wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "p2p/p2p.h"
  37 #include "blacklist.h"
  38 #include "wpas_glue.h"
  39 #include "wps_supplicant.h"
  40 #include "ibss_rsn.h"
  41 #include "sme.h"
  42 #include "gas_query.h"
  43 #include "ap.h"
  44 #include "p2p_supplicant.h"
  45 #include "wifi_display.h"
  46 #include "notify.h"
  47 #include "bgscan.h"
  48 #include "autoscan.h"
  49 #include "bss.h"
  50 #include "scan.h"
  51 #include "offchannel.h"
  52 #include "hs20_supplicant.h"
  53 #include "wnm_sta.h"
  54 #include "wpas_kay.h"
  55 #include "mesh.h"
  56
  57 const char *wpa_supplicant_version =
  58 "wpa_supplicant v" VERSION_STR "\n"
  59 "Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi> and contributors";
  60
  61 const char *wpa_supplicant_license =
  62 "This software may be distributed under the terms of the BSD license.\n"
  63 "See README for more details.\n"
  64 #ifdef EAP_TLS_OPENSSL
  65 "\nThis product includes software developed by the OpenSSL Project\n"
  66 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  67 #endif /* EAP_TLS_OPENSSL */
  68 ;
  69
  70 #ifndef CONFIG_NO_STDOUT_DEBUG
  71 /* Long text divided into parts in order to fit in C89 strings size limits. */
  72 const char *wpa_supplicant_full_license1 =
  73 "";
  74 const char *wpa_supplicant_full_license2 =
  75 "This software may be distributed under the terms of the BSD license.\n"
  76 "\n"
  77 "Redistribution and use in source and binary forms, with or without\n"
  78 "modification, are permitted provided that the following conditions are\n"
  79 "met:\n"
  80 "\n";
  81 const char *wpa_supplicant_full_license3 =
  82 "1. Redistributions of source code must retain the above copyright\n"
  83 "   notice, this list of conditions and the following disclaimer.\n"
  84 "\n"
  85 "2. Redistributions in binary form must reproduce the above copyright\n"
  86 "   notice, this list of conditions and the following disclaimer in the\n"
  87 "   documentation and/or other materials provided with the distribution.\n"
  88 "\n";
  89 const char *wpa_supplicant_full_license4 =
  90 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  91 "   names of its contributors may be used to endorse or promote products\n"
  92 "   derived from this software without specific prior written permission.\n"
  93 "\n"
  94 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  95 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  96 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  97 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  98 const char *wpa_supplicant_full_license5 =
  99 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 100 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 101 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 102 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 103 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 104 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 105 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 106 "\n";
 107 #endif /* CONFIG_NO_STDOUT_DEBUG */
 108
 109 /* Configure default/group WEP keys for static WEP */
 110 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 111 {
 112         int i, set = 0;
 113
 114         for (i = 0; i < NUM_WEP_KEYS; i++) {
 115                 if (ssid->wep_key_len[i] == 0)
 116                         continue;
 117
 118                 set = 1;
 119                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 120                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 121                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 122         }
 123
 124         return set;
 125 }
 126
 127
 128 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 129                                     struct wpa_ssid *ssid)
 130 {
 131         u8 key[32];
 132         size_t keylen;
 133         enum wpa_alg alg;
 134         u8 seq[6] = { 0 };
 135
 136         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 137          * sending unicast and multicast packets. */
 138
 139         if (ssid->mode != WPAS_MODE_IBSS) {
 140                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 141                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 142                 return -1;
 143         }
 144
 145         if (!ssid->psk_set) {
 146                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 147                         "WPA-None");
 148                 return -1;
 149         }
 150
 151         switch (wpa_s->group_cipher) {
 152         case WPA_CIPHER_CCMP:
 153                 os_memcpy(key, ssid->psk, 16);
 154                 keylen = 16;
 155                 alg = WPA_ALG_CCMP;
 156                 break;
 157         case WPA_CIPHER_GCMP:
 158                 os_memcpy(key, ssid->psk, 16);
 159                 keylen = 16;
 160                 alg = WPA_ALG_GCMP;
 161                 break;
 162         case WPA_CIPHER_TKIP:
 163                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 164                 os_memcpy(key, ssid->psk, 16 + 8);
 165                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 166                 keylen = 32;
 167                 alg = WPA_ALG_TKIP;
 168                 break;
 169         default:
 170                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 171                         "WPA-None", wpa_s->group_cipher);
 172                 return -1;
 173         }
 174
 175         /* TODO: should actually remember the previously used seq#, both for TX
 176          * and RX from each STA.. */
 177
 178         return wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 179 }
 180
 181
 182 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 183 {
 184         struct wpa_supplicant *wpa_s = eloop_ctx;
 185         const u8 *bssid = wpa_s->bssid;
 186         if (is_zero_ether_addr(bssid))
 187                 bssid = wpa_s->pending_bssid;
 188         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 189                 MAC2STR(bssid));
 190         wpa_blacklist_add(wpa_s, bssid);
 191         wpa_sm_notify_disassoc(wpa_s->wpa);
 192         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 193         wpa_s->reassociate = 1;
 194
 195         /*
 196          * If we timed out, the AP or the local radio may be busy.
 197          * So, wait a second until scanning again.
 198          */
 199         wpa_supplicant_req_scan(wpa_s, 1, 0);
 200 }
 201
 202
 203 /**
 204  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 205  * @wpa_s: Pointer to wpa_supplicant data
 206  * @sec: Number of seconds after which to time out authentication
 207  * @usec: Number of microseconds after which to time out authentication
 208  *
 209  * This function is used to schedule a timeout for the current authentication
 210  * attempt.
 211  */
 212 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 213                                      int sec, int usec)
 214 {
 215         if (wpa_s->conf->ap_scan == 0 &&
 216             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 217                 return;
 218
 219         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 220                 "%d usec", sec, usec);
 221         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 222         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 223 }
 224
 225
 226 /**
 227  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 228  * @wpa_s: Pointer to wpa_supplicant data
 229  *
 230  * This function is used to cancel authentication timeout scheduled with
 231  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 232  * been completed.
 233  */
 234 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 235 {
 236         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 237         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 238         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 239 }
 240
 241
 242 /**
 243  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 244  * @wpa_s: Pointer to wpa_supplicant data
 245  *
 246  * This function is used to configure EAPOL state machine based on the selected
 247  * authentication mode.
