wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "blacklist.h"
  39 #include "wpas_glue.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "sme.h"
  43 #include "gas_query.h"
  44 #include "ap.h"
  45 #include "p2p_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bgscan.h"
  49 #include "autoscan.h"
  50 #include "bss.h"
  51 #include "scan.h"
  52 #include "offchannel.h"
  53 #include "hs20_supplicant.h"
  54 #include "wnm_sta.h"
  55 #include "wpas_kay.h"
  56 #include "mesh.h"
  57
  58 const char *wpa_supplicant_version =
  59 "wpa_supplicant v" VERSION_STR "\n"
  60 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  61
  62 const char *wpa_supplicant_license =
  63 "This software may be distributed under the terms of the BSD license.\n"
  64 "See README for more details.\n"
  65 #ifdef EAP_TLS_OPENSSL
  66 "\nThis product includes software developed by the OpenSSL Project\n"
  67 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  68 #endif /* EAP_TLS_OPENSSL */
  69 ;
  70
  71 #ifndef CONFIG_NO_STDOUT_DEBUG
  72 /* Long text divided into parts in order to fit in C89 strings size limits. */
  73 const char *wpa_supplicant_full_license1 =
  74 "";
  75 const char *wpa_supplicant_full_license2 =
  76 "This software may be distributed under the terms of the BSD license.\n"
  77 "\n"
  78 "Redistribution and use in source and binary forms, with or without\n"
  79 "modification, are permitted provided that the following conditions are\n"
  80 "met:\n"
  81 "\n";
  82 const char *wpa_supplicant_full_license3 =
  83 "1. Redistributions of source code must retain the above copyright\n"
  84 "   notice, this list of conditions and the following disclaimer.\n"
  85 "\n"
  86 "2. Redistributions in binary form must reproduce the above copyright\n"
  87 "   notice, this list of conditions and the following disclaimer in the\n"
  88 "   documentation and/or other materials provided with the distribution.\n"
  89 "\n";
  90 const char *wpa_supplicant_full_license4 =
  91 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  92 "   names of its contributors may be used to endorse or promote products\n"
  93 "   derived from this software without specific prior written permission.\n"
  94 "\n"
  95 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  96 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  97 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  98 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  99 const char *wpa_supplicant_full_license5 =
 100 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 101 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 102 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 103 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 104 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 105 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 106 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 107 "\n";
 108 #endif /* CONFIG_NO_STDOUT_DEBUG */
 109
 110 /* Configure default/group WEP keys for static WEP */
 111 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 112 {
 113         int i, set = 0;
 114
 115         for (i = 0; i < NUM_WEP_KEYS; i++) {
 116                 if (ssid->wep_key_len[i] == 0)
 117                         continue;
 118
 119                 set = 1;
 120                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 121                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 122                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 123         }
 124
 125         return set;
 126 }
 127
 128
 129 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 130                                     struct wpa_ssid *ssid)
 131 {
 132         u8 key[32];
 133         size_t keylen;
 134         enum wpa_alg alg;
 135         u8 seq[6] = { 0 };
 136         int ret;
 137
 138         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 139          * sending unicast and multicast packets. */
 140
 141         if (ssid->mode != WPAS_MODE_IBSS) {
 142                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 143                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 144                 return -1;
 145         }
 146
 147         if (!ssid->psk_set) {
 148                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 149                         "WPA-None");
 150                 return -1;
 151         }
 152
 153         switch (wpa_s->group_cipher) {
 154         case WPA_CIPHER_CCMP:
 155                 os_memcpy(key, ssid->psk, 16);
 156                 keylen = 16;
 157                 alg = WPA_ALG_CCMP;
 158                 break;
 159         case WPA_CIPHER_GCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_GCMP;
 163                 break;
 164         case WPA_CIPHER_TKIP:
 165                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 166                 os_memcpy(key, ssid->psk, 16 + 8);
 167                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 168                 keylen = 32;
 169                 alg = WPA_ALG_TKIP;
 170                 break;
 171         default:
 172                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 173                         "WPA-None", wpa_s->group_cipher);
 174                 return -1;
 175         }
 176
 177         /* TODO: should actually remember the previously used seq#, both for TX
 178          * and RX from each STA.. */
 179
 180         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 181         os_memset(key, 0, sizeof(key));
 182         return ret;
 183 }
 184
 185
 186 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 187 {
 188         struct wpa_supplicant *wpa_s = eloop_ctx;
 189         const u8 *bssid = wpa_s->bssid;
 190         if (is_zero_ether_addr(bssid))
 191                 bssid = wpa_s->pending_bssid;
 192         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 193                 MAC2STR(bssid));
 194         wpa_blacklist_add(wpa_s, bssid);
 195         wpa_sm_notify_disassoc(wpa_s->wpa);
 196         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 197         wpa_s->reassociate = 1;
 198
 199         /*
 200          * If we timed out, the AP or the local radio may be busy.
 201          * So, wait a second until scanning again.
 202          */
 203         wpa_supplicant_req_scan(wpa_s, 1, 0);
 204 }
 205
 206
 207 /**
 208  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 209  * @wpa_s: Pointer to wpa_supplicant data
 210  * @sec: Number of seconds after which to time out authentication
 211  * @usec: Number of microseconds after which to time out authentication
 212  *
 213  * This function is used to schedule a timeout for the current authentication
 214  * attempt.
 215  */
 216 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 217                                      int sec, int usec)
 218 {
 219         if (wpa_s->conf->ap_scan == 0 &&
 220             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 221                 return;
 222
 223         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 224                 "%d usec", sec, usec);
 225         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 226         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 227 }
 228
 229
 230 /**
 231  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 232  * @wpa_s: Pointer to wpa_supplicant data
 233  *
 234  * This function is used to cancel authentication timeout scheduled with
 235  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 236  * been completed.
 237  */
 238 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 239 {
 240         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 241         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 242         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 243 }
 244
 245
 246 /**
 247  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 248  * @wpa_s: Pointer to wpa_supplicant data
 249  *
 250  * This function is used to configure EAPOL state machine based on the selected
 251  * authentication mode.
 252  */
 253 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 254 {
 255 #ifdef IEEE8021X_EAPOL
 256         struct eapol_config eapol_conf;
 257         struct wpa_ssid *ssid = wpa_s->current_ssid;
 258
 259 #ifdef CONFIG_IBSS_RSN
 260         if (ssid->mode == WPAS_MODE_IBSS &&
 261             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 263                 /*
 264                  * RSN IBSS authentication is per-STA and we can disable the
 265                  * per-BSSID EAPOL authentication.
 266                  */
 267                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 268                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 269                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 270                 return;
 271         }
 272 #endif /* CONFIG_IBSS_RSN */
 273
 274         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 275         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 276
 277         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 278             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 279                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 280         else
 281                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 282
 283         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 285                 eapol_conf.accept_802_1x_keys = 1;
 286                 eapol_conf.required_keys = 0;
 287                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 288                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 289                 }
 290                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 291                         eapol_conf.required_keys |=
 292                                 EAPOL_REQUIRE_KEY_BROADCAST;
 293                 }
 294
 295                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 296                         eapol_conf.required_keys = 0;
 297         }
 298         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 299         eapol_conf.workaround = ssid->eap_workaround;
 300         eapol_conf.eap_disabled =
 301                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 302                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 304         eapol_conf.external_sim = wpa_s->conf->external_sim;
 305
 306 #ifdef CONFIG_WPS
 307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 308                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 309                 if (wpa_s->current_bss) {
 310                         struct wpabuf *ie;
 311                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 312                                                          WPS_IE_VENDOR_TYPE);
 313                         if (ie) {
 314                                 if (wps_is_20(ie))
 315                                         eapol_conf.wps |=
 316                                                 EAPOL_PEER_IS_WPS20_AP;
 317                                 wpabuf_free(ie);
 318                         }
 319                 }
 320         }
 321 #endif /* CONFIG_WPS */
 322
 323         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 324
 325         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 326 #endif /* IEEE8021X_EAPOL */
 327 }
 328
 329
 330 /**
 331  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 332  * @wpa_s: Pointer to wpa_supplicant data
 333  * @ssid: Configuration data for the network
 334  *
 335  * This function is used to configure WPA state machine and related parameters
 336  * to a mode where WPA is not enabled. This is called as part of the
 337  * authentication configuration when the selected network does not use WPA.
 338  */
 339 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 340                                        struct wpa_ssid *ssid)
 341 {
 342         int i;
 343
 344         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 346         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 347                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 348         else
 349                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 350         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 351         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 353         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 354         wpa_s->group_cipher = WPA_CIPHER_NONE;
 355         wpa_s->mgmt_group_cipher = 0;
 356
 357         for (i = 0; i < NUM_WEP_KEYS; i++) {
 358                 if (ssid->wep_key_len[i] > 5) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 361                         break;
 362                 } else if (ssid->wep_key_len[i] > 0) {
 363                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 364                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 365                         break;
 366                 }
 367         }
 368
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 372                          wpa_s->pairwise_cipher);
 373         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 374 #ifdef CONFIG_IEEE80211W
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 376                          wpa_s->mgmt_group_cipher);
 377 #endif /* CONFIG_IEEE80211W */
 378
 379         pmksa_cache_clear_current(wpa_s->wpa);
 380 }
 381
 382
 383 void free_hw_features(struct wpa_supplicant *wpa_s)
 384 {
 385         int i;
 386         if (wpa_s->hw.modes == NULL)
 387                 return;
 388
 389         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 390                 os_free(wpa_s->hw.modes[i].channels);
 391                 os_free(wpa_s->hw.modes[i].rates);
 392         }
 393
 394         os_free(wpa_s->hw.modes);
 395         wpa_s->hw.modes = NULL;
 396 }
 397
 398
 399 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 400 {
 401         int i;
 402
 403         bgscan_deinit(wpa_s);
 404         autoscan_deinit(wpa_s);
 405         scard_deinit(wpa_s->scard);
 406         wpa_s->scard = NULL;
 407         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 408         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 409         l2_packet_deinit(wpa_s->l2);
 410         wpa_s->l2 = NULL;
 411         if (wpa_s->l2_br) {
 412                 l2_packet_deinit(wpa_s->l2_br);
 413                 wpa_s->l2_br = NULL;
 414         }
 415 #ifdef CONFIG_TESTING_OPTIONS
 416         l2_packet_deinit(wpa_s->l2_test);
 417         wpa_s->l2_test = NULL;
 418 #endif /* CONFIG_TESTING_OPTIONS */
 419
 420         if (wpa_s->conf != NULL) {
 421                 struct wpa_ssid *ssid;
 422                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 423                         wpas_notify_network_removed(wpa_s, ssid);
 424         }
 425
 426         os_free(wpa_s->confname);
 427         wpa_s->confname = NULL;
 428
 429         os_free(wpa_s->confanother);
 430         wpa_s->confanother = NULL;
 431
 432         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 433         eapol_sm_deinit(wpa_s->eapol);
 434         wpa_s->eapol = NULL;
 435
 436         rsn_preauth_deinit(wpa_s->wpa);
 437
 438 #ifdef CONFIG_TDLS
 439         wpa_tdls_deinit(wpa_s->wpa);
 440 #endif /* CONFIG_TDLS */
 441
 442         wmm_ac_clear_saved_tspecs(wpa_s);
 443         pmksa_candidate_free(wpa_s->wpa);
 444         wpa_sm_deinit(wpa_s->wpa);
 445         wpa_s->wpa = NULL;
 446         wpa_blacklist_clear(wpa_s);
 447
 448         wpa_bss_deinit(wpa_s);
 449
 450         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 451         wpa_supplicant_cancel_scan(wpa_s);
 452         wpa_supplicant_cancel_auth_timeout(wpa_s);
 453         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 454 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 455         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 456                              wpa_s, NULL);
 457 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 458
 459         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 460
 461         wpas_wps_deinit(wpa_s);
 462
 463         wpabuf_free(wpa_s->pending_eapol_rx);
 464         wpa_s->pending_eapol_rx = NULL;
 465
 466 #ifdef CONFIG_IBSS_RSN
 467         ibss_rsn_deinit(wpa_s->ibss_rsn);
 468         wpa_s->ibss_rsn = NULL;
 469 #endif /* CONFIG_IBSS_RSN */
 470
 471         sme_deinit(wpa_s);
 472
 473 #ifdef CONFIG_AP
 474         wpa_supplicant_ap_deinit(wpa_s);
 475 #endif /* CONFIG_AP */
 476
 477         wpas_p2p_deinit(wpa_s);
 478
 479 #ifdef CONFIG_OFFCHANNEL
 480         offchannel_deinit(wpa_s);
 481 #endif /* CONFIG_OFFCHANNEL */
 482
 483         wpa_supplicant_cancel_sched_scan(wpa_s);
 484
 485         os_free(wpa_s->next_scan_freqs);
 486         wpa_s->next_scan_freqs = NULL;
 487
 488         os_free(wpa_s->manual_scan_freqs);
 489         wpa_s->manual_scan_freqs = NULL;
 490
 491         os_free(wpa_s->manual_sched_scan_freqs);
 492         wpa_s->manual_sched_scan_freqs = NULL;
 493
 494         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 495
 496         gas_query_deinit(wpa_s->gas);
 497         wpa_s->gas = NULL;
 498
 499         free_hw_features(wpa_s);
 500
 501         ieee802_1x_dealloc_kay_sm(wpa_s);
 502
 503         os_free(wpa_s->bssid_filter);
 504         wpa_s->bssid_filter = NULL;
 505
 506         os_free(wpa_s->disallow_aps_bssid);
 507         wpa_s->disallow_aps_bssid = NULL;
 508         os_free(wpa_s->disallow_aps_ssid);
 509         wpa_s->disallow_aps_ssid = NULL;
 510
 511         wnm_bss_keep_alive_deinit(wpa_s);
 512 #ifdef CONFIG_WNM
 513         wnm_deallocate_memory(wpa_s);
 514 #endif /* CONFIG_WNM */
 515
 516         ext_password_deinit(wpa_s->ext_pw);
 517         wpa_s->ext_pw = NULL;
 518
 519         wpabuf_free(wpa_s->last_gas_resp);
 520         wpa_s->last_gas_resp = NULL;
 521         wpabuf_free(wpa_s->prev_gas_resp);
 522         wpa_s->prev_gas_resp = NULL;
 523
 524         os_free(wpa_s->last_scan_res);
 525         wpa_s->last_scan_res = NULL;
 526
 527 #ifdef CONFIG_HS20
 528         hs20_deinit(wpa_s);
 529 #endif /* CONFIG_HS20 */
 530
 531         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 532                 wpabuf_free(wpa_s->vendor_elem[i]);
 533                 wpa_s->vendor_elem[i] = NULL;
 534         }
 535
 536         wmm_ac_notify_disassoc(wpa_s);
 537 }
 538
 539
 540 /**
 541  * wpa_clear_keys - Clear keys configured for the driver
 542  * @wpa_s: Pointer to wpa_supplicant data
 543  * @addr: Previously used BSSID or %NULL if not available
 544  *
 545  * This function clears the encryption keys that has been previously configured
 546  * for the driver.
 547  */
 548 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 549 {
 550         int i, max;
 551
 552 #ifdef CONFIG_IEEE80211W
 553         max = 6;
 554 #else /* CONFIG_IEEE80211W */
 555         max = 4;
 556 #endif /* CONFIG_IEEE80211W */
 557
 558         /* MLME-DELETEKEYS.request */
 559         for (i = 0; i < max; i++) {
 560                 if (wpa_s->keys_cleared & BIT(i))
 561                         continue;
 562                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 563                                 NULL, 0);
 564         }
 565         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 566             !is_zero_ether_addr(addr)) {
 567                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 568                                 0);
 569                 /* MLME-SETPROTECTION.request(None) */
 570                 wpa_drv_mlme_setprotection(
 571                         wpa_s, addr,
 572                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 573                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 574         }
 575         wpa_s->keys_cleared = (u32) -1;
 576 }
 577
 578
 579 /**
 580  * wpa_supplicant_state_txt - Get the connection state name as a text string
 581  * @state: State (wpa_state; WPA_*)
 582  * Returns: The state name as a printable text string
 583  */
 584 const char * wpa_supplicant_state_txt(enum wpa_states state)
 585 {
 586         switch (state) {
 587         case WPA_DISCONNECTED:
 588                 return "DISCONNECTED";
 589         case WPA_INACTIVE:
 590                 return "INACTIVE";
 591         case WPA_INTERFACE_DISABLED:
 592                 return "INTERFACE_DISABLED";
 593         case WPA_SCANNING:
 594                 return "SCANNING";
 595         case WPA_AUTHENTICATING:
 596                 return "AUTHENTICATING";
 597         case WPA_ASSOCIATING:
 598                 return "ASSOCIATING";
 599         case WPA_ASSOCIATED:
 600                 return "ASSOCIATED";
 601         case WPA_4WAY_HANDSHAKE:
 602                 return "4WAY_HANDSHAKE";
 603         case WPA_GROUP_HANDSHAKE:
 604                 return "GROUP_HANDSHAKE";
 605         case WPA_COMPLETED:
 606                 return "COMPLETED";
 607         default:
 608                 return "UNKNOWN";
 609         }
 610 }
 611
 612
 613 #ifdef CONFIG_BGSCAN
 614
 615 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 616 {
 617         const char *name;
 618
 619         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 620                 name = wpa_s->current_ssid->bgscan;
 621         else
 622                 name = wpa_s->conf->bgscan;
 623         if (name == NULL || name[0] == '\0')
 624                 return;
 625         if (wpas_driver_bss_selection(wpa_s))
 626                 return;
 627         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 628                 return;
 629 #ifdef CONFIG_P2P
 630         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 631                 return;
 632 #endif /* CONFIG_P2P */
 633
 634         bgscan_deinit(wpa_s);
 635         if (wpa_s->current_ssid) {
 636                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 637                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 638                                 "bgscan");
 639                         /*
 640                          * Live without bgscan; it is only used as a roaming
 641                          * optimization, so the initial connection is not
 642                          * affected.
 643                          */
 644                 } else {
 645                         struct wpa_scan_results *scan_res;
 646                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 647                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 648                                                                    0);
 649                         if (scan_res) {
 650                                 bgscan_notify_scan(wpa_s, scan_res);
 651                                 wpa_scan_results_free(scan_res);
 652                         }
 653                 }
 654         } else
 655                 wpa_s->bgscan_ssid = NULL;
 656 }
 657
 658
 659 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 660 {
 661         if (wpa_s->bgscan_ssid != NULL) {
 662                 bgscan_deinit(wpa_s);
 663                 wpa_s->bgscan_ssid = NULL;
 664         }
 665 }
 666
 667 #endif /* CONFIG_BGSCAN */
 668
 669
 670 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 671 {
 672         if (autoscan_init(wpa_s, 0))
 673                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 674 }
 675
 676
 677 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 678 {
 679         autoscan_deinit(wpa_s);
 680 }
 681
 682
 683 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 684 {
 685         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 686             wpa_s->wpa_state == WPA_SCANNING) {
 687                 autoscan_deinit(wpa_s);
 688                 wpa_supplicant_start_autoscan(wpa_s);
 689         }
 690 }
 691
 692
 693 /**
 694  * wpa_supplicant_set_state - Set current connection state
 695  * @wpa_s: Pointer to wpa_supplicant data
 696  * @state: The new connection state
 697  *
 698  * This function is called whenever the connection state changes, e.g.,
 699  * association is completed for WPA/WPA2 4-Way Handshake is started.
