                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1292                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1293                         "AES-128-CMAC");
1294         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1295                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1296                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1297                         "BIP-GMAC-128");
1298         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1299                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1300                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1301                         "BIP-GMAC-256");
1302         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1303                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1304                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1305                         "BIP-CMAC-256");
1306         } else {
1307                 wpa_s->mgmt_group_cipher = 0;
1308                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1309         }
1310         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1311                          wpa_s->mgmt_group_cipher);
1312         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1313                          wpas_get_ssid_pmf(wpa_s, ssid));
1314 #endif /* CONFIG_IEEE80211W */
1315
1316         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1317                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1318                 return -1;
1319         }
1320
1321         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1322                 int psk_set = 0;
1323
1324                 if (ssid->psk_set) {
1325                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1326                                        NULL);
1327                         psk_set = 1;
1328                 }
1329 #ifndef CONFIG_NO_PBKDF2
1330                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1331                     ssid->passphrase) {
1332                         u8 psk[PMK_LEN];
1333                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1334                                     4096, psk, PMK_LEN);
1335                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1336                                         psk, PMK_LEN);
1337                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1338                         psk_set = 1;
1339                         os_memset(psk, 0, sizeof(psk));
1340                 }
1341 #endif /* CONFIG_NO_PBKDF2 */
1342 #ifdef CONFIG_EXT_PASSWORD
1343                 if (ssid->ext_psk) {
1344                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1345                                                              ssid->ext_psk);
1346                         char pw_str[64 + 1];
1347                         u8 psk[PMK_LEN];
1348
1349                         if (pw == NULL) {
1350                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1351                                         "found from external storage");
1352                                 return -1;
1353                         }
1354
1355                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1356                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1357                                         "PSK length %d in external storage",
1358                                         (int) wpabuf_len(pw));
1359                                 ext_password_free(pw);
1360                                 return -1;
1361                         }
1362
1363                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1364                         pw_str[wpabuf_len(pw)] = '\0';
1365
1366 #ifndef CONFIG_NO_PBKDF2
1367                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1368                         {
1369                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1370                                             4096, psk, PMK_LEN);
1371                                 os_memset(pw_str, 0, sizeof(pw_str));
1372                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1373                                                 "external passphrase)",
1374                                                 psk, PMK_LEN);
1375                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1376                                                NULL);
1377                                 psk_set = 1;
1378                                 os_memset(psk, 0, sizeof(psk));
1379                         } else
1380 #endif /* CONFIG_NO_PBKDF2 */
1381                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1382                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1383                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1384                                                 "Invalid PSK hex string");
1385                                         os_memset(pw_str, 0, sizeof(pw_str));
1386                                         ext_password_free(pw);
1387                                         return -1;
1388                                 }
1389                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1390                                                NULL);
1391                                 psk_set = 1;
1392                                 os_memset(psk, 0, sizeof(psk));
1393                         } else {
1394                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1395                                         "PSK available");
1396                                 os_memset(pw_str, 0, sizeof(pw_str));
1397                                 ext_password_free(pw);
1398                                 return -1;
1399                         }
1400
1401                         os_memset(pw_str, 0, sizeof(pw_str));
1402                         ext_password_free(pw);
1403                 }
1404 #endif /* CONFIG_EXT_PASSWORD */
1405
1406                 if (!psk_set) {
1407                         wpa_msg(wpa_s, MSG_INFO,
1408                                 "No PSK available for association");
1409                         return -1;
1410                 }
1411         } else
1412                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1413
1414         return 0;
1415 }
1416
1417
1418 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1419 {
1420         *pos = 0x00;
1421
1422         switch (idx) {
1423         case 0: /* Bits 0-7 */
1424                 break;
1425         case 1: /* Bits 8-15 */
1426                 break;
1427         case 2: /* Bits 16-23 */
1428 #ifdef CONFIG_WNM
1429                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1430                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1431 #endif /* CONFIG_WNM */
1432                 break;
1433         case 3: /* Bits 24-31 */
1434 #ifdef CONFIG_WNM
1435                 *pos |= 0x02; /* Bit 25 - SSID List */
1436 #endif /* CONFIG_WNM */
1437 #ifdef CONFIG_INTERWORKING
1438                 if (wpa_s->conf->interworking)
1439                         *pos |= 0x80; /* Bit 31 - Interworking */
1440 #endif /* CONFIG_INTERWORKING */
1441                 break;
1442         case 4: /* Bits 32-39 */
1443 #ifdef CONFIG_INTERWORKING
1444                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1445                         *pos |= 0x01; /* Bit 32 - QoS Map */
1446 #endif /* CONFIG_INTERWORKING */
1447                 break;
1448         case 5: /* Bits 40-47 */
1449 #ifdef CONFIG_HS20
1450                 if (wpa_s->conf->hs20)
1451                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1452 #endif /* CONFIG_HS20 */
1453 #ifdef CONFIG_MBO
1454                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1455 #endif /* CONFIG_MBO */
1456                 break;
1457         case 6: /* Bits 48-55 */
1458                 break;
1459         }
1460 }
1461
1462
1463 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1464 {
1465         u8 *pos = buf;
1466         u8 len = 6, i;
1467
1468         if (len < wpa_s->extended_capa_len)
1469                 len = wpa_s->extended_capa_len;
1470         if (buflen < (size_t) len + 2) {
1471                 wpa_printf(MSG_INFO,
1472                            "Not enough room for building extended capabilities element");
1473                 return -1;
1474         }
1475
1476         *pos++ = WLAN_EID_EXT_CAPAB;
1477         *pos++ = len;
1478         for (i = 0; i < len; i++, pos++) {
1479                 wpas_ext_capab_byte(wpa_s, pos, i);
1480
1481                 if (i < wpa_s->extended_capa_len) {
1482                         *pos &= ~wpa_s->extended_capa_mask[i];
1483                         *pos |= wpa_s->extended_capa[i];
1484                 }
1485         }
1486
1487         while (len > 0 && buf[1 + len] == 0) {
1488                 len--;
1489                 buf[1] = len;
1490         }
1491         if (len == 0)
1492                 return 0;
1493
1494         return 2 + len;
1495 }
1496
1497
1498 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1499                           struct wpa_bss *test_bss)
1500 {
1501         struct wpa_bss *bss;
1502
1503         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1504                 if (bss == test_bss)
1505                         return 1;
1506         }
1507
1508         return 0;
1509 }
1510
1511
1512 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1513                            struct wpa_ssid *test_ssid)
1514 {
1515         struct wpa_ssid *ssid;
1516
1517         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1518                 if (ssid == test_ssid)
1519                         return 1;
1520         }
1521
1522         return 0;
1523 }
1524
1525
1526 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1527                         struct wpa_ssid *test_ssid)
1528 {
1529         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1530                 return 0;
1531
1532         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1533 }
1534
1535
1536 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1537 {
1538         if (cwork == NULL)
1539                 return;
1540         os_free(cwork);
1541 }
1542
1543
1544 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1545 {
1546         struct wpa_connect_work *cwork;
1547         struct wpa_radio_work *work = wpa_s->connect_work;
1548
1549         if (!work)
1550                 return;
1551
1552         wpa_s->connect_work = NULL;
1553         cwork = work->ctx;
1554         work->ctx = NULL;
1555         wpas_connect_work_free(cwork);
1556         radio_work_done(work);
1557 }
1558
1559
1560 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1561 {
1562         struct os_reltime now;
1563         u8 addr[ETH_ALEN];
1564
1565         os_get_reltime(&now);
1566         if (wpa_s->last_mac_addr_style == style &&
1567             wpa_s->last_mac_addr_change.sec != 0 &&
1568             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1569                                 wpa_s->conf->rand_addr_lifetime)) {
1570                 wpa_msg(wpa_s, MSG_DEBUG,
1571                         "Previously selected random MAC address has not yet expired");
1572                 return 0;
1573         }
1574
1575         switch (style) {
1576         case 1:
1577                 if (random_mac_addr(addr) < 0)
1578                         return -1;
1579                 break;
1580         case 2:
1581                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1582                 if (random_mac_addr_keep_oui(addr) < 0)
1583                         return -1;
1584                 break;
1585         default:
1586                 return -1;
1587         }
1588
1589         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1590                 wpa_msg(wpa_s, MSG_INFO,
1591                         "Failed to set random MAC address");
1592                 return -1;
1593         }
1594
1595         os_get_reltime(&wpa_s->last_mac_addr_change);
1596         wpa_s->mac_addr_changed = 1;
1597         wpa_s->last_mac_addr_style = style;
1598
1599         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1600                 wpa_msg(wpa_s, MSG_INFO,
1601                         "Could not update MAC address information");
1602                 return -1;
1603         }
1604
1605         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1606                 MAC2STR(addr));
1607
1608         return 0;
1609 }
1610
1611
1612 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1613 {
1614         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1615             !wpa_s->conf->preassoc_mac_addr)
1616                 return 0;
1617
1618         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1619 }
1620
1621
1622 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1623
1624 /**
1625  * wpa_supplicant_associate - Request association
1626  * @wpa_s: Pointer to wpa_supplicant data
1627  * @bss: Scan results for the selected BSS, or %NULL if not available
1628  * @ssid: Configuration data for the selected network
1629  *
1630  * This function is used to request %wpa_supplicant to associate with a BSS.
1631  */
1632 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1633                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1634 {
1635         struct wpa_connect_work *cwork;
1636         int rand_style;
1637
1638         wpa_s->own_disconnect_req = 0;
1639
1640         /*
1641          * If we are starting a new connection, any previously pending EAPOL
1642          * RX cannot be valid anymore.
1643          */
1644         wpabuf_free(wpa_s->pending_eapol_rx);
1645         wpa_s->pending_eapol_rx = NULL;
1646
1647         if (ssid->mac_addr == -1)
1648                 rand_style = wpa_s->conf->mac_addr;
1649         else
1650                 rand_style = ssid->mac_addr;
1651
1652         wmm_ac_clear_saved_tspecs(wpa_s);
1653         wpa_s->reassoc_same_bss = 0;
1654         wpa_s->reassoc_same_ess = 0;
1655
1656         if (wpa_s->last_ssid == ssid) {
1657                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1658                 wpa_s->reassoc_same_ess = 1;
1659                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1660                         wmm_ac_save_tspecs(wpa_s);
1661                         wpa_s->reassoc_same_bss = 1;
1662                 }
1663         } else if (rand_style > 0) {
1664                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1665                         return;
1666                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1667         } else if (wpa_s->mac_addr_changed) {
1668                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1669                         wpa_msg(wpa_s, MSG_INFO,
1670                                 "Could not restore permanent MAC address");
1671                         return;
1672                 }
1673                 wpa_s->mac_addr_changed = 0;
1674                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1675                         wpa_msg(wpa_s, MSG_INFO,
1676                                 "Could not update MAC address information");
1677                         return;
1678                 }
1679                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1680         }
1681         wpa_s->last_ssid = ssid;
1682
1683 #ifdef CONFIG_IBSS_RSN
1684         ibss_rsn_deinit(wpa_s->ibss_rsn);
1685         wpa_s->ibss_rsn = NULL;
1686 #endif /* CONFIG_IBSS_RSN */
1687
1688         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1689             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1690 #ifdef CONFIG_AP
1691                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1692                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1693                                 "mode");
1694                         return;
1695                 }
1696                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1697                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1698                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1699                                 wpas_p2p_ap_setup_failed(wpa_s);
1700                         return;
1701                 }
1702                 wpa_s->current_bss = bss;
1703 #else /* CONFIG_AP */
1704                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1705                         "the build");
1706 #endif /* CONFIG_AP */
1707                 return;
1708         }
1709
1710         if (ssid->mode == WPAS_MODE_MESH) {
1711 #ifdef CONFIG_MESH
1712                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1713                         wpa_msg(wpa_s, MSG_INFO,
1714                                 "Driver does not support mesh mode");
1715                         return;
1716                 }
1717                 if (bss)
1718                         ssid->frequency = bss->freq;
1719                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1720                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1721                         return;
1722                 }
1723                 wpa_s->current_bss = bss;
1724                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1725                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1726                         ssid->id);
1727 #else /* CONFIG_MESH */
1728                 wpa_msg(wpa_s, MSG_ERROR,
1729                         "mesh mode support not included in the build");
1730 #endif /* CONFIG_MESH */
1731                 return;
1732         }
1733
1734 #ifdef CONFIG_TDLS
1735         if (bss)
1736                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1737                                 bss->ie_len);
1738 #endif /* CONFIG_TDLS */
1739
1740         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1741             ssid->mode == IEEE80211_MODE_INFRA) {
1742                 sme_authenticate(wpa_s, bss, ssid);
1743                 return;
1744         }
1745
1746         if (wpa_s->connect_work) {
1747                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1748                 return;
1749         }
1750
1751         if (radio_work_pending(wpa_s, "connect")) {
1752                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1753                 return;
1754         }
1755
1756         wpas_abort_ongoing_scan(wpa_s);
1757
1758         cwork = os_zalloc(sizeof(*cwork));
1759         if (cwork == NULL)
1760                 return;
1761
1762         cwork->bss = bss;
1763         cwork->ssid = ssid;
1764
1765         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1766                            wpas_start_assoc_cb, cwork) < 0) {
1767                 os_free(cwork);
1768         }
1769 }
1770
1771
1772 static int bss_is_ibss(struct wpa_bss *bss)
1773 {
1774         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1775                 IEEE80211_CAP_IBSS;
1776 }
1777
1778
1779 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1780                             const struct wpa_ssid *ssid)
1781 {
1782         enum hostapd_hw_mode hw_mode;
1783         struct hostapd_hw_modes *mode = NULL;
1784         u8 channel;
1785         int i;
1786
1787 #ifdef CONFIG_HT_OVERRIDES
1788         if (ssid->disable_ht)
1789                 return 0;
1790 #endif /* CONFIG_HT_OVERRIDES */
1791
1792         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1793         if (hw_mode == NUM_HOSTAPD_MODES)
1794                 return 0;
1795         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1796                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1797                         mode = &wpa_s->hw.modes[i];
1798                         break;
1799                 }
1800         }
1801
1802         if (!mode)
1803                 return 0;
1804
1805         return mode->vht_capab != 0;
1806 }
1807
1808
1809 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1810                           const struct wpa_ssid *ssid,
1811                           struct hostapd_freq_params *freq)
1812 {
1813         enum hostapd_hw_mode hw_mode;
1814         struct hostapd_hw_modes *mode = NULL;
1815         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1816                            184, 192 };
1817         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1818         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1819         u8 channel;
1820         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1821         unsigned int j, k;
1822         struct hostapd_freq_params vht_freq;
1823         int chwidth, seg0, seg1;
1824         u32 vht_caps = 0;
1825
1826         freq->freq = ssid->frequency;
1827
1828         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1829                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1830
1831                 if (ssid->mode != WPAS_MODE_IBSS)
1832                         break;
1833
1834                 /* Don't adjust control freq in case of fixed_freq */
1835                 if (ssid->fixed_freq)
1836                         break;
1837
1838                 if (!bss_is_ibss(bss))
1839                         continue;
1840
1841                 if (ssid->ssid_len == bss->ssid_len &&
1842                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1843                         wpa_printf(MSG_DEBUG,
1844                                    "IBSS already found in scan results, adjust control freq: %d",
1845                                    bss->freq);
1846                         freq->freq = bss->freq;
1847                         obss_scan = 0;
1848                         break;
1849                 }
1850         }
1851
1852         /* For IBSS check HT_IBSS flag */
1853         if (ssid->mode == WPAS_MODE_IBSS &&
1854             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1855                 return;
1856
1857         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1858             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1859             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1860                 wpa_printf(MSG_DEBUG,
1861                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1862                 return;
1863         }
1864
1865         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1866         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1867                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1868                         mode = &wpa_s->hw.modes[i];
1869                         break;
1870                 }
1871         }
1872
1873         if (!mode)
1874                 return;
1875
1876         freq->ht_enabled = ht_supported(mode);
1877         if (!freq->ht_enabled)
1878                 return;
1879
1880         /* Setup higher BW only for 5 GHz */
1881         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1882                 return;
1883
1884         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1885                 pri_chan = &mode->channels[chan_idx];
1886                 if (pri_chan->chan == channel)
1887                         break;
1888                 pri_chan = NULL;
1889         }
1890         if (!pri_chan)
1891                 return;
1892
1893         /* Check primary channel flags */
1894         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1895                 return;
1896
1897         /* Check/setup HT40+/HT40- */
1898         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1899                 if (ht40plus[j] == channel) {
1900                         ht40 = 1;
1901                         break;
1902                 }
1903         }
1904
1905         /* Find secondary channel */
1906         for (i = 0; i < mode->num_channels; i++) {
1907                 sec_chan = &mode->channels[i];
1908                 if (sec_chan->chan == channel + ht40 * 4)
1909                         break;
1910                 sec_chan = NULL;
1911         }
1912         if (!sec_chan)
1913                 return;
1914
1915         /* Check secondary channel flags */
1916         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1917                 return;
1918
1919         freq->channel = pri_chan->chan;
1920
1921         switch (ht40) {
1922         case -1:
1923                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1924                         return;
1925                 freq->sec_channel_offset = -1;
1926                 break;
1927         case 1:
1928                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1929                         return;
1930                 freq->sec_channel_offset = 1;
1931                 break;
1932         default:
1933                 break;
1934         }
1935
1936         if (freq->sec_channel_offset && obss_scan) {
1937                 struct wpa_scan_results *scan_res;
1938
1939                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1940                 if (scan_res == NULL) {
1941                         /* Back to HT20 */
1942                         freq->sec_channel_offset = 0;
1943                         return;
1944                 }
1945
1946                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1947                                      sec_chan->chan);
1948                 switch (res) {
1949                 case 0:
1950                         /* Back to HT20 */
1951                         freq->sec_channel_offset = 0;
1952                         break;
1953                 case 1:
1954                         /* Configuration allowed */
1955                         break;
1956                 case 2:
1957                         /* Switch pri/sec channels */
1958                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1959                         freq->sec_channel_offset = -freq->sec_channel_offset;
1960                         freq->channel = sec_chan->chan;
1961                         break;
1962                 default:
1963                         freq->sec_channel_offset = 0;
1964                         break;
1965                 }
1966
1967                 wpa_scan_results_free(scan_res);
1968         }
1969
1970         wpa_printf(MSG_DEBUG,
1971                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1972                    freq->channel, freq->sec_channel_offset);
1973
1974         if (!drv_supports_vht(wpa_s, ssid))
1975                 return;
1976
1977         /* For IBSS check VHT_IBSS flag */
1978         if (ssid->mode == WPAS_MODE_IBSS &&
1979             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1980                 return;
1981
1982         vht_freq = *freq;
1983
1984         vht_freq.vht_enabled = vht_supported(mode);
1985         if (!vht_freq.vht_enabled)
1986                 return;
1987
1988         /* setup center_freq1, bandwidth */
1989         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1990                 if (freq->channel >= vht80[j] &&
1991                     freq->channel < vht80[j] + 16)
1992                         break;
1993         }
1994
1995         if (j == ARRAY_SIZE(vht80))
1996                 return;
1997
1998         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1999                 struct hostapd_channel_data *chan;
2000
2001                 chan = hw_get_channel_chan(mode, i, NULL);
2002                 if (!chan)
2003                         return;
2004
2005                 /* Back to HT configuration if channel not usable */
2006                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2007                         return;
2008         }
2009
2010         chwidth = VHT_CHANWIDTH_80MHZ;
2011         seg0 = vht80[j] + 6;
2012         seg1 = 0;
2013
2014         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2015                 /* setup center_freq2, bandwidth */
2016                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2017                         /* Only accept 80 MHz segments separated by a gap */
2018                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2019                                 continue;
2020                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2021                                 struct hostapd_channel_data *chan;