 248  */
 249 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 250 {
 251 #ifdef IEEE8021X_EAPOL
 252         struct eapol_config eapol_conf;
 253         struct wpa_ssid *ssid = wpa_s->current_ssid;
 254
 255 #ifdef CONFIG_IBSS_RSN
 256         if (ssid->mode == WPAS_MODE_IBSS &&
 257             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 258             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 259                 /*
 260                  * RSN IBSS authentication is per-STA and we can disable the
 261                  * per-BSSID EAPOL authentication.
 262                  */
 263                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 264                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 265                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 266                 return;
 267         }
 268 #endif /* CONFIG_IBSS_RSN */
 269
 270         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 271         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 272
 273         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 274             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 275                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 276         else
 277                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 278
 279         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 280         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 281                 eapol_conf.accept_802_1x_keys = 1;
 282                 eapol_conf.required_keys = 0;
 283                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 284                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 285                 }
 286                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 287                         eapol_conf.required_keys |=
 288                                 EAPOL_REQUIRE_KEY_BROADCAST;
 289                 }
 290
 291                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 292                         eapol_conf.required_keys = 0;
 293         }
 294         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 295         eapol_conf.workaround = ssid->eap_workaround;
 296         eapol_conf.eap_disabled =
 297                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 298                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 299                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 300         eapol_conf.external_sim = wpa_s->conf->external_sim;
 301
 302 #ifdef CONFIG_WPS
 303         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 304                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 305                 if (wpa_s->current_bss) {
 306                         struct wpabuf *ie;
 307                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 308                                                          WPS_IE_VENDOR_TYPE);
 309                         if (ie) {
 310                                 if (wps_is_20(ie))
 311                                         eapol_conf.wps |=
 312                                                 EAPOL_PEER_IS_WPS20_AP;
 313                                 wpabuf_free(ie);
 314                         }
 315                 }
 316         }
 317 #endif /* CONFIG_WPS */
 318
 319         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 320
 321         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 322 #endif /* IEEE8021X_EAPOL */
 323 }
 324
 325
 326 /**
 327  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 328  * @wpa_s: Pointer to wpa_supplicant data
 329  * @ssid: Configuration data for the network
 330  *
 331  * This function is used to configure WPA state machine and related parameters
 332  * to a mode where WPA is not enabled. This is called as part of the
 333  * authentication configuration when the selected network does not use WPA.
 334  */
 335 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 336                                        struct wpa_ssid *ssid)
 337 {
 338         int i;
 339
 340         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 341                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 342         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 343                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 344         else
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 346         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 347         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 348         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 349         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 350         wpa_s->group_cipher = WPA_CIPHER_NONE;
 351         wpa_s->mgmt_group_cipher = 0;
 352
 353         for (i = 0; i < NUM_WEP_KEYS; i++) {
 354                 if (ssid->wep_key_len[i] > 5) {
 355                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 356                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 357                         break;
 358                 } else if (ssid->wep_key_len[i] > 0) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 361                         break;
 362                 }
 363         }
 364
 365         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 366         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 367         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 368                          wpa_s->pairwise_cipher);
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 370 #ifdef CONFIG_IEEE80211W
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 372                          wpa_s->mgmt_group_cipher);
 373 #endif /* CONFIG_IEEE80211W */
 374
 375         pmksa_cache_clear_current(wpa_s->wpa);
 376 }
 377
 378
 379 void free_hw_features(struct wpa_supplicant *wpa_s)
 380 {
 381         int i;
 382         if (wpa_s->hw.modes == NULL)
 383                 return;
 384
 385         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 386                 os_free(wpa_s->hw.modes[i].channels);
 387                 os_free(wpa_s->hw.modes[i].rates);
 388         }
 389
 390         os_free(wpa_s->hw.modes);
 391         wpa_s->hw.modes = NULL;
 392 }
 393
 394
 395 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 396 {
 397         int i;
 398
 399         bgscan_deinit(wpa_s);
 400         autoscan_deinit(wpa_s);
 401         scard_deinit(wpa_s->scard);
 402         wpa_s->scard = NULL;
 403         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 404         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 405         l2_packet_deinit(wpa_s->l2);
 406         wpa_s->l2 = NULL;
 407         if (wpa_s->l2_br) {
 408                 l2_packet_deinit(wpa_s->l2_br);
 409                 wpa_s->l2_br = NULL;
 410         }
 411 #ifdef CONFIG_TESTING_OPTIONS
 412         l2_packet_deinit(wpa_s->l2_test);
 413         wpa_s->l2_test = NULL;
 414 #endif /* CONFIG_TESTING_OPTIONS */
 415
 416         if (wpa_s->conf != NULL) {
 417                 struct wpa_ssid *ssid;
 418                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 419                         wpas_notify_network_removed(wpa_s, ssid);
 420         }
 421
 422         os_free(wpa_s->confname);
 423         wpa_s->confname = NULL;
 424
 425         os_free(wpa_s->confanother);
 426         wpa_s->confanother = NULL;
 427
 428         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 429         eapol_sm_deinit(wpa_s->eapol);
 430         wpa_s->eapol = NULL;
 431
 432         rsn_preauth_deinit(wpa_s->wpa);
 433
 434 #ifdef CONFIG_TDLS
 435         wpa_tdls_deinit(wpa_s->wpa);
 436 #endif /* CONFIG_TDLS */
 437
 438         pmksa_candidate_free(wpa_s->wpa);
 439         wpa_sm_deinit(wpa_s->wpa);
 440         wpa_s->wpa = NULL;
 441         wpa_blacklist_clear(wpa_s);
 442
 443         wpa_bss_deinit(wpa_s);
 444
 445         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 446         wpa_supplicant_cancel_scan(wpa_s);
 447         wpa_supplicant_cancel_auth_timeout(wpa_s);