 700  */
 701 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 702                               enum wpa_states state)
 703 {
 704         enum wpa_states old_state = wpa_s->wpa_state;
 705
 706         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 707                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 708                 wpa_supplicant_state_txt(state));
 709
 710         if (state == WPA_INTERFACE_DISABLED) {
 711                 /* Assure normal scan when interface is restored */
 712                 wpa_s->normal_scans = 0;
 713         }
 714
 715         if (state == WPA_COMPLETED) {
 716                 wpas_connect_work_done(wpa_s);
 717                 /* Reinitialize normal_scan counter */
 718                 wpa_s->normal_scans = 0;
 719         }
 720
 721         if (state != WPA_SCANNING)
 722                 wpa_supplicant_notify_scanning(wpa_s, 0);
 723
 724         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 725                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 726 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 727                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 728                         MACSTR " completed [id=%d id_str=%s]",
 729                         MAC2STR(wpa_s->bssid),
 730                         ssid ? ssid->id : -1,
 731                         ssid && ssid->id_str ? ssid->id_str : "");
 732 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 733                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 734                 wpa_s->extra_blacklist_count = 0;
 735                 wpa_s->new_connection = 0;
 736                 wpa_drv_set_operstate(wpa_s, 1);
 737 #ifndef IEEE8021X_EAPOL
 738                 wpa_drv_set_supp_port(wpa_s, 1);
 739 #endif /* IEEE8021X_EAPOL */
 740                 wpa_s->after_wps = 0;
 741                 wpa_s->known_wps_freq = 0;
 742                 wpas_p2p_completed(wpa_s);
 743
 744                 sme_sched_obss_scan(wpa_s, 1);
 745         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 746                    state == WPA_ASSOCIATED) {
 747                 wpa_s->new_connection = 1;
 748                 wpa_drv_set_operstate(wpa_s, 0);
 749 #ifndef IEEE8021X_EAPOL
 750                 wpa_drv_set_supp_port(wpa_s, 0);
 751 #endif /* IEEE8021X_EAPOL */
 752                 sme_sched_obss_scan(wpa_s, 0);
 753         }
 754         wpa_s->wpa_state = state;
 755
 756 #ifdef CONFIG_BGSCAN
 757         if (state == WPA_COMPLETED)
 758                 wpa_supplicant_start_bgscan(wpa_s);
 759         else if (state < WPA_ASSOCIATED)
 760                 wpa_supplicant_stop_bgscan(wpa_s);
 761 #endif /* CONFIG_BGSCAN */
 762
 763         if (state == WPA_AUTHENTICATING)
 764                 wpa_supplicant_stop_autoscan(wpa_s);
 765
 766         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 767                 wpa_supplicant_start_autoscan(wpa_s);
 768
 769         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 770                 wmm_ac_notify_disassoc(wpa_s);
 771
 772         if (wpa_s->wpa_state != old_state) {
 773                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 774
 775                 /*
 776                  * Notify the P2P Device interface about a state change in one
 777                  * of the interfaces.
 778                  */
 779                 wpas_p2p_indicate_state_change(wpa_s);
 780
 781                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 782                     old_state == WPA_COMPLETED)
 783                         wpas_notify_auth_changed(wpa_s);
 784         }
 785 }
 786
 787
 788 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 789 {
 790         int pending = 0;
 791 #ifdef CONFIG_WPS
 792         struct wpa_supplicant *wpa_s = global->ifaces;
 793         while (wpa_s) {
 794                 struct wpa_supplicant *next = wpa_s->next;
 795                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 796                         pending = 1;
 797 #ifdef CONFIG_P2P
 798                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 799                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 800                         wpas_p2p_disconnect(wpa_s);
 801 #endif /* CONFIG_P2P */
 802                 wpa_s = next;
 803         }
 804 #endif /* CONFIG_WPS */
 805         if (pending)
 806                 return;
 807         eloop_terminate();
 808 }
 809
 810
 811 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 812 {
 813         struct wpa_global *global = signal_ctx;
 814         wpa_supplicant_terminate_proc(global);
 815 }
 816
 817
 818 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 819 {
 820         enum wpa_states old_state = wpa_s->wpa_state;
 821
 822         wpa_s->pairwise_cipher = 0;
 823         wpa_s->group_cipher = 0;
 824         wpa_s->mgmt_group_cipher = 0;
 825         wpa_s->key_mgmt = 0;
 826         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 827                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 828
 829         if (wpa_s->wpa_state != old_state)
 830                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 831 }
 832
 833
 834 /**
 835  * wpa_supplicant_reload_configuration - Reload configuration data
 836  * @wpa_s: Pointer to wpa_supplicant data
 837  * Returns: 0 on success or -1 if configuration parsing failed
 838  *
 839  * This function can be used to request that the configuration data is reloaded
 840  * (e.g., after configuration file change). This function is reloading
 841  * configuration only for one interface, so this may need to be called multiple
 842  * times if %wpa_supplicant is controlling multiple interfaces and all
 843  * interfaces need reconfiguration.
 844  */
 845 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 846 {
 847         struct wpa_config *conf;
 848         int reconf_ctrl;
 849         int old_ap_scan;
 850
 851         if (wpa_s->confname == NULL)
 852                 return -1;
 853         conf = wpa_config_read(wpa_s->confname, NULL);
 854         if (conf == NULL) {
 855                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 856                         "file '%s' - exiting", wpa_s->confname);
 857                 return -1;
 858         }
 859         wpa_config_read(wpa_s->confanother, conf);
 860
 861         conf->changed_parameters = (unsigned int) -1;
 862
 863         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 864                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 865                     os_strcmp(conf->ctrl_interface,
 866                               wpa_s->conf->ctrl_interface) != 0);
 867
 868         if (reconf_ctrl && wpa_s->ctrl_iface) {
 869                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 870                 wpa_s->ctrl_iface = NULL;
 871         }
 872
 873         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 874         if (wpa_s->current_ssid) {
 875                 wpa_s->own_disconnect_req = 1;
 876                 wpa_supplicant_deauthenticate(wpa_s,
 877                                               WLAN_REASON_DEAUTH_LEAVING);
 878         }
 879
 880         /*
 881          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 882          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 883          */
 884         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 885                 /*
 886                  * Clear forced success to clear EAP state for next
 887                  * authentication.
 888                  */
 889                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 890         }
 891         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 892         wpa_sm_set_config(wpa_s->wpa, NULL);
 893         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 894         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 895         rsn_preauth_deinit(wpa_s->wpa);
 896
 897         old_ap_scan = wpa_s->conf->ap_scan;
 898         wpa_config_free(wpa_s->conf);
 899         wpa_s->conf = conf;
 900         if (old_ap_scan != wpa_s->conf->ap_scan)
 901                 wpas_notify_ap_scan_changed(wpa_s);
 902
 903         if (reconf_ctrl)
 904                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 905
 906         wpa_supplicant_update_config(wpa_s);
 907
 908         wpa_supplicant_clear_status(wpa_s);
 909         if (wpa_supplicant_enabled_networks(wpa_s)) {
 910                 wpa_s->reassociate = 1;
 911                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 912         }
 913         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 914         return 0;
 915 }
 916
 917
 918 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 919 {
 920         struct wpa_global *global = signal_ctx;
 921         struct wpa_supplicant *wpa_s;
 922         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 923                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 924                         sig);
 925                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 926                         wpa_supplicant_terminate_proc(global);
 927                 }
 928         }
 929 }
 930
 931
 932 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 933                                          struct wpa_ssid *ssid,
 934                                          struct wpa_ie_data *ie)
 935 {
 936         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 937         if (ret) {
 938                 if (ret == -2) {
 939                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 940                                 "from association info");
 941                 }
 942                 return -1;
 943         }
 944
 945         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 946                 "cipher suites");
 947         if (!(ie->group_cipher & ssid->group_cipher)) {
 948                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 949                         "cipher 0x%x (mask 0x%x) - reject",
 950                         ie->group_cipher, ssid->group_cipher);
 951                 return -1;
 952         }
 953         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 954                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 955                         "cipher 0x%x (mask 0x%x) - reject",
 956                         ie->pairwise_cipher, ssid->pairwise_cipher);
 957                 return -1;
 958         }
 959         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 960                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 961                         "management 0x%x (mask 0x%x) - reject",
 962                         ie->key_mgmt, ssid->key_mgmt);
 963                 return -1;
 964         }
 965
 966 #ifdef CONFIG_IEEE80211W
 967         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 968             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
 969                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 970                         "that does not support management frame protection - "
 971                         "reject");
 972                 return -1;
 973         }
 974 #endif /* CONFIG_IEEE80211W */
 975
 976         return 0;
 977 }
 978
 979
 980 /**
 981  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 982  * @wpa_s: Pointer to wpa_supplicant data
 983  * @bss: Scan results for the selected BSS, or %NULL if not available
 984  * @ssid: Configuration data for the selected network
 985  * @wpa_ie: Buffer for the WPA/RSN IE
 986  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 987  * used buffer length in case the functions returns success.
 988  * Returns: 0 on success or -1 on failure
 989  *
 990  * This function is used to configure authentication and encryption parameters
 991  * based on the network configuration and scan result for the selected BSS (if
 992  * available).
 993  */
 994 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 995                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 996                               u8 *wpa_ie, size_t *wpa_ie_len)
 997 {
 998         struct wpa_ie_data ie;
 999         int sel, proto;
1000         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1001
1002         if (bss) {
1003                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1004                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1005                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1006         } else
1007                 bss_wpa = bss_rsn = bss_osen = NULL;
1008
1009         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1010             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1011             (ie.group_cipher & ssid->group_cipher) &&
1012             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1013             (ie.key_mgmt & ssid->key_mgmt)) {
1014                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1015                 proto = WPA_PROTO_RSN;
1016         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1017                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1018                    (ie.group_cipher & ssid->group_cipher) &&
1019                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1020                    (ie.key_mgmt & ssid->key_mgmt)) {
1021                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1022                 proto = WPA_PROTO_WPA;
1023 #ifdef CONFIG_HS20
1024         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1025                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1026                 /* TODO: parse OSEN element */
1027                 os_memset(&ie, 0, sizeof(ie));
1028                 ie.group_cipher = WPA_CIPHER_CCMP;
1029                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1030                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1031                 proto = WPA_PROTO_OSEN;
1032 #endif /* CONFIG_HS20 */
1033         } else if (bss) {
1034                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1035                 wpa_dbg(wpa_s, MSG_DEBUG,
1036                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1037                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1038                         ssid->key_mgmt);
1039                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1040                         MAC2STR(bss->bssid),
1041                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1042                         bss_wpa ? " WPA" : "",
1043                         bss_rsn ? " RSN" : "",
1044                         bss_osen ? " OSEN" : "");
1045                 if (bss_rsn) {
1046                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1047                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1048                                 wpa_dbg(wpa_s, MSG_DEBUG,
1049                                         "Could not parse RSN element");
1050                         } else {
1051                                 wpa_dbg(wpa_s, MSG_DEBUG,
1052                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1053                                         ie.pairwise_cipher, ie.group_cipher,
1054                                         ie.key_mgmt);
1055                         }
1056                 }
1057                 if (bss_wpa) {
1058                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1059                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1060                                 wpa_dbg(wpa_s, MSG_DEBUG,
1061                                         "Could not parse WPA element");
1062                         } else {
1063                                 wpa_dbg(wpa_s, MSG_DEBUG,
1064                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1065                                         ie.pairwise_cipher, ie.group_cipher,
1066                                         ie.key_mgmt);
1067                         }
1068                 }
1069                 return -1;
1070         } else {
1071                 if (ssid->proto & WPA_PROTO_OSEN)
1072                         proto = WPA_PROTO_OSEN;
1073                 else if (ssid->proto & WPA_PROTO_RSN)
1074                         proto = WPA_PROTO_RSN;
1075                 else
1076                         proto = WPA_PROTO_WPA;
1077                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1078                         os_memset(&ie, 0, sizeof(ie));
1079                         ie.group_cipher = ssid->group_cipher;
1080                         ie.pairwise_cipher = ssid->pairwise_cipher;
1081                         ie.key_mgmt = ssid->key_mgmt;
1082 #ifdef CONFIG_IEEE80211W
1083                         ie.mgmt_group_cipher =
1084                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1085                                 WPA_CIPHER_AES_128_CMAC : 0;
1086 #endif /* CONFIG_IEEE80211W */
1087                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1088                                 "based on configuration");
1089                 } else
1090                         proto = ie.proto;
1091         }
1092
1093         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1094                 "pairwise %d key_mgmt %d proto %d",
1095                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1096 #ifdef CONFIG_IEEE80211W
1097         if (ssid->ieee80211w) {
1098                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1099                         ie.mgmt_group_cipher);
1100         }
1101 #endif /* CONFIG_IEEE80211W */
1102
1103         wpa_s->wpa_proto = proto;
1104         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1105         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1106                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1107
1108         if (bss || !wpa_s->ap_ies_from_associnfo) {
1109                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1110                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1111                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1112                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1113                         return -1;
1114         }
1115
1116         sel = ie.group_cipher & ssid->group_cipher;
1117         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1118         if (wpa_s->group_cipher < 0) {
1119                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1120                         "cipher");
1121                 return -1;
1122         }
1123         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1124                 wpa_cipher_txt(wpa_s->group_cipher));
1125
1126         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1127         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1128         if (wpa_s->pairwise_cipher < 0) {
1129                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1130                         "cipher");
1131                 return -1;
1132         }
1133         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1134                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1135
1136         sel = ie.key_mgmt & ssid->key_mgmt;
1137 #ifdef CONFIG_SAE
1138         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1139                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1140 #endif /* CONFIG_SAE */
1141         if (0) {
1142 #ifdef CONFIG_SUITEB192
1143         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1144                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1145                 wpa_dbg(wpa_s, MSG_DEBUG,
1146                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1147 #endif /* CONFIG_SUITEB192 */
1148 #ifdef CONFIG_SUITEB
1149         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1150                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1151                 wpa_dbg(wpa_s, MSG_DEBUG,
1152                         "WPA: using KEY_MGMT 802.1X with Suite B");
1153 #endif /* CONFIG_SUITEB */
1154 #ifdef CONFIG_IEEE80211R
1155         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1156                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1157                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1158         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1159                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1160                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1161 #endif /* CONFIG_IEEE80211R */
1162 #ifdef CONFIG_SAE
1163         } else if (sel & WPA_KEY_MGMT_SAE) {
1164                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1165                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1166         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1167                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1168                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1169 #endif /* CONFIG_SAE */
1170 #ifdef CONFIG_IEEE80211W
1171         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1172                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1173                 wpa_dbg(wpa_s, MSG_DEBUG,
1174                         "WPA: using KEY_MGMT 802.1X with SHA256");
1175         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1176                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1177                 wpa_dbg(wpa_s, MSG_DEBUG,
1178                         "WPA: using KEY_MGMT PSK with SHA256");
1179 #endif /* CONFIG_IEEE80211W */
1180         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1181                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1182                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1183         } else if (sel & WPA_KEY_MGMT_PSK) {
1184                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1185                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1186         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1187                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1188                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1189 #ifdef CONFIG_HS20
1190         } else if (sel & WPA_KEY_MGMT_OSEN) {
1191                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1192                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1193 #endif /* CONFIG_HS20 */
1194         } else {
1195                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1196                         "authenticated key management type");
1197                 return -1;
1198         }
1199
1200         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1201         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1202                          wpa_s->pairwise_cipher);
1203         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1204
1205 #ifdef CONFIG_IEEE80211W
1206         sel = ie.mgmt_group_cipher;
1207         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1208             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1209                 sel = 0;
1210         if (sel & WPA_CIPHER_AES_128_CMAC) {
1211                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1212                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1213                         "AES-128-CMAC");
1214         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1215                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1217                         "BIP-GMAC-128");
1218         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1219                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1220                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1221                         "BIP-GMAC-256");
1222         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1223                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1225                         "BIP-CMAC-256");
1226         } else {
1227                 wpa_s->mgmt_group_cipher = 0;
1228                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1229         }
1230         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1231                          wpa_s->mgmt_group_cipher);
1232         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1233                          wpas_get_ssid_pmf(wpa_s, ssid));
1234 #endif /* CONFIG_IEEE80211W */
1235
1236         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1237                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1238                 return -1;
1239         }
1240
1241         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1242                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1243 #ifndef CONFIG_NO_PBKDF2
1244                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1245                     ssid->passphrase) {
1246                         u8 psk[PMK_LEN];
1247                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1248                                     4096, psk, PMK_LEN);
1249                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1250                                         psk, PMK_LEN);
1251                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1252                         os_memset(psk, 0, sizeof(psk));
1253                 }
1254 #endif /* CONFIG_NO_PBKDF2 */
1255 #ifdef CONFIG_EXT_PASSWORD
1256                 if (ssid->ext_psk) {
1257                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1258                                                              ssid->ext_psk);
1259                         char pw_str[64 + 1];
1260                         u8 psk[PMK_LEN];
1261
1262                         if (pw == NULL) {
1263                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1264                                         "found from external storage");
1265                                 return -1;
1266                         }
1267
1268                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1269                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1270                                         "PSK length %d in external storage",
1271                                         (int) wpabuf_len(pw));
1272                                 ext_password_free(pw);
1273                                 return -1;
1274                         }
1275
1276                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1277                         pw_str[wpabuf_len(pw)] = '\0';
1278
1279 #ifndef CONFIG_NO_PBKDF2
1280                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1281                         {
1282                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1283                                             4096, psk, PMK_LEN);
1284                                 os_memset(pw_str, 0, sizeof(pw_str));
1285                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1286                                                 "external passphrase)",
1287                                                 psk, PMK_LEN);
1288                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1289                                 os_memset(psk, 0, sizeof(psk));
1290                         } else
1291 #endif /* CONFIG_NO_PBKDF2 */
1292                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1293                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1294                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1295                                                 "Invalid PSK hex string");
1296                                         os_memset(pw_str, 0, sizeof(pw_str));
1297                                         ext_password_free(pw);
1298                                         return -1;
1299                                 }
1300                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1301                                 os_memset(psk, 0, sizeof(psk));
1302                         } else {
1303                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1304                                         "PSK available");
1305                                 os_memset(pw_str, 0, sizeof(pw_str));
1306                                 ext_password_free(pw);
1307                                 return -1;
1308                         }
1309
1310                         os_memset(pw_str, 0, sizeof(pw_str));
1311                         ext_password_free(pw);
1312                 }
1313 #endif /* CONFIG_EXT_PASSWORD */
1314         } else
1315                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1316
1317         return 0;
1318 }
1319
1320
1321 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1322 {
1323         *pos = 0x00;
1324
1325         switch (idx) {
1326         case 0: /* Bits 0-7 */
1327                 break;
1328         case 1: /* Bits 8-15 */
1329                 break;
1330         case 2: /* Bits 16-23 */
1331 #ifdef CONFIG_WNM
1332                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1333                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1334 #endif /* CONFIG_WNM */
1335                 break;
1336         case 3: /* Bits 24-31 */
1337 #ifdef CONFIG_WNM
1338                 *pos |= 0x02; /* Bit 25 - SSID List */
1339 #endif /* CONFIG_WNM */
1340 #ifdef CONFIG_INTERWORKING
1341                 if (wpa_s->conf->interworking)
1342                         *pos |= 0x80; /* Bit 31 - Interworking */
1343 #endif /* CONFIG_INTERWORKING */
1344                 break;
1345         case 4: /* Bits 32-39 */
1346 #ifdef CONFIG_INTERWORKING
1347                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1348                         *pos |= 0x01; /* Bit 32 - QoS Map */
1349 #endif /* CONFIG_INTERWORKING */
1350                 break;
1351         case 5: /* Bits 40-47 */
1352 #ifdef CONFIG_HS20
1353                 if (wpa_s->conf->hs20)
1354                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1355 #endif /* CONFIG_HS20 */
1356                 break;
1357         case 6: /* Bits 48-55 */
1358                 break;
1359         }
1360 }
1361
1362
1363 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1364 {
1365         u8 *pos = buf;
1366         u8 len = 6, i;
1367
1368         if (len < wpa_s->extended_capa_len)
1369                 len = wpa_s->extended_capa_len;
1370         if (buflen < (size_t) len + 2) {
1371                 wpa_printf(MSG_INFO,
1372                            "Not enough room for building extended capabilities element");
1373                 return -1;
1374         }
1375
1376         *pos++ = WLAN_EID_EXT_CAPAB;
1377         *pos++ = len;
1378         for (i = 0; i < len; i++, pos++) {
1379                 wpas_ext_capab_byte(wpa_s, pos, i);
1380
1381                 if (i < wpa_s->extended_capa_len) {
1382                         *pos &= ~wpa_s->extended_capa_mask[i];
1383                         *pos |= wpa_s->extended_capa[i];
1384                 }
1385         }
1386
1387         while (len > 0 && buf[1 + len] == 0) {
1388                 len--;
1389                 buf[1] = len;
1390         }
1391         if (len == 0)
1392                 return 0;
1393
1394         return 2 + len;
1395 }
1396
1397
1398 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1399                           struct wpa_bss *test_bss)
1400 {
1401         struct wpa_bss *bss;
1402
1403         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1404                 if (bss == test_bss)
1405                         return 1;
1406         }
1407
1408         return 0;
1409 }
1410
1411
1412 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1413                            struct wpa_ssid *test_ssid)
1414 {
1415         struct wpa_ssid *ssid;
1416
1417         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1418                 if (ssid == test_ssid)
1419                         return 1;
1420         }
1421
1422         return 0;
1423 }
1424
1425
1426 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1427                         struct wpa_ssid *test_ssid)
1428 {
1429         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1430                 return 0;
1431
1432         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1433 }
1434
1435
1436 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1437 {
1438         if (cwork == NULL)
1439                 return;
1440         os_free(cwork);
1441 }
1442
1443
1444 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1445 {
1446         struct wpa_connect_work *cwork;
1447         struct wpa_radio_work *work = wpa_s->connect_work;
1448
1449         if (!work)
1450                 return;
1451
1452         wpa_s->connect_work = NULL;
1453         cwork = work->ctx;
1454         work->ctx = NULL;
1455         wpas_connect_work_free(cwork);
1456         radio_work_done(work);
1457 }
1458
1459
1460 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1461 {
1462         struct os_reltime now;
1463         u8 addr[ETH_ALEN];
1464
1465         os_get_reltime(&now);
1466         if (wpa_s->last_mac_addr_style == style &&
1467             wpa_s->last_mac_addr_change.sec != 0 &&
1468             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1469                                 wpa_s->conf->rand_addr_lifetime)) {
1470                 wpa_msg(wpa_s, MSG_DEBUG,
1471                         "Previously selected random MAC address has not yet expired");
1472                 return 0;
1473         }
1474
1475         switch (style) {
1476         case 1:
1477                 if (random_mac_addr(addr) < 0)
1478                         return -1;
1479                 break;
1480         case 2:
1481                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1482                 if (random_mac_addr_keep_oui(addr) < 0)
1483                         return -1;
1484                 break;
1485         default:
1486                 return -1;
1487         }
1488
1489         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1490                 wpa_msg(wpa_s, MSG_INFO,
1491                         "Failed to set random MAC address");
1492                 return -1;
1493         }
1494
1495         os_get_reltime(&wpa_s->last_mac_addr_change);
1496         wpa_s->mac_addr_changed = 1;
1497         wpa_s->last_mac_addr_style = style;
1498
1499         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1500                 wpa_msg(wpa_s, MSG_INFO,
1501                         "Could not update MAC address information");
1502                 return -1;
1503         }
1504
1505         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1506                 MAC2STR(addr));
1507
1508         return 0;
1509 }
1510
1511
1512 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1513 {
1514         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1515             !wpa_s->conf->preassoc_mac_addr)
1516                 return 0;
1517
1518         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1519 }
1520
1521
1522 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1523
1524 /**
1525  * wpa_supplicant_associate - Request association
1526  * @wpa_s: Pointer to wpa_supplicant data
1527  * @bss: Scan results for the selected BSS, or %NULL if not available
1528  * @ssid: Configuration data for the selected network
1529  *
1530  * This function is used to request %wpa_supplicant to associate with a BSS.
