wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 401 {
 402         struct wpa_bss_tmp_disallowed *bss, *prev;
 403
 404         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 405                               struct wpa_bss_tmp_disallowed, list) {
 406                 dl_list_del(&bss->list);
 407                 os_free(bss);
 408         }
 409 }
 410
 411
 412 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 413 {
 414         int i;
 415
 416         bgscan_deinit(wpa_s);
 417         autoscan_deinit(wpa_s);
 418         scard_deinit(wpa_s->scard);
 419         wpa_s->scard = NULL;
 420         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 421         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 422         l2_packet_deinit(wpa_s->l2);
 423         wpa_s->l2 = NULL;
 424         if (wpa_s->l2_br) {
 425                 l2_packet_deinit(wpa_s->l2_br);
 426                 wpa_s->l2_br = NULL;
 427         }
 428 #ifdef CONFIG_TESTING_OPTIONS
 429         l2_packet_deinit(wpa_s->l2_test);
 430         wpa_s->l2_test = NULL;
 431 #endif /* CONFIG_TESTING_OPTIONS */
 432
 433         if (wpa_s->conf != NULL) {
 434                 struct wpa_ssid *ssid;
 435                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 436                         wpas_notify_network_removed(wpa_s, ssid);
 437         }
 438
 439         os_free(wpa_s->confname);
 440         wpa_s->confname = NULL;
 441
 442         os_free(wpa_s->confanother);
 443         wpa_s->confanother = NULL;
 444
 445         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 446         eapol_sm_deinit(wpa_s->eapol);
 447         wpa_s->eapol = NULL;
 448
 449         rsn_preauth_deinit(wpa_s->wpa);
 450
 451 #ifdef CONFIG_TDLS
 452         wpa_tdls_deinit(wpa_s->wpa);
 453 #endif /* CONFIG_TDLS */
 454
 455         wmm_ac_clear_saved_tspecs(wpa_s);
 456         pmksa_candidate_free(wpa_s->wpa);
 457         wpa_sm_deinit(wpa_s->wpa);
 458         wpa_s->wpa = NULL;
 459         wpa_blacklist_clear(wpa_s);
 460
 461         wpa_bss_deinit(wpa_s);
 462
 463         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 464         wpa_supplicant_cancel_scan(wpa_s);
 465         wpa_supplicant_cancel_auth_timeout(wpa_s);
 466         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 467 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 468         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 469                              wpa_s, NULL);
 470 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 471
 472         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 473
 474         wpas_wps_deinit(wpa_s);
 475
 476         wpabuf_free(wpa_s->pending_eapol_rx);
 477         wpa_s->pending_eapol_rx = NULL;
 478
 479 #ifdef CONFIG_IBSS_RSN
 480         ibss_rsn_deinit(wpa_s->ibss_rsn);
 481         wpa_s->ibss_rsn = NULL;
 482 #endif /* CONFIG_IBSS_RSN */
 483
 484         sme_deinit(wpa_s);
 485
 486 #ifdef CONFIG_AP
 487         wpa_supplicant_ap_deinit(wpa_s);
 488 #endif /* CONFIG_AP */
 489
 490         wpas_p2p_deinit(wpa_s);
 491
 492 #ifdef CONFIG_OFFCHANNEL
 493         offchannel_deinit(wpa_s);
 494 #endif /* CONFIG_OFFCHANNEL */
 495
 496         wpa_supplicant_cancel_sched_scan(wpa_s);
 497
 498         os_free(wpa_s->next_scan_freqs);
 499         wpa_s->next_scan_freqs = NULL;
 500
 501         os_free(wpa_s->manual_scan_freqs);
 502         wpa_s->manual_scan_freqs = NULL;
 503
 504         os_free(wpa_s->manual_sched_scan_freqs);
 505         wpa_s->manual_sched_scan_freqs = NULL;
 506
 507         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 508
 509         /*
 510          * Need to remove any pending gas-query radio work before the
 511          * gas_query_deinit() call because gas_query::work has not yet been set
 512          * for works that have not been started. gas_query_free() will be unable
 513          * to cancel such pending radio works and once the pending gas-query
 514          * radio work eventually gets removed, the deinit notification call to
 515          * gas_query_start_cb() would result in dereferencing freed memory.
 516          */
 517         if (wpa_s->radio)
 518                 radio_remove_works(wpa_s, "gas-query", 0);
 519         gas_query_deinit(wpa_s->gas);
 520         wpa_s->gas = NULL;
 521
 522         free_hw_features(wpa_s);
 523
 524         ieee802_1x_dealloc_kay_sm(wpa_s);
 525
 526         os_free(wpa_s->bssid_filter);
 527         wpa_s->bssid_filter = NULL;
 528
 529         os_free(wpa_s->disallow_aps_bssid);
 530         wpa_s->disallow_aps_bssid = NULL;
 531         os_free(wpa_s->disallow_aps_ssid);
 532         wpa_s->disallow_aps_ssid = NULL;
 533
 534         wnm_bss_keep_alive_deinit(wpa_s);
 535 #ifdef CONFIG_WNM
 536         wnm_deallocate_memory(wpa_s);
 537 #endif /* CONFIG_WNM */
 538
 539         ext_password_deinit(wpa_s->ext_pw);
 540         wpa_s->ext_pw = NULL;
 541
 542         wpabuf_free(wpa_s->last_gas_resp);
 543         wpa_s->last_gas_resp = NULL;
 544         wpabuf_free(wpa_s->prev_gas_resp);
 545         wpa_s->prev_gas_resp = NULL;
 546
 547         os_free(wpa_s->last_scan_res);
 548         wpa_s->last_scan_res = NULL;
 549
 550 #ifdef CONFIG_HS20
 551         hs20_deinit(wpa_s);
 552 #endif /* CONFIG_HS20 */
 553
 554         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 555                 wpabuf_free(wpa_s->vendor_elem[i]);
 556                 wpa_s->vendor_elem[i] = NULL;
 557         }
 558
 559         wmm_ac_notify_disassoc(wpa_s);
 560
 561         wpa_s->sched_scan_plans_num = 0;
 562         os_free(wpa_s->sched_scan_plans);
 563         wpa_s->sched_scan_plans = NULL;
 564
 565 #ifdef CONFIG_MBO
 566         wpa_s->non_pref_chan_num = 0;
 567         os_free(wpa_s->non_pref_chan);
 568         wpa_s->non_pref_chan = NULL;
 569 #endif /* CONFIG_MBO */
 570
 571         free_bss_tmp_disallowed(wpa_s);
 572 }
 573
 574
 575 /**
 576  * wpa_clear_keys - Clear keys configured for the driver
 577  * @wpa_s: Pointer to wpa_supplicant data
 578  * @addr: Previously used BSSID or %NULL if not available
 579  *
 580  * This function clears the encryption keys that has been previously configured
 581  * for the driver.
 582  */
 583 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 584 {
 585         int i, max;
 586
 587 #ifdef CONFIG_IEEE80211W
 588         max = 6;
 589 #else /* CONFIG_IEEE80211W */
 590         max = 4;
 591 #endif /* CONFIG_IEEE80211W */
 592
 593         /* MLME-DELETEKEYS.request */
 594         for (i = 0; i < max; i++) {
 595                 if (wpa_s->keys_cleared & BIT(i))
 596                         continue;
 597                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 598                                 NULL, 0);
 599         }
 600         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 601             !is_zero_ether_addr(addr)) {
 602                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 603                                 0);
 604                 /* MLME-SETPROTECTION.request(None) */
 605                 wpa_drv_mlme_setprotection(
 606                         wpa_s, addr,
 607                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 608                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 609         }
 610         wpa_s->keys_cleared = (u32) -1;
 611 }
 612
 613
 614 /**
 615  * wpa_supplicant_state_txt - Get the connection state name as a text string
 616  * @state: State (wpa_state; WPA_*)
 617  * Returns: The state name as a printable text string
 618  */
 619 const char * wpa_supplicant_state_txt(enum wpa_states state)
 620 {
 621         switch (state) {
 622         case WPA_DISCONNECTED:
 623                 return "DISCONNECTED";
 624         case WPA_INACTIVE:
 625                 return "INACTIVE";
 626         case WPA_INTERFACE_DISABLED:
 627                 return "INTERFACE_DISABLED";
 628         case WPA_SCANNING:
 629                 return "SCANNING";
 630         case WPA_AUTHENTICATING:
 631                 return "AUTHENTICATING";
 632         case WPA_ASSOCIATING:
 633                 return "ASSOCIATING";
 634         case WPA_ASSOCIATED:
 635                 return "ASSOCIATED";
 636         case WPA_4WAY_HANDSHAKE:
 637                 return "4WAY_HANDSHAKE";
 638         case WPA_GROUP_HANDSHAKE:
 639                 return "GROUP_HANDSHAKE";
 640         case WPA_COMPLETED:
 641                 return "COMPLETED";
 642         default:
 643                 return "UNKNOWN";
 644         }
 645 }
 646
 647
 648 #ifdef CONFIG_BGSCAN
 649
 650 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 651 {
 652         const char *name;
 653
 654         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 655                 name = wpa_s->current_ssid->bgscan;
 656         else
 657                 name = wpa_s->conf->bgscan;
 658         if (name == NULL || name[0] == '\0')
 659                 return;
 660         if (wpas_driver_bss_selection(wpa_s))
 661                 return;
 662         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 663                 return;
 664 #ifdef CONFIG_P2P
 665         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 666                 return;
 667 #endif /* CONFIG_P2P */
 668
 669         bgscan_deinit(wpa_s);
 670         if (wpa_s->current_ssid) {
 671                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 672                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 673                                 "bgscan");
 674                         /*
 675                          * Live without bgscan; it is only used as a roaming
 676                          * optimization, so the initial connection is not
 677                          * affected.
 678                          */
 679                 } else {
 680                         struct wpa_scan_results *scan_res;
 681                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 682                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 683                                                                    0);
 684                         if (scan_res) {
 685                                 bgscan_notify_scan(wpa_s, scan_res);
 686                                 wpa_scan_results_free(scan_res);
 687                         }
 688                 }
 689         } else
 690                 wpa_s->bgscan_ssid = NULL;
 691 }
 692
 693
 694 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 695 {
 696         if (wpa_s->bgscan_ssid != NULL) {
 697                 bgscan_deinit(wpa_s);
 698                 wpa_s->bgscan_ssid = NULL;
 699         }
 700 }
 701
 702 #endif /* CONFIG_BGSCAN */
 703
 704
 705 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 706 {
 707         if (autoscan_init(wpa_s, 0))
 708                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 709 }
 710
 711
 712 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 713 {
 714         autoscan_deinit(wpa_s);
 715 }
 716
 717
 718 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 719 {
 720         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 721             wpa_s->wpa_state == WPA_SCANNING) {
 722                 autoscan_deinit(wpa_s);
 723                 wpa_supplicant_start_autoscan(wpa_s);
 724         }
 725 }
 726
 727
 728 /**
 729  * wpa_supplicant_set_state - Set current connection state
 730  * @wpa_s: Pointer to wpa_supplicant data
 731  * @state: The new connection state
 732  *
 733  * This function is called whenever the connection state changes, e.g.,
 734  * association is completed for WPA/WPA2 4-Way Handshake is started.
 735  */
 736 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 737                               enum wpa_states state)
 738 {
 739         enum wpa_states old_state = wpa_s->wpa_state;
 740
 741         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 742                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 743                 wpa_supplicant_state_txt(state));
 744
 745         if (state == WPA_INTERFACE_DISABLED) {
 746                 /* Assure normal scan when interface is restored */
 747                 wpa_s->normal_scans = 0;
 748         }
 749
 750         if (state == WPA_COMPLETED) {
 751                 wpas_connect_work_done(wpa_s);
 752                 /* Reinitialize normal_scan counter */
 753                 wpa_s->normal_scans = 0;
 754         }
 755
 756 #ifdef CONFIG_P2P
 757         /*
 758          * P2PS client has to reply to Probe Request frames received on the
 759          * group operating channel. Enable Probe Request frame reporting for
 760          * P2P connected client in case p2p_cli_probe configuration property is
 761          * set to 1.
 762          */
 763         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 764             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 765             wpa_s->current_ssid->p2p_group) {
 766                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 767                         wpa_dbg(wpa_s, MSG_DEBUG,
 768                                 "P2P: Enable CLI Probe Request RX reporting");
 769                         wpa_s->p2p_cli_probe =
 770                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 771                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 772                         wpa_dbg(wpa_s, MSG_DEBUG,
 773                                 "P2P: Disable CLI Probe Request RX reporting");
 774                         wpa_s->p2p_cli_probe = 0;
 775                         wpa_drv_probe_req_report(wpa_s, 0);
 776                 }
 777         }
 778 #endif /* CONFIG_P2P */
 779
 780         if (state != WPA_SCANNING)
 781                 wpa_supplicant_notify_scanning(wpa_s, 0);
 782
 783         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 784                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 785 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 786                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 787                         MACSTR " completed [id=%d id_str=%s]",
 788                         MAC2STR(wpa_s->bssid),
 789                         ssid ? ssid->id : -1,
 790                         ssid && ssid->id_str ? ssid->id_str : "");
 791 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 792                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 793                 wpa_blacklist_clear(wpa_s);
 794                 wpa_s->extra_blacklist_count = 0;
 795                 wpa_s->new_connection = 0;
 796                 wpa_drv_set_operstate(wpa_s, 1);
 797 #ifndef IEEE8021X_EAPOL
 798                 wpa_drv_set_supp_port(wpa_s, 1);
 799 #endif /* IEEE8021X_EAPOL */
 800                 wpa_s->after_wps = 0;
 801                 wpa_s->known_wps_freq = 0;
 802                 wpas_p2p_completed(wpa_s);
 803
 804                 sme_sched_obss_scan(wpa_s, 1);
 805         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 806                    state == WPA_ASSOCIATED) {
 807                 wpa_s->new_connection = 1;
 808                 wpa_drv_set_operstate(wpa_s, 0);
 809 #ifndef IEEE8021X_EAPOL
 810                 wpa_drv_set_supp_port(wpa_s, 0);
 811 #endif /* IEEE8021X_EAPOL */
 812                 sme_sched_obss_scan(wpa_s, 0);
 813         }
 814         wpa_s->wpa_state = state;
 815
 816 #ifdef CONFIG_BGSCAN
 817         if (state == WPA_COMPLETED)
 818                 wpa_supplicant_start_bgscan(wpa_s);
 819         else if (state < WPA_ASSOCIATED)
 820                 wpa_supplicant_stop_bgscan(wpa_s);
 821 #endif /* CONFIG_BGSCAN */
 822
 823         if (state == WPA_AUTHENTICATING)
 824                 wpa_supplicant_stop_autoscan(wpa_s);
 825
 826         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 827                 wpa_supplicant_start_autoscan(wpa_s);
 828
 829         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 830                 wmm_ac_notify_disassoc(wpa_s);
 831
 832         if (wpa_s->wpa_state != old_state) {
 833                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 834
 835                 /*
 836                  * Notify the P2P Device interface about a state change in one
 837                  * of the interfaces.
 838                  */
 839                 wpas_p2p_indicate_state_change(wpa_s);
 840
 841                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 842                     old_state == WPA_COMPLETED)
 843                         wpas_notify_auth_changed(wpa_s);
 844         }
 845 }
 846
 847
 848 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 849 {
 850         int pending = 0;
 851 #ifdef CONFIG_WPS
 852         struct wpa_supplicant *wpa_s = global->ifaces;
 853         while (wpa_s) {
 854                 struct wpa_supplicant *next = wpa_s->next;
 855                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 856                         pending = 1;
 857 #ifdef CONFIG_P2P
 858                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 859                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 860                         wpas_p2p_disconnect(wpa_s);
 861 #endif /* CONFIG_P2P */
 862                 wpa_s = next;
 863         }
 864 #endif /* CONFIG_WPS */
 865         if (pending)
 866                 return;
 867         eloop_terminate();
 868 }
 869
 870
 871 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 872 {
 873         struct wpa_global *global = signal_ctx;
 874         wpa_supplicant_terminate_proc(global);
 875 }
 876
 877
 878 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 879 {
 880         enum wpa_states old_state = wpa_s->wpa_state;
 881
 882         wpa_s->pairwise_cipher = 0;
 883         wpa_s->group_cipher = 0;
 884         wpa_s->mgmt_group_cipher = 0;
 885         wpa_s->key_mgmt = 0;
 886         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 887                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 888
 889         if (wpa_s->wpa_state != old_state)
 890                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 891 }
 892
 893
 894 /**
 895  * wpa_supplicant_reload_configuration - Reload configuration data
 896  * @wpa_s: Pointer to wpa_supplicant data
 897  * Returns: 0 on success or -1 if configuration parsing failed
 898  *
 899  * This function can be used to request that the configuration data is reloaded
 900  * (e.g., after configuration file change). This function is reloading
 901  * configuration only for one interface, so this may need to be called multiple
 902  * times if %wpa_supplicant is controlling multiple interfaces and all
 903  * interfaces need reconfiguration.
 904  */
 905 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 906 {
 907         struct wpa_config *conf;
 908         int reconf_ctrl;
 909         int old_ap_scan;
 910
 911         if (wpa_s->confname == NULL)
 912                 return -1;
 913         conf = wpa_config_read(wpa_s->confname, NULL);
 914         if (conf == NULL) {
 915                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 916                         "file '%s' - exiting", wpa_s->confname);
 917                 return -1;
 918         }
 919         wpa_config_read(wpa_s->confanother, conf);
 920
 921         conf->changed_parameters = (unsigned int) -1;
 922
 923         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 924                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 925                     os_strcmp(conf->ctrl_interface,
 926                               wpa_s->conf->ctrl_interface) != 0);
 927
 928         if (reconf_ctrl && wpa_s->ctrl_iface) {
 929                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 930                 wpa_s->ctrl_iface = NULL;
 931         }
 932
 933         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 934         if (wpa_s->current_ssid) {
 935                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 936                         wpa_s->own_disconnect_req = 1;
 937                 wpa_supplicant_deauthenticate(wpa_s,
 938                                               WLAN_REASON_DEAUTH_LEAVING);
 939         }
 940
 941         /*
 942          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 943          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 944          */
 945         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 946                 /*
 947                  * Clear forced success to clear EAP state for next
 948                  * authentication.
 949                  */
 950                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 951         }
 952         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 953         wpa_sm_set_config(wpa_s->wpa, NULL);
 954         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 955         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 956         rsn_preauth_deinit(wpa_s->wpa);
 957
 958         old_ap_scan = wpa_s->conf->ap_scan;
 959         wpa_config_free(wpa_s->conf);
 960         wpa_s->conf = conf;
 961         if (old_ap_scan != wpa_s->conf->ap_scan)
 962                 wpas_notify_ap_scan_changed(wpa_s);
 963
 964         if (reconf_ctrl)
 965                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 966
 967         wpa_supplicant_update_config(wpa_s);
 968
 969         wpa_supplicant_clear_status(wpa_s);
 970         if (wpa_supplicant_enabled_networks(wpa_s)) {
 971                 wpa_s->reassociate = 1;
 972                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 973         }
 974         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 975         return 0;
 976 }
 977
 978
 979 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 980 {
 981         struct wpa_global *global = signal_ctx;
 982         struct wpa_supplicant *wpa_s;
 983         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 984                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 985                         sig);
 986                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 987                         wpa_supplicant_terminate_proc(global);
 988                 }
 989         }
 990
 991         if (wpa_debug_reopen_file() < 0) {
 992                 /* Ignore errors since we cannot really do much to fix this */
 993                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 994         }
 995 }
 996
 997
 998 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 999                                          struct wpa_ssid *ssid,
1000                                          struct wpa_ie_data *ie)
1001 {
1002         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1003         if (ret) {
1004                 if (ret == -2) {
1005                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1006                                 "from association info");
1007                 }
1008                 return -1;
1009         }
1010
1011         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1012                 "cipher suites");
1013         if (!(ie->group_cipher & ssid->group_cipher)) {
1014                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1015                         "cipher 0x%x (mask 0x%x) - reject",
1016                         ie->group_cipher, ssid->group_cipher);
1017                 return -1;
1018         }
1019         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1020                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1021                         "cipher 0x%x (mask 0x%x) - reject",
1022                         ie->pairwise_cipher, ssid->pairwise_cipher);
1023                 return -1;
1024         }
1025         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1026                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1027                         "management 0x%x (mask 0x%x) - reject",
1028                         ie->key_mgmt, ssid->key_mgmt);
1029                 return -1;
1030         }
1031
1032 #ifdef CONFIG_IEEE80211W
1033         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1034             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1036                         "that does not support management frame protection - "
1037                         "reject");
1038                 return -1;
1039         }
1040 #endif /* CONFIG_IEEE80211W */
1041
1042         return 0;
1043 }
1044
1045
1046 /**
1047  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1048  * @wpa_s: Pointer to wpa_supplicant data
1049  * @bss: Scan results for the selected BSS, or %NULL if not available
1050  * @ssid: Configuration data for the selected network
1051  * @wpa_ie: Buffer for the WPA/RSN IE
1052  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1053  * used buffer length in case the functions returns success.
1054  * Returns: 0 on success or -1 on failure
1055  *
1056  * This function is used to configure authentication and encryption parameters
1057  * based on the network configuration and scan result for the selected BSS (if
1058  * available).