 448         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 449 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 450         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 451                              wpa_s, NULL);
 452 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 453
 454         wpas_wps_deinit(wpa_s);
 455
 456         wpabuf_free(wpa_s->pending_eapol_rx);
 457         wpa_s->pending_eapol_rx = NULL;
 458
 459 #ifdef CONFIG_IBSS_RSN
 460         ibss_rsn_deinit(wpa_s->ibss_rsn);
 461         wpa_s->ibss_rsn = NULL;
 462 #endif /* CONFIG_IBSS_RSN */
 463
 464         sme_deinit(wpa_s);
 465
 466 #ifdef CONFIG_AP
 467         wpa_supplicant_ap_deinit(wpa_s);
 468 #endif /* CONFIG_AP */
 469
 470         wpas_p2p_deinit(wpa_s);
 471
 472 #ifdef CONFIG_OFFCHANNEL
 473         offchannel_deinit(wpa_s);
 474 #endif /* CONFIG_OFFCHANNEL */
 475
 476         wpa_supplicant_cancel_sched_scan(wpa_s);
 477
 478         os_free(wpa_s->next_scan_freqs);
 479         wpa_s->next_scan_freqs = NULL;
 480
 481         os_free(wpa_s->manual_scan_freqs);
 482         wpa_s->manual_scan_freqs = NULL;
 483
 484         os_free(wpa_s->manual_sched_scan_freqs);
 485         wpa_s->manual_sched_scan_freqs = NULL;
 486
 487         gas_query_deinit(wpa_s->gas);
 488         wpa_s->gas = NULL;
 489
 490         free_hw_features(wpa_s);
 491
 492         ieee802_1x_dealloc_kay_sm(wpa_s);
 493
 494         os_free(wpa_s->bssid_filter);
 495         wpa_s->bssid_filter = NULL;
 496
 497         os_free(wpa_s->disallow_aps_bssid);
 498         wpa_s->disallow_aps_bssid = NULL;
 499         os_free(wpa_s->disallow_aps_ssid);
 500         wpa_s->disallow_aps_ssid = NULL;
 501
 502         wnm_bss_keep_alive_deinit(wpa_s);
 503 #ifdef CONFIG_WNM
 504         wnm_deallocate_memory(wpa_s);
 505 #endif /* CONFIG_WNM */
 506
 507         ext_password_deinit(wpa_s->ext_pw);
 508         wpa_s->ext_pw = NULL;
 509
 510         wpabuf_free(wpa_s->last_gas_resp);
 511         wpa_s->last_gas_resp = NULL;
 512         wpabuf_free(wpa_s->prev_gas_resp);
 513         wpa_s->prev_gas_resp = NULL;
 514
 515         os_free(wpa_s->last_scan_res);
 516         wpa_s->last_scan_res = NULL;
 517
 518 #ifdef CONFIG_HS20
 519         hs20_deinit(wpa_s);
 520 #endif /* CONFIG_HS20 */
 521
 522         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 523                 wpabuf_free(wpa_s->vendor_elem[i]);
 524                 wpa_s->vendor_elem[i] = NULL;
 525         }
 526
 527         wmm_ac_notify_disassoc(wpa_s);
 528 }
 529
 530
 531 /**
 532  * wpa_clear_keys - Clear keys configured for the driver
 533  * @wpa_s: Pointer to wpa_supplicant data
 534  * @addr: Previously used BSSID or %NULL if not available
 535  *
 536  * This function clears the encryption keys that has been previously configured
 537  * for the driver.
 538  */
 539 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 540 {
 541         int i, max;
 542
 543 #ifdef CONFIG_IEEE80211W
 544         max = 6;
 545 #else /* CONFIG_IEEE80211W */
 546         max = 4;
 547 #endif /* CONFIG_IEEE80211W */
 548
 549         /* MLME-DELETEKEYS.request */
 550         for (i = 0; i < max; i++) {
 551                 if (wpa_s->keys_cleared & BIT(i))
 552                         continue;
 553                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 554                                 NULL, 0);
 555         }
 556         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 557             !is_zero_ether_addr(addr)) {
 558                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 559                                 0);
 560                 /* MLME-SETPROTECTION.request(None) */
 561                 wpa_drv_mlme_setprotection(
 562                         wpa_s, addr,
 563                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 564                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 565         }
 566         wpa_s->keys_cleared = (u32) -1;
 567 }
 568
 569
 570 /**
 571  * wpa_supplicant_state_txt - Get the connection state name as a text string
 572  * @state: State (wpa_state; WPA_*)
 573  * Returns: The state name as a printable text string
 574  */
 575 const char * wpa_supplicant_state_txt(enum wpa_states state)
 576 {
 577         switch (state) {
 578         case WPA_DISCONNECTED:
 579                 return "DISCONNECTED";
 580         case WPA_INACTIVE:
 581                 return "INACTIVE";
 582         case WPA_INTERFACE_DISABLED:
 583                 return "INTERFACE_DISABLED";
 584         case WPA_SCANNING:
 585                 return "SCANNING";
 586         case WPA_AUTHENTICATING:
 587                 return "AUTHENTICATING";
 588         case WPA_ASSOCIATING:
 589                 return "ASSOCIATING";
 590         case WPA_ASSOCIATED:
 591                 return "ASSOCIATED";
 592         case WPA_4WAY_HANDSHAKE:
 593                 return "4WAY_HANDSHAKE";
 594         case WPA_GROUP_HANDSHAKE:
 595                 return "GROUP_HANDSHAKE";
 596         case WPA_COMPLETED:
 597                 return "COMPLETED";
 598         default:
 599                 return "UNKNOWN";
 600         }
 601 }
 602
 603
 604 #ifdef CONFIG_BGSCAN
 605
 606 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 607 {
 608         const char *name;
 609
 610         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 611                 name = wpa_s->current_ssid->bgscan;
 612         else
 613                 name = wpa_s->conf->bgscan;
 614         if (name == NULL || name[0] == '\0')
 615                 return;
 616         if (wpas_driver_bss_selection(wpa_s))
 617                 return;
 618         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 619                 return;
 620 #ifdef CONFIG_P2P
 621         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 622                 return;
 623 #endif /* CONFIG_P2P */
 624
 625         bgscan_deinit(wpa_s);
 626         if (wpa_s->current_ssid) {
 627                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 628                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 629                                 "bgscan");
 630                         /*
 631                          * Live without bgscan; it is only used as a roaming
 632                          * optimization, so the initial connection is not
 633                          * affected.
 634                          */
 635                 } else {
 636                         struct wpa_scan_results *scan_res;
 637                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 638                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 639                                                                    0);
 640                         if (scan_res) {
 641                                 bgscan_notify_scan(wpa_s, scan_res);
 642                                 wpa_scan_results_free(scan_res);
 643                         }
 644                 }
 645         } else
 646                 wpa_s->bgscan_ssid = NULL;
 647 }
 648
 649
 650 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 651 {
 652         if (wpa_s->bgscan_ssid != NULL) {
 653                 bgscan_deinit(wpa_s);
 654                 wpa_s->bgscan_ssid = NULL;
 655         }
 656 }
 657
 658 #endif /* CONFIG_BGSCAN */
 659
 660
 661 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 662 {
 663         if (autoscan_init(wpa_s, 0))
 664                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 665 }
 666
 667
 668 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 669 {
 670         autoscan_deinit(wpa_s);
 671 }
 672
 673
 674 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 675 {
 676         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 677             wpa_s->wpa_state == WPA_SCANNING) {
 678                 autoscan_deinit(wpa_s);
 679                 wpa_supplicant_start_autoscan(wpa_s);
 680         }
 681 }
 682
 683
 684 /**
 685  * wpa_supplicant_set_state - Set current connection state
 686  * @wpa_s: Pointer to wpa_supplicant data
 687  * @state: The new connection state
 688  *
 689  * This function is called whenever the connection state changes, e.g.,
 690  * association is completed for WPA/WPA2 4-Way Handshake is started.
