wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (is_zero_ether_addr(bssid))
 196                 bssid = wpa_s->pending_bssid;
 197         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 198                 MAC2STR(bssid));
 199         wpa_blacklist_add(wpa_s, bssid);
 200         wpa_sm_notify_disassoc(wpa_s->wpa);
 201         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 202         wpa_s->reassociate = 1;
 203
 204         /*
 205          * If we timed out, the AP or the local radio may be busy.
 206          * So, wait a second until scanning again.
 207          */
 208         wpa_supplicant_req_scan(wpa_s, 1, 0);
 209 }
 210
 211
 212 /**
 213  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 214  * @wpa_s: Pointer to wpa_supplicant data
 215  * @sec: Number of seconds after which to time out authentication
 216  * @usec: Number of microseconds after which to time out authentication
 217  *
 218  * This function is used to schedule a timeout for the current authentication
 219  * attempt.
 220  */
 221 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 222                                      int sec, int usec)
 223 {
 224         if (wpa_s->conf->ap_scan == 0 &&
 225             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 226                 return;
 227
 228         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 229                 "%d usec", sec, usec);
 230         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 231         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 232 }
 233
 234
 235 /**
 236  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 237  * @wpa_s: Pointer to wpa_supplicant data
 238  *
 239  * This function is used to cancel authentication timeout scheduled with
 240  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 241  * been completed.
 242  */
 243 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 244 {
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 246         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 247         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 248 }
 249
 250
 251 /**
 252  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 253  * @wpa_s: Pointer to wpa_supplicant data
 254  *
 255  * This function is used to configure EAPOL state machine based on the selected
 256  * authentication mode.
 257  */
 258 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 259 {
 260 #ifdef IEEE8021X_EAPOL
 261         struct eapol_config eapol_conf;
 262         struct wpa_ssid *ssid = wpa_s->current_ssid;
 263
 264 #ifdef CONFIG_IBSS_RSN
 265         if (ssid->mode == WPAS_MODE_IBSS &&
 266             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 267             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 268                 /*
 269                  * RSN IBSS authentication is per-STA and we can disable the
 270                  * per-BSSID EAPOL authentication.
 271                  */
 272                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 273                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 274                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 275                 return;
 276         }
 277 #endif /* CONFIG_IBSS_RSN */
 278
 279         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 280         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 281
 282         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 283             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 284                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 285         else
 286                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 287
 288         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 289         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 290                 eapol_conf.accept_802_1x_keys = 1;
 291                 eapol_conf.required_keys = 0;
 292                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 293                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 294                 }
 295                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 296                         eapol_conf.required_keys |=
 297                                 EAPOL_REQUIRE_KEY_BROADCAST;
 298                 }
 299
 300                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 301                         eapol_conf.required_keys = 0;
 302         }
 303         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 304         eapol_conf.workaround = ssid->eap_workaround;
 305         eapol_conf.eap_disabled =
 306                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 307                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 308                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 309         eapol_conf.external_sim = wpa_s->conf->external_sim;
 310
 311 #ifdef CONFIG_WPS
 312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 313                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 314                 if (wpa_s->current_bss) {
 315                         struct wpabuf *ie;
 316                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 317                                                          WPS_IE_VENDOR_TYPE);
 318                         if (ie) {
 319                                 if (wps_is_20(ie))
 320                                         eapol_conf.wps |=
 321                                                 EAPOL_PEER_IS_WPS20_AP;
 322                                 wpabuf_free(ie);
 323                         }
 324                 }
 325         }
 326 #endif /* CONFIG_WPS */
 327
 328         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 329
 330         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 331 #endif /* IEEE8021X_EAPOL */
 332 }
 333
 334
 335 /**
 336  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 337  * @wpa_s: Pointer to wpa_supplicant data
 338  * @ssid: Configuration data for the network
 339  *
 340  * This function is used to configure WPA state machine and related parameters
 341  * to a mode where WPA is not enabled. This is called as part of the
 342  * authentication configuration when the selected network does not use WPA.
 343  */
 344 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 345                                        struct wpa_ssid *ssid)
 346 {
 347         int i;
 348
 349         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 351         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 353         else
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 355         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 356         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 357         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 359         wpa_s->group_cipher = WPA_CIPHER_NONE;
 360         wpa_s->mgmt_group_cipher = 0;
 361
 362         for (i = 0; i < NUM_WEP_KEYS; i++) {
 363                 if (ssid->wep_key_len[i] > 5) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 366                         break;
 367                 } else if (ssid->wep_key_len[i] > 0) {
 368                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 369                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 370                         break;
 371                 }
 372         }
 373
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 377                          wpa_s->pairwise_cipher);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 379 #ifdef CONFIG_IEEE80211W
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 381                          wpa_s->mgmt_group_cipher);
 382 #endif /* CONFIG_IEEE80211W */
 383
 384         pmksa_cache_clear_current(wpa_s->wpa);
 385 }
 386
 387
 388 void free_hw_features(struct wpa_supplicant *wpa_s)
 389 {
 390         int i;
 391         if (wpa_s->hw.modes == NULL)
 392                 return;
 393
 394         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 395                 os_free(wpa_s->hw.modes[i].channels);
 396                 os_free(wpa_s->hw.modes[i].rates);
 397         }
 398
 399         os_free(wpa_s->hw.modes);
 400         wpa_s->hw.modes = NULL;
 401 }
 402
 403
 404 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 405 {
 406         struct wpa_bss_tmp_disallowed *bss, *prev;
 407
 408         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 409                               struct wpa_bss_tmp_disallowed, list) {
 410                 dl_list_del(&bss->list);
 411                 os_free(bss);
 412         }
 413 }
 414
 415
 416 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 417 {
 418         int i;
 419
 420         bgscan_deinit(wpa_s);
 421         autoscan_deinit(wpa_s);
 422         scard_deinit(wpa_s->scard);
 423         wpa_s->scard = NULL;
 424         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 425         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 426         l2_packet_deinit(wpa_s->l2);
 427         wpa_s->l2 = NULL;
 428         if (wpa_s->l2_br) {
 429                 l2_packet_deinit(wpa_s->l2_br);
 430                 wpa_s->l2_br = NULL;
 431         }
 432 #ifdef CONFIG_TESTING_OPTIONS
 433         l2_packet_deinit(wpa_s->l2_test);
 434         wpa_s->l2_test = NULL;
 435 #endif /* CONFIG_TESTING_OPTIONS */
 436
 437         if (wpa_s->conf != NULL) {
 438                 struct wpa_ssid *ssid;
 439                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 440                         wpas_notify_network_removed(wpa_s, ssid);
 441         }
 442
 443         os_free(wpa_s->confname);
 444         wpa_s->confname = NULL;
 445
 446         os_free(wpa_s->confanother);
 447         wpa_s->confanother = NULL;
 448
 449         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 450         eapol_sm_deinit(wpa_s->eapol);
 451         wpa_s->eapol = NULL;
 452
 453         rsn_preauth_deinit(wpa_s->wpa);
 454
 455 #ifdef CONFIG_TDLS
 456         wpa_tdls_deinit(wpa_s->wpa);
 457 #endif /* CONFIG_TDLS */
 458
 459         wmm_ac_clear_saved_tspecs(wpa_s);
 460         pmksa_candidate_free(wpa_s->wpa);
 461         wpa_sm_deinit(wpa_s->wpa);
 462         wpa_s->wpa = NULL;
 463         wpa_blacklist_clear(wpa_s);
 464
 465         wpa_bss_deinit(wpa_s);
 466
 467         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 468         wpa_supplicant_cancel_scan(wpa_s);
 469         wpa_supplicant_cancel_auth_timeout(wpa_s);
 470         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 471 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 472         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 473                              wpa_s, NULL);
 474 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 475
 476         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 477
 478         wpas_wps_deinit(wpa_s);
 479
 480         wpabuf_free(wpa_s->pending_eapol_rx);
 481         wpa_s->pending_eapol_rx = NULL;
 482
 483 #ifdef CONFIG_IBSS_RSN
 484         ibss_rsn_deinit(wpa_s->ibss_rsn);
 485         wpa_s->ibss_rsn = NULL;
 486 #endif /* CONFIG_IBSS_RSN */
 487
 488         sme_deinit(wpa_s);
 489
 490 #ifdef CONFIG_AP
 491         wpa_supplicant_ap_deinit(wpa_s);
 492 #endif /* CONFIG_AP */
 493
 494         wpas_p2p_deinit(wpa_s);
 495
 496 #ifdef CONFIG_OFFCHANNEL
 497         offchannel_deinit(wpa_s);
 498 #endif /* CONFIG_OFFCHANNEL */
 499
 500         wpa_supplicant_cancel_sched_scan(wpa_s);
 501
 502         os_free(wpa_s->next_scan_freqs);
 503         wpa_s->next_scan_freqs = NULL;
 504
 505         os_free(wpa_s->manual_scan_freqs);
 506         wpa_s->manual_scan_freqs = NULL;
 507
 508         os_free(wpa_s->manual_sched_scan_freqs);
 509         wpa_s->manual_sched_scan_freqs = NULL;
 510
 511         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 512
 513         /*
 514          * Need to remove any pending gas-query radio work before the
 515          * gas_query_deinit() call because gas_query::work has not yet been set
 516          * for works that have not been started. gas_query_free() will be unable
 517          * to cancel such pending radio works and once the pending gas-query
 518          * radio work eventually gets removed, the deinit notification call to
 519          * gas_query_start_cb() would result in dereferencing freed memory.
 520          */
 521         if (wpa_s->radio)
 522                 radio_remove_works(wpa_s, "gas-query", 0);
 523         gas_query_deinit(wpa_s->gas);
 524         wpa_s->gas = NULL;
 525
 526         free_hw_features(wpa_s);
 527
 528         ieee802_1x_dealloc_kay_sm(wpa_s);
 529
 530         os_free(wpa_s->bssid_filter);
 531         wpa_s->bssid_filter = NULL;
 532
 533         os_free(wpa_s->disallow_aps_bssid);
 534         wpa_s->disallow_aps_bssid = NULL;
 535         os_free(wpa_s->disallow_aps_ssid);
 536         wpa_s->disallow_aps_ssid = NULL;
 537
 538         wnm_bss_keep_alive_deinit(wpa_s);
 539 #ifdef CONFIG_WNM
 540         wnm_deallocate_memory(wpa_s);
 541 #endif /* CONFIG_WNM */
 542
 543         ext_password_deinit(wpa_s->ext_pw);
 544         wpa_s->ext_pw = NULL;
 545
 546         wpabuf_free(wpa_s->last_gas_resp);
 547         wpa_s->last_gas_resp = NULL;
 548         wpabuf_free(wpa_s->prev_gas_resp);
 549         wpa_s->prev_gas_resp = NULL;
 550
 551         os_free(wpa_s->last_scan_res);
 552         wpa_s->last_scan_res = NULL;
 553
 554 #ifdef CONFIG_HS20
 555         if (wpa_s->drv_priv)
 556                 wpa_drv_configure_frame_filters(wpa_s, 0);
 557         hs20_deinit(wpa_s);
 558 #endif /* CONFIG_HS20 */
 559
 560         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 561                 wpabuf_free(wpa_s->vendor_elem[i]);
 562                 wpa_s->vendor_elem[i] = NULL;
 563         }
 564
 565         wmm_ac_notify_disassoc(wpa_s);
 566
 567         wpa_s->sched_scan_plans_num = 0;
 568         os_free(wpa_s->sched_scan_plans);
 569         wpa_s->sched_scan_plans = NULL;
 570
 571 #ifdef CONFIG_MBO
 572         wpa_s->non_pref_chan_num = 0;
 573         os_free(wpa_s->non_pref_chan);
 574         wpa_s->non_pref_chan = NULL;
 575 #endif /* CONFIG_MBO */
 576
 577         free_bss_tmp_disallowed(wpa_s);
 578
 579         wpabuf_free(wpa_s->lci);
 580         wpa_s->lci = NULL;
 581 }
 582
 583
 584 /**
 585  * wpa_clear_keys - Clear keys configured for the driver
 586  * @wpa_s: Pointer to wpa_supplicant data
 587  * @addr: Previously used BSSID or %NULL if not available
 588  *
 589  * This function clears the encryption keys that has been previously configured
 590  * for the driver.
 591  */
 592 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 593 {
 594         int i, max;
 595
 596 #ifdef CONFIG_IEEE80211W
 597         max = 6;
 598 #else /* CONFIG_IEEE80211W */
 599         max = 4;
 600 #endif /* CONFIG_IEEE80211W */
 601
 602         /* MLME-DELETEKEYS.request */
 603         for (i = 0; i < max; i++) {
 604                 if (wpa_s->keys_cleared & BIT(i))
 605                         continue;
 606                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 607                                 NULL, 0);
 608         }
 609         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 610             !is_zero_ether_addr(addr)) {
 611                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 612                                 0);
 613                 /* MLME-SETPROTECTION.request(None) */
 614                 wpa_drv_mlme_setprotection(
 615                         wpa_s, addr,
 616                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 617                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 618         }
 619         wpa_s->keys_cleared = (u32) -1;
 620 }
 621
 622
 623 /**
 624  * wpa_supplicant_state_txt - Get the connection state name as a text string
 625  * @state: State (wpa_state; WPA_*)
 626  * Returns: The state name as a printable text string
 627  */
 628 const char * wpa_supplicant_state_txt(enum wpa_states state)
 629 {
 630         switch (state) {
 631         case WPA_DISCONNECTED:
 632                 return "DISCONNECTED";
 633         case WPA_INACTIVE:
 634                 return "INACTIVE";
 635         case WPA_INTERFACE_DISABLED:
 636                 return "INTERFACE_DISABLED";
 637         case WPA_SCANNING:
 638                 return "SCANNING";
 639         case WPA_AUTHENTICATING:
 640                 return "AUTHENTICATING";
 641         case WPA_ASSOCIATING:
 642                 return "ASSOCIATING";
 643         case WPA_ASSOCIATED:
 644                 return "ASSOCIATED";
 645         case WPA_4WAY_HANDSHAKE:
 646                 return "4WAY_HANDSHAKE";
 647         case WPA_GROUP_HANDSHAKE:
 648                 return "GROUP_HANDSHAKE";
 649         case WPA_COMPLETED:
 650                 return "COMPLETED";
 651         default:
 652                 return "UNKNOWN";
 653         }
 654 }
 655
 656
 657 #ifdef CONFIG_BGSCAN
 658
 659 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 660 {
 661         const char *name;
 662
 663         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 664                 name = wpa_s->current_ssid->bgscan;
 665         else
 666                 name = wpa_s->conf->bgscan;
 667         if (name == NULL || name[0] == '\0')
 668                 return;
 669         if (wpas_driver_bss_selection(wpa_s))
 670                 return;
 671         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 672                 return;
 673 #ifdef CONFIG_P2P
 674         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 675                 return;
 676 #endif /* CONFIG_P2P */
 677
 678         bgscan_deinit(wpa_s);
 679         if (wpa_s->current_ssid) {
 680                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 681                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 682                                 "bgscan");
 683                         /*
 684                          * Live without bgscan; it is only used as a roaming
 685                          * optimization, so the initial connection is not
 686                          * affected.
 687                          */
 688                 } else {
 689                         struct wpa_scan_results *scan_res;
 690                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 691                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 692                                                                    0);
 693                         if (scan_res) {
 694                                 bgscan_notify_scan(wpa_s, scan_res);
 695                                 wpa_scan_results_free(scan_res);
 696                         }
 697                 }
 698         } else
 699                 wpa_s->bgscan_ssid = NULL;
 700 }
 701
 702
 703 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 704 {
 705         if (wpa_s->bgscan_ssid != NULL) {
 706                 bgscan_deinit(wpa_s);
 707                 wpa_s->bgscan_ssid = NULL;
 708         }
 709 }
 710
 711 #endif /* CONFIG_BGSCAN */
 712
 713
 714 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 715 {
 716         if (autoscan_init(wpa_s, 0))
 717                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 718 }
 719
 720
 721 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 722 {
 723         autoscan_deinit(wpa_s);
 724 }
 725
 726
 727 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 728 {
 729         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 730             wpa_s->wpa_state == WPA_SCANNING) {
 731                 autoscan_deinit(wpa_s);
 732                 wpa_supplicant_start_autoscan(wpa_s);
 733         }
 734 }
 735
 736
 737 /**
 738  * wpa_supplicant_set_state - Set current connection state
 739  * @wpa_s: Pointer to wpa_supplicant data
 740  * @state: The new connection state
 741  *
 742  * This function is called whenever the connection state changes, e.g.,
 743  * association is completed for WPA/WPA2 4-Way Handshake is started.
 744  */
 745 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 746                               enum wpa_states state)
 747 {
 748         enum wpa_states old_state = wpa_s->wpa_state;
 749
 750         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 751                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 752                 wpa_supplicant_state_txt(state));
 753
 754         if (state == WPA_INTERFACE_DISABLED) {
 755                 /* Assure normal scan when interface is restored */
 756                 wpa_s->normal_scans = 0;
 757         }
 758
 759         if (state == WPA_COMPLETED) {
 760                 wpas_connect_work_done(wpa_s);
 761                 /* Reinitialize normal_scan counter */
 762                 wpa_s->normal_scans = 0;
 763         }
 764
 765 #ifdef CONFIG_P2P
 766         /*
 767          * P2PS client has to reply to Probe Request frames received on the
 768          * group operating channel. Enable Probe Request frame reporting for
 769          * P2P connected client in case p2p_cli_probe configuration property is
 770          * set to 1.
 771          */
 772         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 773             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 774             wpa_s->current_ssid->p2p_group) {
 775                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 776                         wpa_dbg(wpa_s, MSG_DEBUG,
 777                                 "P2P: Enable CLI Probe Request RX reporting");
 778                         wpa_s->p2p_cli_probe =
 779                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 780                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 781                         wpa_dbg(wpa_s, MSG_DEBUG,
 782                                 "P2P: Disable CLI Probe Request RX reporting");
 783                         wpa_s->p2p_cli_probe = 0;
 784                         wpa_drv_probe_req_report(wpa_s, 0);
 785                 }
 786         }
 787 #endif /* CONFIG_P2P */
 788
 789         if (state != WPA_SCANNING)
 790                 wpa_supplicant_notify_scanning(wpa_s, 0);
 791
 792         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 793                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 794 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 795                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 796                         MACSTR " completed [id=%d id_str=%s]",
 797                         MAC2STR(wpa_s->bssid),
 798                         ssid ? ssid->id : -1,
 799                         ssid && ssid->id_str ? ssid->id_str : "");
 800 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 801                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 802                 wpa_blacklist_clear(wpa_s);
 803                 wpa_s->extra_blacklist_count = 0;
 804                 wpa_s->new_connection = 0;
 805                 wpa_drv_set_operstate(wpa_s, 1);
 806 #ifndef IEEE8021X_EAPOL
 807                 wpa_drv_set_supp_port(wpa_s, 1);
 808 #endif /* IEEE8021X_EAPOL */
 809                 wpa_s->after_wps = 0;
 810                 wpa_s->known_wps_freq = 0;
 811                 wpas_p2p_completed(wpa_s);
 812
 813                 sme_sched_obss_scan(wpa_s, 1);
 814         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 815                    state == WPA_ASSOCIATED) {
 816                 wpa_s->new_connection = 1;
 817                 wpa_drv_set_operstate(wpa_s, 0);
 818 #ifndef IEEE8021X_EAPOL
 819                 wpa_drv_set_supp_port(wpa_s, 0);
 820 #endif /* IEEE8021X_EAPOL */
 821                 sme_sched_obss_scan(wpa_s, 0);
 822         }
 823         wpa_s->wpa_state = state;
 824
 825 #ifdef CONFIG_BGSCAN
 826         if (state == WPA_COMPLETED)
 827                 wpa_supplicant_start_bgscan(wpa_s);
 828         else if (state < WPA_ASSOCIATED)
 829                 wpa_supplicant_stop_bgscan(wpa_s);
 830 #endif /* CONFIG_BGSCAN */
 831
 832         if (state == WPA_AUTHENTICATING)
 833                 wpa_supplicant_stop_autoscan(wpa_s);
 834
 835         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 836                 wpa_supplicant_start_autoscan(wpa_s);
 837
 838         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 839                 wmm_ac_notify_disassoc(wpa_s);
 840
 841         if (wpa_s->wpa_state != old_state) {
 842                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 843
 844                 /*
 845                  * Notify the P2P Device interface about a state change in one
 846                  * of the interfaces.
 847                  */
 848                 wpas_p2p_indicate_state_change(wpa_s);
 849
 850                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 851                     old_state == WPA_COMPLETED)
 852                         wpas_notify_auth_changed(wpa_s);
 853         }
 854 }
 855
 856
 857 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 858 {
 859         int pending = 0;
 860 #ifdef CONFIG_WPS
 861         struct wpa_supplicant *wpa_s = global->ifaces;
 862         while (wpa_s) {
 863                 struct wpa_supplicant *next = wpa_s->next;
 864                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 865                         pending = 1;
 866 #ifdef CONFIG_P2P
 867                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 868                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 869                         wpas_p2p_disconnect(wpa_s);
 870 #endif /* CONFIG_P2P */
 871                 wpa_s = next;
 872         }
 873 #endif /* CONFIG_WPS */
 874         if (pending)
 875                 return;
 876         eloop_terminate();
 877 }
 878
 879
 880 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 881 {
 882         struct wpa_global *global = signal_ctx;
 883         wpa_supplicant_terminate_proc(global);
 884 }
 885
 886
 887 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 888 {
 889         enum wpa_states old_state = wpa_s->wpa_state;
 890
 891         wpa_s->pairwise_cipher = 0;
 892         wpa_s->group_cipher = 0;
 893         wpa_s->mgmt_group_cipher = 0;
 894         wpa_s->key_mgmt = 0;
 895         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 896                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 897
 898         if (wpa_s->wpa_state != old_state)
 899                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 900 }
 901
 902
 903 /**
 904  * wpa_supplicant_reload_configuration - Reload configuration data
 905  * @wpa_s: Pointer to wpa_supplicant data
 906  * Returns: 0 on success or -1 if configuration parsing failed
 907  *
 908  * This function can be used to request that the configuration data is reloaded
 909  * (e.g., after configuration file change). This function is reloading
 910  * configuration only for one interface, so this may need to be called multiple
 911  * times if %wpa_supplicant is controlling multiple interfaces and all
 912  * interfaces need reconfiguration.
 913  */
 914 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 915 {
 916         struct wpa_config *conf;
 917         int reconf_ctrl;
 918         int old_ap_scan;
 919
 920         if (wpa_s->confname == NULL)
 921                 return -1;
 922         conf = wpa_config_read(wpa_s->confname, NULL);
 923         if (conf == NULL) {
 924                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 925                         "file '%s' - exiting", wpa_s->confname);
 926                 return -1;
 927         }
 928         wpa_config_read(wpa_s->confanother, conf);
 929
 930         conf->changed_parameters = (unsigned int) -1;
 931
 932         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 933                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 934                     os_strcmp(conf->ctrl_interface,
 935                               wpa_s->conf->ctrl_interface) != 0);
 936
 937         if (reconf_ctrl && wpa_s->ctrl_iface) {
 938                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 939                 wpa_s->ctrl_iface = NULL;
 940         }
 941
 942         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 943         if (wpa_s->current_ssid) {
 944                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 945                         wpa_s->own_disconnect_req = 1;
 946                 wpa_supplicant_deauthenticate(wpa_s,
 947                                               WLAN_REASON_DEAUTH_LEAVING);
 948         }
 949
 950         /*
 951          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 952          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 953          */
 954         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 955                 /*
 956                  * Clear forced success to clear EAP state for next
 957                  * authentication.