2022
2023                                 chan = hw_get_channel_chan(mode, i, NULL);
2024                                 if (!chan)
2025                                         continue;
2026
2027                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2028                                                   HOSTAPD_CHAN_NO_IR |
2029                                                   HOSTAPD_CHAN_RADAR))
2030                                         continue;
2031
2032                                 /* Found a suitable second segment for 80+80 */
2033                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2034                                 vht_caps |=
2035                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2036                                 seg1 = vht80[k] + 6;
2037                         }
2038
2039                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2040                                 break;
2041                 }
2042         } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_160MHZ) {
2043                 if (freq->freq == 5180) {
2044                         chwidth = VHT_CHANWIDTH_160MHZ;
2045                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2046                         seg0 = 50;
2047                 } else if (freq->freq == 5520) {
2048                         chwidth = VHT_CHANWIDTH_160MHZ;
2049                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2050                         seg0 = 114;
2051                 }
2052         }
2053
2054         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2055                                     freq->channel, freq->ht_enabled,
2056                                     vht_freq.vht_enabled,
2057                                     freq->sec_channel_offset,
2058                                     chwidth, seg0, seg1, vht_caps) != 0)
2059                 return;
2060
2061         *freq = vht_freq;
2062
2063         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2064                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2065 }
2066
2067
2068 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2069 {
2070         struct wpa_connect_work *cwork = work->ctx;
2071         struct wpa_bss *bss = cwork->bss;
2072         struct wpa_ssid *ssid = cwork->ssid;
2073         struct wpa_supplicant *wpa_s = work->wpa_s;
2074         u8 wpa_ie[200];
2075         size_t wpa_ie_len;
2076         int use_crypt, ret, i, bssid_changed;
2077         int algs = WPA_AUTH_ALG_OPEN;
2078         unsigned int cipher_pairwise, cipher_group;
2079         struct wpa_driver_associate_params params;
2080         int wep_keys_set = 0;
2081         int assoc_failed = 0;
2082         struct wpa_ssid *old_ssid;
2083         u8 prev_bssid[ETH_ALEN];
2084 #ifdef CONFIG_HT_OVERRIDES
2085         struct ieee80211_ht_capabilities htcaps;
2086         struct ieee80211_ht_capabilities htcaps_mask;
2087 #endif /* CONFIG_HT_OVERRIDES */
2088 #ifdef CONFIG_VHT_OVERRIDES
2089        struct ieee80211_vht_capabilities vhtcaps;
2090        struct ieee80211_vht_capabilities vhtcaps_mask;
2091 #endif /* CONFIG_VHT_OVERRIDES */
2092 #ifdef CONFIG_MBO
2093         const u8 *mbo = NULL;
2094 #endif /* CONFIG_MBO */
2095
2096         if (deinit) {
2097                 if (work->started) {
2098                         wpa_s->connect_work = NULL;
2099
2100                         /* cancel possible auth. timeout */
2101                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2102                                              NULL);
2103                 }
2104                 wpas_connect_work_free(cwork);
2105                 return;
2106         }
2107
2108         wpa_s->connect_work = work;
2109
2110         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2111             wpas_network_disabled(wpa_s, ssid)) {
2112                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2113                 wpas_connect_work_done(wpa_s);
2114                 return;
2115         }
2116
2117         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2118         os_memset(&params, 0, sizeof(params));
2119         wpa_s->reassociate = 0;
2120         wpa_s->eap_expected_failure = 0;
2121         if (bss &&
2122             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2123 #ifdef CONFIG_IEEE80211R
2124                 const u8 *ie, *md = NULL;
2125 #endif /* CONFIG_IEEE80211R */
2126                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2127                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2128                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2129                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2130                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2131                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2132                 if (bssid_changed)
2133                         wpas_notify_bssid_changed(wpa_s);
2134 #ifdef CONFIG_IEEE80211R
2135                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2136                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2137                         md = ie + 2;
2138                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2139                 if (md) {
2140                         /* Prepare for the next transition */
2141                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2142                 }
2143 #endif /* CONFIG_IEEE80211R */
2144 #ifdef CONFIG_WPS
2145         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2146                    wpa_s->conf->ap_scan == 2 &&
2147                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2148                 /* Use ap_scan==1 style network selection to find the network
2149                  */
2150                 wpas_connect_work_done(wpa_s);
2151                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2152                 wpa_s->reassociate = 1;
2153                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2154                 return;
2155 #endif /* CONFIG_WPS */
2156         } else {
2157                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2158                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2159                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2160         }
2161         if (!wpa_s->pno)
2162                 wpa_supplicant_cancel_sched_scan(wpa_s);
2163
2164         wpa_supplicant_cancel_scan(wpa_s);
2165
2166         /* Starting new association, so clear the possibly used WPA IE from the
2167          * previous association. */
2168         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2169
2170 #ifdef IEEE8021X_EAPOL
2171         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2172                 if (ssid->leap) {
2173                         if (ssid->non_leap == 0)
2174                                 algs = WPA_AUTH_ALG_LEAP;
2175                         else
2176                                 algs |= WPA_AUTH_ALG_LEAP;
2177                 }
2178         }
2179 #endif /* IEEE8021X_EAPOL */
2180         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2181         if (ssid->auth_alg) {
2182                 algs = ssid->auth_alg;
2183                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2184                         "0x%x", algs);
2185         }
2186
2187         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2188                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2189             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2190                 int try_opportunistic;
2191                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2192                                      wpa_s->conf->okc :
2193                                      ssid->proactive_key_caching) &&
2194                         (ssid->proto & WPA_PROTO_RSN);
2195                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2196                                             ssid, try_opportunistic) == 0)
2197                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2198                 wpa_ie_len = sizeof(wpa_ie);
2199                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2200                                               wpa_ie, &wpa_ie_len)) {
2201                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2202                                 "key management and encryption suites");
2203                         wpas_connect_work_done(wpa_s);
2204                         return;
2205                 }
2206         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2207                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2208                 /*
2209                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2210                  * use non-WPA since the scan results did not indicate that the
2211                  * AP is using WPA or WPA2.
2212                  */
2213                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2214                 wpa_ie_len = 0;
2215                 wpa_s->wpa_proto = 0;
2216         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2217                 wpa_ie_len = sizeof(wpa_ie);
2218                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2219                                               wpa_ie, &wpa_ie_len)) {
2220                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2221                                 "key management and encryption suites (no "
2222                                 "scan results)");
2223                         wpas_connect_work_done(wpa_s);
2224                         return;
2225                 }
2226 #ifdef CONFIG_WPS
2227         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2228                 struct wpabuf *wps_ie;
2229                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2230                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2231                         wpa_ie_len = wpabuf_len(wps_ie);
2232                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2233                 } else
2234                         wpa_ie_len = 0;
2235                 wpabuf_free(wps_ie);
2236                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2237                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2238                         params.wps = WPS_MODE_PRIVACY;
2239                 else
2240                         params.wps = WPS_MODE_OPEN;
2241                 wpa_s->wpa_proto = 0;
2242 #endif /* CONFIG_WPS */
2243         } else {
2244                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2245                 wpa_ie_len = 0;
2246                 wpa_s->wpa_proto = 0;
2247         }
2248
2249 #ifdef CONFIG_P2P
2250         if (wpa_s->global->p2p) {
2251                 u8 *pos;
2252                 size_t len;
2253                 int res;
2254                 pos = wpa_ie + wpa_ie_len;
2255                 len = sizeof(wpa_ie) - wpa_ie_len;
2256                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2257                                             ssid->p2p_group);
2258                 if (res >= 0)
2259                         wpa_ie_len += res;
2260         }
2261
2262         wpa_s->cross_connect_disallowed = 0;
2263         if (bss) {
2264                 struct wpabuf *p2p;
2265                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2266                 if (p2p) {
2267                         wpa_s->cross_connect_disallowed =
2268                                 p2p_get_cross_connect_disallowed(p2p);
2269                         wpabuf_free(p2p);
2270                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2271                                 "connection",
2272                                 wpa_s->cross_connect_disallowed ?
2273                                 "disallows" : "allows");
2274                 }
2275         }
2276
2277         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2278 #endif /* CONFIG_P2P */
2279
2280 #ifdef CONFIG_MBO
2281         if (bss) {
2282                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2283                 if (mbo) {
2284                         int len;
2285
2286                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2287                                                         wpa_ie + wpa_ie_len,
2288                                                         sizeof(wpa_ie) -
2289                                                         wpa_ie_len);
2290                         if (len > 0)
2291                                 wpa_ie_len += len;
2292                 }
2293         }
2294 #endif /* CONFIG_MBO */
2295
2296         /*
2297          * Workaround: Add Extended Capabilities element only if the AP
2298          * included this element in Beacon/Probe Response frames. Some older
2299          * APs seem to have interoperability issues if this element is
2300          * included, so while the standard may require us to include the
2301          * element in all cases, it is justifiable to skip it to avoid
2302          * interoperability issues.
2303          */
2304         if (ssid->p2p_group)
2305                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
2306         else
2307                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
2308
2309         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2310                 u8 ext_capab[18];
2311                 int ext_capab_len;
2312                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2313                                                      sizeof(ext_capab));
2314                 if (ext_capab_len > 0) {
2315                         u8 *pos = wpa_ie;
2316                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2317                                 pos += 2 + pos[1];
2318                         os_memmove(pos + ext_capab_len, pos,
2319                                    wpa_ie_len - (pos - wpa_ie));
2320                         wpa_ie_len += ext_capab_len;
2321                         os_memcpy(pos, ext_capab, ext_capab_len);
2322                 }
2323         }
2324
2325 #ifdef CONFIG_HS20
2326         if (is_hs20_network(wpa_s, ssid, bss)) {
2327                 struct wpabuf *hs20;
2328
2329                 hs20 = wpabuf_alloc(20);
2330                 if (hs20) {
2331                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2332                         size_t len;
2333
2334                         wpas_hs20_add_indication(hs20, pps_mo_id);
2335                         len = sizeof(wpa_ie) - wpa_ie_len;
2336                         if (wpabuf_len(hs20) <= len) {
2337                                 os_memcpy(wpa_ie + wpa_ie_len,
2338                                           wpabuf_head(hs20), wpabuf_len(hs20));
2339                                 wpa_ie_len += wpabuf_len(hs20);
2340                         }
2341                         wpabuf_free(hs20);
2342
2343                         hs20_configure_frame_filters(wpa_s);
2344                 }
2345         }
2346 #endif /* CONFIG_HS20 */
2347
2348         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2349                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2350                 size_t len;
2351
2352                 len = sizeof(wpa_ie) - wpa_ie_len;
2353                 if (wpabuf_len(buf) <= len) {
2354                         os_memcpy(wpa_ie + wpa_ie_len,
2355                                   wpabuf_head(buf), wpabuf_len(buf));
2356                         wpa_ie_len += wpabuf_len(buf);
2357                 }
2358         }
2359
2360 #ifdef CONFIG_FST
2361         if (wpa_s->fst_ies) {
2362                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2363
2364                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2365                         os_memcpy(wpa_ie + wpa_ie_len,
2366                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2367                         wpa_ie_len += fst_ies_len;
2368                 }
2369         }
2370 #endif /* CONFIG_FST */
2371
2372 #ifdef CONFIG_MBO
2373         if (mbo) {
2374                 int len;
2375
2376                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2377                                   sizeof(wpa_ie) - wpa_ie_len);
2378                 if (len >= 0)
2379                         wpa_ie_len += len;
2380         }
2381 #endif /* CONFIG_MBO */
2382
2383         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2384         use_crypt = 1;
2385         cipher_pairwise = wpa_s->pairwise_cipher;
2386         cipher_group = wpa_s->group_cipher;
2387         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2388             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2389                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2390                         use_crypt = 0;
2391                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2392                         use_crypt = 1;
2393                         wep_keys_set = 1;
2394                 }
2395         }
2396         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2397                 use_crypt = 0;
2398
2399 #ifdef IEEE8021X_EAPOL
2400         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2401                 if ((ssid->eapol_flags &
2402                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2403                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2404                     !wep_keys_set) {
2405                         use_crypt = 0;
2406                 } else {
2407                         /* Assume that dynamic WEP-104 keys will be used and
2408                          * set cipher suites in order for drivers to expect
2409                          * encryption. */
2410                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2411                 }
2412         }
2413 #endif /* IEEE8021X_EAPOL */
2414
2415         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2416                 /* Set the key before (and later after) association */
2417                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2418         }
2419
2420         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2421         if (bss) {
2422                 params.ssid = bss->ssid;
2423                 params.ssid_len = bss->ssid_len;
2424                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2425                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2426                                    MACSTR " freq=%u MHz based on scan results "
2427                                    "(bssid_set=%d)",
2428                                    MAC2STR(bss->bssid), bss->freq,
2429                                    ssid->bssid_set);
2430                         params.bssid = bss->bssid;
2431                         params.freq.freq = bss->freq;
2432                 }
2433                 params.bssid_hint = bss->bssid;
2434                 params.freq_hint = bss->freq;
2435                 params.pbss = bss_is_pbss(bss);
2436         } else {
2437                 params.ssid = ssid->ssid;
2438                 params.ssid_len = ssid->ssid_len;
2439                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2440         }
2441
2442         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2443             wpa_s->conf->ap_scan == 2) {
2444                 params.bssid = ssid->bssid;
2445                 params.fixed_bssid = 1;
2446         }
2447
2448         /* Initial frequency for IBSS/mesh */
2449         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2450             ssid->frequency > 0 && params.freq.freq == 0)
2451                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2452
2453         if (ssid->mode == WPAS_MODE_IBSS) {
2454                 params.fixed_freq = ssid->fixed_freq;
2455                 if (ssid->beacon_int)
2456                         params.beacon_int = ssid->beacon_int;
2457                 else
2458                         params.beacon_int = wpa_s->conf->beacon_int;
2459         }
2460
2461         params.wpa_ie = wpa_ie;
2462         params.wpa_ie_len = wpa_ie_len;
2463         params.pairwise_suite = cipher_pairwise;
2464         params.group_suite = cipher_group;
2465         params.key_mgmt_suite = wpa_s->key_mgmt;
2466         params.wpa_proto = wpa_s->wpa_proto;
2467         params.auth_alg = algs;
2468         params.mode = ssid->mode;
2469         params.bg_scan_period = ssid->bg_scan_period;
2470         for (i = 0; i < NUM_WEP_KEYS; i++) {
2471                 if (ssid->wep_key_len[i])
2472                         params.wep_key[i] = ssid->wep_key[i];
2473                 params.wep_key_len[i] = ssid->wep_key_len[i];
2474         }
2475         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2476
2477         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2478             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2479              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2480                 params.passphrase = ssid->passphrase;
2481                 if (ssid->psk_set)
2482                         params.psk = ssid->psk;
2483         }
2484
2485         if (wpa_s->conf->key_mgmt_offload) {
2486                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2487                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2488                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2489                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2490                         params.req_key_mgmt_offload =
2491                                 ssid->proactive_key_caching < 0 ?
2492                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2493                 else
2494                         params.req_key_mgmt_offload = 1;
2495
2496                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2497                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2498                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2499                     ssid->psk_set)
2500                         params.psk = ssid->psk;
2501         }
2502
2503         params.drop_unencrypted = use_crypt;
2504
2505 #ifdef CONFIG_IEEE80211W
2506         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2507         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2508                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2509                 struct wpa_ie_data ie;
2510                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2511                     ie.capabilities &
2512                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2513                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2514                                 "MFP: require MFP");
2515                         params.mgmt_frame_protection =
2516                                 MGMT_FRAME_PROTECTION_REQUIRED;
2517                 }
2518         }
2519 #endif /* CONFIG_IEEE80211W */
2520
2521         params.p2p = ssid->p2p_group;
2522
2523         if (wpa_s->p2pdev->set_sta_uapsd)
2524                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2525         else
2526                 params.uapsd = -1;
2527
2528 #ifdef CONFIG_HT_OVERRIDES
2529         os_memset(&htcaps, 0, sizeof(htcaps));
2530         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2531         params.htcaps = (u8 *) &htcaps;
2532         params.htcaps_mask = (u8 *) &htcaps_mask;
2533         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2534 #endif /* CONFIG_HT_OVERRIDES */
2535 #ifdef CONFIG_VHT_OVERRIDES
2536         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2537         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2538         params.vhtcaps = &vhtcaps;
2539         params.vhtcaps_mask = &vhtcaps_mask;
2540         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2541 #endif /* CONFIG_VHT_OVERRIDES */
2542
2543 #ifdef CONFIG_P2P
2544         /*
2545          * If multi-channel concurrency is not supported, check for any
2546          * frequency conflict. In case of any frequency conflict, remove the
2547          * least prioritized connection.
2548          */
2549         if (wpa_s->num_multichan_concurrent < 2) {
2550                 int freq, num;
2551                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2552                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2553                         wpa_printf(MSG_DEBUG,
2554                                    "Assoc conflicting freq found (%d != %d)",
2555                                    freq, params.freq.freq);
2556                         if (wpas_p2p_handle_frequency_conflicts(
2557                                     wpa_s, params.freq.freq, ssid) < 0) {
2558                                 wpas_connect_work_done(wpa_s);
2559                                 return;
2560                         }
2561                 }
2562         }
2563 #endif /* CONFIG_P2P */
2564
2565         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2566             wpa_s->current_ssid)
2567                 params.prev_bssid = prev_bssid;
2568
2569         ret = wpa_drv_associate(wpa_s, &params);
2570         if (ret < 0) {
2571                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2572                         "failed");
2573                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2574                         /*
2575                          * The driver is known to mean what is saying, so we
2576                          * can stop right here; the association will not
2577                          * succeed.
2578                          */
2579                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2580                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2581                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2582                         return;
2583                 }
2584                 /* try to continue anyway; new association will be tried again
2585                  * after timeout */
2586                 assoc_failed = 1;
2587         }
2588
2589         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2590                 /* Set the key after the association just in case association
2591                  * cleared the previously configured key. */
2592                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2593                 /* No need to timeout authentication since there is no key
2594                  * management. */
2595                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2596                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2597 #ifdef CONFIG_IBSS_RSN
2598         } else if (ssid->mode == WPAS_MODE_IBSS &&
2599                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2600                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2601                 /*
2602                  * RSN IBSS authentication is per-STA and we can disable the
2603                  * per-BSSID authentication.
2604                  */
2605                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2606 #endif /* CONFIG_IBSS_RSN */
2607         } else {
2608                 /* Timeout for IEEE 802.11 authentication and association */
2609                 int timeout = 60;
2610
2611                 if (assoc_failed) {
2612                         /* give IBSS a bit more time */
2613                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2614                 } else if (wpa_s->conf->ap_scan == 1) {
2615                         /* give IBSS a bit more time */
2616                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2617                 }
2618                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2619         }
2620
2621         if (wep_keys_set &&
2622             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2623                 /* Set static WEP keys again */
2624                 wpa_set_wep_keys(wpa_s, ssid);
2625         }
2626
2627         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2628                 /*
2629                  * Do not allow EAP session resumption between different
2630                  * network configurations.