 691  */
 692 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 693                               enum wpa_states state)
 694 {
 695         enum wpa_states old_state = wpa_s->wpa_state;
 696
 697         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 698                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 699                 wpa_supplicant_state_txt(state));
 700
 701         if (state == WPA_INTERFACE_DISABLED) {
 702                 /* Assure normal scan when interface is restored */
 703                 wpa_s->normal_scans = 0;
 704         }
 705
 706         if (state == WPA_COMPLETED) {
 707                 wpas_connect_work_done(wpa_s);
 708                 /* Reinitialize normal_scan counter */
 709                 wpa_s->normal_scans = 0;
 710         }
 711
 712         if (state != WPA_SCANNING)
 713                 wpa_supplicant_notify_scanning(wpa_s, 0);
 714
 715         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 716                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 717 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 718                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 719                         MACSTR " completed [id=%d id_str=%s]",
 720                         MAC2STR(wpa_s->bssid),
 721                         ssid ? ssid->id : -1,
 722                         ssid && ssid->id_str ? ssid->id_str : "");
 723 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 724                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 725                 wpa_s->extra_blacklist_count = 0;
 726                 wpa_s->new_connection = 0;
 727                 wpa_drv_set_operstate(wpa_s, 1);
 728 #ifndef IEEE8021X_EAPOL
 729                 wpa_drv_set_supp_port(wpa_s, 1);
 730 #endif /* IEEE8021X_EAPOL */
 731                 wpa_s->after_wps = 0;
 732                 wpa_s->known_wps_freq = 0;
 733                 wpas_p2p_completed(wpa_s);
 734
 735                 sme_sched_obss_scan(wpa_s, 1);
 736         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 737                    state == WPA_ASSOCIATED) {
 738                 wpa_s->new_connection = 1;
 739                 wpa_drv_set_operstate(wpa_s, 0);
 740 #ifndef IEEE8021X_EAPOL
 741                 wpa_drv_set_supp_port(wpa_s, 0);
 742 #endif /* IEEE8021X_EAPOL */
 743                 sme_sched_obss_scan(wpa_s, 0);
 744         }
 745         wpa_s->wpa_state = state;
 746
 747 #ifdef CONFIG_BGSCAN
 748         if (state == WPA_COMPLETED)
 749                 wpa_supplicant_start_bgscan(wpa_s);
 750         else if (state < WPA_ASSOCIATED)
 751                 wpa_supplicant_stop_bgscan(wpa_s);
 752 #endif /* CONFIG_BGSCAN */
 753
 754         if (state == WPA_AUTHENTICATING)
 755                 wpa_supplicant_stop_autoscan(wpa_s);
 756
 757         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 758                 wpa_supplicant_start_autoscan(wpa_s);
 759
 760         if (wpa_s->wpa_state != old_state) {
 761                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 762
 763                 /*
 764                  * Notify the P2P Device interface about a state change in one
 765                  * of the interfaces.
 766                  */
 767                 wpas_p2p_indicate_state_change(wpa_s);
 768
 769                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 770                     old_state == WPA_COMPLETED)
 771                         wpas_notify_auth_changed(wpa_s);
 772         }
 773 }
 774
 775
 776 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 777 {
 778         int pending = 0;
 779 #ifdef CONFIG_WPS
 780         struct wpa_supplicant *wpa_s = global->ifaces;
 781         while (wpa_s) {
 782                 struct wpa_supplicant *next = wpa_s->next;
 783                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 784                         pending = 1;
 785 #ifdef CONFIG_P2P
 786                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 787                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 788                         wpas_p2p_disconnect(wpa_s);
 789 #endif /* CONFIG_P2P */
 790                 wpa_s = next;
 791         }
 792 #endif /* CONFIG_WPS */
 793         if (pending)
 794                 return;
 795         eloop_terminate();
 796 }
 797
 798
 799 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 800 {
 801         struct wpa_global *global = signal_ctx;
 802         wpa_supplicant_terminate_proc(global);
 803 }
 804
 805
 806 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 807 {
 808         enum wpa_states old_state = wpa_s->wpa_state;
 809
 810         wpa_s->pairwise_cipher = 0;
 811         wpa_s->group_cipher = 0;
 812         wpa_s->mgmt_group_cipher = 0;
 813         wpa_s->key_mgmt = 0;
 814         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 815                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 816
 817         if (wpa_s->wpa_state != old_state)
 818                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 819 }
 820
 821
 822 /**
 823  * wpa_supplicant_reload_configuration - Reload configuration data
 824  * @wpa_s: Pointer to wpa_supplicant data
 825  * Returns: 0 on success or -1 if configuration parsing failed
 826  *
 827  * This function can be used to request that the configuration data is reloaded
 828  * (e.g., after configuration file change). This function is reloading
 829  * configuration only for one interface, so this may need to be called multiple
 830  * times if %wpa_supplicant is controlling multiple interfaces and all
 831  * interfaces need reconfiguration.
 832  */
 833 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 834 {
 835         struct wpa_config *conf;
 836         int reconf_ctrl;
 837         int old_ap_scan;
 838
 839         if (wpa_s->confname == NULL)
 840                 return -1;
 841         conf = wpa_config_read(wpa_s->confname, NULL);
 842         if (conf == NULL) {
 843                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 844                         "file '%s' - exiting", wpa_s->confname);
 845                 return -1;
 846         }
 847         wpa_config_read(wpa_s->confanother, conf);
 848
 849         conf->changed_parameters = (unsigned int) -1;
 850
 851         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 852                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 853                     os_strcmp(conf->ctrl_interface,
 854                               wpa_s->conf->ctrl_interface) != 0);
 855
 856         if (reconf_ctrl && wpa_s->ctrl_iface) {
 857                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 858                 wpa_s->ctrl_iface = NULL;
 859         }
 860
 861         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 862         if (wpa_s->current_ssid) {
 863                 wpa_supplicant_deauthenticate(wpa_s,
 864                                               WLAN_REASON_DEAUTH_LEAVING);
 865         }
 866
 867         /*
 868          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 869          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 870          */
 871         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 872                 /*
 873                  * Clear forced success to clear EAP state for next
 874                  * authentication.