1059  */
1060 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1061                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1062                               u8 *wpa_ie, size_t *wpa_ie_len)
1063 {
1064         struct wpa_ie_data ie;
1065         int sel, proto;
1066         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1067
1068         if (bss) {
1069                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1070                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1071                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1072         } else
1073                 bss_wpa = bss_rsn = bss_osen = NULL;
1074
1075         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1076             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1077             (ie.group_cipher & ssid->group_cipher) &&
1078             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1079             (ie.key_mgmt & ssid->key_mgmt)) {
1080                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1081                 proto = WPA_PROTO_RSN;
1082         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1083                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1084                    (ie.group_cipher & ssid->group_cipher) &&
1085                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1086                    (ie.key_mgmt & ssid->key_mgmt)) {
1087                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1088                 proto = WPA_PROTO_WPA;
1089 #ifdef CONFIG_HS20
1090         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1092                 /* TODO: parse OSEN element */
1093                 os_memset(&ie, 0, sizeof(ie));
1094                 ie.group_cipher = WPA_CIPHER_CCMP;
1095                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1096                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1097                 proto = WPA_PROTO_OSEN;
1098 #endif /* CONFIG_HS20 */
1099         } else if (bss) {
1100                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1101                 wpa_dbg(wpa_s, MSG_DEBUG,
1102                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1103                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1104                         ssid->key_mgmt);
1105                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1106                         MAC2STR(bss->bssid),
1107                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1108                         bss_wpa ? " WPA" : "",
1109                         bss_rsn ? " RSN" : "",
1110                         bss_osen ? " OSEN" : "");
1111                 if (bss_rsn) {
1112                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1113                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1114                                 wpa_dbg(wpa_s, MSG_DEBUG,
1115                                         "Could not parse RSN element");
1116                         } else {
1117                                 wpa_dbg(wpa_s, MSG_DEBUG,
1118                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1119                                         ie.pairwise_cipher, ie.group_cipher,
1120                                         ie.key_mgmt);
1121                         }
1122                 }
1123                 if (bss_wpa) {
1124                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1125                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "Could not parse WPA element");
1128                         } else {
1129                                 wpa_dbg(wpa_s, MSG_DEBUG,
1130                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1131                                         ie.pairwise_cipher, ie.group_cipher,
1132                                         ie.key_mgmt);
1133                         }
1134                 }
1135                 return -1;
1136         } else {
1137                 if (ssid->proto & WPA_PROTO_OSEN)
1138                         proto = WPA_PROTO_OSEN;
1139                 else if (ssid->proto & WPA_PROTO_RSN)
1140                         proto = WPA_PROTO_RSN;
1141                 else
1142                         proto = WPA_PROTO_WPA;
1143                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1144                         os_memset(&ie, 0, sizeof(ie));
1145                         ie.group_cipher = ssid->group_cipher;
1146                         ie.pairwise_cipher = ssid->pairwise_cipher;
1147                         ie.key_mgmt = ssid->key_mgmt;
1148 #ifdef CONFIG_IEEE80211W
1149                         ie.mgmt_group_cipher =
1150                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1151                                 WPA_CIPHER_AES_128_CMAC : 0;
1152 #endif /* CONFIG_IEEE80211W */
1153                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1154                                 "based on configuration");
1155                 } else
1156                         proto = ie.proto;
1157         }
1158
1159         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1160                 "pairwise %d key_mgmt %d proto %d",
1161                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1162 #ifdef CONFIG_IEEE80211W
1163         if (ssid->ieee80211w) {
1164                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1165                         ie.mgmt_group_cipher);
1166         }
1167 #endif /* CONFIG_IEEE80211W */
1168
1169         wpa_s->wpa_proto = proto;
1170         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1171         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1172                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1173
1174         if (bss || !wpa_s->ap_ies_from_associnfo) {
1175                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1176                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1177                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1178                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1179                         return -1;
1180         }
1181
1182 #ifdef CONFIG_NO_WPA
1183         wpa_s->group_cipher = WPA_CIPHER_NONE;
1184         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1185 #else /* CONFIG_NO_WPA */
1186         sel = ie.group_cipher & ssid->group_cipher;
1187         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1188         if (wpa_s->group_cipher < 0) {
1189                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1190                         "cipher");
1191                 return -1;
1192         }
1193         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1194                 wpa_cipher_txt(wpa_s->group_cipher));
1195
1196         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1197         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1198         if (wpa_s->pairwise_cipher < 0) {
1199                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1200                         "cipher");
1201                 return -1;
1202         }
1203         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1204                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1205 #endif /* CONFIG_NO_WPA */
1206
1207         sel = ie.key_mgmt & ssid->key_mgmt;
1208 #ifdef CONFIG_SAE
1209         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1210                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1211 #endif /* CONFIG_SAE */
1212         if (0) {
1213 #ifdef CONFIG_SUITEB192
1214         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1216                 wpa_dbg(wpa_s, MSG_DEBUG,
1217                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1218 #endif /* CONFIG_SUITEB192 */
1219 #ifdef CONFIG_SUITEB
1220         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1222                 wpa_dbg(wpa_s, MSG_DEBUG,
1223                         "WPA: using KEY_MGMT 802.1X with Suite B");
1224 #endif /* CONFIG_SUITEB */
1225 #ifdef CONFIG_IEEE80211R
1226         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1228                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1229         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1231                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1232 #endif /* CONFIG_IEEE80211R */
1233 #ifdef CONFIG_SAE
1234         } else if (sel & WPA_KEY_MGMT_SAE) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1237         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1240 #endif /* CONFIG_SAE */
1241 #ifdef CONFIG_IEEE80211W
1242         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1243                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1244                 wpa_dbg(wpa_s, MSG_DEBUG,
1245                         "WPA: using KEY_MGMT 802.1X with SHA256");
1246         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1248                 wpa_dbg(wpa_s, MSG_DEBUG,
1249                         "WPA: using KEY_MGMT PSK with SHA256");
1250 #endif /* CONFIG_IEEE80211W */
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1253                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1254         } else if (sel & WPA_KEY_MGMT_PSK) {
1255                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1256                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1257         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1258                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1259                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1260 #ifdef CONFIG_HS20
1261         } else if (sel & WPA_KEY_MGMT_OSEN) {
1262                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1264 #endif /* CONFIG_HS20 */
1265         } else {
1266                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1267                         "authenticated key management type");
1268                 return -1;
1269         }
1270
1271         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1272         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1273                          wpa_s->pairwise_cipher);
1274         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1275
1276 #ifdef CONFIG_IEEE80211W
1277         sel = ie.mgmt_group_cipher;
1278         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1279             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1280                 sel = 0;
1281         if (sel & WPA_CIPHER_AES_128_CMAC) {
1282                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1283                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1284                         "AES-128-CMAC");
1285         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1286                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1287                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1288                         "BIP-GMAC-128");
1289         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1290                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1291                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1292                         "BIP-GMAC-256");
1293         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1294                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1295                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1296                         "BIP-CMAC-256");
1297         } else {
1298                 wpa_s->mgmt_group_cipher = 0;
1299                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1300         }
1301         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1302                          wpa_s->mgmt_group_cipher);
1303         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1304                          wpas_get_ssid_pmf(wpa_s, ssid));
1305 #endif /* CONFIG_IEEE80211W */
1306
1307         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1308                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1309                 return -1;
1310         }
1311
1312         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1313                 int psk_set = 0;
1314
1315                 if (ssid->psk_set) {
1316                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1317                                        NULL);
1318                         psk_set = 1;
1319                 }
1320 #ifndef CONFIG_NO_PBKDF2
1321                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1322                     ssid->passphrase) {
1323                         u8 psk[PMK_LEN];
1324                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1325                                     4096, psk, PMK_LEN);
1326                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1327                                         psk, PMK_LEN);
1328                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1329                         psk_set = 1;
1330                         os_memset(psk, 0, sizeof(psk));
1331                 }
1332 #endif /* CONFIG_NO_PBKDF2 */
1333 #ifdef CONFIG_EXT_PASSWORD
1334                 if (ssid->ext_psk) {
1335                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1336                                                              ssid->ext_psk);
1337                         char pw_str[64 + 1];
1338                         u8 psk[PMK_LEN];
1339
1340                         if (pw == NULL) {
1341                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1342                                         "found from external storage");
1343                                 return -1;
1344                         }
1345
1346                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1347                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1348                                         "PSK length %d in external storage",
1349                                         (int) wpabuf_len(pw));
1350                                 ext_password_free(pw);
1351                                 return -1;
1352                         }
1353
1354                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1355                         pw_str[wpabuf_len(pw)] = '\0';
1356
1357 #ifndef CONFIG_NO_PBKDF2
1358                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1359                         {
1360                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1361                                             4096, psk, PMK_LEN);
1362                                 os_memset(pw_str, 0, sizeof(pw_str));
1363                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1364                                                 "external passphrase)",
1365                                                 psk, PMK_LEN);
1366                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1367                                                NULL);
1368                                 psk_set = 1;
1369                                 os_memset(psk, 0, sizeof(psk));
1370                         } else
1371 #endif /* CONFIG_NO_PBKDF2 */
1372                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1373                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1374                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1375                                                 "Invalid PSK hex string");
1376                                         os_memset(pw_str, 0, sizeof(pw_str));
1377                                         ext_password_free(pw);
1378                                         return -1;
1379                                 }
1380                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1381                                                NULL);
1382                                 psk_set = 1;
1383                                 os_memset(psk, 0, sizeof(psk));
1384                         } else {
1385                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1386                                         "PSK available");
1387                                 os_memset(pw_str, 0, sizeof(pw_str));
1388                                 ext_password_free(pw);
1389                                 return -1;
1390                         }
1391
1392                         os_memset(pw_str, 0, sizeof(pw_str));
1393                         ext_password_free(pw);
1394                 }
1395 #endif /* CONFIG_EXT_PASSWORD */
1396
1397                 if (!psk_set) {
1398                         wpa_msg(wpa_s, MSG_INFO,
1399                                 "No PSK available for association");
1400                         return -1;
1401                 }
1402         } else
1403                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1404
1405         return 0;
1406 }
1407
1408
1409 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1410 {
1411         *pos = 0x00;
1412
1413         switch (idx) {
1414         case 0: /* Bits 0-7 */
1415                 break;
1416         case 1: /* Bits 8-15 */
1417                 break;
1418         case 2: /* Bits 16-23 */
1419 #ifdef CONFIG_WNM
1420                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1421                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1422 #endif /* CONFIG_WNM */
1423                 break;
1424         case 3: /* Bits 24-31 */
1425 #ifdef CONFIG_WNM
1426                 *pos |= 0x02; /* Bit 25 - SSID List */
1427 #endif /* CONFIG_WNM */
1428 #ifdef CONFIG_INTERWORKING
1429                 if (wpa_s->conf->interworking)
1430                         *pos |= 0x80; /* Bit 31 - Interworking */
1431 #endif /* CONFIG_INTERWORKING */
1432                 break;
1433         case 4: /* Bits 32-39 */
1434 #ifdef CONFIG_INTERWORKING
1435                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1436                         *pos |= 0x01; /* Bit 32 - QoS Map */
1437 #endif /* CONFIG_INTERWORKING */
1438                 break;
1439         case 5: /* Bits 40-47 */
1440 #ifdef CONFIG_HS20
1441                 if (wpa_s->conf->hs20)
1442                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1443 #endif /* CONFIG_HS20 */
1444 #ifdef CONFIG_MBO
1445                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1446 #endif /* CONFIG_MBO */
1447                 break;
1448         case 6: /* Bits 48-55 */
1449                 break;
1450         }
1451 }
1452
1453
1454 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1455 {
1456         u8 *pos = buf;
1457         u8 len = 6, i;
1458
1459         if (len < wpa_s->extended_capa_len)
1460                 len = wpa_s->extended_capa_len;
1461         if (buflen < (size_t) len + 2) {
1462                 wpa_printf(MSG_INFO,
1463                            "Not enough room for building extended capabilities element");
1464                 return -1;
1465         }
1466
1467         *pos++ = WLAN_EID_EXT_CAPAB;
1468         *pos++ = len;
1469         for (i = 0; i < len; i++, pos++) {
1470                 wpas_ext_capab_byte(wpa_s, pos, i);
1471
1472                 if (i < wpa_s->extended_capa_len) {
1473                         *pos &= ~wpa_s->extended_capa_mask[i];
1474                         *pos |= wpa_s->extended_capa[i];
1475                 }
1476         }
1477
1478         while (len > 0 && buf[1 + len] == 0) {
1479                 len--;
1480                 buf[1] = len;
1481         }
1482         if (len == 0)
1483                 return 0;
1484
1485         return 2 + len;
1486 }
1487
1488
1489 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1490                           struct wpa_bss *test_bss)
1491 {
1492         struct wpa_bss *bss;
1493
1494         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1495                 if (bss == test_bss)
1496                         return 1;
1497         }
1498
1499         return 0;
1500 }
1501
1502
1503 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1504                            struct wpa_ssid *test_ssid)
1505 {
1506         struct wpa_ssid *ssid;
1507
1508         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1509                 if (ssid == test_ssid)
1510                         return 1;
1511         }
1512
1513         return 0;
1514 }
1515
1516
1517 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1518                         struct wpa_ssid *test_ssid)
1519 {
1520         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1521                 return 0;
1522
1523         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1524 }
1525
1526
1527 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1528 {
1529         if (cwork == NULL)
1530                 return;
1531         os_free(cwork);
1532 }
1533
1534
1535 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1536 {
1537         struct wpa_connect_work *cwork;
1538         struct wpa_radio_work *work = wpa_s->connect_work;
1539
1540         if (!work)
1541                 return;
1542
1543         wpa_s->connect_work = NULL;
1544         cwork = work->ctx;
1545         work->ctx = NULL;
1546         wpas_connect_work_free(cwork);
1547         radio_work_done(work);
1548 }
1549
1550
1551 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1552 {
1553         struct os_reltime now;
1554         u8 addr[ETH_ALEN];
1555
1556         os_get_reltime(&now);
1557         if (wpa_s->last_mac_addr_style == style &&
1558             wpa_s->last_mac_addr_change.sec != 0 &&
1559             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1560                                 wpa_s->conf->rand_addr_lifetime)) {
1561                 wpa_msg(wpa_s, MSG_DEBUG,
1562                         "Previously selected random MAC address has not yet expired");
1563                 return 0;
1564         }
1565
1566         switch (style) {
1567         case 1:
1568                 if (random_mac_addr(addr) < 0)
1569                         return -1;
1570                 break;
1571         case 2:
1572                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1573                 if (random_mac_addr_keep_oui(addr) < 0)
1574                         return -1;
1575                 break;
1576         default:
1577                 return -1;
1578         }
1579
1580         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1581                 wpa_msg(wpa_s, MSG_INFO,
1582                         "Failed to set random MAC address");
1583                 return -1;
1584         }
1585
1586         os_get_reltime(&wpa_s->last_mac_addr_change);
1587         wpa_s->mac_addr_changed = 1;
1588         wpa_s->last_mac_addr_style = style;
1589
1590         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1591                 wpa_msg(wpa_s, MSG_INFO,
1592                         "Could not update MAC address information");
1593                 return -1;
1594         }
1595
1596         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1597                 MAC2STR(addr));
1598
1599         return 0;
1600 }
1601
1602
1603 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1604 {
1605         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1606             !wpa_s->conf->preassoc_mac_addr)
1607                 return 0;
1608
1609         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1610 }
1611
1612
1613 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1614
1615 /**
1616  * wpa_supplicant_associate - Request association
1617  * @wpa_s: Pointer to wpa_supplicant data
1618  * @bss: Scan results for the selected BSS, or %NULL if not available
1619  * @ssid: Configuration data for the selected network
1620  *
1621  * This function is used to request %wpa_supplicant to associate with a BSS.
1622  */
1623 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1624                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1625 {
1626         struct wpa_connect_work *cwork;
1627         int rand_style;
1628
1629         wpa_s->own_disconnect_req = 0;
1630
1631         /*
1632          * If we are starting a new connection, any previously pending EAPOL
1633          * RX cannot be valid anymore.