 958                  */
 959                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 960         }
 961         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 962         wpa_sm_set_config(wpa_s->wpa, NULL);
 963         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 964         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 965         rsn_preauth_deinit(wpa_s->wpa);
 966
 967         old_ap_scan = wpa_s->conf->ap_scan;
 968         wpa_config_free(wpa_s->conf);
 969         wpa_s->conf = conf;
 970         if (old_ap_scan != wpa_s->conf->ap_scan)
 971                 wpas_notify_ap_scan_changed(wpa_s);
 972
 973         if (reconf_ctrl)
 974                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 975
 976         wpa_supplicant_update_config(wpa_s);
 977
 978         wpa_supplicant_clear_status(wpa_s);
 979         if (wpa_supplicant_enabled_networks(wpa_s)) {
 980                 wpa_s->reassociate = 1;
 981                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 982         }
 983         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 984         return 0;
 985 }
 986
 987
 988 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 989 {
 990         struct wpa_global *global = signal_ctx;
 991         struct wpa_supplicant *wpa_s;
 992         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 993                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 994                         sig);
 995                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 996                         wpa_supplicant_terminate_proc(global);
 997                 }
 998         }
 999
1000         if (wpa_debug_reopen_file() < 0) {
1001                 /* Ignore errors since we cannot really do much to fix this */
1002                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1003         }
1004 }
1005
1006
1007 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1008                                          struct wpa_ssid *ssid,
1009                                          struct wpa_ie_data *ie)
1010 {
1011         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1012         if (ret) {
1013                 if (ret == -2) {
1014                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1015                                 "from association info");
1016                 }
1017                 return -1;
1018         }
1019
1020         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1021                 "cipher suites");
1022         if (!(ie->group_cipher & ssid->group_cipher)) {
1023                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1024                         "cipher 0x%x (mask 0x%x) - reject",
1025                         ie->group_cipher, ssid->group_cipher);
1026                 return -1;
1027         }
1028         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1029                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1030                         "cipher 0x%x (mask 0x%x) - reject",
1031                         ie->pairwise_cipher, ssid->pairwise_cipher);
1032                 return -1;
1033         }
1034         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1036                         "management 0x%x (mask 0x%x) - reject",
1037                         ie->key_mgmt, ssid->key_mgmt);
1038                 return -1;
1039         }
1040
1041 #ifdef CONFIG_IEEE80211W
1042         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1043             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1044                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1045                         "that does not support management frame protection - "
1046                         "reject");
1047                 return -1;
1048         }
1049 #endif /* CONFIG_IEEE80211W */
1050
1051         return 0;
1052 }
1053
1054
1055 /**
1056  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1057  * @wpa_s: Pointer to wpa_supplicant data
1058  * @bss: Scan results for the selected BSS, or %NULL if not available
1059  * @ssid: Configuration data for the selected network
1060  * @wpa_ie: Buffer for the WPA/RSN IE
1061  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1062  * used buffer length in case the functions returns success.
1063  * Returns: 0 on success or -1 on failure
1064  *
1065  * This function is used to configure authentication and encryption parameters
1066  * based on the network configuration and scan result for the selected BSS (if
1067  * available).
1068  */
1069 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1070                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1071                               u8 *wpa_ie, size_t *wpa_ie_len)
1072 {
1073         struct wpa_ie_data ie;
1074         int sel, proto;
1075         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1076
1077         if (bss) {
1078                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1079                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1080                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1081         } else
1082                 bss_wpa = bss_rsn = bss_osen = NULL;
1083
1084         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1085             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1086             (ie.group_cipher & ssid->group_cipher) &&
1087             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1088             (ie.key_mgmt & ssid->key_mgmt)) {
1089                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1090                 proto = WPA_PROTO_RSN;
1091         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1092                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1093                    (ie.group_cipher & ssid->group_cipher) &&
1094                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1095                    (ie.key_mgmt & ssid->key_mgmt)) {
1096                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1097                 proto = WPA_PROTO_WPA;
1098 #ifdef CONFIG_HS20
1099         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1100                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1101                 /* TODO: parse OSEN element */
1102                 os_memset(&ie, 0, sizeof(ie));
1103                 ie.group_cipher = WPA_CIPHER_CCMP;
1104                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1105                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1106                 proto = WPA_PROTO_OSEN;
1107 #endif /* CONFIG_HS20 */
1108         } else if (bss) {
1109                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1110                 wpa_dbg(wpa_s, MSG_DEBUG,
1111                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1112                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1113                         ssid->key_mgmt);
1114                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1115                         MAC2STR(bss->bssid),
1116                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1117                         bss_wpa ? " WPA" : "",
1118                         bss_rsn ? " RSN" : "",
1119                         bss_osen ? " OSEN" : "");
1120                 if (bss_rsn) {
1121                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1122                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1123                                 wpa_dbg(wpa_s, MSG_DEBUG,
1124                                         "Could not parse RSN element");
1125                         } else {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1128                                         ie.pairwise_cipher, ie.group_cipher,
1129                                         ie.key_mgmt);
1130                         }
1131                 }
1132                 if (bss_wpa) {
1133                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1134                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1135                                 wpa_dbg(wpa_s, MSG_DEBUG,
1136                                         "Could not parse WPA element");
1137                         } else {
1138                                 wpa_dbg(wpa_s, MSG_DEBUG,
1139                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1140                                         ie.pairwise_cipher, ie.group_cipher,
1141                                         ie.key_mgmt);
1142                         }
1143                 }
1144                 return -1;
1145         } else {
1146                 if (ssid->proto & WPA_PROTO_OSEN)
1147                         proto = WPA_PROTO_OSEN;
1148                 else if (ssid->proto & WPA_PROTO_RSN)
1149                         proto = WPA_PROTO_RSN;
1150                 else
1151                         proto = WPA_PROTO_WPA;
1152                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1153                         os_memset(&ie, 0, sizeof(ie));
1154                         ie.group_cipher = ssid->group_cipher;
1155                         ie.pairwise_cipher = ssid->pairwise_cipher;
1156                         ie.key_mgmt = ssid->key_mgmt;
1157 #ifdef CONFIG_IEEE80211W
1158                         ie.mgmt_group_cipher =
1159                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1160                                 WPA_CIPHER_AES_128_CMAC : 0;
1161 #endif /* CONFIG_IEEE80211W */
1162                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1163                                 "based on configuration");
1164                 } else
1165                         proto = ie.proto;
1166         }
1167
1168         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1169                 "pairwise %d key_mgmt %d proto %d",
1170                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1171 #ifdef CONFIG_IEEE80211W
1172         if (ssid->ieee80211w) {
1173                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1174                         ie.mgmt_group_cipher);
1175         }
1176 #endif /* CONFIG_IEEE80211W */
1177
1178         wpa_s->wpa_proto = proto;
1179         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1180         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1181                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1182
1183         if (bss || !wpa_s->ap_ies_from_associnfo) {
1184                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1185                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1186                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1187                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1188                         return -1;
1189         }
1190
1191 #ifdef CONFIG_NO_WPA
1192         wpa_s->group_cipher = WPA_CIPHER_NONE;
1193         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1194 #else /* CONFIG_NO_WPA */
1195         sel = ie.group_cipher & ssid->group_cipher;
1196         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1197         if (wpa_s->group_cipher < 0) {
1198                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1199                         "cipher");
1200                 return -1;
1201         }
1202         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1203                 wpa_cipher_txt(wpa_s->group_cipher));
1204
1205         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1206         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1207         if (wpa_s->pairwise_cipher < 0) {
1208                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1209                         "cipher");
1210                 return -1;
1211         }
1212         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1213                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1214 #endif /* CONFIG_NO_WPA */
1215
1216         sel = ie.key_mgmt & ssid->key_mgmt;
1217 #ifdef CONFIG_SAE
1218         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1219                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1220 #endif /* CONFIG_SAE */
1221         if (0) {
1222 #ifdef CONFIG_SUITEB192
1223         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1225                 wpa_dbg(wpa_s, MSG_DEBUG,
1226                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1227 #endif /* CONFIG_SUITEB192 */
1228 #ifdef CONFIG_SUITEB
1229         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1231                 wpa_dbg(wpa_s, MSG_DEBUG,
1232                         "WPA: using KEY_MGMT 802.1X with Suite B");
1233 #endif /* CONFIG_SUITEB */
1234 #ifdef CONFIG_IEEE80211R
1235         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1236                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1237                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1238         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1239                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1240                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1241 #endif /* CONFIG_IEEE80211R */
1242 #ifdef CONFIG_SAE
1243         } else if (sel & WPA_KEY_MGMT_SAE) {
1244                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1245                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1246         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1248                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1249 #endif /* CONFIG_SAE */
1250 #ifdef CONFIG_IEEE80211W
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1253                 wpa_dbg(wpa_s, MSG_DEBUG,
1254                         "WPA: using KEY_MGMT 802.1X with SHA256");
1255         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1256                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1257                 wpa_dbg(wpa_s, MSG_DEBUG,
1258                         "WPA: using KEY_MGMT PSK with SHA256");
1259 #endif /* CONFIG_IEEE80211W */
1260         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1261                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1262                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1263         } else if (sel & WPA_KEY_MGMT_PSK) {
1264                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1266         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1267                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1268                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1269 #ifdef CONFIG_HS20
1270         } else if (sel & WPA_KEY_MGMT_OSEN) {
1271                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1272                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1273 #endif /* CONFIG_HS20 */
1274         } else {
1275                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1276                         "authenticated key management type");
1277                 return -1;
1278         }
1279
1280         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1282                          wpa_s->pairwise_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1284
1285 #ifdef CONFIG_IEEE80211W
1286         sel = ie.mgmt_group_cipher;
1287         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1288             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1289                 sel = 0;
1290         if (sel & WPA_CIPHER_AES_128_CMAC) {
1291                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1292                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1293                         "AES-128-CMAC");
1294         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1295                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1296                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1297                         "BIP-GMAC-128");
1298         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1299                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1300                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1301                         "BIP-GMAC-256");
1302         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1303                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1304                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1305                         "BIP-CMAC-256");
1306         } else {
1307                 wpa_s->mgmt_group_cipher = 0;
1308                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1309         }
1310         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1311                          wpa_s->mgmt_group_cipher);
1312         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1313                          wpas_get_ssid_pmf(wpa_s, ssid));
1314 #endif /* CONFIG_IEEE80211W */
1315
1316         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1317                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1318                 return -1;
1319         }
1320
1321         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1322                 int psk_set = 0;
1323
1324                 if (ssid->psk_set) {
1325                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1326                                        NULL);
1327                         psk_set = 1;
1328                 }
1329 #ifndef CONFIG_NO_PBKDF2
1330                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1331                     ssid->passphrase) {
1332                         u8 psk[PMK_LEN];
1333                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1334                                     4096, psk, PMK_LEN);
1335                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1336                                         psk, PMK_LEN);
1337                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1338                         psk_set = 1;
1339                         os_memset(psk, 0, sizeof(psk));
1340                 }
1341 #endif /* CONFIG_NO_PBKDF2 */
1342 #ifdef CONFIG_EXT_PASSWORD
1343                 if (ssid->ext_psk) {
1344                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1345                                                              ssid->ext_psk);
1346                         char pw_str[64 + 1];
1347                         u8 psk[PMK_LEN];
1348
1349                         if (pw == NULL) {
1350                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1351                                         "found from external storage");
1352                                 return -1;
1353                         }
1354
1355                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1356                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1357                                         "PSK length %d in external storage",
1358                                         (int) wpabuf_len(pw));
1359                                 ext_password_free(pw);
1360                                 return -1;
1361                         }
1362
1363                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1364                         pw_str[wpabuf_len(pw)] = '\0';
1365
1366 #ifndef CONFIG_NO_PBKDF2
1367                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1368                         {
1369                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1370                                             4096, psk, PMK_LEN);
1371                                 os_memset(pw_str, 0, sizeof(pw_str));
1372                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1373                                                 "external passphrase)",
1374                                                 psk, PMK_LEN);
1375                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1376                                                NULL);
1377                                 psk_set = 1;
1378                                 os_memset(psk, 0, sizeof(psk));
1379                         } else
1380 #endif /* CONFIG_NO_PBKDF2 */
1381                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1382                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1383                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1384                                                 "Invalid PSK hex string");
1385                                         os_memset(pw_str, 0, sizeof(pw_str));
1386                                         ext_password_free(pw);
1387                                         return -1;
1388                                 }
1389                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1390                                                NULL);
1391                                 psk_set = 1;
1392                                 os_memset(psk, 0, sizeof(psk));
1393                         } else {
1394                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1395                                         "PSK available");
1396                                 os_memset(pw_str, 0, sizeof(pw_str));
1397                                 ext_password_free(pw);
1398                                 return -1;
1399                         }
1400
1401                         os_memset(pw_str, 0, sizeof(pw_str));
1402                         ext_password_free(pw);
1403                 }
1404 #endif /* CONFIG_EXT_PASSWORD */
1405
1406                 if (!psk_set) {
1407                         wpa_msg(wpa_s, MSG_INFO,
1408                                 "No PSK available for association");
1409                         return -1;
1410                 }
1411         } else
1412                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1413
1414         return 0;
1415 }
1416
1417
1418 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1419 {
1420         *pos = 0x00;
1421
1422         switch (idx) {
1423         case 0: /* Bits 0-7 */
1424                 break;
1425         case 1: /* Bits 8-15 */
1426                 break;
1427         case 2: /* Bits 16-23 */
1428 #ifdef CONFIG_WNM
1429                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1430                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1431 #endif /* CONFIG_WNM */
1432                 break;
1433         case 3: /* Bits 24-31 */
1434 #ifdef CONFIG_WNM
1435                 *pos |= 0x02; /* Bit 25 - SSID List */
1436 #endif /* CONFIG_WNM */
1437 #ifdef CONFIG_INTERWORKING
1438                 if (wpa_s->conf->interworking)
1439                         *pos |= 0x80; /* Bit 31 - Interworking */
1440 #endif /* CONFIG_INTERWORKING */
1441                 break;
1442         case 4: /* Bits 32-39 */
1443 #ifdef CONFIG_INTERWORKING
1444                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1445                         *pos |= 0x01; /* Bit 32 - QoS Map */
1446 #endif /* CONFIG_INTERWORKING */
1447                 break;
1448         case 5: /* Bits 40-47 */
1449 #ifdef CONFIG_HS20
1450                 if (wpa_s->conf->hs20)
1451                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1452 #endif /* CONFIG_HS20 */
1453 #ifdef CONFIG_MBO
1454                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1455 #endif /* CONFIG_MBO */
1456                 break;
1457         case 6: /* Bits 48-55 */
1458                 break;
1459         }
1460 }
1461
1462
1463 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1464 {
1465         u8 *pos = buf;
1466         u8 len = 6, i;
1467
1468         if (len < wpa_s->extended_capa_len)
1469                 len = wpa_s->extended_capa_len;
1470         if (buflen < (size_t) len + 2) {
1471                 wpa_printf(MSG_INFO,
1472                            "Not enough room for building extended capabilities element");
1473                 return -1;
1474         }
1475
1476         *pos++ = WLAN_EID_EXT_CAPAB;
1477         *pos++ = len;
1478         for (i = 0; i < len; i++, pos++) {
1479                 wpas_ext_capab_byte(wpa_s, pos, i);
1480
1481                 if (i < wpa_s->extended_capa_len) {
1482                         *pos &= ~wpa_s->extended_capa_mask[i];
1483                         *pos |= wpa_s->extended_capa[i];
1484                 }
1485         }
1486
1487         while (len > 0 && buf[1 + len] == 0) {
1488                 len--;
1489                 buf[1] = len;
1490         }
1491         if (len == 0)
1492                 return 0;
1493
1494         return 2 + len;
1495 }
1496
1497
1498 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1499                           struct wpa_bss *test_bss)
1500 {
1501         struct wpa_bss *bss;
1502
1503         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1504                 if (bss == test_bss)
1505                         return 1;
1506         }
1507
1508         return 0;
1509 }
1510
1511
1512 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1513                            struct wpa_ssid *test_ssid)
1514 {
1515         struct wpa_ssid *ssid;
1516
1517         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1518                 if (ssid == test_ssid)
1519                         return 1;
1520         }
1521
1522         return 0;
1523 }
1524
1525
1526 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1527                         struct wpa_ssid *test_ssid)
1528 {
1529         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1530                 return 0;
1531
1532         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1533 }
1534
1535
1536 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1537 {
1538         if (cwork == NULL)
1539                 return;
1540         os_free(cwork);
1541 }
1542
1543
1544 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1545 {
1546         struct wpa_connect_work *cwork;
1547         struct wpa_radio_work *work = wpa_s->connect_work;
1548
1549         if (!work)
1550                 return;
1551
1552         wpa_s->connect_work = NULL;
1553         cwork = work->ctx;
1554         work->ctx = NULL;
1555         wpas_connect_work_free(cwork);
1556         radio_work_done(work);
1557 }
1558
1559
1560 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1561 {
1562         struct os_reltime now;
1563         u8 addr[ETH_ALEN];
1564
1565         os_get_reltime(&now);
1566         if (wpa_s->last_mac_addr_style == style &&
1567             wpa_s->last_mac_addr_change.sec != 0 &&
1568             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1569                                 wpa_s->conf->rand_addr_lifetime)) {
1570                 wpa_msg(wpa_s, MSG_DEBUG,
1571                         "Previously selected random MAC address has not yet expired");
1572                 return 0;
1573         }
1574
1575         switch (style) {
1576         case 1:
1577                 if (random_mac_addr(addr) < 0)
1578                         return -1;
1579                 break;
1580         case 2:
1581                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1582                 if (random_mac_addr_keep_oui(addr) < 0)
1583                         return -1;
1584                 break;
1585         default:
1586                 return -1;
1587         }
1588
1589         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1590                 wpa_msg(wpa_s, MSG_INFO,
1591                         "Failed to set random MAC address");
1592                 return -1;
1593         }
1594
1595         os_get_reltime(&wpa_s->last_mac_addr_change);
1596         wpa_s->mac_addr_changed = 1;
1597         wpa_s->last_mac_addr_style = style;
1598
1599         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1600                 wpa_msg(wpa_s, MSG_INFO,
1601                         "Could not update MAC address information");
1602                 return -1;
1603         }
1604
1605         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1606                 MAC2STR(addr));
1607
1608         return 0;
1609 }
1610
1611
1612 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1613 {
1614         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1615             !wpa_s->conf->preassoc_mac_addr)
1616                 return 0;
1617
1618         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1619 }
1620
1621
1622 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1623
1624 /**
1625  * wpa_supplicant_associate - Request association
1626  * @wpa_s: Pointer to wpa_supplicant data
1627  * @bss: Scan results for the selected BSS, or %NULL if not available
1628  * @ssid: Configuration data for the selected network
1629  *
1630  * This function is used to request %wpa_supplicant to associate with a BSS.
1631  */
1632 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1633                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1634 {
1635         struct wpa_connect_work *cwork;
1636         int rand_style;
1637
1638         wpa_s->own_disconnect_req = 0;
1639
1640         /*
1641          * If we are starting a new connection, any previously pending EAPOL
1642          * RX cannot be valid anymore.