1531  */
1532 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1533                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1534 {
1535         struct wpa_connect_work *cwork;
1536         int rand_style;
1537
1538         if (ssid->mac_addr == -1)
1539                 rand_style = wpa_s->conf->mac_addr;
1540         else
1541                 rand_style = ssid->mac_addr;
1542
1543         wmm_ac_clear_saved_tspecs(wpa_s);
1544         wpa_s->reassoc_same_bss = 0;
1545
1546         if (wpa_s->last_ssid == ssid) {
1547                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1548                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1549                         wmm_ac_save_tspecs(wpa_s);
1550                         wpa_s->reassoc_same_bss = 1;
1551                 }
1552         } else if (rand_style > 0) {
1553                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1554                         return;
1555                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1556         } else if (wpa_s->mac_addr_changed) {
1557                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1558                         wpa_msg(wpa_s, MSG_INFO,
1559                                 "Could not restore permanent MAC address");
1560                         return;
1561                 }
1562                 wpa_s->mac_addr_changed = 0;
1563                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1564                         wpa_msg(wpa_s, MSG_INFO,
1565                                 "Could not update MAC address information");
1566                         return;
1567                 }
1568                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1569         }
1570         wpa_s->last_ssid = ssid;
1571
1572 #ifdef CONFIG_IBSS_RSN
1573         ibss_rsn_deinit(wpa_s->ibss_rsn);
1574         wpa_s->ibss_rsn = NULL;
1575 #endif /* CONFIG_IBSS_RSN */
1576
1577         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1578             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1579 #ifdef CONFIG_AP
1580                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1581                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1582                                 "mode");
1583                         return;
1584                 }
1585                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1586                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1587                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1588                                 wpas_p2p_ap_setup_failed(wpa_s);
1589                         return;
1590                 }
1591                 wpa_s->current_bss = bss;
1592 #else /* CONFIG_AP */
1593                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1594                         "the build");
1595 #endif /* CONFIG_AP */
1596                 return;
1597         }
1598
1599         if (ssid->mode == WPAS_MODE_MESH) {
1600 #ifdef CONFIG_MESH
1601                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1602                         wpa_msg(wpa_s, MSG_INFO,
1603                                 "Driver does not support mesh mode");
1604                         return;
1605                 }
1606                 if (bss)
1607                         ssid->frequency = bss->freq;
1608                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1609                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1610                         return;
1611                 }
1612                 wpa_s->current_bss = bss;
1613                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1614                              "ssid=\"%s\" id=%d",
1615                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1616                              ssid->id);
1617 #else /* CONFIG_MESH */
1618                 wpa_msg(wpa_s, MSG_ERROR,
1619                         "mesh mode support not included in the build");
1620 #endif /* CONFIG_MESH */
1621                 return;
1622         }
1623
1624 #ifdef CONFIG_TDLS
1625         if (bss)
1626                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1627                                 bss->ie_len);
1628 #endif /* CONFIG_TDLS */
1629
1630         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1631             ssid->mode == IEEE80211_MODE_INFRA) {
1632                 sme_authenticate(wpa_s, bss, ssid);
1633                 return;
1634         }
1635
1636         if (wpa_s->connect_work) {
1637                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1638                 return;
1639         }
1640
1641         if (radio_work_pending(wpa_s, "connect")) {
1642                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1643                 return;
1644         }
1645
1646         cwork = os_zalloc(sizeof(*cwork));
1647         if (cwork == NULL)
1648                 return;
1649
1650         cwork->bss = bss;
1651         cwork->ssid = ssid;
1652
1653         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1654                            wpas_start_assoc_cb, cwork) < 0) {
1655                 os_free(cwork);
1656         }
1657 }
1658
1659
1660 static int bss_is_ibss(struct wpa_bss *bss)
1661 {
1662         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1663                 IEEE80211_CAP_IBSS;
1664 }
1665
1666
1667 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1668                           const struct wpa_ssid *ssid,
1669                           struct hostapd_freq_params *freq)
1670 {
1671         enum hostapd_hw_mode hw_mode;
1672         struct hostapd_hw_modes *mode = NULL;
1673         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1674                            184, 192 };
1675         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1676         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1677         u8 channel;
1678         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1679         unsigned int j;
1680         struct hostapd_freq_params vht_freq;
1681
1682         freq->freq = ssid->frequency;
1683
1684         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1685                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1686
1687                 if (ssid->mode != WPAS_MODE_IBSS)
1688                         break;
1689
1690                 /* Don't adjust control freq in case of fixed_freq */
1691                 if (ssid->fixed_freq)
1692                         break;
1693
1694                 if (!bss_is_ibss(bss))
1695                         continue;
1696
1697                 if (ssid->ssid_len == bss->ssid_len &&
1698                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1699                         wpa_printf(MSG_DEBUG,
1700                                    "IBSS already found in scan results, adjust control freq: %d",
1701                                    bss->freq);
1702                         freq->freq = bss->freq;
1703                         obss_scan = 0;
1704                         break;
1705                 }
1706         }
1707
1708         /* For IBSS check HT_IBSS flag */
1709         if (ssid->mode == WPAS_MODE_IBSS &&
1710             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1711                 return;
1712
1713         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1714             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1715             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1716                 wpa_printf(MSG_DEBUG,
1717                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1718                 return;
1719         }
1720
1721         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1722         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1723                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1724                         mode = &wpa_s->hw.modes[i];
1725                         break;
1726                 }
1727         }
1728
1729         if (!mode)
1730                 return;
1731
1732         freq->ht_enabled = ht_supported(mode);
1733         if (!freq->ht_enabled)
1734                 return;
1735
1736         /* Setup higher BW only for 5 GHz */
1737         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1738                 return;
1739
1740         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1741                 pri_chan = &mode->channels[chan_idx];
1742                 if (pri_chan->chan == channel)
1743                         break;
1744                 pri_chan = NULL;
1745         }
1746         if (!pri_chan)
1747                 return;
1748
1749         /* Check primary channel flags */
1750         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1751                 return;
1752
1753         /* Check/setup HT40+/HT40- */
1754         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1755                 if (ht40plus[j] == channel) {
1756                         ht40 = 1;
1757                         break;
1758                 }
1759         }
1760
1761         /* Find secondary channel */
1762         for (i = 0; i < mode->num_channels; i++) {
1763                 sec_chan = &mode->channels[i];
1764                 if (sec_chan->chan == channel + ht40 * 4)
1765                         break;
1766                 sec_chan = NULL;
1767         }
1768         if (!sec_chan)
1769                 return;
1770
1771         /* Check secondary channel flags */
1772         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1773                 return;
1774
1775         freq->channel = pri_chan->chan;
1776
1777         switch (ht40) {
1778         case -1:
1779                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1780                         return;
1781                 freq->sec_channel_offset = -1;
1782                 break;
1783         case 1:
1784                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1785                         return;
1786                 freq->sec_channel_offset = 1;
1787                 break;
1788         default:
1789                 break;
1790         }
1791
1792         if (freq->sec_channel_offset && obss_scan) {
1793                 struct wpa_scan_results *scan_res;
1794
1795                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1796                 if (scan_res == NULL) {
1797                         /* Back to HT20 */
1798                         freq->sec_channel_offset = 0;
1799                         return;
1800                 }
1801
1802                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1803                                      sec_chan->chan);
1804                 switch (res) {
1805                 case 0:
1806                         /* Back to HT20 */
1807                         freq->sec_channel_offset = 0;
1808                         break;
1809                 case 1:
1810                         /* Configuration allowed */
1811                         break;
1812                 case 2:
1813                         /* Switch pri/sec channels */
1814                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1815                         freq->sec_channel_offset = -freq->sec_channel_offset;
1816                         freq->channel = sec_chan->chan;
1817                         break;
1818                 default:
1819                         freq->sec_channel_offset = 0;
1820                         break;
1821                 }
1822
1823                 wpa_scan_results_free(scan_res);
1824         }
1825
1826         wpa_printf(MSG_DEBUG,
1827                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1828                    freq->channel, freq->sec_channel_offset);
1829
1830         /* Not sure if mesh is ready for VHT */
1831         if (ssid->mode != WPAS_MODE_IBSS)
1832                 return;
1833
1834         /* For IBSS check VHT_IBSS flag */
1835         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1836                 return;
1837
1838         vht_freq = *freq;
1839
1840         vht_freq.vht_enabled = vht_supported(mode);
1841         if (!vht_freq.vht_enabled)
1842                 return;
1843
1844         /* setup center_freq1, bandwidth */
1845         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1846                 if (freq->channel >= vht80[j] &&
1847                     freq->channel < vht80[j] + 16)
1848                         break;
1849         }
1850
1851         if (j == ARRAY_SIZE(vht80))
1852                 return;
1853
1854         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1855                 struct hostapd_channel_data *chan;
1856
1857                 chan = hw_get_channel_chan(mode, i, NULL);
1858                 if (!chan)
1859                         return;
1860
1861                 /* Back to HT configuration if channel not usable */
1862                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1863                         return;
1864         }
1865
1866         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
1867                                     freq->channel, freq->ht_enabled,
1868                                     vht_freq.vht_enabled,
1869                                     freq->sec_channel_offset,
1870                                     VHT_CHANWIDTH_80MHZ,
1871                                     vht80[j] + 6, 0, 0) != 0)
1872                 return;
1873
1874         *freq = vht_freq;
1875
1876         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
1877                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
1878 }
1879
1880
1881 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1882 {
1883         struct wpa_connect_work *cwork = work->ctx;
1884         struct wpa_bss *bss = cwork->bss;
1885         struct wpa_ssid *ssid = cwork->ssid;
1886         struct wpa_supplicant *wpa_s = work->wpa_s;
1887         u8 wpa_ie[200];
1888         size_t wpa_ie_len;
1889         int use_crypt, ret, i, bssid_changed;
1890         int algs = WPA_AUTH_ALG_OPEN;
1891         unsigned int cipher_pairwise, cipher_group;
1892         struct wpa_driver_associate_params params;
1893         int wep_keys_set = 0;
1894         int assoc_failed = 0;
1895         struct wpa_ssid *old_ssid;
1896 #ifdef CONFIG_HT_OVERRIDES
1897         struct ieee80211_ht_capabilities htcaps;
1898         struct ieee80211_ht_capabilities htcaps_mask;
1899 #endif /* CONFIG_HT_OVERRIDES */
1900 #ifdef CONFIG_VHT_OVERRIDES
1901        struct ieee80211_vht_capabilities vhtcaps;
1902        struct ieee80211_vht_capabilities vhtcaps_mask;
1903 #endif /* CONFIG_VHT_OVERRIDES */
1904
1905         if (deinit) {
1906                 if (work->started) {
1907                         wpa_s->connect_work = NULL;
1908
1909                         /* cancel possible auth. timeout */
1910                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1911                                              NULL);
1912                 }
1913                 wpas_connect_work_free(cwork);
1914                 return;
1915         }
1916
1917         wpa_s->connect_work = work;
1918
1919         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1920                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1921                 wpas_connect_work_done(wpa_s);
1922                 return;
1923         }
1924
1925         os_memset(&params, 0, sizeof(params));
1926         wpa_s->reassociate = 0;
1927         wpa_s->eap_expected_failure = 0;
1928         if (bss &&
1929             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1930 #ifdef CONFIG_IEEE80211R
1931                 const u8 *ie, *md = NULL;
1932 #endif /* CONFIG_IEEE80211R */
1933                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1934                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1935                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1936                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1937                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1938                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1939                 if (bssid_changed)
1940                         wpas_notify_bssid_changed(wpa_s);
1941 #ifdef CONFIG_IEEE80211R
1942                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1943                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1944                         md = ie + 2;
1945                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1946                 if (md) {
1947                         /* Prepare for the next transition */
1948                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1949                 }
1950 #endif /* CONFIG_IEEE80211R */
1951 #ifdef CONFIG_WPS
1952         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1953                    wpa_s->conf->ap_scan == 2 &&
1954                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1955                 /* Use ap_scan==1 style network selection to find the network
1956                  */
1957                 wpas_connect_work_done(wpa_s);
1958                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1959                 wpa_s->reassociate = 1;
1960                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1961                 return;
1962 #endif /* CONFIG_WPS */
1963         } else {
1964                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1965                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1966                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1967         }
1968         wpa_supplicant_cancel_sched_scan(wpa_s);
1969         wpa_supplicant_cancel_scan(wpa_s);
1970
1971         /* Starting new association, so clear the possibly used WPA IE from the
1972          * previous association. */
1973         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1974
1975 #ifdef IEEE8021X_EAPOL
1976         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1977                 if (ssid->leap) {
1978                         if (ssid->non_leap == 0)
1979                                 algs = WPA_AUTH_ALG_LEAP;
1980                         else
1981                                 algs |= WPA_AUTH_ALG_LEAP;
1982                 }
1983         }
1984 #endif /* IEEE8021X_EAPOL */
1985         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1986         if (ssid->auth_alg) {
1987                 algs = ssid->auth_alg;
1988                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1989                         "0x%x", algs);
1990         }
1991
1992         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1993                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1994             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1995                 int try_opportunistic;
1996                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1997                                      wpa_s->conf->okc :
1998                                      ssid->proactive_key_caching) &&
1999                         (ssid->proto & WPA_PROTO_RSN);
2000                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2001                                             ssid, try_opportunistic) == 0)
2002                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2003                 wpa_ie_len = sizeof(wpa_ie);
2004                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2005                                               wpa_ie, &wpa_ie_len)) {
2006                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2007                                 "key management and encryption suites");
2008                         wpas_connect_work_done(wpa_s);
2009                         return;
2010                 }
2011         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2012                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2013                 /*
2014                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2015                  * use non-WPA since the scan results did not indicate that the
2016                  * AP is using WPA or WPA2.
2017                  */
2018                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2019                 wpa_ie_len = 0;
2020                 wpa_s->wpa_proto = 0;
2021         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2022                 wpa_ie_len = sizeof(wpa_ie);
2023                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2024                                               wpa_ie, &wpa_ie_len)) {
2025                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2026                                 "key management and encryption suites (no "
2027                                 "scan results)");
2028                         wpas_connect_work_done(wpa_s);
2029                         return;
2030                 }
2031 #ifdef CONFIG_WPS
2032         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2033                 struct wpabuf *wps_ie;
2034                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2035                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2036                         wpa_ie_len = wpabuf_len(wps_ie);
2037                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2038                 } else
2039                         wpa_ie_len = 0;
2040                 wpabuf_free(wps_ie);
2041                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2042                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2043                         params.wps = WPS_MODE_PRIVACY;
2044                 else
2045                         params.wps = WPS_MODE_OPEN;
2046                 wpa_s->wpa_proto = 0;
2047 #endif /* CONFIG_WPS */
2048         } else {
2049                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2050                 wpa_ie_len = 0;
2051                 wpa_s->wpa_proto = 0;
2052         }
2053
2054 #ifdef CONFIG_P2P
2055         if (wpa_s->global->p2p) {
2056                 u8 *pos;
2057                 size_t len;
2058                 int res;
2059                 pos = wpa_ie + wpa_ie_len;
2060                 len = sizeof(wpa_ie) - wpa_ie_len;
2061                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2062                                             ssid->p2p_group);
2063                 if (res >= 0)
2064                         wpa_ie_len += res;
2065         }
2066
2067         wpa_s->cross_connect_disallowed = 0;
2068         if (bss) {
2069                 struct wpabuf *p2p;
2070                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2071                 if (p2p) {
2072                         wpa_s->cross_connect_disallowed =
2073                                 p2p_get_cross_connect_disallowed(p2p);
2074                         wpabuf_free(p2p);
2075                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2076                                 "connection",
2077                                 wpa_s->cross_connect_disallowed ?