1634          */
1635         wpabuf_free(wpa_s->pending_eapol_rx);
1636         wpa_s->pending_eapol_rx = NULL;
1637
1638         if (ssid->mac_addr == -1)
1639                 rand_style = wpa_s->conf->mac_addr;
1640         else
1641                 rand_style = ssid->mac_addr;
1642
1643         wmm_ac_clear_saved_tspecs(wpa_s);
1644         wpa_s->reassoc_same_bss = 0;
1645
1646         if (wpa_s->last_ssid == ssid) {
1647                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1648                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1649                         wmm_ac_save_tspecs(wpa_s);
1650                         wpa_s->reassoc_same_bss = 1;
1651                 }
1652         } else if (rand_style > 0) {
1653                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1654                         return;
1655                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1656         } else if (wpa_s->mac_addr_changed) {
1657                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1658                         wpa_msg(wpa_s, MSG_INFO,
1659                                 "Could not restore permanent MAC address");
1660                         return;
1661                 }
1662                 wpa_s->mac_addr_changed = 0;
1663                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1664                         wpa_msg(wpa_s, MSG_INFO,
1665                                 "Could not update MAC address information");
1666                         return;
1667                 }
1668                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1669         }
1670         wpa_s->last_ssid = ssid;
1671
1672 #ifdef CONFIG_IBSS_RSN
1673         ibss_rsn_deinit(wpa_s->ibss_rsn);
1674         wpa_s->ibss_rsn = NULL;
1675 #endif /* CONFIG_IBSS_RSN */
1676
1677         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1678             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1679 #ifdef CONFIG_AP
1680                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1681                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1682                                 "mode");
1683                         return;
1684                 }
1685                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1686                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1687                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1688                                 wpas_p2p_ap_setup_failed(wpa_s);
1689                         return;
1690                 }
1691                 wpa_s->current_bss = bss;
1692 #else /* CONFIG_AP */
1693                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1694                         "the build");
1695 #endif /* CONFIG_AP */
1696                 return;
1697         }
1698
1699         if (ssid->mode == WPAS_MODE_MESH) {
1700 #ifdef CONFIG_MESH
1701                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1702                         wpa_msg(wpa_s, MSG_INFO,
1703                                 "Driver does not support mesh mode");
1704                         return;
1705                 }
1706                 if (bss)
1707                         ssid->frequency = bss->freq;
1708                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1709                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1710                         return;
1711                 }
1712                 wpa_s->current_bss = bss;
1713                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1714                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1715                         ssid->id);
1716 #else /* CONFIG_MESH */
1717                 wpa_msg(wpa_s, MSG_ERROR,
1718                         "mesh mode support not included in the build");
1719 #endif /* CONFIG_MESH */
1720                 return;
1721         }
1722
1723 #ifdef CONFIG_TDLS
1724         if (bss)
1725                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1726                                 bss->ie_len);
1727 #endif /* CONFIG_TDLS */
1728
1729         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1730             ssid->mode == IEEE80211_MODE_INFRA) {
1731                 sme_authenticate(wpa_s, bss, ssid);
1732                 return;
1733         }
1734
1735         if (wpa_s->connect_work) {
1736                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1737                 return;
1738         }
1739
1740         if (radio_work_pending(wpa_s, "connect")) {
1741                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1742                 return;
1743         }
1744
1745         wpas_abort_ongoing_scan(wpa_s);
1746
1747         cwork = os_zalloc(sizeof(*cwork));
1748         if (cwork == NULL)
1749                 return;
1750
1751         cwork->bss = bss;
1752         cwork->ssid = ssid;
1753
1754         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1755                            wpas_start_assoc_cb, cwork) < 0) {
1756                 os_free(cwork);
1757         }
1758 }
1759
1760
1761 static int bss_is_ibss(struct wpa_bss *bss)
1762 {
1763         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1764                 IEEE80211_CAP_IBSS;
1765 }
1766
1767
1768 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1769                             const struct wpa_ssid *ssid)
1770 {
1771         enum hostapd_hw_mode hw_mode;
1772         struct hostapd_hw_modes *mode = NULL;
1773         u8 channel;
1774         int i;
1775
1776 #ifdef CONFIG_HT_OVERRIDES
1777         if (ssid->disable_ht)
1778                 return 0;
1779 #endif /* CONFIG_HT_OVERRIDES */
1780
1781         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1782         if (hw_mode == NUM_HOSTAPD_MODES)
1783                 return 0;
1784         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1785                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1786                         mode = &wpa_s->hw.modes[i];
1787                         break;
1788                 }
1789         }
1790
1791         if (!mode)
1792                 return 0;
1793
1794         return mode->vht_capab != 0;
1795 }
1796
1797
1798 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1799                           const struct wpa_ssid *ssid,
1800                           struct hostapd_freq_params *freq)
1801 {
1802         enum hostapd_hw_mode hw_mode;
1803         struct hostapd_hw_modes *mode = NULL;
1804         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1805                            184, 192 };
1806         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1807         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1808         u8 channel;
1809         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1810         unsigned int j, k;
1811         struct hostapd_freq_params vht_freq;
1812         int chwidth, seg0, seg1;
1813         u32 vht_caps = 0;
1814
1815         freq->freq = ssid->frequency;
1816
1817         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1818                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1819
1820                 if (ssid->mode != WPAS_MODE_IBSS)
1821                         break;
1822
1823                 /* Don't adjust control freq in case of fixed_freq */
1824                 if (ssid->fixed_freq)
1825                         break;
1826
1827                 if (!bss_is_ibss(bss))
1828                         continue;
1829
1830                 if (ssid->ssid_len == bss->ssid_len &&
1831                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1832                         wpa_printf(MSG_DEBUG,
1833                                    "IBSS already found in scan results, adjust control freq: %d",
1834                                    bss->freq);
1835                         freq->freq = bss->freq;
1836                         obss_scan = 0;
1837                         break;
1838                 }
1839         }
1840
1841         /* For IBSS check HT_IBSS flag */
1842         if (ssid->mode == WPAS_MODE_IBSS &&
1843             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1844                 return;
1845
1846         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1847             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1848             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1849                 wpa_printf(MSG_DEBUG,
1850                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1851                 return;
1852         }
1853
1854         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1855         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1856                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1857                         mode = &wpa_s->hw.modes[i];
1858                         break;
1859                 }
1860         }
1861
1862         if (!mode)
1863                 return;
1864
1865         freq->ht_enabled = ht_supported(mode);
1866         if (!freq->ht_enabled)
1867                 return;
1868
1869         /* Setup higher BW only for 5 GHz */
1870         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1871                 return;
1872
1873         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1874                 pri_chan = &mode->channels[chan_idx];
1875                 if (pri_chan->chan == channel)
1876                         break;
1877                 pri_chan = NULL;
1878         }
1879         if (!pri_chan)
1880                 return;
1881
1882         /* Check primary channel flags */
1883         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1884                 return;
1885
1886         /* Check/setup HT40+/HT40- */
1887         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1888                 if (ht40plus[j] == channel) {
1889                         ht40 = 1;
1890                         break;
1891                 }
1892         }
1893
1894         /* Find secondary channel */
1895         for (i = 0; i < mode->num_channels; i++) {
1896                 sec_chan = &mode->channels[i];
1897                 if (sec_chan->chan == channel + ht40 * 4)
1898                         break;
1899                 sec_chan = NULL;
1900         }
1901         if (!sec_chan)
1902                 return;
1903
1904         /* Check secondary channel flags */
1905         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1906                 return;
1907
1908         freq->channel = pri_chan->chan;
1909
1910         switch (ht40) {
1911         case -1:
1912                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1913                         return;
1914                 freq->sec_channel_offset = -1;
1915                 break;
1916         case 1:
1917                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1918                         return;
1919                 freq->sec_channel_offset = 1;
1920                 break;
1921         default:
1922                 break;
1923         }
1924
1925         if (freq->sec_channel_offset && obss_scan) {
1926                 struct wpa_scan_results *scan_res;
1927
1928                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1929                 if (scan_res == NULL) {
1930                         /* Back to HT20 */
1931                         freq->sec_channel_offset = 0;
1932                         return;
1933                 }
1934
1935                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1936                                      sec_chan->chan);
1937                 switch (res) {
1938                 case 0:
1939                         /* Back to HT20 */
1940                         freq->sec_channel_offset = 0;
1941                         break;
1942                 case 1:
1943                         /* Configuration allowed */
1944                         break;
1945                 case 2:
1946                         /* Switch pri/sec channels */
1947                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1948                         freq->sec_channel_offset = -freq->sec_channel_offset;
1949                         freq->channel = sec_chan->chan;
1950                         break;
1951                 default:
1952                         freq->sec_channel_offset = 0;
1953                         break;
1954                 }
1955
1956                 wpa_scan_results_free(scan_res);
1957         }
1958
1959         wpa_printf(MSG_DEBUG,
1960                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1961                    freq->channel, freq->sec_channel_offset);
1962
1963         if (!drv_supports_vht(wpa_s, ssid))
1964                 return;
1965
1966         /* For IBSS check VHT_IBSS flag */
1967         if (ssid->mode == WPAS_MODE_IBSS &&
1968             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1969                 return;
1970
1971         vht_freq = *freq;
1972
1973         vht_freq.vht_enabled = vht_supported(mode);
1974         if (!vht_freq.vht_enabled)
1975                 return;
1976
1977         /* setup center_freq1, bandwidth */
1978         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1979                 if (freq->channel >= vht80[j] &&
1980                     freq->channel < vht80[j] + 16)
1981                         break;
1982         }
1983
1984         if (j == ARRAY_SIZE(vht80))
1985                 return;
1986
1987         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1988                 struct hostapd_channel_data *chan;
1989
1990                 chan = hw_get_channel_chan(mode, i, NULL);
1991                 if (!chan)
1992                         return;
1993
1994                 /* Back to HT configuration if channel not usable */
1995                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1996                         return;
1997         }
1998
1999         chwidth = VHT_CHANWIDTH_80MHZ;
2000         seg0 = vht80[j] + 6;
2001         seg1 = 0;
2002
2003         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2004                 /* setup center_freq2, bandwidth */
2005                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2006                         /* Only accept 80 MHz segments separated by a gap */
2007                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2008                                 continue;
2009                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2010                                 struct hostapd_channel_data *chan;
2011
2012                                 chan = hw_get_channel_chan(mode, i, NULL);
2013                                 if (!chan)
2014                                         continue;
2015
2016                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2017                                                   HOSTAPD_CHAN_NO_IR |
2018                                                   HOSTAPD_CHAN_RADAR))
2019                                         continue;
2020
2021                                 /* Found a suitable second segment for 80+80 */
2022                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2023                                 vht_caps |=
2024                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2025                                 seg1 = vht80[k] + 6;
2026                         }
2027
2028                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2029                                 break;
2030                 }
2031         }
2032
2033         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2034                                     freq->channel, freq->ht_enabled,
2035                                     vht_freq.vht_enabled,
2036                                     freq->sec_channel_offset,
2037                                     chwidth, seg0, seg1, vht_caps) != 0)
2038                 return;
2039
2040         *freq = vht_freq;
2041
2042         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2043                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2044 }
2045
2046
2047 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2048 {
2049         struct wpa_connect_work *cwork = work->ctx;
2050         struct wpa_bss *bss = cwork->bss;
2051         struct wpa_ssid *ssid = cwork->ssid;
2052         struct wpa_supplicant *wpa_s = work->wpa_s;
2053         u8 wpa_ie[200];
2054         size_t wpa_ie_len;
2055         int use_crypt, ret, i, bssid_changed;
2056         int algs = WPA_AUTH_ALG_OPEN;
2057         unsigned int cipher_pairwise, cipher_group;
2058         struct wpa_driver_associate_params params;
2059         int wep_keys_set = 0;
2060         int assoc_failed = 0;
2061         struct wpa_ssid *old_ssid;
2062 #ifdef CONFIG_HT_OVERRIDES
2063         struct ieee80211_ht_capabilities htcaps;
2064         struct ieee80211_ht_capabilities htcaps_mask;
2065 #endif /* CONFIG_HT_OVERRIDES */
2066 #ifdef CONFIG_VHT_OVERRIDES
2067        struct ieee80211_vht_capabilities vhtcaps;
2068        struct ieee80211_vht_capabilities vhtcaps_mask;
2069 #endif /* CONFIG_VHT_OVERRIDES */
2070 #ifdef CONFIG_MBO
2071         const u8 *mbo = NULL;
2072 #endif /* CONFIG_MBO */
2073
2074         if (deinit) {
2075                 if (work->started) {
2076                         wpa_s->connect_work = NULL;
2077
2078                         /* cancel possible auth. timeout */
2079                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2080                                              NULL);
2081                 }
2082                 wpas_connect_work_free(cwork);
2083                 return;
2084         }
2085
2086         wpa_s->connect_work = work;
2087
2088         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2089             wpas_network_disabled(wpa_s, ssid)) {
2090                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2091                 wpas_connect_work_done(wpa_s);
2092                 return;
2093         }
2094
2095         os_memset(&params, 0, sizeof(params));
2096         wpa_s->reassociate = 0;
2097         wpa_s->eap_expected_failure = 0;
2098         if (bss &&
2099             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2100 #ifdef CONFIG_IEEE80211R
2101                 const u8 *ie, *md = NULL;
2102 #endif /* CONFIG_IEEE80211R */
2103                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2104                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2105                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2106                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2107                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2108                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2109                 if (bssid_changed)
2110                         wpas_notify_bssid_changed(wpa_s);
2111 #ifdef CONFIG_IEEE80211R
2112                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2113                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2114                         md = ie + 2;
2115                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2116                 if (md) {
2117                         /* Prepare for the next transition */
2118                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2119                 }
2120 #endif /* CONFIG_IEEE80211R */
2121 #ifdef CONFIG_WPS
2122         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2123                    wpa_s->conf->ap_scan == 2 &&
2124                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2125                 /* Use ap_scan==1 style network selection to find the network
2126                  */
2127                 wpas_connect_work_done(wpa_s);
2128                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2129                 wpa_s->reassociate = 1;
2130                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2131                 return;
2132 #endif /* CONFIG_WPS */
2133         } else {
2134                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2135                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2136                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2137         }
2138         if (!wpa_s->pno)
2139                 wpa_supplicant_cancel_sched_scan(wpa_s);
2140
2141         wpa_supplicant_cancel_scan(wpa_s);
2142
2143         /* Starting new association, so clear the possibly used WPA IE from the
2144          * previous association. */
2145         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2146
2147 #ifdef IEEE8021X_EAPOL
2148         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2149                 if (ssid->leap) {
2150                         if (ssid->non_leap == 0)
2151                                 algs = WPA_AUTH_ALG_LEAP;
2152                         else
2153                                 algs |= WPA_AUTH_ALG_LEAP;
2154                 }
2155         }
2156 #endif /* IEEE8021X_EAPOL */
2157         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2158         if (ssid->auth_alg) {
2159                 algs = ssid->auth_alg;
2160                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2161                         "0x%x", algs);
2162         }
2163
2164         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2165                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2166             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2167                 int try_opportunistic;
2168                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2169                                      wpa_s->conf->okc :
2170                                      ssid->proactive_key_caching) &&
2171                         (ssid->proto & WPA_PROTO_RSN);
2172                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2173                                             ssid, try_opportunistic) == 0)
2174                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2175                 wpa_ie_len = sizeof(wpa_ie);
2176                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2177                                               wpa_ie, &wpa_ie_len)) {
2178                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2179                                 "key management and encryption suites");
2180                         wpas_connect_work_done(wpa_s);
2181                         return;
2182                 }
2183         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2184                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2185                 /*
2186                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2187                  * use non-WPA since the scan results did not indicate that the
2188                  * AP is using WPA or WPA2.
2189                  */
2190                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2191                 wpa_ie_len = 0;
2192                 wpa_s->wpa_proto = 0;
2193         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2194                 wpa_ie_len = sizeof(wpa_ie);
2195                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2196                                               wpa_ie, &wpa_ie_len)) {
2197                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2198                                 "key management and encryption suites (no "
2199                                 "scan results)");
2200                         wpas_connect_work_done(wpa_s);
2201                         return;
2202                 }
2203 #ifdef CONFIG_WPS
2204         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2205                 struct wpabuf *wps_ie;
2206                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2207                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2208                         wpa_ie_len = wpabuf_len(wps_ie);
2209                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2210                 } else
2211                         wpa_ie_len = 0;
2212                 wpabuf_free(wps_ie);
2213                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2214                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2215                         params.wps = WPS_MODE_PRIVACY;
2216                 else
2217                         params.wps = WPS_MODE_OPEN;
2218                 wpa_s->wpa_proto = 0;
2219 #endif /* CONFIG_WPS */
2220         } else {
2221                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2222                 wpa_ie_len = 0;
2223                 wpa_s->wpa_proto = 0;
2224         }
2225
2226 #ifdef CONFIG_P2P
2227         if (wpa_s->global->p2p) {
2228                 u8 *pos;
2229                 size_t len;
2230                 int res;
2231                 pos = wpa_ie + wpa_ie_len;
2232                 len = sizeof(wpa_ie) - wpa_ie_len;
2233                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2234                                             ssid->p2p_group);
2235                 if (res >= 0)
2236                         wpa_ie_len += res;
2237         }
2238
2239         wpa_s->cross_connect_disallowed = 0;
2240         if (bss) {
2241                 struct wpabuf *p2p;
2242                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2243                 if (p2p) {
2244                         wpa_s->cross_connect_disallowed =
2245                                 p2p_get_cross_connect_disallowed(p2p);
2246                         wpabuf_free(p2p);
2247                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2248                                 "connection",
2249                                 wpa_s->cross_connect_disallowed ?
2250                                 "disallows" : "allows");
2251                 }
2252         }
2253
2254         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2255 #endif /* CONFIG_P2P */
2256
2257 #ifdef CONFIG_MBO
2258         if (bss) {
2259                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2260                 if (mbo) {
2261                         int len;
2262
2263                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2264                                                         wpa_ie + wpa_ie_len,
2265                                                         sizeof(wpa_ie) -
2266                                                         wpa_ie_len);
2267                         if (len > 0)
2268                                 wpa_ie_len += len;
2269                 }
2270         }
2271 #endif /* CONFIG_MBO */
2272
2273         /*
2274          * Workaround: Add Extended Capabilities element only if the AP
2275          * included this element in Beacon/Probe Response frames. Some older
2276          * APs seem to have interoperability issues if this element is
2277          * included, so while the standard may require us to include the
2278          * element in all cases, it is justifiable to skip it to avoid
2279          * interoperability issues.
2280          */
2281         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2282                 u8 ext_capab[18];
2283                 int ext_capab_len;
2284                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2285                                                      sizeof(ext_capab));
2286                 if (ext_capab_len > 0) {
2287                         u8 *pos = wpa_ie;
2288                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2289                                 pos += 2 + pos[1];
2290                         os_memmove(pos + ext_capab_len, pos,
2291                                    wpa_ie_len - (pos - wpa_ie));
2292                         wpa_ie_len += ext_capab_len;
2293                         os_memcpy(pos, ext_capab, ext_capab_len);
2294                 }
2295         }
2296
2297 #ifdef CONFIG_HS20
2298         if (is_hs20_network(wpa_s, ssid, bss)) {
2299                 struct wpabuf *hs20;
2300
2301                 hs20 = wpabuf_alloc(20);
2302                 if (hs20) {
2303                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2304                         size_t len;
2305
2306                         wpas_hs20_add_indication(hs20, pps_mo_id);
2307                         len = sizeof(wpa_ie) - wpa_ie_len;
2308                         if (wpabuf_len(hs20) <= len) {
2309                                 os_memcpy(wpa_ie + wpa_ie_len,
2310                                           wpabuf_head(hs20), wpabuf_len(hs20));
2311                                 wpa_ie_len += wpabuf_len(hs20);
2312                         }
2313                         wpabuf_free(hs20);
2314                 }
2315         }
2316 #endif /* CONFIG_HS20 */
2317
2318         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2319                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2320                 size_t len;
2321
2322                 len = sizeof(wpa_ie) - wpa_ie_len;
2323                 if (wpabuf_len(buf) <= len) {
2324                         os_memcpy(wpa_ie + wpa_ie_len,
2325                                   wpabuf_head(buf), wpabuf_len(buf));
2326                         wpa_ie_len += wpabuf_len(buf);
2327                 }
2328         }
2329
2330 #ifdef CONFIG_FST
2331         if (wpa_s->fst_ies) {
2332                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2333
2334                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2335                         os_memcpy(wpa_ie + wpa_ie_len,
2336                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2337                         wpa_ie_len += fst_ies_len;
2338                 }
2339         }
2340 #endif /* CONFIG_FST */
2341
2342 #ifdef CONFIG_MBO
2343         if (mbo) {
2344                 int len;
2345
2346                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2347                                   sizeof(wpa_ie) - wpa_ie_len);
2348                 if (len >= 0)
2349                         wpa_ie_len += len;
2350         }
2351 #endif /* CONFIG_MBO */
2352
2353         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2354         use_crypt = 1;
2355         cipher_pairwise = wpa_s->pairwise_cipher;
2356         cipher_group = wpa_s->group_cipher;
2357         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2358             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2359                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2360                         use_crypt = 0;
2361                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2362                         use_crypt = 1;
2363                         wep_keys_set = 1;
2364                 }
2365         }
2366         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2367                 use_crypt = 0;
2368
2369 #ifdef IEEE8021X_EAPOL
2370         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2371                 if ((ssid->eapol_flags &
2372                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2373                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2374                     !wep_keys_set) {
2375                         use_crypt = 0;
2376                 } else {
2377                         /* Assume that dynamic WEP-104 keys will be used and
2378                          * set cipher suites in order for drivers to expect
2379                          * encryption. */
2380                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2381                 }
2382         }
2383 #endif /* IEEE8021X_EAPOL */
2384
2385         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2386                 /* Set the key before (and later after) association */
2387                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2388         }
2389
2390         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2391         if (bss) {
2392                 params.ssid = bss->ssid;
2393                 params.ssid_len = bss->ssid_len;
2394                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2395                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2396                                    MACSTR " freq=%u MHz based on scan results "
2397                                    "(bssid_set=%d)",
2398                                    MAC2STR(bss->bssid), bss->freq,
2399                                    ssid->bssid_set);
2400                         params.bssid = bss->bssid;
2401                         params.freq.freq = bss->freq;
2402                 }
2403                 params.bssid_hint = bss->bssid;
2404                 params.freq_hint = bss->freq;
2405                 params.pbss = bss_is_pbss(bss);
2406         } else {
2407                 params.ssid = ssid->ssid;
2408                 params.ssid_len = ssid->ssid_len;
2409                 params.pbss = ssid->pbss;
2410         }
2411
2412         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2413             wpa_s->conf->ap_scan == 2) {
2414                 params.bssid = ssid->bssid;
2415                 params.fixed_bssid = 1;
2416         }
2417
2418         /* Initial frequency for IBSS/mesh */
2419         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2420             ssid->frequency > 0 && params.freq.freq == 0)
2421                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2422
2423         if (ssid->mode == WPAS_MODE_IBSS) {
2424                 params.fixed_freq = ssid->fixed_freq;
2425                 if (ssid->beacon_int)
2426                         params.beacon_int = ssid->beacon_int;
2427                 else
2428                         params.beacon_int = wpa_s->conf->beacon_int;
2429         }
2430
2431         params.wpa_ie = wpa_ie;
2432         params.wpa_ie_len = wpa_ie_len;
2433         params.pairwise_suite = cipher_pairwise;
2434         params.group_suite = cipher_group;
2435         params.key_mgmt_suite = wpa_s->key_mgmt;
2436         params.wpa_proto = wpa_s->wpa_proto;
2437         params.auth_alg = algs;
2438         params.mode = ssid->mode;
2439         params.bg_scan_period = ssid->bg_scan_period;
2440         for (i = 0; i < NUM_WEP_KEYS; i++) {
2441                 if (ssid->wep_key_len[i])
2442                         params.wep_key[i] = ssid->wep_key[i];
2443                 params.wep_key_len[i] = ssid->wep_key_len[i];
2444         }
2445         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2446
2447         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2448             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2449              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2450                 params.passphrase = ssid->passphrase;
2451                 if (ssid->psk_set)
2452                         params.psk = ssid->psk;
2453         }
2454
2455         if (wpa_s->conf->key_mgmt_offload) {
2456                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2457                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2458                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2459                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2460                         params.req_key_mgmt_offload =
2461                                 ssid->proactive_key_caching < 0 ?
2462                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2463                 else
2464                         params.req_key_mgmt_offload = 1;
2465
2466                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2467                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2468                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2469                     ssid->psk_set)
2470                         params.psk = ssid->psk;
2471         }
2472
2473         params.drop_unencrypted = use_crypt;
2474
2475 #ifdef CONFIG_IEEE80211W
2476         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2477         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2478                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2479                 struct wpa_ie_data ie;
2480                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2481                     ie.capabilities &
2482                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2483                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2484                                 "MFP: require MFP");
2485                         params.mgmt_frame_protection =
2486                                 MGMT_FRAME_PROTECTION_REQUIRED;
2487                 }
2488         }
2489 #endif /* CONFIG_IEEE80211W */
2490
2491         params.p2p = ssid->p2p_group;
2492
2493         if (wpa_s->parent->set_sta_uapsd)
2494                 params.uapsd = wpa_s->parent->sta_uapsd;
2495         else
2496                 params.uapsd = -1;
2497
2498 #ifdef CONFIG_HT_OVERRIDES
2499         os_memset(&htcaps, 0, sizeof(htcaps));
2500         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2501         params.htcaps = (u8 *) &htcaps;
2502         params.htcaps_mask = (u8 *) &htcaps_mask;
2503         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2504 #endif /* CONFIG_HT_OVERRIDES */
2505 #ifdef CONFIG_VHT_OVERRIDES
2506         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2507         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2508         params.vhtcaps = &vhtcaps;
2509         params.vhtcaps_mask = &vhtcaps_mask;
2510         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2511 #endif /* CONFIG_VHT_OVERRIDES */
2512
2513 #ifdef CONFIG_P2P
2514         /*
2515          * If multi-channel concurrency is not supported, check for any
2516          * frequency conflict. In case of any frequency conflict, remove the
2517          * least prioritized connection.
2518          */
2519         if (wpa_s->num_multichan_concurrent < 2) {
2520                 int freq, num;
2521                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2522                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2523                         wpa_printf(MSG_DEBUG,
2524                                    "Assoc conflicting freq found (%d != %d)",
2525                                    freq, params.freq.freq);
2526                         if (wpas_p2p_handle_frequency_conflicts(
2527                                     wpa_s, params.freq.freq, ssid) < 0) {
2528                                 wpas_connect_work_done(wpa_s);
2529                                 return;
2530                         }
2531                 }
2532         }
2533 #endif /* CONFIG_P2P */
2534
2535         ret = wpa_drv_associate(wpa_s, &params);
2536         if (ret < 0) {
2537                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2538                         "failed");
2539                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2540                         /*
2541                          * The driver is known to mean what is saying, so we
2542                          * can stop right here; the association will not
2543                          * succeed.
2544                          */
2545                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2546                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2547                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2548                         return;
2549                 }
2550                 /* try to continue anyway; new association will be tried again
2551                  * after timeout */
2552                 assoc_failed = 1;
2553         }
2554
2555         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2556                 /* Set the key after the association just in case association
2557                  * cleared the previously configured key. */
2558                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2559                 /* No need to timeout authentication since there is no key
2560                  * management. */
2561                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2562                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2563 #ifdef CONFIG_IBSS_RSN
2564         } else if (ssid->mode == WPAS_MODE_IBSS &&
2565                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2566                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2567                 /*
2568                  * RSN IBSS authentication is per-STA and we can disable the
2569                  * per-BSSID authentication.