1643          */
1644         wpabuf_free(wpa_s->pending_eapol_rx);
1645         wpa_s->pending_eapol_rx = NULL;
1646
1647         if (ssid->mac_addr == -1)
1648                 rand_style = wpa_s->conf->mac_addr;
1649         else
1650                 rand_style = ssid->mac_addr;
1651
1652         wmm_ac_clear_saved_tspecs(wpa_s);
1653         wpa_s->reassoc_same_bss = 0;
1654         wpa_s->reassoc_same_ess = 0;
1655
1656         if (wpa_s->last_ssid == ssid) {
1657                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1658                 wpa_s->reassoc_same_ess = 1;
1659                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1660                         wmm_ac_save_tspecs(wpa_s);
1661                         wpa_s->reassoc_same_bss = 1;
1662                 }
1663         } else if (rand_style > 0) {
1664                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1665                         return;
1666                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1667         } else if (wpa_s->mac_addr_changed) {
1668                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1669                         wpa_msg(wpa_s, MSG_INFO,
1670                                 "Could not restore permanent MAC address");
1671                         return;
1672                 }
1673                 wpa_s->mac_addr_changed = 0;
1674                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1675                         wpa_msg(wpa_s, MSG_INFO,
1676                                 "Could not update MAC address information");
1677                         return;
1678                 }
1679                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1680         }
1681         wpa_s->last_ssid = ssid;
1682
1683 #ifdef CONFIG_IBSS_RSN
1684         ibss_rsn_deinit(wpa_s->ibss_rsn);
1685         wpa_s->ibss_rsn = NULL;
1686 #endif /* CONFIG_IBSS_RSN */
1687
1688         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1689             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1690 #ifdef CONFIG_AP
1691                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1692                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1693                                 "mode");
1694                         return;
1695                 }
1696                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1697                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1698                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1699                                 wpas_p2p_ap_setup_failed(wpa_s);
1700                         return;
1701                 }
1702                 wpa_s->current_bss = bss;
1703 #else /* CONFIG_AP */
1704                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1705                         "the build");
1706 #endif /* CONFIG_AP */
1707                 return;
1708         }
1709
1710         if (ssid->mode == WPAS_MODE_MESH) {
1711 #ifdef CONFIG_MESH
1712                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1713                         wpa_msg(wpa_s, MSG_INFO,
1714                                 "Driver does not support mesh mode");
1715                         return;
1716                 }
1717                 if (bss)
1718                         ssid->frequency = bss->freq;
1719                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1720                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1721                         return;
1722                 }
1723                 wpa_s->current_bss = bss;
1724                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1725                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1726                         ssid->id);
1727 #else /* CONFIG_MESH */
1728                 wpa_msg(wpa_s, MSG_ERROR,
1729                         "mesh mode support not included in the build");
1730 #endif /* CONFIG_MESH */
1731                 return;
1732         }
1733
1734 #ifdef CONFIG_TDLS
1735         if (bss)
1736                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1737                                 bss->ie_len);
1738 #endif /* CONFIG_TDLS */
1739
1740         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1741             ssid->mode == IEEE80211_MODE_INFRA) {
1742                 sme_authenticate(wpa_s, bss, ssid);
1743                 return;
1744         }
1745
1746         if (wpa_s->connect_work) {
1747                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1748                 return;
1749         }
1750
1751         if (radio_work_pending(wpa_s, "connect")) {
1752                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1753                 return;
1754         }
1755
1756         wpas_abort_ongoing_scan(wpa_s);
1757
1758         cwork = os_zalloc(sizeof(*cwork));
1759         if (cwork == NULL)
1760                 return;
1761
1762         cwork->bss = bss;
1763         cwork->ssid = ssid;
1764
1765         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1766                            wpas_start_assoc_cb, cwork) < 0) {
1767                 os_free(cwork);
1768         }
1769 }
1770
1771
1772 static int bss_is_ibss(struct wpa_bss *bss)
1773 {
1774         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1775                 IEEE80211_CAP_IBSS;
1776 }
1777
1778
1779 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1780                             const struct wpa_ssid *ssid)
1781 {
1782         enum hostapd_hw_mode hw_mode;
1783         struct hostapd_hw_modes *mode = NULL;
1784         u8 channel;
1785         int i;
1786
1787 #ifdef CONFIG_HT_OVERRIDES
1788         if (ssid->disable_ht)
1789                 return 0;
1790 #endif /* CONFIG_HT_OVERRIDES */
1791
1792         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1793         if (hw_mode == NUM_HOSTAPD_MODES)
1794                 return 0;
1795         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1796                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1797                         mode = &wpa_s->hw.modes[i];
1798                         break;
1799                 }
1800         }
1801
1802         if (!mode)
1803                 return 0;
1804
1805         return mode->vht_capab != 0;
1806 }
1807
1808
1809 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1810                           const struct wpa_ssid *ssid,
1811                           struct hostapd_freq_params *freq)
1812 {
1813         enum hostapd_hw_mode hw_mode;
1814         struct hostapd_hw_modes *mode = NULL;
1815         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1816                            184, 192 };
1817         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1818         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1819         u8 channel;
1820         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1821         unsigned int j, k;
1822         struct hostapd_freq_params vht_freq;
1823         int chwidth, seg0, seg1;
1824         u32 vht_caps = 0;
1825
1826         freq->freq = ssid->frequency;
1827
1828         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1829                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1830
1831                 if (ssid->mode != WPAS_MODE_IBSS)
1832                         break;
1833
1834                 /* Don't adjust control freq in case of fixed_freq */
1835                 if (ssid->fixed_freq)
1836                         break;
1837
1838                 if (!bss_is_ibss(bss))
1839                         continue;
1840
1841                 if (ssid->ssid_len == bss->ssid_len &&
1842                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1843                         wpa_printf(MSG_DEBUG,
1844                                    "IBSS already found in scan results, adjust control freq: %d",
1845                                    bss->freq);
1846                         freq->freq = bss->freq;
1847                         obss_scan = 0;
1848                         break;
1849                 }
1850         }
1851
1852         /* For IBSS check HT_IBSS flag */
1853         if (ssid->mode == WPAS_MODE_IBSS &&
1854             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1855                 return;
1856
1857         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1858             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1859             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1860                 wpa_printf(MSG_DEBUG,
1861                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1862                 return;
1863         }
1864
1865         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1866         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1867                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1868                         mode = &wpa_s->hw.modes[i];
1869                         break;
1870                 }
1871         }
1872
1873         if (!mode)
1874                 return;
1875
1876 #ifdef CONFIG_HT_OVERRIDES
1877         if (ssid->disable_ht) {
1878                 freq->ht_enabled = 0;
1879                 return;
1880         }
1881 #endif /* CONFIG_HT_OVERRIDES */
1882
1883         freq->ht_enabled = ht_supported(mode);
1884         if (!freq->ht_enabled)
1885                 return;
1886
1887         /* Setup higher BW only for 5 GHz */
1888         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1889                 return;
1890
1891         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1892                 pri_chan = &mode->channels[chan_idx];
1893                 if (pri_chan->chan == channel)
1894                         break;
1895                 pri_chan = NULL;
1896         }
1897         if (!pri_chan)
1898                 return;
1899
1900         /* Check primary channel flags */
1901         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1902                 return;
1903
1904         /* Check/setup HT40+/HT40- */
1905         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1906                 if (ht40plus[j] == channel) {
1907                         ht40 = 1;
1908                         break;
1909                 }
1910         }
1911
1912         /* Find secondary channel */
1913         for (i = 0; i < mode->num_channels; i++) {
1914                 sec_chan = &mode->channels[i];
1915                 if (sec_chan->chan == channel + ht40 * 4)
1916                         break;
1917                 sec_chan = NULL;
1918         }
1919         if (!sec_chan)
1920                 return;
1921
1922         /* Check secondary channel flags */
1923         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1924                 return;
1925
1926         freq->channel = pri_chan->chan;
1927
1928         switch (ht40) {
1929         case -1:
1930                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1931                         return;
1932                 freq->sec_channel_offset = -1;
1933                 break;
1934         case 1:
1935                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1936                         return;
1937                 freq->sec_channel_offset = 1;
1938                 break;
1939         default:
1940                 break;
1941         }
1942
1943         if (freq->sec_channel_offset && obss_scan) {
1944                 struct wpa_scan_results *scan_res;
1945
1946                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1947                 if (scan_res == NULL) {
1948                         /* Back to HT20 */
1949                         freq->sec_channel_offset = 0;
1950                         return;
1951                 }
1952
1953                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1954                                      sec_chan->chan);
1955                 switch (res) {
1956                 case 0:
1957                         /* Back to HT20 */
1958                         freq->sec_channel_offset = 0;
1959                         break;
1960                 case 1:
1961                         /* Configuration allowed */
1962                         break;
1963                 case 2:
1964                         /* Switch pri/sec channels */
1965                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1966                         freq->sec_channel_offset = -freq->sec_channel_offset;
1967                         freq->channel = sec_chan->chan;
1968                         break;
1969                 default:
1970                         freq->sec_channel_offset = 0;
1971                         break;
1972                 }
1973
1974                 wpa_scan_results_free(scan_res);
1975         }
1976
1977         wpa_printf(MSG_DEBUG,
1978                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1979                    freq->channel, freq->sec_channel_offset);
1980
1981         if (!drv_supports_vht(wpa_s, ssid))
1982                 return;
1983
1984         /* For IBSS check VHT_IBSS flag */
1985         if (ssid->mode == WPAS_MODE_IBSS &&
1986             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1987                 return;
1988
1989         vht_freq = *freq;
1990
1991         vht_freq.vht_enabled = vht_supported(mode);
1992         if (!vht_freq.vht_enabled)
1993                 return;
1994
1995         /* setup center_freq1, bandwidth */
1996         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1997                 if (freq->channel >= vht80[j] &&
1998                     freq->channel < vht80[j] + 16)
1999                         break;
2000         }
2001
2002         if (j == ARRAY_SIZE(vht80))
2003                 return;
2004
2005         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
2006                 struct hostapd_channel_data *chan;
2007
2008                 chan = hw_get_channel_chan(mode, i, NULL);
2009                 if (!chan)
2010                         return;
2011
2012                 /* Back to HT configuration if channel not usable */
2013                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2014                         return;
2015         }
2016
2017         chwidth = VHT_CHANWIDTH_80MHZ;
2018         seg0 = vht80[j] + 6;
2019         seg1 = 0;
2020
2021         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2022                 /* setup center_freq2, bandwidth */
2023                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2024                         /* Only accept 80 MHz segments separated by a gap */
2025                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2026                                 continue;
2027                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2028                                 struct hostapd_channel_data *chan;
2029
2030                                 chan = hw_get_channel_chan(mode, i, NULL);
2031                                 if (!chan)
2032                                         continue;
2033
2034                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2035                                                   HOSTAPD_CHAN_NO_IR |
2036                                                   HOSTAPD_CHAN_RADAR))
2037                                         continue;
2038
2039                                 /* Found a suitable second segment for 80+80 */
2040                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2041                                 vht_caps |=
2042                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2043                                 seg1 = vht80[k] + 6;
2044                         }
2045
2046                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2047                                 break;
2048                 }
2049         } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_160MHZ) {
2050                 if (freq->freq == 5180) {
2051                         chwidth = VHT_CHANWIDTH_160MHZ;
2052                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2053                         seg0 = 50;
2054                 } else if (freq->freq == 5520) {
2055                         chwidth = VHT_CHANWIDTH_160MHZ;
2056                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2057                         seg0 = 114;
2058                 }
2059         }
2060
2061         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2062                                     freq->channel, freq->ht_enabled,
2063                                     vht_freq.vht_enabled,
2064                                     freq->sec_channel_offset,
2065                                     chwidth, seg0, seg1, vht_caps) != 0)
2066                 return;
2067
2068         *freq = vht_freq;
2069
2070         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2071                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2072 }
2073
2074
2075 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2076 {
2077         struct wpa_connect_work *cwork = work->ctx;
2078         struct wpa_bss *bss = cwork->bss;
2079         struct wpa_ssid *ssid = cwork->ssid;
2080         struct wpa_supplicant *wpa_s = work->wpa_s;
2081         u8 wpa_ie[200];
2082         size_t wpa_ie_len;
2083         int use_crypt, ret, i, bssid_changed;
2084         int algs = WPA_AUTH_ALG_OPEN;
2085         unsigned int cipher_pairwise, cipher_group;
2086         struct wpa_driver_associate_params params;
2087         int wep_keys_set = 0;
2088         int assoc_failed = 0;
2089         struct wpa_ssid *old_ssid;
2090         u8 prev_bssid[ETH_ALEN];
2091 #ifdef CONFIG_HT_OVERRIDES
2092         struct ieee80211_ht_capabilities htcaps;
2093         struct ieee80211_ht_capabilities htcaps_mask;
2094 #endif /* CONFIG_HT_OVERRIDES */
2095 #ifdef CONFIG_VHT_OVERRIDES
2096        struct ieee80211_vht_capabilities vhtcaps;
2097        struct ieee80211_vht_capabilities vhtcaps_mask;
2098 #endif /* CONFIG_VHT_OVERRIDES */
2099 #ifdef CONFIG_MBO
2100         const u8 *mbo = NULL;
2101 #endif /* CONFIG_MBO */
2102
2103         if (deinit) {
2104                 if (work->started) {
2105                         wpa_s->connect_work = NULL;
2106
2107                         /* cancel possible auth. timeout */
2108                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2109                                              NULL);
2110                 }
2111                 wpas_connect_work_free(cwork);
2112                 return;
2113         }
2114
2115         wpa_s->connect_work = work;
2116
2117         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2118             wpas_network_disabled(wpa_s, ssid)) {
2119                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2120                 wpas_connect_work_done(wpa_s);
2121                 return;
2122         }
2123
2124         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2125         os_memset(&params, 0, sizeof(params));
2126         wpa_s->reassociate = 0;
2127         wpa_s->eap_expected_failure = 0;
2128         if (bss &&
2129             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2130 #ifdef CONFIG_IEEE80211R
2131                 const u8 *ie, *md = NULL;
2132 #endif /* CONFIG_IEEE80211R */
2133                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2134                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2135                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2136                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2137                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2138                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2139                 if (bssid_changed)
2140                         wpas_notify_bssid_changed(wpa_s);
2141 #ifdef CONFIG_IEEE80211R
2142                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2143                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2144                         md = ie + 2;
2145                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2146                 if (md) {
2147                         /* Prepare for the next transition */
2148                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2149                 }
2150 #endif /* CONFIG_IEEE80211R */
2151 #ifdef CONFIG_WPS
2152         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2153                    wpa_s->conf->ap_scan == 2 &&
2154                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2155                 /* Use ap_scan==1 style network selection to find the network
2156                  */
2157                 wpas_connect_work_done(wpa_s);
2158                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2159                 wpa_s->reassociate = 1;
2160                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2161                 return;
2162 #endif /* CONFIG_WPS */
2163         } else {
2164                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2165                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2166                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2167         }
2168         if (!wpa_s->pno)
2169                 wpa_supplicant_cancel_sched_scan(wpa_s);
2170
2171         wpa_supplicant_cancel_scan(wpa_s);
2172
2173         /* Starting new association, so clear the possibly used WPA IE from the
2174          * previous association. */
2175         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2176
2177 #ifdef IEEE8021X_EAPOL
2178         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2179                 if (ssid->leap) {
2180                         if (ssid->non_leap == 0)
2181                                 algs = WPA_AUTH_ALG_LEAP;
2182                         else
2183                                 algs |= WPA_AUTH_ALG_LEAP;
2184                 }
2185         }
2186 #endif /* IEEE8021X_EAPOL */
2187         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2188         if (ssid->auth_alg) {
2189                 algs = ssid->auth_alg;
2190                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2191                         "0x%x", algs);
2192         }
2193
2194         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2195                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2196             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2197                 int try_opportunistic;
2198                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2199                                      wpa_s->conf->okc :
2200                                      ssid->proactive_key_caching) &&
2201                         (ssid->proto & WPA_PROTO_RSN);
2202                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2203                                             ssid, try_opportunistic) == 0)
2204                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2205                 wpa_ie_len = sizeof(wpa_ie);
2206                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2207                                               wpa_ie, &wpa_ie_len)) {
2208                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2209                                 "key management and encryption suites");
2210                         wpas_connect_work_done(wpa_s);
2211                         return;
2212                 }
2213         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2214                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2215                 /*
2216                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2217                  * use non-WPA since the scan results did not indicate that the
2218                  * AP is using WPA or WPA2.
2219                  */
2220                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2221                 wpa_ie_len = 0;
2222                 wpa_s->wpa_proto = 0;
2223         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2224                 wpa_ie_len = sizeof(wpa_ie);
2225                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2226                                               wpa_ie, &wpa_ie_len)) {
2227                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2228                                 "key management and encryption suites (no "
2229                                 "scan results)");
2230                         wpas_connect_work_done(wpa_s);
2231                         return;
2232                 }
2233 #ifdef CONFIG_WPS
2234         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2235                 struct wpabuf *wps_ie;
2236                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2237                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2238                         wpa_ie_len = wpabuf_len(wps_ie);
2239                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2240                 } else
2241                         wpa_ie_len = 0;
2242                 wpabuf_free(wps_ie);
2243                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2244                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2245                         params.wps = WPS_MODE_PRIVACY;
2246                 else
2247                         params.wps = WPS_MODE_OPEN;
2248                 wpa_s->wpa_proto = 0;
2249 #endif /* CONFIG_WPS */
2250         } else {
2251                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2252                 wpa_ie_len = 0;
2253                 wpa_s->wpa_proto = 0;
2254         }
2255
2256 #ifdef CONFIG_P2P
2257         if (wpa_s->global->p2p) {
2258                 u8 *pos;
2259                 size_t len;
2260                 int res;
2261                 pos = wpa_ie + wpa_ie_len;
2262                 len = sizeof(wpa_ie) - wpa_ie_len;
2263                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2264                                             ssid->p2p_group);
2265                 if (res >= 0)
2266                         wpa_ie_len += res;
2267         }
2268
2269         wpa_s->cross_connect_disallowed = 0;
2270         if (bss) {
2271                 struct wpabuf *p2p;
2272                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2273                 if (p2p) {
2274                         wpa_s->cross_connect_disallowed =
2275                                 p2p_get_cross_connect_disallowed(p2p);
2276                         wpabuf_free(p2p);
2277                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2278                                 "connection",
2279                                 wpa_s->cross_connect_disallowed ?
2280                                 "disallows" : "allows");
2281                 }
2282         }
2283
2284         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2285 #endif /* CONFIG_P2P */
2286
2287 #ifdef CONFIG_MBO
2288         if (bss) {
2289                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2290                 if (mbo) {
2291                         int len;
2292
2293                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2294                                                         wpa_ie + wpa_ie_len,
2295                                                         sizeof(wpa_ie) -
2296                                                         wpa_ie_len);
2297                         if (len > 0)
2298                                 wpa_ie_len += len;
2299                 }
2300         }
2301 #endif /* CONFIG_MBO */
2302
2303         /*
2304          * Workaround: Add Extended Capabilities element only if the AP
2305          * included this element in Beacon/Probe Response frames. Some older
2306          * APs seem to have interoperability issues if this element is
2307          * included, so while the standard may require us to include the
2308          * element in all cases, it is justifiable to skip it to avoid
2309          * interoperability issues.
2310          */
2311         if (ssid->p2p_group)
2312                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
2313         else
2314                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
2315
2316         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2317                 u8 ext_capab[18];
2318                 int ext_capab_len;
2319                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2320                                                      sizeof(ext_capab));
2321                 if (ext_capab_len > 0) {
2322                         u8 *pos = wpa_ie;
2323                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2324                                 pos += 2 + pos[1];
2325                         os_memmove(pos + ext_capab_len, pos,
2326                                    wpa_ie_len - (pos - wpa_ie));
2327                         wpa_ie_len += ext_capab_len;
2328                         os_memcpy(pos, ext_capab, ext_capab_len);
2329                 }
2330         }
2331
2332 #ifdef CONFIG_HS20
2333         if (is_hs20_network(wpa_s, ssid, bss)) {
2334                 struct wpabuf *hs20;
2335
2336                 hs20 = wpabuf_alloc(20);
2337                 if (hs20) {
2338                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2339                         size_t len;
2340
2341                         wpas_hs20_add_indication(hs20, pps_mo_id);
2342                         len = sizeof(wpa_ie) - wpa_ie_len;
2343                         if (wpabuf_len(hs20) <= len) {
2344                                 os_memcpy(wpa_ie + wpa_ie_len,
2345                                           wpabuf_head(hs20), wpabuf_len(hs20));
2346                                 wpa_ie_len += wpabuf_len(hs20);
2347                         }
2348                         wpabuf_free(hs20);
2349
2350                         hs20_configure_frame_filters(wpa_s);
2351                 }
2352         }
2353 #endif /* CONFIG_HS20 */
2354
2355         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2356                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2357                 size_t len;
2358
2359                 len = sizeof(wpa_ie) - wpa_ie_len;
2360                 if (wpabuf_len(buf) <= len) {
2361                         os_memcpy(wpa_ie + wpa_ie_len,
2362                                   wpabuf_head(buf), wpabuf_len(buf));
2363                         wpa_ie_len += wpabuf_len(buf);
2364                 }
2365         }
2366
2367 #ifdef CONFIG_FST
2368         if (wpa_s->fst_ies) {
2369                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2370
2371                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2372                         os_memcpy(wpa_ie + wpa_ie_len,
2373                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2374                         wpa_ie_len += fst_ies_len;
2375                 }
2376         }
2377 #endif /* CONFIG_FST */
2378
2379 #ifdef CONFIG_MBO
2380         if (mbo) {
2381                 int len;
2382
2383                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2384                                   sizeof(wpa_ie) - wpa_ie_len);
2385                 if (len >= 0)
2386                         wpa_ie_len += len;
2387         }
2388 #endif /* CONFIG_MBO */
2389
2390         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2391         use_crypt = 1;
2392         cipher_pairwise = wpa_s->pairwise_cipher;
2393         cipher_group = wpa_s->group_cipher;
2394         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2395             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2396                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2397                         use_crypt = 0;
2398                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2399                         use_crypt = 1;
2400                         wep_keys_set = 1;
2401                 }
2402         }
2403         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2404                 use_crypt = 0;
2405
2406 #ifdef IEEE8021X_EAPOL
2407         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2408                 if ((ssid->eapol_flags &
2409                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2410                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2411                     !wep_keys_set) {
2412                         use_crypt = 0;
2413                 } else {
2414                         /* Assume that dynamic WEP-104 keys will be used and
2415                          * set cipher suites in order for drivers to expect
2416                          * encryption. */
2417                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2418                 }
2419         }
2420 #endif /* IEEE8021X_EAPOL */
2421
2422         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2423                 /* Set the key before (and later after) association */
2424                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2425         }
2426
2427         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2428         if (bss) {
2429                 params.ssid = bss->ssid;
2430                 params.ssid_len = bss->ssid_len;
2431                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2432                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2433                                    MACSTR " freq=%u MHz based on scan results "
2434                                    "(bssid_set=%d)",
2435                                    MAC2STR(bss->bssid), bss->freq,
2436                                    ssid->bssid_set);
2437                         params.bssid = bss->bssid;
2438                         params.freq.freq = bss->freq;
2439                 }
2440                 params.bssid_hint = bss->bssid;
2441                 params.freq_hint = bss->freq;
2442                 params.pbss = bss_is_pbss(bss);
2443         } else {
2444                 params.ssid = ssid->ssid;
2445                 params.ssid_len = ssid->ssid_len;
2446                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2447         }
2448
2449         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2450             wpa_s->conf->ap_scan == 2) {
2451                 params.bssid = ssid->bssid;
2452                 params.fixed_bssid = 1;
2453         }
2454
2455         /* Initial frequency for IBSS/mesh */
2456         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2457             ssid->frequency > 0 && params.freq.freq == 0)
2458                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2459
2460         if (ssid->mode == WPAS_MODE_IBSS) {
2461                 params.fixed_freq = ssid->fixed_freq;
2462                 if (ssid->beacon_int)
2463                         params.beacon_int = ssid->beacon_int;
2464                 else
2465                         params.beacon_int = wpa_s->conf->beacon_int;
2466         }
2467
2468         params.wpa_ie = wpa_ie;
2469         params.wpa_ie_len = wpa_ie_len;
2470         params.pairwise_suite = cipher_pairwise;
2471         params.group_suite = cipher_group;
2472         params.key_mgmt_suite = wpa_s->key_mgmt;
2473         params.wpa_proto = wpa_s->wpa_proto;
2474         params.auth_alg = algs;
2475         params.mode = ssid->mode;
2476         params.bg_scan_period = ssid->bg_scan_period;
2477         for (i = 0; i < NUM_WEP_KEYS; i++) {
2478                 if (ssid->wep_key_len[i])
2479                         params.wep_key[i] = ssid->wep_key[i];
2480                 params.wep_key_len[i] = ssid->wep_key_len[i];
2481         }
2482         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2483
2484         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2485             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2486              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2487                 params.passphrase = ssid->passphrase;
2488                 if (ssid->psk_set)
2489                         params.psk = ssid->psk;
2490         }
2491
2492         if (wpa_s->conf->key_mgmt_offload) {
2493                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2494                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2495                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2496                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2497                         params.req_key_mgmt_offload =
2498                                 ssid->proactive_key_caching < 0 ?
2499                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2500                 else
2501                         params.req_key_mgmt_offload = 1;
2502
2503                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2504                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2505                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2506                     ssid->psk_set)
2507                         params.psk = ssid->psk;
2508         }
2509
2510         params.drop_unencrypted = use_crypt;
2511
2512 #ifdef CONFIG_IEEE80211W
2513         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2514         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2515                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2516                 struct wpa_ie_data ie;
2517                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2518                     ie.capabilities &
2519                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2520                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2521                                 "MFP: require MFP");
2522                         params.mgmt_frame_protection =
2523                                 MGMT_FRAME_PROTECTION_REQUIRED;
2524                 }
2525         }
2526 #endif /* CONFIG_IEEE80211W */
2527
2528         params.p2p = ssid->p2p_group;
2529
2530         if (wpa_s->p2pdev->set_sta_uapsd)
2531                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2532         else
2533                 params.uapsd = -1;
2534
2535 #ifdef CONFIG_HT_OVERRIDES
2536         os_memset(&htcaps, 0, sizeof(htcaps));
2537         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2538         params.htcaps = (u8 *) &htcaps;
2539         params.htcaps_mask = (u8 *) &htcaps_mask;
2540         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2541 #endif /* CONFIG_HT_OVERRIDES */
2542 #ifdef CONFIG_VHT_OVERRIDES
2543         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2544         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2545         params.vhtcaps = &vhtcaps;
2546         params.vhtcaps_mask = &vhtcaps_mask;
2547         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2548 #endif /* CONFIG_VHT_OVERRIDES */
2549
2550 #ifdef CONFIG_P2P
2551         /*
2552          * If multi-channel concurrency is not supported, check for any
2553          * frequency conflict. In case of any frequency conflict, remove the
2554          * least prioritized connection.
2555          */
2556         if (wpa_s->num_multichan_concurrent < 2) {
2557                 int freq, num;
2558                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2559                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2560                         wpa_printf(MSG_DEBUG,
2561                                    "Assoc conflicting freq found (%d != %d)",
2562                                    freq, params.freq.freq);
2563                         if (wpas_p2p_handle_frequency_conflicts(
2564                                     wpa_s, params.freq.freq, ssid) < 0) {
2565                                 wpas_connect_work_done(wpa_s);
2566                                 return;
2567                         }
2568                 }
2569         }
2570 #endif /* CONFIG_P2P */
2571
2572         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2573             wpa_s->current_ssid)
2574                 params.prev_bssid = prev_bssid;
2575
2576         ret = wpa_drv_associate(wpa_s, &params);
2577         if (ret < 0) {
2578                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2579                         "failed");
2580                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2581                         /*
2582                          * The driver is known to mean what is saying, so we
2583                          * can stop right here; the association will not
2584                          * succeed.
2585                          */
2586                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2587                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2588                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2589                         return;
2590                 }
2591                 /* try to continue anyway; new association will be tried again
2592                  * after timeout */
2593                 assoc_failed = 1;
2594         }
2595
2596         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2597                 /* Set the key after the association just in case association
2598                  * cleared the previously configured key. */
2599                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2600                 /* No need to timeout authentication since there is no key
2601                  * management. */
2602                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2603                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2604 #ifdef CONFIG_IBSS_RSN
2605         } else if (ssid->mode == WPAS_MODE_IBSS &&
2606                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2607                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2608                 /*
2609                  * RSN IBSS authentication is per-STA and we can disable the
2610                  * per-BSSID authentication.