 875                  */
 876                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 877         }
 878         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 879         wpa_sm_set_config(wpa_s->wpa, NULL);
 880         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 881         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 882         rsn_preauth_deinit(wpa_s->wpa);
 883
 884         old_ap_scan = wpa_s->conf->ap_scan;
 885         wpa_config_free(wpa_s->conf);
 886         wpa_s->conf = conf;
 887         if (old_ap_scan != wpa_s->conf->ap_scan)
 888                 wpas_notify_ap_scan_changed(wpa_s);
 889
 890         if (reconf_ctrl)
 891                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 892
 893         wpa_supplicant_update_config(wpa_s);
 894
 895         wpa_supplicant_clear_status(wpa_s);
 896         if (wpa_supplicant_enabled_networks(wpa_s)) {
 897                 wpa_s->reassociate = 1;
 898                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 899         }
 900         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 901         return 0;
 902 }
 903
 904
 905 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 906 {
 907         struct wpa_global *global = signal_ctx;
 908         struct wpa_supplicant *wpa_s;
 909         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 910                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 911                         sig);
 912                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 913                         wpa_supplicant_terminate_proc(global);
 914                 }
 915         }
 916 }
 917
 918
 919 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 920                                          struct wpa_ssid *ssid,
 921                                          struct wpa_ie_data *ie)
 922 {
 923         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 924         if (ret) {
 925                 if (ret == -2) {
 926                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 927                                 "from association info");
 928                 }
 929                 return -1;
 930         }
 931
 932         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 933                 "cipher suites");
 934         if (!(ie->group_cipher & ssid->group_cipher)) {
 935                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 936                         "cipher 0x%x (mask 0x%x) - reject",
 937                         ie->group_cipher, ssid->group_cipher);
 938                 return -1;
 939         }
 940         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 941                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 942                         "cipher 0x%x (mask 0x%x) - reject",
 943                         ie->pairwise_cipher, ssid->pairwise_cipher);
 944                 return -1;
 945         }
 946         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 947                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 948                         "management 0x%x (mask 0x%x) - reject",
 949                         ie->key_mgmt, ssid->key_mgmt);
 950                 return -1;
 951         }
 952
 953 #ifdef CONFIG_IEEE80211W
 954         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 955             (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
 956              wpa_s->conf->pmf : ssid->ieee80211w) ==
 957             MGMT_FRAME_PROTECTION_REQUIRED) {
 958                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 959                         "that does not support management frame protection - "
 960                         "reject");
 961                 return -1;
 962         }
 963 #endif /* CONFIG_IEEE80211W */
 964
 965         return 0;
 966 }
 967
 968
 969 /**
 970  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 971  * @wpa_s: Pointer to wpa_supplicant data
 972  * @bss: Scan results for the selected BSS, or %NULL if not available
 973  * @ssid: Configuration data for the selected network
 974  * @wpa_ie: Buffer for the WPA/RSN IE
 975  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 976  * used buffer length in case the functions returns success.
 977  * Returns: 0 on success or -1 on failure
 978  *
 979  * This function is used to configure authentication and encryption parameters
 980  * based on the network configuration and scan result for the selected BSS (if
 981  * available).
 982  */
 983 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 984                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 985                               u8 *wpa_ie, size_t *wpa_ie_len)
 986 {
 987         struct wpa_ie_data ie;
 988         int sel, proto;
 989         const u8 *bss_wpa, *bss_rsn, *bss_osen;
 990
 991         if (bss) {
 992                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 993                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
 994                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
 995         } else
 996                 bss_wpa = bss_rsn = bss_osen = NULL;
 997
 998         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
 999             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1000             (ie.group_cipher & ssid->group_cipher) &&
1001             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1002             (ie.key_mgmt & ssid->key_mgmt)) {
1003                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1004                 proto = WPA_PROTO_RSN;
1005         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1006                    wpa_parse_wpa_ie(bss_wpa, 2 +bss_wpa[1], &ie) == 0 &&
1007                    (ie.group_cipher & ssid->group_cipher) &&
1008                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1009                    (ie.key_mgmt & ssid->key_mgmt)) {
1010                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1011                 proto = WPA_PROTO_WPA;
1012 #ifdef CONFIG_HS20
1013         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1014                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1015                 /* TODO: parse OSEN element */
1016                 os_memset(&ie, 0, sizeof(ie));
1017                 ie.group_cipher = WPA_CIPHER_CCMP;
1018                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1019                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1020                 proto = WPA_PROTO_OSEN;
1021 #endif /* CONFIG_HS20 */
1022         } else if (bss) {
1023                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1024                 return -1;
1025         } else {
1026                 if (ssid->proto & WPA_PROTO_OSEN)
1027                         proto = WPA_PROTO_OSEN;
1028                 else if (ssid->proto & WPA_PROTO_RSN)
1029                         proto = WPA_PROTO_RSN;
1030                 else
1031                         proto = WPA_PROTO_WPA;
1032                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1033                         os_memset(&ie, 0, sizeof(ie));
1034                         ie.group_cipher = ssid->group_cipher;
1035                         ie.pairwise_cipher = ssid->pairwise_cipher;
1036                         ie.key_mgmt = ssid->key_mgmt;
1037 #ifdef CONFIG_IEEE80211W
1038                         ie.mgmt_group_cipher =
1039                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1040                                 WPA_CIPHER_AES_128_CMAC : 0;
1041 #endif /* CONFIG_IEEE80211W */
1042                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1043                                 "based on configuration");
1044                 } else
1045                         proto = ie.proto;
1046         }
1047
1048         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1049                 "pairwise %d key_mgmt %d proto %d",
1050                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1051 #ifdef CONFIG_IEEE80211W
1052         if (ssid->ieee80211w) {
1053                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1054                         ie.mgmt_group_cipher);
1055         }
1056 #endif /* CONFIG_IEEE80211W */
1057
1058         wpa_s->wpa_proto = proto;
1059         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1060         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1061                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1062
1063         if (bss || !wpa_s->ap_ies_from_associnfo) {
1064                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1065                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1066                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1067                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1068                         return -1;
1069         }
1070
1071         sel = ie.group_cipher & ssid->group_cipher;
1072         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1073         if (wpa_s->group_cipher < 0) {
1074                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1075                         "cipher");
1076                 return -1;
1077         }
1078         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1079                 wpa_cipher_txt(wpa_s->group_cipher));
1080
1081         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1082         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1083         if (wpa_s->pairwise_cipher < 0) {
1084                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1085                         "cipher");
1086                 return -1;
1087         }
1088         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1089                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1090