2570                  */
2571                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2572 #endif /* CONFIG_IBSS_RSN */
2573         } else {
2574                 /* Timeout for IEEE 802.11 authentication and association */
2575                 int timeout = 60;
2576
2577                 if (assoc_failed) {
2578                         /* give IBSS a bit more time */
2579                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2580                 } else if (wpa_s->conf->ap_scan == 1) {
2581                         /* give IBSS a bit more time */
2582                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2583                 }
2584                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2585         }
2586
2587         if (wep_keys_set &&
2588             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2589                 /* Set static WEP keys again */
2590                 wpa_set_wep_keys(wpa_s, ssid);
2591         }
2592
2593         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2594                 /*
2595                  * Do not allow EAP session resumption between different
2596                  * network configurations.
2597                  */
2598                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2599         }
2600         old_ssid = wpa_s->current_ssid;
2601         wpa_s->current_ssid = ssid;
2602         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2603                 wpa_s->current_bss = bss;
2604         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2605         wpa_supplicant_initiate_eapol(wpa_s);
2606         if (old_ssid != wpa_s->current_ssid)
2607                 wpas_notify_network_changed(wpa_s);
2608 }
2609
2610
2611 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2612                                             const u8 *addr)
2613 {
2614         struct wpa_ssid *old_ssid;
2615
2616         wpas_connect_work_done(wpa_s);
2617         wpa_clear_keys(wpa_s, addr);
2618         old_ssid = wpa_s->current_ssid;
2619         wpa_supplicant_mark_disassoc(wpa_s);
2620         wpa_sm_set_config(wpa_s->wpa, NULL);
2621         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2622         if (old_ssid != wpa_s->current_ssid)
2623                 wpas_notify_network_changed(wpa_s);
2624         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2625 }
2626
2627
2628 /**
2629  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2630  * @wpa_s: Pointer to wpa_supplicant data
2631  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2632  *
2633  * This function is used to request %wpa_supplicant to deauthenticate from the
2634  * current AP.
2635  */
2636 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2637                                    int reason_code)
2638 {
2639         u8 *addr = NULL;
2640         union wpa_event_data event;
2641         int zero_addr = 0;
2642
2643         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2644                 " pending_bssid=" MACSTR " reason=%d state=%s",
2645                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2646                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2647
2648         if (!is_zero_ether_addr(wpa_s->bssid))
2649                 addr = wpa_s->bssid;
2650         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2651                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2652                   wpa_s->wpa_state == WPA_ASSOCIATING))
2653                 addr = wpa_s->pending_bssid;
2654         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2655                 /*
2656                  * When using driver-based BSS selection, we may not know the
2657                  * BSSID with which we are currently trying to associate. We
2658                  * need to notify the driver of this disconnection even in such
2659                  * a case, so use the all zeros address here.
2660                  */
2661                 addr = wpa_s->bssid;
2662                 zero_addr = 1;
2663         }
2664
2665 #ifdef CONFIG_TDLS
2666         wpa_tdls_teardown_peers(wpa_s->wpa);
2667 #endif /* CONFIG_TDLS */
2668
2669 #ifdef CONFIG_MESH
2670         if (wpa_s->ifmsh) {
2671                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2672                         wpa_s->ifname);
2673                 wpa_supplicant_leave_mesh(wpa_s);
2674         }
2675 #endif /* CONFIG_MESH */
2676
2677         if (addr) {
2678                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2679                 os_memset(&event, 0, sizeof(event));
2680                 event.deauth_info.reason_code = (u16) reason_code;
2681                 event.deauth_info.locally_generated = 1;
2682                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2683                 if (zero_addr)
2684                         addr = NULL;
2685         }
2686
2687         wpa_supplicant_clear_connection(wpa_s, addr);
2688 }
2689
2690 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2691                                               struct wpa_ssid *ssid)
2692 {
2693         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2694                 return;
2695
2696         ssid->disabled = 0;
2697         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2698         wpas_notify_network_enabled_changed(wpa_s, ssid);
2699
2700         /*
2701          * Try to reassociate since there is no current configuration and a new
2702          * network was made available.
2703          */
2704         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2705                 wpa_s->reassociate = 1;
2706 }
2707
2708
2709 /**
2710  * wpa_supplicant_enable_network - Mark a configured network as enabled
2711  * @wpa_s: wpa_supplicant structure for a network interface
2712  * @ssid: wpa_ssid structure for a configured network or %NULL
2713  *
2714  * Enables the specified network or all networks if no network specified.
2715  */
2716 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2717                                    struct wpa_ssid *ssid)
2718 {
2719         if (ssid == NULL) {
2720                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2721                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2722         } else
2723                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2724
2725         if (wpa_s->reassociate && !wpa_s->disconnected &&
2726             (!wpa_s->current_ssid ||
2727              wpa_s->wpa_state == WPA_DISCONNECTED ||
2728              wpa_s->wpa_state == WPA_SCANNING)) {
2729                 if (wpa_s->sched_scanning) {
2730                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2731                                    "new network to scan filters");
2732                         wpa_supplicant_cancel_sched_scan(wpa_s);
2733                 }
2734
2735                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2736                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2737                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2738                 }
2739         }
2740 }
2741
2742
2743 /**
2744  * wpa_supplicant_disable_network - Mark a configured network as disabled
2745  * @wpa_s: wpa_supplicant structure for a network interface
2746  * @ssid: wpa_ssid structure for a configured network or %NULL
2747  *
2748  * Disables the specified network or all networks if no network specified.
2749  */
2750 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2751                                     struct wpa_ssid *ssid)
2752 {
2753         struct wpa_ssid *other_ssid;
2754         int was_disabled;
2755
2756         if (ssid == NULL) {
2757                 if (wpa_s->sched_scanning)
2758                         wpa_supplicant_cancel_sched_scan(wpa_s);
2759
2760                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2761                      other_ssid = other_ssid->next) {
2762                         was_disabled = other_ssid->disabled;
2763                         if (was_disabled == 2)
2764                                 continue; /* do not change persistent P2P group
2765                                            * data */
2766
2767                         other_ssid->disabled = 1;
2768
2769                         if (was_disabled != other_ssid->disabled)
2770                                 wpas_notify_network_enabled_changed(
2771                                         wpa_s, other_ssid);
2772                 }
2773                 if (wpa_s->current_ssid)
2774                         wpa_supplicant_deauthenticate(
2775                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2776         } else if (ssid->disabled != 2) {
2777                 if (ssid == wpa_s->current_ssid)
2778                         wpa_supplicant_deauthenticate(
2779                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2780
2781                 was_disabled = ssid->disabled;
2782
2783                 ssid->disabled = 1;
2784
2785                 if (was_disabled != ssid->disabled) {
2786                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2787                         if (wpa_s->sched_scanning) {
2788                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2789                                            "to remove network from filters");
2790                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2791                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2792                         }
2793                 }
2794         }
2795 }
2796
2797
2798 /**
2799  * wpa_supplicant_select_network - Attempt association with a network
2800  * @wpa_s: wpa_supplicant structure for a network interface
2801  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2802  */
2803 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2804                                    struct wpa_ssid *ssid)
2805 {
2806
2807         struct wpa_ssid *other_ssid;
2808         int disconnected = 0;
2809
2810         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2811                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2812                         wpa_s->own_disconnect_req = 1;
2813                 wpa_supplicant_deauthenticate(
2814                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2815                 disconnected = 1;
2816         }
2817
2818         if (ssid)
2819                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2820
2821         /*
2822          * Mark all other networks disabled or mark all networks enabled if no
2823          * network specified.
2824          */
2825         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2826              other_ssid = other_ssid->next) {
2827                 int was_disabled = other_ssid->disabled;
2828                 if (was_disabled == 2)
2829                         continue; /* do not change persistent P2P group data */
2830
2831                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2832                 if (was_disabled && !other_ssid->disabled)
2833                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2834
2835                 if (was_disabled != other_ssid->disabled)
2836                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2837         }
2838
2839         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2840             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2841                 /* We are already associated with the selected network */
2842                 wpa_printf(MSG_DEBUG, "Already associated with the "
2843                            "selected network - do nothing");
2844                 return;
2845         }
2846
2847         if (ssid) {
2848                 wpa_s->current_ssid = ssid;
2849                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2850                 wpa_s->connect_without_scan =
2851                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2852
2853                 /*
2854                  * Don't optimize next scan freqs since a new ESS has been
2855                  * selected.
2856                  */
2857                 os_free(wpa_s->next_scan_freqs);
2858                 wpa_s->next_scan_freqs = NULL;
2859         } else {
2860                 wpa_s->connect_without_scan = NULL;
2861         }
2862
2863         wpa_s->disconnected = 0;
2864         wpa_s->reassociate = 1;
2865
2866         if (wpa_s->connect_without_scan ||
2867             wpa_supplicant_fast_associate(wpa_s) != 1) {
2868                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2869                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2870         }
2871
2872         if (ssid)
2873                 wpas_notify_network_selected(wpa_s, ssid);
2874 }
2875
2876
2877 /**
2878  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2879  * @wpa_s: wpa_supplicant structure for a network interface
2880  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2881  * @pkcs11_module_path: PKCS #11 module path or NULL
2882  * Returns: 0 on success; -1 on failure
2883  *
2884  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2885  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2886  * module path fails the paths will be reset to the default value (NULL).
2887  */
2888 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2889                                            const char *pkcs11_engine_path,
2890                                            const char *pkcs11_module_path)
2891 {
2892         char *pkcs11_engine_path_copy = NULL;
2893         char *pkcs11_module_path_copy = NULL;
2894
2895         if (pkcs11_engine_path != NULL) {
2896                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2897                 if (pkcs11_engine_path_copy == NULL)
2898                         return -1;
2899         }
2900         if (pkcs11_module_path != NULL) {
2901                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2902                 if (pkcs11_module_path_copy == NULL) {
2903                         os_free(pkcs11_engine_path_copy);
2904                         return -1;
2905                 }
2906         }
2907
2908         os_free(wpa_s->conf->pkcs11_engine_path);
2909         os_free(wpa_s->conf->pkcs11_module_path);
2910         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2911         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2912
2913         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2914         eapol_sm_deinit(wpa_s->eapol);
2915         wpa_s->eapol = NULL;
2916         if (wpa_supplicant_init_eapol(wpa_s)) {
2917                 /* Error -> Reset paths to the default value (NULL) once. */
2918                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2919                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2920                                                                NULL);
2921
2922                 return -1;
2923         }
2924         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2925
2926         return 0;
2927 }
2928
2929
2930 /**
2931  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2932  * @wpa_s: wpa_supplicant structure for a network interface
2933  * @ap_scan: AP scan mode
2934  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2935  *
2936  */
2937 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2938 {
2939
2940         int old_ap_scan;
2941
2942         if (ap_scan < 0 || ap_scan > 2)
2943                 return -1;
2944
2945         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2946                 wpa_printf(MSG_INFO,
2947                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2948         }
2949
2950 #ifdef ANDROID
2951         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2952             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2953             wpa_s->wpa_state < WPA_COMPLETED) {
2954                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2955                            "associating", wpa_s->conf->ap_scan, ap_scan);
2956                 return 0;
2957         }
2958 #endif /* ANDROID */
2959
2960         old_ap_scan = wpa_s->conf->ap_scan;
2961         wpa_s->conf->ap_scan = ap_scan;
2962
2963         if (old_ap_scan != wpa_s->conf->ap_scan)
2964                 wpas_notify_ap_scan_changed(wpa_s);
2965
2966         return 0;
2967 }
2968
2969
2970 /**
2971  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2972  * @wpa_s: wpa_supplicant structure for a network interface
2973  * @expire_age: Expiration age in seconds
2974  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2975  *
2976  */
2977 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2978                                           unsigned int bss_expire_age)
2979 {
2980         if (bss_expire_age < 10) {
2981                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2982                         bss_expire_age);
2983                 return -1;
2984         }
2985         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2986                 bss_expire_age);
2987         wpa_s->conf->bss_expiration_age = bss_expire_age;
2988
2989         return 0;
2990 }
2991
2992
2993 /**
2994  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2995  * @wpa_s: wpa_supplicant structure for a network interface
2996  * @expire_count: number of scans after which an unseen BSS is reclaimed
2997  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2998  *
2999  */
3000 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3001                                             unsigned int bss_expire_count)
3002 {
3003         if (bss_expire_count < 1) {
3004                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3005                         bss_expire_count);
3006                 return -1;
3007         }
3008         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3009                 bss_expire_count);
3010         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3011
3012         return 0;
3013 }
3014
3015
3016 /**
3017  * wpa_supplicant_set_scan_interval - Set scan interval
3018  * @wpa_s: wpa_supplicant structure for a network interface
3019  * @scan_interval: scan interval in seconds
3020  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3021  *
3022  */
3023 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3024                                      int scan_interval)
3025 {
3026         if (scan_interval < 0) {
3027                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3028                         scan_interval);
3029                 return -1;
3030         }
3031         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3032                 scan_interval);
3033         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3034
3035         return 0;
3036 }
3037
3038
3039 /**
3040  * wpa_supplicant_set_debug_params - Set global debug params
3041  * @global: wpa_global structure
3042  * @debug_level: debug level
3043  * @debug_timestamp: determines if show timestamp in debug data
3044  * @debug_show_keys: determines if show keys in debug data
3045  * Returns: 0 if succeed or -1 if debug_level has wrong value
3046  */
3047 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3048                                     int debug_timestamp, int debug_show_keys)
3049 {
3050
3051         int old_level, old_timestamp, old_show_keys;
3052
3053         /* check for allowed debuglevels */
3054         if (debug_level != MSG_EXCESSIVE &&
3055             debug_level != MSG_MSGDUMP &&
3056             debug_level != MSG_DEBUG &&
3057             debug_level != MSG_INFO &&
3058             debug_level != MSG_WARNING &&
3059             debug_level != MSG_ERROR)
3060                 return -1;
3061
3062         old_level = wpa_debug_level;
3063         old_timestamp = wpa_debug_timestamp;
3064         old_show_keys = wpa_debug_show_keys;
3065
3066         wpa_debug_level = debug_level;
3067         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3068         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3069
3070         if (wpa_debug_level != old_level)
3071                 wpas_notify_debug_level_changed(global);
3072         if (wpa_debug_timestamp != old_timestamp)
3073                 wpas_notify_debug_timestamp_changed(global);
3074         if (wpa_debug_show_keys != old_show_keys)
3075                 wpas_notify_debug_show_keys_changed(global);
3076
3077         return 0;
3078 }
3079
3080
3081 /**
3082  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3083  * @wpa_s: Pointer to wpa_supplicant data
3084  * Returns: A pointer to the current network structure or %NULL on failure
3085  */
3086 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3087 {
3088         struct wpa_ssid *entry;
3089         u8 ssid[SSID_MAX_LEN];
3090         int res;
3091         size_t ssid_len;
3092         u8 bssid[ETH_ALEN];
3093         int wired;
3094
3095         res = wpa_drv_get_ssid(wpa_s, ssid);
3096         if (res < 0) {
3097                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3098                         "driver");
3099                 return NULL;
3100         }
3101         ssid_len = res;
3102
3103         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3104                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3105                         "driver");
3106                 return NULL;
3107         }
3108
3109         wired = wpa_s->conf->ap_scan == 0 &&
3110                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3111
3112         entry = wpa_s->conf->ssid;
3113         while (entry) {
3114                 if (!wpas_network_disabled(wpa_s, entry) &&
3115                     ((ssid_len == entry->ssid_len &&
3116                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3117                     (!entry->bssid_set ||
3118                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3119                         return entry;
3120 #ifdef CONFIG_WPS
3121                 if (!wpas_network_disabled(wpa_s, entry) &&
3122                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3123                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3124                     (!entry->bssid_set ||
3125                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3126                         return entry;
3127 #endif /* CONFIG_WPS */
3128
3129                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3130                     entry->ssid_len == 0 &&
3131                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3132                         return entry;
3133
3134                 entry = entry->next;
3135         }
3136
3137         return NULL;
3138 }
3139
3140
3141 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3142 {
3143         struct wpa_global *global = wpa_s->global;
3144
3145         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3146                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3147                 if (global->drv_priv[i] == NULL) {
3148                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3149                                    "'%s'", wpa_drivers[i]->name);
3150                         return -1;
3151                 }
3152         }
3153
3154         wpa_s->driver = wpa_drivers[i];
3155         wpa_s->global_drv_priv = global->drv_priv[i];
3156
3157         return 0;
3158 }
3159
3160
3161 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3162                                      const char *name)
3163 {
3164         int i;
3165         size_t len;
3166         const char *pos, *driver = name;
3167
3168         if (wpa_s == NULL)
3169                 return -1;
3170
3171         if (wpa_drivers[0] == NULL) {
3172                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3173                         "wpa_supplicant");
3174                 return -1;
3175         }
3176
3177         if (name == NULL) {
3178                 /* default to first driver in the list */
3179                 return select_driver(wpa_s, 0);
3180         }
3181
3182         do {
3183                 pos = os_strchr(driver, ',');
3184                 if (pos)
3185                         len = pos - driver;
3186                 else
3187                         len = os_strlen(driver);
3188
3189                 for (i = 0; wpa_drivers[i]; i++) {
3190                         if (os_strlen(wpa_drivers[i]->name) == len &&
3191                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3192                             0) {
3193                                 /* First driver that succeeds wins */
3194                                 if (select_driver(wpa_s, i) == 0)
3195                                         return 0;
3196                         }
3197                 }
3198
3199                 driver = pos + 1;
3200         } while (pos);
3201
3202         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3203         return -1;
3204 }
3205
3206
3207 /**
3208  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3209  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3210  *      with struct wpa_driver_ops::init()
3211  * @src_addr: Source address of the EAPOL frame
3212  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3213  * @len: Length of the EAPOL data
3214  *
3215  * This function is called for each received EAPOL frame. Most driver
3216  * interfaces rely on more generic OS mechanism for receiving frames through
3217  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3218  * take care of received EAPOL frames and deliver them to the core supplicant
3219  * code by calling this function.
3220  */
3221 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3222                              const u8 *buf, size_t len)
3223 {
3224         struct wpa_supplicant *wpa_s = ctx;
3225
3226         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3227         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3228
3229 #ifdef CONFIG_PEERKEY
3230         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3231             wpa_s->current_ssid->peerkey &&
3232             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3233             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3234                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3235                 return;
3236         }
3237 #endif /* CONFIG_PEERKEY */
3238
3239         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3240             (wpa_s->last_eapol_matches_bssid &&
3241 #ifdef CONFIG_AP
3242              !wpa_s->ap_iface &&
3243 #endif /* CONFIG_AP */
3244              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3245                 /*
3246                  * There is possible race condition between receiving the
3247                  * association event and the EAPOL frame since they are coming
3248                  * through different paths from the driver. In order to avoid
3249                  * issues in trying to process the EAPOL frame before receiving
3250                  * association information, lets queue it for processing until
3251                  * the association event is received. This may also be needed in
3252                  * driver-based roaming case, so also use src_addr != BSSID as a
3253                  * trigger if we have previously confirmed that the
3254                  * Authenticator uses BSSID as the src_addr (which is not the
3255                  * case with wired IEEE 802.1X).
3256                  */
3257                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3258                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3259                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3260                         MAC2STR(wpa_s->bssid));
3261                 wpabuf_free(wpa_s->pending_eapol_rx);
3262                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3263                 if (wpa_s->pending_eapol_rx) {
3264                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3265                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3266                                   ETH_ALEN);
3267                 }
3268                 return;
3269         }
3270
3271         wpa_s->last_eapol_matches_bssid =
3272                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3273
3274 #ifdef CONFIG_AP
3275         if (wpa_s->ap_iface) {
3276                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3277                 return;
3278         }
3279 #endif /* CONFIG_AP */
3280
3281         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3282                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3283                         "no key management is configured");
3284                 return;
3285         }
3286
3287         if (wpa_s->eapol_received == 0 &&
3288             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3289              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3290              wpa_s->wpa_state != WPA_COMPLETED) &&
3291             (wpa_s->current_ssid == NULL ||
3292              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3293                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3294                 int timeout = 10;
3295
3296                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3297                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3298                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3299                         /* Use longer timeout for IEEE 802.1X/EAP */
3300                         timeout = 70;
3301                 }
3302
3303 #ifdef CONFIG_WPS
3304                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3305                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3306                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3307                         /*
3308                          * Use shorter timeout if going through WPS AP iteration
3309                          * for PIN config method with an AP that does not
3310                          * advertise Selected Registrar.
3311                          */
3312                         struct wpabuf *wps_ie;
3313
3314                         wps_ie = wpa_bss_get_vendor_ie_multi(
3315                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3316                         if (wps_ie &&
3317                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3318                                 timeout = 10;
3319                         wpabuf_free(wps_ie);
3320                 }
3321 #endif /* CONFIG_WPS */
3322
3323                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3324         }
3325         wpa_s->eapol_received++;
3326
3327         if (wpa_s->countermeasures) {
3328                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3329                         "EAPOL packet");
3330                 return;
3331         }
3332
3333 #ifdef CONFIG_IBSS_RSN
3334         if (wpa_s->current_ssid &&
3335             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3336                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3337                 return;
3338         }
3339 #endif /* CONFIG_IBSS_RSN */
3340
3341         /* Source address of the incoming EAPOL frame could be compared to the
3342          * current BSSID. However, it is possible that a centralized
3343          * Authenticator could be using another MAC address than the BSSID of
3344          * an AP, so just allow any address to be used for now. The replies are
3345          * still sent to the current BSSID (if available), though. */
3346
3347         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3348         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3349             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3350                 return;
3351         wpa_drv_poll(wpa_s);
3352         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3353                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3354         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3355                 /*
3356                  * Set portValid = TRUE here since we are going to skip 4-way
3357                  * handshake processing which would normally set portValid. We
3358                  * need this to allow the EAPOL state machines to be completed
3359                  * without going through EAPOL-Key handshake.