2078                                 "disallows" : "allows");
2079                 }
2080         }
2081
2082         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2083 #endif /* CONFIG_P2P */
2084
2085 #ifdef CONFIG_HS20
2086         if (is_hs20_network(wpa_s, ssid, bss)) {
2087                 struct wpabuf *hs20;
2088                 hs20 = wpabuf_alloc(20);
2089                 if (hs20) {
2090                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2091                         size_t len;
2092
2093                         wpas_hs20_add_indication(hs20, pps_mo_id);
2094                         len = sizeof(wpa_ie) - wpa_ie_len;
2095                         if (wpabuf_len(hs20) <= len) {
2096                                 os_memcpy(wpa_ie + wpa_ie_len,
2097                                           wpabuf_head(hs20), wpabuf_len(hs20));
2098                                 wpa_ie_len += wpabuf_len(hs20);
2099                         }
2100                         wpabuf_free(hs20);
2101                 }
2102         }
2103 #endif /* CONFIG_HS20 */
2104
2105         /*
2106          * Workaround: Add Extended Capabilities element only if the AP
2107          * included this element in Beacon/Probe Response frames. Some older
2108          * APs seem to have interoperability issues if this element is
2109          * included, so while the standard may require us to include the
2110          * element in all cases, it is justifiable to skip it to avoid
2111          * interoperability issues.
2112          */
2113         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2114                 u8 ext_capab[18];
2115                 int ext_capab_len;
2116                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2117                                                      sizeof(ext_capab));
2118                 if (ext_capab_len > 0) {
2119                         u8 *pos = wpa_ie;
2120                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2121                                 pos += 2 + pos[1];
2122                         os_memmove(pos + ext_capab_len, pos,
2123                                    wpa_ie_len - (pos - wpa_ie));
2124                         wpa_ie_len += ext_capab_len;
2125                         os_memcpy(pos, ext_capab, ext_capab_len);
2126                 }
2127         }
2128
2129         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2130                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2131                 size_t len;
2132
2133                 len = sizeof(wpa_ie) - wpa_ie_len;
2134                 if (wpabuf_len(buf) <= len) {
2135                         os_memcpy(wpa_ie + wpa_ie_len,
2136                                   wpabuf_head(buf), wpabuf_len(buf));
2137                         wpa_ie_len += wpabuf_len(buf);
2138                 }
2139         }
2140
2141         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2142         use_crypt = 1;
2143         cipher_pairwise = wpa_s->pairwise_cipher;
2144         cipher_group = wpa_s->group_cipher;
2145         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2146             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2147                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2148                         use_crypt = 0;
2149                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2150                         use_crypt = 1;
2151                         wep_keys_set = 1;
2152                 }
2153         }
2154         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2155                 use_crypt = 0;
2156
2157 #ifdef IEEE8021X_EAPOL
2158         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2159                 if ((ssid->eapol_flags &
2160                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2161                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2162                     !wep_keys_set) {
2163                         use_crypt = 0;
2164                 } else {
2165                         /* Assume that dynamic WEP-104 keys will be used and
2166                          * set cipher suites in order for drivers to expect
2167                          * encryption. */
2168                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2169                 }
2170         }
2171 #endif /* IEEE8021X_EAPOL */
2172
2173         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2174                 /* Set the key before (and later after) association */
2175                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2176         }
2177
2178         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2179         if (bss) {
2180                 params.ssid = bss->ssid;
2181                 params.ssid_len = bss->ssid_len;
2182                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2183                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2184                                    MACSTR " freq=%u MHz based on scan results "
2185                                    "(bssid_set=%d)",
2186                                    MAC2STR(bss->bssid), bss->freq,
2187                                    ssid->bssid_set);
2188                         params.bssid = bss->bssid;
2189                         params.freq.freq = bss->freq;
2190                 }
2191                 params.bssid_hint = bss->bssid;
2192                 params.freq_hint = bss->freq;
2193         } else {
2194                 params.ssid = ssid->ssid;
2195                 params.ssid_len = ssid->ssid_len;
2196         }
2197
2198         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2199             wpa_s->conf->ap_scan == 2) {
2200                 params.bssid = ssid->bssid;
2201                 params.fixed_bssid = 1;
2202         }
2203
2204         /* Initial frequency for IBSS/mesh */
2205         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2206             ssid->frequency > 0 && params.freq.freq == 0)
2207                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2208
2209         if (ssid->mode == WPAS_MODE_IBSS) {
2210                 params.fixed_freq = ssid->fixed_freq;
2211                 if (ssid->beacon_int)
2212                         params.beacon_int = ssid->beacon_int;
2213                 else
2214                         params.beacon_int = wpa_s->conf->beacon_int;
2215         }
2216
2217         params.wpa_ie = wpa_ie;
2218         params.wpa_ie_len = wpa_ie_len;
2219         params.pairwise_suite = cipher_pairwise;
2220         params.group_suite = cipher_group;
2221         params.key_mgmt_suite = wpa_s->key_mgmt;
2222         params.wpa_proto = wpa_s->wpa_proto;
2223         params.auth_alg = algs;
2224         params.mode = ssid->mode;
2225         params.bg_scan_period = ssid->bg_scan_period;
2226         for (i = 0; i < NUM_WEP_KEYS; i++) {
2227                 if (ssid->wep_key_len[i])
2228                         params.wep_key[i] = ssid->wep_key[i];
2229                 params.wep_key_len[i] = ssid->wep_key_len[i];
2230         }
2231         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2232
2233         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2234             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2235              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2236                 params.passphrase = ssid->passphrase;
2237                 if (ssid->psk_set)
2238                         params.psk = ssid->psk;
2239         }
2240
2241         if (wpa_s->conf->key_mgmt_offload) {
2242                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2243                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2244                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2245                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2246                         params.req_key_mgmt_offload =
2247                                 ssid->proactive_key_caching < 0 ?
2248                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2249                 else
2250                         params.req_key_mgmt_offload = 1;
2251
2252                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2253                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2254                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2255                     ssid->psk_set)
2256                         params.psk = ssid->psk;
2257         }
2258
2259         params.drop_unencrypted = use_crypt;
2260
2261 #ifdef CONFIG_IEEE80211W
2262         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2263         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2264                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2265                 struct wpa_ie_data ie;
2266                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2267                     ie.capabilities &
2268                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2269                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2270                                 "MFP: require MFP");
2271                         params.mgmt_frame_protection =
2272                                 MGMT_FRAME_PROTECTION_REQUIRED;
2273                 }
2274         }
2275 #endif /* CONFIG_IEEE80211W */
2276
2277         params.p2p = ssid->p2p_group;
2278
2279         if (wpa_s->parent->set_sta_uapsd)
2280                 params.uapsd = wpa_s->parent->sta_uapsd;
2281         else
2282                 params.uapsd = -1;
2283
2284 #ifdef CONFIG_HT_OVERRIDES
2285         os_memset(&htcaps, 0, sizeof(htcaps));
2286         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2287         params.htcaps = (u8 *) &htcaps;
2288         params.htcaps_mask = (u8 *) &htcaps_mask;
2289         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2290 #endif /* CONFIG_HT_OVERRIDES */
2291 #ifdef CONFIG_VHT_OVERRIDES
2292         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2293         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2294         params.vhtcaps = &vhtcaps;
2295         params.vhtcaps_mask = &vhtcaps_mask;
2296         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2297 #endif /* CONFIG_VHT_OVERRIDES */
2298
2299 #ifdef CONFIG_P2P
2300         /*
2301          * If multi-channel concurrency is not supported, check for any
2302          * frequency conflict. In case of any frequency conflict, remove the
2303          * least prioritized connection.
2304          */
2305         if (wpa_s->num_multichan_concurrent < 2) {
2306                 int freq, num;
2307                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2308                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2309                         wpa_printf(MSG_DEBUG,
2310                                    "Assoc conflicting freq found (%d != %d)",
2311                                    freq, params.freq.freq);
2312                         if (wpas_p2p_handle_frequency_conflicts(
2313                                     wpa_s, params.freq.freq, ssid) < 0) {
2314                                 wpas_connect_work_done(wpa_s);
2315                                 return;
2316                         }
2317                 }
2318         }
2319 #endif /* CONFIG_P2P */
2320
2321         ret = wpa_drv_associate(wpa_s, &params);
2322         if (ret < 0) {
2323                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2324                         "failed");
2325                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2326                         /*
2327                          * The driver is known to mean what is saying, so we
2328                          * can stop right here; the association will not
2329                          * succeed.
2330                          */
2331                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2332                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2333                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2334                         return;
2335                 }
2336                 /* try to continue anyway; new association will be tried again
2337                  * after timeout */
2338                 assoc_failed = 1;
2339         }
2340
2341         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2342                 /* Set the key after the association just in case association
2343                  * cleared the previously configured key. */
2344                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2345                 /* No need to timeout authentication since there is no key
2346                  * management. */
2347                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2348                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2349 #ifdef CONFIG_IBSS_RSN
2350         } else if (ssid->mode == WPAS_MODE_IBSS &&
2351                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2352                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2353                 /*
2354                  * RSN IBSS authentication is per-STA and we can disable the
2355                  * per-BSSID authentication.
2356                  */
2357                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2358 #endif /* CONFIG_IBSS_RSN */
2359         } else {
2360                 /* Timeout for IEEE 802.11 authentication and association */
2361                 int timeout = 60;
2362
2363                 if (assoc_failed) {
2364                         /* give IBSS a bit more time */
2365                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2366                 } else if (wpa_s->conf->ap_scan == 1) {
2367                         /* give IBSS a bit more time */
2368                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2369                 }
2370                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2371         }
2372
2373         if (wep_keys_set &&
2374             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2375                 /* Set static WEP keys again */
2376                 wpa_set_wep_keys(wpa_s, ssid);
2377         }
2378
2379         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2380                 /*
2381                  * Do not allow EAP session resumption between different
2382                  * network configurations.
2383                  */
2384                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2385         }
2386         old_ssid = wpa_s->current_ssid;
2387         wpa_s->current_ssid = ssid;
2388         wpa_s->current_bss = bss;
2389         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2390         wpa_supplicant_initiate_eapol(wpa_s);
2391         if (old_ssid != wpa_s->current_ssid)
2392                 wpas_notify_network_changed(wpa_s);
2393 }
2394
2395
2396 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2397                                             const u8 *addr)
2398 {
2399         struct wpa_ssid *old_ssid;
2400
2401         wpas_connect_work_done(wpa_s);
2402         wpa_clear_keys(wpa_s, addr);
2403         old_ssid = wpa_s->current_ssid;
2404         wpa_supplicant_mark_disassoc(wpa_s);
2405         wpa_sm_set_config(wpa_s->wpa, NULL);
2406         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2407         if (old_ssid != wpa_s->current_ssid)
2408                 wpas_notify_network_changed(wpa_s);
2409         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2410 }
2411
2412
2413 /**
2414  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2415  * @wpa_s: Pointer to wpa_supplicant data
2416  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2417  *
2418  * This function is used to request %wpa_supplicant to deauthenticate from the
2419  * current AP.
2420  */
2421 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2422                                    int reason_code)
2423 {
2424         u8 *addr = NULL;
2425         union wpa_event_data event;
2426         int zero_addr = 0;
2427
2428         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2429                 " pending_bssid=" MACSTR " reason=%d state=%s",
2430                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2431                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2432
2433         if (!is_zero_ether_addr(wpa_s->bssid))
2434                 addr = wpa_s->bssid;
2435         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2436                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2437                   wpa_s->wpa_state == WPA_ASSOCIATING))
2438                 addr = wpa_s->pending_bssid;
2439         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2440                 /*
2441                  * When using driver-based BSS selection, we may not know the
2442                  * BSSID with which we are currently trying to associate. We
2443                  * need to notify the driver of this disconnection even in such
2444                  * a case, so use the all zeros address here.
2445                  */
2446                 addr = wpa_s->bssid;
2447                 zero_addr = 1;
2448         }
2449
2450 #ifdef CONFIG_TDLS
2451         wpa_tdls_teardown_peers(wpa_s->wpa);
2452 #endif /* CONFIG_TDLS */
2453
2454 #ifdef CONFIG_MESH
2455         if (wpa_s->ifmsh) {
2456                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2457                              wpa_s->ifname);
2458                 wpa_supplicant_leave_mesh(wpa_s);
2459         }
2460 #endif /* CONFIG_MESH */
2461
2462         if (addr) {
2463                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2464                 os_memset(&event, 0, sizeof(event));
2465                 event.deauth_info.reason_code = (u16) reason_code;
2466                 event.deauth_info.locally_generated = 1;
2467                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2468                 if (zero_addr)
2469                         addr = NULL;
2470         }
2471
2472         wpa_supplicant_clear_connection(wpa_s, addr);
2473 }
2474
2475 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2476                                               struct wpa_ssid *ssid)
2477 {
2478         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2479                 return;
2480
2481         ssid->disabled = 0;
2482         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2483         wpas_notify_network_enabled_changed(wpa_s, ssid);
2484
2485         /*
2486          * Try to reassociate since there is no current configuration and a new
2487          * network was made available.
2488          */
2489         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2490                 wpa_s->reassociate = 1;
2491 }
2492
2493
2494 /**
2495  * wpa_supplicant_enable_network - Mark a configured network as enabled
2496  * @wpa_s: wpa_supplicant structure for a network interface
2497  * @ssid: wpa_ssid structure for a configured network or %NULL
2498  *
2499  * Enables the specified network or all networks if no network specified.
2500  */
2501 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2502                                    struct wpa_ssid *ssid)
2503 {
2504         if (ssid == NULL) {
2505                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2506                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2507         } else
2508                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2509
2510         if (wpa_s->reassociate && !wpa_s->disconnected) {
2511                 if (wpa_s->sched_scanning) {
2512                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2513                                    "new network to scan filters");
2514                         wpa_supplicant_cancel_sched_scan(wpa_s);
2515                 }
2516
2517                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2518                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2519         }
2520 }
2521
2522
2523 /**
2524  * wpa_supplicant_disable_network - Mark a configured network as disabled
2525  * @wpa_s: wpa_supplicant structure for a network interface
2526  * @ssid: wpa_ssid structure for a configured network or %NULL
2527  *
2528  * Disables the specified network or all networks if no network specified.
2529  */
2530 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2531                                     struct wpa_ssid *ssid)
2532 {
2533         struct wpa_ssid *other_ssid;
2534         int was_disabled;
2535
2536         if (ssid == NULL) {
2537                 if (wpa_s->sched_scanning)
2538                         wpa_supplicant_cancel_sched_scan(wpa_s);
2539
2540                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2541                      other_ssid = other_ssid->next) {
2542                         was_disabled = other_ssid->disabled;
2543                         if (was_disabled == 2)
2544                                 continue; /* do not change persistent P2P group
2545                                            * data */
2546
2547                         other_ssid->disabled = 1;
2548
2549                         if (was_disabled != other_ssid->disabled)
2550                                 wpas_notify_network_enabled_changed(
2551                                         wpa_s, other_ssid);
2552                 }
2553                 if (wpa_s->current_ssid)
2554                         wpa_supplicant_deauthenticate(
2555                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2556         } else if (ssid->disabled != 2) {
2557                 if (ssid == wpa_s->current_ssid)
2558                         wpa_supplicant_deauthenticate(
2559                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2560
2561                 was_disabled = ssid->disabled;
2562
2563                 ssid->disabled = 1;
2564
2565                 if (was_disabled != ssid->disabled) {
2566                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2567                         if (wpa_s->sched_scanning) {
2568                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2569                                            "to remove network from filters");
2570                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2571                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2572                         }
2573                 }
2574         }
2575 }
2576
2577
2578 /**
2579  * wpa_supplicant_select_network - Attempt association with a network
2580  * @wpa_s: wpa_supplicant structure for a network interface
2581  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2582  */
2583 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2584                                    struct wpa_ssid *ssid)
2585 {
2586
2587         struct wpa_ssid *other_ssid;
2588         int disconnected = 0;
2589
2590         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2591                 wpa_s->own_disconnect_req = 1;
2592                 wpa_supplicant_deauthenticate(
2593                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2594                 disconnected = 1;
2595         }
2596
2597         if (ssid)
2598                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2599
2600         /*
2601          * Mark all other networks disabled or mark all networks enabled if no
2602          * network specified.
2603          */
2604         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2605              other_ssid = other_ssid->next) {
2606                 int was_disabled = other_ssid->disabled;
2607                 if (was_disabled == 2)
2608                         continue; /* do not change persistent P2P group data */
2609
2610                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2611                 if (was_disabled && !other_ssid->disabled)
2612                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2613
2614                 if (was_disabled != other_ssid->disabled)
2615                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2616         }
2617
2618         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2619                 /* We are already associated with the selected network */
2620                 wpa_printf(MSG_DEBUG, "Already associated with the "
2621                            "selected network - do nothing");
2622                 return;
2623         }
2624
2625         if (ssid) {
2626                 wpa_s->current_ssid = ssid;
2627                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2628                 wpa_s->connect_without_scan =
2629                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2630
2631                 /*
2632                  * Don't optimize next scan freqs since a new ESS has been
2633                  * selected.
2634                  */
2635                 os_free(wpa_s->next_scan_freqs);
2636                 wpa_s->next_scan_freqs = NULL;
2637         } else {
2638                 wpa_s->connect_without_scan = NULL;
2639         }
2640
2641         wpa_s->disconnected = 0;
2642         wpa_s->reassociate = 1;
2643
2644         if (wpa_s->connect_without_scan ||
2645             wpa_supplicant_fast_associate(wpa_s) != 1)
2646                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2647
2648         if (ssid)
2649                 wpas_notify_network_selected(wpa_s, ssid);
2650 }
2651
2652
2653 /**
2654  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2655  * @wpa_s: wpa_supplicant structure for a network interface
2656  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2657  * @pkcs11_module_path: PKCS #11 module path or NULL
2658  * Returns: 0 on success; -1 on failure
2659  *
2660  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2661  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2662  * module path fails the paths will be reset to the default value (NULL).