2611                  */
2612                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2613 #endif /* CONFIG_IBSS_RSN */
2614         } else {
2615                 /* Timeout for IEEE 802.11 authentication and association */
2616                 int timeout = 60;
2617
2618                 if (assoc_failed) {
2619                         /* give IBSS a bit more time */
2620                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2621                 } else if (wpa_s->conf->ap_scan == 1) {
2622                         /* give IBSS a bit more time */
2623                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2624                 }
2625                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2626         }
2627
2628         if (wep_keys_set &&
2629             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2630                 /* Set static WEP keys again */
2631                 wpa_set_wep_keys(wpa_s, ssid);
2632         }
2633
2634         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2635                 /*
2636                  * Do not allow EAP session resumption between different
2637                  * network configurations.
2638                  */
2639                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2640         }
2641         old_ssid = wpa_s->current_ssid;
2642         wpa_s->current_ssid = ssid;
2643
2644         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2645                 wpa_s->current_bss = bss;
2646 #ifdef CONFIG_HS20
2647                 hs20_configure_frame_filters(wpa_s);
2648 #endif /* CONFIG_HS20 */
2649         }
2650
2651         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2652         wpa_supplicant_initiate_eapol(wpa_s);
2653         if (old_ssid != wpa_s->current_ssid)
2654                 wpas_notify_network_changed(wpa_s);
2655 }
2656
2657
2658 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2659                                             const u8 *addr)
2660 {
2661         struct wpa_ssid *old_ssid;
2662
2663         wpas_connect_work_done(wpa_s);
2664         wpa_clear_keys(wpa_s, addr);
2665         old_ssid = wpa_s->current_ssid;
2666         wpa_supplicant_mark_disassoc(wpa_s);
2667         wpa_sm_set_config(wpa_s->wpa, NULL);
2668         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2669         if (old_ssid != wpa_s->current_ssid)
2670                 wpas_notify_network_changed(wpa_s);
2671         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2672 }
2673
2674
2675 /**
2676  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2677  * @wpa_s: Pointer to wpa_supplicant data
2678  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2679  *
2680  * This function is used to request %wpa_supplicant to deauthenticate from the
2681  * current AP.
2682  */
2683 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2684                                    int reason_code)
2685 {
2686         u8 *addr = NULL;
2687         union wpa_event_data event;
2688         int zero_addr = 0;
2689
2690         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2691                 " pending_bssid=" MACSTR " reason=%d state=%s",
2692                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2693                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2694
2695         if (!is_zero_ether_addr(wpa_s->bssid))
2696                 addr = wpa_s->bssid;
2697         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2698                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2699                   wpa_s->wpa_state == WPA_ASSOCIATING))
2700                 addr = wpa_s->pending_bssid;
2701         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2702                 /*
2703                  * When using driver-based BSS selection, we may not know the
2704                  * BSSID with which we are currently trying to associate. We
2705                  * need to notify the driver of this disconnection even in such
2706                  * a case, so use the all zeros address here.
2707                  */
2708                 addr = wpa_s->bssid;
2709                 zero_addr = 1;
2710         }
2711
2712 #ifdef CONFIG_TDLS
2713         wpa_tdls_teardown_peers(wpa_s->wpa);
2714 #endif /* CONFIG_TDLS */
2715
2716 #ifdef CONFIG_MESH
2717         if (wpa_s->ifmsh) {
2718                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2719                         wpa_s->ifname);
2720                 wpa_supplicant_leave_mesh(wpa_s);
2721         }
2722 #endif /* CONFIG_MESH */
2723
2724         if (addr) {
2725                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2726                 os_memset(&event, 0, sizeof(event));
2727                 event.deauth_info.reason_code = (u16) reason_code;
2728                 event.deauth_info.locally_generated = 1;
2729                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2730                 if (zero_addr)
2731                         addr = NULL;
2732         }
2733
2734         wpa_supplicant_clear_connection(wpa_s, addr);
2735 }
2736
2737 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2738                                               struct wpa_ssid *ssid)
2739 {
2740         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2741                 return;
2742
2743         ssid->disabled = 0;
2744         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2745         wpas_notify_network_enabled_changed(wpa_s, ssid);
2746
2747         /*
2748          * Try to reassociate since there is no current configuration and a new
2749          * network was made available.
2750          */
2751         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2752                 wpa_s->reassociate = 1;
2753 }
2754
2755
2756 /**
2757  * wpa_supplicant_enable_network - Mark a configured network as enabled
2758  * @wpa_s: wpa_supplicant structure for a network interface
2759  * @ssid: wpa_ssid structure for a configured network or %NULL
2760  *
2761  * Enables the specified network or all networks if no network specified.
2762  */
2763 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2764                                    struct wpa_ssid *ssid)
2765 {
2766         if (ssid == NULL) {
2767                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2768                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2769         } else
2770                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2771
2772         if (wpa_s->reassociate && !wpa_s->disconnected &&
2773             (!wpa_s->current_ssid ||
2774              wpa_s->wpa_state == WPA_DISCONNECTED ||
2775              wpa_s->wpa_state == WPA_SCANNING)) {
2776                 if (wpa_s->sched_scanning) {
2777                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2778                                    "new network to scan filters");
2779                         wpa_supplicant_cancel_sched_scan(wpa_s);
2780                 }
2781
2782                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2783                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2784                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2785                 }
2786         }
2787 }
2788
2789
2790 /**
2791  * wpa_supplicant_disable_network - Mark a configured network as disabled
2792  * @wpa_s: wpa_supplicant structure for a network interface
2793  * @ssid: wpa_ssid structure for a configured network or %NULL
2794  *
2795  * Disables the specified network or all networks if no network specified.
2796  */
2797 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2798                                     struct wpa_ssid *ssid)
2799 {
2800         struct wpa_ssid *other_ssid;
2801         int was_disabled;
2802
2803         if (ssid == NULL) {
2804                 if (wpa_s->sched_scanning)
2805                         wpa_supplicant_cancel_sched_scan(wpa_s);
2806
2807                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2808                      other_ssid = other_ssid->next) {
2809                         was_disabled = other_ssid->disabled;
2810                         if (was_disabled == 2)
2811                                 continue; /* do not change persistent P2P group
2812                                            * data */
2813
2814                         other_ssid->disabled = 1;
2815
2816                         if (was_disabled != other_ssid->disabled)
2817                                 wpas_notify_network_enabled_changed(
2818                                         wpa_s, other_ssid);
2819                 }
2820                 if (wpa_s->current_ssid)
2821                         wpa_supplicant_deauthenticate(
2822                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2823         } else if (ssid->disabled != 2) {
2824                 if (ssid == wpa_s->current_ssid)
2825                         wpa_supplicant_deauthenticate(
2826                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2827
2828                 was_disabled = ssid->disabled;
2829
2830                 ssid->disabled = 1;
2831
2832                 if (was_disabled != ssid->disabled) {
2833                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2834                         if (wpa_s->sched_scanning) {
2835                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2836                                            "to remove network from filters");
2837                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2838                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2839                         }
2840                 }
2841         }
2842 }
2843
2844
2845 /**
2846  * wpa_supplicant_select_network - Attempt association with a network
2847  * @wpa_s: wpa_supplicant structure for a network interface
2848  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2849  */
2850 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2851                                    struct wpa_ssid *ssid)
2852 {
2853
2854         struct wpa_ssid *other_ssid;
2855         int disconnected = 0;
2856
2857         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2858                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2859                         wpa_s->own_disconnect_req = 1;
2860                 wpa_supplicant_deauthenticate(
2861                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2862                 disconnected = 1;
2863         }
2864
2865         if (ssid)
2866                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2867
2868         /*
2869          * Mark all other networks disabled or mark all networks enabled if no
2870          * network specified.
2871          */
2872         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2873              other_ssid = other_ssid->next) {
2874                 int was_disabled = other_ssid->disabled;
2875                 if (was_disabled == 2)
2876                         continue; /* do not change persistent P2P group data */
2877
2878                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2879                 if (was_disabled && !other_ssid->disabled)
2880                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2881
2882                 if (was_disabled != other_ssid->disabled)
2883                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2884         }
2885
2886         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2887             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2888                 /* We are already associated with the selected network */
2889                 wpa_printf(MSG_DEBUG, "Already associated with the "
2890                            "selected network - do nothing");
2891                 return;
2892         }
2893
2894         if (ssid) {
2895                 wpa_s->current_ssid = ssid;
2896                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2897                 wpa_s->connect_without_scan =
2898                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2899
2900                 /*
2901                  * Don't optimize next scan freqs since a new ESS has been
2902                  * selected.
2903                  */
2904                 os_free(wpa_s->next_scan_freqs);
2905                 wpa_s->next_scan_freqs = NULL;
2906         } else {
2907                 wpa_s->connect_without_scan = NULL;
2908         }
2909
2910         wpa_s->disconnected = 0;
2911         wpa_s->reassociate = 1;
2912
2913         if (wpa_s->connect_without_scan ||
2914             wpa_supplicant_fast_associate(wpa_s) != 1) {
2915                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2916                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2917         }
2918
2919         if (ssid)
2920                 wpas_notify_network_selected(wpa_s, ssid);
2921 }
2922
2923
2924 /**
2925  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2926  * @wpa_s: wpa_supplicant structure for a network interface
2927  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2928  * @pkcs11_module_path: PKCS #11 module path or NULL
2929  * Returns: 0 on success; -1 on failure
2930  *
2931  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2932  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2933  * module path fails the paths will be reset to the default value (NULL).
2934  */
2935 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2936                                            const char *pkcs11_engine_path,
2937                                            const char *pkcs11_module_path)
2938 {
2939         char *pkcs11_engine_path_copy = NULL;
2940         char *pkcs11_module_path_copy = NULL;
2941
2942         if (pkcs11_engine_path != NULL) {
2943                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2944                 if (pkcs11_engine_path_copy == NULL)
2945                         return -1;
2946         }
2947         if (pkcs11_module_path != NULL) {
2948                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2949                 if (pkcs11_module_path_copy == NULL) {
2950                         os_free(pkcs11_engine_path_copy);
2951                         return -1;
2952                 }
2953         }
2954
2955         os_free(wpa_s->conf->pkcs11_engine_path);
2956         os_free(wpa_s->conf->pkcs11_module_path);
2957         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2958         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2959
2960         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2961         eapol_sm_deinit(wpa_s->eapol);
2962         wpa_s->eapol = NULL;
2963         if (wpa_supplicant_init_eapol(wpa_s)) {
2964                 /* Error -> Reset paths to the default value (NULL) once. */
2965                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2966                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2967                                                                NULL);
2968
2969                 return -1;
2970         }
2971         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2972
2973         return 0;
2974 }
2975
2976
2977 /**
2978  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2979  * @wpa_s: wpa_supplicant structure for a network interface
2980  * @ap_scan: AP scan mode
2981  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2982  *
2983  */
2984 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2985 {
2986
2987         int old_ap_scan;
2988
2989         if (ap_scan < 0 || ap_scan > 2)
2990                 return -1;
2991
2992         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2993                 wpa_printf(MSG_INFO,
2994                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2995         }
2996
2997 #ifdef ANDROID
2998         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2999             wpa_s->wpa_state >= WPA_ASSOCIATING &&
3000             wpa_s->wpa_state < WPA_COMPLETED) {
3001                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
3002                            "associating", wpa_s->conf->ap_scan, ap_scan);
3003                 return 0;
3004         }
3005 #endif /* ANDROID */
3006
3007         old_ap_scan = wpa_s->conf->ap_scan;
3008         wpa_s->conf->ap_scan = ap_scan;
3009
3010         if (old_ap_scan != wpa_s->conf->ap_scan)
3011                 wpas_notify_ap_scan_changed(wpa_s);
3012
3013         return 0;
3014 }
3015
3016
3017 /**
3018  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
3019  * @wpa_s: wpa_supplicant structure for a network interface
3020  * @expire_age: Expiration age in seconds
3021  * Returns: 0 if succeed or -1 if expire_age has an invalid value
3022  *
3023  */
3024 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3025                                           unsigned int bss_expire_age)
3026 {
3027         if (bss_expire_age < 10) {
3028                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3029                         bss_expire_age);
3030                 return -1;
3031         }
3032         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3033                 bss_expire_age);
3034         wpa_s->conf->bss_expiration_age = bss_expire_age;
3035
3036         return 0;
3037 }
3038
3039
3040 /**
3041  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3042  * @wpa_s: wpa_supplicant structure for a network interface
3043  * @expire_count: number of scans after which an unseen BSS is reclaimed
3044  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3045  *
3046  */
3047 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3048                                             unsigned int bss_expire_count)
3049 {
3050         if (bss_expire_count < 1) {
3051                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3052                         bss_expire_count);
3053                 return -1;
3054         }
3055         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3056                 bss_expire_count);
3057         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3058
3059         return 0;
3060 }
3061
3062
3063 /**
3064  * wpa_supplicant_set_scan_interval - Set scan interval
3065  * @wpa_s: wpa_supplicant structure for a network interface
3066  * @scan_interval: scan interval in seconds
3067  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3068  *
3069  */
3070 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3071                                      int scan_interval)
3072 {
3073         if (scan_interval < 0) {
3074                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3075                         scan_interval);
3076                 return -1;
3077         }
3078         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3079                 scan_interval);
3080         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3081
3082         return 0;
3083 }
3084
3085
3086 /**
3087  * wpa_supplicant_set_debug_params - Set global debug params
3088  * @global: wpa_global structure
3089  * @debug_level: debug level
3090  * @debug_timestamp: determines if show timestamp in debug data
3091  * @debug_show_keys: determines if show keys in debug data
3092  * Returns: 0 if succeed or -1 if debug_level has wrong value
3093  */
3094 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3095                                     int debug_timestamp, int debug_show_keys)
3096 {
3097
3098         int old_level, old_timestamp, old_show_keys;
3099
3100         /* check for allowed debuglevels */
3101         if (debug_level != MSG_EXCESSIVE &&
3102             debug_level != MSG_MSGDUMP &&
3103             debug_level != MSG_DEBUG &&
3104             debug_level != MSG_INFO &&
3105             debug_level != MSG_WARNING &&
3106             debug_level != MSG_ERROR)
3107                 return -1;
3108
3109         old_level = wpa_debug_level;
3110         old_timestamp = wpa_debug_timestamp;
3111         old_show_keys = wpa_debug_show_keys;
3112
3113         wpa_debug_level = debug_level;
3114         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3115         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3116
3117         if (wpa_debug_level != old_level)
3118                 wpas_notify_debug_level_changed(global);
3119         if (wpa_debug_timestamp != old_timestamp)
3120                 wpas_notify_debug_timestamp_changed(global);
3121         if (wpa_debug_show_keys != old_show_keys)
3122                 wpas_notify_debug_show_keys_changed(global);
3123
3124         return 0;
3125 }
3126
3127
3128 /**
3129  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3130  * @wpa_s: Pointer to wpa_supplicant data
3131  * Returns: A pointer to the current network structure or %NULL on failure
3132  */
3133 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3134 {
3135         struct wpa_ssid *entry;
3136         u8 ssid[SSID_MAX_LEN];
3137         int res;
3138         size_t ssid_len;
3139         u8 bssid[ETH_ALEN];
3140         int wired;
3141
3142         res = wpa_drv_get_ssid(wpa_s, ssid);
3143         if (res < 0) {
3144                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3145                         "driver");
3146                 return NULL;
3147         }
3148         ssid_len = res;
3149
3150         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3151                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3152                         "driver");
3153                 return NULL;
3154         }
3155
3156         wired = wpa_s->conf->ap_scan == 0 &&
3157                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3158
3159         entry = wpa_s->conf->ssid;
3160         while (entry) {
3161                 if (!wpas_network_disabled(wpa_s, entry) &&
3162                     ((ssid_len == entry->ssid_len &&
3163                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3164                     (!entry->bssid_set ||
3165                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3166                         return entry;
3167 #ifdef CONFIG_WPS
3168                 if (!wpas_network_disabled(wpa_s, entry) &&
3169                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3170                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3171                     (!entry->bssid_set ||
3172                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3173                         return entry;
3174 #endif /* CONFIG_WPS */
3175
3176                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3177                     entry->ssid_len == 0 &&
3178                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3179                         return entry;
3180
3181                 entry = entry->next;
3182         }
3183
3184         return NULL;
3185 }
3186
3187
3188 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3189 {
3190         struct wpa_global *global = wpa_s->global;
3191
3192         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3193                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3194                 if (global->drv_priv[i] == NULL) {
3195                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3196                                    "'%s'", wpa_drivers[i]->name);
3197                         return -1;
3198                 }
3199         }
3200
3201         wpa_s->driver = wpa_drivers[i];
3202         wpa_s->global_drv_priv = global->drv_priv[i];
3203
3204         return 0;
3205 }
3206
3207
3208 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3209                                      const char *name)
3210 {
3211         int i;
3212         size_t len;
3213         const char *pos, *driver = name;
3214
3215         if (wpa_s == NULL)
3216                 return -1;
3217
3218         if (wpa_drivers[0] == NULL) {
3219                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3220                         "wpa_supplicant");
3221                 return -1;
3222         }
3223
3224         if (name == NULL) {
3225                 /* default to first driver in the list */
3226                 return select_driver(wpa_s, 0);
3227         }
3228
3229         do {
3230                 pos = os_strchr(driver, ',');
3231                 if (pos)
3232                         len = pos - driver;
3233                 else
3234                         len = os_strlen(driver);
3235
3236                 for (i = 0; wpa_drivers[i]; i++) {
3237                         if (os_strlen(wpa_drivers[i]->name) == len &&
3238                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3239                             0) {
3240                                 /* First driver that succeeds wins */
3241                                 if (select_driver(wpa_s, i) == 0)
3242                                         return 0;
3243                         }
3244                 }
3245
3246                 driver = pos + 1;
3247         } while (pos);
3248
3249         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3250         return -1;
3251 }
3252
3253
3254 /**
3255  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3256  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3257  *      with struct wpa_driver_ops::init()
3258  * @src_addr: Source address of the EAPOL frame
3259  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3260  * @len: Length of the EAPOL data
3261  *
3262  * This function is called for each received EAPOL frame. Most driver
3263  * interfaces rely on more generic OS mechanism for receiving frames through
3264  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3265  * take care of received EAPOL frames and deliver them to the core supplicant
3266  * code by calling this function.
3267  */
3268 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3269                              const u8 *buf, size_t len)
3270 {
3271         struct wpa_supplicant *wpa_s = ctx;
3272
3273         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3274         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3275
3276 #ifdef CONFIG_PEERKEY
3277         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3278             wpa_s->current_ssid->peerkey &&
3279             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3280             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3281                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3282                 return;
3283         }
3284 #endif /* CONFIG_PEERKEY */
3285
3286         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3287             (wpa_s->last_eapol_matches_bssid &&
3288 #ifdef CONFIG_AP
3289              !wpa_s->ap_iface &&
3290 #endif /* CONFIG_AP */
3291              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3292                 /*
3293                  * There is possible race condition between receiving the
3294                  * association event and the EAPOL frame since they are coming
3295                  * through different paths from the driver. In order to avoid
3296                  * issues in trying to process the EAPOL frame before receiving
3297                  * association information, lets queue it for processing until
3298                  * the association event is received. This may also be needed in
3299                  * driver-based roaming case, so also use src_addr != BSSID as a
3300                  * trigger if we have previously confirmed that the
3301                  * Authenticator uses BSSID as the src_addr (which is not the
3302                  * case with wired IEEE 802.1X).
3303                  */
3304                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3305                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3306                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3307                         MAC2STR(wpa_s->bssid));
3308                 wpabuf_free(wpa_s->pending_eapol_rx);
3309                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3310                 if (wpa_s->pending_eapol_rx) {
3311                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3312                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3313                                   ETH_ALEN);
3314                 }
3315                 return;
3316         }
3317
3318         wpa_s->last_eapol_matches_bssid =
3319                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3320
3321 #ifdef CONFIG_AP
3322         if (wpa_s->ap_iface) {
3323                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3324                 return;
3325         }
3326 #endif /* CONFIG_AP */
3327
3328         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3329                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3330                         "no key management is configured");
3331                 return;
3332         }
3333
3334         if (wpa_s->eapol_received == 0 &&
3335             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3336              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3337              wpa_s->wpa_state != WPA_COMPLETED) &&
3338             (wpa_s->current_ssid == NULL ||
3339              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3340                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3341                 int timeout = 10;
3342
3343                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3344                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3345                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3346                         /* Use longer timeout for IEEE 802.1X/EAP */
3347                         timeout = 70;
3348                 }
3349
3350 #ifdef CONFIG_WPS
3351                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3352                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3353                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3354                         /*
3355                          * Use shorter timeout if going through WPS AP iteration
3356                          * for PIN config method with an AP that does not
3357                          * advertise Selected Registrar.
3358                          */
3359                         struct wpabuf *wps_ie;
3360
3361                         wps_ie = wpa_bss_get_vendor_ie_multi(
3362                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3363                         if (wps_ie &&
3364                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3365                                 timeout = 10;
3366                         wpabuf_free(wps_ie);
3367                 }
3368 #endif /* CONFIG_WPS */
3369
3370                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3371         }
3372         wpa_s->eapol_received++;
3373
3374         if (wpa_s->countermeasures) {
3375                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3376                         "EAPOL packet");
3377                 return;
3378         }
3379
3380 #ifdef CONFIG_IBSS_RSN
3381         if (wpa_s->current_ssid &&
3382             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3383                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3384                 return;
3385         }
3386 #endif /* CONFIG_IBSS_RSN */
3387
3388         /* Source address of the incoming EAPOL frame could be compared to the
3389          * current BSSID. However, it is possible that a centralized
3390          * Authenticator could be using another MAC address than the BSSID of
3391          * an AP, so just allow any address to be used for now. The replies are
3392          * still sent to the current BSSID (if available), though. */
3393
3394         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3395         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3396             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3397                 return;
3398         wpa_drv_poll(wpa_s);
3399         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3400                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3401         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3402                 /*
3403                  * Set portValid = TRUE here since we are going to skip 4-way
3404                  * handshake processing which would normally set portValid. We
3405                  * need this to allow the EAPOL state machines to be completed
3406                  * without going through EAPOL-Key handshake.
3407                  */
3408                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3409         }
3410 }
3411
3412
3413 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3414 {
3415         if ((!wpa_s->p2p_mgmt ||
3416              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3417             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3418                 l2_packet_deinit(wpa_s->l2);
3419                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3420                                            wpa_drv_get_mac_addr(wpa_s),
3421                                            ETH_P_EAPOL,
3422                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3423                 if (wpa_s->l2 == NULL)
3424                         return -1;
3425         } else {
3426                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3427                 if (addr)
3428                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3429         }
3430
3431         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3432                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3433                 return -1;
3434         }
3435
3436         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3437
3438         return 0;
3439 }
3440
3441
3442 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3443                                            const u8 *buf, size_t len)
3444 {
3445         struct wpa_supplicant *wpa_s = ctx;
3446         const struct l2_ethhdr *eth;
3447
3448         if (len < sizeof(*eth))
3449                 return;
3450         eth = (const struct l2_ethhdr *) buf;
3451
3452         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3453             !(eth->h_dest[0] & 0x01)) {
3454                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3455                         " (bridge - not for this interface - ignore)",
3456                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3457                 return;
3458         }
3459
3460         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3461                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3462         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3463                                 len - sizeof(*eth));
3464 }
3465
3466
3467 /**
3468  * wpa_supplicant_driver_init - Initialize driver interface parameters
3469  * @wpa_s: Pointer to wpa_supplicant data
3470  * Returns: 0 on success, -1 on failure
3471  *
3472  * This function is called to initialize driver interface parameters.
3473  * wpa_drv_init() must have been called before this function to initialize the
3474  * driver interface.