1091         sel = ie.key_mgmt & ssid->key_mgmt;
1092 #ifdef CONFIG_SAE
1093         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1094                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1095 #endif /* CONFIG_SAE */
1096         if (0) {
1097         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1098                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1099                 wpa_dbg(wpa_s, MSG_DEBUG,
1100                         "WPA: using KEY_MGMT 802.1X with Suite B");
1101 #ifdef CONFIG_IEEE80211R
1102         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1103                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1104                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1105         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1106                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1107                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1108 #endif /* CONFIG_IEEE80211R */
1109 #ifdef CONFIG_SAE
1110         } else if (sel & WPA_KEY_MGMT_SAE) {
1111                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1112                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1113         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1114                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1115                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1116 #endif /* CONFIG_SAE */
1117 #ifdef CONFIG_IEEE80211W
1118         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1119                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1120                 wpa_dbg(wpa_s, MSG_DEBUG,
1121                         "WPA: using KEY_MGMT 802.1X with SHA256");
1122         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1123                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1124                 wpa_dbg(wpa_s, MSG_DEBUG,
1125                         "WPA: using KEY_MGMT PSK with SHA256");
1126 #endif /* CONFIG_IEEE80211W */
1127         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1128                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1129                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1130         } else if (sel & WPA_KEY_MGMT_PSK) {
1131                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1132                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1133         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1134                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1135                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1136 #ifdef CONFIG_HS20
1137         } else if (sel & WPA_KEY_MGMT_OSEN) {
1138                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1139                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1140 #endif /* CONFIG_HS20 */
1141         } else {
1142                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1143                         "authenticated key management type");
1144                 return -1;
1145         }
1146
1147         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1148         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1149                          wpa_s->pairwise_cipher);
1150         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1151
1152 #ifdef CONFIG_IEEE80211W
1153         sel = ie.mgmt_group_cipher;
1154         if ((ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1155              wpa_s->conf->pmf : ssid->ieee80211w) == NO_MGMT_FRAME_PROTECTION ||
1156             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1157                 sel = 0;
1158         if (sel & WPA_CIPHER_AES_128_CMAC) {
1159                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1160                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1161                         "AES-128-CMAC");
1162         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1163                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1164                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1165                         "BIP-GMAC-128");
1166         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1167                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1168                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1169                         "BIP-GMAC-256");
1170         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1171                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1172                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1173                         "BIP-CMAC-256");
1174         } else {
1175                 wpa_s->mgmt_group_cipher = 0;
1176                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1177         }
1178         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1179                          wpa_s->mgmt_group_cipher);
1180         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1181                          (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1182                           wpa_s->conf->pmf : ssid->ieee80211w));
1183 #endif /* CONFIG_IEEE80211W */
1184
1185         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1186                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1187                 return -1;
1188         }
1189
1190         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1191                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1192 #ifndef CONFIG_NO_PBKDF2
1193                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1194                     ssid->passphrase) {
1195                         u8 psk[PMK_LEN];
1196                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1197                                     4096, psk, PMK_LEN);
1198                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1199                                         psk, PMK_LEN);
1200                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1201                 }
1202 #endif /* CONFIG_NO_PBKDF2 */
1203 #ifdef CONFIG_EXT_PASSWORD
1204                 if (ssid->ext_psk) {
1205                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1206                                                              ssid->ext_psk);
1207                         char pw_str[64 + 1];
1208                         u8 psk[PMK_LEN];
1209
1210                         if (pw == NULL) {
1211                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1212                                         "found from external storage");
1213                                 return -1;
1214                         }
1215
1216                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1217                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1218                                         "PSK length %d in external storage",
1219                                         (int) wpabuf_len(pw));
1220                                 ext_password_free(pw);
1221                                 return -1;
1222                         }
1223
1224                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1225                         pw_str[wpabuf_len(pw)] = '\0';
1226
1227 #ifndef CONFIG_NO_PBKDF2
1228                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1229                         {
1230                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1231                                             4096, psk, PMK_LEN);
1232                                 os_memset(pw_str, 0, sizeof(pw_str));
1233                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1234                                                 "external passphrase)",
1235                                                 psk, PMK_LEN);
1236                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1237                         } else
1238 #endif /* CONFIG_NO_PBKDF2 */
1239                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1240                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1241                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1242                                                 "Invalid PSK hex string");
1243                                         os_memset(pw_str, 0, sizeof(pw_str));
1244                                         ext_password_free(pw);
1245                                         return -1;
1246                                 }
1247                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1248                         } else {
1249                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1250                                         "PSK available");
1251                                 os_memset(pw_str, 0, sizeof(pw_str));
1252                                 ext_password_free(pw);
1253                                 return -1;
1254                         }
1255
1256                         os_memset(pw_str, 0, sizeof(pw_str));
1257                         ext_password_free(pw);
1258                 }
1259 #endif /* CONFIG_EXT_PASSWORD */
1260         } else
1261                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1262
1263         return 0;
1264 }
1265
1266
1267 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1268 {
1269         *pos = 0x00;
1270
1271         switch (idx) {
1272         case 0: /* Bits 0-7 */
1273                 break;
1274         case 1: /* Bits 8-15 */
1275                 break;
1276         case 2: /* Bits 16-23 */
1277 #ifdef CONFIG_WNM
1278                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1279                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1280 #endif /* CONFIG_WNM */