2663  */
2664 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2665                                            const char *pkcs11_engine_path,
2666                                            const char *pkcs11_module_path)
2667 {
2668         char *pkcs11_engine_path_copy = NULL;
2669         char *pkcs11_module_path_copy = NULL;
2670
2671         if (pkcs11_engine_path != NULL) {
2672                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2673                 if (pkcs11_engine_path_copy == NULL)
2674                         return -1;
2675         }
2676         if (pkcs11_module_path != NULL) {
2677                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2678                 if (pkcs11_module_path_copy == NULL) {
2679                         os_free(pkcs11_engine_path_copy);
2680                         return -1;
2681                 }
2682         }
2683
2684         os_free(wpa_s->conf->pkcs11_engine_path);
2685         os_free(wpa_s->conf->pkcs11_module_path);
2686         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2687         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2688
2689         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2690         eapol_sm_deinit(wpa_s->eapol);
2691         wpa_s->eapol = NULL;
2692         if (wpa_supplicant_init_eapol(wpa_s)) {
2693                 /* Error -> Reset paths to the default value (NULL) once. */
2694                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2695                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2696                                                                NULL);
2697
2698                 return -1;
2699         }
2700         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2701
2702         return 0;
2703 }
2704
2705
2706 /**
2707  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2708  * @wpa_s: wpa_supplicant structure for a network interface
2709  * @ap_scan: AP scan mode
2710  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2711  *
2712  */
2713 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2714 {
2715
2716         int old_ap_scan;
2717
2718         if (ap_scan < 0 || ap_scan > 2)
2719                 return -1;
2720
2721 #ifdef ANDROID
2722         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2723             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2724             wpa_s->wpa_state < WPA_COMPLETED) {
2725                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2726                            "associating", wpa_s->conf->ap_scan, ap_scan);
2727                 return 0;
2728         }
2729 #endif /* ANDROID */
2730
2731         old_ap_scan = wpa_s->conf->ap_scan;
2732         wpa_s->conf->ap_scan = ap_scan;
2733
2734         if (old_ap_scan != wpa_s->conf->ap_scan)
2735                 wpas_notify_ap_scan_changed(wpa_s);
2736
2737         return 0;
2738 }
2739
2740
2741 /**
2742  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2743  * @wpa_s: wpa_supplicant structure for a network interface
2744  * @expire_age: Expiration age in seconds
2745  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2746  *
2747  */
2748 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2749                                           unsigned int bss_expire_age)
2750 {
2751         if (bss_expire_age < 10) {
2752                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2753                         bss_expire_age);
2754                 return -1;
2755         }
2756         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2757                 bss_expire_age);
2758         wpa_s->conf->bss_expiration_age = bss_expire_age;
2759
2760         return 0;
2761 }
2762
2763
2764 /**
2765  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2766  * @wpa_s: wpa_supplicant structure for a network interface
2767  * @expire_count: number of scans after which an unseen BSS is reclaimed
2768  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2769  *
2770  */
2771 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2772                                             unsigned int bss_expire_count)
2773 {
2774         if (bss_expire_count < 1) {
2775                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2776                         bss_expire_count);
2777                 return -1;
2778         }
2779         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2780                 bss_expire_count);
2781         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2782
2783         return 0;
2784 }
2785
2786
2787 /**
2788  * wpa_supplicant_set_scan_interval - Set scan interval
2789  * @wpa_s: wpa_supplicant structure for a network interface
2790  * @scan_interval: scan interval in seconds
2791  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2792  *
2793  */
2794 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2795                                      int scan_interval)
2796 {
2797         if (scan_interval < 0) {
2798                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2799                         scan_interval);
2800                 return -1;
2801         }
2802         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2803                 scan_interval);
2804         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2805
2806         return 0;
2807 }
2808
2809
2810 /**
2811  * wpa_supplicant_set_debug_params - Set global debug params
2812  * @global: wpa_global structure
2813  * @debug_level: debug level
2814  * @debug_timestamp: determines if show timestamp in debug data
2815  * @debug_show_keys: determines if show keys in debug data
2816  * Returns: 0 if succeed or -1 if debug_level has wrong value
2817  */
2818 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2819                                     int debug_timestamp, int debug_show_keys)
2820 {
2821
2822         int old_level, old_timestamp, old_show_keys;
2823
2824         /* check for allowed debuglevels */
2825         if (debug_level != MSG_EXCESSIVE &&
2826             debug_level != MSG_MSGDUMP &&
2827             debug_level != MSG_DEBUG &&
2828             debug_level != MSG_INFO &&
2829             debug_level != MSG_WARNING &&
2830             debug_level != MSG_ERROR)
2831                 return -1;
2832
2833         old_level = wpa_debug_level;
2834         old_timestamp = wpa_debug_timestamp;
2835         old_show_keys = wpa_debug_show_keys;
2836
2837         wpa_debug_level = debug_level;
2838         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2839         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2840
2841         if (wpa_debug_level != old_level)
2842                 wpas_notify_debug_level_changed(global);
2843         if (wpa_debug_timestamp != old_timestamp)
2844                 wpas_notify_debug_timestamp_changed(global);
2845         if (wpa_debug_show_keys != old_show_keys)
2846                 wpas_notify_debug_show_keys_changed(global);
2847
2848         return 0;
2849 }
2850
2851
2852 /**
2853  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2854  * @wpa_s: Pointer to wpa_supplicant data
2855  * Returns: A pointer to the current network structure or %NULL on failure
2856  */
2857 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2858 {
2859         struct wpa_ssid *entry;
2860         u8 ssid[MAX_SSID_LEN];
2861         int res;
2862         size_t ssid_len;
2863         u8 bssid[ETH_ALEN];
2864         int wired;
2865
2866         res = wpa_drv_get_ssid(wpa_s, ssid);
2867         if (res < 0) {
2868                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2869                         "driver");
2870                 return NULL;
2871         }
2872         ssid_len = res;
2873
2874         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2875                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2876                         "driver");
2877                 return NULL;
2878         }
2879
2880         wired = wpa_s->conf->ap_scan == 0 &&
2881                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2882
2883         entry = wpa_s->conf->ssid;
2884         while (entry) {
2885                 if (!wpas_network_disabled(wpa_s, entry) &&
2886                     ((ssid_len == entry->ssid_len &&
2887                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2888                     (!entry->bssid_set ||
2889                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2890                         return entry;
2891 #ifdef CONFIG_WPS
2892                 if (!wpas_network_disabled(wpa_s, entry) &&
2893                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2894                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2895                     (!entry->bssid_set ||
2896                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2897                         return entry;
2898 #endif /* CONFIG_WPS */
2899
2900                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2901                     entry->ssid_len == 0 &&
2902                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2903                         return entry;
2904
2905                 entry = entry->next;
2906         }
2907
2908         return NULL;
2909 }
2910
2911
2912 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2913 {
2914         struct wpa_global *global = wpa_s->global;
2915
2916         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2917                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2918                 if (global->drv_priv[i] == NULL) {
2919                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2920                                    "'%s'", wpa_drivers[i]->name);
2921                         return -1;
2922                 }
2923         }
2924
2925         wpa_s->driver = wpa_drivers[i];
2926         wpa_s->global_drv_priv = global->drv_priv[i];
2927
2928         return 0;
2929 }
2930
2931
2932 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2933                                      const char *name)
2934 {
2935         int i;
2936         size_t len;
2937         const char *pos, *driver = name;
2938
2939         if (wpa_s == NULL)
2940                 return -1;
2941
2942         if (wpa_drivers[0] == NULL) {
2943                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2944                         "wpa_supplicant");
2945                 return -1;
2946         }
2947
2948         if (name == NULL) {
2949                 /* default to first driver in the list */
2950                 return select_driver(wpa_s, 0);
2951         }
2952
2953         do {
2954                 pos = os_strchr(driver, ',');
2955                 if (pos)
2956                         len = pos - driver;
2957                 else
2958                         len = os_strlen(driver);
2959
2960                 for (i = 0; wpa_drivers[i]; i++) {
2961                         if (os_strlen(wpa_drivers[i]->name) == len &&
2962                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2963                             0) {
2964                                 /* First driver that succeeds wins */
2965                                 if (select_driver(wpa_s, i) == 0)
2966                                         return 0;
2967                         }
2968                 }
2969
2970                 driver = pos + 1;
2971         } while (pos);
2972
2973         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2974         return -1;
2975 }
2976
2977
2978 /**
2979  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2980  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2981  *      with struct wpa_driver_ops::init()
2982  * @src_addr: Source address of the EAPOL frame
2983  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2984  * @len: Length of the EAPOL data
2985  *
2986  * This function is called for each received EAPOL frame. Most driver
2987  * interfaces rely on more generic OS mechanism for receiving frames through
2988  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2989  * take care of received EAPOL frames and deliver them to the core supplicant
2990  * code by calling this function.
2991  */
2992 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2993                              const u8 *buf, size_t len)
2994 {
2995         struct wpa_supplicant *wpa_s = ctx;
2996
2997         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2998         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2999
3000 #ifdef CONFIG_PEERKEY
3001         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3002             wpa_s->current_ssid->peerkey &&
3003             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3004             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3005                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3006                 return;
3007         }
3008 #endif /* CONFIG_PEERKEY */
3009
3010         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3011             (wpa_s->last_eapol_matches_bssid &&
3012 #ifdef CONFIG_AP
3013              !wpa_s->ap_iface &&
3014 #endif /* CONFIG_AP */
3015              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3016                 /*
3017                  * There is possible race condition between receiving the
3018                  * association event and the EAPOL frame since they are coming
3019                  * through different paths from the driver. In order to avoid
3020                  * issues in trying to process the EAPOL frame before receiving
3021                  * association information, lets queue it for processing until
3022                  * the association event is received. This may also be needed in
3023                  * driver-based roaming case, so also use src_addr != BSSID as a
3024                  * trigger if we have previously confirmed that the
3025                  * Authenticator uses BSSID as the src_addr (which is not the
3026                  * case with wired IEEE 802.1X).
3027                  */
3028                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3029                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3030                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3031                         MAC2STR(wpa_s->bssid));
3032                 wpabuf_free(wpa_s->pending_eapol_rx);
3033                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3034                 if (wpa_s->pending_eapol_rx) {
3035                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3036                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3037                                   ETH_ALEN);
3038                 }
3039                 return;
3040         }
3041
3042         wpa_s->last_eapol_matches_bssid =
3043                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3044
3045 #ifdef CONFIG_AP
3046         if (wpa_s->ap_iface) {
3047                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3048                 return;
3049         }
3050 #endif /* CONFIG_AP */
3051
3052         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3053                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3054                         "no key management is configured");
3055                 return;
3056         }
3057
3058         if (wpa_s->eapol_received == 0 &&
3059             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3060              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3061              wpa_s->wpa_state != WPA_COMPLETED) &&
3062             (wpa_s->current_ssid == NULL ||
3063              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3064                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3065                 wpa_supplicant_req_auth_timeout(
3066                         wpa_s,
3067                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3068                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3069                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
3070                         70 : 10, 0);
3071         }
3072         wpa_s->eapol_received++;
3073
3074         if (wpa_s->countermeasures) {
3075                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3076                         "EAPOL packet");
3077                 return;
3078         }
3079
3080 #ifdef CONFIG_IBSS_RSN
3081         if (wpa_s->current_ssid &&
3082             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3083                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3084                 return;
3085         }
3086 #endif /* CONFIG_IBSS_RSN */
3087
3088         /* Source address of the incoming EAPOL frame could be compared to the
3089          * current BSSID. However, it is possible that a centralized
3090          * Authenticator could be using another MAC address than the BSSID of
3091          * an AP, so just allow any address to be used for now. The replies are
3092          * still sent to the current BSSID (if available), though. */
3093
3094         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3095         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3096             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3097                 return;
3098         wpa_drv_poll(wpa_s);
3099         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3100                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3101         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3102                 /*
3103                  * Set portValid = TRUE here since we are going to skip 4-way
3104                  * handshake processing which would normally set portValid. We
3105                  * need this to allow the EAPOL state machines to be completed
3106                  * without going through EAPOL-Key handshake.
3107                  */
3108                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3109         }
3110 }
3111
3112
3113 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3114 {
3115         if ((!wpa_s->p2p_mgmt ||
3116              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3117             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3118                 l2_packet_deinit(wpa_s->l2);
3119                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3120                                            wpa_drv_get_mac_addr(wpa_s),
3121                                            ETH_P_EAPOL,
3122                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3123                 if (wpa_s->l2 == NULL)
3124                         return -1;
3125         } else {
3126                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3127                 if (addr)
3128                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3129         }
3130
3131         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3132                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3133                 return -1;
3134         }
3135
3136         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3137
3138         return 0;
3139 }
3140
3141
3142 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3143                                            const u8 *buf, size_t len)
3144 {
3145         struct wpa_supplicant *wpa_s = ctx;
3146         const struct l2_ethhdr *eth;
3147
3148         if (len < sizeof(*eth))
3149                 return;
3150         eth = (const struct l2_ethhdr *) buf;
3151
3152         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3153             !(eth->h_dest[0] & 0x01)) {
3154                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3155                         " (bridge - not for this interface - ignore)",
3156                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3157                 return;
3158         }
3159
3160         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3161                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3162         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3163                                 len - sizeof(*eth));
3164 }
3165
3166
3167 /**
3168  * wpa_supplicant_driver_init - Initialize driver interface parameters
3169  * @wpa_s: Pointer to wpa_supplicant data
3170  * Returns: 0 on success, -1 on failure
3171  *
3172  * This function is called to initialize driver interface parameters.
3173  * wpa_drv_init() must have been called before this function to initialize the
3174  * driver interface.
3175  */
3176 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3177 {
3178         static int interface_count = 0;
3179
3180         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3181                 return -1;
3182
3183         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3184                 MAC2STR(wpa_s->own_addr));
3185         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3186         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3187
3188         if (wpa_s->bridge_ifname[0]) {
3189                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3190                         "interface '%s'", wpa_s->bridge_ifname);
3191                 wpa_s->l2_br = l2_packet_init_bridge(
3192                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3193                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3194                 if (wpa_s->l2_br == NULL) {
3195                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3196                                 "connection for the bridge interface '%s'",
3197                                 wpa_s->bridge_ifname);
3198                         return -1;
3199                 }
3200         }
3201
3202         wpa_clear_keys(wpa_s, NULL);
3203
3204         /* Make sure that TKIP countermeasures are not left enabled (could
3205          * happen if wpa_supplicant is killed during countermeasures. */
3206         wpa_drv_set_countermeasures(wpa_s, 0);
3207
3208         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3209         wpa_drv_flush_pmkid(wpa_s);
3210
3211         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3212         wpa_s->prev_scan_wildcard = 0;
3213
3214         if (wpa_supplicant_enabled_networks(wpa_s)) {
3215                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3216                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3217                         interface_count = 0;
3218                 }
3219 #ifndef ANDROID
3220                 if (!wpa_s->p2p_mgmt &&
3221                     wpa_supplicant_delayed_sched_scan(wpa_s,
3222                                                       interface_count % 3,
3223                                                       100000))
3224                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3225                                                 100000);
3226 #endif /* ANDROID */
3227                 interface_count++;
3228         } else
3229                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3230
3231         return 0;
3232 }
3233
3234
3235 static int wpa_supplicant_daemon(const char *pid_file)
3236 {
3237         wpa_printf(MSG_DEBUG, "Daemonize..");
3238         return os_daemonize(pid_file);
3239 }
3240
3241
3242 static struct wpa_supplicant *
3243 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3244 {
3245         struct wpa_supplicant *wpa_s;
3246
3247         wpa_s = os_zalloc(sizeof(*wpa_s));
3248         if (wpa_s == NULL)
3249                 return NULL;
3250         wpa_s->scan_req = INITIAL_SCAN_REQ;
3251         wpa_s->scan_interval = 5;
3252         wpa_s->new_connection = 1;
3253         wpa_s->parent = parent ? parent : wpa_s;
3254         wpa_s->sched_scanning = 0;
3255
3256         return wpa_s;
3257 }
3258
3259
3260 #ifdef CONFIG_HT_OVERRIDES
3261
3262 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3263                              struct ieee80211_ht_capabilities *htcaps,
3264                              struct ieee80211_ht_capabilities *htcaps_mask,
3265                              const char *ht_mcs)
3266 {
3267         /* parse ht_mcs into hex array */
3268         int i;
3269         const char *tmp = ht_mcs;
3270         char *end = NULL;
3271
3272         /* If ht_mcs is null, do not set anything */
3273         if (!ht_mcs)
3274                 return 0;
3275
3276         /* This is what we are setting in the kernel */
3277         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3278
3279         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3280
3281         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3282                 errno = 0;
3283                 long v = strtol(tmp, &end, 16);
3284                 if (errno == 0) {
3285                         wpa_msg(wpa_s, MSG_DEBUG,
3286                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3287                                 i, v, end, tmp);
3288                         if (end == tmp)
3289                                 break;
3290
3291                         htcaps->supported_mcs_set[i] = v;
3292                         tmp = end;
3293                 } else {
3294                         wpa_msg(wpa_s, MSG_ERROR,
3295                                 "Failed to parse ht-mcs: %s, error: %s\n",
3296                                 ht_mcs, strerror(errno));
3297                         return -1;
3298                 }
3299         }
3300
3301         /*
3302          * If we were able to parse any values, then set mask for the MCS set.