3360                  */
3361                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3362         }
3363 }
3364
3365
3366 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3367 {
3368         if ((!wpa_s->p2p_mgmt ||
3369              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3370             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3371                 l2_packet_deinit(wpa_s->l2);
3372                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3373                                            wpa_drv_get_mac_addr(wpa_s),
3374                                            ETH_P_EAPOL,
3375                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3376                 if (wpa_s->l2 == NULL)
3377                         return -1;
3378         } else {
3379                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3380                 if (addr)
3381                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3382         }
3383
3384         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3385                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3386                 return -1;
3387         }
3388
3389         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3390
3391         return 0;
3392 }
3393
3394
3395 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3396                                            const u8 *buf, size_t len)
3397 {
3398         struct wpa_supplicant *wpa_s = ctx;
3399         const struct l2_ethhdr *eth;
3400
3401         if (len < sizeof(*eth))
3402                 return;
3403         eth = (const struct l2_ethhdr *) buf;
3404
3405         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3406             !(eth->h_dest[0] & 0x01)) {
3407                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3408                         " (bridge - not for this interface - ignore)",
3409                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3410                 return;
3411         }
3412
3413         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3414                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3415         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3416                                 len - sizeof(*eth));
3417 }
3418
3419
3420 /**
3421  * wpa_supplicant_driver_init - Initialize driver interface parameters
3422  * @wpa_s: Pointer to wpa_supplicant data
3423  * Returns: 0 on success, -1 on failure
3424  *
3425  * This function is called to initialize driver interface parameters.
3426  * wpa_drv_init() must have been called before this function to initialize the
3427  * driver interface.
3428  */
3429 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3430 {
3431         static int interface_count = 0;
3432
3433         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3434                 return -1;
3435
3436         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3437                 MAC2STR(wpa_s->own_addr));
3438         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3439         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3440
3441         if (wpa_s->bridge_ifname[0]) {
3442                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3443                         "interface '%s'", wpa_s->bridge_ifname);
3444                 wpa_s->l2_br = l2_packet_init_bridge(
3445                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3446                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3447                 if (wpa_s->l2_br == NULL) {
3448                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3449                                 "connection for the bridge interface '%s'",
3450                                 wpa_s->bridge_ifname);
3451                         return -1;
3452                 }
3453         }
3454
3455         if (wpa_s->conf->ap_scan == 2 &&
3456             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3457                 wpa_printf(MSG_INFO,
3458                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3459         }
3460
3461         wpa_clear_keys(wpa_s, NULL);
3462
3463         /* Make sure that TKIP countermeasures are not left enabled (could
3464          * happen if wpa_supplicant is killed during countermeasures. */
3465         wpa_drv_set_countermeasures(wpa_s, 0);
3466
3467         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3468         wpa_drv_flush_pmkid(wpa_s);
3469
3470         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3471         wpa_s->prev_scan_wildcard = 0;
3472
3473         if (wpa_supplicant_enabled_networks(wpa_s)) {
3474                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3475                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3476                         interface_count = 0;
3477                 }
3478 #ifndef ANDROID
3479                 if (!wpa_s->p2p_mgmt &&
3480                     wpa_supplicant_delayed_sched_scan(wpa_s,
3481                                                       interface_count % 3,
3482                                                       100000))
3483                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3484                                                 100000);
3485 #endif /* ANDROID */
3486                 interface_count++;
3487         } else
3488                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3489
3490         return 0;
3491 }
3492
3493
3494 static int wpa_supplicant_daemon(const char *pid_file)
3495 {
3496         wpa_printf(MSG_DEBUG, "Daemonize..");
3497         return os_daemonize(pid_file);
3498 }
3499
3500
3501 static struct wpa_supplicant *
3502 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3503 {
3504         struct wpa_supplicant *wpa_s;
3505
3506         wpa_s = os_zalloc(sizeof(*wpa_s));
3507         if (wpa_s == NULL)
3508                 return NULL;
3509         wpa_s->scan_req = INITIAL_SCAN_REQ;
3510         wpa_s->scan_interval = 5;
3511         wpa_s->new_connection = 1;
3512         wpa_s->parent = parent ? parent : wpa_s;
3513         wpa_s->sched_scanning = 0;
3514
3515         dl_list_init(&wpa_s->bss_tmp_disallowed);
3516
3517         return wpa_s;
3518 }
3519
3520
3521 #ifdef CONFIG_HT_OVERRIDES
3522
3523 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3524                              struct ieee80211_ht_capabilities *htcaps,
3525                              struct ieee80211_ht_capabilities *htcaps_mask,
3526                              const char *ht_mcs)
3527 {
3528         /* parse ht_mcs into hex array */
3529         int i;
3530         const char *tmp = ht_mcs;
3531         char *end = NULL;
3532
3533         /* If ht_mcs is null, do not set anything */
3534         if (!ht_mcs)
3535                 return 0;
3536
3537         /* This is what we are setting in the kernel */
3538         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3539
3540         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3541
3542         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3543                 errno = 0;
3544                 long v = strtol(tmp, &end, 16);
3545                 if (errno == 0) {
3546                         wpa_msg(wpa_s, MSG_DEBUG,
3547                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3548                                 i, v, end, tmp);
3549                         if (end == tmp)
3550                                 break;
3551
3552                         htcaps->supported_mcs_set[i] = v;
3553                         tmp = end;
3554                 } else {
3555                         wpa_msg(wpa_s, MSG_ERROR,
3556                                 "Failed to parse ht-mcs: %s, error: %s\n",
3557                                 ht_mcs, strerror(errno));
3558                         return -1;
3559                 }
3560         }
3561
3562         /*
3563          * If we were able to parse any values, then set mask for the MCS set.
3564          */
3565         if (i) {
3566                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3567                           IEEE80211_HT_MCS_MASK_LEN - 1);
3568                 /* skip the 3 reserved bits */
3569                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3570                         0x1f;
3571         }
3572
3573         return 0;
3574 }
3575
3576
3577 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3578                                  struct ieee80211_ht_capabilities *htcaps,
3579                                  struct ieee80211_ht_capabilities *htcaps_mask,
3580                                  int disabled)
3581 {
3582         le16 msk;
3583
3584         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3585
3586         if (disabled == -1)
3587                 return 0;
3588
3589         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3590         htcaps_mask->ht_capabilities_info |= msk;
3591         if (disabled)
3592                 htcaps->ht_capabilities_info &= msk;
3593         else
3594                 htcaps->ht_capabilities_info |= msk;
3595
3596         return 0;
3597 }
3598
3599
3600 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3601                                 struct ieee80211_ht_capabilities *htcaps,
3602                                 struct ieee80211_ht_capabilities *htcaps_mask,
3603                                 int factor)
3604 {
3605         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3606
3607         if (factor == -1)
3608                 return 0;
3609
3610         if (factor < 0 || factor > 3) {
3611                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3612                         "Must be 0-3 or -1", factor);
3613                 return -EINVAL;
3614         }
3615
3616         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3617         htcaps->a_mpdu_params &= ~0x3;
3618         htcaps->a_mpdu_params |= factor & 0x3;
3619
3620         return 0;
3621 }
3622
3623
3624 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3625                                  struct ieee80211_ht_capabilities *htcaps,
3626                                  struct ieee80211_ht_capabilities *htcaps_mask,
3627                                  int density)
3628 {
3629         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3630
3631         if (density == -1)
3632                 return 0;
3633
3634         if (density < 0 || density > 7) {
3635                 wpa_msg(wpa_s, MSG_ERROR,
3636                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3637                         density);
3638                 return -EINVAL;
3639         }
3640
3641         htcaps_mask->a_mpdu_params |= 0x1C;
3642         htcaps->a_mpdu_params &= ~(0x1C);
3643         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3644
3645         return 0;
3646 }
3647
3648
3649 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3650                                 struct ieee80211_ht_capabilities *htcaps,
3651                                 struct ieee80211_ht_capabilities *htcaps_mask,
3652                                 int disabled)
3653 {
3654         /* Masking these out disables HT40 */
3655         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3656                                 HT_CAP_INFO_SHORT_GI40MHZ);
3657
3658         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3659
3660         if (disabled)
3661                 htcaps->ht_capabilities_info &= ~msk;
3662         else
3663                 htcaps->ht_capabilities_info |= msk;
3664
3665         htcaps_mask->ht_capabilities_info |= msk;
3666
3667         return 0;
3668 }
3669
3670
3671 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3672                                struct ieee80211_ht_capabilities *htcaps,
3673                                struct ieee80211_ht_capabilities *htcaps_mask,
3674                                int disabled)
3675 {
3676         /* Masking these out disables SGI */
3677         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3678                                 HT_CAP_INFO_SHORT_GI40MHZ);
3679
3680         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3681
3682         if (disabled)
3683                 htcaps->ht_capabilities_info &= ~msk;
3684         else
3685                 htcaps->ht_capabilities_info |= msk;
3686
3687         htcaps_mask->ht_capabilities_info |= msk;
3688
3689         return 0;
3690 }
3691
3692
3693 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3694                                struct ieee80211_ht_capabilities *htcaps,
3695                                struct ieee80211_ht_capabilities *htcaps_mask,
3696                                int disabled)
3697 {
3698         /* Masking these out disables LDPC */
3699         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3700
3701         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3702
3703         if (disabled)
3704                 htcaps->ht_capabilities_info &= ~msk;
3705         else
3706                 htcaps->ht_capabilities_info |= msk;
3707
3708         htcaps_mask->ht_capabilities_info |= msk;
3709
3710         return 0;
3711 }
3712
3713
3714 void wpa_supplicant_apply_ht_overrides(
3715         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3716         struct wpa_driver_associate_params *params)
3717 {
3718         struct ieee80211_ht_capabilities *htcaps;
3719         struct ieee80211_ht_capabilities *htcaps_mask;
3720
3721         if (!ssid)
3722                 return;
3723
3724         params->disable_ht = ssid->disable_ht;
3725         if (!params->htcaps || !params->htcaps_mask)
3726                 return;
3727
3728         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3729         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3730         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3731         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3732                               ssid->disable_max_amsdu);
3733         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3734         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3735         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3736         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3737         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3738
3739         if (ssid->ht40_intolerant) {
3740                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3741                 htcaps->ht_capabilities_info |= bit;
3742                 htcaps_mask->ht_capabilities_info |= bit;
3743         }
3744 }
3745
3746 #endif /* CONFIG_HT_OVERRIDES */
3747
3748
3749 #ifdef CONFIG_VHT_OVERRIDES
3750 void wpa_supplicant_apply_vht_overrides(
3751         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3752         struct wpa_driver_associate_params *params)
3753 {
3754         struct ieee80211_vht_capabilities *vhtcaps;
3755         struct ieee80211_vht_capabilities *vhtcaps_mask;
3756
3757         if (!ssid)
3758                 return;
3759
3760         params->disable_vht = ssid->disable_vht;
3761
3762         vhtcaps = (void *) params->vhtcaps;
3763         vhtcaps_mask = (void *) params->vhtcaps_mask;
3764
3765         if (!vhtcaps || !vhtcaps_mask)
3766                 return;
3767
3768         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3769         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3770
3771 #ifdef CONFIG_HT_OVERRIDES
3772         /* if max ampdu is <= 3, we have to make the HT cap the same */
3773         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3774                 int max_ampdu;
3775
3776                 max_ampdu = (ssid->vht_capa &
3777                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3778                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3779
3780                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3781                 wpa_set_ampdu_factor(wpa_s,
3782                                      (void *) params->htcaps,
3783                                      (void *) params->htcaps_mask,
3784                                      max_ampdu);
3785         }
3786 #endif /* CONFIG_HT_OVERRIDES */
3787
3788 #define OVERRIDE_MCS(i)                                                 \
3789         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3790                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3791                         3 << 2 * (i - 1);                               \
3792                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3793                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3794         }                                                               \
3795         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3796                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3797                         3 << 2 * (i - 1);                               \
3798                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3799                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3800         }
3801
3802         OVERRIDE_MCS(1);
3803         OVERRIDE_MCS(2);
3804         OVERRIDE_MCS(3);
3805         OVERRIDE_MCS(4);
3806         OVERRIDE_MCS(5);
3807         OVERRIDE_MCS(6);
3808         OVERRIDE_MCS(7);
3809         OVERRIDE_MCS(8);
3810 }
3811 #endif /* CONFIG_VHT_OVERRIDES */
3812
3813
3814 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3815 {
3816 #ifdef PCSC_FUNCS
3817         size_t len;
3818
3819         if (!wpa_s->conf->pcsc_reader)
3820                 return 0;
3821
3822         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3823         if (!wpa_s->scard)
3824                 return 1;
3825
3826         if (wpa_s->conf->pcsc_pin &&
3827             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3828                 scard_deinit(wpa_s->scard);
3829                 wpa_s->scard = NULL;
3830                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3831                 return -1;
3832         }
3833
3834         len = sizeof(wpa_s->imsi) - 1;
3835         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3836                 scard_deinit(wpa_s->scard);
3837                 wpa_s->scard = NULL;
3838                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3839                 return -1;
3840         }
3841         wpa_s->imsi[len] = '\0';
3842
3843         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3844
3845         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3846                    wpa_s->imsi, wpa_s->mnc_len);
3847
3848         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3849         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3850 #endif /* PCSC_FUNCS */
3851
3852         return 0;
3853 }
3854
3855
3856 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3857 {
3858         char *val, *pos;
3859
3860         ext_password_deinit(wpa_s->ext_pw);
3861         wpa_s->ext_pw = NULL;
3862         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3863
3864         if (!wpa_s->conf->ext_password_backend)
3865                 return 0;
3866
3867         val = os_strdup(wpa_s->conf->ext_password_backend);
3868         if (val == NULL)
3869                 return -1;
3870         pos = os_strchr(val, ':');
3871         if (pos)
3872                 *pos++ = '\0';
3873
3874         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3875
3876         wpa_s->ext_pw = ext_password_init(val, pos);
3877         os_free(val);
3878         if (wpa_s->ext_pw == NULL) {
3879                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3880                 return -1;
3881         }
3882         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3883
3884         return 0;
3885 }
3886
3887
3888 #ifdef CONFIG_FST
3889
3890 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3891 {
3892         struct wpa_supplicant *wpa_s = ctx;
3893
3894         return (is_zero_ether_addr(wpa_s->bssid) ||
3895                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3896 }
3897
3898
3899 static void wpas_fst_get_channel_info_cb(void *ctx,
3900                                          enum hostapd_hw_mode *hw_mode,
3901                                          u8 *channel)
3902 {
3903         struct wpa_supplicant *wpa_s = ctx;
3904
3905         if (wpa_s->current_bss) {
3906                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3907                                                   channel);
3908         } else if (wpa_s->hw.num_modes) {
3909                 *hw_mode = wpa_s->hw.modes[0].mode;
3910         } else {
3911                 WPA_ASSERT(0);
3912                 *hw_mode = 0;
3913         }
3914 }
3915
3916
3917 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3918 {
3919         struct wpa_supplicant *wpa_s = ctx;
3920
3921         *modes = wpa_s->hw.modes;
3922         return wpa_s->hw.num_modes;
3923 }
3924
3925
3926 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3927 {
3928         struct wpa_supplicant *wpa_s = ctx;
3929
3930         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3931         wpa_s->fst_ies = fst_ies;
3932 }
3933
3934
3935 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3936 {
3937         struct wpa_supplicant *wpa_s = ctx;
3938
3939         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3940         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3941                                           wpa_s->own_addr, wpa_s->bssid,
3942                                           wpabuf_head(data), wpabuf_len(data),
3943                                    0);
3944 }
3945
3946
3947 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3948 {
3949         struct wpa_supplicant *wpa_s = ctx;
3950
3951         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3952         return wpa_s->received_mb_ies;
3953 }
3954
3955
3956 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3957                                      const u8 *buf, size_t size)
3958 {
3959         struct wpa_supplicant *wpa_s = ctx;
3960         struct mb_ies_info info;
3961
3962         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3963
3964         if (!mb_ies_info_by_ies(&info, buf, size)) {
3965                 wpabuf_free(wpa_s->received_mb_ies);
3966                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3967         }
3968 }
3969
3970
3971 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3972                                    Boolean mb_only)
3973 {
3974         struct wpa_supplicant *wpa_s = ctx;
3975
3976         *get_ctx = NULL;
3977         if (!is_zero_ether_addr(wpa_s->bssid))
3978                 return (wpa_s->received_mb_ies || !mb_only) ?
3979                         wpa_s->bssid : NULL;
3980         return NULL;
3981 }
3982
3983
3984 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3985                                   Boolean mb_only)
3986 {
3987         return NULL;
3988 }
3989
3990 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3991                                        struct fst_wpa_obj *iface_obj)
3992 {
3993         iface_obj->ctx              = wpa_s;
3994         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3995         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3996         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3997         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3998         iface_obj->send_action      = wpas_fst_send_action_cb;
3999         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4000         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4001         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4002         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4003 }
4004 #endif /* CONFIG_FST */
4005
4006 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4007                                     const struct wpa_driver_capa *capa)
4008 {
4009         struct wowlan_triggers *triggers;
4010         int ret = 0;
4011
4012         if (!wpa_s->conf->wowlan_triggers)
4013                 return 0;
4014
4015         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4016         if (triggers) {
4017                 ret = wpa_drv_wowlan(wpa_s, triggers);
4018                 os_free(triggers);
4019         }
4020         return ret;
4021 }
4022
4023
4024 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
4025 {
4026         if (freq < 3000)
4027                 return BAND_2_4_GHZ;
4028         if (freq > 50000)
4029                 return BAND_60_GHZ;
4030         return BAND_5_GHZ;
4031 }
4032
4033
4034 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
4035                                    const int *freqs)
4036 {
4037         int i;
4038         unsigned int band = 0;
4039
4040         if (freqs) {
4041                 /* freqs are specified for the radio work */
4042                 for (i = 0; freqs[i]; i++)
4043                         band |= wpas_freq_to_band(freqs[i]);
4044         } else {
4045                 /*
4046                  * freqs are not specified, implies all
4047                  * the supported freqs by HW
4048                  */
4049                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4050                         if (wpa_s->hw.modes[i].num_channels != 0) {
4051                                 if (wpa_s->hw.modes[i].mode ==
4052                                     HOSTAPD_MODE_IEEE80211B ||
4053                                     wpa_s->hw.modes[i].mode ==
4054                                     HOSTAPD_MODE_IEEE80211G)
4055                                         band |= BAND_2_4_GHZ;
4056                                 else if (wpa_s->hw.modes[i].mode ==
4057                                          HOSTAPD_MODE_IEEE80211A)
4058                                         band |= BAND_5_GHZ;
4059                                 else if (wpa_s->hw.modes[i].mode ==
4060                                          HOSTAPD_MODE_IEEE80211AD)
4061                                         band |= BAND_60_GHZ;
4062                                 else if (wpa_s->hw.modes[i].mode ==
4063                                          HOSTAPD_MODE_IEEE80211ANY)
4064                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4065                                                 BAND_60_GHZ;
4066                         }
4067                 }
4068         }
4069
4070         return band;
4071 }
4072
4073
4074 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4075                                               const char *rn)
4076 {
4077         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4078         struct wpa_radio *radio;
4079
4080         while (rn && iface) {
4081                 radio = iface->radio;
4082                 if (radio && os_strcmp(rn, radio->name) == 0) {
4083                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4084                                    wpa_s->ifname, rn);
4085                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4086                         return radio;
4087                 }
4088
4089                 iface = iface->next;
4090         }
4091
4092         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4093                    wpa_s->ifname, rn ? rn : "N/A");
4094         radio = os_zalloc(sizeof(*radio));
4095         if (radio == NULL)
4096                 return NULL;
4097
4098         if (rn)
4099                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4100         dl_list_init(&radio->ifaces);
4101         dl_list_init(&radio->work);
4102         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4103
4104         return radio;
4105 }
4106
4107
4108 static void radio_work_free(struct wpa_radio_work *work)
4109 {
4110         if (work->wpa_s->scan_work == work) {
4111                 /* This should not really happen. */
4112                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4113                         work->type, work, work->started);
4114                 work->wpa_s->scan_work = NULL;
4115         }
4116
4117 #ifdef CONFIG_P2P
4118         if (work->wpa_s->p2p_scan_work == work) {
4119                 /* This should not really happen. */
4120                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4121                         work->type, work, work->started);
4122                 work->wpa_s->p2p_scan_work = NULL;
4123         }
4124 #endif /* CONFIG_P2P */
4125
4126         if (work->started) {
4127                 work->wpa_s->radio->num_active_works--;
4128                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4129                         "radio_work_free('%s'@%p: num_active_works --> %u",
4130                         work->type, work,
4131                         work->wpa_s->radio->num_active_works);
4132         }
4133
4134         dl_list_del(&work->list);
4135         os_free(work);
4136 }
4137
4138
4139 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4140 {
4141         struct wpa_radio_work *active_work = NULL;
4142         struct wpa_radio_work *tmp;
4143
4144         /* Get the active work to know the type and band. */
4145         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4146                 if (tmp->started) {
4147                         active_work = tmp;
4148                         break;
4149                 }
4150         }
4151
4152         if (!active_work) {
4153                 /* No active work, start one */
4154                 radio->num_active_works = 0;
4155                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4156                                  list) {
4157                         if (os_strcmp(tmp->type, "scan") == 0 &&
4158                             radio->external_scan_running &&
4159                             (((struct wpa_driver_scan_params *)
4160                               tmp->ctx)->only_new_results ||
4161                              tmp->wpa_s->clear_driver_scan_cache))
4162                                 continue;
4163                         return tmp;
4164                 }
4165                 return NULL;
4166         }
4167
4168         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4169             os_strcmp(active_work->type, "connect") == 0) {
4170                 /*
4171                  * If the active work is either connect or sme-connect,
4172                  * do not parallelize them with other radio works.