3475  */
3476 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3477 {
3478         static int interface_count = 0;
3479
3480         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3481                 return -1;
3482
3483         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3484                 MAC2STR(wpa_s->own_addr));
3485         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3486         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3487
3488         if (wpa_s->bridge_ifname[0]) {
3489                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3490                         "interface '%s'", wpa_s->bridge_ifname);
3491                 wpa_s->l2_br = l2_packet_init_bridge(
3492                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3493                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3494                 if (wpa_s->l2_br == NULL) {
3495                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3496                                 "connection for the bridge interface '%s'",
3497                                 wpa_s->bridge_ifname);
3498                         return -1;
3499                 }
3500         }
3501
3502         if (wpa_s->conf->ap_scan == 2 &&
3503             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3504                 wpa_printf(MSG_INFO,
3505                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3506         }
3507
3508         wpa_clear_keys(wpa_s, NULL);
3509
3510         /* Make sure that TKIP countermeasures are not left enabled (could
3511          * happen if wpa_supplicant is killed during countermeasures. */
3512         wpa_drv_set_countermeasures(wpa_s, 0);
3513
3514         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3515         wpa_drv_flush_pmkid(wpa_s);
3516
3517         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3518         wpa_s->prev_scan_wildcard = 0;
3519
3520         if (wpa_supplicant_enabled_networks(wpa_s)) {
3521                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3522                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3523                         interface_count = 0;
3524                 }
3525 #ifndef ANDROID
3526                 if (!wpa_s->p2p_mgmt &&
3527                     wpa_supplicant_delayed_sched_scan(wpa_s,
3528                                                       interface_count % 3,
3529                                                       100000))
3530                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3531                                                 100000);
3532 #endif /* ANDROID */
3533                 interface_count++;
3534         } else
3535                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3536
3537         return 0;
3538 }
3539
3540
3541 static int wpa_supplicant_daemon(const char *pid_file)
3542 {
3543         wpa_printf(MSG_DEBUG, "Daemonize..");
3544         return os_daemonize(pid_file);
3545 }
3546
3547
3548 static struct wpa_supplicant *
3549 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3550 {
3551         struct wpa_supplicant *wpa_s;
3552
3553         wpa_s = os_zalloc(sizeof(*wpa_s));
3554         if (wpa_s == NULL)
3555                 return NULL;
3556         wpa_s->scan_req = INITIAL_SCAN_REQ;
3557         wpa_s->scan_interval = 5;
3558         wpa_s->new_connection = 1;
3559         wpa_s->parent = parent ? parent : wpa_s;
3560         wpa_s->p2pdev = wpa_s->parent;
3561         wpa_s->sched_scanning = 0;
3562
3563         dl_list_init(&wpa_s->bss_tmp_disallowed);
3564
3565         return wpa_s;
3566 }
3567
3568
3569 #ifdef CONFIG_HT_OVERRIDES
3570
3571 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3572                              struct ieee80211_ht_capabilities *htcaps,
3573                              struct ieee80211_ht_capabilities *htcaps_mask,
3574                              const char *ht_mcs)
3575 {
3576         /* parse ht_mcs into hex array */
3577         int i;
3578         const char *tmp = ht_mcs;
3579         char *end = NULL;
3580
3581         /* If ht_mcs is null, do not set anything */
3582         if (!ht_mcs)
3583                 return 0;
3584
3585         /* This is what we are setting in the kernel */
3586         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3587
3588         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3589
3590         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3591                 errno = 0;
3592                 long v = strtol(tmp, &end, 16);
3593                 if (errno == 0) {
3594                         wpa_msg(wpa_s, MSG_DEBUG,
3595                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3596                                 i, v, end, tmp);
3597                         if (end == tmp)
3598                                 break;
3599
3600                         htcaps->supported_mcs_set[i] = v;
3601                         tmp = end;
3602                 } else {
3603                         wpa_msg(wpa_s, MSG_ERROR,
3604                                 "Failed to parse ht-mcs: %s, error: %s\n",
3605                                 ht_mcs, strerror(errno));
3606                         return -1;
3607                 }
3608         }
3609
3610         /*
3611          * If we were able to parse any values, then set mask for the MCS set.
3612          */
3613         if (i) {
3614                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3615                           IEEE80211_HT_MCS_MASK_LEN - 1);
3616                 /* skip the 3 reserved bits */
3617                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3618                         0x1f;
3619         }
3620
3621         return 0;
3622 }
3623
3624
3625 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3626                                  struct ieee80211_ht_capabilities *htcaps,
3627                                  struct ieee80211_ht_capabilities *htcaps_mask,
3628                                  int disabled)
3629 {
3630         le16 msk;
3631
3632         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3633
3634         if (disabled == -1)
3635                 return 0;
3636
3637         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3638         htcaps_mask->ht_capabilities_info |= msk;
3639         if (disabled)
3640                 htcaps->ht_capabilities_info &= msk;
3641         else
3642                 htcaps->ht_capabilities_info |= msk;
3643
3644         return 0;
3645 }
3646
3647
3648 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3649                                 struct ieee80211_ht_capabilities *htcaps,
3650                                 struct ieee80211_ht_capabilities *htcaps_mask,
3651                                 int factor)
3652 {
3653         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3654
3655         if (factor == -1)
3656                 return 0;
3657
3658         if (factor < 0 || factor > 3) {
3659                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3660                         "Must be 0-3 or -1", factor);
3661                 return -EINVAL;
3662         }
3663
3664         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3665         htcaps->a_mpdu_params &= ~0x3;
3666         htcaps->a_mpdu_params |= factor & 0x3;
3667
3668         return 0;
3669 }
3670
3671
3672 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3673                                  struct ieee80211_ht_capabilities *htcaps,
3674                                  struct ieee80211_ht_capabilities *htcaps_mask,
3675                                  int density)
3676 {
3677         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3678
3679         if (density == -1)
3680                 return 0;
3681
3682         if (density < 0 || density > 7) {
3683                 wpa_msg(wpa_s, MSG_ERROR,
3684                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3685                         density);
3686                 return -EINVAL;
3687         }
3688
3689         htcaps_mask->a_mpdu_params |= 0x1C;
3690         htcaps->a_mpdu_params &= ~(0x1C);
3691         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3692
3693         return 0;
3694 }
3695
3696
3697 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3698                                 struct ieee80211_ht_capabilities *htcaps,
3699                                 struct ieee80211_ht_capabilities *htcaps_mask,
3700                                 int disabled)
3701 {
3702         /* Masking these out disables HT40 */
3703         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3704                                 HT_CAP_INFO_SHORT_GI40MHZ);
3705
3706         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3707
3708         if (disabled)
3709                 htcaps->ht_capabilities_info &= ~msk;
3710         else
3711                 htcaps->ht_capabilities_info |= msk;
3712
3713         htcaps_mask->ht_capabilities_info |= msk;
3714
3715         return 0;
3716 }
3717
3718
3719 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3720                                struct ieee80211_ht_capabilities *htcaps,
3721                                struct ieee80211_ht_capabilities *htcaps_mask,
3722                                int disabled)
3723 {
3724         /* Masking these out disables SGI */
3725         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3726                                 HT_CAP_INFO_SHORT_GI40MHZ);
3727
3728         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3729
3730         if (disabled)
3731                 htcaps->ht_capabilities_info &= ~msk;
3732         else
3733                 htcaps->ht_capabilities_info |= msk;
3734
3735         htcaps_mask->ht_capabilities_info |= msk;
3736
3737         return 0;
3738 }
3739
3740
3741 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3742                                struct ieee80211_ht_capabilities *htcaps,
3743                                struct ieee80211_ht_capabilities *htcaps_mask,
3744                                int disabled)
3745 {
3746         /* Masking these out disables LDPC */
3747         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3748
3749         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3750
3751         if (disabled)
3752                 htcaps->ht_capabilities_info &= ~msk;
3753         else
3754                 htcaps->ht_capabilities_info |= msk;
3755
3756         htcaps_mask->ht_capabilities_info |= msk;
3757
3758         return 0;
3759 }
3760
3761
3762 void wpa_supplicant_apply_ht_overrides(
3763         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3764         struct wpa_driver_associate_params *params)
3765 {
3766         struct ieee80211_ht_capabilities *htcaps;
3767         struct ieee80211_ht_capabilities *htcaps_mask;
3768
3769         if (!ssid)
3770                 return;
3771
3772         params->disable_ht = ssid->disable_ht;
3773         if (!params->htcaps || !params->htcaps_mask)
3774                 return;
3775
3776         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3777         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3778         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3779         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3780                               ssid->disable_max_amsdu);
3781         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3782         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3783         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3784         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3785         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3786
3787         if (ssid->ht40_intolerant) {
3788                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3789                 htcaps->ht_capabilities_info |= bit;
3790                 htcaps_mask->ht_capabilities_info |= bit;
3791         }
3792 }
3793
3794 #endif /* CONFIG_HT_OVERRIDES */
3795
3796
3797 #ifdef CONFIG_VHT_OVERRIDES
3798 void wpa_supplicant_apply_vht_overrides(
3799         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3800         struct wpa_driver_associate_params *params)
3801 {
3802         struct ieee80211_vht_capabilities *vhtcaps;
3803         struct ieee80211_vht_capabilities *vhtcaps_mask;
3804
3805         if (!ssid)
3806                 return;
3807
3808         params->disable_vht = ssid->disable_vht;
3809
3810         vhtcaps = (void *) params->vhtcaps;
3811         vhtcaps_mask = (void *) params->vhtcaps_mask;
3812
3813         if (!vhtcaps || !vhtcaps_mask)
3814                 return;
3815
3816         vhtcaps->vht_capabilities_info = host_to_le32(ssid->vht_capa);
3817         vhtcaps_mask->vht_capabilities_info = host_to_le32(ssid->vht_capa_mask);
3818
3819 #ifdef CONFIG_HT_OVERRIDES
3820         /* if max ampdu is <= 3, we have to make the HT cap the same */
3821         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3822                 int max_ampdu;
3823
3824                 max_ampdu = (ssid->vht_capa &
3825                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3826                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3827
3828                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3829                 wpa_set_ampdu_factor(wpa_s,
3830                                      (void *) params->htcaps,
3831                                      (void *) params->htcaps_mask,
3832                                      max_ampdu);
3833         }
3834 #endif /* CONFIG_HT_OVERRIDES */
3835
3836 #define OVERRIDE_MCS(i)                                                 \
3837         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3838                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3839                         host_to_le16(3 << 2 * (i - 1));                 \
3840                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3841                         host_to_le16(ssid->vht_tx_mcs_nss_ ##i <<       \
3842                                      2 * (i - 1));                      \
3843         }                                                               \
3844         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3845                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3846                         host_to_le16(3 << 2 * (i - 1));                 \
3847                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3848                         host_to_le16(ssid->vht_rx_mcs_nss_ ##i <<       \
3849                                      2 * (i - 1));                      \
3850         }
3851
3852         OVERRIDE_MCS(1);
3853         OVERRIDE_MCS(2);
3854         OVERRIDE_MCS(3);
3855         OVERRIDE_MCS(4);
3856         OVERRIDE_MCS(5);
3857         OVERRIDE_MCS(6);
3858         OVERRIDE_MCS(7);
3859         OVERRIDE_MCS(8);
3860 }
3861 #endif /* CONFIG_VHT_OVERRIDES */
3862
3863
3864 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3865 {
3866 #ifdef PCSC_FUNCS
3867         size_t len;
3868
3869         if (!wpa_s->conf->pcsc_reader)
3870                 return 0;
3871
3872         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3873         if (!wpa_s->scard)
3874                 return 1;
3875
3876         if (wpa_s->conf->pcsc_pin &&
3877             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3878                 scard_deinit(wpa_s->scard);
3879                 wpa_s->scard = NULL;
3880                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3881                 return -1;
3882         }
3883
3884         len = sizeof(wpa_s->imsi) - 1;
3885         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3886                 scard_deinit(wpa_s->scard);
3887                 wpa_s->scard = NULL;
3888                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3889                 return -1;
3890         }
3891         wpa_s->imsi[len] = '\0';
3892
3893         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3894
3895         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3896                    wpa_s->imsi, wpa_s->mnc_len);
3897
3898         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3899         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3900 #endif /* PCSC_FUNCS */
3901
3902         return 0;
3903 }
3904
3905
3906 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3907 {
3908         char *val, *pos;
3909
3910         ext_password_deinit(wpa_s->ext_pw);
3911         wpa_s->ext_pw = NULL;
3912         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3913
3914         if (!wpa_s->conf->ext_password_backend)
3915                 return 0;
3916
3917         val = os_strdup(wpa_s->conf->ext_password_backend);
3918         if (val == NULL)
3919                 return -1;
3920         pos = os_strchr(val, ':');
3921         if (pos)
3922                 *pos++ = '\0';
3923
3924         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3925
3926         wpa_s->ext_pw = ext_password_init(val, pos);
3927         os_free(val);
3928         if (wpa_s->ext_pw == NULL) {
3929                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3930                 return -1;
3931         }
3932         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3933
3934         return 0;
3935 }
3936
3937
3938 #ifdef CONFIG_FST
3939
3940 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3941 {
3942         struct wpa_supplicant *wpa_s = ctx;
3943
3944         return (is_zero_ether_addr(wpa_s->bssid) ||
3945                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3946 }
3947
3948
3949 static void wpas_fst_get_channel_info_cb(void *ctx,
3950                                          enum hostapd_hw_mode *hw_mode,
3951                                          u8 *channel)
3952 {
3953         struct wpa_supplicant *wpa_s = ctx;
3954
3955         if (wpa_s->current_bss) {
3956                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3957                                                   channel);
3958         } else if (wpa_s->hw.num_modes) {
3959                 *hw_mode = wpa_s->hw.modes[0].mode;
3960         } else {
3961                 WPA_ASSERT(0);
3962                 *hw_mode = 0;
3963         }
3964 }
3965
3966
3967 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3968 {
3969         struct wpa_supplicant *wpa_s = ctx;
3970
3971         *modes = wpa_s->hw.modes;
3972         return wpa_s->hw.num_modes;
3973 }
3974
3975
3976 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3977 {
3978         struct wpa_supplicant *wpa_s = ctx;
3979
3980         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3981         wpa_s->fst_ies = fst_ies;
3982 }
3983
3984
3985 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3986 {
3987         struct wpa_supplicant *wpa_s = ctx;
3988
3989         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3990         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3991                                           wpa_s->own_addr, wpa_s->bssid,
3992                                           wpabuf_head(data), wpabuf_len(data),
3993                                    0);
3994 }
3995
3996
3997 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3998 {
3999         struct wpa_supplicant *wpa_s = ctx;
4000
4001         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4002         return wpa_s->received_mb_ies;
4003 }
4004
4005
4006 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
4007                                      const u8 *buf, size_t size)
4008 {
4009         struct wpa_supplicant *wpa_s = ctx;
4010         struct mb_ies_info info;
4011
4012         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4013
4014         if (!mb_ies_info_by_ies(&info, buf, size)) {
4015                 wpabuf_free(wpa_s->received_mb_ies);
4016                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
4017         }
4018 }
4019
4020
4021 static const u8 * wpas_fst_get_peer_first(void *ctx,
4022                                           struct fst_get_peer_ctx **get_ctx,
4023                                           Boolean mb_only)
4024 {
4025         struct wpa_supplicant *wpa_s = ctx;
4026
4027         *get_ctx = NULL;
4028         if (!is_zero_ether_addr(wpa_s->bssid))
4029                 return (wpa_s->received_mb_ies || !mb_only) ?
4030                         wpa_s->bssid : NULL;
4031         return NULL;
4032 }
4033
4034
4035 static const u8 * wpas_fst_get_peer_next(void *ctx,
4036                                          struct fst_get_peer_ctx **get_ctx,
4037                                          Boolean mb_only)
4038 {
4039         return NULL;
4040 }
4041
4042 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4043                                        struct fst_wpa_obj *iface_obj)
4044 {
4045         iface_obj->ctx              = wpa_s;
4046         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4047         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4048         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4049         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4050         iface_obj->send_action      = wpas_fst_send_action_cb;
4051         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4052         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4053         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4054         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4055 }
4056 #endif /* CONFIG_FST */
4057
4058 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4059                                     const struct wpa_driver_capa *capa)
4060 {
4061         struct wowlan_triggers *triggers;
4062         int ret = 0;
4063
4064         if (!wpa_s->conf->wowlan_triggers)
4065                 return 0;
4066
4067         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4068         if (triggers) {
4069                 ret = wpa_drv_wowlan(wpa_s, triggers);
4070                 os_free(triggers);
4071         }
4072         return ret;
4073 }
4074
4075
4076 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4077 {
4078         if (freq < 3000)
4079                 return BAND_2_4_GHZ;
4080         if (freq > 50000)
4081                 return BAND_60_GHZ;
4082         return BAND_5_GHZ;
4083 }
4084
4085
4086 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4087 {
4088         int i;
4089         unsigned int band = 0;
4090
4091         if (freqs) {
4092                 /* freqs are specified for the radio work */
4093                 for (i = 0; freqs[i]; i++)
4094                         band |= wpas_freq_to_band(freqs[i]);
4095         } else {
4096                 /*
4097                  * freqs are not specified, implies all
4098                  * the supported freqs by HW
4099                  */
4100                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4101                         if (wpa_s->hw.modes[i].num_channels != 0) {
4102                                 if (wpa_s->hw.modes[i].mode ==
4103                                     HOSTAPD_MODE_IEEE80211B ||
4104                                     wpa_s->hw.modes[i].mode ==
4105                                     HOSTAPD_MODE_IEEE80211G)
4106                                         band |= BAND_2_4_GHZ;
4107                                 else if (wpa_s->hw.modes[i].mode ==
4108                                          HOSTAPD_MODE_IEEE80211A)
4109                                         band |= BAND_5_GHZ;
4110                                 else if (wpa_s->hw.modes[i].mode ==
4111                                          HOSTAPD_MODE_IEEE80211AD)
4112                                         band |= BAND_60_GHZ;
4113                                 else if (wpa_s->hw.modes[i].mode ==
4114                                          HOSTAPD_MODE_IEEE80211ANY)
4115                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4116                                                 BAND_60_GHZ;
4117                         }
4118                 }
4119         }
4120
4121         return band;
4122 }
4123
4124
4125 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4126                                               const char *rn)
4127 {
4128         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4129         struct wpa_radio *radio;
4130
4131         while (rn && iface) {
4132                 radio = iface->radio;
4133                 if (radio && os_strcmp(rn, radio->name) == 0) {
4134                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4135                                    wpa_s->ifname, rn);
4136                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4137                         return radio;
4138                 }
4139
4140                 iface = iface->next;
4141         }
4142
4143         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4144                    wpa_s->ifname, rn ? rn : "N/A");
4145         radio = os_zalloc(sizeof(*radio));
4146         if (radio == NULL)
4147                 return NULL;
4148
4149         if (rn)
4150                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4151         dl_list_init(&radio->ifaces);
4152         dl_list_init(&radio->work);
4153         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4154
4155         return radio;
4156 }
4157
4158
4159 static void radio_work_free(struct wpa_radio_work *work)
4160 {
4161         if (work->wpa_s->scan_work == work) {
4162                 /* This should not really happen. */
4163                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4164                         work->type, work, work->started);
4165                 work->wpa_s->scan_work = NULL;
4166         }
4167
4168 #ifdef CONFIG_P2P
4169         if (work->wpa_s->p2p_scan_work == work) {
4170                 /* This should not really happen. */
4171                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4172                         work->type, work, work->started);
4173                 work->wpa_s->p2p_scan_work = NULL;
4174         }
4175 #endif /* CONFIG_P2P */
4176
4177         if (work->started) {
4178                 work->wpa_s->radio->num_active_works--;
4179                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4180                         "radio_work_free('%s'@%p: num_active_works --> %u",
4181                         work->type, work,
4182                         work->wpa_s->radio->num_active_works);
4183         }
4184
4185         dl_list_del(&work->list);
4186         os_free(work);
4187 }
4188
4189
4190 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4191 {
4192         struct wpa_radio_work *active_work = NULL;
4193         struct wpa_radio_work *tmp;
4194
4195         /* Get the active work to know the type and band. */
4196         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4197                 if (tmp->started) {
4198                         active_work = tmp;
4199                         break;
4200                 }
4201         }
4202
4203         if (!active_work) {
4204                 /* No active work, start one */
4205                 radio->num_active_works = 0;
4206                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4207                                  list) {
4208                         if (os_strcmp(tmp->type, "scan") == 0 &&
4209                             radio->external_scan_running &&
4210                             (((struct wpa_driver_scan_params *)
4211                               tmp->ctx)->only_new_results ||
4212                              tmp->wpa_s->clear_driver_scan_cache))
4213                                 continue;
4214                         return tmp;
4215                 }
4216                 return NULL;
4217         }
4218
4219         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4220             os_strcmp(active_work->type, "connect") == 0) {
4221                 /*
4222                  * If the active work is either connect or sme-connect,
4223                  * do not parallelize them with other radio works.
4224                  */
4225                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4226                         "Do not parallelize radio work with %s",
4227                         active_work->type);
4228                 return NULL;
4229         }
4230
4231         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4232                 if (tmp->started)
4233                         continue;
4234
4235                 /*
4236                  * If connect or sme-connect are enqueued, parallelize only
4237                  * those operations ahead of them in the queue.
4238                  */
4239                 if (os_strcmp(tmp->type, "connect") == 0 ||
4240                     os_strcmp(tmp->type, "sme-connect") == 0)
4241                         break;
4242
4243                 /*
4244                  * Check that the radio works are distinct and
4245                  * on different bands.
4246                  */
4247                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4248                     (active_work->bands != tmp->bands)) {
4249                         /*
4250                          * If a scan has to be scheduled through nl80211 scan
4251                          * interface and if an external scan is already running,
4252                          * do not schedule the scan since it is likely to get
4253                          * rejected by kernel.
4254                          */
4255                         if (os_strcmp(tmp->type, "scan") == 0 &&
4256                             radio->external_scan_running &&
4257                             (((struct wpa_driver_scan_params *)
4258                               tmp->ctx)->only_new_results ||
4259                              tmp->wpa_s->clear_driver_scan_cache))
4260                                 continue;
4261
4262                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4263                                 "active_work:%s new_work:%s",
4264                                 active_work->type, tmp->type);
4265                         return tmp;
4266                 }
4267         }
4268
4269         /* Did not find a radio work to schedule in parallel. */
4270         return NULL;
4271 }
4272
4273
4274 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4275 {
4276         struct wpa_radio *radio = eloop_ctx;
4277         struct wpa_radio_work *work;
4278         struct os_reltime now, diff;
4279         struct wpa_supplicant *wpa_s;
4280
4281         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4282         if (work == NULL) {
4283                 radio->num_active_works = 0;
4284                 return;
4285         }
4286
4287         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4288                               radio_list);
4289
4290         if (!(wpa_s &&
4291               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4292                 if (work->started)
4293                         return; /* already started and still in progress */
4294
4295                 if (wpa_s && wpa_s->radio->external_scan_running) {
4296                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4297                         return;
4298                 }
4299         } else {
4300                 work = NULL;
4301                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4302                         /* get the work to schedule next */
4303                         work = radio_work_get_next_work(radio);
4304                 }
4305                 if (!work)
4306                         return;
4307         }
4308
4309         wpa_s = work->wpa_s;
4310         os_get_reltime(&now);
4311         os_reltime_sub(&now, &work->time, &diff);
4312         wpa_dbg(wpa_s, MSG_DEBUG,
4313                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4314                 work->type, work, diff.sec, diff.usec);
4315         work->started = 1;
4316         work->time = now;
4317         radio->num_active_works++;
4318
4319         work->cb(work, 0);
4320
4321         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4322             radio->num_active_works < MAX_ACTIVE_WORKS)
4323                 radio_work_check_next(wpa_s);
4324 }
4325
4326
4327 /*
4328  * This function removes both started and pending radio works running on
4329  * the provided interface's radio.