3303          */
3304         if (i) {
3305                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3306                           IEEE80211_HT_MCS_MASK_LEN - 1);
3307                 /* skip the 3 reserved bits */
3308                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3309                         0x1f;
3310         }
3311
3312         return 0;
3313 }
3314
3315
3316 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3317                                  struct ieee80211_ht_capabilities *htcaps,
3318                                  struct ieee80211_ht_capabilities *htcaps_mask,
3319                                  int disabled)
3320 {
3321         le16 msk;
3322
3323         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3324
3325         if (disabled == -1)
3326                 return 0;
3327
3328         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3329         htcaps_mask->ht_capabilities_info |= msk;
3330         if (disabled)
3331                 htcaps->ht_capabilities_info &= msk;
3332         else
3333                 htcaps->ht_capabilities_info |= msk;
3334
3335         return 0;
3336 }
3337
3338
3339 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3340                                 struct ieee80211_ht_capabilities *htcaps,
3341                                 struct ieee80211_ht_capabilities *htcaps_mask,
3342                                 int factor)
3343 {
3344         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3345
3346         if (factor == -1)
3347                 return 0;
3348
3349         if (factor < 0 || factor > 3) {
3350                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3351                         "Must be 0-3 or -1", factor);
3352                 return -EINVAL;
3353         }
3354
3355         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3356         htcaps->a_mpdu_params &= ~0x3;
3357         htcaps->a_mpdu_params |= factor & 0x3;
3358
3359         return 0;
3360 }
3361
3362
3363 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3364                                  struct ieee80211_ht_capabilities *htcaps,
3365                                  struct ieee80211_ht_capabilities *htcaps_mask,
3366                                  int density)
3367 {
3368         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3369
3370         if (density == -1)
3371                 return 0;
3372
3373         if (density < 0 || density > 7) {
3374                 wpa_msg(wpa_s, MSG_ERROR,
3375                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3376                         density);
3377                 return -EINVAL;
3378         }
3379
3380         htcaps_mask->a_mpdu_params |= 0x1C;
3381         htcaps->a_mpdu_params &= ~(0x1C);
3382         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3383
3384         return 0;
3385 }
3386
3387
3388 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3389                                 struct ieee80211_ht_capabilities *htcaps,
3390                                 struct ieee80211_ht_capabilities *htcaps_mask,
3391                                 int disabled)
3392 {
3393         /* Masking these out disables HT40 */
3394         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3395                                 HT_CAP_INFO_SHORT_GI40MHZ);
3396
3397         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3398
3399         if (disabled)
3400                 htcaps->ht_capabilities_info &= ~msk;
3401         else
3402                 htcaps->ht_capabilities_info |= msk;
3403
3404         htcaps_mask->ht_capabilities_info |= msk;
3405
3406         return 0;
3407 }
3408
3409
3410 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3411                                struct ieee80211_ht_capabilities *htcaps,
3412                                struct ieee80211_ht_capabilities *htcaps_mask,
3413                                int disabled)
3414 {
3415         /* Masking these out disables SGI */
3416         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3417                                 HT_CAP_INFO_SHORT_GI40MHZ);
3418
3419         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3420
3421         if (disabled)
3422                 htcaps->ht_capabilities_info &= ~msk;
3423         else
3424                 htcaps->ht_capabilities_info |= msk;
3425
3426         htcaps_mask->ht_capabilities_info |= msk;
3427
3428         return 0;
3429 }
3430
3431
3432 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3433                                struct ieee80211_ht_capabilities *htcaps,
3434                                struct ieee80211_ht_capabilities *htcaps_mask,
3435                                int disabled)
3436 {
3437         /* Masking these out disables LDPC */
3438         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3439
3440         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3441
3442         if (disabled)
3443                 htcaps->ht_capabilities_info &= ~msk;
3444         else
3445                 htcaps->ht_capabilities_info |= msk;
3446
3447         htcaps_mask->ht_capabilities_info |= msk;
3448
3449         return 0;
3450 }
3451
3452
3453 void wpa_supplicant_apply_ht_overrides(
3454         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3455         struct wpa_driver_associate_params *params)
3456 {
3457         struct ieee80211_ht_capabilities *htcaps;
3458         struct ieee80211_ht_capabilities *htcaps_mask;
3459
3460         if (!ssid)
3461                 return;
3462
3463         params->disable_ht = ssid->disable_ht;
3464         if (!params->htcaps || !params->htcaps_mask)
3465                 return;
3466
3467         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3468         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3469         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3470         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3471                               ssid->disable_max_amsdu);
3472         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3473         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3474         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3475         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3476         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3477
3478         if (ssid->ht40_intolerant) {
3479                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3480                 htcaps->ht_capabilities_info |= bit;
3481                 htcaps_mask->ht_capabilities_info |= bit;
3482         }
3483 }
3484
3485 #endif /* CONFIG_HT_OVERRIDES */
3486
3487
3488 #ifdef CONFIG_VHT_OVERRIDES
3489 void wpa_supplicant_apply_vht_overrides(
3490         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3491         struct wpa_driver_associate_params *params)
3492 {
3493         struct ieee80211_vht_capabilities *vhtcaps;
3494         struct ieee80211_vht_capabilities *vhtcaps_mask;
3495
3496         if (!ssid)
3497                 return;
3498
3499         params->disable_vht = ssid->disable_vht;
3500
3501         vhtcaps = (void *) params->vhtcaps;
3502         vhtcaps_mask = (void *) params->vhtcaps_mask;
3503
3504         if (!vhtcaps || !vhtcaps_mask)
3505                 return;
3506
3507         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3508         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3509
3510 #ifdef CONFIG_HT_OVERRIDES
3511         /* if max ampdu is <= 3, we have to make the HT cap the same */
3512         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3513                 int max_ampdu;
3514
3515                 max_ampdu = (ssid->vht_capa &
3516                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3517                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3518
3519                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3520                 wpa_set_ampdu_factor(wpa_s,
3521                                      (void *) params->htcaps,
3522                                      (void *) params->htcaps_mask,
3523                                      max_ampdu);
3524         }
3525 #endif /* CONFIG_HT_OVERRIDES */
3526
3527 #define OVERRIDE_MCS(i)                                                 \
3528         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3529                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3530                         3 << 2 * (i - 1);                               \
3531                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3532                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3533         }                                                               \
3534         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3535                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3536                         3 << 2 * (i - 1);                               \
3537                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3538                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3539         }
3540
3541         OVERRIDE_MCS(1);
3542         OVERRIDE_MCS(2);
3543         OVERRIDE_MCS(3);
3544         OVERRIDE_MCS(4);
3545         OVERRIDE_MCS(5);
3546         OVERRIDE_MCS(6);
3547         OVERRIDE_MCS(7);
3548         OVERRIDE_MCS(8);
3549 }
3550 #endif /* CONFIG_VHT_OVERRIDES */
3551
3552
3553 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3554 {
3555 #ifdef PCSC_FUNCS
3556         size_t len;
3557
3558         if (!wpa_s->conf->pcsc_reader)
3559                 return 0;
3560
3561         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3562         if (!wpa_s->scard)
3563                 return 1;
3564
3565         if (wpa_s->conf->pcsc_pin &&
3566             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3567                 scard_deinit(wpa_s->scard);
3568                 wpa_s->scard = NULL;
3569                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3570                 return -1;
3571         }
3572
3573         len = sizeof(wpa_s->imsi) - 1;
3574         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3575                 scard_deinit(wpa_s->scard);
3576                 wpa_s->scard = NULL;
3577                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3578                 return -1;
3579         }
3580         wpa_s->imsi[len] = '\0';
3581
3582         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3583
3584         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3585                    wpa_s->imsi, wpa_s->mnc_len);
3586
3587         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3588         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3589 #endif /* PCSC_FUNCS */
3590
3591         return 0;
3592 }
3593
3594
3595 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3596 {
3597         char *val, *pos;
3598
3599         ext_password_deinit(wpa_s->ext_pw);
3600         wpa_s->ext_pw = NULL;
3601         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3602
3603         if (!wpa_s->conf->ext_password_backend)
3604                 return 0;
3605
3606         val = os_strdup(wpa_s->conf->ext_password_backend);
3607         if (val == NULL)
3608                 return -1;
3609         pos = os_strchr(val, ':');
3610         if (pos)
3611                 *pos++ = '\0';
3612
3613         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3614
3615         wpa_s->ext_pw = ext_password_init(val, pos);
3616         os_free(val);
3617         if (wpa_s->ext_pw == NULL) {
3618                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3619                 return -1;
3620         }
3621         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3622
3623         return 0;
3624 }
3625
3626
3627 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3628                                     const struct wpa_driver_capa *capa)
3629 {
3630         struct wowlan_triggers *triggers;
3631         int ret = 0;
3632
3633         if (!wpa_s->conf->wowlan_triggers)
3634                 return 0;
3635
3636         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3637         if (triggers) {
3638                 ret = wpa_drv_wowlan(wpa_s, triggers);
3639                 os_free(triggers);
3640         }
3641         return ret;
3642 }
3643
3644
3645 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3646                                               const char *rn)
3647 {
3648         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3649         struct wpa_radio *radio;
3650
3651         while (rn && iface) {
3652                 radio = iface->radio;
3653                 if (radio && os_strcmp(rn, radio->name) == 0) {
3654                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3655                                    wpa_s->ifname, rn);
3656                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3657                         return radio;
3658                 }
3659
3660                 iface = iface->next;
3661         }
3662
3663         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3664                    wpa_s->ifname, rn ? rn : "N/A");
3665         radio = os_zalloc(sizeof(*radio));
3666         if (radio == NULL)
3667                 return NULL;
3668
3669         if (rn)
3670                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3671         dl_list_init(&radio->ifaces);
3672         dl_list_init(&radio->work);
3673         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3674
3675         return radio;
3676 }
3677
3678
3679 static void radio_work_free(struct wpa_radio_work *work)
3680 {
3681         if (work->wpa_s->scan_work == work) {
3682                 /* This should not really happen. */
3683                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3684                         work->type, work, work->started);
3685                 work->wpa_s->scan_work = NULL;
3686         }
3687
3688 #ifdef CONFIG_P2P
3689         if (work->wpa_s->p2p_scan_work == work) {
3690                 /* This should not really happen. */
3691                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3692                         work->type, work, work->started);
3693                 work->wpa_s->p2p_scan_work = NULL;
3694         }
3695 #endif /* CONFIG_P2P */
3696
3697         dl_list_del(&work->list);
3698         os_free(work);
3699 }
3700
3701
3702 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3703 {
3704         struct wpa_radio *radio = eloop_ctx;
3705         struct wpa_radio_work *work;
3706         struct os_reltime now, diff;
3707         struct wpa_supplicant *wpa_s;
3708
3709         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3710         if (work == NULL)
3711                 return;
3712
3713         if (work->started)
3714                 return; /* already started and still in progress */
3715
3716         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3717                               radio_list);
3718         if (wpa_s && wpa_s->radio->external_scan_running) {
3719                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3720                 return;
3721         }
3722
3723         os_get_reltime(&now);
3724         os_reltime_sub(&now, &work->time, &diff);
3725         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3726                 work->type, work, diff.sec, diff.usec);
3727         work->started = 1;
3728         work->time = now;
3729         work->cb(work, 0);
3730 }
3731
3732
3733 /*
3734  * This function removes both started and pending radio works running on
3735  * the provided interface's radio.
3736  * Prior to the removal of the radio work, its callback (cb) is called with
3737  * deinit set to be 1. Each work's callback is responsible for clearing its
3738  * internal data and restoring to a correct state.
3739  * @wpa_s: wpa_supplicant data
3740  * @type: type of works to be removed
3741  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3742  * this interface's works.
3743  */
3744 void radio_remove_works(struct wpa_supplicant *wpa_s,
3745                         const char *type, int remove_all)
3746 {
3747         struct wpa_radio_work *work, *tmp;
3748         struct wpa_radio *radio = wpa_s->radio;
3749
3750         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3751                               list) {
3752                 if (type && os_strcmp(type, work->type) != 0)
3753                         continue;
3754
3755                 /* skip other ifaces' works */
3756                 if (!remove_all && work->wpa_s != wpa_s)
3757                         continue;
3758
3759                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3760                         work->type, work, work->started ? " (started)" : "");
3761                 work->cb(work, 1);
3762                 radio_work_free(work);
3763         }
3764
3765         /* in case we removed the started work */
3766         radio_work_check_next(wpa_s);
3767 }
3768
3769
3770 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3771 {
3772         struct wpa_radio *radio = wpa_s->radio;
3773
3774         if (!radio)
3775                 return;
3776
3777         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3778                    wpa_s->ifname, radio->name);
3779         dl_list_del(&wpa_s->radio_list);
3780         radio_remove_works(wpa_s, NULL, 0);
3781         wpa_s->radio = NULL;
3782         if (!dl_list_empty(&radio->ifaces))
3783                 return; /* Interfaces remain for this radio */
3784
3785         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3786         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3787         os_free(radio);
3788 }
3789
3790
3791 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3792 {
3793         struct wpa_radio *radio = wpa_s->radio;
3794
3795         if (dl_list_empty(&radio->work))
3796                 return;
3797         if (wpa_s->ext_work_in_progress) {
3798                 wpa_printf(MSG_DEBUG,
3799                            "External radio work in progress - delay start of pending item");
3800                 return;
3801         }
3802         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3803         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3804 }
3805
3806
3807 /**
3808  * radio_add_work - Add a radio work item
3809  * @wpa_s: Pointer to wpa_supplicant data
3810  * @freq: Frequency of the offchannel operation in MHz or 0
3811  * @type: Unique identifier for each type of work
3812  * @next: Force as the next work to be executed
3813  * @cb: Callback function for indicating when radio is available
3814  * @ctx: Context pointer for the work (work->ctx in cb())
3815  * Returns: 0 on success, -1 on failure
3816  *
3817  * This function is used to request time for an operation that requires
3818  * exclusive radio control. Once the radio is available, the registered callback
3819  * function will be called. radio_work_done() must be called once the exclusive
3820  * radio operation has been completed, so that the radio is freed for other
3821  * operations. The special case of deinit=1 is used to free the context data
3822  * during interface removal. That does not allow the callback function to start
3823  * the radio operation, i.e., it must free any resources allocated for the radio
3824  * work and return.
3825  *
3826  * The @freq parameter can be used to indicate a single channel on which the
3827  * offchannel operation will occur. This may allow multiple radio work
3828  * operations to be performed in parallel if they apply for the same channel.
3829  * Setting this to 0 indicates that the work item may use multiple channels or
3830  * requires exclusive control of the radio.
3831  */
3832 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3833                    const char *type, int next,
3834                    void (*cb)(struct wpa_radio_work *work, int deinit),
3835                    void *ctx)
3836 {
3837         struct wpa_radio_work *work;
3838         int was_empty;
3839
3840         work = os_zalloc(sizeof(*work));
3841         if (work == NULL)
3842                 return -1;
3843         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3844         os_get_reltime(&work->time);
3845         work->freq = freq;
3846         work->type = type;
3847         work->wpa_s = wpa_s;
3848         work->cb = cb;
3849         work->ctx = ctx;
3850
3851         was_empty = dl_list_empty(&wpa_s->radio->work);
3852         if (next)
3853                 dl_list_add(&wpa_s->radio->work, &work->list);
3854         else
3855                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3856         if (was_empty) {
3857                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3858                 radio_work_check_next(wpa_s);
3859         }
3860
3861         return 0;
3862 }
3863
3864
3865 /**
3866  * radio_work_done - Indicate that a radio work item has been completed
3867  * @work: Completed work
3868  *
3869  * This function is called once the callback function registered with
3870  * radio_add_work() has completed its work.
3871  */
3872 void radio_work_done(struct wpa_radio_work *work)
3873 {
3874         struct wpa_supplicant *wpa_s = work->wpa_s;
3875         struct os_reltime now, diff;
3876         unsigned int started = work->started;
3877
3878         os_get_reltime(&now);
3879         os_reltime_sub(&now, &work->time, &diff);
3880         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3881                 work->type, work, started ? "done" : "canceled",
3882                 diff.sec, diff.usec);
3883         radio_work_free(work);
3884         if (started)
3885                 radio_work_check_next(wpa_s);
3886 }
3887
3888
3889 struct wpa_radio_work *
3890 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3891 {
3892         struct wpa_radio_work *work;
3893         struct wpa_radio *radio = wpa_s->radio;
3894
3895         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3896                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3897                         return work;
3898         }
3899
3900         return NULL;
3901 }
3902
3903
3904 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3905                             struct wpa_interface *iface)
3906 {
3907         const char *ifname, *driver, *rn;
3908
3909         driver = iface->driver;
3910 next_driver:
3911         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3912                 return -1;
3913
3914         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3915         if (wpa_s->drv_priv == NULL) {
3916                 const char *pos;
3917                 pos = driver ? os_strchr(driver, ',') : NULL;
3918                 if (pos) {
3919                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3920                                 "driver interface - try next driver wrapper");
3921                         driver = pos + 1;
3922                         goto next_driver;
3923                 }
3924                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3925                         "interface");
3926                 return -1;
3927         }
3928         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3929                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3930                         "driver_param '%s'", wpa_s->conf->driver_param);
3931                 return -1;
3932         }
3933
3934         ifname = wpa_drv_get_ifname(wpa_s);
3935         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3936                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3937                         "interface name with '%s'", ifname);
3938                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3939         }
3940
3941         rn = wpa_driver_get_radio_name(wpa_s);
3942         if (rn && rn[0] == '\0')
3943                 rn = NULL;
3944
3945         wpa_s->radio = radio_add_interface(wpa_s, rn);
3946         if (wpa_s->radio == NULL)
3947                 return -1;
3948
3949         return 0;
3950 }
3951
3952
3953 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3954                                      struct wpa_interface *iface)
3955 {
3956         struct wpa_driver_capa capa;
3957         int capa_res;
3958
3959         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3960                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3961                    iface->confname ? iface->confname : "N/A",
3962                    iface->driver ? iface->driver : "default",
3963                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3964                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3965
3966         if (iface->confname) {
3967 #ifdef CONFIG_BACKEND_FILE
3968                 wpa_s->confname = os_rel2abs_path(iface->confname);
3969                 if (wpa_s->confname == NULL) {
3970                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3971                                    "for configuration file '%s'.",
3972                                    iface->confname);
3973                         return -1;
3974                 }
3975                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3976                            iface->confname, wpa_s->confname);
3977 #else /* CONFIG_BACKEND_FILE */
3978                 wpa_s->confname = os_strdup(iface->confname);
3979 #endif /* CONFIG_BACKEND_FILE */
3980                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3981                 if (wpa_s->conf == NULL) {
3982                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3983                                    "configuration '%s'.", wpa_s->confname);
3984                         return -1;
3985                 }
3986                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3987                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3988
3989                 /*
3990                  * Override ctrl_interface and driver_param if set on command
3991                  * line.
3992                  */
3993                 if (iface->ctrl_interface) {
3994                         os_free(wpa_s->conf->ctrl_interface);
3995                         wpa_s->conf->ctrl_interface =
3996                                 os_strdup(iface->ctrl_interface);
3997                 }
3998
3999                 if (iface->driver_param) {
4000                         os_free(wpa_s->conf->driver_param);
4001                         wpa_s->conf->driver_param =
4002                                 os_strdup(iface->driver_param);
4003                 }
4004
4005                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4006                         os_free(wpa_s->conf->ctrl_interface);
4007                         wpa_s->conf->ctrl_interface = NULL;
4008                 }
4009         } else
4010                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4011                                                      iface->driver_param);
4012
4013         if (wpa_s->conf == NULL) {
4014                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4015                 return -1;
4016         }
4017
4018         if (iface->ifname == NULL) {
4019                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4020                 return -1;
4021         }
4022         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4023                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4024                            iface->ifname);
4025                 return -1;
4026         }
4027         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4028
4029         if (iface->bridge_ifname) {
4030                 if (os_strlen(iface->bridge_ifname) >=
4031                     sizeof(wpa_s->bridge_ifname)) {
4032                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4033                                    "name '%s'.", iface->bridge_ifname);
4034                         return -1;
4035                 }
4036                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4037                            sizeof(wpa_s->bridge_ifname));
4038         }
4039
4040         /* RSNA Supplicant Key Management - INITIALIZE */
4041         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4042         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4043
4044         /* Initialize driver interface and register driver event handler before
4045          * L2 receive handler so that association events are processed before
4046          * EAPOL-Key packets if both become available for the same select()
4047          * call. */
4048         if (wpas_init_driver(wpa_s, iface) < 0)
4049                 return -1;
4050
4051         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4052                 return -1;
4053
4054         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4055                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4056                           NULL);
4057         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4058
4059         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4060             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4061                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4062                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4063                         "dot11RSNAConfigPMKLifetime");
4064                 return -1;
4065         }
4066
4067         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4068             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4069                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4070                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4071                         "dot11RSNAConfigPMKReauthThreshold");
4072                 return -1;
4073         }
4074
4075         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4076             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4077                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4078                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4079                         "dot11RSNAConfigSATimeout");
4080                 return -1;
4081         }
4082
4083         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4084                                                       &wpa_s->hw.num_modes,
4085                                                       &wpa_s->hw.flags);
4086         if (wpa_s->hw.modes) {
4087                 u16 i;
4088
4089                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4090                         if (wpa_s->hw.modes[i].vht_capab) {
4091                                 wpa_s->hw_capab = CAPAB_VHT;
4092                                 break;
4093                         }
4094
4095                         if (wpa_s->hw.modes[i].ht_capab &
4096                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4097                                 wpa_s->hw_capab = CAPAB_HT40;
4098                         else if (wpa_s->hw.modes[i].ht_capab &&
4099                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4100                                 wpa_s->hw_capab = CAPAB_HT;
4101                 }
4102         }
4103
4104         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4105         if (capa_res == 0) {
4106                 wpa_s->drv_capa_known = 1;
4107                 wpa_s->drv_flags = capa.flags;
4108                 wpa_s->drv_enc = capa.enc;
4109                 wpa_s->drv_smps_modes = capa.smps_modes;
4110                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4111                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4112                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4113                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4114                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4115                 wpa_s->max_match_sets = capa.max_match_sets;
4116                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4117                 wpa_s->max_stations = capa.max_stations;
4118                 wpa_s->extended_capa = capa.extended_capa;
4119                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4120                 wpa_s->extended_capa_len = capa.extended_capa_len;
4121                 wpa_s->num_multichan_concurrent =
4122                         capa.num_multichan_concurrent;
4123                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4124
4125                 if (capa.mac_addr_rand_scan_supported)
4126                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4127                 if (wpa_s->sched_scan_supported &&
4128                     capa.mac_addr_rand_sched_scan_supported)
4129                         wpa_s->mac_addr_rand_supported |=
4130                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4131         }
4132         if (wpa_s->max_remain_on_chan == 0)
4133                 wpa_s->max_remain_on_chan = 1000;
4134
4135         /*
4136          * Only take p2p_mgmt parameters when P2P Device is supported.
4137          * Doing it here as it determines whether l2_packet_init() will be done
4138          * during wpa_supplicant_driver_init().
4139          */
4140         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4141                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4142         else
4143                 iface->p2p_mgmt = 1;
4144
4145         if (wpa_s->num_multichan_concurrent == 0)
4146                 wpa_s->num_multichan_concurrent = 1;
4147
4148         if (wpa_supplicant_driver_init(wpa_s) < 0)
4149                 return -1;
4150
4151 #ifdef CONFIG_TDLS
4152         if ((!iface->p2p_mgmt ||
4153              !(wpa_s->drv_flags &
4154                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4155             wpa_tdls_init(wpa_s->wpa))
4156                 return -1;
4157 #endif /* CONFIG_TDLS */
4158
4159         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4160             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4161                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4162                 return -1;
4163         }
4164
4165         if (wpas_wps_init(wpa_s))
4166                 return -1;
4167
4168         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4169                 return -1;
4170         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4171
4172         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4173         if (wpa_s->ctrl_iface == NULL) {
4174                 wpa_printf(MSG_ERROR,
4175                            "Failed to initialize control interface '%s'.\n"
4176                            "You may have another wpa_supplicant process "
4177                            "already running or the file was\n"
4178                            "left by an unclean termination of wpa_supplicant "
4179                            "in which case you will need\n"
4180                            "to manually remove this file before starting "
4181                            "wpa_supplicant again.\n",
4182                            wpa_s->conf->ctrl_interface);
4183                 return -1;
4184         }
4185
4186         wpa_s->gas = gas_query_init(wpa_s);
4187         if (wpa_s->gas == NULL) {
4188                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4189                 return -1;
4190         }
4191
4192         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4193                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4194                 return -1;
4195         }
4196
4197         if (wpa_bss_init(wpa_s) < 0)
4198                 return -1;
4199
4200         /*
4201          * Set Wake-on-WLAN triggers, if configured.