4173                  */
4174                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4175                         "Do not parallelize radio work with %s",
4176                         active_work->type);
4177                 return NULL;
4178         }
4179
4180         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4181                 if (tmp->started)
4182                         continue;
4183
4184                 /*
4185                  * If connect or sme-connect are enqueued, parallelize only
4186                  * those operations ahead of them in the queue.
4187                  */
4188                 if (os_strcmp(tmp->type, "connect") == 0 ||
4189                     os_strcmp(tmp->type, "sme-connect") == 0)
4190                         break;
4191
4192                 /*
4193                  * Check that the radio works are distinct and
4194                  * on different bands.
4195                  */
4196                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4197                     (active_work->bands != tmp->bands)) {
4198                         /*
4199                          * If a scan has to be scheduled through nl80211 scan
4200                          * interface and if an external scan is already running,
4201                          * do not schedule the scan since it is likely to get
4202                          * rejected by kernel.
4203                          */
4204                         if (os_strcmp(tmp->type, "scan") == 0 &&
4205                             radio->external_scan_running &&
4206                             (((struct wpa_driver_scan_params *)
4207                               tmp->ctx)->only_new_results ||
4208                              tmp->wpa_s->clear_driver_scan_cache))
4209                                 continue;
4210
4211                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4212                                 "active_work:%s new_work:%s",
4213                                 active_work->type, tmp->type);
4214                         return tmp;
4215                 }
4216         }
4217
4218         /* Did not find a radio work to schedule in parallel. */
4219         return NULL;
4220 }
4221
4222
4223 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4224 {
4225         struct wpa_radio *radio = eloop_ctx;
4226         struct wpa_radio_work *work;
4227         struct os_reltime now, diff;
4228         struct wpa_supplicant *wpa_s;
4229
4230         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4231         if (work == NULL) {
4232                 radio->num_active_works = 0;
4233                 return;
4234         }
4235
4236         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4237                               radio_list);
4238
4239         if (!(wpa_s &&
4240               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4241                 if (work->started)
4242                         return; /* already started and still in progress */
4243
4244                 if (wpa_s && wpa_s->radio->external_scan_running) {
4245                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4246                         return;
4247                 }
4248         } else {
4249                 work = NULL;
4250                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4251                         /* get the work to schedule next */
4252                         work = radio_work_get_next_work(radio);
4253                 }
4254                 if (!work)
4255                         return;
4256         }
4257
4258         wpa_s = work->wpa_s;
4259         os_get_reltime(&now);
4260         os_reltime_sub(&now, &work->time, &diff);
4261         wpa_dbg(wpa_s, MSG_DEBUG,
4262                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4263                 work->type, work, diff.sec, diff.usec);
4264         work->started = 1;
4265         work->time = now;
4266         radio->num_active_works++;
4267
4268         work->cb(work, 0);
4269
4270         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4271             radio->num_active_works < MAX_ACTIVE_WORKS)
4272                 radio_work_check_next(wpa_s);
4273 }
4274
4275
4276 /*
4277  * This function removes both started and pending radio works running on
4278  * the provided interface's radio.
4279  * Prior to the removal of the radio work, its callback (cb) is called with
4280  * deinit set to be 1. Each work's callback is responsible for clearing its
4281  * internal data and restoring to a correct state.
4282  * @wpa_s: wpa_supplicant data
4283  * @type: type of works to be removed
4284  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4285  * this interface's works.
4286  */
4287 void radio_remove_works(struct wpa_supplicant *wpa_s,
4288                         const char *type, int remove_all)
4289 {
4290         struct wpa_radio_work *work, *tmp;
4291         struct wpa_radio *radio = wpa_s->radio;
4292
4293         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4294                               list) {
4295                 if (type && os_strcmp(type, work->type) != 0)
4296                         continue;
4297
4298                 /* skip other ifaces' works */
4299                 if (!remove_all && work->wpa_s != wpa_s)
4300                         continue;
4301
4302                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4303                         work->type, work, work->started ? " (started)" : "");
4304                 work->cb(work, 1);
4305                 radio_work_free(work);
4306         }
4307
4308         /* in case we removed the started work */
4309         radio_work_check_next(wpa_s);
4310 }
4311
4312
4313 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4314 {
4315         struct wpa_radio *radio = wpa_s->radio;
4316
4317         if (!radio)
4318                 return;
4319
4320         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4321                    wpa_s->ifname, radio->name);
4322         dl_list_del(&wpa_s->radio_list);
4323         radio_remove_works(wpa_s, NULL, 0);
4324         wpa_s->radio = NULL;
4325         if (!dl_list_empty(&radio->ifaces))
4326                 return; /* Interfaces remain for this radio */
4327
4328         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4329         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4330         os_free(radio);
4331 }
4332
4333
4334 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4335 {
4336         struct wpa_radio *radio = wpa_s->radio;
4337
4338         if (dl_list_empty(&radio->work))
4339                 return;
4340         if (wpa_s->ext_work_in_progress) {
4341                 wpa_printf(MSG_DEBUG,
4342                            "External radio work in progress - delay start of pending item");
4343                 return;
4344         }
4345         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4346         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4347 }
4348
4349
4350 /**
4351  * radio_add_work - Add a radio work item
4352  * @wpa_s: Pointer to wpa_supplicant data
4353  * @freq: Frequency of the offchannel operation in MHz or 0
4354  * @type: Unique identifier for each type of work
4355  * @next: Force as the next work to be executed
4356  * @cb: Callback function for indicating when radio is available
4357  * @ctx: Context pointer for the work (work->ctx in cb())
4358  * Returns: 0 on success, -1 on failure
4359  *
4360  * This function is used to request time for an operation that requires
4361  * exclusive radio control. Once the radio is available, the registered callback
4362  * function will be called. radio_work_done() must be called once the exclusive
4363  * radio operation has been completed, so that the radio is freed for other
4364  * operations. The special case of deinit=1 is used to free the context data
4365  * during interface removal. That does not allow the callback function to start
4366  * the radio operation, i.e., it must free any resources allocated for the radio
4367  * work and return.
4368  *
4369  * The @freq parameter can be used to indicate a single channel on which the
4370  * offchannel operation will occur. This may allow multiple radio work
4371  * operations to be performed in parallel if they apply for the same channel.
4372  * Setting this to 0 indicates that the work item may use multiple channels or
4373  * requires exclusive control of the radio.
4374  */
4375 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4376                    const char *type, int next,
4377                    void (*cb)(struct wpa_radio_work *work, int deinit),
4378                    void *ctx)
4379 {
4380         struct wpa_radio *radio = wpa_s->radio;
4381         struct wpa_radio_work *work;
4382         int was_empty;
4383
4384         work = os_zalloc(sizeof(*work));
4385         if (work == NULL)
4386                 return -1;
4387         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4388         os_get_reltime(&work->time);
4389         work->freq = freq;
4390         work->type = type;
4391         work->wpa_s = wpa_s;
4392         work->cb = cb;
4393         work->ctx = ctx;
4394
4395         if (freq)
4396                 work->bands = wpas_freq_to_band(freq);
4397         else if (os_strcmp(type, "scan") == 0 ||
4398                  os_strcmp(type, "p2p-scan") == 0)
4399                 work->bands = wpas_get_bands(wpa_s,
4400                                              ((struct wpa_driver_scan_params *)
4401                                               ctx)->freqs);
4402         else
4403                 work->bands = wpas_get_bands(wpa_s, NULL);
4404
4405         was_empty = dl_list_empty(&wpa_s->radio->work);
4406         if (next)
4407                 dl_list_add(&wpa_s->radio->work, &work->list);
4408         else
4409                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4410         if (was_empty) {
4411                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4412                 radio_work_check_next(wpa_s);
4413         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4414                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4415                 wpa_dbg(wpa_s, MSG_DEBUG,
4416                         "Try to schedule a radio work (num_active_works=%u)",
4417                         radio->num_active_works);
4418                 radio_work_check_next(wpa_s);
4419         }
4420
4421         return 0;
4422 }
4423
4424
4425 /**
4426  * radio_work_done - Indicate that a radio work item has been completed
4427  * @work: Completed work
4428  *
4429  * This function is called once the callback function registered with
4430  * radio_add_work() has completed its work.
4431  */
4432 void radio_work_done(struct wpa_radio_work *work)
4433 {
4434         struct wpa_supplicant *wpa_s = work->wpa_s;
4435         struct os_reltime now, diff;
4436         unsigned int started = work->started;
4437
4438         os_get_reltime(&now);
4439         os_reltime_sub(&now, &work->time, &diff);
4440         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4441                 work->type, work, started ? "done" : "canceled",
4442                 diff.sec, diff.usec);
4443         radio_work_free(work);
4444         if (started)
4445                 radio_work_check_next(wpa_s);
4446 }
4447
4448
4449 struct wpa_radio_work *
4450 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4451 {
4452         struct wpa_radio_work *work;
4453         struct wpa_radio *radio = wpa_s->radio;
4454
4455         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4456                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4457                         return work;
4458         }
4459
4460         return NULL;
4461 }
4462
4463
4464 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4465                             struct wpa_interface *iface)
4466 {
4467         const char *ifname, *driver, *rn;
4468
4469         driver = iface->driver;
4470 next_driver:
4471         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4472                 return -1;
4473
4474         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4475         if (wpa_s->drv_priv == NULL) {
4476                 const char *pos;
4477                 pos = driver ? os_strchr(driver, ',') : NULL;
4478                 if (pos) {
4479                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4480                                 "driver interface - try next driver wrapper");
4481                         driver = pos + 1;
4482                         goto next_driver;
4483                 }
4484                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4485                         "interface");
4486                 return -1;
4487         }
4488         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4489                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4490                         "driver_param '%s'", wpa_s->conf->driver_param);
4491                 return -1;
4492         }
4493
4494         ifname = wpa_drv_get_ifname(wpa_s);
4495         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4496                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4497                         "interface name with '%s'", ifname);
4498                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4499         }
4500
4501         rn = wpa_driver_get_radio_name(wpa_s);
4502         if (rn && rn[0] == '\0')
4503                 rn = NULL;
4504
4505         wpa_s->radio = radio_add_interface(wpa_s, rn);
4506         if (wpa_s->radio == NULL)
4507                 return -1;
4508
4509         return 0;
4510 }
4511
4512
4513 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4514                                      struct wpa_interface *iface)
4515 {
4516         struct wpa_driver_capa capa;
4517         int capa_res;
4518
4519         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4520                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4521                    iface->confname ? iface->confname : "N/A",
4522                    iface->driver ? iface->driver : "default",
4523                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4524                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4525
4526         if (iface->confname) {
4527 #ifdef CONFIG_BACKEND_FILE
4528                 wpa_s->confname = os_rel2abs_path(iface->confname);
4529                 if (wpa_s->confname == NULL) {
4530                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4531                                    "for configuration file '%s'.",
4532                                    iface->confname);
4533                         return -1;
4534                 }
4535                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4536                            iface->confname, wpa_s->confname);
4537 #else /* CONFIG_BACKEND_FILE */
4538                 wpa_s->confname = os_strdup(iface->confname);
4539 #endif /* CONFIG_BACKEND_FILE */
4540                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4541                 if (wpa_s->conf == NULL) {
4542                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4543                                    "configuration '%s'.", wpa_s->confname);
4544                         return -1;
4545                 }
4546                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4547                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4548
4549                 /*
4550                  * Override ctrl_interface and driver_param if set on command
4551                  * line.
4552                  */
4553                 if (iface->ctrl_interface) {
4554                         os_free(wpa_s->conf->ctrl_interface);
4555                         wpa_s->conf->ctrl_interface =
4556                                 os_strdup(iface->ctrl_interface);
4557                 }
4558
4559                 if (iface->driver_param) {
4560                         os_free(wpa_s->conf->driver_param);
4561                         wpa_s->conf->driver_param =
4562                                 os_strdup(iface->driver_param);
4563                 }
4564
4565                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4566                         os_free(wpa_s->conf->ctrl_interface);
4567                         wpa_s->conf->ctrl_interface = NULL;
4568                 }
4569         } else
4570                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4571                                                      iface->driver_param);
4572
4573         if (wpa_s->conf == NULL) {
4574                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4575                 return -1;
4576         }
4577
4578         if (iface->ifname == NULL) {
4579                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4580                 return -1;
4581         }
4582         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4583                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4584                            iface->ifname);
4585                 return -1;
4586         }
4587         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4588
4589         if (iface->bridge_ifname) {
4590                 if (os_strlen(iface->bridge_ifname) >=
4591                     sizeof(wpa_s->bridge_ifname)) {
4592                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4593                                    "name '%s'.", iface->bridge_ifname);
4594                         return -1;
4595                 }
4596                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4597                            sizeof(wpa_s->bridge_ifname));
4598         }
4599
4600         /* RSNA Supplicant Key Management - INITIALIZE */
4601         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4602         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4603
4604         /* Initialize driver interface and register driver event handler before
4605          * L2 receive handler so that association events are processed before
4606          * EAPOL-Key packets if both become available for the same select()
4607          * call. */
4608         if (wpas_init_driver(wpa_s, iface) < 0)
4609                 return -1;
4610
4611         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4612                 return -1;
4613
4614         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4615                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4616                           NULL);
4617         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4618
4619         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4620             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4621                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4622                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4623                         "dot11RSNAConfigPMKLifetime");
4624                 return -1;
4625         }
4626
4627         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4628             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4629                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4630                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4631                         "dot11RSNAConfigPMKReauthThreshold");
4632                 return -1;
4633         }
4634
4635         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4636             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4637                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4638                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4639                         "dot11RSNAConfigSATimeout");
4640                 return -1;
4641         }
4642
4643         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4644                                                       &wpa_s->hw.num_modes,
4645                                                       &wpa_s->hw.flags);
4646         if (wpa_s->hw.modes) {
4647                 u16 i;
4648
4649                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4650                         if (wpa_s->hw.modes[i].vht_capab) {
4651                                 wpa_s->hw_capab = CAPAB_VHT;
4652                                 break;
4653                         }
4654
4655                         if (wpa_s->hw.modes[i].ht_capab &
4656                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4657                                 wpa_s->hw_capab = CAPAB_HT40;
4658                         else if (wpa_s->hw.modes[i].ht_capab &&
4659                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4660                                 wpa_s->hw_capab = CAPAB_HT;
4661                 }
4662         }
4663
4664         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4665         if (capa_res == 0) {
4666                 wpa_s->drv_capa_known = 1;
4667                 wpa_s->drv_flags = capa.flags;
4668                 wpa_s->drv_enc = capa.enc;
4669                 wpa_s->drv_smps_modes = capa.smps_modes;
4670                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4671                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4672                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4673                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4674                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4675                 wpa_s->max_sched_scan_plan_interval =
4676                         capa.max_sched_scan_plan_interval;
4677                 wpa_s->max_sched_scan_plan_iterations =
4678                         capa.max_sched_scan_plan_iterations;
4679                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4680                 wpa_s->max_match_sets = capa.max_match_sets;
4681                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4682                 wpa_s->max_stations = capa.max_stations;
4683                 wpa_s->extended_capa = capa.extended_capa;
4684                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4685                 wpa_s->extended_capa_len = capa.extended_capa_len;
4686                 wpa_s->num_multichan_concurrent =
4687                         capa.num_multichan_concurrent;
4688                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4689
4690                 if (capa.mac_addr_rand_scan_supported)
4691                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4692                 if (wpa_s->sched_scan_supported &&
4693                     capa.mac_addr_rand_sched_scan_supported)
4694                         wpa_s->mac_addr_rand_supported |=
4695                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4696         }
4697         if (wpa_s->max_remain_on_chan == 0)
4698                 wpa_s->max_remain_on_chan = 1000;
4699
4700         /*
4701          * Only take p2p_mgmt parameters when P2P Device is supported.
4702          * Doing it here as it determines whether l2_packet_init() will be done
4703          * during wpa_supplicant_driver_init().
4704          */
4705         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4706                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4707         else
4708                 iface->p2p_mgmt = 1;
4709
4710         if (wpa_s->num_multichan_concurrent == 0)
4711                 wpa_s->num_multichan_concurrent = 1;
4712
4713         if (wpa_supplicant_driver_init(wpa_s) < 0)
4714                 return -1;
4715
4716 #ifdef CONFIG_TDLS
4717         if ((!iface->p2p_mgmt ||
4718              !(wpa_s->drv_flags &
4719                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4720             wpa_tdls_init(wpa_s->wpa))
4721                 return -1;
4722 #endif /* CONFIG_TDLS */
4723
4724         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4725             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4726                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4727                 return -1;
4728         }
4729
4730 #ifdef CONFIG_FST
4731         if (wpa_s->conf->fst_group_id) {
4732                 struct fst_iface_cfg cfg;
4733                 struct fst_wpa_obj iface_obj;
4734
4735                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4736                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4737                            sizeof(cfg.group_id));
4738                 cfg.priority = wpa_s->conf->fst_priority;
4739                 cfg.llt = wpa_s->conf->fst_llt;
4740
4741                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4742                                         &iface_obj, &cfg);
4743                 if (!wpa_s->fst) {
4744                         wpa_msg(wpa_s, MSG_ERROR,
4745                                 "FST: Cannot attach iface %s to group %s",
4746                                 wpa_s->ifname, cfg.group_id);
4747                         return -1;
4748                 }
4749         }
4750 #endif /* CONFIG_FST */
4751
4752         if (wpas_wps_init(wpa_s))
4753                 return -1;
4754
4755         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4756                 return -1;
4757         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4758
4759         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4760         if (wpa_s->ctrl_iface == NULL) {
4761                 wpa_printf(MSG_ERROR,
4762                            "Failed to initialize control interface '%s'.\n"
4763                            "You may have another wpa_supplicant process "
4764                            "already running or the file was\n"
4765                            "left by an unclean termination of wpa_supplicant "
4766                            "in which case you will need\n"
4767                            "to manually remove this file before starting "
4768                            "wpa_supplicant again.\n",
4769                            wpa_s->conf->ctrl_interface);
4770                 return -1;
4771         }
4772
4773         wpa_s->gas = gas_query_init(wpa_s);
4774         if (wpa_s->gas == NULL) {
4775                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4776                 return -1;
4777         }
4778
4779         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4780                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4781                 return -1;
4782         }
4783
4784         if (wpa_bss_init(wpa_s) < 0)
4785                 return -1;
4786
4787         /*
4788          * Set Wake-on-WLAN triggers, if configured.
4789          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4790          * have effect anyway when the interface is down).
4791          */
4792         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4793                 return -1;
4794
4795 #ifdef CONFIG_EAP_PROXY
4796 {
4797         size_t len;
4798         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4799                                                      &len);
4800         if (wpa_s->mnc_len > 0) {
4801                 wpa_s->imsi[len] = '\0';
4802                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4803                            wpa_s->imsi, wpa_s->mnc_len);
4804         } else {
4805                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4806         }
4807 }
4808 #endif /* CONFIG_EAP_PROXY */
4809
4810         if (pcsc_reader_init(wpa_s) < 0)
4811                 return -1;
4812
4813         if (wpas_init_ext_pw(wpa_s) < 0)
4814                 return -1;
4815
4816         wpas_rrm_reset(wpa_s);
4817
4818         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4819
4820 #ifdef CONFIG_HS20
4821         hs20_init(wpa_s);
4822 #endif /* CONFIG_HS20 */
4823 #ifdef CONFIG_MBO
4824         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4825 #endif /* CONFIG_MBO */
4826
4827         return 0;
4828 }
4829
4830
4831 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4832                                         int notify, int terminate)
4833 {
4834         struct wpa_global *global = wpa_s->global;
4835         struct wpa_supplicant *iface, *prev;
4836
4837         if (wpa_s == wpa_s->parent)
4838                 wpas_p2p_group_remove(wpa_s, "*");
4839
4840         iface = global->ifaces;
4841         while (iface) {
4842                 if (iface == wpa_s || iface->parent != wpa_s) {
4843                         iface = iface->next;
4844                         continue;
4845                 }
4846                 wpa_printf(MSG_DEBUG,
4847                            "Remove remaining child interface %s from parent %s",
4848                            iface->ifname, wpa_s->ifname);
4849                 prev = iface;
4850                 iface = iface->next;
4851                 wpa_supplicant_remove_iface(global, prev, terminate);
4852         }
4853
4854         wpa_s->disconnected = 1;
4855         if (wpa_s->drv_priv) {
4856                 wpa_supplicant_deauthenticate(wpa_s,
4857                                               WLAN_REASON_DEAUTH_LEAVING);
4858
4859                 wpa_drv_set_countermeasures(wpa_s, 0);
4860                 wpa_clear_keys(wpa_s, NULL);
4861         }
4862
4863         wpa_supplicant_cleanup(wpa_s);
4864         wpas_p2p_deinit_iface(wpa_s);
4865
4866         wpas_ctrl_radio_work_flush(wpa_s);
4867         radio_remove_interface(wpa_s);
4868
4869 #ifdef CONFIG_FST
4870         if (wpa_s->fst) {
4871                 fst_detach(wpa_s->fst);
4872                 wpa_s->fst = NULL;
4873         }
4874         if (wpa_s->received_mb_ies) {
4875                 wpabuf_free(wpa_s->received_mb_ies);
4876                 wpa_s->received_mb_ies = NULL;
4877         }
4878 #endif /* CONFIG_FST */
4879
4880         if (wpa_s->drv_priv)
4881                 wpa_drv_deinit(wpa_s);
4882
4883         if (notify)
4884                 wpas_notify_iface_removed(wpa_s);
4885
4886         if (terminate)
4887                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4888
4889         if (wpa_s->ctrl_iface) {
4890                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4891                 wpa_s->ctrl_iface = NULL;
4892         }
4893
4894 #ifdef CONFIG_MESH
4895         if (wpa_s->ifmsh) {
4896                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4897                 wpa_s->ifmsh = NULL;
4898         }
4899 #endif /* CONFIG_MESH */
4900
4901         if (wpa_s->conf != NULL) {
4902                 wpa_config_free(wpa_s->conf);
4903                 wpa_s->conf = NULL;
4904         }
4905
4906         os_free(wpa_s->ssids_from_scan_req);
4907
4908         os_free(wpa_s);
4909 }
4910
4911
4912 /**
4913  * wpa_supplicant_add_iface - Add a new network interface
4914  * @global: Pointer to global data from wpa_supplicant_init()
4915  * @iface: Interface configuration options
4916  * @parent: Parent interface or %NULL to assign new interface as parent
4917  * Returns: Pointer to the created interface or %NULL on failure
4918  *
4919  * This function is used to add new network interfaces for %wpa_supplicant.