2631                  */
2632                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2633         }
2634         old_ssid = wpa_s->current_ssid;
2635         wpa_s->current_ssid = ssid;
2636
2637         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2638                 wpa_s->current_bss = bss;
2639 #ifdef CONFIG_HS20
2640                 hs20_configure_frame_filters(wpa_s);
2641 #endif /* CONFIG_HS20 */
2642         }
2643
2644         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2645         wpa_supplicant_initiate_eapol(wpa_s);
2646         if (old_ssid != wpa_s->current_ssid)
2647                 wpas_notify_network_changed(wpa_s);
2648 }
2649
2650
2651 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2652                                             const u8 *addr)
2653 {
2654         struct wpa_ssid *old_ssid;
2655
2656         wpas_connect_work_done(wpa_s);
2657         wpa_clear_keys(wpa_s, addr);
2658         old_ssid = wpa_s->current_ssid;
2659         wpa_supplicant_mark_disassoc(wpa_s);
2660         wpa_sm_set_config(wpa_s->wpa, NULL);
2661         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2662         if (old_ssid != wpa_s->current_ssid)
2663                 wpas_notify_network_changed(wpa_s);
2664         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2665 }
2666
2667
2668 /**
2669  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2670  * @wpa_s: Pointer to wpa_supplicant data
2671  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2672  *
2673  * This function is used to request %wpa_supplicant to deauthenticate from the
2674  * current AP.
2675  */
2676 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2677                                    int reason_code)
2678 {
2679         u8 *addr = NULL;
2680         union wpa_event_data event;
2681         int zero_addr = 0;
2682
2683         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2684                 " pending_bssid=" MACSTR " reason=%d state=%s",
2685                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2686                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2687
2688         if (!is_zero_ether_addr(wpa_s->bssid))
2689                 addr = wpa_s->bssid;
2690         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2691                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2692                   wpa_s->wpa_state == WPA_ASSOCIATING))
2693                 addr = wpa_s->pending_bssid;
2694         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2695                 /*
2696                  * When using driver-based BSS selection, we may not know the
2697                  * BSSID with which we are currently trying to associate. We
2698                  * need to notify the driver of this disconnection even in such
2699                  * a case, so use the all zeros address here.
2700                  */
2701                 addr = wpa_s->bssid;
2702                 zero_addr = 1;
2703         }
2704
2705 #ifdef CONFIG_TDLS
2706         wpa_tdls_teardown_peers(wpa_s->wpa);
2707 #endif /* CONFIG_TDLS */
2708
2709 #ifdef CONFIG_MESH
2710         if (wpa_s->ifmsh) {
2711                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2712                         wpa_s->ifname);
2713                 wpa_supplicant_leave_mesh(wpa_s);
2714         }
2715 #endif /* CONFIG_MESH */
2716
2717         if (addr) {
2718                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2719                 os_memset(&event, 0, sizeof(event));
2720                 event.deauth_info.reason_code = (u16) reason_code;
2721                 event.deauth_info.locally_generated = 1;
2722                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2723                 if (zero_addr)
2724                         addr = NULL;
2725         }
2726
2727         wpa_supplicant_clear_connection(wpa_s, addr);
2728 }
2729
2730 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2731                                               struct wpa_ssid *ssid)
2732 {
2733         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2734                 return;
2735
2736         ssid->disabled = 0;
2737         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2738         wpas_notify_network_enabled_changed(wpa_s, ssid);
2739
2740         /*
2741          * Try to reassociate since there is no current configuration and a new
2742          * network was made available.
2743          */
2744         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2745                 wpa_s->reassociate = 1;
2746 }
2747
2748
2749 /**
2750  * wpa_supplicant_enable_network - Mark a configured network as enabled
2751  * @wpa_s: wpa_supplicant structure for a network interface
2752  * @ssid: wpa_ssid structure for a configured network or %NULL
2753  *
2754  * Enables the specified network or all networks if no network specified.
2755  */
2756 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2757                                    struct wpa_ssid *ssid)
2758 {
2759         if (ssid == NULL) {
2760                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2761                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2762         } else
2763                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2764
2765         if (wpa_s->reassociate && !wpa_s->disconnected &&
2766             (!wpa_s->current_ssid ||
2767              wpa_s->wpa_state == WPA_DISCONNECTED ||
2768              wpa_s->wpa_state == WPA_SCANNING)) {
2769                 if (wpa_s->sched_scanning) {
2770                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2771                                    "new network to scan filters");
2772                         wpa_supplicant_cancel_sched_scan(wpa_s);
2773                 }
2774
2775                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2776                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2777                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2778                 }
2779         }
2780 }
2781
2782
2783 /**
2784  * wpa_supplicant_disable_network - Mark a configured network as disabled
2785  * @wpa_s: wpa_supplicant structure for a network interface
2786  * @ssid: wpa_ssid structure for a configured network or %NULL
2787  *
2788  * Disables the specified network or all networks if no network specified.
2789  */
2790 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2791                                     struct wpa_ssid *ssid)
2792 {
2793         struct wpa_ssid *other_ssid;
2794         int was_disabled;
2795
2796         if (ssid == NULL) {
2797                 if (wpa_s->sched_scanning)
2798                         wpa_supplicant_cancel_sched_scan(wpa_s);
2799
2800                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2801                      other_ssid = other_ssid->next) {
2802                         was_disabled = other_ssid->disabled;
2803                         if (was_disabled == 2)
2804                                 continue; /* do not change persistent P2P group
2805                                            * data */
2806
2807                         other_ssid->disabled = 1;
2808
2809                         if (was_disabled != other_ssid->disabled)
2810                                 wpas_notify_network_enabled_changed(
2811                                         wpa_s, other_ssid);
2812                 }
2813                 if (wpa_s->current_ssid)
2814                         wpa_supplicant_deauthenticate(
2815                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2816         } else if (ssid->disabled != 2) {
2817                 if (ssid == wpa_s->current_ssid)
2818                         wpa_supplicant_deauthenticate(
2819                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2820
2821                 was_disabled = ssid->disabled;
2822
2823                 ssid->disabled = 1;
2824
2825                 if (was_disabled != ssid->disabled) {
2826                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2827                         if (wpa_s->sched_scanning) {
2828                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2829                                            "to remove network from filters");
2830                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2831                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2832                         }
2833                 }
2834         }
2835 }
2836
2837
2838 /**
2839  * wpa_supplicant_select_network - Attempt association with a network
2840  * @wpa_s: wpa_supplicant structure for a network interface
2841  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2842  */
2843 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2844                                    struct wpa_ssid *ssid)
2845 {
2846
2847         struct wpa_ssid *other_ssid;
2848         int disconnected = 0;
2849
2850         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2851                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2852                         wpa_s->own_disconnect_req = 1;
2853                 wpa_supplicant_deauthenticate(
2854                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2855                 disconnected = 1;
2856         }
2857
2858         if (ssid)
2859                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2860
2861         /*
2862          * Mark all other networks disabled or mark all networks enabled if no
2863          * network specified.
2864          */
2865         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2866              other_ssid = other_ssid->next) {
2867                 int was_disabled = other_ssid->disabled;
2868                 if (was_disabled == 2)
2869                         continue; /* do not change persistent P2P group data */
2870
2871                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2872                 if (was_disabled && !other_ssid->disabled)
2873                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2874
2875                 if (was_disabled != other_ssid->disabled)
2876                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2877         }
2878
2879         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2880             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2881                 /* We are already associated with the selected network */
2882                 wpa_printf(MSG_DEBUG, "Already associated with the "
2883                            "selected network - do nothing");
2884                 return;
2885         }
2886
2887         if (ssid) {
2888                 wpa_s->current_ssid = ssid;
2889                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2890                 wpa_s->connect_without_scan =
2891                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2892
2893                 /*
2894                  * Don't optimize next scan freqs since a new ESS has been
2895                  * selected.
2896                  */
2897                 os_free(wpa_s->next_scan_freqs);
2898                 wpa_s->next_scan_freqs = NULL;
2899         } else {
2900                 wpa_s->connect_without_scan = NULL;
2901         }
2902
2903         wpa_s->disconnected = 0;
2904         wpa_s->reassociate = 1;
2905
2906         if (wpa_s->connect_without_scan ||
2907             wpa_supplicant_fast_associate(wpa_s) != 1) {
2908                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2909                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2910         }
2911
2912         if (ssid)
2913                 wpas_notify_network_selected(wpa_s, ssid);
2914 }
2915
2916
2917 /**
2918  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2919  * @wpa_s: wpa_supplicant structure for a network interface
2920  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2921  * @pkcs11_module_path: PKCS #11 module path or NULL
2922  * Returns: 0 on success; -1 on failure
2923  *
2924  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2925  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2926  * module path fails the paths will be reset to the default value (NULL).
2927  */
2928 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2929                                            const char *pkcs11_engine_path,
2930                                            const char *pkcs11_module_path)
2931 {
2932         char *pkcs11_engine_path_copy = NULL;
2933         char *pkcs11_module_path_copy = NULL;
2934
2935         if (pkcs11_engine_path != NULL) {
2936                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2937                 if (pkcs11_engine_path_copy == NULL)
2938                         return -1;
2939         }
2940         if (pkcs11_module_path != NULL) {
2941                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2942                 if (pkcs11_module_path_copy == NULL) {
2943                         os_free(pkcs11_engine_path_copy);
2944                         return -1;
2945                 }
2946         }
2947
2948         os_free(wpa_s->conf->pkcs11_engine_path);
2949         os_free(wpa_s->conf->pkcs11_module_path);
2950         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2951         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2952
2953         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2954         eapol_sm_deinit(wpa_s->eapol);
2955         wpa_s->eapol = NULL;
2956         if (wpa_supplicant_init_eapol(wpa_s)) {
2957                 /* Error -> Reset paths to the default value (NULL) once. */
2958                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2959                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2960                                                                NULL);
2961
2962                 return -1;
2963         }
2964         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2965
2966         return 0;
2967 }
2968
2969
2970 /**
2971  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2972  * @wpa_s: wpa_supplicant structure for a network interface
2973  * @ap_scan: AP scan mode
2974  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2975  *
2976  */
2977 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2978 {
2979
2980         int old_ap_scan;
2981
2982         if (ap_scan < 0 || ap_scan > 2)
2983                 return -1;
2984
2985         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2986                 wpa_printf(MSG_INFO,
2987                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2988         }
2989
2990 #ifdef ANDROID
2991         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2992             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2993             wpa_s->wpa_state < WPA_COMPLETED) {
2994                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2995                            "associating", wpa_s->conf->ap_scan, ap_scan);
2996                 return 0;
2997         }
2998 #endif /* ANDROID */
2999
3000         old_ap_scan = wpa_s->conf->ap_scan;
3001         wpa_s->conf->ap_scan = ap_scan;
3002
3003         if (old_ap_scan != wpa_s->conf->ap_scan)
3004                 wpas_notify_ap_scan_changed(wpa_s);
3005
3006         return 0;
3007 }
3008
3009
3010 /**
3011  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
3012  * @wpa_s: wpa_supplicant structure for a network interface
3013  * @expire_age: Expiration age in seconds
3014  * Returns: 0 if succeed or -1 if expire_age has an invalid value
3015  *
3016  */
3017 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3018                                           unsigned int bss_expire_age)
3019 {
3020         if (bss_expire_age < 10) {
3021                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3022                         bss_expire_age);
3023                 return -1;
3024         }
3025         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3026                 bss_expire_age);
3027         wpa_s->conf->bss_expiration_age = bss_expire_age;
3028
3029         return 0;
3030 }
3031
3032
3033 /**
3034  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3035  * @wpa_s: wpa_supplicant structure for a network interface
3036  * @expire_count: number of scans after which an unseen BSS is reclaimed
3037  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3038  *
3039  */
3040 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3041                                             unsigned int bss_expire_count)
3042 {
3043         if (bss_expire_count < 1) {
3044                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3045                         bss_expire_count);
3046                 return -1;
3047         }
3048         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3049                 bss_expire_count);
3050         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3051
3052         return 0;
3053 }
3054
3055
3056 /**
3057  * wpa_supplicant_set_scan_interval - Set scan interval
3058  * @wpa_s: wpa_supplicant structure for a network interface
3059  * @scan_interval: scan interval in seconds
3060  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3061  *
3062  */
3063 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3064                                      int scan_interval)
3065 {
3066         if (scan_interval < 0) {
3067                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3068                         scan_interval);
3069                 return -1;
3070         }
3071         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3072                 scan_interval);
3073         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3074
3075         return 0;
3076 }
3077
3078
3079 /**
3080  * wpa_supplicant_set_debug_params - Set global debug params
3081  * @global: wpa_global structure
3082  * @debug_level: debug level
3083  * @debug_timestamp: determines if show timestamp in debug data
3084  * @debug_show_keys: determines if show keys in debug data
3085  * Returns: 0 if succeed or -1 if debug_level has wrong value
3086  */
3087 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3088                                     int debug_timestamp, int debug_show_keys)
3089 {
3090
3091         int old_level, old_timestamp, old_show_keys;
3092
3093         /* check for allowed debuglevels */
3094         if (debug_level != MSG_EXCESSIVE &&
3095             debug_level != MSG_MSGDUMP &&
3096             debug_level != MSG_DEBUG &&
3097             debug_level != MSG_INFO &&
3098             debug_level != MSG_WARNING &&
3099             debug_level != MSG_ERROR)
3100                 return -1;
3101
3102         old_level = wpa_debug_level;
3103         old_timestamp = wpa_debug_timestamp;
3104         old_show_keys = wpa_debug_show_keys;
3105
3106         wpa_debug_level = debug_level;
3107         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3108         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3109
3110         if (wpa_debug_level != old_level)
3111                 wpas_notify_debug_level_changed(global);
3112         if (wpa_debug_timestamp != old_timestamp)
3113                 wpas_notify_debug_timestamp_changed(global);
3114         if (wpa_debug_show_keys != old_show_keys)
3115                 wpas_notify_debug_show_keys_changed(global);
3116
3117         return 0;
3118 }
3119
3120
3121 /**
3122  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3123  * @wpa_s: Pointer to wpa_supplicant data
3124  * Returns: A pointer to the current network structure or %NULL on failure
3125  */
3126 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3127 {
3128         struct wpa_ssid *entry;
3129         u8 ssid[SSID_MAX_LEN];
3130         int res;
3131         size_t ssid_len;
3132         u8 bssid[ETH_ALEN];
3133         int wired;
3134
3135         res = wpa_drv_get_ssid(wpa_s, ssid);
3136         if (res < 0) {
3137                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3138                         "driver");
3139                 return NULL;
3140         }
3141         ssid_len = res;
3142
3143         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3144                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3145                         "driver");
3146                 return NULL;
3147         }
3148
3149         wired = wpa_s->conf->ap_scan == 0 &&
3150                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3151
3152         entry = wpa_s->conf->ssid;
3153         while (entry) {
3154                 if (!wpas_network_disabled(wpa_s, entry) &&
3155                     ((ssid_len == entry->ssid_len &&
3156                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3157                     (!entry->bssid_set ||
3158                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3159                         return entry;
3160 #ifdef CONFIG_WPS
3161                 if (!wpas_network_disabled(wpa_s, entry) &&
3162                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3163                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3164                     (!entry->bssid_set ||
3165                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3166                         return entry;
3167 #endif /* CONFIG_WPS */
3168
3169                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3170                     entry->ssid_len == 0 &&
3171                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3172                         return entry;
3173
3174                 entry = entry->next;
3175         }
3176
3177         return NULL;
3178 }
3179
3180
3181 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3182 {
3183         struct wpa_global *global = wpa_s->global;
3184
3185         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3186                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3187                 if (global->drv_priv[i] == NULL) {
3188                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3189                                    "'%s'", wpa_drivers[i]->name);
3190                         return -1;
3191                 }
3192         }
3193
3194         wpa_s->driver = wpa_drivers[i];
3195         wpa_s->global_drv_priv = global->drv_priv[i];
3196
3197         return 0;
3198 }
3199
3200
3201 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3202                                      const char *name)
3203 {
3204         int i;
3205         size_t len;
3206         const char *pos, *driver = name;
3207
3208         if (wpa_s == NULL)
3209                 return -1;
3210
3211         if (wpa_drivers[0] == NULL) {
3212                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3213                         "wpa_supplicant");
3214                 return -1;
3215         }
3216
3217         if (name == NULL) {
3218                 /* default to first driver in the list */
3219                 return select_driver(wpa_s, 0);
3220         }
3221
3222         do {
3223                 pos = os_strchr(driver, ',');
3224                 if (pos)
3225                         len = pos - driver;
3226                 else
3227                         len = os_strlen(driver);
3228
3229                 for (i = 0; wpa_drivers[i]; i++) {
3230                         if (os_strlen(wpa_drivers[i]->name) == len &&
3231                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3232                             0) {
3233                                 /* First driver that succeeds wins */
3234                                 if (select_driver(wpa_s, i) == 0)
3235                                         return 0;
3236                         }
3237                 }
3238
3239                 driver = pos + 1;
3240         } while (pos);
3241
3242         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3243         return -1;
3244 }
3245
3246
3247 /**
3248  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3249  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3250  *      with struct wpa_driver_ops::init()
3251  * @src_addr: Source address of the EAPOL frame
3252  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3253  * @len: Length of the EAPOL data
3254  *
3255  * This function is called for each received EAPOL frame. Most driver
3256  * interfaces rely on more generic OS mechanism for receiving frames through
3257  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3258  * take care of received EAPOL frames and deliver them to the core supplicant
3259  * code by calling this function.
3260  */
3261 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3262                              const u8 *buf, size_t len)
3263 {
3264         struct wpa_supplicant *wpa_s = ctx;
3265
3266         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3267         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3268
3269 #ifdef CONFIG_PEERKEY
3270         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3271             wpa_s->current_ssid->peerkey &&
3272             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3273             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3274                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3275                 return;
3276         }
3277 #endif /* CONFIG_PEERKEY */
3278
3279         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3280             (wpa_s->last_eapol_matches_bssid &&
3281 #ifdef CONFIG_AP
3282              !wpa_s->ap_iface &&
3283 #endif /* CONFIG_AP */
3284              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3285                 /*
3286                  * There is possible race condition between receiving the
3287                  * association event and the EAPOL frame since they are coming
3288                  * through different paths from the driver. In order to avoid
3289                  * issues in trying to process the EAPOL frame before receiving
3290                  * association information, lets queue it for processing until
3291                  * the association event is received. This may also be needed in
3292                  * driver-based roaming case, so also use src_addr != BSSID as a
3293                  * trigger if we have previously confirmed that the
3294                  * Authenticator uses BSSID as the src_addr (which is not the
3295                  * case with wired IEEE 802.1X).
3296                  */
3297                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3298                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3299                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3300                         MAC2STR(wpa_s->bssid));
3301                 wpabuf_free(wpa_s->pending_eapol_rx);
3302                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3303                 if (wpa_s->pending_eapol_rx) {
3304                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3305                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3306                                   ETH_ALEN);
3307                 }
3308                 return;
3309         }
3310
3311         wpa_s->last_eapol_matches_bssid =
3312                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3313
3314 #ifdef CONFIG_AP
3315         if (wpa_s->ap_iface) {
3316                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3317                 return;
3318         }
3319 #endif /* CONFIG_AP */
3320
3321         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3322                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3323                         "no key management is configured");
3324                 return;
3325         }
3326
3327         if (wpa_s->eapol_received == 0 &&
3328             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3329              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3330              wpa_s->wpa_state != WPA_COMPLETED) &&
3331             (wpa_s->current_ssid == NULL ||
3332              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3333                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3334                 int timeout = 10;
3335
3336                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3337                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3338                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3339                         /* Use longer timeout for IEEE 802.1X/EAP */
3340                         timeout = 70;
3341                 }
3342
3343 #ifdef CONFIG_WPS
3344                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3345                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3346                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3347                         /*
3348                          * Use shorter timeout if going through WPS AP iteration
3349                          * for PIN config method with an AP that does not
3350                          * advertise Selected Registrar.