4202          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4203          * have effect anyway when the interface is down).
4204          */
4205         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4206                 return -1;
4207
4208 #ifdef CONFIG_EAP_PROXY
4209 {
4210         size_t len;
4211         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4212                                                      &len);
4213         if (wpa_s->mnc_len > 0) {
4214                 wpa_s->imsi[len] = '\0';
4215                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4216                            wpa_s->imsi, wpa_s->mnc_len);
4217         } else {
4218                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4219         }
4220 }
4221 #endif /* CONFIG_EAP_PROXY */
4222
4223         if (pcsc_reader_init(wpa_s) < 0)
4224                 return -1;
4225
4226         if (wpas_init_ext_pw(wpa_s) < 0)
4227                 return -1;
4228
4229         wpas_rrm_reset(wpa_s);
4230
4231         return 0;
4232 }
4233
4234
4235 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4236                                         int notify, int terminate)
4237 {
4238         struct wpa_global *global = wpa_s->global;
4239         struct wpa_supplicant *iface, *prev;
4240
4241         if (wpa_s == wpa_s->parent)
4242                 wpas_p2p_group_remove(wpa_s, "*");
4243
4244         iface = global->ifaces;
4245         while (iface) {
4246                 if (iface == wpa_s || iface->parent != wpa_s) {
4247                         iface = iface->next;
4248                         continue;
4249                 }
4250                 wpa_printf(MSG_DEBUG,
4251                            "Remove remaining child interface %s from parent %s",
4252                            iface->ifname, wpa_s->ifname);
4253                 prev = iface;
4254                 iface = iface->next;
4255                 wpa_supplicant_remove_iface(global, prev, terminate);
4256         }
4257
4258         wpa_s->disconnected = 1;
4259         if (wpa_s->drv_priv) {
4260                 wpa_supplicant_deauthenticate(wpa_s,
4261                                               WLAN_REASON_DEAUTH_LEAVING);
4262
4263                 wpa_drv_set_countermeasures(wpa_s, 0);
4264                 wpa_clear_keys(wpa_s, NULL);
4265         }
4266
4267         wpa_supplicant_cleanup(wpa_s);
4268         wpas_p2p_deinit_iface(wpa_s);
4269
4270         wpas_ctrl_radio_work_flush(wpa_s);
4271         radio_remove_interface(wpa_s);
4272
4273         if (wpa_s->drv_priv)
4274                 wpa_drv_deinit(wpa_s);
4275
4276         if (notify)
4277                 wpas_notify_iface_removed(wpa_s);
4278
4279         if (terminate)
4280                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4281
4282         if (wpa_s->ctrl_iface) {
4283                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4284                 wpa_s->ctrl_iface = NULL;
4285         }
4286
4287 #ifdef CONFIG_MESH
4288         if (wpa_s->ifmsh) {
4289                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4290                 wpa_s->ifmsh = NULL;
4291         }
4292 #endif /* CONFIG_MESH */
4293
4294         if (wpa_s->conf != NULL) {
4295                 wpa_config_free(wpa_s->conf);
4296                 wpa_s->conf = NULL;
4297         }
4298
4299         os_free(wpa_s);
4300 }
4301
4302
4303 /**
4304  * wpa_supplicant_add_iface - Add a new network interface
4305  * @global: Pointer to global data from wpa_supplicant_init()
4306  * @iface: Interface configuration options
4307  * @parent: Parent interface or %NULL to assign new interface as parent
4308  * Returns: Pointer to the created interface or %NULL on failure
4309  *
4310  * This function is used to add new network interfaces for %wpa_supplicant.
4311  * This can be called before wpa_supplicant_run() to add interfaces before the
4312  * main event loop has been started. In addition, new interfaces can be added
4313  * dynamically while %wpa_supplicant is already running. This could happen,
4314  * e.g., when a hotplug network adapter is inserted.
4315  */
4316 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4317                                                  struct wpa_interface *iface,
4318                                                  struct wpa_supplicant *parent)
4319 {
4320         struct wpa_supplicant *wpa_s;
4321         struct wpa_interface t_iface;
4322         struct wpa_ssid *ssid;
4323
4324         if (global == NULL || iface == NULL)
4325                 return NULL;
4326
4327         wpa_s = wpa_supplicant_alloc(parent);
4328         if (wpa_s == NULL)
4329                 return NULL;
4330
4331         wpa_s->global = global;
4332
4333         t_iface = *iface;
4334         if (global->params.override_driver) {
4335                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4336                            "('%s' -> '%s')",
4337                            iface->driver, global->params.override_driver);
4338                 t_iface.driver = global->params.override_driver;
4339         }
4340         if (global->params.override_ctrl_interface) {
4341                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4342                            "ctrl_interface ('%s' -> '%s')",
4343                            iface->ctrl_interface,
4344                            global->params.override_ctrl_interface);
4345                 t_iface.ctrl_interface =
4346                         global->params.override_ctrl_interface;
4347         }
4348         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4349                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4350                            iface->ifname);
4351                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4352                 return NULL;
4353         }
4354
4355         if (iface->p2p_mgmt == 0) {
4356                 /* Notify the control interfaces about new iface */
4357                 if (wpas_notify_iface_added(wpa_s)) {
4358                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4359                         return NULL;
4360                 }
4361
4362                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4363                         wpas_notify_network_added(wpa_s, ssid);
4364         }
4365
4366         wpa_s->next = global->ifaces;
4367         global->ifaces = wpa_s;
4368
4369         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4370         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4371
4372 #ifdef CONFIG_P2P
4373         if (wpa_s->global->p2p == NULL &&
4374             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4375             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4376                 wpa_printf(MSG_INFO,
4377                            "P2P: Failed to enable P2P Device interface");
4378                 /* Try to continue without. P2P will be disabled. */
4379         }
4380 #endif /* CONFIG_P2P */
4381
4382         return wpa_s;
4383 }
4384
4385
4386 /**
4387  * wpa_supplicant_remove_iface - Remove a network interface
4388  * @global: Pointer to global data from wpa_supplicant_init()
4389  * @wpa_s: Pointer to the network interface to be removed
4390  * Returns: 0 if interface was removed, -1 if interface was not found
4391  *
4392  * This function can be used to dynamically remove network interfaces from
4393  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4394  * addition, this function is used to remove all remaining interfaces when
4395  * %wpa_supplicant is terminated.
4396  */
4397 int wpa_supplicant_remove_iface(struct wpa_global *global,
4398                                 struct wpa_supplicant *wpa_s,
4399                                 int terminate)
4400 {
4401         struct wpa_supplicant *prev;
4402 #ifdef CONFIG_MESH
4403         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4404         char *ifname = NULL;
4405 #endif /* CONFIG_MESH */
4406
4407         /* Remove interface from the global list of interfaces */
4408         prev = global->ifaces;
4409         if (prev == wpa_s) {
4410                 global->ifaces = wpa_s->next;
4411         } else {
4412                 while (prev && prev->next != wpa_s)
4413                         prev = prev->next;
4414                 if (prev == NULL)
4415                         return -1;
4416                 prev->next = wpa_s->next;
4417         }
4418
4419         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4420
4421 #ifdef CONFIG_MESH
4422         if (mesh_if_created) {
4423                 ifname = os_strdup(wpa_s->ifname);
4424                 if (ifname == NULL) {
4425                         wpa_dbg(wpa_s, MSG_ERROR,
4426                                 "mesh: Failed to malloc ifname");
4427                         return -1;
4428                 }
4429         }
4430 #endif /* CONFIG_MESH */
4431
4432         if (global->p2p_group_formation == wpa_s)
4433                 global->p2p_group_formation = NULL;
4434         if (global->p2p_invite_group == wpa_s)
4435                 global->p2p_invite_group = NULL;
4436         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4437
4438 #ifdef CONFIG_MESH
4439         if (mesh_if_created) {
4440                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4441                 os_free(ifname);
4442         }
4443 #endif /* CONFIG_MESH */
4444
4445         return 0;
4446 }
4447
4448
4449 /**
4450  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4451  * @wpa_s: Pointer to the network interface
4452  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4453  */
4454 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4455 {
4456         const char *eapol_method;
4457
4458         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4459             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4460                 return "NO-EAP";
4461         }
4462
4463         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4464         if (eapol_method == NULL)
4465                 return "UNKNOWN-EAP";
4466
4467         return eapol_method;
4468 }
4469
4470
4471 /**
4472  * wpa_supplicant_get_iface - Get a new network interface
4473  * @global: Pointer to global data from wpa_supplicant_init()
4474  * @ifname: Interface name
4475  * Returns: Pointer to the interface or %NULL if not found
4476  */
4477 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4478                                                  const char *ifname)
4479 {
4480         struct wpa_supplicant *wpa_s;
4481
4482         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4483                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4484                         return wpa_s;
4485         }
4486         return NULL;
4487 }
4488
4489
4490 #ifndef CONFIG_NO_WPA_MSG
4491 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4492 {
4493         struct wpa_supplicant *wpa_s = ctx;
4494         if (wpa_s == NULL)
4495                 return NULL;
4496         return wpa_s->ifname;
4497 }
4498 #endif /* CONFIG_NO_WPA_MSG */
4499
4500
4501 /**
4502  * wpa_supplicant_init - Initialize %wpa_supplicant
4503  * @params: Parameters for %wpa_supplicant
4504  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4505  *
4506  * This function is used to initialize %wpa_supplicant. After successful
4507  * initialization, the returned data pointer can be used to add and remove
4508  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4509  */
4510 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4511 {
4512         struct wpa_global *global;
4513         int ret, i;
4514
4515         if (params == NULL)
4516                 return NULL;
4517
4518 #ifdef CONFIG_DRIVER_NDIS
4519         {
4520                 void driver_ndis_init_ops(void);
4521                 driver_ndis_init_ops();
4522         }
4523 #endif /* CONFIG_DRIVER_NDIS */
4524
4525 #ifndef CONFIG_NO_WPA_MSG
4526         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4527 #endif /* CONFIG_NO_WPA_MSG */
4528
4529         if (params->wpa_debug_file_path)
4530                 wpa_debug_open_file(params->wpa_debug_file_path);
4531         else
4532                 wpa_debug_setup_stdout();
4533         if (params->wpa_debug_syslog)
4534                 wpa_debug_open_syslog();
4535         if (params->wpa_debug_tracing) {
4536                 ret = wpa_debug_open_linux_tracing();
4537                 if (ret) {
4538                         wpa_printf(MSG_ERROR,
4539                                    "Failed to enable trace logging");
4540                         return NULL;
4541                 }
4542         }
4543
4544         ret = eap_register_methods();
4545         if (ret) {
4546                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4547                 if (ret == -2)
4548                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4549                                    "the same EAP type.");
4550                 return NULL;
4551         }
4552
4553         global = os_zalloc(sizeof(*global));
4554         if (global == NULL)
4555                 return NULL;
4556         dl_list_init(&global->p2p_srv_bonjour);
4557         dl_list_init(&global->p2p_srv_upnp);
4558         global->params.daemonize = params->daemonize;
4559         global->params.wait_for_monitor = params->wait_for_monitor;
4560         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4561         if (params->pid_file)
4562                 global->params.pid_file = os_strdup(params->pid_file);
4563         if (params->ctrl_interface)
4564                 global->params.ctrl_interface =
4565                         os_strdup(params->ctrl_interface);
4566         if (params->ctrl_interface_group)
4567                 global->params.ctrl_interface_group =
4568                         os_strdup(params->ctrl_interface_group);
4569         if (params->override_driver)
4570                 global->params.override_driver =
4571                         os_strdup(params->override_driver);
4572         if (params->override_ctrl_interface)
4573                 global->params.override_ctrl_interface =
4574                         os_strdup(params->override_ctrl_interface);
4575         wpa_debug_level = global->params.wpa_debug_level =
4576                 params->wpa_debug_level;
4577         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4578                 params->wpa_debug_show_keys;
4579         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4580                 params->wpa_debug_timestamp;
4581
4582         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4583
4584         if (eloop_init()) {
4585                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4586                 wpa_supplicant_deinit(global);
4587                 return NULL;
4588         }
4589
4590         random_init(params->entropy_file);
4591
4592         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4593         if (global->ctrl_iface == NULL) {
4594                 wpa_supplicant_deinit(global);
4595                 return NULL;
4596         }
4597
4598         if (wpas_notify_supplicant_initialized(global)) {
4599                 wpa_supplicant_deinit(global);
4600                 return NULL;
4601         }
4602
4603         for (i = 0; wpa_drivers[i]; i++)
4604                 global->drv_count++;
4605         if (global->drv_count == 0) {
4606                 wpa_printf(MSG_ERROR, "No drivers enabled");
4607                 wpa_supplicant_deinit(global);
4608                 return NULL;
4609         }
4610         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4611         if (global->drv_priv == NULL) {
4612                 wpa_supplicant_deinit(global);
4613                 return NULL;
4614         }
4615
4616 #ifdef CONFIG_WIFI_DISPLAY
4617         if (wifi_display_init(global) < 0) {
4618                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4619                 wpa_supplicant_deinit(global);
4620                 return NULL;
4621         }
4622 #endif /* CONFIG_WIFI_DISPLAY */
4623
4624         return global;
4625 }
4626
4627
4628 /**
4629  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4630  * @global: Pointer to global data from wpa_supplicant_init()
4631  * Returns: 0 after successful event loop run, -1 on failure
4632  *
4633  * This function starts the main event loop and continues running as long as
4634  * there are any remaining events. In most cases, this function is running as
4635  * long as the %wpa_supplicant process in still in use.
4636  */
4637 int wpa_supplicant_run(struct wpa_global *global)
4638 {
4639         struct wpa_supplicant *wpa_s;
4640
4641         if (global->params.daemonize &&
4642             wpa_supplicant_daemon(global->params.pid_file))
4643                 return -1;
4644
4645         if (global->params.wait_for_monitor) {
4646                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4647                         if (wpa_s->ctrl_iface)
4648                                 wpa_supplicant_ctrl_iface_wait(
4649                                         wpa_s->ctrl_iface);
4650         }
4651
4652         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4653         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4654
4655         eloop_run();
4656
4657         return 0;
4658 }
4659
4660
4661 /**
4662  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4663  * @global: Pointer to global data from wpa_supplicant_init()
4664  *
4665  * This function is called to deinitialize %wpa_supplicant and to free all
4666  * allocated resources. Remaining network interfaces will also be removed.
4667  */
4668 void wpa_supplicant_deinit(struct wpa_global *global)
4669 {
4670         int i;
4671
4672         if (global == NULL)
4673                 return;
4674
4675 #ifdef CONFIG_WIFI_DISPLAY
4676         wifi_display_deinit(global);
4677 #endif /* CONFIG_WIFI_DISPLAY */
4678
4679         while (global->ifaces)
4680                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4681
4682         if (global->ctrl_iface)
4683                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4684
4685         wpas_notify_supplicant_deinitialized(global);
4686
4687         eap_peer_unregister_methods();
4688 #ifdef CONFIG_AP
4689         eap_server_unregister_methods();
4690 #endif /* CONFIG_AP */
4691
4692         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4693                 if (!global->drv_priv[i])
4694                         continue;
4695                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4696         }
4697         os_free(global->drv_priv);
4698
4699         random_deinit();
4700
4701         eloop_destroy();
4702
4703         if (global->params.pid_file) {
4704                 os_daemonize_terminate(global->params.pid_file);
4705                 os_free(global->params.pid_file);
4706         }
4707         os_free(global->params.ctrl_interface);
4708         os_free(global->params.ctrl_interface_group);
4709         os_free(global->params.override_driver);
4710         os_free(global->params.override_ctrl_interface);
4711
4712         os_free(global->p2p_disallow_freq.range);
4713         os_free(global->p2p_go_avoid_freq.range);
4714         os_free(global->add_psk);
4715
4716         os_free(global);
4717         wpa_debug_close_syslog();
4718         wpa_debug_close_file();
4719         wpa_debug_close_linux_tracing();
4720 }
4721
4722
4723 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4724 {
4725         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4726             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4727                 char country[3];
4728                 country[0] = wpa_s->conf->country[0];
4729                 country[1] = wpa_s->conf->country[1];
4730                 country[2] = '\0';
4731                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4732                         wpa_printf(MSG_ERROR, "Failed to set country code "
4733                                    "'%s'", country);
4734                 }
4735         }
4736
4737         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4738                 wpas_init_ext_pw(wpa_s);
4739
4740 #ifdef CONFIG_WPS
4741         wpas_wps_update_config(wpa_s);
4742 #endif /* CONFIG_WPS */
4743         wpas_p2p_update_config(wpa_s);
4744         wpa_s->conf->changed_parameters = 0;
4745 }
4746
4747
4748 void add_freq(int *freqs, int *num_freqs, int freq)
4749 {
4750         int i;
4751
4752         for (i = 0; i < *num_freqs; i++) {
4753                 if (freqs[i] == freq)
4754                         return;
4755         }
4756
4757         freqs[*num_freqs] = freq;
4758         (*num_freqs)++;
4759 }
4760
4761
4762 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4763 {
4764         struct wpa_bss *bss, *cbss;
4765         const int max_freqs = 10;
4766         int *freqs;
4767         int num_freqs = 0;
4768
4769         freqs = os_calloc(max_freqs + 1, sizeof(int));
4770         if (freqs == NULL)
4771                 return NULL;
4772
4773         cbss = wpa_s->current_bss;
4774
4775         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4776                 if (bss == cbss)
4777                         continue;
4778                 if (bss->ssid_len == cbss->ssid_len &&
4779                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4780                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4781                         add_freq(freqs, &num_freqs, bss->freq);
4782                         if (num_freqs == max_freqs)
4783                                 break;
4784                 }
4785         }
4786
4787         if (num_freqs == 0) {
4788                 os_free(freqs);
4789                 freqs = NULL;
4790         }
4791
4792         return freqs;
4793 }
4794
4795
4796 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4797 {
4798         int timeout;
4799         int count;
4800         int *freqs = NULL;
4801
4802         wpas_connect_work_done(wpa_s);
4803
4804         /*
4805          * Remove possible authentication timeout since the connection failed.
4806          */
4807         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4808
4809         /*
4810          * There is no point in blacklisting the AP if this event is
4811          * generated based on local request to disconnect.
4812          */
4813         if (wpa_s->own_disconnect_req) {
4814                 wpa_s->own_disconnect_req = 0;
4815                 wpa_dbg(wpa_s, MSG_DEBUG,
4816                         "Ignore connection failure due to local request to disconnect");
4817                 return;
4818         }
4819         if (wpa_s->disconnected) {
4820                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4821                         "indication since interface has been put into "
4822                         "disconnected state");
4823                 return;
4824         }
4825
4826         /*
4827          * Add the failed BSSID into the blacklist and speed up next scan
4828          * attempt if there could be other APs that could accept association.
4829          * The current blacklist count indicates how many times we have tried
4830          * connecting to this AP and multiple attempts mean that other APs are
4831          * either not available or has already been tried, so that we can start
4832          * increasing the delay here to avoid constant scanning.
4833          */
4834         count = wpa_blacklist_add(wpa_s, bssid);
4835         if (count == 1 && wpa_s->current_bss) {
4836                 /*
4837                  * This BSS was not in the blacklist before. If there is
4838                  * another BSS available for the same ESS, we should try that
4839                  * next. Otherwise, we may as well try this one once more
4840                  * before allowing other, likely worse, ESSes to be considered.