4920  * This can be called before wpa_supplicant_run() to add interfaces before the
4921  * main event loop has been started. In addition, new interfaces can be added
4922  * dynamically while %wpa_supplicant is already running. This could happen,
4923  * e.g., when a hotplug network adapter is inserted.
4924  */
4925 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4926                                                  struct wpa_interface *iface,
4927                                                  struct wpa_supplicant *parent)
4928 {
4929         struct wpa_supplicant *wpa_s;
4930         struct wpa_interface t_iface;
4931         struct wpa_ssid *ssid;
4932
4933         if (global == NULL || iface == NULL)
4934                 return NULL;
4935
4936         wpa_s = wpa_supplicant_alloc(parent);
4937         if (wpa_s == NULL)
4938                 return NULL;
4939
4940         wpa_s->global = global;
4941
4942         t_iface = *iface;
4943         if (global->params.override_driver) {
4944                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4945                            "('%s' -> '%s')",
4946                            iface->driver, global->params.override_driver);
4947                 t_iface.driver = global->params.override_driver;
4948         }
4949         if (global->params.override_ctrl_interface) {
4950                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4951                            "ctrl_interface ('%s' -> '%s')",
4952                            iface->ctrl_interface,
4953                            global->params.override_ctrl_interface);
4954                 t_iface.ctrl_interface =
4955                         global->params.override_ctrl_interface;
4956         }
4957         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4958                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4959                            iface->ifname);
4960                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4961                 return NULL;
4962         }
4963
4964         if (iface->p2p_mgmt == 0) {
4965                 /* Notify the control interfaces about new iface */
4966                 if (wpas_notify_iface_added(wpa_s)) {
4967                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4968                         return NULL;
4969                 }
4970
4971                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4972                         wpas_notify_network_added(wpa_s, ssid);
4973         }
4974
4975         wpa_s->next = global->ifaces;
4976         global->ifaces = wpa_s;
4977
4978         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4979         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4980
4981 #ifdef CONFIG_P2P
4982         if (wpa_s->global->p2p == NULL &&
4983             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4984             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4985             wpas_p2p_add_p2pdev_interface(
4986                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4987                 wpa_printf(MSG_INFO,
4988                            "P2P: Failed to enable P2P Device interface");
4989                 /* Try to continue without. P2P will be disabled. */
4990         }
4991 #endif /* CONFIG_P2P */
4992
4993         return wpa_s;
4994 }
4995
4996
4997 /**
4998  * wpa_supplicant_remove_iface - Remove a network interface
4999  * @global: Pointer to global data from wpa_supplicant_init()
5000  * @wpa_s: Pointer to the network interface to be removed
5001  * Returns: 0 if interface was removed, -1 if interface was not found
5002  *
5003  * This function can be used to dynamically remove network interfaces from
5004  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5005  * addition, this function is used to remove all remaining interfaces when
5006  * %wpa_supplicant is terminated.
5007  */
5008 int wpa_supplicant_remove_iface(struct wpa_global *global,
5009                                 struct wpa_supplicant *wpa_s,
5010                                 int terminate)
5011 {
5012         struct wpa_supplicant *prev;
5013 #ifdef CONFIG_MESH
5014         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5015         char *ifname = NULL;
5016 #endif /* CONFIG_MESH */
5017
5018         /* Remove interface from the global list of interfaces */
5019         prev = global->ifaces;
5020         if (prev == wpa_s) {
5021                 global->ifaces = wpa_s->next;
5022         } else {
5023                 while (prev && prev->next != wpa_s)
5024                         prev = prev->next;
5025                 if (prev == NULL)
5026                         return -1;
5027                 prev->next = wpa_s->next;
5028         }
5029
5030         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5031
5032 #ifdef CONFIG_MESH
5033         if (mesh_if_created) {
5034                 ifname = os_strdup(wpa_s->ifname);
5035                 if (ifname == NULL) {
5036                         wpa_dbg(wpa_s, MSG_ERROR,
5037                                 "mesh: Failed to malloc ifname");
5038                         return -1;
5039                 }
5040         }
5041 #endif /* CONFIG_MESH */
5042
5043         if (global->p2p_group_formation == wpa_s)
5044                 global->p2p_group_formation = NULL;
5045         if (global->p2p_invite_group == wpa_s)
5046                 global->p2p_invite_group = NULL;
5047         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5048
5049 #ifdef CONFIG_MESH
5050         if (mesh_if_created) {
5051                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5052                 os_free(ifname);
5053         }
5054 #endif /* CONFIG_MESH */
5055
5056         return 0;
5057 }
5058
5059
5060 /**
5061  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5062  * @wpa_s: Pointer to the network interface
5063  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5064  */
5065 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5066 {
5067         const char *eapol_method;
5068
5069         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5070             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5071                 return "NO-EAP";
5072         }
5073
5074         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5075         if (eapol_method == NULL)
5076                 return "UNKNOWN-EAP";
5077
5078         return eapol_method;
5079 }
5080
5081
5082 /**
5083  * wpa_supplicant_get_iface - Get a new network interface
5084  * @global: Pointer to global data from wpa_supplicant_init()
5085  * @ifname: Interface name
5086  * Returns: Pointer to the interface or %NULL if not found
5087  */
5088 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5089                                                  const char *ifname)
5090 {
5091         struct wpa_supplicant *wpa_s;
5092
5093         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5094                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5095                         return wpa_s;
5096         }
5097         return NULL;
5098 }
5099
5100
5101 #ifndef CONFIG_NO_WPA_MSG
5102 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5103 {
5104         struct wpa_supplicant *wpa_s = ctx;
5105         if (wpa_s == NULL)
5106                 return NULL;
5107         return wpa_s->ifname;
5108 }
5109 #endif /* CONFIG_NO_WPA_MSG */
5110
5111
5112 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5113 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5114 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5115
5116 /* Periodic cleanup tasks */
5117 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5118 {
5119         struct wpa_global *global = eloop_ctx;
5120         struct wpa_supplicant *wpa_s;
5121
5122         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5123                                wpas_periodic, global, NULL);
5124
5125 #ifdef CONFIG_P2P
5126         if (global->p2p)
5127                 p2p_expire_peers(global->p2p);
5128 #endif /* CONFIG_P2P */
5129
5130         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5131                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5132 #ifdef CONFIG_AP
5133                 ap_periodic(wpa_s);
5134 #endif /* CONFIG_AP */
5135         }
5136 }
5137
5138
5139 /**
5140  * wpa_supplicant_init - Initialize %wpa_supplicant
5141  * @params: Parameters for %wpa_supplicant
5142  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5143  *
5144  * This function is used to initialize %wpa_supplicant. After successful
5145  * initialization, the returned data pointer can be used to add and remove
5146  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5147  */
5148 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5149 {
5150         struct wpa_global *global;
5151         int ret, i;
5152
5153         if (params == NULL)
5154                 return NULL;
5155
5156 #ifdef CONFIG_DRIVER_NDIS
5157         {
5158                 void driver_ndis_init_ops(void);
5159                 driver_ndis_init_ops();
5160         }
5161 #endif /* CONFIG_DRIVER_NDIS */
5162
5163 #ifndef CONFIG_NO_WPA_MSG
5164         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5165 #endif /* CONFIG_NO_WPA_MSG */
5166
5167         if (params->wpa_debug_file_path)
5168                 wpa_debug_open_file(params->wpa_debug_file_path);
5169         else
5170                 wpa_debug_setup_stdout();
5171         if (params->wpa_debug_syslog)
5172                 wpa_debug_open_syslog();
5173         if (params->wpa_debug_tracing) {
5174                 ret = wpa_debug_open_linux_tracing();
5175                 if (ret) {
5176                         wpa_printf(MSG_ERROR,
5177                                    "Failed to enable trace logging");
5178                         return NULL;
5179                 }
5180         }
5181
5182         ret = eap_register_methods();
5183         if (ret) {
5184                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5185                 if (ret == -2)
5186                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5187                                    "the same EAP type.");
5188                 return NULL;
5189         }
5190
5191         global = os_zalloc(sizeof(*global));
5192         if (global == NULL)
5193                 return NULL;
5194         dl_list_init(&global->p2p_srv_bonjour);
5195         dl_list_init(&global->p2p_srv_upnp);
5196         global->params.daemonize = params->daemonize;
5197         global->params.wait_for_monitor = params->wait_for_monitor;
5198         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5199         if (params->pid_file)
5200                 global->params.pid_file = os_strdup(params->pid_file);
5201         if (params->ctrl_interface)
5202                 global->params.ctrl_interface =
5203                         os_strdup(params->ctrl_interface);
5204         if (params->ctrl_interface_group)
5205                 global->params.ctrl_interface_group =
5206                         os_strdup(params->ctrl_interface_group);
5207         if (params->override_driver)
5208                 global->params.override_driver =
5209                         os_strdup(params->override_driver);
5210         if (params->override_ctrl_interface)
5211                 global->params.override_ctrl_interface =
5212                         os_strdup(params->override_ctrl_interface);
5213 #ifdef CONFIG_P2P
5214         if (params->conf_p2p_dev)
5215                 global->params.conf_p2p_dev =
5216                         os_strdup(params->conf_p2p_dev);
5217 #endif /* CONFIG_P2P */
5218         wpa_debug_level = global->params.wpa_debug_level =
5219                 params->wpa_debug_level;
5220         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5221                 params->wpa_debug_show_keys;
5222         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5223                 params->wpa_debug_timestamp;
5224
5225         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5226
5227         if (eloop_init()) {
5228                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5229                 wpa_supplicant_deinit(global);
5230                 return NULL;
5231         }
5232
5233         random_init(params->entropy_file);
5234
5235         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5236         if (global->ctrl_iface == NULL) {
5237                 wpa_supplicant_deinit(global);
5238                 return NULL;
5239         }
5240
5241         if (wpas_notify_supplicant_initialized(global)) {
5242                 wpa_supplicant_deinit(global);
5243                 return NULL;
5244         }
5245
5246         for (i = 0; wpa_drivers[i]; i++)
5247                 global->drv_count++;
5248         if (global->drv_count == 0) {
5249                 wpa_printf(MSG_ERROR, "No drivers enabled");
5250                 wpa_supplicant_deinit(global);
5251                 return NULL;
5252         }
5253         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5254         if (global->drv_priv == NULL) {
5255                 wpa_supplicant_deinit(global);
5256                 return NULL;
5257         }
5258
5259 #ifdef CONFIG_WIFI_DISPLAY
5260         if (wifi_display_init(global) < 0) {
5261                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5262                 wpa_supplicant_deinit(global);
5263                 return NULL;
5264         }
5265 #endif /* CONFIG_WIFI_DISPLAY */
5266
5267         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5268                                wpas_periodic, global, NULL);
5269
5270         return global;
5271 }
5272
5273
5274 /**
5275  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5276  * @global: Pointer to global data from wpa_supplicant_init()
5277  * Returns: 0 after successful event loop run, -1 on failure
5278  *
5279  * This function starts the main event loop and continues running as long as
5280  * there are any remaining events. In most cases, this function is running as
5281  * long as the %wpa_supplicant process in still in use.
5282  */
5283 int wpa_supplicant_run(struct wpa_global *global)
5284 {
5285         struct wpa_supplicant *wpa_s;
5286
5287         if (global->params.daemonize &&
5288             (wpa_supplicant_daemon(global->params.pid_file) ||
5289              eloop_sock_requeue()))
5290                 return -1;
5291
5292         if (global->params.wait_for_monitor) {
5293                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5294                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5295                                 wpa_supplicant_ctrl_iface_wait(
5296                                         wpa_s->ctrl_iface);
5297         }
5298
5299         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5300         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5301
5302         eloop_run();
5303
5304         return 0;
5305 }
5306
5307
5308 /**
5309  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5310  * @global: Pointer to global data from wpa_supplicant_init()
5311  *
5312  * This function is called to deinitialize %wpa_supplicant and to free all
5313  * allocated resources. Remaining network interfaces will also be removed.
5314  */
5315 void wpa_supplicant_deinit(struct wpa_global *global)
5316 {
5317         int i;
5318
5319         if (global == NULL)
5320                 return;
5321
5322         eloop_cancel_timeout(wpas_periodic, global, NULL);
5323
5324 #ifdef CONFIG_WIFI_DISPLAY
5325         wifi_display_deinit(global);
5326 #endif /* CONFIG_WIFI_DISPLAY */
5327
5328         while (global->ifaces)
5329                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5330
5331         if (global->ctrl_iface)
5332                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5333
5334         wpas_notify_supplicant_deinitialized(global);
5335
5336         eap_peer_unregister_methods();
5337 #ifdef CONFIG_AP
5338         eap_server_unregister_methods();
5339 #endif /* CONFIG_AP */
5340
5341         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5342                 if (!global->drv_priv[i])
5343                         continue;
5344                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5345         }
5346         os_free(global->drv_priv);
5347
5348         random_deinit();
5349
5350         eloop_destroy();
5351
5352         if (global->params.pid_file) {
5353                 os_daemonize_terminate(global->params.pid_file);
5354                 os_free(global->params.pid_file);
5355         }
5356         os_free(global->params.ctrl_interface);
5357         os_free(global->params.ctrl_interface_group);
5358         os_free(global->params.override_driver);
5359         os_free(global->params.override_ctrl_interface);
5360 #ifdef CONFIG_P2P
5361         os_free(global->params.conf_p2p_dev);
5362 #endif /* CONFIG_P2P */
5363
5364         os_free(global->p2p_disallow_freq.range);
5365         os_free(global->p2p_go_avoid_freq.range);
5366         os_free(global->add_psk);
5367
5368         os_free(global);
5369         wpa_debug_close_syslog();
5370         wpa_debug_close_file();
5371         wpa_debug_close_linux_tracing();
5372 }
5373
5374
5375 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5376 {
5377         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5378             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5379                 char country[3];
5380                 country[0] = wpa_s->conf->country[0];
5381                 country[1] = wpa_s->conf->country[1];
5382                 country[2] = '\0';
5383                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5384                         wpa_printf(MSG_ERROR, "Failed to set country code "
5385                                    "'%s'", country);
5386                 }
5387         }
5388
5389         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5390                 wpas_init_ext_pw(wpa_s);
5391
5392         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5393                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5394
5395 #ifdef CONFIG_WPS
5396         wpas_wps_update_config(wpa_s);
5397 #endif /* CONFIG_WPS */
5398         wpas_p2p_update_config(wpa_s);
5399         wpa_s->conf->changed_parameters = 0;
5400 }
5401
5402
5403 void add_freq(int *freqs, int *num_freqs, int freq)
5404 {
5405         int i;
5406
5407         for (i = 0; i < *num_freqs; i++) {
5408                 if (freqs[i] == freq)
5409                         return;
5410         }
5411
5412         freqs[*num_freqs] = freq;
5413         (*num_freqs)++;
5414 }
5415
5416
5417 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5418 {
5419         struct wpa_bss *bss, *cbss;
5420         const int max_freqs = 10;
5421         int *freqs;
5422         int num_freqs = 0;
5423
5424         freqs = os_calloc(max_freqs + 1, sizeof(int));
5425         if (freqs == NULL)
5426                 return NULL;
5427
5428         cbss = wpa_s->current_bss;
5429
5430         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5431                 if (bss == cbss)
5432                         continue;
5433                 if (bss->ssid_len == cbss->ssid_len &&
5434                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5435                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5436                         add_freq(freqs, &num_freqs, bss->freq);
5437                         if (num_freqs == max_freqs)
5438                                 break;
5439                 }
5440         }
5441
5442         if (num_freqs == 0) {
5443                 os_free(freqs);
5444                 freqs = NULL;
5445         }
5446
5447         return freqs;
5448 }
5449
5450
5451 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5452 {
5453         int timeout;
5454         int count;
5455         int *freqs = NULL;
5456
5457         wpas_connect_work_done(wpa_s);
5458
5459         /*
5460          * Remove possible authentication timeout since the connection failed.
5461          */
5462         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5463
5464         /*
5465          * There is no point in blacklisting the AP if this event is
5466          * generated based on local request to disconnect.
5467          */
5468         if (wpa_s->own_disconnect_req) {
5469                 wpa_s->own_disconnect_req = 0;
5470                 wpa_dbg(wpa_s, MSG_DEBUG,
5471                         "Ignore connection failure due to local request to disconnect");
5472                 return;
5473         }
5474         if (wpa_s->disconnected) {
5475                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5476                         "indication since interface has been put into "
5477                         "disconnected state");
5478                 return;
5479         }
5480
5481         /*
5482          * Add the failed BSSID into the blacklist and speed up next scan
5483          * attempt if there could be other APs that could accept association.
5484          * The current blacklist count indicates how many times we have tried
5485          * connecting to this AP and multiple attempts mean that other APs are
5486          * either not available or has already been tried, so that we can start
5487          * increasing the delay here to avoid constant scanning.
5488          */
5489         count = wpa_blacklist_add(wpa_s, bssid);
5490         if (count == 1 && wpa_s->current_bss) {
5491                 /*
5492                  * This BSS was not in the blacklist before. If there is
5493                  * another BSS available for the same ESS, we should try that
5494                  * next. Otherwise, we may as well try this one once more
5495                  * before allowing other, likely worse, ESSes to be considered.
5496                  */
5497                 freqs = get_bss_freqs_in_ess(wpa_s);
5498                 if (freqs) {
5499                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5500                                 "has been seen; try it next");
5501                         wpa_blacklist_add(wpa_s, bssid);
5502                         /*
5503                          * On the next scan, go through only the known channels
5504                          * used in this ESS based on previous scans to speed up
5505                          * common load balancing use case.
5506                          */
5507                         os_free(wpa_s->next_scan_freqs);
5508                         wpa_s->next_scan_freqs = freqs;
5509                 }
5510         }
5511
5512         /*
5513          * Add previous failure count in case the temporary blacklist was
5514          * cleared due to no other BSSes being available.
5515          */
5516         count += wpa_s->extra_blacklist_count;
5517
5518         if (count > 3 && wpa_s->current_ssid) {
5519                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5520                            "consider temporary network disabling");
5521                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5522         }
5523
5524         switch (count) {
5525         case 1:
5526                 timeout = 100;
5527                 break;
5528         case 2:
5529                 timeout = 500;
5530                 break;
5531         case 3:
5532                 timeout = 1000;
5533                 break;
5534         case 4:
5535                 timeout = 5000;
5536                 break;
5537         default:
5538                 timeout = 10000;
5539                 break;
5540         }
5541
5542         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5543                 "ms", count, timeout);
5544
5545         /*
5546          * TODO: if more than one possible AP is available in scan results,
5547          * could try the other ones before requesting a new scan.