4330  * Prior to the removal of the radio work, its callback (cb) is called with
4331  * deinit set to be 1. Each work's callback is responsible for clearing its
4332  * internal data and restoring to a correct state.
4333  * @wpa_s: wpa_supplicant data
4334  * @type: type of works to be removed
4335  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4336  * this interface's works.
4337  */
4338 void radio_remove_works(struct wpa_supplicant *wpa_s,
4339                         const char *type, int remove_all)
4340 {
4341         struct wpa_radio_work *work, *tmp;
4342         struct wpa_radio *radio = wpa_s->radio;
4343
4344         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4345                               list) {
4346                 if (type && os_strcmp(type, work->type) != 0)
4347                         continue;
4348
4349                 /* skip other ifaces' works */
4350                 if (!remove_all && work->wpa_s != wpa_s)
4351                         continue;
4352
4353                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4354                         work->type, work, work->started ? " (started)" : "");
4355                 work->cb(work, 1);
4356                 radio_work_free(work);
4357         }
4358
4359         /* in case we removed the started work */
4360         radio_work_check_next(wpa_s);
4361 }
4362
4363
4364 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4365 {
4366         struct wpa_radio *radio = wpa_s->radio;
4367
4368         if (!radio)
4369                 return;
4370
4371         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4372                    wpa_s->ifname, radio->name);
4373         dl_list_del(&wpa_s->radio_list);
4374         radio_remove_works(wpa_s, NULL, 0);
4375         wpa_s->radio = NULL;
4376         if (!dl_list_empty(&radio->ifaces))
4377                 return; /* Interfaces remain for this radio */
4378
4379         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4380         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4381         os_free(radio);
4382 }
4383
4384
4385 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4386 {
4387         struct wpa_radio *radio = wpa_s->radio;
4388
4389         if (dl_list_empty(&radio->work))
4390                 return;
4391         if (wpa_s->ext_work_in_progress) {
4392                 wpa_printf(MSG_DEBUG,
4393                            "External radio work in progress - delay start of pending item");
4394                 return;
4395         }
4396         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4397         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4398 }
4399
4400
4401 /**
4402  * radio_add_work - Add a radio work item
4403  * @wpa_s: Pointer to wpa_supplicant data
4404  * @freq: Frequency of the offchannel operation in MHz or 0
4405  * @type: Unique identifier for each type of work
4406  * @next: Force as the next work to be executed
4407  * @cb: Callback function for indicating when radio is available
4408  * @ctx: Context pointer for the work (work->ctx in cb())
4409  * Returns: 0 on success, -1 on failure
4410  *
4411  * This function is used to request time for an operation that requires
4412  * exclusive radio control. Once the radio is available, the registered callback
4413  * function will be called. radio_work_done() must be called once the exclusive
4414  * radio operation has been completed, so that the radio is freed for other
4415  * operations. The special case of deinit=1 is used to free the context data
4416  * during interface removal. That does not allow the callback function to start
4417  * the radio operation, i.e., it must free any resources allocated for the radio
4418  * work and return.
4419  *
4420  * The @freq parameter can be used to indicate a single channel on which the
4421  * offchannel operation will occur. This may allow multiple radio work
4422  * operations to be performed in parallel if they apply for the same channel.
4423  * Setting this to 0 indicates that the work item may use multiple channels or
4424  * requires exclusive control of the radio.
4425  */
4426 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4427                    const char *type, int next,
4428                    void (*cb)(struct wpa_radio_work *work, int deinit),
4429                    void *ctx)
4430 {
4431         struct wpa_radio *radio = wpa_s->radio;
4432         struct wpa_radio_work *work;
4433         int was_empty;
4434
4435         work = os_zalloc(sizeof(*work));
4436         if (work == NULL)
4437                 return -1;
4438         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4439         os_get_reltime(&work->time);
4440         work->freq = freq;
4441         work->type = type;
4442         work->wpa_s = wpa_s;
4443         work->cb = cb;
4444         work->ctx = ctx;
4445
4446         if (freq)
4447                 work->bands = wpas_freq_to_band(freq);
4448         else if (os_strcmp(type, "scan") == 0 ||
4449                  os_strcmp(type, "p2p-scan") == 0)
4450                 work->bands = wpas_get_bands(wpa_s,
4451                                              ((struct wpa_driver_scan_params *)
4452                                               ctx)->freqs);
4453         else
4454                 work->bands = wpas_get_bands(wpa_s, NULL);
4455
4456         was_empty = dl_list_empty(&wpa_s->radio->work);
4457         if (next)
4458                 dl_list_add(&wpa_s->radio->work, &work->list);
4459         else
4460                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4461         if (was_empty) {
4462                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4463                 radio_work_check_next(wpa_s);
4464         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4465                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4466                 wpa_dbg(wpa_s, MSG_DEBUG,
4467                         "Try to schedule a radio work (num_active_works=%u)",
4468                         radio->num_active_works);
4469                 radio_work_check_next(wpa_s);
4470         }
4471
4472         return 0;
4473 }
4474
4475
4476 /**
4477  * radio_work_done - Indicate that a radio work item has been completed
4478  * @work: Completed work
4479  *
4480  * This function is called once the callback function registered with
4481  * radio_add_work() has completed its work.
4482  */
4483 void radio_work_done(struct wpa_radio_work *work)
4484 {
4485         struct wpa_supplicant *wpa_s = work->wpa_s;
4486         struct os_reltime now, diff;
4487         unsigned int started = work->started;
4488
4489         os_get_reltime(&now);
4490         os_reltime_sub(&now, &work->time, &diff);
4491         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4492                 work->type, work, started ? "done" : "canceled",
4493                 diff.sec, diff.usec);
4494         radio_work_free(work);
4495         if (started)
4496                 radio_work_check_next(wpa_s);
4497 }
4498
4499
4500 struct wpa_radio_work *
4501 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4502 {
4503         struct wpa_radio_work *work;
4504         struct wpa_radio *radio = wpa_s->radio;
4505
4506         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4507                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4508                         return work;
4509         }
4510
4511         return NULL;
4512 }
4513
4514
4515 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4516                             struct wpa_interface *iface)
4517 {
4518         const char *ifname, *driver, *rn;
4519
4520         driver = iface->driver;
4521 next_driver:
4522         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4523                 return -1;
4524
4525         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4526         if (wpa_s->drv_priv == NULL) {
4527                 const char *pos;
4528                 pos = driver ? os_strchr(driver, ',') : NULL;
4529                 if (pos) {
4530                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4531                                 "driver interface - try next driver wrapper");
4532                         driver = pos + 1;
4533                         goto next_driver;
4534                 }
4535                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4536                         "interface");
4537                 return -1;
4538         }
4539         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4540                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4541                         "driver_param '%s'", wpa_s->conf->driver_param);
4542                 return -1;
4543         }
4544
4545         ifname = wpa_drv_get_ifname(wpa_s);
4546         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4547                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4548                         "interface name with '%s'", ifname);
4549                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4550         }
4551
4552         rn = wpa_driver_get_radio_name(wpa_s);
4553         if (rn && rn[0] == '\0')
4554                 rn = NULL;
4555
4556         wpa_s->radio = radio_add_interface(wpa_s, rn);
4557         if (wpa_s->radio == NULL)
4558                 return -1;
4559
4560         return 0;
4561 }
4562
4563
4564 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4565                                      struct wpa_interface *iface)
4566 {
4567         struct wpa_driver_capa capa;
4568         int capa_res;
4569
4570         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4571                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4572                    iface->confname ? iface->confname : "N/A",
4573                    iface->driver ? iface->driver : "default",
4574                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4575                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4576
4577         if (iface->confname) {
4578 #ifdef CONFIG_BACKEND_FILE
4579                 wpa_s->confname = os_rel2abs_path(iface->confname);
4580                 if (wpa_s->confname == NULL) {
4581                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4582                                    "for configuration file '%s'.",
4583                                    iface->confname);
4584                         return -1;
4585                 }
4586                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4587                            iface->confname, wpa_s->confname);
4588 #else /* CONFIG_BACKEND_FILE */
4589                 wpa_s->confname = os_strdup(iface->confname);
4590 #endif /* CONFIG_BACKEND_FILE */
4591                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4592                 if (wpa_s->conf == NULL) {
4593                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4594                                    "configuration '%s'.", wpa_s->confname);
4595                         return -1;
4596                 }
4597                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4598                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4599
4600                 /*
4601                  * Override ctrl_interface and driver_param if set on command
4602                  * line.
4603                  */
4604                 if (iface->ctrl_interface) {
4605                         os_free(wpa_s->conf->ctrl_interface);
4606                         wpa_s->conf->ctrl_interface =
4607                                 os_strdup(iface->ctrl_interface);
4608                 }
4609
4610                 if (iface->driver_param) {
4611                         os_free(wpa_s->conf->driver_param);
4612                         wpa_s->conf->driver_param =
4613                                 os_strdup(iface->driver_param);
4614                 }
4615
4616                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4617                         os_free(wpa_s->conf->ctrl_interface);
4618                         wpa_s->conf->ctrl_interface = NULL;
4619                 }
4620         } else
4621                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4622                                                      iface->driver_param);
4623
4624         if (wpa_s->conf == NULL) {
4625                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4626                 return -1;
4627         }
4628
4629         if (iface->ifname == NULL) {
4630                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4631                 return -1;
4632         }
4633         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4634                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4635                            iface->ifname);
4636                 return -1;
4637         }
4638         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4639
4640         if (iface->bridge_ifname) {
4641                 if (os_strlen(iface->bridge_ifname) >=
4642                     sizeof(wpa_s->bridge_ifname)) {
4643                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4644                                    "name '%s'.", iface->bridge_ifname);
4645                         return -1;
4646                 }
4647                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4648                            sizeof(wpa_s->bridge_ifname));
4649         }
4650
4651         /* RSNA Supplicant Key Management - INITIALIZE */
4652         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4653         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4654
4655         /* Initialize driver interface and register driver event handler before
4656          * L2 receive handler so that association events are processed before
4657          * EAPOL-Key packets if both become available for the same select()
4658          * call. */
4659         if (wpas_init_driver(wpa_s, iface) < 0)
4660                 return -1;
4661
4662         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4663                 return -1;
4664
4665         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4666                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4667                           NULL);
4668         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4669
4670         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4671             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4672                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4673                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4674                         "dot11RSNAConfigPMKLifetime");
4675                 return -1;
4676         }
4677
4678         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4679             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4680                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4681                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4682                         "dot11RSNAConfigPMKReauthThreshold");
4683                 return -1;
4684         }
4685
4686         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4687             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4688                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4689                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4690                         "dot11RSNAConfigSATimeout");
4691                 return -1;
4692         }
4693
4694         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4695                                                       &wpa_s->hw.num_modes,
4696                                                       &wpa_s->hw.flags);
4697         if (wpa_s->hw.modes) {
4698                 u16 i;
4699
4700                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4701                         if (wpa_s->hw.modes[i].vht_capab) {
4702                                 wpa_s->hw_capab = CAPAB_VHT;
4703                                 break;
4704                         }
4705
4706                         if (wpa_s->hw.modes[i].ht_capab &
4707                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4708                                 wpa_s->hw_capab = CAPAB_HT40;
4709                         else if (wpa_s->hw.modes[i].ht_capab &&
4710                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4711                                 wpa_s->hw_capab = CAPAB_HT;
4712                 }
4713         }
4714
4715         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4716         if (capa_res == 0) {
4717                 wpa_s->drv_capa_known = 1;
4718                 wpa_s->drv_flags = capa.flags;
4719                 wpa_s->drv_enc = capa.enc;
4720                 wpa_s->drv_smps_modes = capa.smps_modes;
4721                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4722                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4723                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4724                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4725                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4726                 wpa_s->max_sched_scan_plan_interval =
4727                         capa.max_sched_scan_plan_interval;
4728                 wpa_s->max_sched_scan_plan_iterations =
4729                         capa.max_sched_scan_plan_iterations;
4730                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4731                 wpa_s->max_match_sets = capa.max_match_sets;
4732                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4733                 wpa_s->max_stations = capa.max_stations;
4734                 wpa_s->extended_capa = capa.extended_capa;
4735                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4736                 wpa_s->extended_capa_len = capa.extended_capa_len;
4737                 wpa_s->num_multichan_concurrent =
4738                         capa.num_multichan_concurrent;
4739                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4740
4741                 if (capa.mac_addr_rand_scan_supported)
4742                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4743                 if (wpa_s->sched_scan_supported &&
4744                     capa.mac_addr_rand_sched_scan_supported)
4745                         wpa_s->mac_addr_rand_supported |=
4746                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4747         }
4748         if (wpa_s->max_remain_on_chan == 0)
4749                 wpa_s->max_remain_on_chan = 1000;
4750
4751         /*
4752          * Only take p2p_mgmt parameters when P2P Device is supported.
4753          * Doing it here as it determines whether l2_packet_init() will be done
4754          * during wpa_supplicant_driver_init().
4755          */
4756         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4757                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4758         else
4759                 iface->p2p_mgmt = 1;
4760
4761         if (wpa_s->num_multichan_concurrent == 0)
4762                 wpa_s->num_multichan_concurrent = 1;
4763
4764         if (wpa_supplicant_driver_init(wpa_s) < 0)
4765                 return -1;
4766
4767 #ifdef CONFIG_TDLS
4768         if ((!iface->p2p_mgmt ||
4769              !(wpa_s->drv_flags &
4770                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4771             wpa_tdls_init(wpa_s->wpa))
4772                 return -1;
4773 #endif /* CONFIG_TDLS */
4774
4775         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4776             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4777                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4778                 return -1;
4779         }
4780
4781 #ifdef CONFIG_FST
4782         if (wpa_s->conf->fst_group_id) {
4783                 struct fst_iface_cfg cfg;
4784                 struct fst_wpa_obj iface_obj;
4785
4786                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4787                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4788                            sizeof(cfg.group_id));
4789                 cfg.priority = wpa_s->conf->fst_priority;
4790                 cfg.llt = wpa_s->conf->fst_llt;
4791
4792                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4793                                         &iface_obj, &cfg);
4794                 if (!wpa_s->fst) {
4795                         wpa_msg(wpa_s, MSG_ERROR,
4796                                 "FST: Cannot attach iface %s to group %s",
4797                                 wpa_s->ifname, cfg.group_id);
4798                         return -1;
4799                 }
4800         }
4801 #endif /* CONFIG_FST */
4802
4803         if (wpas_wps_init(wpa_s))
4804                 return -1;
4805
4806         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4807                 return -1;
4808         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4809
4810         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4811         if (wpa_s->ctrl_iface == NULL) {
4812                 wpa_printf(MSG_ERROR,
4813                            "Failed to initialize control interface '%s'.\n"
4814                            "You may have another wpa_supplicant process "
4815                            "already running or the file was\n"
4816                            "left by an unclean termination of wpa_supplicant "
4817                            "in which case you will need\n"
4818                            "to manually remove this file before starting "
4819                            "wpa_supplicant again.\n",
4820                            wpa_s->conf->ctrl_interface);
4821                 return -1;
4822         }
4823
4824         wpa_s->gas = gas_query_init(wpa_s);
4825         if (wpa_s->gas == NULL) {
4826                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4827                 return -1;
4828         }
4829
4830         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4831                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4832                 return -1;
4833         }
4834
4835         if (wpa_bss_init(wpa_s) < 0)
4836                 return -1;
4837
4838         /*
4839          * Set Wake-on-WLAN triggers, if configured.
4840          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4841          * have effect anyway when the interface is down).
4842          */
4843         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4844                 return -1;
4845
4846 #ifdef CONFIG_EAP_PROXY
4847 {
4848         size_t len;
4849         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4850                                                      &len);
4851         if (wpa_s->mnc_len > 0) {
4852                 wpa_s->imsi[len] = '\0';
4853                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4854                            wpa_s->imsi, wpa_s->mnc_len);
4855         } else {
4856                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4857         }
4858 }
4859 #endif /* CONFIG_EAP_PROXY */
4860
4861         if (pcsc_reader_init(wpa_s) < 0)
4862                 return -1;
4863
4864         if (wpas_init_ext_pw(wpa_s) < 0)
4865                 return -1;
4866
4867         wpas_rrm_reset(wpa_s);
4868
4869         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4870
4871 #ifdef CONFIG_HS20
4872         hs20_init(wpa_s);
4873 #endif /* CONFIG_HS20 */
4874 #ifdef CONFIG_MBO
4875         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4876 #endif /* CONFIG_MBO */
4877
4878         return 0;
4879 }
4880
4881
4882 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4883                                         int notify, int terminate)
4884 {
4885         struct wpa_global *global = wpa_s->global;
4886         struct wpa_supplicant *iface, *prev;
4887
4888         if (wpa_s == wpa_s->parent)
4889                 wpas_p2p_group_remove(wpa_s, "*");
4890
4891         iface = global->ifaces;
4892         while (iface) {
4893                 if (iface->p2pdev == wpa_s)
4894                         iface->p2pdev = iface->parent;
4895                 if (iface == wpa_s || iface->parent != wpa_s) {
4896                         iface = iface->next;
4897                         continue;
4898                 }
4899                 wpa_printf(MSG_DEBUG,
4900                            "Remove remaining child interface %s from parent %s",
4901                            iface->ifname, wpa_s->ifname);
4902                 prev = iface;
4903                 iface = iface->next;
4904                 wpa_supplicant_remove_iface(global, prev, terminate);
4905         }
4906
4907         wpa_s->disconnected = 1;
4908         if (wpa_s->drv_priv) {
4909                 wpa_supplicant_deauthenticate(wpa_s,
4910                                               WLAN_REASON_DEAUTH_LEAVING);
4911
4912                 wpa_drv_set_countermeasures(wpa_s, 0);
4913                 wpa_clear_keys(wpa_s, NULL);
4914         }
4915
4916         wpa_supplicant_cleanup(wpa_s);
4917         wpas_p2p_deinit_iface(wpa_s);
4918
4919         wpas_ctrl_radio_work_flush(wpa_s);
4920         radio_remove_interface(wpa_s);
4921
4922 #ifdef CONFIG_FST
4923         if (wpa_s->fst) {
4924                 fst_detach(wpa_s->fst);
4925                 wpa_s->fst = NULL;
4926         }
4927         if (wpa_s->received_mb_ies) {
4928                 wpabuf_free(wpa_s->received_mb_ies);
4929                 wpa_s->received_mb_ies = NULL;
4930         }
4931 #endif /* CONFIG_FST */
4932
4933         if (wpa_s->drv_priv)
4934                 wpa_drv_deinit(wpa_s);
4935
4936         if (notify)
4937                 wpas_notify_iface_removed(wpa_s);
4938
4939         if (terminate)
4940                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4941
4942         if (wpa_s->ctrl_iface) {
4943                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4944                 wpa_s->ctrl_iface = NULL;
4945         }
4946
4947 #ifdef CONFIG_MESH
4948         if (wpa_s->ifmsh) {
4949                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4950                 wpa_s->ifmsh = NULL;
4951         }
4952 #endif /* CONFIG_MESH */
4953
4954         if (wpa_s->conf != NULL) {
4955                 wpa_config_free(wpa_s->conf);
4956                 wpa_s->conf = NULL;
4957         }
4958
4959         os_free(wpa_s->ssids_from_scan_req);
4960
4961         os_free(wpa_s);
4962 }
4963
4964
4965 #ifdef CONFIG_MATCH_IFACE
4966
4967 /**
4968  * wpa_supplicant_match_iface - Match an interface description to a name
4969  * @global: Pointer to global data from wpa_supplicant_init()
4970  * @ifname: Name of the interface to match
4971  * Returns: Pointer to the created interface description or %NULL on failure
4972  */
4973 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
4974                                                   const char *ifname)
4975 {
4976         int i;
4977         struct wpa_interface *iface, *miface;
4978
4979         for (i = 0; i < global->params.match_iface_count; i++) {
4980                 miface = &global->params.match_ifaces[i];
4981                 if (!miface->ifname ||
4982                     fnmatch(miface->ifname, ifname, 0) == 0) {
4983                         iface = os_zalloc(sizeof(*iface));
4984                         if (!iface)
4985                                 return NULL;
4986                         *iface = *miface;
4987                         iface->ifname = ifname;
4988                         return iface;
4989                 }
4990         }
4991
4992         return NULL;
4993 }
4994
4995
4996 /**
4997  * wpa_supplicant_match_existing - Match existing interfaces
4998  * @global: Pointer to global data from wpa_supplicant_init()
4999  * Returns: 0 on success, -1 on failure
5000  */
5001 static int wpa_supplicant_match_existing(struct wpa_global *global)
5002 {
5003         struct if_nameindex *ifi, *ifp;
5004         struct wpa_supplicant *wpa_s;
5005         struct wpa_interface *iface;
5006
5007         ifp = if_nameindex();
5008         if (!ifp) {
5009                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
5010                 return -1;
5011         }
5012
5013         for (ifi = ifp; ifi->if_name; ifi++) {
5014                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
5015                 if (wpa_s)
5016                         continue;
5017                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
5018                 if (iface) {
5019                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
5020                         os_free(iface);
5021                         if (wpa_s)
5022                                 wpa_s->matched = 1;
5023                 }
5024         }
5025
5026         if_freenameindex(ifp);
5027         return 0;
5028 }
5029
5030 #endif /* CONFIG_MATCH_IFACE */
5031
5032
5033 /**
5034  * wpa_supplicant_add_iface - Add a new network interface
5035  * @global: Pointer to global data from wpa_supplicant_init()
5036  * @iface: Interface configuration options
5037  * @parent: Parent interface or %NULL to assign new interface as parent
5038  * Returns: Pointer to the created interface or %NULL on failure
5039  *
5040  * This function is used to add new network interfaces for %wpa_supplicant.
5041  * This can be called before wpa_supplicant_run() to add interfaces before the
5042  * main event loop has been started. In addition, new interfaces can be added
5043  * dynamically while %wpa_supplicant is already running. This could happen,
5044  * e.g., when a hotplug network adapter is inserted.
5045  */
5046 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5047                                                  struct wpa_interface *iface,
5048                                                  struct wpa_supplicant *parent)
5049 {
5050         struct wpa_supplicant *wpa_s;
5051         struct wpa_interface t_iface;
5052         struct wpa_ssid *ssid;
5053
5054         if (global == NULL || iface == NULL)
5055                 return NULL;
5056
5057         wpa_s = wpa_supplicant_alloc(parent);
5058         if (wpa_s == NULL)
5059                 return NULL;
5060
5061         wpa_s->global = global;
5062
5063         t_iface = *iface;
5064         if (global->params.override_driver) {
5065                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5066                            "('%s' -> '%s')",
5067                            iface->driver, global->params.override_driver);
5068                 t_iface.driver = global->params.override_driver;
5069         }
5070         if (global->params.override_ctrl_interface) {
5071                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5072                            "ctrl_interface ('%s' -> '%s')",
5073                            iface->ctrl_interface,
5074                            global->params.override_ctrl_interface);
5075                 t_iface.ctrl_interface =
5076                         global->params.override_ctrl_interface;
5077         }
5078         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5079                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5080                            iface->ifname);
5081                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5082                 return NULL;
5083         }
5084
5085         if (iface->p2p_mgmt == 0) {
5086                 /* Notify the control interfaces about new iface */
5087                 if (wpas_notify_iface_added(wpa_s)) {
5088                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5089                         return NULL;
5090                 }
5091
5092                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5093                         wpas_notify_network_added(wpa_s, ssid);
5094         }
5095
5096         wpa_s->next = global->ifaces;
5097         global->ifaces = wpa_s;
5098
5099         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5100         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5101
5102 #ifdef CONFIG_P2P
5103         if (wpa_s->global->p2p == NULL &&
5104             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5105             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5106             wpas_p2p_add_p2pdev_interface(
5107                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5108                 wpa_printf(MSG_INFO,
5109                            "P2P: Failed to enable P2P Device interface");
5110                 /* Try to continue without. P2P will be disabled. */
5111         }
5112 #endif /* CONFIG_P2P */
5113
5114         return wpa_s;
5115 }
5116
5117
5118 /**
5119  * wpa_supplicant_remove_iface - Remove a network interface
5120  * @global: Pointer to global data from wpa_supplicant_init()
5121  * @wpa_s: Pointer to the network interface to be removed
5122  * Returns: 0 if interface was removed, -1 if interface was not found
5123  *
5124  * This function can be used to dynamically remove network interfaces from
5125  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5126  * addition, this function is used to remove all remaining interfaces when
5127  * %wpa_supplicant is terminated.