3351                          */
3352                         struct wpabuf *wps_ie;
3353
3354                         wps_ie = wpa_bss_get_vendor_ie_multi(
3355                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3356                         if (wps_ie &&
3357                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3358                                 timeout = 10;
3359                         wpabuf_free(wps_ie);
3360                 }
3361 #endif /* CONFIG_WPS */
3362
3363                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3364         }
3365         wpa_s->eapol_received++;
3366
3367         if (wpa_s->countermeasures) {
3368                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3369                         "EAPOL packet");
3370                 return;
3371         }
3372
3373 #ifdef CONFIG_IBSS_RSN
3374         if (wpa_s->current_ssid &&
3375             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3376                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3377                 return;
3378         }
3379 #endif /* CONFIG_IBSS_RSN */
3380
3381         /* Source address of the incoming EAPOL frame could be compared to the
3382          * current BSSID. However, it is possible that a centralized
3383          * Authenticator could be using another MAC address than the BSSID of
3384          * an AP, so just allow any address to be used for now. The replies are
3385          * still sent to the current BSSID (if available), though. */
3386
3387         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3388         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3389             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3390                 return;
3391         wpa_drv_poll(wpa_s);
3392         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3393                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3394         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3395                 /*
3396                  * Set portValid = TRUE here since we are going to skip 4-way
3397                  * handshake processing which would normally set portValid. We
3398                  * need this to allow the EAPOL state machines to be completed
3399                  * without going through EAPOL-Key handshake.
3400                  */
3401                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3402         }
3403 }
3404
3405
3406 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3407 {
3408         if ((!wpa_s->p2p_mgmt ||
3409              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3410             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3411                 l2_packet_deinit(wpa_s->l2);
3412                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3413                                            wpa_drv_get_mac_addr(wpa_s),
3414                                            ETH_P_EAPOL,
3415                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3416                 if (wpa_s->l2 == NULL)
3417                         return -1;
3418         } else {
3419                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3420                 if (addr)
3421                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3422         }
3423
3424         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3425                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3426                 return -1;
3427         }
3428
3429         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3430
3431         return 0;
3432 }
3433
3434
3435 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3436                                            const u8 *buf, size_t len)
3437 {
3438         struct wpa_supplicant *wpa_s = ctx;
3439         const struct l2_ethhdr *eth;
3440
3441         if (len < sizeof(*eth))
3442                 return;
3443         eth = (const struct l2_ethhdr *) buf;
3444
3445         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3446             !(eth->h_dest[0] & 0x01)) {
3447                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3448                         " (bridge - not for this interface - ignore)",
3449                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3450                 return;
3451         }
3452
3453         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3454                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3455         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3456                                 len - sizeof(*eth));
3457 }
3458
3459
3460 /**
3461  * wpa_supplicant_driver_init - Initialize driver interface parameters
3462  * @wpa_s: Pointer to wpa_supplicant data
3463  * Returns: 0 on success, -1 on failure
3464  *
3465  * This function is called to initialize driver interface parameters.
3466  * wpa_drv_init() must have been called before this function to initialize the
3467  * driver interface.
3468  */
3469 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3470 {
3471         static int interface_count = 0;
3472
3473         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3474                 return -1;
3475
3476         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3477                 MAC2STR(wpa_s->own_addr));
3478         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3479         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3480
3481         if (wpa_s->bridge_ifname[0]) {
3482                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3483                         "interface '%s'", wpa_s->bridge_ifname);
3484                 wpa_s->l2_br = l2_packet_init_bridge(
3485                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3486                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3487                 if (wpa_s->l2_br == NULL) {
3488                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3489                                 "connection for the bridge interface '%s'",
3490                                 wpa_s->bridge_ifname);
3491                         return -1;
3492                 }
3493         }
3494
3495         if (wpa_s->conf->ap_scan == 2 &&
3496             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3497                 wpa_printf(MSG_INFO,
3498                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3499         }
3500
3501         wpa_clear_keys(wpa_s, NULL);
3502
3503         /* Make sure that TKIP countermeasures are not left enabled (could
3504          * happen if wpa_supplicant is killed during countermeasures. */
3505         wpa_drv_set_countermeasures(wpa_s, 0);
3506
3507         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3508         wpa_drv_flush_pmkid(wpa_s);
3509
3510         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3511         wpa_s->prev_scan_wildcard = 0;
3512
3513         if (wpa_supplicant_enabled_networks(wpa_s)) {
3514                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3515                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3516                         interface_count = 0;
3517                 }
3518 #ifndef ANDROID
3519                 if (!wpa_s->p2p_mgmt &&
3520                     wpa_supplicant_delayed_sched_scan(wpa_s,
3521                                                       interface_count % 3,
3522                                                       100000))
3523                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3524                                                 100000);
3525 #endif /* ANDROID */
3526                 interface_count++;
3527         } else
3528                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3529
3530         return 0;
3531 }
3532
3533
3534 static int wpa_supplicant_daemon(const char *pid_file)
3535 {
3536         wpa_printf(MSG_DEBUG, "Daemonize..");
3537         return os_daemonize(pid_file);
3538 }
3539
3540
3541 static struct wpa_supplicant *
3542 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3543 {
3544         struct wpa_supplicant *wpa_s;
3545
3546         wpa_s = os_zalloc(sizeof(*wpa_s));
3547         if (wpa_s == NULL)
3548                 return NULL;
3549         wpa_s->scan_req = INITIAL_SCAN_REQ;
3550         wpa_s->scan_interval = 5;
3551         wpa_s->new_connection = 1;
3552         wpa_s->parent = parent ? parent : wpa_s;
3553         wpa_s->p2pdev = wpa_s->parent;
3554         wpa_s->sched_scanning = 0;
3555
3556         dl_list_init(&wpa_s->bss_tmp_disallowed);
3557
3558         return wpa_s;
3559 }
3560
3561
3562 #ifdef CONFIG_HT_OVERRIDES
3563
3564 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3565                              struct ieee80211_ht_capabilities *htcaps,
3566                              struct ieee80211_ht_capabilities *htcaps_mask,
3567                              const char *ht_mcs)
3568 {
3569         /* parse ht_mcs into hex array */
3570         int i;
3571         const char *tmp = ht_mcs;
3572         char *end = NULL;
3573
3574         /* If ht_mcs is null, do not set anything */
3575         if (!ht_mcs)
3576                 return 0;
3577
3578         /* This is what we are setting in the kernel */
3579         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3580
3581         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3582
3583         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3584                 errno = 0;
3585                 long v = strtol(tmp, &end, 16);
3586                 if (errno == 0) {
3587                         wpa_msg(wpa_s, MSG_DEBUG,
3588                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3589                                 i, v, end, tmp);
3590                         if (end == tmp)
3591                                 break;
3592
3593                         htcaps->supported_mcs_set[i] = v;
3594                         tmp = end;
3595                 } else {
3596                         wpa_msg(wpa_s, MSG_ERROR,
3597                                 "Failed to parse ht-mcs: %s, error: %s\n",
3598                                 ht_mcs, strerror(errno));
3599                         return -1;
3600                 }
3601         }
3602
3603         /*
3604          * If we were able to parse any values, then set mask for the MCS set.
3605          */
3606         if (i) {
3607                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3608                           IEEE80211_HT_MCS_MASK_LEN - 1);
3609                 /* skip the 3 reserved bits */
3610                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3611                         0x1f;
3612         }
3613
3614         return 0;
3615 }
3616
3617
3618 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3619                                  struct ieee80211_ht_capabilities *htcaps,
3620                                  struct ieee80211_ht_capabilities *htcaps_mask,
3621                                  int disabled)
3622 {
3623         le16 msk;
3624
3625         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3626
3627         if (disabled == -1)
3628                 return 0;
3629
3630         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3631         htcaps_mask->ht_capabilities_info |= msk;
3632         if (disabled)
3633                 htcaps->ht_capabilities_info &= msk;
3634         else
3635                 htcaps->ht_capabilities_info |= msk;
3636
3637         return 0;
3638 }
3639
3640
3641 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3642                                 struct ieee80211_ht_capabilities *htcaps,
3643                                 struct ieee80211_ht_capabilities *htcaps_mask,
3644                                 int factor)
3645 {
3646         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3647
3648         if (factor == -1)
3649                 return 0;
3650
3651         if (factor < 0 || factor > 3) {
3652                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3653                         "Must be 0-3 or -1", factor);
3654                 return -EINVAL;
3655         }
3656
3657         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3658         htcaps->a_mpdu_params &= ~0x3;
3659         htcaps->a_mpdu_params |= factor & 0x3;
3660
3661         return 0;
3662 }
3663
3664
3665 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3666                                  struct ieee80211_ht_capabilities *htcaps,
3667                                  struct ieee80211_ht_capabilities *htcaps_mask,
3668                                  int density)
3669 {
3670         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3671
3672         if (density == -1)
3673                 return 0;
3674
3675         if (density < 0 || density > 7) {
3676                 wpa_msg(wpa_s, MSG_ERROR,
3677                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3678                         density);
3679                 return -EINVAL;
3680         }
3681
3682         htcaps_mask->a_mpdu_params |= 0x1C;
3683         htcaps->a_mpdu_params &= ~(0x1C);
3684         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3685
3686         return 0;
3687 }
3688
3689
3690 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3691                                 struct ieee80211_ht_capabilities *htcaps,
3692                                 struct ieee80211_ht_capabilities *htcaps_mask,
3693                                 int disabled)
3694 {
3695         /* Masking these out disables HT40 */
3696         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3697                                 HT_CAP_INFO_SHORT_GI40MHZ);
3698
3699         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3700
3701         if (disabled)
3702                 htcaps->ht_capabilities_info &= ~msk;
3703         else
3704                 htcaps->ht_capabilities_info |= msk;
3705
3706         htcaps_mask->ht_capabilities_info |= msk;
3707
3708         return 0;
3709 }
3710
3711
3712 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3713                                struct ieee80211_ht_capabilities *htcaps,
3714                                struct ieee80211_ht_capabilities *htcaps_mask,
3715                                int disabled)
3716 {
3717         /* Masking these out disables SGI */
3718         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3719                                 HT_CAP_INFO_SHORT_GI40MHZ);
3720
3721         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3722
3723         if (disabled)
3724                 htcaps->ht_capabilities_info &= ~msk;
3725         else
3726                 htcaps->ht_capabilities_info |= msk;
3727
3728         htcaps_mask->ht_capabilities_info |= msk;
3729
3730         return 0;
3731 }
3732
3733
3734 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3735                                struct ieee80211_ht_capabilities *htcaps,
3736                                struct ieee80211_ht_capabilities *htcaps_mask,
3737                                int disabled)
3738 {
3739         /* Masking these out disables LDPC */
3740         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3741
3742         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3743
3744         if (disabled)
3745                 htcaps->ht_capabilities_info &= ~msk;
3746         else
3747                 htcaps->ht_capabilities_info |= msk;
3748
3749         htcaps_mask->ht_capabilities_info |= msk;
3750
3751         return 0;
3752 }
3753
3754
3755 void wpa_supplicant_apply_ht_overrides(
3756         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3757         struct wpa_driver_associate_params *params)
3758 {
3759         struct ieee80211_ht_capabilities *htcaps;
3760         struct ieee80211_ht_capabilities *htcaps_mask;
3761
3762         if (!ssid)
3763                 return;
3764
3765         params->disable_ht = ssid->disable_ht;
3766         if (!params->htcaps || !params->htcaps_mask)
3767                 return;
3768
3769         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3770         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3771         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3772         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3773                               ssid->disable_max_amsdu);
3774         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3775         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3776         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3777         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3778         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3779
3780         if (ssid->ht40_intolerant) {
3781                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3782                 htcaps->ht_capabilities_info |= bit;
3783                 htcaps_mask->ht_capabilities_info |= bit;
3784         }
3785 }
3786
3787 #endif /* CONFIG_HT_OVERRIDES */
3788
3789
3790 #ifdef CONFIG_VHT_OVERRIDES
3791 void wpa_supplicant_apply_vht_overrides(
3792         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3793         struct wpa_driver_associate_params *params)
3794 {
3795         struct ieee80211_vht_capabilities *vhtcaps;
3796         struct ieee80211_vht_capabilities *vhtcaps_mask;
3797
3798         if (!ssid)
3799                 return;
3800
3801         params->disable_vht = ssid->disable_vht;
3802
3803         vhtcaps = (void *) params->vhtcaps;
3804         vhtcaps_mask = (void *) params->vhtcaps_mask;
3805
3806         if (!vhtcaps || !vhtcaps_mask)
3807                 return;
3808
3809         vhtcaps->vht_capabilities_info = host_to_le32(ssid->vht_capa);
3810         vhtcaps_mask->vht_capabilities_info = host_to_le32(ssid->vht_capa_mask);
3811
3812 #ifdef CONFIG_HT_OVERRIDES
3813         /* if max ampdu is <= 3, we have to make the HT cap the same */
3814         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3815                 int max_ampdu;
3816
3817                 max_ampdu = (ssid->vht_capa &
3818                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3819                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3820
3821                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3822                 wpa_set_ampdu_factor(wpa_s,
3823                                      (void *) params->htcaps,
3824                                      (void *) params->htcaps_mask,
3825                                      max_ampdu);
3826         }
3827 #endif /* CONFIG_HT_OVERRIDES */
3828
3829 #define OVERRIDE_MCS(i)                                                 \
3830         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3831                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3832                         host_to_le16(3 << 2 * (i - 1));                 \
3833                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3834                         host_to_le16(ssid->vht_tx_mcs_nss_ ##i <<       \
3835                                      2 * (i - 1));                      \
3836         }                                                               \
3837         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3838                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3839                         host_to_le16(3 << 2 * (i - 1));                 \
3840                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3841                         host_to_le16(ssid->vht_rx_mcs_nss_ ##i <<       \
3842                                      2 * (i - 1));                      \
3843         }
3844
3845         OVERRIDE_MCS(1);
3846         OVERRIDE_MCS(2);
3847         OVERRIDE_MCS(3);
3848         OVERRIDE_MCS(4);
3849         OVERRIDE_MCS(5);
3850         OVERRIDE_MCS(6);
3851         OVERRIDE_MCS(7);
3852         OVERRIDE_MCS(8);
3853 }
3854 #endif /* CONFIG_VHT_OVERRIDES */
3855
3856
3857 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3858 {
3859 #ifdef PCSC_FUNCS
3860         size_t len;
3861
3862         if (!wpa_s->conf->pcsc_reader)
3863                 return 0;
3864
3865         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3866         if (!wpa_s->scard)
3867                 return 1;
3868
3869         if (wpa_s->conf->pcsc_pin &&
3870             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3871                 scard_deinit(wpa_s->scard);
3872                 wpa_s->scard = NULL;
3873                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3874                 return -1;
3875         }
3876
3877         len = sizeof(wpa_s->imsi) - 1;
3878         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3879                 scard_deinit(wpa_s->scard);
3880                 wpa_s->scard = NULL;
3881                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3882                 return -1;
3883         }
3884         wpa_s->imsi[len] = '\0';
3885
3886         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3887
3888         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3889                    wpa_s->imsi, wpa_s->mnc_len);
3890
3891         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3892         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3893 #endif /* PCSC_FUNCS */
3894
3895         return 0;
3896 }
3897
3898
3899 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3900 {
3901         char *val, *pos;
3902
3903         ext_password_deinit(wpa_s->ext_pw);
3904         wpa_s->ext_pw = NULL;
3905         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3906
3907         if (!wpa_s->conf->ext_password_backend)
3908                 return 0;
3909
3910         val = os_strdup(wpa_s->conf->ext_password_backend);
3911         if (val == NULL)
3912                 return -1;
3913         pos = os_strchr(val, ':');
3914         if (pos)
3915                 *pos++ = '\0';
3916
3917         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3918
3919         wpa_s->ext_pw = ext_password_init(val, pos);
3920         os_free(val);
3921         if (wpa_s->ext_pw == NULL) {
3922                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3923                 return -1;
3924         }
3925         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3926
3927         return 0;
3928 }
3929
3930
3931 #ifdef CONFIG_FST
3932
3933 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3934 {
3935         struct wpa_supplicant *wpa_s = ctx;
3936
3937         return (is_zero_ether_addr(wpa_s->bssid) ||
3938                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3939 }
3940
3941
3942 static void wpas_fst_get_channel_info_cb(void *ctx,
3943                                          enum hostapd_hw_mode *hw_mode,
3944                                          u8 *channel)
3945 {
3946         struct wpa_supplicant *wpa_s = ctx;
3947
3948         if (wpa_s->current_bss) {
3949                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3950                                                   channel);
3951         } else if (wpa_s->hw.num_modes) {
3952                 *hw_mode = wpa_s->hw.modes[0].mode;
3953         } else {
3954                 WPA_ASSERT(0);
3955                 *hw_mode = 0;
3956         }
3957 }
3958
3959
3960 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3961 {
3962         struct wpa_supplicant *wpa_s = ctx;
3963
3964         *modes = wpa_s->hw.modes;
3965         return wpa_s->hw.num_modes;
3966 }
3967
3968
3969 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3970 {
3971         struct wpa_supplicant *wpa_s = ctx;
3972
3973         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3974         wpa_s->fst_ies = fst_ies;
3975 }
3976
3977
3978 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3979 {
3980         struct wpa_supplicant *wpa_s = ctx;
3981
3982         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3983         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3984                                           wpa_s->own_addr, wpa_s->bssid,
3985                                           wpabuf_head(data), wpabuf_len(data),
3986                                    0);
3987 }
3988
3989
3990 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3991 {
3992         struct wpa_supplicant *wpa_s = ctx;
3993
3994         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3995         return wpa_s->received_mb_ies;
3996 }
3997
3998
3999 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
4000                                      const u8 *buf, size_t size)
4001 {
4002         struct wpa_supplicant *wpa_s = ctx;
4003         struct mb_ies_info info;
4004
4005         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4006
4007         if (!mb_ies_info_by_ies(&info, buf, size)) {
4008                 wpabuf_free(wpa_s->received_mb_ies);
4009                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
4010         }
4011 }
4012
4013
4014 static const u8 * wpas_fst_get_peer_first(void *ctx,
4015                                           struct fst_get_peer_ctx **get_ctx,
4016                                           Boolean mb_only)
4017 {
4018         struct wpa_supplicant *wpa_s = ctx;
4019
4020         *get_ctx = NULL;
4021         if (!is_zero_ether_addr(wpa_s->bssid))
4022                 return (wpa_s->received_mb_ies || !mb_only) ?