5548          */
5549         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5550                                 1000 * (timeout % 1000));
5551 }
5552
5553
5554 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5555 {
5556         return wpa_s->conf->ap_scan == 2 ||
5557                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5558 }
5559
5560
5561 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5562 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5563                                               struct wpa_ssid *ssid,
5564                                               const char *field,
5565                                               const char *value)
5566 {
5567 #ifdef IEEE8021X_EAPOL
5568         struct eap_peer_config *eap = &ssid->eap;
5569
5570         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5571         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5572                               (const u8 *) value, os_strlen(value));
5573
5574         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5575         case WPA_CTRL_REQ_EAP_IDENTITY:
5576                 os_free(eap->identity);
5577                 eap->identity = (u8 *) os_strdup(value);
5578                 eap->identity_len = os_strlen(value);
5579                 eap->pending_req_identity = 0;
5580                 if (ssid == wpa_s->current_ssid)
5581                         wpa_s->reassociate = 1;
5582                 break;
5583         case WPA_CTRL_REQ_EAP_PASSWORD:
5584                 bin_clear_free(eap->password, eap->password_len);
5585                 eap->password = (u8 *) os_strdup(value);
5586                 eap->password_len = os_strlen(value);
5587                 eap->pending_req_password = 0;
5588                 if (ssid == wpa_s->current_ssid)
5589                         wpa_s->reassociate = 1;
5590                 break;
5591         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5592                 bin_clear_free(eap->new_password, eap->new_password_len);
5593                 eap->new_password = (u8 *) os_strdup(value);
5594                 eap->new_password_len = os_strlen(value);
5595                 eap->pending_req_new_password = 0;
5596                 if (ssid == wpa_s->current_ssid)
5597                         wpa_s->reassociate = 1;
5598                 break;
5599         case WPA_CTRL_REQ_EAP_PIN:
5600                 str_clear_free(eap->pin);
5601                 eap->pin = os_strdup(value);
5602                 eap->pending_req_pin = 0;
5603                 if (ssid == wpa_s->current_ssid)
5604                         wpa_s->reassociate = 1;
5605                 break;
5606         case WPA_CTRL_REQ_EAP_OTP:
5607                 bin_clear_free(eap->otp, eap->otp_len);
5608                 eap->otp = (u8 *) os_strdup(value);
5609                 eap->otp_len = os_strlen(value);
5610                 os_free(eap->pending_req_otp);
5611                 eap->pending_req_otp = NULL;
5612                 eap->pending_req_otp_len = 0;
5613                 break;
5614         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5615                 str_clear_free(eap->private_key_passwd);
5616                 eap->private_key_passwd = os_strdup(value);
5617                 eap->pending_req_passphrase = 0;
5618                 if (ssid == wpa_s->current_ssid)
5619                         wpa_s->reassociate = 1;
5620                 break;
5621         case WPA_CTRL_REQ_SIM:
5622                 str_clear_free(eap->external_sim_resp);
5623                 eap->external_sim_resp = os_strdup(value);
5624                 break;
5625         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5626                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5627                         return -1;
5628                 ssid->mem_only_psk = 1;
5629                 if (ssid->passphrase)
5630                         wpa_config_update_psk(ssid);
5631                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5632                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5633                 break;
5634         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5635                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5636                         return -1;
5637                 if (os_strcmp(value, "good") == 0)
5638                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5639                 else if (os_strcmp(value, "bad") == 0)
5640                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5641                 else
5642                         return -1;
5643                 break;
5644         default:
5645                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5646                 return -1;
5647         }
5648
5649         return 0;
5650 #else /* IEEE8021X_EAPOL */
5651         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5652         return -1;
5653 #endif /* IEEE8021X_EAPOL */
5654 }
5655 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5656
5657
5658 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5659 {
5660         int i;
5661         unsigned int drv_enc;
5662
5663         if (wpa_s->p2p_mgmt)
5664                 return 1; /* no normal network profiles on p2p_mgmt interface */
5665
5666         if (ssid == NULL)
5667                 return 1;
5668
5669         if (ssid->disabled)
5670                 return 1;
5671
5672         if (wpa_s->drv_capa_known)
5673                 drv_enc = wpa_s->drv_enc;
5674         else
5675                 drv_enc = (unsigned int) -1;
5676
5677         for (i = 0; i < NUM_WEP_KEYS; i++) {
5678                 size_t len = ssid->wep_key_len[i];
5679                 if (len == 0)
5680                         continue;
5681                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5682                         continue;
5683                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5684                         continue;
5685                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5686                         continue;
5687                 return 1; /* invalid WEP key */
5688         }
5689
5690         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5691             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5692             !ssid->mem_only_psk)
5693                 return 1;
5694
5695         return 0;
5696 }
5697
5698
5699 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5700 {
5701 #ifdef CONFIG_IEEE80211W
5702         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5703                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5704                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5705                         /*
5706                          * Driver does not support BIP -- ignore pmf=1 default
5707                          * since the connection with PMF would fail and the
5708                          * configuration does not require PMF to be enabled.
5709                          */
5710                         return NO_MGMT_FRAME_PROTECTION;
5711                 }
5712
5713                 return wpa_s->conf->pmf;
5714         }
5715
5716         return ssid->ieee80211w;
5717 #else /* CONFIG_IEEE80211W */
5718         return NO_MGMT_FRAME_PROTECTION;
5719 #endif /* CONFIG_IEEE80211W */
5720 }
5721
5722
5723 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5724 {
5725         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5726                 return 1;
5727         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5728                 return 0;
5729         return -1;
5730 }
5731
5732
5733 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5734 {
5735         struct wpa_ssid *ssid = wpa_s->current_ssid;
5736         int dur;
5737         struct os_reltime now;
5738
5739         if (ssid == NULL) {
5740                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5741                            "SSID block");
5742                 return;
5743         }
5744
5745         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5746                 return;
5747
5748         ssid->auth_failures++;
5749
5750 #ifdef CONFIG_P2P
5751         if (ssid->p2p_group &&
5752             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5753                 /*
5754                  * Skip the wait time since there is a short timeout on the
5755                  * connection to a P2P group.
5756                  */
5757                 return;
5758         }
5759 #endif /* CONFIG_P2P */
5760
5761         if (ssid->auth_failures > 50)
5762                 dur = 300;
5763         else if (ssid->auth_failures > 10)
5764                 dur = 120;
5765         else if (ssid->auth_failures > 5)
5766                 dur = 90;
5767         else if (ssid->auth_failures > 3)
5768                 dur = 60;
5769         else if (ssid->auth_failures > 2)
5770                 dur = 30;
5771         else if (ssid->auth_failures > 1)
5772                 dur = 20;
5773         else
5774                 dur = 10;
5775
5776         if (ssid->auth_failures > 1 &&
5777             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5778                 dur += os_random() % (ssid->auth_failures * 10);
5779
5780         os_get_reltime(&now);
5781         if (now.sec + dur <= ssid->disabled_until.sec)
5782                 return;
5783
5784         ssid->disabled_until.sec = now.sec + dur;
5785
5786         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5787                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5788                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5789                 ssid->auth_failures, dur, reason);
5790 }
5791
5792
5793 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5794                               struct wpa_ssid *ssid, int clear_failures)
5795 {
5796         if (ssid == NULL)
5797                 return;
5798
5799         if (ssid->disabled_until.sec) {
5800                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5801                         "id=%d ssid=\"%s\"",
5802                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5803         }
5804         ssid->disabled_until.sec = 0;
5805         ssid->disabled_until.usec = 0;
5806         if (clear_failures)
5807                 ssid->auth_failures = 0;
5808 }
5809
5810
5811 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5812 {
5813         size_t i;
5814
5815         if (wpa_s->disallow_aps_bssid == NULL)
5816                 return 0;
5817
5818         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5819                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5820                               bssid, ETH_ALEN) == 0)
5821                         return 1;
5822         }
5823
5824         return 0;
5825 }
5826
5827
5828 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5829                     size_t ssid_len)
5830 {
5831         size_t i;
5832
5833         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5834                 return 0;
5835
5836         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5837                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5838                 if (ssid_len == s->ssid_len &&
5839                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5840                         return 1;
5841         }
5842
5843         return 0;
5844 }
5845
5846
5847 /**
5848  * wpas_request_connection - Request a new connection
5849  * @wpa_s: Pointer to the network interface
5850  *
5851  * This function is used to request a new connection to be found. It will mark
5852  * the interface to allow reassociation and request a new scan to find a
5853  * suitable network to connect to.
5854  */
5855 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5856 {
5857         wpa_s->normal_scans = 0;
5858         wpa_s->scan_req = NORMAL_SCAN_REQ;
5859         wpa_supplicant_reinit_autoscan(wpa_s);
5860         wpa_s->extra_blacklist_count = 0;
5861         wpa_s->disconnected = 0;
5862         wpa_s->reassociate = 1;
5863
5864         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5865                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5866         else
5867                 wpa_s->reattach = 0;
5868 }
5869
5870
5871 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5872                     struct wpa_used_freq_data *freqs_data,
5873                     unsigned int len)
5874 {
5875         unsigned int i;
5876
5877         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5878                 len, title);
5879         for (i = 0; i < len; i++) {
5880                 struct wpa_used_freq_data *cur = &freqs_data[i];
5881                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5882                         i, cur->freq, cur->flags);
5883         }
5884 }
5885
5886
5887 /*
5888  * Find the operating frequencies of any of the virtual interfaces that
5889  * are using the same radio as the current interface, and in addition, get
5890  * information about the interface types that are using the frequency.
5891  */
5892 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5893                                 struct wpa_used_freq_data *freqs_data,
5894                                 unsigned int len)
5895 {
5896         struct wpa_supplicant *ifs;
5897         u8 bssid[ETH_ALEN];
5898         int freq;
5899         unsigned int idx = 0, i;
5900
5901         wpa_dbg(wpa_s, MSG_DEBUG,
5902                 "Determining shared radio frequencies (max len %u)", len);
5903         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5904
5905         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5906                          radio_list) {
5907                 if (idx == len)
5908                         break;
5909
5910                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5911                         continue;
5912
5913                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5914                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5915                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5916                         freq = ifs->current_ssid->frequency;
5917                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5918                         freq = ifs->assoc_freq;
5919                 else
5920                         continue;
5921
5922                 /* Hold only distinct freqs */
5923                 for (i = 0; i < idx; i++)
5924                         if (freqs_data[i].freq == freq)
5925                                 break;
5926
5927                 if (i == idx)
5928                         freqs_data[idx++].freq = freq;
5929
5930                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5931                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5932                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5933                                 WPA_FREQ_USED_BY_INFRA_STATION;
5934                 }
5935         }
5936
5937         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5938         return idx;
5939 }
5940
5941
5942 /*
5943  * Find the operating frequencies of any of the virtual interfaces that
5944  * are using the same radio as the current interface.
5945  */
5946 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5947                            int *freq_array, unsigned int len)
5948 {
5949         struct wpa_used_freq_data *freqs_data;
5950         int num, i;
5951
5952         os_memset(freq_array, 0, sizeof(int) * len);
5953
5954         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5955         if (!freqs_data)
5956                 return -1;
5957
5958         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5959         for (i = 0; i < num; i++)
5960                 freq_array[i] = freqs_data[i].freq;
5961
5962         os_free(freqs_data);
5963
5964         return num;
5965 }
5966
5967
5968 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5969 {
5970         struct rrm_data *rrm = data;
5971
5972         if (!rrm->notify_neighbor_rep) {
5973                 wpa_printf(MSG_ERROR,
5974                            "RRM: Unexpected neighbor report timeout");
5975                 return;
5976         }
5977
5978         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5979         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5980
5981         rrm->notify_neighbor_rep = NULL;
5982         rrm->neighbor_rep_cb_ctx = NULL;
5983 }
5984
5985
5986 /*
5987  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5988  * @wpa_s: Pointer to wpa_supplicant
5989  */
5990 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5991 {
5992         wpa_s->rrm.rrm_used = 0;
5993
5994         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5995                              NULL);
5996         if (wpa_s->rrm.notify_neighbor_rep)
5997                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5998         wpa_s->rrm.next_neighbor_rep_token = 1;
5999 }
6000
6001
6002 /*
6003  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6004  * @wpa_s: Pointer to wpa_supplicant
6005  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6006  * @report_len: Length of neighbor report buffer
6007  */
6008 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6009                                    const u8 *report, size_t report_len)
6010 {
6011         struct wpabuf *neighbor_rep;
6012
6013         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6014         if (report_len < 1)
6015                 return;
6016
6017         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6018                 wpa_printf(MSG_DEBUG,
6019                            "RRM: Discarding neighbor report with token %d (expected %d)",
6020                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6021                 return;
6022         }
6023
6024         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6025                              NULL);
6026
6027         if (!wpa_s->rrm.notify_neighbor_rep) {
6028                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6029                 return;
6030         }
6031
6032         /* skipping the first byte, which is only an id (dialog token) */
6033         neighbor_rep = wpabuf_alloc(report_len - 1);
6034         if (neighbor_rep == NULL)
6035                 return;
6036         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6037         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6038                    report[0]);
6039         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6040                                        neighbor_rep);
6041         wpa_s->rrm.notify_neighbor_rep = NULL;
6042         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6043 }
6044
6045
6046 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6047 /* Workaround different, undefined for Windows, error codes used here */
6048 #define ENOTCONN -1
6049 #define EOPNOTSUPP -1
6050 #define ECANCELED -1
6051 #endif
6052
6053 /**
6054  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6055  * @wpa_s: Pointer to wpa_supplicant
6056  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6057  *        is sent in the request.
6058  * @cb: Callback function to be called once the requested report arrives, or
6059  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6060  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6061  *      the requester's responsibility to free it.
6062  *      In the latter case NULL will be sent in 'neighbor_rep'.
6063  * @cb_ctx: Context value to send the callback function
6064  * Returns: 0 in case of success, negative error code otherwise
6065  *
6066  * In case there is a previous request which has not been answered yet, the
6067  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6068  * Request must contain a callback function.
6069  */
6070 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6071                                        const struct wpa_ssid *ssid,
6072                                        void (*cb)(void *ctx,
6073                                                   struct wpabuf *neighbor_rep),
6074                                        void *cb_ctx)
6075 {
6076         struct wpabuf *buf;
6077         const u8 *rrm_ie;
6078
6079         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6080                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6081                 return -ENOTCONN;
6082         }
6083
6084         if (!wpa_s->rrm.rrm_used) {
6085                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6086                 return -EOPNOTSUPP;
6087         }
6088
6089         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6090                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6091         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6092             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6093                 wpa_printf(MSG_DEBUG,
6094                            "RRM: No network support for Neighbor Report.");
6095                 return -EOPNOTSUPP;
6096         }
6097
6098         if (!cb) {
6099                 wpa_printf(MSG_DEBUG,
6100                            "RRM: Neighbor Report request must provide a callback.");
6101                 return -EINVAL;
6102         }
6103
6104         /* Refuse if there's a live request */
6105         if (wpa_s->rrm.notify_neighbor_rep) {
6106                 wpa_printf(MSG_DEBUG,
6107                            "RRM: Currently handling previous Neighbor Report.");
6108                 return -EBUSY;
6109         }
6110
6111         /* 3 = action category + action code + dialog token */
6112         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6113         if (buf == NULL) {
6114                 wpa_printf(MSG_DEBUG,
6115                            "RRM: Failed to allocate Neighbor Report Request");
6116                 return -ENOMEM;
6117         }
6118
6119         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6120                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6121                    wpa_s->rrm.next_neighbor_rep_token);
6122
6123         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6124         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6125         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6126         if (ssid) {
6127                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6128                 wpabuf_put_u8(buf, ssid->ssid_len);
6129                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6130         }
6131
6132         wpa_s->rrm.next_neighbor_rep_token++;
6133
6134         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6135                                 wpa_s->own_addr, wpa_s->bssid,
6136                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6137                 wpa_printf(MSG_DEBUG,
6138                            "RRM: Failed to send Neighbor Report Request");
6139                 wpabuf_free(buf);
6140                 return -ECANCELED;
6141         }
6142
6143         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6144         wpa_s->rrm.notify_neighbor_rep = cb;
6145         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6146                                wpas_rrm_neighbor_rep_timeout_handler,
6147                                &wpa_s->rrm, NULL);
6148
6149         wpabuf_free(buf);
6150         return 0;
6151 }
6152
6153
6154 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6155                                               const u8 *src,
6156                                               const u8 *frame, size_t len,
6157                                               int rssi)
6158 {
6159         struct wpabuf *buf;
6160         const struct rrm_link_measurement_request *req;
6161         struct rrm_link_measurement_report report;
6162
6163         if (wpa_s->wpa_state != WPA_COMPLETED) {
6164                 wpa_printf(MSG_INFO,
6165                            "RRM: Ignoring link measurement request. Not associated");
6166                 return;
6167         }
6168
6169         if (!wpa_s->rrm.rrm_used) {
6170                 wpa_printf(MSG_INFO,
6171                            "RRM: Ignoring link measurement request. Not RRM network");
6172                 return;
6173         }
6174
6175         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6176                 wpa_printf(MSG_INFO,
6177                            "RRM: Measurement report failed. TX power insertion not supported");
6178                 return;
6179         }
6180
6181         req = (const struct rrm_link_measurement_request *) frame;
6182         if (len < sizeof(*req)) {
6183                 wpa_printf(MSG_INFO,
6184                            "RRM: Link measurement report failed. Request too short");
6185                 return;
6186         }
6187
6188         os_memset(&report, 0, sizeof(report));
6189         report.tpc.eid = WLAN_EID_TPC_REPORT;
6190         report.tpc.len = 2;
6191         report.rsni = 255; /* 255 indicates that RSNI is not available */
6192         report.dialog_token = req->dialog_token;
6193
6194         /*
6195          * It's possible to estimate RCPI based on RSSI in dBm. This
6196          * calculation will not reflect the correct value for high rates,
6197          * but it's good enough for Action frames which are transmitted
6198          * with up to 24 Mbps rates.
6199          */
6200         if (!rssi)
6201                 report.rcpi = 255; /* not available */
6202         else if (rssi < -110)
6203                 report.rcpi = 0;
6204         else if (rssi > 0)
6205                 report.rcpi = 220;
6206         else
6207                 report.rcpi = (rssi + 110) * 2;
6208
6209         /* action_category + action_code */
6210         buf = wpabuf_alloc(2 + sizeof(report));
6211         if (buf == NULL) {
6212                 wpa_printf(MSG_ERROR,
6213                            "RRM: Link measurement report failed. Buffer allocation failed");
6214                 return;
6215         }
6216
6217         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6218         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6219         wpabuf_put_data(buf, &report, sizeof(report));
6220         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6221                     wpabuf_head(buf), wpabuf_len(buf));
6222
6223         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6224                                 wpa_s->own_addr, wpa_s->bssid,
6225                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6226                 wpa_printf(MSG_ERROR,
6227                            "RRM: Link measurement report failed. Send action failed");
6228         }
6229         wpabuf_free(buf);
6230 }
6231
6232
6233 struct wpa_supplicant *
6234 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6235 {
6236         switch (frame) {
6237 #ifdef CONFIG_P2P
6238         case VENDOR_ELEM_PROBE_REQ_P2P:
6239         case VENDOR_ELEM_PROBE_RESP_P2P:
6240         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6241         case VENDOR_ELEM_BEACON_P2P_GO:
6242         case VENDOR_ELEM_P2P_PD_REQ:
6243         case VENDOR_ELEM_P2P_PD_RESP:
6244         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6245         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6246         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6247         case VENDOR_ELEM_P2P_INV_REQ:
6248         case VENDOR_ELEM_P2P_INV_RESP:
6249         case VENDOR_ELEM_P2P_ASSOC_REQ:
6250         case VENDOR_ELEM_P2P_ASSOC_RESP:
6251                 return wpa_s->parent;
6252 #endif /* CONFIG_P2P */
6253         default:
6254                 return wpa_s;
6255         }
6256 }
6257
6258
6259 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6260 {
6261         unsigned int i;
6262         char buf[30];
6263
6264         wpa_printf(MSG_DEBUG, "Update vendor elements");
6265
6266         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6267                 if (wpa_s->vendor_elem[i]) {
6268                         int res;
6269
6270                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6271                         if (!os_snprintf_error(sizeof(buf), res)) {
6272                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6273                                                 wpa_s->vendor_elem[i]);
6274                         }
6275                 }
6276         }
6277
6278 #ifdef CONFIG_P2P
6279         if (wpa_s->parent == wpa_s &&
6280             wpa_s->global->p2p &&
6281             !wpa_s->global->p2p_disabled)
6282                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6283 #endif /* CONFIG_P2P */
6284 }
6285
6286
6287 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6288                             const u8 *elem, size_t len)
6289 {
6290         u8 *ie, *end;
6291
6292         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6293         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6294
6295         for (; ie + 1 < end; ie += 2 + ie[1]) {
6296                 if (ie + len > end)
6297                         break;
6298                 if (os_memcmp(ie, elem, len) != 0)
6299                         continue;
6300
6301                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6302                         wpabuf_free(wpa_s->vendor_elem[frame]);
6303                         wpa_s->vendor_elem[frame] = NULL;
6304                 } else {
6305                         os_memmove(ie, ie + len, end - (ie + len));
6306                         wpa_s->vendor_elem[frame]->used -= len;
6307                 }
6308                 wpas_vendor_elem_update(wpa_s);
6309                 return 0;
6310         }
6311
6312         return -1;
6313 }
6314
6315
6316 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6317                                    u16 num_modes, enum hostapd_hw_mode mode)
6318 {
6319         u16 i;
6320
6321         for (i = 0; i < num_modes; i++) {
6322                 if (modes[i].mode == mode)
6323                         return &modes[i];
6324         }
6325
6326         return NULL;
6327 }
6328
6329
6330 static struct
6331 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6332                                                  const u8 *bssid)
6333 {
6334         struct wpa_bss_tmp_disallowed *bss;
6335
6336         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6337                          struct wpa_bss_tmp_disallowed, list) {
6338                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6339                         return bss;
6340         }
6341
6342         return NULL;
6343 }
6344
6345
6346 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6347                           unsigned int sec)
6348 {
6349         struct wpa_bss_tmp_disallowed *bss;
6350         struct os_reltime until;
6351
6352         os_get_reltime(&until);
6353         until.sec += sec;
6354
6355         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6356         if (bss) {
6357                 bss->disallowed_until = until;
6358                 return;
6359         }
6360
6361         bss = os_malloc(sizeof(*bss));
6362         if (!bss) {
6363                 wpa_printf(MSG_DEBUG,
6364                            "Failed to allocate memory for temp disallow BSS");
6365                 return;
6366         }
6367
6368         bss->disallowed_until = until;
6369         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6370         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6371 }
6372
6373
6374 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6375 {
6376         struct wpa_bss_tmp_disallowed *bss;
6377         struct os_reltime now, age;
6378
6379         os_get_reltime(&now);
6380
6381         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6382         if (!bss)
6383                 return 0;
6384
6385         if (os_reltime_before(&now, &bss->disallowed_until)) {
6386                 os_reltime_sub(&bss->disallowed_until, &now, &age);
6387                 wpa_printf(MSG_DEBUG,
6388                            "BSS " MACSTR " disabled for %ld.%0ld seconds",
6389                            MAC2STR(bss->bssid), age.sec, age.usec);
6390                 return 1;
6391         }
6392
6393         /* This BSS is not disallowed anymore */
6394         dl_list_del(&bss->list);
6395         os_free(bss);
6396         return 0;
6397 }