4841                  */
4842                 freqs = get_bss_freqs_in_ess(wpa_s);
4843                 if (freqs) {
4844                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4845                                 "has been seen; try it next");
4846                         wpa_blacklist_add(wpa_s, bssid);
4847                         /*
4848                          * On the next scan, go through only the known channels
4849                          * used in this ESS based on previous scans to speed up
4850                          * common load balancing use case.
4851                          */
4852                         os_free(wpa_s->next_scan_freqs);
4853                         wpa_s->next_scan_freqs = freqs;
4854                 }
4855         }
4856
4857         /*
4858          * Add previous failure count in case the temporary blacklist was
4859          * cleared due to no other BSSes being available.
4860          */
4861         count += wpa_s->extra_blacklist_count;
4862
4863         if (count > 3 && wpa_s->current_ssid) {
4864                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4865                            "consider temporary network disabling");
4866                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4867         }
4868
4869         switch (count) {
4870         case 1:
4871                 timeout = 100;
4872                 break;
4873         case 2:
4874                 timeout = 500;
4875                 break;
4876         case 3:
4877                 timeout = 1000;
4878                 break;
4879         case 4:
4880                 timeout = 5000;
4881                 break;
4882         default:
4883                 timeout = 10000;
4884                 break;
4885         }
4886
4887         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4888                 "ms", count, timeout);
4889
4890         /*
4891          * TODO: if more than one possible AP is available in scan results,
4892          * could try the other ones before requesting a new scan.
4893          */
4894         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4895                                 1000 * (timeout % 1000));
4896 }
4897
4898
4899 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4900 {
4901         return wpa_s->conf->ap_scan == 2 ||
4902                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4903 }
4904
4905
4906 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4907 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4908                                               struct wpa_ssid *ssid,
4909                                               const char *field,
4910                                               const char *value)
4911 {
4912 #ifdef IEEE8021X_EAPOL
4913         struct eap_peer_config *eap = &ssid->eap;
4914
4915         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4916         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4917                               (const u8 *) value, os_strlen(value));
4918
4919         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4920         case WPA_CTRL_REQ_EAP_IDENTITY:
4921                 os_free(eap->identity);
4922                 eap->identity = (u8 *) os_strdup(value);
4923                 eap->identity_len = os_strlen(value);
4924                 eap->pending_req_identity = 0;
4925                 if (ssid == wpa_s->current_ssid)
4926                         wpa_s->reassociate = 1;
4927                 break;
4928         case WPA_CTRL_REQ_EAP_PASSWORD:
4929                 bin_clear_free(eap->password, eap->password_len);
4930                 eap->password = (u8 *) os_strdup(value);
4931                 eap->password_len = os_strlen(value);
4932                 eap->pending_req_password = 0;
4933                 if (ssid == wpa_s->current_ssid)
4934                         wpa_s->reassociate = 1;
4935                 break;
4936         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4937                 bin_clear_free(eap->new_password, eap->new_password_len);
4938                 eap->new_password = (u8 *) os_strdup(value);
4939                 eap->new_password_len = os_strlen(value);
4940                 eap->pending_req_new_password = 0;
4941                 if (ssid == wpa_s->current_ssid)
4942                         wpa_s->reassociate = 1;
4943                 break;
4944         case WPA_CTRL_REQ_EAP_PIN:
4945                 str_clear_free(eap->pin);
4946                 eap->pin = os_strdup(value);
4947                 eap->pending_req_pin = 0;
4948                 if (ssid == wpa_s->current_ssid)
4949                         wpa_s->reassociate = 1;
4950                 break;
4951         case WPA_CTRL_REQ_EAP_OTP:
4952                 bin_clear_free(eap->otp, eap->otp_len);
4953                 eap->otp = (u8 *) os_strdup(value);
4954                 eap->otp_len = os_strlen(value);
4955                 os_free(eap->pending_req_otp);
4956                 eap->pending_req_otp = NULL;
4957                 eap->pending_req_otp_len = 0;
4958                 break;
4959         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4960                 str_clear_free(eap->private_key_passwd);
4961                 eap->private_key_passwd = os_strdup(value);
4962                 eap->pending_req_passphrase = 0;
4963                 if (ssid == wpa_s->current_ssid)
4964                         wpa_s->reassociate = 1;
4965                 break;
4966         case WPA_CTRL_REQ_SIM:
4967                 str_clear_free(eap->external_sim_resp);
4968                 eap->external_sim_resp = os_strdup(value);
4969                 break;
4970         default:
4971                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4972                 return -1;
4973         }
4974
4975         return 0;
4976 #else /* IEEE8021X_EAPOL */
4977         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4978         return -1;
4979 #endif /* IEEE8021X_EAPOL */
4980 }
4981 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4982
4983
4984 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4985 {
4986         int i;
4987         unsigned int drv_enc;
4988
4989         if (wpa_s->p2p_mgmt)
4990                 return 1; /* no normal network profiles on p2p_mgmt interface */
4991
4992         if (ssid == NULL)
4993                 return 1;
4994
4995         if (ssid->disabled)
4996                 return 1;
4997
4998         if (wpa_s->drv_capa_known)
4999                 drv_enc = wpa_s->drv_enc;
5000         else
5001                 drv_enc = (unsigned int) -1;
5002
5003         for (i = 0; i < NUM_WEP_KEYS; i++) {
5004                 size_t len = ssid->wep_key_len[i];
5005                 if (len == 0)
5006                         continue;
5007                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5008                         continue;
5009                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5010                         continue;
5011                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5012                         continue;
5013                 return 1; /* invalid WEP key */
5014         }
5015
5016         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5017             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
5018                 return 1;
5019
5020         return 0;
5021 }
5022
5023
5024 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5025 {
5026 #ifdef CONFIG_IEEE80211W
5027         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5028                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5029                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5030                         /*
5031                          * Driver does not support BIP -- ignore pmf=1 default
5032                          * since the connection with PMF would fail and the
5033                          * configuration does not require PMF to be enabled.
5034                          */
5035                         return NO_MGMT_FRAME_PROTECTION;
5036                 }
5037
5038                 return wpa_s->conf->pmf;
5039         }
5040
5041         return ssid->ieee80211w;
5042 #else /* CONFIG_IEEE80211W */
5043         return NO_MGMT_FRAME_PROTECTION;
5044 #endif /* CONFIG_IEEE80211W */
5045 }
5046
5047
5048 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5049 {
5050         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5051                 return 1;
5052         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5053                 return 0;
5054         return -1;
5055 }
5056
5057
5058 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5059 {
5060         struct wpa_ssid *ssid = wpa_s->current_ssid;
5061         int dur;
5062         struct os_reltime now;
5063
5064         if (ssid == NULL) {
5065                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5066                            "SSID block");
5067                 return;
5068         }
5069
5070         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5071                 return;
5072
5073         ssid->auth_failures++;
5074
5075 #ifdef CONFIG_P2P
5076         if (ssid->p2p_group &&
5077             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5078                 /*
5079                  * Skip the wait time since there is a short timeout on the
5080                  * connection to a P2P group.
5081                  */
5082                 return;
5083         }
5084 #endif /* CONFIG_P2P */
5085
5086         if (ssid->auth_failures > 50)
5087                 dur = 300;
5088         else if (ssid->auth_failures > 10)
5089                 dur = 120;
5090         else if (ssid->auth_failures > 5)
5091                 dur = 90;
5092         else if (ssid->auth_failures > 3)
5093                 dur = 60;
5094         else if (ssid->auth_failures > 2)
5095                 dur = 30;
5096         else if (ssid->auth_failures > 1)
5097                 dur = 20;
5098         else
5099                 dur = 10;
5100
5101         if (ssid->auth_failures > 1 &&
5102             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5103                 dur += os_random() % (ssid->auth_failures * 10);
5104
5105         os_get_reltime(&now);
5106         if (now.sec + dur <= ssid->disabled_until.sec)
5107                 return;
5108
5109         ssid->disabled_until.sec = now.sec + dur;
5110
5111         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5112                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5113                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5114                 ssid->auth_failures, dur, reason);
5115 }
5116
5117
5118 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5119                               struct wpa_ssid *ssid, int clear_failures)
5120 {
5121         if (ssid == NULL)
5122                 return;
5123
5124         if (ssid->disabled_until.sec) {
5125                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5126                         "id=%d ssid=\"%s\"",
5127                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5128         }
5129         ssid->disabled_until.sec = 0;
5130         ssid->disabled_until.usec = 0;
5131         if (clear_failures)
5132                 ssid->auth_failures = 0;
5133 }
5134
5135
5136 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5137 {
5138         size_t i;
5139
5140         if (wpa_s->disallow_aps_bssid == NULL)
5141                 return 0;
5142
5143         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5144                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5145                               bssid, ETH_ALEN) == 0)
5146                         return 1;
5147         }
5148
5149         return 0;
5150 }
5151
5152
5153 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5154                     size_t ssid_len)
5155 {
5156         size_t i;
5157
5158         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5159                 return 0;
5160
5161         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5162                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5163                 if (ssid_len == s->ssid_len &&
5164                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5165                         return 1;
5166         }
5167
5168         return 0;
5169 }
5170
5171
5172 /**
5173  * wpas_request_connection - Request a new connection
5174  * @wpa_s: Pointer to the network interface
5175  *
5176  * This function is used to request a new connection to be found. It will mark
5177  * the interface to allow reassociation and request a new scan to find a
5178  * suitable network to connect to.
5179  */
5180 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5181 {
5182         wpa_s->normal_scans = 0;
5183         wpa_s->scan_req = NORMAL_SCAN_REQ;
5184         wpa_supplicant_reinit_autoscan(wpa_s);
5185         wpa_s->extra_blacklist_count = 0;
5186         wpa_s->disconnected = 0;
5187         wpa_s->reassociate = 1;
5188
5189         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5190                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5191         else
5192                 wpa_s->reattach = 0;
5193 }
5194
5195
5196 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5197                     struct wpa_used_freq_data *freqs_data,
5198                     unsigned int len)
5199 {
5200         unsigned int i;
5201
5202         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5203                 len, title);
5204         for (i = 0; i < len; i++) {
5205                 struct wpa_used_freq_data *cur = &freqs_data[i];
5206                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5207                         i, cur->freq, cur->flags);
5208         }
5209 }
5210
5211
5212 /*
5213  * Find the operating frequencies of any of the virtual interfaces that
5214  * are using the same radio as the current interface, and in addition, get
5215  * information about the interface types that are using the frequency.
5216  */
5217 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5218                                 struct wpa_used_freq_data *freqs_data,
5219                                 unsigned int len)
5220 {
5221         struct wpa_supplicant *ifs;
5222         u8 bssid[ETH_ALEN];
5223         int freq;
5224         unsigned int idx = 0, i;
5225
5226         wpa_dbg(wpa_s, MSG_DEBUG,
5227                 "Determining shared radio frequencies (max len %u)", len);
5228         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5229
5230         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5231                          radio_list) {
5232                 if (idx == len)
5233                         break;
5234
5235                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5236                         continue;
5237
5238                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5239                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5240                         freq = ifs->current_ssid->frequency;
5241                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5242                         freq = ifs->assoc_freq;
5243                 else
5244                         continue;
5245
5246                 /* Hold only distinct freqs */
5247                 for (i = 0; i < idx; i++)
5248                         if (freqs_data[i].freq == freq)
5249                                 break;
5250
5251                 if (i == idx)
5252                         freqs_data[idx++].freq = freq;
5253
5254                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5255                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5256                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5257                                 WPA_FREQ_USED_BY_INFRA_STATION;
5258                 }
5259         }
5260
5261         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5262         return idx;
5263 }
5264
5265
5266 /*
5267  * Find the operating frequencies of any of the virtual interfaces that
5268  * are using the same radio as the current interface.
5269  */
5270 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5271                            int *freq_array, unsigned int len)
5272 {
5273         struct wpa_used_freq_data *freqs_data;
5274         int num, i;
5275
5276         os_memset(freq_array, 0, sizeof(int) * len);
5277
5278         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5279         if (!freqs_data)
5280                 return -1;
5281
5282         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5283         for (i = 0; i < num; i++)
5284                 freq_array[i] = freqs_data[i].freq;
5285
5286         os_free(freqs_data);
5287
5288         return num;
5289 }
5290
5291
5292 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5293 {
5294         struct rrm_data *rrm = data;
5295
5296         if (!rrm->notify_neighbor_rep) {
5297                 wpa_printf(MSG_ERROR,
5298                            "RRM: Unexpected neighbor report timeout");
5299                 return;
5300         }
5301
5302         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5303         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5304
5305         rrm->notify_neighbor_rep = NULL;
5306         rrm->neighbor_rep_cb_ctx = NULL;
5307 }
5308
5309
5310 /*
5311  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5312  * @wpa_s: Pointer to wpa_supplicant
5313  */
5314 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5315 {
5316         wpa_s->rrm.rrm_used = 0;
5317
5318         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5319                              NULL);
5320         if (wpa_s->rrm.notify_neighbor_rep)
5321                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5322         wpa_s->rrm.next_neighbor_rep_token = 1;
5323 }
5324
5325
5326 /*
5327  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5328  * @wpa_s: Pointer to wpa_supplicant
5329  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5330  * @report_len: Length of neighbor report buffer
5331  */
5332 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5333                                    const u8 *report, size_t report_len)
5334 {
5335         struct wpabuf *neighbor_rep;
5336
5337         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5338         if (report_len < 1)
5339                 return;
5340
5341         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5342                 wpa_printf(MSG_DEBUG,
5343                            "RRM: Discarding neighbor report with token %d (expected %d)",
5344                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5345                 return;
5346         }
5347
5348         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5349                              NULL);
5350
5351         if (!wpa_s->rrm.notify_neighbor_rep) {
5352                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5353                 return;
5354         }
5355
5356         /* skipping the first byte, which is only an id (dialog token) */
5357         neighbor_rep = wpabuf_alloc(report_len - 1);
5358         if (neighbor_rep == NULL)
5359                 return;
5360         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5361         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5362                    report[0]);
5363         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5364                                        neighbor_rep);
5365         wpa_s->rrm.notify_neighbor_rep = NULL;
5366         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5367 }
5368
5369
5370 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5371 /* Workaround different, undefined for Windows, error codes used here */
5372 #define ENOTCONN -1
5373 #define EOPNOTSUPP -1
5374 #define ECANCELED -1
5375 #endif
5376
5377 /**
5378  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5379  * @wpa_s: Pointer to wpa_supplicant
5380  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5381  *        is sent in the request.
5382  * @cb: Callback function to be called once the requested report arrives, or
5383  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5384  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5385  *      the requester's responsibility to free it.
5386  *      In the latter case NULL will be sent in 'neighbor_rep'.
5387  * @cb_ctx: Context value to send the callback function
5388  * Returns: 0 in case of success, negative error code otherwise
5389  *
5390  * In case there is a previous request which has not been answered yet, the
5391  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5392  * Request must contain a callback function.
5393  */
5394 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5395                                        const struct wpa_ssid *ssid,
5396                                        void (*cb)(void *ctx,
5397                                                   struct wpabuf *neighbor_rep),
5398                                        void *cb_ctx)
5399 {
5400         struct wpabuf *buf;
5401         const u8 *rrm_ie;
5402
5403         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5404                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5405                 return -ENOTCONN;
5406         }
5407
5408         if (!wpa_s->rrm.rrm_used) {
5409                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5410                 return -EOPNOTSUPP;
5411         }
5412
5413         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5414                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5415         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5416             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5417                 wpa_printf(MSG_DEBUG,
5418                            "RRM: No network support for Neighbor Report.");
5419                 return -EOPNOTSUPP;
5420         }
5421
5422         if (!cb) {
5423                 wpa_printf(MSG_DEBUG,
5424                            "RRM: Neighbor Report request must provide a callback.");
5425                 return -EINVAL;
5426         }
5427
5428         /* Refuse if there's a live request */
5429         if (wpa_s->rrm.notify_neighbor_rep) {
5430                 wpa_printf(MSG_DEBUG,
5431                            "RRM: Currently handling previous Neighbor Report.");
5432                 return -EBUSY;
5433         }
5434
5435         /* 3 = action category + action code + dialog token */
5436         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5437         if (buf == NULL) {
5438                 wpa_printf(MSG_DEBUG,
5439                            "RRM: Failed to allocate Neighbor Report Request");
5440                 return -ENOMEM;
5441         }
5442
5443         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5444                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5445                    wpa_s->rrm.next_neighbor_rep_token);
5446
5447         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5448         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5449         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5450         if (ssid) {
5451                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5452                 wpabuf_put_u8(buf, ssid->ssid_len);
5453                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5454         }
5455
5456         wpa_s->rrm.next_neighbor_rep_token++;
5457
5458         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5459                                 wpa_s->own_addr, wpa_s->bssid,
5460                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5461                 wpa_printf(MSG_DEBUG,
5462                            "RRM: Failed to send Neighbor Report Request");
5463                 wpabuf_free(buf);
5464                 return -ECANCELED;
5465         }
5466
5467         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5468         wpa_s->rrm.notify_neighbor_rep = cb;
5469         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5470                                wpas_rrm_neighbor_rep_timeout_handler,
5471                                &wpa_s->rrm, NULL);
5472
5473         wpabuf_free(buf);
5474         return 0;
5475 }
5476
5477
5478 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5479                                               const u8 *src,
5480                                               const u8 *frame, size_t len,
5481                                               int rssi)
5482 {
5483         struct wpabuf *buf;
5484         const struct rrm_link_measurement_request *req;
5485         struct rrm_link_measurement_report report;
5486
5487         if (wpa_s->wpa_state != WPA_COMPLETED) {
5488                 wpa_printf(MSG_INFO,
5489                            "RRM: Ignoring link measurement request. Not associated");
5490                 return;
5491         }
5492
5493         if (!wpa_s->rrm.rrm_used) {
5494                 wpa_printf(MSG_INFO,
5495                            "RRM: Ignoring link measurement request. Not RRM network");
5496                 return;
5497         }
5498
5499         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5500                 wpa_printf(MSG_INFO,
5501                            "RRM: Measurement report failed. TX power insertion not supported");
5502                 return;
5503         }
5504
5505         req = (const struct rrm_link_measurement_request *) frame;
5506         if (len < sizeof(*req)) {
5507                 wpa_printf(MSG_INFO,
5508                            "RRM: Link measurement report failed. Request too short");
5509                 return;
5510         }
5511
5512         os_memset(&report, 0, sizeof(report));
5513         report.tpc.eid = WLAN_EID_TPC_REPORT;
5514         report.tpc.len = 2;
5515         report.rsni = 255; /* 255 indicates that RSNI is not available */
5516         report.dialog_token = req->dialog_token;
5517
5518         /*
5519          * It's possible to estimate RCPI based on RSSI in dBm. This
5520          * calculation will not reflect the correct value for high rates,
5521          * but it's good enough for Action frames which are transmitted
5522          * with up to 24 Mbps rates.
5523          */
5524         if (!rssi)
5525                 report.rcpi = 255; /* not available */
5526         else if (rssi < -110)
5527                 report.rcpi = 0;
5528         else if (rssi > 0)
5529                 report.rcpi = 220;
5530         else
5531                 report.rcpi = (rssi + 110) * 2;
5532
5533         /* action_category + action_code */
5534         buf = wpabuf_alloc(2 + sizeof(report));
5535         if (buf == NULL) {
5536                 wpa_printf(MSG_ERROR,
5537                            "RRM: Link measurement report failed. Buffer allocation failed");
5538                 return;
5539         }
5540
5541         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5542         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5543         wpabuf_put_data(buf, &report, sizeof(report));
5544         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5545                     wpabuf_head(buf), wpabuf_len(buf));
5546
5547         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5548                                 wpa_s->own_addr, wpa_s->bssid,
5549                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5550                 wpa_printf(MSG_ERROR,
5551                            "RRM: Link measurement report failed. Send action failed");
5552         }
5553         wpabuf_free(buf);
5554 }