4023                         wpa_s->bssid : NULL;
4024         return NULL;
4025 }
4026
4027
4028 static const u8 * wpas_fst_get_peer_next(void *ctx,
4029                                          struct fst_get_peer_ctx **get_ctx,
4030                                          Boolean mb_only)
4031 {
4032         return NULL;
4033 }
4034
4035 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4036                                        struct fst_wpa_obj *iface_obj)
4037 {
4038         iface_obj->ctx              = wpa_s;
4039         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4040         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4041         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4042         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4043         iface_obj->send_action      = wpas_fst_send_action_cb;
4044         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4045         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4046         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4047         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4048 }
4049 #endif /* CONFIG_FST */
4050
4051 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4052                                     const struct wpa_driver_capa *capa)
4053 {
4054         struct wowlan_triggers *triggers;
4055         int ret = 0;
4056
4057         if (!wpa_s->conf->wowlan_triggers)
4058                 return 0;
4059
4060         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4061         if (triggers) {
4062                 ret = wpa_drv_wowlan(wpa_s, triggers);
4063                 os_free(triggers);
4064         }
4065         return ret;
4066 }
4067
4068
4069 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4070 {
4071         if (freq < 3000)
4072                 return BAND_2_4_GHZ;
4073         if (freq > 50000)
4074                 return BAND_60_GHZ;
4075         return BAND_5_GHZ;
4076 }
4077
4078
4079 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4080 {
4081         int i;
4082         unsigned int band = 0;
4083
4084         if (freqs) {
4085                 /* freqs are specified for the radio work */
4086                 for (i = 0; freqs[i]; i++)
4087                         band |= wpas_freq_to_band(freqs[i]);
4088         } else {
4089                 /*
4090                  * freqs are not specified, implies all
4091                  * the supported freqs by HW
4092                  */
4093                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4094                         if (wpa_s->hw.modes[i].num_channels != 0) {
4095                                 if (wpa_s->hw.modes[i].mode ==
4096                                     HOSTAPD_MODE_IEEE80211B ||
4097                                     wpa_s->hw.modes[i].mode ==
4098                                     HOSTAPD_MODE_IEEE80211G)
4099                                         band |= BAND_2_4_GHZ;
4100                                 else if (wpa_s->hw.modes[i].mode ==
4101                                          HOSTAPD_MODE_IEEE80211A)
4102                                         band |= BAND_5_GHZ;
4103                                 else if (wpa_s->hw.modes[i].mode ==
4104                                          HOSTAPD_MODE_IEEE80211AD)
4105                                         band |= BAND_60_GHZ;
4106                                 else if (wpa_s->hw.modes[i].mode ==
4107                                          HOSTAPD_MODE_IEEE80211ANY)
4108                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4109                                                 BAND_60_GHZ;
4110                         }
4111                 }
4112         }
4113
4114         return band;
4115 }
4116
4117
4118 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4119                                               const char *rn)
4120 {
4121         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4122         struct wpa_radio *radio;
4123
4124         while (rn && iface) {
4125                 radio = iface->radio;
4126                 if (radio && os_strcmp(rn, radio->name) == 0) {
4127                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4128                                    wpa_s->ifname, rn);
4129                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4130                         return radio;
4131                 }
4132
4133                 iface = iface->next;
4134         }
4135
4136         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4137                    wpa_s->ifname, rn ? rn : "N/A");
4138         radio = os_zalloc(sizeof(*radio));
4139         if (radio == NULL)
4140                 return NULL;
4141
4142         if (rn)
4143                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4144         dl_list_init(&radio->ifaces);
4145         dl_list_init(&radio->work);
4146         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4147
4148         return radio;
4149 }
4150
4151
4152 static void radio_work_free(struct wpa_radio_work *work)
4153 {
4154         if (work->wpa_s->scan_work == work) {
4155                 /* This should not really happen. */
4156                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4157                         work->type, work, work->started);
4158                 work->wpa_s->scan_work = NULL;
4159         }
4160
4161 #ifdef CONFIG_P2P
4162         if (work->wpa_s->p2p_scan_work == work) {
4163                 /* This should not really happen. */
4164                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4165                         work->type, work, work->started);
4166                 work->wpa_s->p2p_scan_work = NULL;
4167         }
4168 #endif /* CONFIG_P2P */
4169
4170         if (work->started) {
4171                 work->wpa_s->radio->num_active_works--;
4172                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4173                         "radio_work_free('%s'@%p: num_active_works --> %u",
4174                         work->type, work,
4175                         work->wpa_s->radio->num_active_works);
4176         }
4177
4178         dl_list_del(&work->list);
4179         os_free(work);
4180 }
4181
4182
4183 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4184 {
4185         struct wpa_radio_work *active_work = NULL;
4186         struct wpa_radio_work *tmp;
4187
4188         /* Get the active work to know the type and band. */
4189         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4190                 if (tmp->started) {
4191                         active_work = tmp;
4192                         break;
4193                 }
4194         }
4195
4196         if (!active_work) {
4197                 /* No active work, start one */
4198                 radio->num_active_works = 0;
4199                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4200                                  list) {
4201                         if (os_strcmp(tmp->type, "scan") == 0 &&
4202                             radio->external_scan_running &&
4203                             (((struct wpa_driver_scan_params *)
4204                               tmp->ctx)->only_new_results ||
4205                              tmp->wpa_s->clear_driver_scan_cache))
4206                                 continue;
4207                         return tmp;
4208                 }
4209                 return NULL;
4210         }
4211
4212         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4213             os_strcmp(active_work->type, "connect") == 0) {
4214                 /*
4215                  * If the active work is either connect or sme-connect,
4216                  * do not parallelize them with other radio works.
4217                  */
4218                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4219                         "Do not parallelize radio work with %s",
4220                         active_work->type);
4221                 return NULL;
4222         }
4223
4224         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4225                 if (tmp->started)
4226                         continue;
4227
4228                 /*
4229                  * If connect or sme-connect are enqueued, parallelize only
4230                  * those operations ahead of them in the queue.
4231                  */
4232                 if (os_strcmp(tmp->type, "connect") == 0 ||
4233                     os_strcmp(tmp->type, "sme-connect") == 0)
4234                         break;
4235
4236                 /*
4237                  * Check that the radio works are distinct and
4238                  * on different bands.
4239                  */
4240                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4241                     (active_work->bands != tmp->bands)) {
4242                         /*
4243                          * If a scan has to be scheduled through nl80211 scan
4244                          * interface and if an external scan is already running,
4245                          * do not schedule the scan since it is likely to get
4246                          * rejected by kernel.
4247                          */
4248                         if (os_strcmp(tmp->type, "scan") == 0 &&
4249                             radio->external_scan_running &&
4250                             (((struct wpa_driver_scan_params *)
4251                               tmp->ctx)->only_new_results ||
4252                              tmp->wpa_s->clear_driver_scan_cache))
4253                                 continue;
4254
4255                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4256                                 "active_work:%s new_work:%s",
4257                                 active_work->type, tmp->type);
4258                         return tmp;
4259                 }
4260         }
4261
4262         /* Did not find a radio work to schedule in parallel. */
4263         return NULL;
4264 }
4265
4266
4267 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4268 {
4269         struct wpa_radio *radio = eloop_ctx;
4270         struct wpa_radio_work *work;
4271         struct os_reltime now, diff;
4272         struct wpa_supplicant *wpa_s;
4273
4274         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4275         if (work == NULL) {
4276                 radio->num_active_works = 0;
4277                 return;
4278         }
4279
4280         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4281                               radio_list);
4282
4283         if (!(wpa_s &&
4284               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4285                 if (work->started)
4286                         return; /* already started and still in progress */
4287
4288                 if (wpa_s && wpa_s->radio->external_scan_running) {
4289                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4290                         return;
4291                 }
4292         } else {
4293                 work = NULL;
4294                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4295                         /* get the work to schedule next */
4296                         work = radio_work_get_next_work(radio);
4297                 }
4298                 if (!work)
4299                         return;
4300         }
4301
4302         wpa_s = work->wpa_s;
4303         os_get_reltime(&now);
4304         os_reltime_sub(&now, &work->time, &diff);
4305         wpa_dbg(wpa_s, MSG_DEBUG,
4306                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4307                 work->type, work, diff.sec, diff.usec);
4308         work->started = 1;
4309         work->time = now;
4310         radio->num_active_works++;
4311
4312         work->cb(work, 0);
4313
4314         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4315             radio->num_active_works < MAX_ACTIVE_WORKS)
4316                 radio_work_check_next(wpa_s);
4317 }
4318
4319
4320 /*
4321  * This function removes both started and pending radio works running on
4322  * the provided interface's radio.
4323  * Prior to the removal of the radio work, its callback (cb) is called with
4324  * deinit set to be 1. Each work's callback is responsible for clearing its
4325  * internal data and restoring to a correct state.
4326  * @wpa_s: wpa_supplicant data
4327  * @type: type of works to be removed
4328  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4329  * this interface's works.
4330  */
4331 void radio_remove_works(struct wpa_supplicant *wpa_s,
4332                         const char *type, int remove_all)
4333 {
4334         struct wpa_radio_work *work, *tmp;
4335         struct wpa_radio *radio = wpa_s->radio;
4336
4337         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4338                               list) {
4339                 if (type && os_strcmp(type, work->type) != 0)
4340                         continue;
4341
4342                 /* skip other ifaces' works */
4343                 if (!remove_all && work->wpa_s != wpa_s)
4344                         continue;
4345
4346                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4347                         work->type, work, work->started ? " (started)" : "");
4348                 work->cb(work, 1);
4349                 radio_work_free(work);
4350         }
4351
4352         /* in case we removed the started work */
4353         radio_work_check_next(wpa_s);
4354 }
4355
4356
4357 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4358 {
4359         struct wpa_radio *radio = wpa_s->radio;
4360
4361         if (!radio)
4362                 return;
4363
4364         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4365                    wpa_s->ifname, radio->name);
4366         dl_list_del(&wpa_s->radio_list);
4367         radio_remove_works(wpa_s, NULL, 0);
4368         wpa_s->radio = NULL;
4369         if (!dl_list_empty(&radio->ifaces))
4370                 return; /* Interfaces remain for this radio */
4371
4372         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4373         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4374         os_free(radio);
4375 }
4376
4377
4378 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4379 {
4380         struct wpa_radio *radio = wpa_s->radio;
4381
4382         if (dl_list_empty(&radio->work))
4383                 return;
4384         if (wpa_s->ext_work_in_progress) {
4385                 wpa_printf(MSG_DEBUG,
4386                            "External radio work in progress - delay start of pending item");
4387                 return;
4388         }
4389         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4390         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4391 }
4392
4393
4394 /**
4395  * radio_add_work - Add a radio work item
4396  * @wpa_s: Pointer to wpa_supplicant data
4397  * @freq: Frequency of the offchannel operation in MHz or 0
4398  * @type: Unique identifier for each type of work
4399  * @next: Force as the next work to be executed
4400  * @cb: Callback function for indicating when radio is available
4401  * @ctx: Context pointer for the work (work->ctx in cb())
4402  * Returns: 0 on success, -1 on failure
4403  *
4404  * This function is used to request time for an operation that requires
4405  * exclusive radio control. Once the radio is available, the registered callback
4406  * function will be called. radio_work_done() must be called once the exclusive
4407  * radio operation has been completed, so that the radio is freed for other
4408  * operations. The special case of deinit=1 is used to free the context data
4409  * during interface removal. That does not allow the callback function to start
4410  * the radio operation, i.e., it must free any resources allocated for the radio
4411  * work and return.
4412  *
4413  * The @freq parameter can be used to indicate a single channel on which the
4414  * offchannel operation will occur. This may allow multiple radio work
4415  * operations to be performed in parallel if they apply for the same channel.
4416  * Setting this to 0 indicates that the work item may use multiple channels or
4417  * requires exclusive control of the radio.
4418  */
4419 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4420                    const char *type, int next,
4421                    void (*cb)(struct wpa_radio_work *work, int deinit),
4422                    void *ctx)
4423 {
4424         struct wpa_radio *radio = wpa_s->radio;
4425         struct wpa_radio_work *work;
4426         int was_empty;
4427
4428         work = os_zalloc(sizeof(*work));
4429         if (work == NULL)
4430                 return -1;
4431         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4432         os_get_reltime(&work->time);
4433         work->freq = freq;
4434         work->type = type;
4435         work->wpa_s = wpa_s;
4436         work->cb = cb;
4437         work->ctx = ctx;
4438
4439         if (freq)
4440                 work->bands = wpas_freq_to_band(freq);
4441         else if (os_strcmp(type, "scan") == 0 ||
4442                  os_strcmp(type, "p2p-scan") == 0)
4443                 work->bands = wpas_get_bands(wpa_s,
4444                                              ((struct wpa_driver_scan_params *)
4445                                               ctx)->freqs);
4446         else
4447                 work->bands = wpas_get_bands(wpa_s, NULL);
4448
4449         was_empty = dl_list_empty(&wpa_s->radio->work);
4450         if (next)
4451                 dl_list_add(&wpa_s->radio->work, &work->list);
4452         else
4453                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4454         if (was_empty) {
4455                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4456                 radio_work_check_next(wpa_s);
4457         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4458                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4459                 wpa_dbg(wpa_s, MSG_DEBUG,
4460                         "Try to schedule a radio work (num_active_works=%u)",
4461                         radio->num_active_works);
4462                 radio_work_check_next(wpa_s);
4463         }
4464
4465         return 0;
4466 }
4467
4468
4469 /**
4470  * radio_work_done - Indicate that a radio work item has been completed
4471  * @work: Completed work
4472  *
4473  * This function is called once the callback function registered with
4474  * radio_add_work() has completed its work.
4475  */
4476 void radio_work_done(struct wpa_radio_work *work)
4477 {
4478         struct wpa_supplicant *wpa_s = work->wpa_s;
4479         struct os_reltime now, diff;
4480         unsigned int started = work->started;
4481
4482         os_get_reltime(&now);
4483         os_reltime_sub(&now, &work->time, &diff);
4484         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4485                 work->type, work, started ? "done" : "canceled",
4486                 diff.sec, diff.usec);
4487         radio_work_free(work);
4488         if (started)
4489                 radio_work_check_next(wpa_s);
4490 }
4491
4492
4493 struct wpa_radio_work *
4494 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4495 {
4496         struct wpa_radio_work *work;
4497         struct wpa_radio *radio = wpa_s->radio;
4498
4499         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4500                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4501                         return work;
4502         }
4503
4504         return NULL;
4505 }
4506
4507
4508 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4509                             struct wpa_interface *iface)
4510 {
4511         const char *ifname, *driver, *rn;
4512
4513         driver = iface->driver;
4514 next_driver:
4515         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4516                 return -1;
4517
4518         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4519         if (wpa_s->drv_priv == NULL) {
4520                 const char *pos;
4521                 pos = driver ? os_strchr(driver, ',') : NULL;
4522                 if (pos) {
4523                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4524                                 "driver interface - try next driver wrapper");
4525                         driver = pos + 1;
4526                         goto next_driver;
4527                 }
4528                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4529                         "interface");
4530                 return -1;
4531         }
4532         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4533                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4534                         "driver_param '%s'", wpa_s->conf->driver_param);
4535                 return -1;
4536         }
4537
4538         ifname = wpa_drv_get_ifname(wpa_s);
4539         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4540                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4541                         "interface name with '%s'", ifname);
4542                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4543         }
4544
4545         rn = wpa_driver_get_radio_name(wpa_s);
4546         if (rn && rn[0] == '\0')
4547                 rn = NULL;
4548
4549         wpa_s->radio = radio_add_interface(wpa_s, rn);
4550         if (wpa_s->radio == NULL)
4551                 return -1;
4552
4553         return 0;
4554 }
4555
4556
4557 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4558                                      struct wpa_interface *iface)
4559 {
4560         struct wpa_driver_capa capa;
4561         int capa_res;
4562
4563         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4564                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4565                    iface->confname ? iface->confname : "N/A",
4566                    iface->driver ? iface->driver : "default",
4567                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4568                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4569
4570         if (iface->confname) {
4571 #ifdef CONFIG_BACKEND_FILE
4572                 wpa_s->confname = os_rel2abs_path(iface->confname);
4573                 if (wpa_s->confname == NULL) {
4574                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4575                                    "for configuration file '%s'.",
4576                                    iface->confname);
4577                         return -1;
4578                 }
4579                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4580                            iface->confname, wpa_s->confname);
4581 #else /* CONFIG_BACKEND_FILE */
4582                 wpa_s->confname = os_strdup(iface->confname);
4583 #endif /* CONFIG_BACKEND_FILE */
4584                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4585                 if (wpa_s->conf == NULL) {
4586                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4587                                    "configuration '%s'.", wpa_s->confname);
4588                         return -1;
4589                 }
4590                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4591                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4592
4593                 /*
4594                  * Override ctrl_interface and driver_param if set on command
4595                  * line.
4596                  */
4597                 if (iface->ctrl_interface) {
4598                         os_free(wpa_s->conf->ctrl_interface);
4599                         wpa_s->conf->ctrl_interface =
4600                                 os_strdup(iface->ctrl_interface);
4601                 }
4602
4603                 if (iface->driver_param) {
4604                         os_free(wpa_s->conf->driver_param);
4605                         wpa_s->conf->driver_param =
4606                                 os_strdup(iface->driver_param);
4607                 }
4608
4609                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4610                         os_free(wpa_s->conf->ctrl_interface);
4611                         wpa_s->conf->ctrl_interface = NULL;
4612                 }
4613         } else
4614                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4615                                                      iface->driver_param);
4616
4617         if (wpa_s->conf == NULL) {
4618                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4619                 return -1;
4620         }
4621
4622         if (iface->ifname == NULL) {
4623                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4624                 return -1;
4625         }
4626         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4627                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4628                            iface->ifname);
4629                 return -1;
4630         }
4631         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4632
4633         if (iface->bridge_ifname) {
4634                 if (os_strlen(iface->bridge_ifname) >=
4635                     sizeof(wpa_s->bridge_ifname)) {
4636                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4637                                    "name '%s'.", iface->bridge_ifname);
4638                         return -1;
4639                 }
4640                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4641                            sizeof(wpa_s->bridge_ifname));
4642         }
4643
4644         /* RSNA Supplicant Key Management - INITIALIZE */
4645         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4646         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4647
4648         /* Initialize driver interface and register driver event handler before
4649          * L2 receive handler so that association events are processed before
4650          * EAPOL-Key packets if both become available for the same select()
4651          * call. */
4652         if (wpas_init_driver(wpa_s, iface) < 0)
4653                 return -1;
4654
4655         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4656                 return -1;
4657
4658         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4659                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4660                           NULL);
4661         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4662
4663         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4664             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4665                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4666                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4667                         "dot11RSNAConfigPMKLifetime");
4668                 return -1;
4669         }
4670
4671         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4672             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4673                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4674                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4675                         "dot11RSNAConfigPMKReauthThreshold");
4676                 return -1;
4677         }
4678
4679         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4680             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4681                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4682                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4683                         "dot11RSNAConfigSATimeout");
4684                 return -1;
4685         }
4686
4687         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4688                                                       &wpa_s->hw.num_modes,
4689                                                       &wpa_s->hw.flags);
4690         if (wpa_s->hw.modes) {
4691                 u16 i;
4692
4693                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4694                         if (wpa_s->hw.modes[i].vht_capab) {
4695                                 wpa_s->hw_capab = CAPAB_VHT;
4696                                 break;
4697                         }
4698
4699                         if (wpa_s->hw.modes[i].ht_capab &
4700                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4701                                 wpa_s->hw_capab = CAPAB_HT40;
4702                         else if (wpa_s->hw.modes[i].ht_capab &&
4703                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4704                                 wpa_s->hw_capab = CAPAB_HT;
4705                 }
4706         }
4707
4708         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4709         if (capa_res == 0) {
4710                 wpa_s->drv_capa_known = 1;
4711                 wpa_s->drv_flags = capa.flags;
4712                 wpa_s->drv_enc = capa.enc;
4713                 wpa_s->drv_smps_modes = capa.smps_modes;
4714                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4715                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4716                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4717                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4718                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4719                 wpa_s->max_sched_scan_plan_interval =
4720                         capa.max_sched_scan_plan_interval;
4721                 wpa_s->max_sched_scan_plan_iterations =
4722                         capa.max_sched_scan_plan_iterations;
4723                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4724                 wpa_s->max_match_sets = capa.max_match_sets;
4725                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4726                 wpa_s->max_stations = capa.max_stations;
4727                 wpa_s->extended_capa = capa.extended_capa;
4728                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4729                 wpa_s->extended_capa_len = capa.extended_capa_len;
4730                 wpa_s->num_multichan_concurrent =
4731                         capa.num_multichan_concurrent;
4732                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4733
4734                 if (capa.mac_addr_rand_scan_supported)
4735                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4736                 if (wpa_s->sched_scan_supported &&
4737                     capa.mac_addr_rand_sched_scan_supported)
4738                         wpa_s->mac_addr_rand_supported |=
4739                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4740         }
4741         if (wpa_s->max_remain_on_chan == 0)
4742                 wpa_s->max_remain_on_chan = 1000;
4743
4744         /*
4745          * Only take p2p_mgmt parameters when P2P Device is supported.