1281                 break;
1282         case 3: /* Bits 24-31 */
1283 #ifdef CONFIG_WNM
1284                 *pos |= 0x02; /* Bit 25 - SSID List */
1285 #endif /* CONFIG_WNM */
1286 #ifdef CONFIG_INTERWORKING
1287                 if (wpa_s->conf->interworking)
1288                         *pos |= 0x80; /* Bit 31 - Interworking */
1289 #endif /* CONFIG_INTERWORKING */
1290                 break;
1291         case 4: /* Bits 32-39 */
1292 #ifdef CONFIG_INTERWORKING
1293                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1294                         *pos |= 0x01; /* Bit 32 - QoS Map */
1295 #endif /* CONFIG_INTERWORKING */
1296                 break;
1297         case 5: /* Bits 40-47 */
1298 #ifdef CONFIG_HS20
1299                 if (wpa_s->conf->hs20)
1300                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1301 #endif /* CONFIG_HS20 */
1302                 break;
1303         case 6: /* Bits 48-55 */
1304                 break;
1305         }
1306 }
1307
1308
1309 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1310 {
1311         u8 *pos = buf;
1312         u8 len = 6, i;
1313
1314         if (len < wpa_s->extended_capa_len)
1315                 len = wpa_s->extended_capa_len;
1316         if (buflen < (size_t) len + 2) {
1317                 wpa_printf(MSG_INFO,
1318                            "Not enough room for building extended capabilities element");
1319                 return -1;
1320         }
1321
1322         *pos++ = WLAN_EID_EXT_CAPAB;
1323         *pos++ = len;
1324         for (i = 0; i < len; i++, pos++) {
1325                 wpas_ext_capab_byte(wpa_s, pos, i);
1326
1327                 if (i < wpa_s->extended_capa_len) {
1328                         *pos &= ~wpa_s->extended_capa_mask[i];
1329                         *pos |= wpa_s->extended_capa[i];
1330                 }
1331         }
1332
1333         while (len > 0 && buf[1 + len] == 0) {
1334                 len--;
1335                 buf[1] = len;
1336         }
1337         if (len == 0)
1338                 return 0;
1339
1340         return 2 + len;
1341 }
1342
1343
1344 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1345                           struct wpa_bss *test_bss)
1346 {
1347         struct wpa_bss *bss;
1348
1349         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1350                 if (bss == test_bss)
1351                         return 1;
1352         }
1353
1354         return 0;
1355 }
1356
1357
1358 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1359                            struct wpa_ssid *test_ssid)
1360 {
1361         struct wpa_ssid *ssid;
1362
1363         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1364                 if (ssid == test_ssid)
1365                         return 1;
1366         }
1367
1368         return 0;
1369 }
1370
1371
1372 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1373                         struct wpa_ssid *test_ssid)
1374 {
1375         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1376                 return 0;
1377
1378         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1379 }
1380
1381
1382 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1383 {
1384         if (cwork == NULL)
1385                 return;
1386         os_free(cwork);
1387 }
1388
1389
1390 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1391 {
1392         struct wpa_connect_work *cwork;
1393         struct wpa_radio_work *work = wpa_s->connect_work;
1394
1395         if (!work)
1396                 return;
1397
1398         wpa_s->connect_work = NULL;
1399         cwork = work->ctx;
1400         work->ctx = NULL;
1401         wpas_connect_work_free(cwork);
1402         radio_work_done(work);
1403 }
1404
1405
1406 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1407 {
1408         struct os_reltime now;
1409         u8 addr[ETH_ALEN];
1410
1411         os_get_reltime(&now);
1412         if (wpa_s->last_mac_addr_style == style &&
1413             wpa_s->last_mac_addr_change.sec != 0 &&
1414             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1415                                 wpa_s->conf->rand_addr_lifetime)) {
1416                 wpa_msg(wpa_s, MSG_DEBUG,
1417                         "Previously selected random MAC address has not yet expired");
1418                 return 0;
1419         }
1420
1421         switch (style) {
1422         case 1:
1423                 if (random_mac_addr(addr) < 0)
1424                         return -1;
1425                 break;
1426         case 2:
1427                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1428                 if (random_mac_addr_keep_oui(addr) < 0)
1429                         return -1;
1430                 break;
1431         default:
1432                 return -1;
1433         }
1434
1435         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1436                 wpa_msg(wpa_s, MSG_INFO,
1437                         "Failed to set random MAC address");
1438                 return -1;
1439         }
1440
1441         os_get_reltime(&wpa_s->last_mac_addr_change);
1442         wpa_s->mac_addr_changed = 1;
1443         wpa_s->last_mac_addr_style = style;
1444
1445         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1446                 wpa_msg(wpa_s, MSG_INFO,
1447                         "Could not update MAC address information");
1448                 return -1;
1449         }
1450
1451         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1452                 MAC2STR(addr));
1453
1454         return 0;
1455 }
1456
1457
1458 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1459 {
1460         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1461             !wpa_s->conf->preassoc_mac_addr)
1462                 return 0;
1463
1464         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1465 }
1466
1467
1468 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1469
1470 /**
1471  * wpa_supplicant_associate - Request association
1472  * @wpa_s: Pointer to wpa_supplicant data
1473  * @bss: Scan results for the selected BSS, or %NULL if not available
1474  * @ssid: Configuration data for the selected network
1475  *
1476  * This function is used to request %wpa_supplicant to associate with a BSS.
1477  */
1478 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1479                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1480 {
1481         struct wpa_connect_work *cwork;
1482         int rand_style;
1483
1484         if (ssid->mac_addr == -1)
1485                 rand_style = wpa_s->conf->mac_addr;
1486         else
1487                 rand_style = ssid->mac_addr;
1488
1489         if (wpa_s->last_ssid == ssid) {
1490                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1491         } else if (rand_style > 0) {
1492                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1493                         return;
1494                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1495         } else if (wpa_s->mac_addr_changed) {
1496                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1497                         wpa_msg(wpa_s, MSG_INFO,
1498                                 "Could not restore permanent MAC address");
1499                         return;
1500                 }
1501                 wpa_s->mac_addr_changed = 0;
1502                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1503                         wpa_msg(wpa_s, MSG_INFO,
1504                                 "Could not update MAC address information");
1505                         return;
1506                 }
1507                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1508         }
1509         wpa_s->last_ssid = ssid;
1510
1511 #ifdef CONFIG_IBSS_RSN
1512         ibss_rsn_deinit(wpa_s->ibss_rsn);
1513         wpa_s->ibss_rsn = NULL;
1514 #endif /* CONFIG_IBSS_RSN */
1515
1516         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1517             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1518 #ifdef CONFIG_AP
1519                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1520                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1521                                 "mode");
1522                         return;
1523                 }
1524                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1525                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1526                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1527                                 wpas_p2p_ap_setup_failed(wpa_s);
1528                         return;
1529                 }
1530                 wpa_s->current_bss = bss;
1531 #else /* CONFIG_AP */
1532                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1533                         "the build");
1534 #endif /* CONFIG_AP */
1535                 return;
1536         }
1537
1538         if (ssid->mode == WPAS_MODE_MESH) {
1539 #ifdef CONFIG_MESH
1540                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1541                         wpa_msg(wpa_s, MSG_INFO,
1542                                 "Driver does not support mesh mode");
1543                         return;
1544                 }
1545                 if (bss)
1546                         ssid->frequency = bss->freq;
1547                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1548                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1549                         return;
1550                 }
1551                 wpa_s->current_bss = bss;
1552                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1553                              "ssid=\"%s\" id=%d",
1554                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1555                              ssid->id);