5128  */
5129 int wpa_supplicant_remove_iface(struct wpa_global *global,
5130                                 struct wpa_supplicant *wpa_s,
5131                                 int terminate)
5132 {
5133         struct wpa_supplicant *prev;
5134 #ifdef CONFIG_MESH
5135         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5136         char *ifname = NULL;
5137 #endif /* CONFIG_MESH */
5138
5139         /* Remove interface from the global list of interfaces */
5140         prev = global->ifaces;
5141         if (prev == wpa_s) {
5142                 global->ifaces = wpa_s->next;
5143         } else {
5144                 while (prev && prev->next != wpa_s)
5145                         prev = prev->next;
5146                 if (prev == NULL)
5147                         return -1;
5148                 prev->next = wpa_s->next;
5149         }
5150
5151         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5152
5153 #ifdef CONFIG_MESH
5154         if (mesh_if_created) {
5155                 ifname = os_strdup(wpa_s->ifname);
5156                 if (ifname == NULL) {
5157                         wpa_dbg(wpa_s, MSG_ERROR,
5158                                 "mesh: Failed to malloc ifname");
5159                         return -1;
5160                 }
5161         }
5162 #endif /* CONFIG_MESH */
5163
5164         if (global->p2p_group_formation == wpa_s)
5165                 global->p2p_group_formation = NULL;
5166         if (global->p2p_invite_group == wpa_s)
5167                 global->p2p_invite_group = NULL;
5168         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5169
5170 #ifdef CONFIG_MESH
5171         if (mesh_if_created) {
5172                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5173                 os_free(ifname);
5174         }
5175 #endif /* CONFIG_MESH */
5176
5177         return 0;
5178 }
5179
5180
5181 /**
5182  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5183  * @wpa_s: Pointer to the network interface
5184  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5185  */
5186 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5187 {
5188         const char *eapol_method;
5189
5190         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5191             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5192                 return "NO-EAP";
5193         }
5194
5195         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5196         if (eapol_method == NULL)
5197                 return "UNKNOWN-EAP";
5198
5199         return eapol_method;
5200 }
5201
5202
5203 /**
5204  * wpa_supplicant_get_iface - Get a new network interface
5205  * @global: Pointer to global data from wpa_supplicant_init()
5206  * @ifname: Interface name
5207  * Returns: Pointer to the interface or %NULL if not found
5208  */
5209 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5210                                                  const char *ifname)
5211 {
5212         struct wpa_supplicant *wpa_s;
5213
5214         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5215                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5216                         return wpa_s;
5217         }
5218         return NULL;
5219 }
5220
5221
5222 #ifndef CONFIG_NO_WPA_MSG
5223 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5224 {
5225         struct wpa_supplicant *wpa_s = ctx;
5226         if (wpa_s == NULL)
5227                 return NULL;
5228         return wpa_s->ifname;
5229 }
5230 #endif /* CONFIG_NO_WPA_MSG */
5231
5232
5233 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5234 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5235 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5236
5237 /* Periodic cleanup tasks */
5238 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5239 {
5240         struct wpa_global *global = eloop_ctx;
5241         struct wpa_supplicant *wpa_s;
5242
5243         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5244                                wpas_periodic, global, NULL);
5245
5246 #ifdef CONFIG_P2P
5247         if (global->p2p)
5248                 p2p_expire_peers(global->p2p);
5249 #endif /* CONFIG_P2P */
5250
5251         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5252                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5253 #ifdef CONFIG_AP
5254                 ap_periodic(wpa_s);
5255 #endif /* CONFIG_AP */
5256         }
5257 }
5258
5259
5260 /**
5261  * wpa_supplicant_init - Initialize %wpa_supplicant
5262  * @params: Parameters for %wpa_supplicant
5263  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5264  *
5265  * This function is used to initialize %wpa_supplicant. After successful
5266  * initialization, the returned data pointer can be used to add and remove
5267  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5268  */
5269 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5270 {
5271         struct wpa_global *global;
5272         int ret, i;
5273
5274         if (params == NULL)
5275                 return NULL;
5276
5277 #ifdef CONFIG_DRIVER_NDIS
5278         {
5279                 void driver_ndis_init_ops(void);
5280                 driver_ndis_init_ops();
5281         }
5282 #endif /* CONFIG_DRIVER_NDIS */
5283
5284 #ifndef CONFIG_NO_WPA_MSG
5285         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5286 #endif /* CONFIG_NO_WPA_MSG */
5287
5288         if (params->wpa_debug_file_path)
5289                 wpa_debug_open_file(params->wpa_debug_file_path);
5290         else
5291                 wpa_debug_setup_stdout();
5292         if (params->wpa_debug_syslog)
5293                 wpa_debug_open_syslog();
5294         if (params->wpa_debug_tracing) {
5295                 ret = wpa_debug_open_linux_tracing();
5296                 if (ret) {
5297                         wpa_printf(MSG_ERROR,
5298                                    "Failed to enable trace logging");
5299                         return NULL;
5300                 }
5301         }
5302
5303         ret = eap_register_methods();
5304         if (ret) {
5305                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5306                 if (ret == -2)
5307                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5308                                    "the same EAP type.");
5309                 return NULL;
5310         }
5311
5312         global = os_zalloc(sizeof(*global));
5313         if (global == NULL)
5314                 return NULL;
5315         dl_list_init(&global->p2p_srv_bonjour);
5316         dl_list_init(&global->p2p_srv_upnp);
5317         global->params.daemonize = params->daemonize;
5318         global->params.wait_for_monitor = params->wait_for_monitor;
5319         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5320         if (params->pid_file)
5321                 global->params.pid_file = os_strdup(params->pid_file);
5322         if (params->ctrl_interface)
5323                 global->params.ctrl_interface =
5324                         os_strdup(params->ctrl_interface);
5325         if (params->ctrl_interface_group)
5326                 global->params.ctrl_interface_group =
5327                         os_strdup(params->ctrl_interface_group);
5328         if (params->override_driver)
5329                 global->params.override_driver =
5330                         os_strdup(params->override_driver);
5331         if (params->override_ctrl_interface)
5332                 global->params.override_ctrl_interface =
5333                         os_strdup(params->override_ctrl_interface);
5334 #ifdef CONFIG_MATCH_IFACE
5335         global->params.match_iface_count = params->match_iface_count;
5336         if (params->match_iface_count) {
5337                 global->params.match_ifaces =
5338                         os_calloc(params->match_iface_count,
5339                                   sizeof(struct wpa_interface));
5340                 os_memcpy(global->params.match_ifaces,
5341                           params->match_ifaces,
5342                           params->match_iface_count *
5343                           sizeof(struct wpa_interface));
5344         }
5345 #endif /* CONFIG_MATCH_IFACE */
5346 #ifdef CONFIG_P2P
5347         if (params->conf_p2p_dev)
5348                 global->params.conf_p2p_dev =
5349                         os_strdup(params->conf_p2p_dev);
5350 #endif /* CONFIG_P2P */
5351         wpa_debug_level = global->params.wpa_debug_level =
5352                 params->wpa_debug_level;
5353         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5354                 params->wpa_debug_show_keys;
5355         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5356                 params->wpa_debug_timestamp;
5357
5358         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5359
5360         if (eloop_init()) {
5361                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5362                 wpa_supplicant_deinit(global);
5363                 return NULL;
5364         }
5365
5366         random_init(params->entropy_file);
5367
5368         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5369         if (global->ctrl_iface == NULL) {
5370                 wpa_supplicant_deinit(global);
5371                 return NULL;
5372         }
5373
5374         if (wpas_notify_supplicant_initialized(global)) {
5375                 wpa_supplicant_deinit(global);
5376                 return NULL;
5377         }
5378
5379         for (i = 0; wpa_drivers[i]; i++)
5380                 global->drv_count++;
5381         if (global->drv_count == 0) {
5382                 wpa_printf(MSG_ERROR, "No drivers enabled");
5383                 wpa_supplicant_deinit(global);
5384                 return NULL;
5385         }
5386         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5387         if (global->drv_priv == NULL) {
5388                 wpa_supplicant_deinit(global);
5389                 return NULL;
5390         }
5391
5392 #ifdef CONFIG_WIFI_DISPLAY
5393         if (wifi_display_init(global) < 0) {
5394                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5395                 wpa_supplicant_deinit(global);
5396                 return NULL;
5397         }
5398 #endif /* CONFIG_WIFI_DISPLAY */
5399
5400         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5401                                wpas_periodic, global, NULL);
5402
5403         return global;
5404 }
5405
5406
5407 /**
5408  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5409  * @global: Pointer to global data from wpa_supplicant_init()
5410  * Returns: 0 after successful event loop run, -1 on failure
5411  *
5412  * This function starts the main event loop and continues running as long as
5413  * there are any remaining events. In most cases, this function is running as
5414  * long as the %wpa_supplicant process in still in use.
5415  */
5416 int wpa_supplicant_run(struct wpa_global *global)
5417 {
5418         struct wpa_supplicant *wpa_s;
5419
5420         if (global->params.daemonize &&
5421             (wpa_supplicant_daemon(global->params.pid_file) ||
5422              eloop_sock_requeue()))
5423                 return -1;
5424
5425 #ifdef CONFIG_MATCH_IFACE
5426         if (wpa_supplicant_match_existing(global))
5427                 return -1;
5428 #endif
5429
5430         if (global->params.wait_for_monitor) {
5431                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5432                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5433                                 wpa_supplicant_ctrl_iface_wait(
5434                                         wpa_s->ctrl_iface);
5435         }
5436
5437         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5438         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5439
5440         eloop_run();
5441
5442         return 0;
5443 }
5444
5445
5446 /**
5447  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5448  * @global: Pointer to global data from wpa_supplicant_init()
5449  *
5450  * This function is called to deinitialize %wpa_supplicant and to free all
5451  * allocated resources. Remaining network interfaces will also be removed.
5452  */
5453 void wpa_supplicant_deinit(struct wpa_global *global)
5454 {
5455         int i;
5456
5457         if (global == NULL)
5458                 return;
5459
5460         eloop_cancel_timeout(wpas_periodic, global, NULL);
5461
5462 #ifdef CONFIG_WIFI_DISPLAY
5463         wifi_display_deinit(global);
5464 #endif /* CONFIG_WIFI_DISPLAY */
5465
5466         while (global->ifaces)
5467                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5468
5469         if (global->ctrl_iface)
5470                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5471
5472         wpas_notify_supplicant_deinitialized(global);
5473
5474         eap_peer_unregister_methods();
5475 #ifdef CONFIG_AP
5476         eap_server_unregister_methods();
5477 #endif /* CONFIG_AP */
5478
5479         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5480                 if (!global->drv_priv[i])
5481                         continue;
5482                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5483         }
5484         os_free(global->drv_priv);
5485
5486         random_deinit();
5487
5488         eloop_destroy();
5489
5490         if (global->params.pid_file) {
5491                 os_daemonize_terminate(global->params.pid_file);
5492                 os_free(global->params.pid_file);
5493         }
5494         os_free(global->params.ctrl_interface);
5495         os_free(global->params.ctrl_interface_group);
5496         os_free(global->params.override_driver);
5497         os_free(global->params.override_ctrl_interface);
5498 #ifdef CONFIG_MATCH_IFACE
5499         os_free(global->params.match_ifaces);
5500 #endif /* CONFIG_MATCH_IFACE */
5501 #ifdef CONFIG_P2P
5502         os_free(global->params.conf_p2p_dev);
5503 #endif /* CONFIG_P2P */
5504
5505         os_free(global->p2p_disallow_freq.range);
5506         os_free(global->p2p_go_avoid_freq.range);
5507         os_free(global->add_psk);
5508
5509         os_free(global);
5510         wpa_debug_close_syslog();
5511         wpa_debug_close_file();
5512         wpa_debug_close_linux_tracing();
5513 }
5514
5515
5516 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5517 {
5518         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5519             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5520                 char country[3];
5521                 country[0] = wpa_s->conf->country[0];
5522                 country[1] = wpa_s->conf->country[1];
5523                 country[2] = '\0';
5524                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5525                         wpa_printf(MSG_ERROR, "Failed to set country code "
5526                                    "'%s'", country);
5527                 }
5528         }
5529
5530         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5531                 wpas_init_ext_pw(wpa_s);
5532
5533         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5534                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5535
5536 #ifdef CONFIG_WPS
5537         wpas_wps_update_config(wpa_s);
5538 #endif /* CONFIG_WPS */
5539         wpas_p2p_update_config(wpa_s);
5540         wpa_s->conf->changed_parameters = 0;
5541 }
5542
5543
5544 void add_freq(int *freqs, int *num_freqs, int freq)
5545 {
5546         int i;
5547
5548         for (i = 0; i < *num_freqs; i++) {
5549                 if (freqs[i] == freq)
5550                         return;
5551         }
5552
5553         freqs[*num_freqs] = freq;
5554         (*num_freqs)++;
5555 }
5556
5557
5558 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5559 {
5560         struct wpa_bss *bss, *cbss;
5561         const int max_freqs = 10;
5562         int *freqs;
5563         int num_freqs = 0;
5564
5565         freqs = os_calloc(max_freqs + 1, sizeof(int));
5566         if (freqs == NULL)
5567                 return NULL;
5568
5569         cbss = wpa_s->current_bss;
5570
5571         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5572                 if (bss == cbss)
5573                         continue;
5574                 if (bss->ssid_len == cbss->ssid_len &&
5575                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5576                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5577                         add_freq(freqs, &num_freqs, bss->freq);
5578                         if (num_freqs == max_freqs)
5579                                 break;
5580                 }
5581         }
5582
5583         if (num_freqs == 0) {
5584                 os_free(freqs);
5585                 freqs = NULL;
5586         }
5587
5588         return freqs;
5589 }
5590
5591
5592 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5593 {
5594         int timeout;
5595         int count;
5596         int *freqs = NULL;
5597
5598         wpas_connect_work_done(wpa_s);
5599
5600         /*
5601          * Remove possible authentication timeout since the connection failed.
5602          */
5603         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5604
5605         /*
5606          * There is no point in blacklisting the AP if this event is
5607          * generated based on local request to disconnect.
5608          */
5609         if (wpa_s->own_disconnect_req) {
5610                 wpa_s->own_disconnect_req = 0;
5611                 wpa_dbg(wpa_s, MSG_DEBUG,
5612                         "Ignore connection failure due to local request to disconnect");
5613                 return;
5614         }
5615         if (wpa_s->disconnected) {
5616                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5617                         "indication since interface has been put into "
5618                         "disconnected state");
5619                 return;
5620         }
5621
5622         /*
5623          * Add the failed BSSID into the blacklist and speed up next scan
5624          * attempt if there could be other APs that could accept association.
5625          * The current blacklist count indicates how many times we have tried
5626          * connecting to this AP and multiple attempts mean that other APs are
5627          * either not available or has already been tried, so that we can start
5628          * increasing the delay here to avoid constant scanning.
5629          */
5630         count = wpa_blacklist_add(wpa_s, bssid);
5631         if (count == 1 && wpa_s->current_bss) {
5632                 /*
5633                  * This BSS was not in the blacklist before. If there is
5634                  * another BSS available for the same ESS, we should try that
5635                  * next. Otherwise, we may as well try this one once more
5636                  * before allowing other, likely worse, ESSes to be considered.
5637                  */
5638                 freqs = get_bss_freqs_in_ess(wpa_s);
5639                 if (freqs) {
5640                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5641                                 "has been seen; try it next");
5642                         wpa_blacklist_add(wpa_s, bssid);
5643                         /*
5644                          * On the next scan, go through only the known channels
5645                          * used in this ESS based on previous scans to speed up
5646                          * common load balancing use case.
5647                          */
5648                         os_free(wpa_s->next_scan_freqs);
5649                         wpa_s->next_scan_freqs = freqs;
5650                 }
5651         }
5652
5653         /*
5654          * Add previous failure count in case the temporary blacklist was
5655          * cleared due to no other BSSes being available.
5656          */
5657         count += wpa_s->extra_blacklist_count;
5658
5659         if (count > 3 && wpa_s->current_ssid) {
5660                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5661                            "consider temporary network disabling");
5662                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5663         }
5664
5665         switch (count) {
5666         case 1:
5667                 timeout = 100;
5668                 break;
5669         case 2:
5670                 timeout = 500;
5671                 break;
5672         case 3:
5673                 timeout = 1000;
5674                 break;
5675         case 4:
5676                 timeout = 5000;
5677                 break;
5678         default:
5679                 timeout = 10000;
5680                 break;
5681         }
5682
5683         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5684                 "ms", count, timeout);
5685
5686         /*
5687          * TODO: if more than one possible AP is available in scan results,
5688          * could try the other ones before requesting a new scan.
5689          */
5690         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5691                                 1000 * (timeout % 1000));
5692 }
5693
5694
5695 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5696 {
5697         return wpa_s->conf->ap_scan == 2 ||
5698                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5699 }
5700
5701
5702 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5703 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5704                                               struct wpa_ssid *ssid,
5705                                               const char *field,
5706                                               const char *value)
5707 {
5708 #ifdef IEEE8021X_EAPOL
5709         struct eap_peer_config *eap = &ssid->eap;
5710
5711         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5712         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5713                               (const u8 *) value, os_strlen(value));
5714
5715         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5716         case WPA_CTRL_REQ_EAP_IDENTITY:
5717                 os_free(eap->identity);
5718                 eap->identity = (u8 *) os_strdup(value);
5719                 eap->identity_len = os_strlen(value);
5720                 eap->pending_req_identity = 0;
5721                 if (ssid == wpa_s->current_ssid)
5722                         wpa_s->reassociate = 1;
5723                 break;
5724         case WPA_CTRL_REQ_EAP_PASSWORD:
5725                 bin_clear_free(eap->password, eap->password_len);
5726                 eap->password = (u8 *) os_strdup(value);
5727                 eap->password_len = os_strlen(value);
5728                 eap->pending_req_password = 0;
5729                 if (ssid == wpa_s->current_ssid)
5730                         wpa_s->reassociate = 1;
5731                 break;
5732         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5733                 bin_clear_free(eap->new_password, eap->new_password_len);
5734                 eap->new_password = (u8 *) os_strdup(value);
5735                 eap->new_password_len = os_strlen(value);
5736                 eap->pending_req_new_password = 0;
5737                 if (ssid == wpa_s->current_ssid)
5738                         wpa_s->reassociate = 1;
5739                 break;
5740         case WPA_CTRL_REQ_EAP_PIN:
5741                 str_clear_free(eap->pin);
5742                 eap->pin = os_strdup(value);
5743                 eap->pending_req_pin = 0;
5744                 if (ssid == wpa_s->current_ssid)
5745                         wpa_s->reassociate = 1;
5746                 break;
5747         case WPA_CTRL_REQ_EAP_OTP:
5748                 bin_clear_free(eap->otp, eap->otp_len);
5749                 eap->otp = (u8 *) os_strdup(value);
5750                 eap->otp_len = os_strlen(value);
5751                 os_free(eap->pending_req_otp);
5752                 eap->pending_req_otp = NULL;
5753                 eap->pending_req_otp_len = 0;
5754                 break;
5755         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5756                 str_clear_free(eap->private_key_passwd);
5757                 eap->private_key_passwd = os_strdup(value);
5758                 eap->pending_req_passphrase = 0;
5759                 if (ssid == wpa_s->current_ssid)
5760                         wpa_s->reassociate = 1;
5761                 break;
5762         case WPA_CTRL_REQ_SIM:
5763                 str_clear_free(eap->external_sim_resp);
5764                 eap->external_sim_resp = os_strdup(value);
5765                 break;
5766         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5767                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5768                         return -1;
5769                 ssid->mem_only_psk = 1;
5770                 if (ssid->passphrase)
5771                         wpa_config_update_psk(ssid);
5772                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5773                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5774                 break;
5775         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5776                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5777                         return -1;
5778                 if (os_strcmp(value, "good") == 0)
5779                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5780                 else if (os_strcmp(value, "bad") == 0)
5781                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5782                 else
5783                         return -1;
5784                 break;
5785         default:
5786                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5787                 return -1;
5788         }
5789
5790         return 0;
5791 #else /* IEEE8021X_EAPOL */
5792         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5793         return -1;
5794 #endif /* IEEE8021X_EAPOL */
5795 }
5796 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5797
5798
5799 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5800 {
5801         int i;
5802         unsigned int drv_enc;
5803
5804         if (wpa_s->p2p_mgmt)
5805                 return 1; /* no normal network profiles on p2p_mgmt interface */
5806
5807         if (ssid == NULL)
5808                 return 1;
5809
5810         if (ssid->disabled)
5811                 return 1;
5812
5813         if (wpa_s->drv_capa_known)
5814                 drv_enc = wpa_s->drv_enc;
5815         else
5816                 drv_enc = (unsigned int) -1;
5817
5818         for (i = 0; i < NUM_WEP_KEYS; i++) {
5819                 size_t len = ssid->wep_key_len[i];
5820                 if (len == 0)
5821                         continue;
5822                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5823                         continue;
5824                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5825                         continue;
5826                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5827                         continue;
5828                 return 1; /* invalid WEP key */
5829         }
5830
5831         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5832             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5833             !ssid->mem_only_psk)
5834                 return 1;
5835
5836         return 0;
5837 }
5838
5839
5840 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5841 {
5842 #ifdef CONFIG_IEEE80211W
5843         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5844                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5845                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5846                         /*
5847                          * Driver does not support BIP -- ignore pmf=1 default
5848                          * since the connection with PMF would fail and the
5849                          * configuration does not require PMF to be enabled.
5850                          */
5851                         return NO_MGMT_FRAME_PROTECTION;
5852                 }
5853
5854                 if (ssid &&
5855                     (ssid->key_mgmt &
5856                      ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
5857                        WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
5858                         /*
5859                          * Do not use the default PMF value for non-RSN networks
5860                          * since PMF is available only with RSN and pmf=2
5861                          * configuration would otherwise prevent connections to
5862                          * all open networks.
5863                          */
5864                         return NO_MGMT_FRAME_PROTECTION;
5865                 }
5866
5867                 return wpa_s->conf->pmf;
5868         }
5869
5870         return ssid->ieee80211w;
5871 #else /* CONFIG_IEEE80211W */
5872         return NO_MGMT_FRAME_PROTECTION;
5873 #endif /* CONFIG_IEEE80211W */
5874 }
5875
5876
5877 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5878 {
5879         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5880                 return 1;
5881         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5882                 return 0;
5883         return -1;
5884 }
5885
5886
5887 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5888 {
5889         struct wpa_ssid *ssid = wpa_s->current_ssid;
5890         int dur;
5891         struct os_reltime now;
5892
5893         if (ssid == NULL) {
5894                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5895                            "SSID block");
5896                 return;
5897         }
5898
5899         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5900                 return;
5901
5902         ssid->auth_failures++;
5903
5904 #ifdef CONFIG_P2P
5905         if (ssid->p2p_group &&
5906             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5907                 /*
5908                  * Skip the wait time since there is a short timeout on the
5909                  * connection to a P2P group.