4746          * Doing it here as it determines whether l2_packet_init() will be done
4747          * during wpa_supplicant_driver_init().
4748          */
4749         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4750                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4751         else
4752                 iface->p2p_mgmt = 1;
4753
4754         if (wpa_s->num_multichan_concurrent == 0)
4755                 wpa_s->num_multichan_concurrent = 1;
4756
4757         if (wpa_supplicant_driver_init(wpa_s) < 0)
4758                 return -1;
4759
4760 #ifdef CONFIG_TDLS
4761         if ((!iface->p2p_mgmt ||
4762              !(wpa_s->drv_flags &
4763                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4764             wpa_tdls_init(wpa_s->wpa))
4765                 return -1;
4766 #endif /* CONFIG_TDLS */
4767
4768         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4769             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4770                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4771                 return -1;
4772         }
4773
4774 #ifdef CONFIG_FST
4775         if (wpa_s->conf->fst_group_id) {
4776                 struct fst_iface_cfg cfg;
4777                 struct fst_wpa_obj iface_obj;
4778
4779                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4780                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4781                            sizeof(cfg.group_id));
4782                 cfg.priority = wpa_s->conf->fst_priority;
4783                 cfg.llt = wpa_s->conf->fst_llt;
4784
4785                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4786                                         &iface_obj, &cfg);
4787                 if (!wpa_s->fst) {
4788                         wpa_msg(wpa_s, MSG_ERROR,
4789                                 "FST: Cannot attach iface %s to group %s",
4790                                 wpa_s->ifname, cfg.group_id);
4791                         return -1;
4792                 }
4793         }
4794 #endif /* CONFIG_FST */
4795
4796         if (wpas_wps_init(wpa_s))
4797                 return -1;
4798
4799         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4800                 return -1;
4801         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4802
4803         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4804         if (wpa_s->ctrl_iface == NULL) {
4805                 wpa_printf(MSG_ERROR,
4806                            "Failed to initialize control interface '%s'.\n"
4807                            "You may have another wpa_supplicant process "
4808                            "already running or the file was\n"
4809                            "left by an unclean termination of wpa_supplicant "
4810                            "in which case you will need\n"
4811                            "to manually remove this file before starting "
4812                            "wpa_supplicant again.\n",
4813                            wpa_s->conf->ctrl_interface);
4814                 return -1;
4815         }
4816
4817         wpa_s->gas = gas_query_init(wpa_s);
4818         if (wpa_s->gas == NULL) {
4819                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4820                 return -1;
4821         }
4822
4823         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4824                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4825                 return -1;
4826         }
4827
4828         if (wpa_bss_init(wpa_s) < 0)
4829                 return -1;
4830
4831         /*
4832          * Set Wake-on-WLAN triggers, if configured.
4833          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4834          * have effect anyway when the interface is down).
4835          */
4836         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4837                 return -1;
4838
4839 #ifdef CONFIG_EAP_PROXY
4840 {
4841         size_t len;
4842         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4843                                                      &len);
4844         if (wpa_s->mnc_len > 0) {
4845                 wpa_s->imsi[len] = '\0';
4846                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4847                            wpa_s->imsi, wpa_s->mnc_len);
4848         } else {
4849                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4850         }
4851 }
4852 #endif /* CONFIG_EAP_PROXY */
4853
4854         if (pcsc_reader_init(wpa_s) < 0)
4855                 return -1;
4856
4857         if (wpas_init_ext_pw(wpa_s) < 0)
4858                 return -1;
4859
4860         wpas_rrm_reset(wpa_s);
4861
4862         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4863
4864 #ifdef CONFIG_HS20
4865         hs20_init(wpa_s);
4866 #endif /* CONFIG_HS20 */
4867 #ifdef CONFIG_MBO
4868         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4869 #endif /* CONFIG_MBO */
4870
4871         return 0;
4872 }
4873
4874
4875 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4876                                         int notify, int terminate)
4877 {
4878         struct wpa_global *global = wpa_s->global;
4879         struct wpa_supplicant *iface, *prev;
4880
4881         if (wpa_s == wpa_s->parent)
4882                 wpas_p2p_group_remove(wpa_s, "*");
4883
4884         iface = global->ifaces;
4885         while (iface) {
4886                 if (iface->p2pdev == wpa_s)
4887                         iface->p2pdev = iface->parent;
4888                 if (iface == wpa_s || iface->parent != wpa_s) {
4889                         iface = iface->next;
4890                         continue;
4891                 }
4892                 wpa_printf(MSG_DEBUG,
4893                            "Remove remaining child interface %s from parent %s",
4894                            iface->ifname, wpa_s->ifname);
4895                 prev = iface;
4896                 iface = iface->next;
4897                 wpa_supplicant_remove_iface(global, prev, terminate);
4898         }
4899
4900         wpa_s->disconnected = 1;
4901         if (wpa_s->drv_priv) {
4902                 wpa_supplicant_deauthenticate(wpa_s,
4903                                               WLAN_REASON_DEAUTH_LEAVING);
4904
4905                 wpa_drv_set_countermeasures(wpa_s, 0);
4906                 wpa_clear_keys(wpa_s, NULL);
4907         }
4908
4909         wpa_supplicant_cleanup(wpa_s);
4910         wpas_p2p_deinit_iface(wpa_s);
4911
4912         wpas_ctrl_radio_work_flush(wpa_s);
4913         radio_remove_interface(wpa_s);
4914
4915 #ifdef CONFIG_FST
4916         if (wpa_s->fst) {
4917                 fst_detach(wpa_s->fst);
4918                 wpa_s->fst = NULL;
4919         }
4920         if (wpa_s->received_mb_ies) {
4921                 wpabuf_free(wpa_s->received_mb_ies);
4922                 wpa_s->received_mb_ies = NULL;
4923         }
4924 #endif /* CONFIG_FST */
4925
4926         if (wpa_s->drv_priv)
4927                 wpa_drv_deinit(wpa_s);
4928
4929         if (notify)
4930                 wpas_notify_iface_removed(wpa_s);
4931
4932         if (terminate)
4933                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4934
4935         if (wpa_s->ctrl_iface) {
4936                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4937                 wpa_s->ctrl_iface = NULL;
4938         }
4939
4940 #ifdef CONFIG_MESH
4941         if (wpa_s->ifmsh) {
4942                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4943                 wpa_s->ifmsh = NULL;
4944         }
4945 #endif /* CONFIG_MESH */
4946
4947         if (wpa_s->conf != NULL) {
4948                 wpa_config_free(wpa_s->conf);
4949                 wpa_s->conf = NULL;
4950         }
4951
4952         os_free(wpa_s->ssids_from_scan_req);
4953
4954         os_free(wpa_s);
4955 }
4956
4957
4958 #ifdef CONFIG_MATCH_IFACE
4959
4960 /**
4961  * wpa_supplicant_match_iface - Match an interface description to a name
4962  * @global: Pointer to global data from wpa_supplicant_init()
4963  * @ifname: Name of the interface to match
4964  * Returns: Pointer to the created interface description or %NULL on failure
4965  */
4966 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
4967                                                   const char *ifname)
4968 {
4969         int i;
4970         struct wpa_interface *iface, *miface;
4971
4972         for (i = 0; i < global->params.match_iface_count; i++) {
4973                 miface = &global->params.match_ifaces[i];
4974                 if (!miface->ifname ||
4975                     fnmatch(miface->ifname, ifname, 0) == 0) {
4976                         iface = os_zalloc(sizeof(*iface));
4977                         if (!iface)
4978                                 return NULL;
4979                         *iface = *miface;
4980                         iface->ifname = ifname;
4981                         return iface;
4982                 }
4983         }
4984
4985         return NULL;
4986 }
4987
4988
4989 /**
4990  * wpa_supplicant_match_existing - Match existing interfaces
4991  * @global: Pointer to global data from wpa_supplicant_init()
4992  * Returns: 0 on success, -1 on failure
4993  */
4994 static int wpa_supplicant_match_existing(struct wpa_global *global)
4995 {
4996         struct if_nameindex *ifi, *ifp;
4997         struct wpa_supplicant *wpa_s;
4998         struct wpa_interface *iface;
4999
5000         ifp = if_nameindex();
5001         if (!ifp) {
5002                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
5003                 return -1;
5004         }
5005
5006         for (ifi = ifp; ifi->if_name; ifi++) {
5007                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
5008                 if (wpa_s)
5009                         continue;
5010                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
5011                 if (iface) {
5012                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
5013                         os_free(iface);
5014                         if (wpa_s)
5015                                 wpa_s->matched = 1;
5016                 }
5017         }
5018
5019         if_freenameindex(ifp);
5020         return 0;
5021 }
5022
5023 #endif /* CONFIG_MATCH_IFACE */
5024
5025
5026 /**
5027  * wpa_supplicant_add_iface - Add a new network interface
5028  * @global: Pointer to global data from wpa_supplicant_init()
5029  * @iface: Interface configuration options
5030  * @parent: Parent interface or %NULL to assign new interface as parent
5031  * Returns: Pointer to the created interface or %NULL on failure
5032  *
5033  * This function is used to add new network interfaces for %wpa_supplicant.
5034  * This can be called before wpa_supplicant_run() to add interfaces before the
5035  * main event loop has been started. In addition, new interfaces can be added
5036  * dynamically while %wpa_supplicant is already running. This could happen,
5037  * e.g., when a hotplug network adapter is inserted.
5038  */
5039 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5040                                                  struct wpa_interface *iface,
5041                                                  struct wpa_supplicant *parent)
5042 {
5043         struct wpa_supplicant *wpa_s;
5044         struct wpa_interface t_iface;
5045         struct wpa_ssid *ssid;
5046
5047         if (global == NULL || iface == NULL)
5048                 return NULL;
5049
5050         wpa_s = wpa_supplicant_alloc(parent);
5051         if (wpa_s == NULL)
5052                 return NULL;
5053
5054         wpa_s->global = global;
5055
5056         t_iface = *iface;
5057         if (global->params.override_driver) {
5058                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5059                            "('%s' -> '%s')",
5060                            iface->driver, global->params.override_driver);
5061                 t_iface.driver = global->params.override_driver;
5062         }
5063         if (global->params.override_ctrl_interface) {
5064                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5065                            "ctrl_interface ('%s' -> '%s')",
5066                            iface->ctrl_interface,
5067                            global->params.override_ctrl_interface);
5068                 t_iface.ctrl_interface =
5069                         global->params.override_ctrl_interface;
5070         }
5071         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5072                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5073                            iface->ifname);
5074                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5075                 return NULL;
5076         }
5077
5078         if (iface->p2p_mgmt == 0) {
5079                 /* Notify the control interfaces about new iface */
5080                 if (wpas_notify_iface_added(wpa_s)) {
5081                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5082                         return NULL;
5083                 }
5084
5085                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5086                         wpas_notify_network_added(wpa_s, ssid);
5087         }
5088
5089         wpa_s->next = global->ifaces;
5090         global->ifaces = wpa_s;
5091
5092         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5093         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5094
5095 #ifdef CONFIG_P2P
5096         if (wpa_s->global->p2p == NULL &&
5097             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5098             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5099             wpas_p2p_add_p2pdev_interface(
5100                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5101                 wpa_printf(MSG_INFO,
5102                            "P2P: Failed to enable P2P Device interface");
5103                 /* Try to continue without. P2P will be disabled. */
5104         }
5105 #endif /* CONFIG_P2P */
5106
5107         return wpa_s;
5108 }
5109
5110
5111 /**
5112  * wpa_supplicant_remove_iface - Remove a network interface
5113  * @global: Pointer to global data from wpa_supplicant_init()
5114  * @wpa_s: Pointer to the network interface to be removed
5115  * Returns: 0 if interface was removed, -1 if interface was not found
5116  *
5117  * This function can be used to dynamically remove network interfaces from
5118  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5119  * addition, this function is used to remove all remaining interfaces when
5120  * %wpa_supplicant is terminated.
5121  */
5122 int wpa_supplicant_remove_iface(struct wpa_global *global,
5123                                 struct wpa_supplicant *wpa_s,
5124                                 int terminate)
5125 {
5126         struct wpa_supplicant *prev;
5127 #ifdef CONFIG_MESH
5128         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5129         char *ifname = NULL;
5130 #endif /* CONFIG_MESH */
5131
5132         /* Remove interface from the global list of interfaces */
5133         prev = global->ifaces;
5134         if (prev == wpa_s) {
5135                 global->ifaces = wpa_s->next;
5136         } else {
5137                 while (prev && prev->next != wpa_s)
5138                         prev = prev->next;
5139                 if (prev == NULL)
5140                         return -1;
5141                 prev->next = wpa_s->next;
5142         }
5143
5144         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5145
5146 #ifdef CONFIG_MESH
5147         if (mesh_if_created) {
5148                 ifname = os_strdup(wpa_s->ifname);
5149                 if (ifname == NULL) {
5150                         wpa_dbg(wpa_s, MSG_ERROR,
5151                                 "mesh: Failed to malloc ifname");
5152                         return -1;
5153                 }
5154         }
5155 #endif /* CONFIG_MESH */
5156
5157         if (global->p2p_group_formation == wpa_s)
5158                 global->p2p_group_formation = NULL;
5159         if (global->p2p_invite_group == wpa_s)
5160                 global->p2p_invite_group = NULL;
5161         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5162
5163 #ifdef CONFIG_MESH
5164         if (mesh_if_created) {
5165                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5166                 os_free(ifname);
5167         }
5168 #endif /* CONFIG_MESH */
5169
5170         return 0;
5171 }
5172
5173
5174 /**
5175  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5176  * @wpa_s: Pointer to the network interface
5177  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5178  */
5179 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5180 {
5181         const char *eapol_method;
5182
5183         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5184             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5185                 return "NO-EAP";
5186         }
5187
5188         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5189         if (eapol_method == NULL)
5190                 return "UNKNOWN-EAP";
5191
5192         return eapol_method;
5193 }
5194
5195
5196 /**
5197  * wpa_supplicant_get_iface - Get a new network interface
5198  * @global: Pointer to global data from wpa_supplicant_init()
5199  * @ifname: Interface name
5200  * Returns: Pointer to the interface or %NULL if not found
5201  */
5202 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5203                                                  const char *ifname)
5204 {
5205         struct wpa_supplicant *wpa_s;
5206
5207         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5208                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5209                         return wpa_s;
5210         }
5211         return NULL;
5212 }
5213
5214
5215 #ifndef CONFIG_NO_WPA_MSG
5216 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5217 {
5218         struct wpa_supplicant *wpa_s = ctx;
5219         if (wpa_s == NULL)
5220                 return NULL;
5221         return wpa_s->ifname;
5222 }
5223 #endif /* CONFIG_NO_WPA_MSG */
5224
5225
5226 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5227 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5228 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5229
5230 /* Periodic cleanup tasks */
5231 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5232 {
5233         struct wpa_global *global = eloop_ctx;
5234         struct wpa_supplicant *wpa_s;
5235
5236         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5237                                wpas_periodic, global, NULL);
5238
5239 #ifdef CONFIG_P2P
5240         if (global->p2p)
5241                 p2p_expire_peers(global->p2p);
5242 #endif /* CONFIG_P2P */
5243
5244         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5245                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5246 #ifdef CONFIG_AP
5247                 ap_periodic(wpa_s);
5248 #endif /* CONFIG_AP */
5249         }
5250 }
5251
5252
5253 /**
5254  * wpa_supplicant_init - Initialize %wpa_supplicant
5255  * @params: Parameters for %wpa_supplicant
5256  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5257  *
5258  * This function is used to initialize %wpa_supplicant. After successful
5259  * initialization, the returned data pointer can be used to add and remove
5260  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5261  */
5262 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5263 {
5264         struct wpa_global *global;
5265         int ret, i;
5266
5267         if (params == NULL)
5268                 return NULL;
5269
5270 #ifdef CONFIG_DRIVER_NDIS
5271         {
5272                 void driver_ndis_init_ops(void);
5273                 driver_ndis_init_ops();
5274         }
5275 #endif /* CONFIG_DRIVER_NDIS */
5276
5277 #ifndef CONFIG_NO_WPA_MSG
5278         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5279 #endif /* CONFIG_NO_WPA_MSG */
5280
5281         if (params->wpa_debug_file_path)
5282                 wpa_debug_open_file(params->wpa_debug_file_path);
5283         else
5284                 wpa_debug_setup_stdout();
5285         if (params->wpa_debug_syslog)
5286                 wpa_debug_open_syslog();
5287         if (params->wpa_debug_tracing) {
5288                 ret = wpa_debug_open_linux_tracing();
5289                 if (ret) {
5290                         wpa_printf(MSG_ERROR,
5291                                    "Failed to enable trace logging");
5292                         return NULL;
5293                 }
5294         }
5295
5296         ret = eap_register_methods();
5297         if (ret) {
5298                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5299                 if (ret == -2)
5300                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5301                                    "the same EAP type.");
5302                 return NULL;
5303         }
5304
5305         global = os_zalloc(sizeof(*global));
5306         if (global == NULL)
5307                 return NULL;
5308         dl_list_init(&global->p2p_srv_bonjour);
5309         dl_list_init(&global->p2p_srv_upnp);
5310         global->params.daemonize = params->daemonize;
5311         global->params.wait_for_monitor = params->wait_for_monitor;
5312         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5313         if (params->pid_file)
5314                 global->params.pid_file = os_strdup(params->pid_file);
5315         if (params->ctrl_interface)
5316                 global->params.ctrl_interface =
5317                         os_strdup(params->ctrl_interface);
5318         if (params->ctrl_interface_group)
5319                 global->params.ctrl_interface_group =
5320                         os_strdup(params->ctrl_interface_group);
5321         if (params->override_driver)
5322                 global->params.override_driver =
5323                         os_strdup(params->override_driver);
5324         if (params->override_ctrl_interface)
5325                 global->params.override_ctrl_interface =
5326                         os_strdup(params->override_ctrl_interface);
5327 #ifdef CONFIG_MATCH_IFACE
5328         global->params.match_iface_count = params->match_iface_count;
5329         if (params->match_iface_count) {
5330                 global->params.match_ifaces =
5331                         os_calloc(params->match_iface_count,
5332                                   sizeof(struct wpa_interface));
5333                 os_memcpy(global->params.match_ifaces,
5334                           params->match_ifaces,
5335                           params->match_iface_count *
5336                           sizeof(struct wpa_interface));
5337         }
5338 #endif /* CONFIG_MATCH_IFACE */
5339 #ifdef CONFIG_P2P
5340         if (params->conf_p2p_dev)
5341                 global->params.conf_p2p_dev =
5342                         os_strdup(params->conf_p2p_dev);
5343 #endif /* CONFIG_P2P */
5344         wpa_debug_level = global->params.wpa_debug_level =
5345                 params->wpa_debug_level;
5346         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5347                 params->wpa_debug_show_keys;
5348         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5349                 params->wpa_debug_timestamp;
5350
5351         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5352
5353         if (eloop_init()) {
5354                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5355                 wpa_supplicant_deinit(global);
5356                 return NULL;
5357         }
5358
5359         random_init(params->entropy_file);
5360
5361         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5362         if (global->ctrl_iface == NULL) {
5363                 wpa_supplicant_deinit(global);
5364                 return NULL;
5365         }
5366
5367         if (wpas_notify_supplicant_initialized(global)) {
5368                 wpa_supplicant_deinit(global);
5369                 return NULL;
5370         }
5371
5372         for (i = 0; wpa_drivers[i]; i++)
5373                 global->drv_count++;
5374         if (global->drv_count == 0) {
5375                 wpa_printf(MSG_ERROR, "No drivers enabled");
5376                 wpa_supplicant_deinit(global);
5377                 return NULL;
5378         }
5379         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5380         if (global->drv_priv == NULL) {
5381                 wpa_supplicant_deinit(global);
5382                 return NULL;
5383         }
5384
5385 #ifdef CONFIG_WIFI_DISPLAY
5386         if (wifi_display_init(global) < 0) {
5387                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5388                 wpa_supplicant_deinit(global);
5389                 return NULL;
5390         }
5391 #endif /* CONFIG_WIFI_DISPLAY */
5392
5393         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5394                                wpas_periodic, global, NULL);
5395
5396         return global;
5397 }
5398
5399
5400 /**
5401  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5402  * @global: Pointer to global data from wpa_supplicant_init()
5403  * Returns: 0 after successful event loop run, -1 on failure
5404  *
5405  * This function starts the main event loop and continues running as long as
5406  * there are any remaining events. In most cases, this function is running as
5407  * long as the %wpa_supplicant process in still in use.
5408  */
5409 int wpa_supplicant_run(struct wpa_global *global)
5410 {
5411         struct wpa_supplicant *wpa_s;
5412
5413         if (global->params.daemonize &&
5414             (wpa_supplicant_daemon(global->params.pid_file) ||
5415              eloop_sock_requeue()))
5416                 return -1;
5417
5418 #ifdef CONFIG_MATCH_IFACE
5419         if (wpa_supplicant_match_existing(global))
5420                 return -1;
5421 #endif
5422
5423         if (global->params.wait_for_monitor) {
5424                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5425                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5426                                 wpa_supplicant_ctrl_iface_wait(
5427                                         wpa_s->ctrl_iface);
5428         }
5429
5430         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5431         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5432
5433         eloop_run();
5434
5435         return 0;
5436 }
5437
5438
5439 /**
5440  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5441  * @global: Pointer to global data from wpa_supplicant_init()
5442  *
5443  * This function is called to deinitialize %wpa_supplicant and to free all
5444  * allocated resources. Remaining network interfaces will also be removed.
5445  */
5446 void wpa_supplicant_deinit(struct wpa_global *global)
5447 {
5448         int i;
5449
5450         if (global == NULL)
5451                 return;
5452
5453         eloop_cancel_timeout(wpas_periodic, global, NULL);
5454
5455 #ifdef CONFIG_WIFI_DISPLAY
5456         wifi_display_deinit(global);
5457 #endif /* CONFIG_WIFI_DISPLAY */
5458
5459         while (global->ifaces)
5460                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5461
5462         if (global->ctrl_iface)
5463                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5464
5465         wpas_notify_supplicant_deinitialized(global);
5466
5467         eap_peer_unregister_methods();
5468 #ifdef CONFIG_AP
5469         eap_server_unregister_methods();
5470 #endif /* CONFIG_AP */
5471
5472         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5473                 if (!global->drv_priv[i])
5474                         continue;
5475                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5476         }
5477         os_free(global->drv_priv);
5478
5479         random_deinit();
5480
5481         eloop_destroy();
5482
5483         if (global->params.pid_file) {
5484                 os_daemonize_terminate(global->params.pid_file);
5485                 os_free(global->params.pid_file);
5486         }
5487         os_free(global->params.ctrl_interface);
5488         os_free(global->params.ctrl_interface_group);
5489         os_free(global->params.override_driver);
5490         os_free(global->params.override_ctrl_interface);
5491 #ifdef CONFIG_MATCH_IFACE
5492         os_free(global->params.match_ifaces);
5493 #endif /* CONFIG_MATCH_IFACE */
5494 #ifdef CONFIG_P2P
5495         os_free(global->params.conf_p2p_dev);
5496 #endif /* CONFIG_P2P */
5497
5498         os_free(global->p2p_disallow_freq.range);
5499         os_free(global->p2p_go_avoid_freq.range);
5500         os_free(global->add_psk);
5501
5502         os_free(global);
5503         wpa_debug_close_syslog();
5504         wpa_debug_close_file();
5505         wpa_debug_close_linux_tracing();
5506 }
5507
5508
5509 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5510 {
5511         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5512             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5513                 char country[3];
5514                 country[0] = wpa_s->conf->country[0];
5515                 country[1] = wpa_s->conf->country[1];
5516                 country[2] = '\0';
5517                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5518                         wpa_printf(MSG_ERROR, "Failed to set country code "
5519                                    "'%s'", country);
5520                 }
5521         }
5522
5523         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5524                 wpas_init_ext_pw(wpa_s);
5525
5526         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5527                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5528
5529 #ifdef CONFIG_WPS
5530         wpas_wps_update_config(wpa_s);
5531 #endif /* CONFIG_WPS */
5532         wpas_p2p_update_config(wpa_s);
5533         wpa_s->conf->changed_parameters = 0;
5534 }
5535
5536
5537 void add_freq(int *freqs, int *num_freqs, int freq)
5538 {
5539         int i;
5540
5541         for (i = 0; i < *num_freqs; i++) {
5542                 if (freqs[i] == freq)
5543                         return;
5544         }
5545
5546         freqs[*num_freqs] = freq;
5547         (*num_freqs)++;
5548 }
5549
5550
5551 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5552 {
5553         struct wpa_bss *bss, *cbss;
5554         const int max_freqs = 10;
5555         int *freqs;
5556         int num_freqs = 0;
5557
5558         freqs = os_calloc(max_freqs + 1, sizeof(int));
5559         if (freqs == NULL)
5560                 return NULL;
5561
5562         cbss = wpa_s->current_bss;
5563
5564         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5565                 if (bss == cbss)
5566                         continue;
5567                 if (bss->ssid_len == cbss->ssid_len &&
5568                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5569                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5570                         add_freq(freqs, &num_freqs, bss->freq);
5571                         if (num_freqs == max_freqs)
5572                                 break;
5573                 }
5574         }
5575
5576         if (num_freqs == 0) {
5577                 os_free(freqs);
5578                 freqs = NULL;
5579         }
5580
5581         return freqs;
5582 }
5583
5584
5585 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5586 {
5587         int timeout;
5588         int count;
5589         int *freqs = NULL;
5590
5591         wpas_connect_work_done(wpa_s);
5592
5593         /*
5594          * Remove possible authentication timeout since the connection failed.
5595          */
5596         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5597
5598         /*
5599          * There is no point in blacklisting the AP if this event is
5600          * generated based on local request to disconnect.
5601          */
5602         if (wpa_s->own_disconnect_req) {
5603                 wpa_s->own_disconnect_req = 0;
5604                 wpa_dbg(wpa_s, MSG_DEBUG,
5605                         "Ignore connection failure due to local request to disconnect");
5606                 return;
5607         }
5608         if (wpa_s->disconnected) {
5609                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5610                         "indication since interface has been put into "
5611                         "disconnected state");
5612                 return;
5613         }
5614
5615         /*
5616          * Add the failed BSSID into the blacklist and speed up next scan
5617          * attempt if there could be other APs that could accept association.
5618          * The current blacklist count indicates how many times we have tried
5619          * connecting to this AP and multiple attempts mean that other APs are
5620          * either not available or has already been tried, so that we can start
5621          * increasing the delay here to avoid constant scanning.
5622          */
5623         count = wpa_blacklist_add(wpa_s, bssid);
5624         if (count == 1 && wpa_s->current_bss) {
5625                 /*
5626                  * This BSS was not in the blacklist before. If there is
5627                  * another BSS available for the same ESS, we should try that
5628                  * next. Otherwise, we may as well try this one once more
5629                  * before allowing other, likely worse, ESSes to be considered.
5630                  */
5631                 freqs = get_bss_freqs_in_ess(wpa_s);
5632                 if (freqs) {
5633                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5634                                 "has been seen; try it next");
5635                         wpa_blacklist_add(wpa_s, bssid);
5636                         /*
5637                          * On the next scan, go through only the known channels
5638                          * used in this ESS based on previous scans to speed up
5639                          * common load balancing use case.
5640                          */
5641                         os_free(wpa_s->next_scan_freqs);
5642                         wpa_s->next_scan_freqs = freqs;
5643                 }
5644         }
5645
5646         /*
5647          * Add previous failure count in case the temporary blacklist was
5648          * cleared due to no other BSSes being available.
5649          */
5650         count += wpa_s->extra_blacklist_count;
5651
5652         if (count > 3 && wpa_s->current_ssid) {
5653                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5654                            "consider temporary network disabling");
5655                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5656         }
5657
5658         switch (count) {
5659         case 1:
5660                 timeout = 100;
5661                 break;
5662         case 2:
5663                 timeout = 500;
5664                 break;
5665         case 3:
5666                 timeout = 1000;
5667                 break;
5668         case 4:
5669                 timeout = 5000;
5670                 break;
5671         default:
5672                 timeout = 10000;
5673                 break;
5674         }
5675
5676         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5677                 "ms", count, timeout);
5678
5679         /*
5680          * TODO: if more than one possible AP is available in scan results,
5681          * could try the other ones before requesting a new scan.
5682          */
5683         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5684                                 1000 * (timeout % 1000));
5685 }
5686
5687
5688 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5689 {
5690         return wpa_s->conf->ap_scan == 2 ||
5691                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5692 }
5693
5694
5695 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5696 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5697                                               struct wpa_ssid *ssid,
5698                                               const char *field,
5699                                               const char *value)
5700 {
5701 #ifdef IEEE8021X_EAPOL
5702         struct eap_peer_config *eap = &ssid->eap;
5703
5704         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5705         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5706                               (const u8 *) value, os_strlen(value));
5707
5708         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5709         case WPA_CTRL_REQ_EAP_IDENTITY:
5710                 os_free(eap->identity);
5711                 eap->identity = (u8 *) os_strdup(value);
5712                 eap->identity_len = os_strlen(value);
5713                 eap->pending_req_identity = 0;
5714                 if (ssid == wpa_s->current_ssid)
5715                         wpa_s->reassociate = 1;
5716                 break;
5717         case WPA_CTRL_REQ_EAP_PASSWORD:
5718                 bin_clear_free(eap->password, eap->password_len);
5719                 eap->password = (u8 *) os_strdup(value);
5720                 eap->password_len = os_strlen(value);
5721                 eap->pending_req_password = 0;
5722                 if (ssid == wpa_s->current_ssid)
5723                         wpa_s->reassociate = 1;
5724                 break;
5725         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5726                 bin_clear_free(eap->new_password, eap->new_password_len);
5727                 eap->new_password = (u8 *) os_strdup(value);
5728                 eap->new_password_len = os_strlen(value);
5729                 eap->pending_req_new_password = 0;
5730                 if (ssid == wpa_s->current_ssid)
5731                         wpa_s->reassociate = 1;
5732                 break;
5733         case WPA_CTRL_REQ_EAP_PIN:
5734                 str_clear_free(eap->pin);
5735                 eap->pin = os_strdup(value);
5736                 eap->pending_req_pin = 0;
5737                 if (ssid == wpa_s->current_ssid)
5738                         wpa_s->reassociate = 1;
5739                 break;
5740         case WPA_CTRL_REQ_EAP_OTP:
5741                 bin_clear_free(eap->otp, eap->otp_len);
5742                 eap->otp = (u8 *) os_strdup(value);
5743                 eap->otp_len = os_strlen(value);
5744                 os_free(eap->pending_req_otp);
5745                 eap->pending_req_otp = NULL;
5746                 eap->pending_req_otp_len = 0;
5747                 break;
5748         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5749                 str_clear_free(eap->private_key_passwd);
5750                 eap->private_key_passwd = os_strdup(value);
5751                 eap->pending_req_passphrase = 0;
5752                 if (ssid == wpa_s->current_ssid)
5753                         wpa_s->reassociate = 1;
5754                 break;
5755         case WPA_CTRL_REQ_SIM:
5756                 str_clear_free(eap->external_sim_resp);
5757                 eap->external_sim_resp = os_strdup(value);
5758                 break;
5759         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5760                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5761                         return -1;
5762                 ssid->mem_only_psk = 1;
5763                 if (ssid->passphrase)
5764                         wpa_config_update_psk(ssid);
5765                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5766                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5767                 break;
5768         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5769                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5770                         return -1;
5771                 if (os_strcmp(value, "good") == 0)
5772                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5773                 else if (os_strcmp(value, "bad") == 0)
5774                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5775                 else
5776                         return -1;
5777                 break;
5778         default:
5779                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5780                 return -1;
5781         }
5782
5783         return 0;
5784 #else /* IEEE8021X_EAPOL */
5785         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5786         return -1;
5787 #endif /* IEEE8021X_EAPOL */
5788 }
5789 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5790
5791
5792 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5793 {
5794         int i;
5795         unsigned int drv_enc;
5796
5797         if (wpa_s->p2p_mgmt)
5798                 return 1; /* no normal network profiles on p2p_mgmt interface */
5799
5800         if (ssid == NULL)
5801                 return 1;
5802
5803         if (ssid->disabled)
5804                 return 1;
5805
5806         if (wpa_s->drv_capa_known)
5807                 drv_enc = wpa_s->drv_enc;
5808         else
5809                 drv_enc = (unsigned int) -1;
5810
5811         for (i = 0; i < NUM_WEP_KEYS; i++) {
5812                 size_t len = ssid->wep_key_len[i];
5813                 if (len == 0)
5814                         continue;
5815                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5816                         continue;
5817                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5818                         continue;
5819                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5820                         continue;
5821                 return 1; /* invalid WEP key */
5822         }
5823
5824         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5825             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5826             !ssid->mem_only_psk)
5827                 return 1;
5828
5829         return 0;
5830 }
5831
5832
5833 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5834 {
5835 #ifdef CONFIG_IEEE80211W
5836         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5837                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5838                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5839                         /*
5840                          * Driver does not support BIP -- ignore pmf=1 default
5841                          * since the connection with PMF would fail and the
5842                          * configuration does not require PMF to be enabled.
5843                          */
5844                         return NO_MGMT_FRAME_PROTECTION;
5845                 }
5846
5847                 if (ssid &&
5848                     (ssid->key_mgmt &
5849                      ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
5850                        WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
5851                         /*
5852                          * Do not use the default PMF value for non-RSN networks
5853                          * since PMF is available only with RSN and pmf=2
5854                          * configuration would otherwise prevent connections to
5855                          * all open networks.
5856                          */
5857                         return NO_MGMT_FRAME_PROTECTION;
5858                 }
5859
5860                 return wpa_s->conf->pmf;
5861         }
5862
5863         return ssid->ieee80211w;
5864 #else /* CONFIG_IEEE80211W */
5865         return NO_MGMT_FRAME_PROTECTION;
5866 #endif /* CONFIG_IEEE80211W */
5867 }
5868
5869
5870 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5871 {
5872         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5873                 return 1;
5874         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5875                 return 0;
5876         return -1;
5877 }
5878
5879
5880 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5881 {
5882         struct wpa_ssid *ssid = wpa_s->current_ssid;
5883         int dur;
5884         struct os_reltime now;
5885
5886         if (ssid == NULL) {
5887                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5888                            "SSID block");
5889                 return;
5890         }
5891
5892         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5893                 return;
5894
5895         ssid->auth_failures++;
5896
5897 #ifdef CONFIG_P2P
5898         if (ssid->p2p_group &&
5899             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5900                 /*
5901                  * Skip the wait time since there is a short timeout on the
5902                  * connection to a P2P group.
5903                  */
5904                 return;
5905         }
5906 #endif /* CONFIG_P2P */
5907
5908         if (ssid->auth_failures > 50)
5909                 dur = 300;
5910         else if (ssid->auth_failures > 10)
5911                 dur = 120;
5912         else if (ssid->auth_failures > 5)
5913                 dur = 90;
5914         else if (ssid->auth_failures > 3)
5915                 dur = 60;
5916         else if (ssid->auth_failures > 2)
5917                 dur = 30;
5918         else if (ssid->auth_failures > 1)
5919                 dur = 20;
5920         else
5921                 dur = 10;
5922
5923         if (ssid->auth_failures > 1 &&
5924             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5925                 dur += os_random() % (ssid->auth_failures * 10);
5926
5927         os_get_reltime(&now);
5928         if (now.sec + dur <= ssid->disabled_until.sec)
5929                 return;
5930
5931         ssid->disabled_until.sec = now.sec + dur;
5932
5933         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5934                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5935                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5936                 ssid->auth_failures, dur, reason);
5937 }
5938
5939
5940 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5941                               struct wpa_ssid *ssid, int clear_failures)
5942 {
5943         if (ssid == NULL)
5944                 return;
5945
5946         if (ssid->disabled_until.sec) {
5947                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5948                         "id=%d ssid=\"%s\"",
5949                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5950         }
5951         ssid->disabled_until.sec = 0;
5952         ssid->disabled_until.usec = 0;
5953         if (clear_failures)
5954                 ssid->auth_failures = 0;
5955 }
5956
5957
5958 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5959 {
5960         size_t i;
5961
5962         if (wpa_s->disallow_aps_bssid == NULL)
5963                 return 0;
5964
5965         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5966                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5967                               bssid, ETH_ALEN) == 0)
5968                         return 1;
5969         }
5970
5971         return 0;
5972 }
5973
5974
5975 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5976                     size_t ssid_len)
5977 {
5978         size_t i;
5979
5980         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5981                 return 0;
5982
5983         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5984                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5985                 if (ssid_len == s->ssid_len &&
5986                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5987                         return 1;
5988         }
5989
5990         return 0;
5991 }
5992
5993
5994 /**
5995  * wpas_request_connection - Request a new connection
5996  * @wpa_s: Pointer to the network interface
5997  *
5998  * This function is used to request a new connection to be found. It will mark
5999  * the interface to allow reassociation and request a new scan to find a
6000  * suitable network to connect to.
6001  */
6002 void wpas_request_connection(struct wpa_supplicant *wpa_s)
6003 {
6004         wpa_s->normal_scans = 0;
6005         wpa_s->scan_req = NORMAL_SCAN_REQ;
6006         wpa_supplicant_reinit_autoscan(wpa_s);
6007         wpa_s->extra_blacklist_count = 0;
6008         wpa_s->disconnected = 0;
6009         wpa_s->reassociate = 1;
6010
6011         if (wpa_supplicant_fast_associate(wpa_s) != 1)
6012                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6013         else
6014                 wpa_s->reattach = 0;
6015 }
6016
6017
6018 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
6019                     struct wpa_used_freq_data *freqs_data,
6020                     unsigned int len)
6021 {
6022         unsigned int i;
6023
6024         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
6025                 len, title);
6026         for (i = 0; i < len; i++) {
6027                 struct wpa_used_freq_data *cur = &freqs_data[i];
6028                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
6029                         i, cur->freq, cur->flags);
6030         }
6031 }
6032
6033
6034 /*
6035  * Find the operating frequencies of any of the virtual interfaces that
6036  * are using the same radio as the current interface, and in addition, get
6037  * information about the interface types that are using the frequency.
6038  */
6039 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6040                                 struct wpa_used_freq_data *freqs_data,
6041                                 unsigned int len)
6042 {
6043         struct wpa_supplicant *ifs;
6044         u8 bssid[ETH_ALEN];
6045         int freq;
6046         unsigned int idx = 0, i;
6047
6048         wpa_dbg(wpa_s, MSG_DEBUG,
6049                 "Determining shared radio frequencies (max len %u)", len);
6050         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6051
6052         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6053                          radio_list) {
6054                 if (idx == len)
6055                         break;
6056
6057                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6058                         continue;
6059
6060                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6061                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6062                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6063                         freq = ifs->current_ssid->frequency;
6064                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6065                         freq = ifs->assoc_freq;
6066                 else
6067                         continue;
6068
6069                 /* Hold only distinct freqs */
6070                 for (i = 0; i < idx; i++)
6071                         if (freqs_data[i].freq == freq)
6072                                 break;
6073
6074                 if (i == idx)
6075                         freqs_data[idx++].freq = freq;
6076
6077                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6078                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6079                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6080                                 WPA_FREQ_USED_BY_INFRA_STATION;
6081                 }
6082         }
6083
6084         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6085         return idx;
6086 }
6087
6088
6089 /*
6090  * Find the operating frequencies of any of the virtual interfaces that
6091  * are using the same radio as the current interface.