5910                  */
5911                 return;
5912         }
5913 #endif /* CONFIG_P2P */
5914
5915         if (ssid->auth_failures > 50)
5916                 dur = 300;
5917         else if (ssid->auth_failures > 10)
5918                 dur = 120;
5919         else if (ssid->auth_failures > 5)
5920                 dur = 90;
5921         else if (ssid->auth_failures > 3)
5922                 dur = 60;
5923         else if (ssid->auth_failures > 2)
5924                 dur = 30;
5925         else if (ssid->auth_failures > 1)
5926                 dur = 20;
5927         else
5928                 dur = 10;
5929
5930         if (ssid->auth_failures > 1 &&
5931             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5932                 dur += os_random() % (ssid->auth_failures * 10);
5933
5934         os_get_reltime(&now);
5935         if (now.sec + dur <= ssid->disabled_until.sec)
5936                 return;
5937
5938         ssid->disabled_until.sec = now.sec + dur;
5939
5940         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5941                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5942                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5943                 ssid->auth_failures, dur, reason);
5944 }
5945
5946
5947 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5948                               struct wpa_ssid *ssid, int clear_failures)
5949 {
5950         if (ssid == NULL)
5951                 return;
5952
5953         if (ssid->disabled_until.sec) {
5954                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5955                         "id=%d ssid=\"%s\"",
5956                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5957         }
5958         ssid->disabled_until.sec = 0;
5959         ssid->disabled_until.usec = 0;
5960         if (clear_failures)
5961                 ssid->auth_failures = 0;
5962 }
5963
5964
5965 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5966 {
5967         size_t i;
5968
5969         if (wpa_s->disallow_aps_bssid == NULL)
5970                 return 0;
5971
5972         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5973                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5974                               bssid, ETH_ALEN) == 0)
5975                         return 1;
5976         }
5977
5978         return 0;
5979 }
5980
5981
5982 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5983                     size_t ssid_len)
5984 {
5985         size_t i;
5986
5987         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5988                 return 0;
5989
5990         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5991                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5992                 if (ssid_len == s->ssid_len &&
5993                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5994                         return 1;
5995         }
5996
5997         return 0;
5998 }
5999
6000
6001 /**
6002  * wpas_request_connection - Request a new connection
6003  * @wpa_s: Pointer to the network interface
6004  *
6005  * This function is used to request a new connection to be found. It will mark
6006  * the interface to allow reassociation and request a new scan to find a
6007  * suitable network to connect to.
6008  */
6009 void wpas_request_connection(struct wpa_supplicant *wpa_s)
6010 {
6011         wpa_s->normal_scans = 0;
6012         wpa_s->scan_req = NORMAL_SCAN_REQ;
6013         wpa_supplicant_reinit_autoscan(wpa_s);
6014         wpa_s->extra_blacklist_count = 0;
6015         wpa_s->disconnected = 0;
6016         wpa_s->reassociate = 1;
6017
6018         if (wpa_supplicant_fast_associate(wpa_s) != 1)
6019                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6020         else
6021                 wpa_s->reattach = 0;
6022 }
6023
6024
6025 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
6026                     struct wpa_used_freq_data *freqs_data,
6027                     unsigned int len)
6028 {
6029         unsigned int i;
6030
6031         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
6032                 len, title);
6033         for (i = 0; i < len; i++) {
6034                 struct wpa_used_freq_data *cur = &freqs_data[i];
6035                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
6036                         i, cur->freq, cur->flags);
6037         }
6038 }
6039
6040
6041 /*
6042  * Find the operating frequencies of any of the virtual interfaces that
6043  * are using the same radio as the current interface, and in addition, get
6044  * information about the interface types that are using the frequency.
6045  */
6046 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6047                                 struct wpa_used_freq_data *freqs_data,
6048                                 unsigned int len)
6049 {
6050         struct wpa_supplicant *ifs;
6051         u8 bssid[ETH_ALEN];
6052         int freq;
6053         unsigned int idx = 0, i;
6054
6055         wpa_dbg(wpa_s, MSG_DEBUG,
6056                 "Determining shared radio frequencies (max len %u)", len);
6057         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6058
6059         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6060                          radio_list) {
6061                 if (idx == len)
6062                         break;
6063
6064                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6065                         continue;
6066
6067                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6068                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6069                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6070                         freq = ifs->current_ssid->frequency;
6071                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6072                         freq = ifs->assoc_freq;
6073                 else
6074                         continue;
6075
6076                 /* Hold only distinct freqs */
6077                 for (i = 0; i < idx; i++)
6078                         if (freqs_data[i].freq == freq)
6079                                 break;
6080
6081                 if (i == idx)
6082                         freqs_data[idx++].freq = freq;
6083
6084                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6085                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6086                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6087                                 WPA_FREQ_USED_BY_INFRA_STATION;
6088                 }
6089         }
6090
6091         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6092         return idx;
6093 }
6094
6095
6096 /*
6097  * Find the operating frequencies of any of the virtual interfaces that
6098  * are using the same radio as the current interface.
6099  */
6100 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6101                            int *freq_array, unsigned int len)
6102 {
6103         struct wpa_used_freq_data *freqs_data;
6104         int num, i;
6105
6106         os_memset(freq_array, 0, sizeof(int) * len);
6107
6108         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6109         if (!freqs_data)
6110                 return -1;
6111
6112         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6113         for (i = 0; i < num; i++)
6114                 freq_array[i] = freqs_data[i].freq;
6115
6116         os_free(freqs_data);
6117
6118         return num;
6119 }
6120
6121
6122 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6123 {
6124         struct rrm_data *rrm = data;
6125
6126         if (!rrm->notify_neighbor_rep) {
6127                 wpa_printf(MSG_ERROR,
6128                            "RRM: Unexpected neighbor report timeout");
6129                 return;
6130         }
6131
6132         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6133         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6134
6135         rrm->notify_neighbor_rep = NULL;
6136         rrm->neighbor_rep_cb_ctx = NULL;
6137 }
6138
6139
6140 /*
6141  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6142  * @wpa_s: Pointer to wpa_supplicant
6143  */
6144 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6145 {
6146         wpa_s->rrm.rrm_used = 0;
6147
6148         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6149                              NULL);
6150         if (wpa_s->rrm.notify_neighbor_rep)
6151                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6152         wpa_s->rrm.next_neighbor_rep_token = 1;
6153 }
6154
6155
6156 /*
6157  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6158  * @wpa_s: Pointer to wpa_supplicant
6159  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6160  * @report_len: Length of neighbor report buffer
6161  */
6162 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6163                                    const u8 *report, size_t report_len)
6164 {
6165         struct wpabuf *neighbor_rep;
6166
6167         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6168         if (report_len < 1)
6169                 return;
6170
6171         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6172                 wpa_printf(MSG_DEBUG,
6173                            "RRM: Discarding neighbor report with token %d (expected %d)",
6174                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6175                 return;
6176         }
6177
6178         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6179                              NULL);
6180
6181         if (!wpa_s->rrm.notify_neighbor_rep) {
6182                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6183                 return;
6184         }
6185
6186         /* skipping the first byte, which is only an id (dialog token) */
6187         neighbor_rep = wpabuf_alloc(report_len - 1);
6188         if (neighbor_rep == NULL)
6189                 return;
6190         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6191         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6192                    report[0]);
6193         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6194                                        neighbor_rep);
6195         wpa_s->rrm.notify_neighbor_rep = NULL;
6196         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6197 }
6198
6199
6200 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6201 /* Workaround different, undefined for Windows, error codes used here */
6202 #define ENOTCONN -1
6203 #define EOPNOTSUPP -1
6204 #define ECANCELED -1
6205 #endif
6206
6207 /* Measurement Request element + Location Subject + Maximum Age subelement */
6208 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
6209 /* Measurement Request element + Location Civic Request */
6210 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
6211
6212
6213 /**
6214  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6215  * @wpa_s: Pointer to wpa_supplicant
6216  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6217  *        is sent in the request.
6218  * @lci: if set, neighbor request will include LCI request
6219  * @civic: if set, neighbor request will include civic location request
6220  * @cb: Callback function to be called once the requested report arrives, or
6221  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6222  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6223  *      the requester's responsibility to free it.
6224  *      In the latter case NULL will be sent in 'neighbor_rep'.
6225  * @cb_ctx: Context value to send the callback function
6226  * Returns: 0 in case of success, negative error code otherwise
6227  *
6228  * In case there is a previous request which has not been answered yet, the
6229  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6230  * Request must contain a callback function.
6231  */
6232 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6233                                        const struct wpa_ssid_value *ssid,
6234                                        int lci, int civic,
6235                                        void (*cb)(void *ctx,
6236                                                   struct wpabuf *neighbor_rep),
6237                                        void *cb_ctx)
6238 {
6239         struct wpabuf *buf;
6240         const u8 *rrm_ie;
6241
6242         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6243                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6244                 return -ENOTCONN;
6245         }
6246
6247         if (!wpa_s->rrm.rrm_used) {
6248                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6249                 return -EOPNOTSUPP;
6250         }
6251
6252         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6253                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6254         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6255             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6256                 wpa_printf(MSG_DEBUG,
6257                            "RRM: No network support for Neighbor Report.");
6258                 return -EOPNOTSUPP;
6259         }
6260
6261         if (!cb) {
6262                 wpa_printf(MSG_DEBUG,
6263                            "RRM: Neighbor Report request must provide a callback.");
6264                 return -EINVAL;
6265         }
6266
6267         /* Refuse if there's a live request */
6268         if (wpa_s->rrm.notify_neighbor_rep) {
6269                 wpa_printf(MSG_DEBUG,
6270                            "RRM: Currently handling previous Neighbor Report.");
6271                 return -EBUSY;
6272         }
6273
6274         /* 3 = action category + action code + dialog token */
6275         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
6276                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
6277                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
6278         if (buf == NULL) {
6279                 wpa_printf(MSG_DEBUG,
6280                            "RRM: Failed to allocate Neighbor Report Request");
6281                 return -ENOMEM;
6282         }
6283
6284         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6285                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6286                    wpa_s->rrm.next_neighbor_rep_token);
6287
6288         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6289         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6290         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6291         if (ssid) {
6292                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6293                 wpabuf_put_u8(buf, ssid->ssid_len);
6294                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6295         }
6296
6297         if (lci) {
6298                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6299                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6300                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
6301
6302                 /*
6303                  * Measurement token; nonzero number that is unique among the
6304                  * Measurement Request elements in a particular frame.
6305                  */
6306                 wpabuf_put_u8(buf, 1); /* Measurement Token */
6307
6308                 /*
6309                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6310                  * reserved.
6311                  */
6312                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6313                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
6314
6315                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
6316                 /* Location Subject */
6317                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6318
6319                 /* Optional Subelements */
6320                 /*
6321                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
6322                  * The Maximum Age subelement is required, otherwise the AP can
6323                  * send only data that was determined after receiving the
6324                  * request. Setting it here to unlimited age.
6325                  */
6326                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
6327                 wpabuf_put_u8(buf, 2);
6328                 wpabuf_put_le16(buf, 0xffff);
6329         }
6330
6331         if (civic) {
6332                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6333                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6334                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
6335
6336                 /*
6337                  * Measurement token; nonzero number that is unique among the
6338                  * Measurement Request elements in a particular frame.
6339                  */
6340                 wpabuf_put_u8(buf, 2); /* Measurement Token */
6341
6342                 /*
6343                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6344                  * reserved.
6345                  */
6346                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6347                 /* Measurement Type */
6348                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
6349
6350                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
6351                  * Location Civic request */
6352                 /* Location Subject */
6353                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6354                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
6355                 /* Location Service Interval Units: Seconds */
6356                 wpabuf_put_u8(buf, 0);
6357                 /* Location Service Interval: 0 - Only one report is requested
6358                  */
6359                 wpabuf_put_le16(buf, 0);
6360                 /* No optional subelements */
6361         }
6362
6363         wpa_s->rrm.next_neighbor_rep_token++;
6364
6365         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6366                                 wpa_s->own_addr, wpa_s->bssid,
6367                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6368                 wpa_printf(MSG_DEBUG,
6369                            "RRM: Failed to send Neighbor Report Request");
6370                 wpabuf_free(buf);
6371                 return -ECANCELED;
6372         }
6373
6374         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6375         wpa_s->rrm.notify_neighbor_rep = cb;
6376         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6377                                wpas_rrm_neighbor_rep_timeout_handler,
6378                                &wpa_s->rrm, NULL);
6379
6380         wpabuf_free(buf);
6381         return 0;
6382 }
6383
6384
6385 static struct wpabuf * wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
6386                                                  const u8 *request, size_t len,
6387                                                  struct wpabuf *report)
6388 {
6389         u8 token, type, subject;
6390         u16 max_age = 0;
6391         struct os_reltime t, diff;
6392         unsigned long diff_l;
6393         u8 *ptoken;
6394         const u8 *subelem;
6395
6396         if (!wpa_s->lci || len < 3 + 4)
6397                 return report;
6398
6399         token = *request++;
6400         /* Measurement request mode isn't used */
6401         request++;
6402         type = *request++;
6403         subject = *request++;
6404
6405         wpa_printf(MSG_DEBUG,
6406                    "Measurement request token %u type %u location subject %u",
6407                    token, type, subject);
6408
6409         if (type != MEASURE_TYPE_LCI || subject != LOCATION_SUBJECT_REMOTE) {
6410                 wpa_printf(MSG_INFO,
6411                            "Not building LCI report - bad type or location subject");
6412                 return report;
6413         }
6414
6415         /* Subelements are formatted exactly like elements */
6416         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
6417         if (subelem && subelem[1] == 2)
6418                 max_age = WPA_GET_LE16(subelem + 2);
6419
6420         if (os_get_reltime(&t))
6421                 return report;
6422
6423         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
6424         /* LCI age is calculated in 10th of a second units. */
6425         diff_l = diff.sec * 10 + diff.usec / 100000;
6426
6427         if (max_age != 0xffff && max_age < diff_l)
6428                 return report;
6429
6430         if (wpabuf_resize(&report, 2 + wpabuf_len(wpa_s->lci)))
6431                 return report;
6432
6433         wpabuf_put_u8(report, WLAN_EID_MEASURE_REPORT);
6434         wpabuf_put_u8(report, wpabuf_len(wpa_s->lci));
6435         /* We'll override user's measurement token */
6436         ptoken = wpabuf_put(report, 0);
6437         wpabuf_put_buf(report, wpa_s->lci);
6438         *ptoken = token;
6439
6440         return report;
6441 }
6442
6443
6444 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
6445                                                const u8 *src,
6446                                                const u8 *frame, size_t len)
6447 {
6448         struct wpabuf *buf, *report;
6449         u8 token;
6450         const u8 *ie, *end;
6451
6452         if (wpa_s->wpa_state != WPA_COMPLETED) {
6453                 wpa_printf(MSG_INFO,
6454                            "RRM: Ignoring radio measurement request: Not associated");
6455                 return;
6456         }
6457
6458         if (!wpa_s->rrm.rrm_used) {
6459                 wpa_printf(MSG_INFO,
6460                            "RRM: Ignoring radio measurement request: Not RRM network");
6461                 return;
6462         }
6463
6464         if (len < 3) {
6465                 wpa_printf(MSG_INFO,
6466                            "RRM: Ignoring too short radio measurement request");
6467                 return;
6468         }
6469
6470         end = frame + len;
6471
6472         token = *frame++;
6473
6474         /* Ignore number of repetitions because it's not used in LCI request */
6475         frame += 2;
6476
6477         report = NULL;
6478         while ((ie = get_ie(frame, end - frame, WLAN_EID_MEASURE_REQUEST)) &&
6479                ie[1] >= 3) {
6480                 u8 msmt_type;
6481
6482                 msmt_type = ie[4];
6483                 wpa_printf(MSG_DEBUG, "RRM request %d", msmt_type);
6484
6485                 switch (msmt_type) {
6486                 case MEASURE_TYPE_LCI:
6487                         report = wpas_rrm_build_lci_report(wpa_s, ie + 2, ie[1],
6488                                                            report);
6489                         break;
6490                 default:
6491                         wpa_printf(MSG_INFO,
6492                                    "RRM: Unsupported radio measurement request %d",
6493                                    msmt_type);
6494                         break;
6495                 }
6496
6497                 frame = ie + ie[1] + 2;
6498         }
6499
6500         if (!report)
6501                 return;
6502
6503         buf = wpabuf_alloc(3 + wpabuf_len(report));
6504         if (!buf) {
6505                 wpabuf_free(report);
6506                 return;
6507         }
6508
6509         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6510         wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
6511         wpabuf_put_u8(buf, token);
6512
6513         wpabuf_put_buf(buf, report);
6514         wpabuf_free(report);
6515
6516         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6517                                 wpa_s->own_addr, wpa_s->bssid,
6518                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6519                 wpa_printf(MSG_ERROR,
6520                            "RRM: Radio measurement report failed: Sending Action frame failed");
6521         }
6522         wpabuf_free(buf);
6523 }
6524
6525
6526 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6527                                               const u8 *src,
6528                                               const u8 *frame, size_t len,
6529                                               int rssi)
6530 {
6531         struct wpabuf *buf;
6532         const struct rrm_link_measurement_request *req;
6533         struct rrm_link_measurement_report report;
6534
6535         if (wpa_s->wpa_state != WPA_COMPLETED) {
6536                 wpa_printf(MSG_INFO,
6537                            "RRM: Ignoring link measurement request. Not associated");
6538                 return;
6539         }
6540
6541         if (!wpa_s->rrm.rrm_used) {
6542                 wpa_printf(MSG_INFO,
6543                            "RRM: Ignoring link measurement request. Not RRM network");
6544                 return;
6545         }
6546
6547         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6548                 wpa_printf(MSG_INFO,
6549                            "RRM: Measurement report failed. TX power insertion not supported");
6550                 return;
6551         }
6552
6553         req = (const struct rrm_link_measurement_request *) frame;
6554         if (len < sizeof(*req)) {
6555                 wpa_printf(MSG_INFO,
6556                            "RRM: Link measurement report failed. Request too short");
6557                 return;
6558         }
6559
6560         os_memset(&report, 0, sizeof(report));
6561         report.tpc.eid = WLAN_EID_TPC_REPORT;
6562         report.tpc.len = 2;
6563         report.rsni = 255; /* 255 indicates that RSNI is not available */
6564         report.dialog_token = req->dialog_token;
6565
6566         /*
6567          * It's possible to estimate RCPI based on RSSI in dBm. This
6568          * calculation will not reflect the correct value for high rates,
6569          * but it's good enough for Action frames which are transmitted
6570          * with up to 24 Mbps rates.
6571          */
6572         if (!rssi)
6573                 report.rcpi = 255; /* not available */
6574         else if (rssi < -110)
6575                 report.rcpi = 0;
6576         else if (rssi > 0)
6577                 report.rcpi = 220;
6578         else
6579                 report.rcpi = (rssi + 110) * 2;
6580
6581         /* action_category + action_code */
6582         buf = wpabuf_alloc(2 + sizeof(report));
6583         if (buf == NULL) {
6584                 wpa_printf(MSG_ERROR,
6585                            "RRM: Link measurement report failed. Buffer allocation failed");
6586                 return;
6587         }
6588
6589         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6590         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6591         wpabuf_put_data(buf, &report, sizeof(report));
6592         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6593                     wpabuf_head(buf), wpabuf_len(buf));
6594
6595         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6596                                 wpa_s->own_addr, wpa_s->bssid,
6597                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6598                 wpa_printf(MSG_ERROR,
6599                            "RRM: Link measurement report failed. Send action failed");
6600         }
6601         wpabuf_free(buf);
6602 }
6603
6604
6605 struct wpa_supplicant *
6606 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6607 {
6608         switch (frame) {
6609 #ifdef CONFIG_P2P
6610         case VENDOR_ELEM_PROBE_REQ_P2P:
6611         case VENDOR_ELEM_PROBE_RESP_P2P:
6612         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6613         case VENDOR_ELEM_BEACON_P2P_GO:
6614         case VENDOR_ELEM_P2P_PD_REQ:
6615         case VENDOR_ELEM_P2P_PD_RESP:
6616         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6617         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6618         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6619         case VENDOR_ELEM_P2P_INV_REQ:
6620         case VENDOR_ELEM_P2P_INV_RESP:
6621         case VENDOR_ELEM_P2P_ASSOC_REQ:
6622         case VENDOR_ELEM_P2P_ASSOC_RESP:
6623                 return wpa_s->p2pdev;
6624 #endif /* CONFIG_P2P */
6625         default:
6626                 return wpa_s;
6627         }
6628 }
6629
6630
6631 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6632 {
6633         unsigned int i;
6634         char buf[30];
6635
6636         wpa_printf(MSG_DEBUG, "Update vendor elements");
6637
6638         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6639                 if (wpa_s->vendor_elem[i]) {
6640                         int res;
6641
6642                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6643                         if (!os_snprintf_error(sizeof(buf), res)) {
6644                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6645                                                 wpa_s->vendor_elem[i]);
6646                         }
6647                 }
6648         }
6649
6650 #ifdef CONFIG_P2P
6651         if (wpa_s->parent == wpa_s &&
6652             wpa_s->global->p2p &&
6653             !wpa_s->global->p2p_disabled)
6654                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6655 #endif /* CONFIG_P2P */
6656 }
6657
6658
6659 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6660                             const u8 *elem, size_t len)
6661 {
6662         u8 *ie, *end;
6663
6664         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6665         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6666
6667         for (; ie + 1 < end; ie += 2 + ie[1]) {
6668                 if (ie + len > end)
6669                         break;
6670                 if (os_memcmp(ie, elem, len) != 0)
6671                         continue;
6672
6673                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6674                         wpabuf_free(wpa_s->vendor_elem[frame]);
6675                         wpa_s->vendor_elem[frame] = NULL;
6676                 } else {
6677                         os_memmove(ie, ie + len, end - (ie + len));
6678                         wpa_s->vendor_elem[frame]->used -= len;
6679                 }
6680                 wpas_vendor_elem_update(wpa_s);
6681                 return 0;
6682         }
6683
6684         return -1;
6685 }
6686
6687
6688 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6689                                    u16 num_modes, enum hostapd_hw_mode mode)
6690 {
6691         u16 i;
6692
6693         for (i = 0; i < num_modes; i++) {
6694                 if (modes[i].mode == mode)
6695                         return &modes[i];
6696         }
6697
6698         return NULL;
6699 }
6700
6701
6702 static struct
6703 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6704                                                  const u8 *bssid)
6705 {
6706         struct wpa_bss_tmp_disallowed *bss;
6707
6708         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6709                          struct wpa_bss_tmp_disallowed, list) {
6710                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6711                         return bss;
6712         }
6713
6714         return NULL;
6715 }
6716
6717
6718 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6719                           unsigned int sec)
6720 {
6721         struct wpa_bss_tmp_disallowed *bss;
6722         struct os_reltime until;
6723
6724         os_get_reltime(&until);
6725         until.sec += sec;
6726
6727         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6728         if (bss) {
6729                 bss->disallowed_until = until;
6730                 return;
6731         }
6732
6733         bss = os_malloc(sizeof(*bss));
6734         if (!bss) {
6735                 wpa_printf(MSG_DEBUG,
6736                            "Failed to allocate memory for temp disallow BSS");
6737                 return;
6738         }
6739
6740         bss->disallowed_until = until;
6741         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6742         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6743 }
6744
6745
6746 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6747 {
6748         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6749         struct os_reltime now, age;
6750
6751         os_get_reltime(&now);
6752
6753         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6754                          struct wpa_bss_tmp_disallowed, list) {
6755                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6756                         /* This BSS is not disallowed anymore */
6757                         dl_list_del(&tmp->list);
6758                         os_free(tmp);
6759                         continue;
6760                 }
6761                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6762                         bss = tmp;
6763                         break;
6764                 }
6765         }
6766         if (!bss)
6767                 return 0;
6768
6769         os_reltime_sub(&bss->disallowed_until, &now, &age);
6770         wpa_printf(MSG_DEBUG,
6771                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6772                    MAC2STR(bss->bssid), age.sec, age.usec);
6773         return 1;
6774 }