6092  */
6093 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6094                            int *freq_array, unsigned int len)
6095 {
6096         struct wpa_used_freq_data *freqs_data;
6097         int num, i;
6098
6099         os_memset(freq_array, 0, sizeof(int) * len);
6100
6101         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6102         if (!freqs_data)
6103                 return -1;
6104
6105         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6106         for (i = 0; i < num; i++)
6107                 freq_array[i] = freqs_data[i].freq;
6108
6109         os_free(freqs_data);
6110
6111         return num;
6112 }
6113
6114
6115 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6116 {
6117         struct rrm_data *rrm = data;
6118
6119         if (!rrm->notify_neighbor_rep) {
6120                 wpa_printf(MSG_ERROR,
6121                            "RRM: Unexpected neighbor report timeout");
6122                 return;
6123         }
6124
6125         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6126         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6127
6128         rrm->notify_neighbor_rep = NULL;
6129         rrm->neighbor_rep_cb_ctx = NULL;
6130 }
6131
6132
6133 /*
6134  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6135  * @wpa_s: Pointer to wpa_supplicant
6136  */
6137 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6138 {
6139         wpa_s->rrm.rrm_used = 0;
6140
6141         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6142                              NULL);
6143         if (wpa_s->rrm.notify_neighbor_rep)
6144                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6145         wpa_s->rrm.next_neighbor_rep_token = 1;
6146 }
6147
6148
6149 /*
6150  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6151  * @wpa_s: Pointer to wpa_supplicant
6152  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6153  * @report_len: Length of neighbor report buffer
6154  */
6155 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6156                                    const u8 *report, size_t report_len)
6157 {
6158         struct wpabuf *neighbor_rep;
6159
6160         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6161         if (report_len < 1)
6162                 return;
6163
6164         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6165                 wpa_printf(MSG_DEBUG,
6166                            "RRM: Discarding neighbor report with token %d (expected %d)",
6167                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6168                 return;
6169         }
6170
6171         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6172                              NULL);
6173
6174         if (!wpa_s->rrm.notify_neighbor_rep) {
6175                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6176                 return;
6177         }
6178
6179         /* skipping the first byte, which is only an id (dialog token) */
6180         neighbor_rep = wpabuf_alloc(report_len - 1);
6181         if (neighbor_rep == NULL)
6182                 return;
6183         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6184         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6185                    report[0]);
6186         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6187                                        neighbor_rep);
6188         wpa_s->rrm.notify_neighbor_rep = NULL;
6189         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6190 }
6191
6192
6193 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6194 /* Workaround different, undefined for Windows, error codes used here */
6195 #define ENOTCONN -1
6196 #define EOPNOTSUPP -1
6197 #define ECANCELED -1
6198 #endif
6199
6200 /* Measurement Request element + Location Subject + Maximum Age subelement */
6201 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
6202 /* Measurement Request element + Location Civic Request */
6203 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
6204
6205
6206 /**
6207  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6208  * @wpa_s: Pointer to wpa_supplicant
6209  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6210  *        is sent in the request.
6211  * @lci: if set, neighbor request will include LCI request
6212  * @civic: if set, neighbor request will include civic location request
6213  * @cb: Callback function to be called once the requested report arrives, or
6214  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6215  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6216  *      the requester's responsibility to free it.
6217  *      In the latter case NULL will be sent in 'neighbor_rep'.
6218  * @cb_ctx: Context value to send the callback function
6219  * Returns: 0 in case of success, negative error code otherwise
6220  *
6221  * In case there is a previous request which has not been answered yet, the
6222  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6223  * Request must contain a callback function.
6224  */
6225 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6226                                        const struct wpa_ssid_value *ssid,
6227                                        int lci, int civic,
6228                                        void (*cb)(void *ctx,
6229                                                   struct wpabuf *neighbor_rep),
6230                                        void *cb_ctx)
6231 {
6232         struct wpabuf *buf;
6233         const u8 *rrm_ie;
6234
6235         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6236                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6237                 return -ENOTCONN;
6238         }
6239
6240         if (!wpa_s->rrm.rrm_used) {
6241                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6242                 return -EOPNOTSUPP;
6243         }
6244
6245         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6246                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6247         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6248             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6249                 wpa_printf(MSG_DEBUG,
6250                            "RRM: No network support for Neighbor Report.");
6251                 return -EOPNOTSUPP;
6252         }
6253
6254         if (!cb) {
6255                 wpa_printf(MSG_DEBUG,
6256                            "RRM: Neighbor Report request must provide a callback.");
6257                 return -EINVAL;
6258         }
6259
6260         /* Refuse if there's a live request */
6261         if (wpa_s->rrm.notify_neighbor_rep) {
6262                 wpa_printf(MSG_DEBUG,
6263                            "RRM: Currently handling previous Neighbor Report.");
6264                 return -EBUSY;
6265         }
6266
6267         /* 3 = action category + action code + dialog token */
6268         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
6269                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
6270                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
6271         if (buf == NULL) {
6272                 wpa_printf(MSG_DEBUG,
6273                            "RRM: Failed to allocate Neighbor Report Request");
6274                 return -ENOMEM;
6275         }
6276
6277         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6278                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6279                    wpa_s->rrm.next_neighbor_rep_token);
6280
6281         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6282         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6283         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6284         if (ssid) {
6285                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6286                 wpabuf_put_u8(buf, ssid->ssid_len);
6287                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6288         }
6289
6290         if (lci) {
6291                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6292                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6293                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
6294
6295                 /*
6296                  * Measurement token; nonzero number that is unique among the
6297                  * Measurement Request elements in a particular frame.
6298                  */
6299                 wpabuf_put_u8(buf, 1); /* Measurement Token */
6300
6301                 /*
6302                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6303                  * reserved.
6304                  */
6305                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6306                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
6307
6308                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
6309                 /* Location Subject */
6310                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6311
6312                 /* Optional Subelements */
6313                 /*
6314                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
6315                  * The Maximum Age subelement is required, otherwise the AP can
6316                  * send only data that was determined after receiving the
6317                  * request. Setting it here to unlimited age.
6318                  */
6319                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
6320                 wpabuf_put_u8(buf, 2);
6321                 wpabuf_put_le16(buf, 0xffff);
6322         }
6323
6324         if (civic) {
6325                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6326                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6327                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
6328
6329                 /*
6330                  * Measurement token; nonzero number that is unique among the
6331                  * Measurement Request elements in a particular frame.
6332                  */
6333                 wpabuf_put_u8(buf, 2); /* Measurement Token */
6334
6335                 /*
6336                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6337                  * reserved.
6338                  */
6339                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6340                 /* Measurement Type */
6341                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
6342
6343                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
6344                  * Location Civic request */
6345                 /* Location Subject */
6346                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6347                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
6348                 /* Location Service Interval Units: Seconds */
6349                 wpabuf_put_u8(buf, 0);
6350                 /* Location Service Interval: 0 - Only one report is requested
6351                  */
6352                 wpabuf_put_le16(buf, 0);
6353                 /* No optional subelements */
6354         }
6355
6356         wpa_s->rrm.next_neighbor_rep_token++;
6357
6358         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6359                                 wpa_s->own_addr, wpa_s->bssid,
6360                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6361                 wpa_printf(MSG_DEBUG,
6362                            "RRM: Failed to send Neighbor Report Request");
6363                 wpabuf_free(buf);
6364                 return -ECANCELED;
6365         }
6366
6367         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6368         wpa_s->rrm.notify_neighbor_rep = cb;
6369         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6370                                wpas_rrm_neighbor_rep_timeout_handler,
6371                                &wpa_s->rrm, NULL);
6372
6373         wpabuf_free(buf);
6374         return 0;
6375 }
6376
6377
6378 static struct wpabuf * wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
6379                                                  const u8 *request, size_t len,
6380                                                  struct wpabuf *report)
6381 {
6382         u8 token, type, subject;
6383         u16 max_age = 0;
6384         struct os_reltime t, diff;
6385         unsigned long diff_l;
6386         u8 *ptoken;
6387         const u8 *subelem;
6388
6389         if (!wpa_s->lci || len < 3 + 4)
6390                 return report;
6391
6392         token = *request++;
6393         /* Measurement request mode isn't used */
6394         request++;
6395         type = *request++;
6396         subject = *request++;
6397
6398         wpa_printf(MSG_DEBUG,
6399                    "Measurement request token %u type %u location subject %u",
6400                    token, type, subject);
6401
6402         if (type != MEASURE_TYPE_LCI || subject != LOCATION_SUBJECT_REMOTE) {
6403                 wpa_printf(MSG_INFO,
6404                            "Not building LCI report - bad type or location subject");
6405                 return report;
6406         }
6407
6408         /* Subelements are formatted exactly like elements */
6409         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
6410         if (subelem && subelem[1] == 2)
6411                 max_age = WPA_GET_LE16(subelem + 2);
6412
6413         if (os_get_reltime(&t))
6414                 return report;
6415
6416         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
6417         /* LCI age is calculated in 10th of a second units. */
6418         diff_l = diff.sec * 10 + diff.usec / 100000;
6419
6420         if (max_age != 0xffff && max_age < diff_l)
6421                 return report;
6422
6423         if (wpabuf_resize(&report, 2 + wpabuf_len(wpa_s->lci)))
6424                 return report;
6425
6426         wpabuf_put_u8(report, WLAN_EID_MEASURE_REPORT);
6427         wpabuf_put_u8(report, wpabuf_len(wpa_s->lci));
6428         /* We'll override user's measurement token */
6429         ptoken = wpabuf_put(report, 0);
6430         wpabuf_put_buf(report, wpa_s->lci);
6431         *ptoken = token;
6432
6433         return report;
6434 }
6435
6436
6437 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
6438                                                const u8 *src,
6439                                                const u8 *frame, size_t len)
6440 {
6441         struct wpabuf *buf, *report;
6442         u8 token;
6443         const u8 *ie, *end;
6444
6445         if (wpa_s->wpa_state != WPA_COMPLETED) {
6446                 wpa_printf(MSG_INFO,
6447                            "RRM: Ignoring radio measurement request: Not associated");
6448                 return;
6449         }
6450
6451         if (!wpa_s->rrm.rrm_used) {
6452                 wpa_printf(MSG_INFO,
6453                            "RRM: Ignoring radio measurement request: Not RRM network");
6454                 return;
6455         }
6456
6457         if (len < 3) {
6458                 wpa_printf(MSG_INFO,
6459                            "RRM: Ignoring too short radio measurement request");
6460                 return;
6461         }
6462
6463         end = frame + len;
6464
6465         token = *frame++;
6466
6467         /* Ignore number of repetitions because it's not used in LCI request */
6468         frame += 2;
6469
6470         report = NULL;
6471         while ((ie = get_ie(frame, end - frame, WLAN_EID_MEASURE_REQUEST)) &&
6472                ie[1] >= 3) {
6473                 u8 msmt_type;
6474
6475                 msmt_type = ie[4];
6476                 wpa_printf(MSG_DEBUG, "RRM request %d", msmt_type);
6477
6478                 switch (msmt_type) {
6479                 case MEASURE_TYPE_LCI:
6480                         report = wpas_rrm_build_lci_report(wpa_s, ie + 2, ie[1],
6481                                                            report);
6482                         break;
6483                 default:
6484                         wpa_printf(MSG_INFO,
6485                                    "RRM: Unsupported radio measurement request %d",
6486                                    msmt_type);
6487                         break;
6488                 }
6489
6490                 frame = ie + ie[1] + 2;
6491         }
6492
6493         if (!report)
6494                 return;
6495
6496         buf = wpabuf_alloc(3 + wpabuf_len(report));
6497         if (!buf) {
6498                 wpabuf_free(report);
6499                 return;
6500         }
6501
6502         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6503         wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
6504         wpabuf_put_u8(buf, token);
6505
6506         wpabuf_put_buf(buf, report);
6507         wpabuf_free(report);
6508
6509         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6510                                 wpa_s->own_addr, wpa_s->bssid,
6511                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6512                 wpa_printf(MSG_ERROR,
6513                            "RRM: Radio measurement report failed: Sending Action frame failed");
6514         }
6515         wpabuf_free(buf);
6516 }
6517
6518
6519 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6520                                               const u8 *src,
6521                                               const u8 *frame, size_t len,
6522                                               int rssi)
6523 {
6524         struct wpabuf *buf;
6525         const struct rrm_link_measurement_request *req;
6526         struct rrm_link_measurement_report report;
6527
6528         if (wpa_s->wpa_state != WPA_COMPLETED) {
6529                 wpa_printf(MSG_INFO,
6530                            "RRM: Ignoring link measurement request. Not associated");
6531                 return;
6532         }
6533
6534         if (!wpa_s->rrm.rrm_used) {
6535                 wpa_printf(MSG_INFO,
6536                            "RRM: Ignoring link measurement request. Not RRM network");
6537                 return;
6538         }
6539
6540         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6541                 wpa_printf(MSG_INFO,
6542                            "RRM: Measurement report failed. TX power insertion not supported");
6543                 return;
6544         }
6545
6546         req = (const struct rrm_link_measurement_request *) frame;
6547         if (len < sizeof(*req)) {
6548                 wpa_printf(MSG_INFO,
6549                            "RRM: Link measurement report failed. Request too short");
6550                 return;
6551         }
6552
6553         os_memset(&report, 0, sizeof(report));
6554         report.tpc.eid = WLAN_EID_TPC_REPORT;
6555         report.tpc.len = 2;
6556         report.rsni = 255; /* 255 indicates that RSNI is not available */
6557         report.dialog_token = req->dialog_token;
6558
6559         /*
6560          * It's possible to estimate RCPI based on RSSI in dBm. This
6561          * calculation will not reflect the correct value for high rates,
6562          * but it's good enough for Action frames which are transmitted
6563          * with up to 24 Mbps rates.
6564          */
6565         if (!rssi)
6566                 report.rcpi = 255; /* not available */
6567         else if (rssi < -110)
6568                 report.rcpi = 0;
6569         else if (rssi > 0)
6570                 report.rcpi = 220;
6571         else
6572                 report.rcpi = (rssi + 110) * 2;
6573
6574         /* action_category + action_code */
6575         buf = wpabuf_alloc(2 + sizeof(report));
6576         if (buf == NULL) {
6577                 wpa_printf(MSG_ERROR,
6578                            "RRM: Link measurement report failed. Buffer allocation failed");
6579                 return;
6580         }
6581
6582         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6583         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6584         wpabuf_put_data(buf, &report, sizeof(report));
6585         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6586                     wpabuf_head(buf), wpabuf_len(buf));
6587
6588         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6589                                 wpa_s->own_addr, wpa_s->bssid,
6590                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6591                 wpa_printf(MSG_ERROR,
6592                            "RRM: Link measurement report failed. Send action failed");
6593         }
6594         wpabuf_free(buf);
6595 }
6596
6597
6598 struct wpa_supplicant *
6599 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6600 {
6601         switch (frame) {
6602 #ifdef CONFIG_P2P
6603         case VENDOR_ELEM_PROBE_REQ_P2P:
6604         case VENDOR_ELEM_PROBE_RESP_P2P:
6605         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6606         case VENDOR_ELEM_BEACON_P2P_GO:
6607         case VENDOR_ELEM_P2P_PD_REQ:
6608         case VENDOR_ELEM_P2P_PD_RESP:
6609         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6610         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6611         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6612         case VENDOR_ELEM_P2P_INV_REQ:
6613         case VENDOR_ELEM_P2P_INV_RESP:
6614         case VENDOR_ELEM_P2P_ASSOC_REQ:
6615         case VENDOR_ELEM_P2P_ASSOC_RESP:
6616                 return wpa_s->p2pdev;
6617 #endif /* CONFIG_P2P */
6618         default:
6619                 return wpa_s;
6620         }
6621 }
6622
6623
6624 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6625 {
6626         unsigned int i;
6627         char buf[30];
6628
6629         wpa_printf(MSG_DEBUG, "Update vendor elements");
6630
6631         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6632                 if (wpa_s->vendor_elem[i]) {
6633                         int res;
6634
6635                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6636                         if (!os_snprintf_error(sizeof(buf), res)) {
6637                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6638                                                 wpa_s->vendor_elem[i]);
6639                         }
6640                 }
6641         }
6642
6643 #ifdef CONFIG_P2P
6644         if (wpa_s->parent == wpa_s &&
6645             wpa_s->global->p2p &&
6646             !wpa_s->global->p2p_disabled)
6647                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6648 #endif /* CONFIG_P2P */
6649 }
6650
6651
6652 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6653                             const u8 *elem, size_t len)
6654 {
6655         u8 *ie, *end;
6656
6657         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6658         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6659
6660         for (; ie + 1 < end; ie += 2 + ie[1]) {
6661                 if (ie + len > end)
6662                         break;
6663                 if (os_memcmp(ie, elem, len) != 0)
6664                         continue;
6665
6666                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6667                         wpabuf_free(wpa_s->vendor_elem[frame]);
6668                         wpa_s->vendor_elem[frame] = NULL;
6669                 } else {
6670                         os_memmove(ie, ie + len, end - (ie + len));
6671                         wpa_s->vendor_elem[frame]->used -= len;
6672                 }
6673                 wpas_vendor_elem_update(wpa_s);
6674                 return 0;
6675         }
6676
6677         return -1;
6678 }
6679
6680
6681 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6682                                    u16 num_modes, enum hostapd_hw_mode mode)
6683 {
6684         u16 i;
6685
6686         for (i = 0; i < num_modes; i++) {
6687                 if (modes[i].mode == mode)
6688                         return &modes[i];
6689         }
6690
6691         return NULL;
6692 }
6693
6694
6695 static struct
6696 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6697                                                  const u8 *bssid)
6698 {
6699         struct wpa_bss_tmp_disallowed *bss;
6700
6701         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6702                          struct wpa_bss_tmp_disallowed, list) {
6703                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6704                         return bss;
6705         }
6706
6707         return NULL;
6708 }
6709
6710
6711 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6712                           unsigned int sec)
6713 {
6714         struct wpa_bss_tmp_disallowed *bss;
6715         struct os_reltime until;
6716
6717         os_get_reltime(&until);
6718         until.sec += sec;
6719
6720         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6721         if (bss) {
6722                 bss->disallowed_until = until;
6723                 return;
6724         }
6725
6726         bss = os_malloc(sizeof(*bss));
6727         if (!bss) {
6728                 wpa_printf(MSG_DEBUG,
6729                            "Failed to allocate memory for temp disallow BSS");
6730                 return;
6731         }
6732
6733         bss->disallowed_until = until;
6734         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6735         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6736 }
6737
6738
6739 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6740 {
6741         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6742         struct os_reltime now, age;
6743
6744         os_get_reltime(&now);
6745
6746         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6747                          struct wpa_bss_tmp_disallowed, list) {
6748                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6749                         /* This BSS is not disallowed anymore */
6750                         dl_list_del(&tmp->list);
6751                         os_free(tmp);
6752                         continue;
6753                 }
6754                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6755                         bss = tmp;
6756                         break;
6757                 }
6758         }
6759         if (!bss)
6760                 return 0;
6761
6762         os_reltime_sub(&bss->disallowed_until, &now, &age);
6763         wpa_printf(MSG_DEBUG,
6764                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6765                    MAC2STR(bss->bssid), age.sec, age.usec);
6766         return 1;
6767 }