1556 #else /* CONFIG_MESH */
1557                 wpa_msg(wpa_s, MSG_ERROR,
1558                         "mesh mode support not included in the build");
1559 #endif /* CONFIG_MESH */
1560                 return;
1561         }
1562
1563 #ifdef CONFIG_TDLS
1564         if (bss)
1565                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1566                                 bss->ie_len);
1567 #endif /* CONFIG_TDLS */
1568
1569         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1570             ssid->mode == IEEE80211_MODE_INFRA) {
1571                 sme_authenticate(wpa_s, bss, ssid);
1572                 return;
1573         }
1574
1575         if (wpa_s->connect_work) {
1576                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1577                 return;
1578         }
1579
1580         if (radio_work_pending(wpa_s, "connect")) {
1581                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1582                 return;
1583         }
1584
1585         cwork = os_zalloc(sizeof(*cwork));
1586         if (cwork == NULL)
1587                 return;
1588
1589         cwork->bss = bss;
1590         cwork->ssid = ssid;
1591
1592         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1593                            wpas_start_assoc_cb, cwork) < 0) {
1594                 os_free(cwork);
1595         }
1596 }
1597
1598
1599 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1600 {
1601         struct wpa_connect_work *cwork = work->ctx;
1602         struct wpa_bss *bss = cwork->bss;
1603         struct wpa_ssid *ssid = cwork->ssid;
1604         struct wpa_supplicant *wpa_s = work->wpa_s;
1605         u8 wpa_ie[200];
1606         size_t wpa_ie_len;
1607         int use_crypt, ret, i, bssid_changed;
1608         int algs = WPA_AUTH_ALG_OPEN;
1609         unsigned int cipher_pairwise, cipher_group;
1610         struct wpa_driver_associate_params params;
1611         int wep_keys_set = 0;
1612         int assoc_failed = 0;
1613         struct wpa_ssid *old_ssid;
1614 #ifdef CONFIG_HT_OVERRIDES
1615         struct ieee80211_ht_capabilities htcaps;
1616         struct ieee80211_ht_capabilities htcaps_mask;
1617 #endif /* CONFIG_HT_OVERRIDES */
1618 #ifdef CONFIG_VHT_OVERRIDES
1619        struct ieee80211_vht_capabilities vhtcaps;
1620        struct ieee80211_vht_capabilities vhtcaps_mask;
1621 #endif /* CONFIG_VHT_OVERRIDES */
1622
1623         if (deinit) {
1624                 if (work->started) {
1625                         wpa_s->connect_work = NULL;
1626
1627                         /* cancel possible auth. timeout */
1628                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1629                                              NULL);
1630                 }
1631                 wpas_connect_work_free(cwork);
1632                 return;
1633         }
1634
1635         wpa_s->connect_work = work;
1636
1637         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1638                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1639                 wpas_connect_work_done(wpa_s);
1640                 return;
1641         }
1642
1643         os_memset(&params, 0, sizeof(params));
1644         wpa_s->reassociate = 0;
1645         wpa_s->eap_expected_failure = 0;
1646         if (bss &&
1647             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1648 #ifdef CONFIG_IEEE80211R
1649                 const u8 *ie, *md = NULL;
1650 #endif /* CONFIG_IEEE80211R */
1651                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1652                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1653                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1654                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1655                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1656                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1657                 if (bssid_changed)
1658                         wpas_notify_bssid_changed(wpa_s);
1659 #ifdef CONFIG_IEEE80211R
1660                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1661                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1662                         md = ie + 2;
1663                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1664                 if (md) {
1665                         /* Prepare for the next transition */
1666                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1667                 }
1668 #endif /* CONFIG_IEEE80211R */
1669 #ifdef CONFIG_WPS
1670         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1671                    wpa_s->conf->ap_scan == 2 &&
1672                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1673                 /* Use ap_scan==1 style network selection to find the network
1674                  */
1675                 wpas_connect_work_done(wpa_s);
1676                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1677                 wpa_s->reassociate = 1;
1678                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1679                 return;
1680 #endif /* CONFIG_WPS */
1681         } else {
1682                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1683                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1684                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1685         }
1686         wpa_supplicant_cancel_sched_scan(wpa_s);
1687         wpa_supplicant_cancel_scan(wpa_s);
1688
1689         /* Starting new association, so clear the possibly used WPA IE from the
1690          * previous association. */
1691         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1692
1693 #ifdef IEEE8021X_EAPOL
1694         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1695                 if (ssid->leap) {
1696                         if (ssid->non_leap == 0)
1697                                 algs = WPA_AUTH_ALG_LEAP;
1698                         else
1699                                 algs |= WPA_AUTH_ALG_LEAP;
1700                 }
1701         }
1702 #endif /* IEEE8021X_EAPOL */
1703         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1704         if (ssid->auth_alg) {
1705                 algs = ssid->auth_alg;
1706                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1707                         "0x%x", algs);
1708         }
1709
1710         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1711                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1712             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1713                 int try_opportunistic;
1714                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1715                                      wpa_s->conf->okc :
1716                                      ssid->proactive_key_caching) &&
1717                         (ssid->proto & WPA_PROTO_RSN);
1718                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
1719                                             ssid, try_opportunistic) == 0)
1720                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
1721                 wpa_ie_len = sizeof(wpa_ie);
1722                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1723                                               wpa_ie, &wpa_ie_len)) {
1724                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1725                                 "key management and encryption suites");
1726                         wpas_connect_work_done(wpa_s);
1727                         return;
1728                 }
1729         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
1730                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1731                 /*
1732                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1733                  * use non-WPA since the scan results did not indicate that the
1734                  * AP is using WPA or WPA2.
1735                  */
1736                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1737                 wpa_ie_len = 0;
1738                 wpa_s->wpa_proto = 0;
1739         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1740                 wpa_ie_len = sizeof(wpa_ie);
1741                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1742                                               wpa_ie, &wpa_ie_len)) {
1743                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1744                                 "key management and encryption suites (no "
1745                                 "scan results)");
1746                         wpas_connect_work_done(wpa_s);
1747                         return;
1748                 }
1749 #ifdef CONFIG_WPS
1750         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1751                 struct wpabuf *wps_ie;
1752                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1753                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
1754                         wpa_ie_len = wpabuf_len(wps_ie);
1755                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
1756                 } else
1757                         wpa_ie_len = 0;
1758                 wpabuf_free(wps_ie);
1759                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1760                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
1761                         params.wps = WPS_MODE_PRIVACY;
1762                 else
1763                         params.wps = WPS_MODE_OPEN;
1764                 wpa_s->wpa_proto = 0;
1765 #endif /* CONFIG_WPS */
1766         } else {
1767                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1768                 wpa_ie_len = 0;
1769                 wpa_s->wpa_proto = 0;
1770         }
1771
1772 #ifdef CONFIG_P2P
1773         if (wpa_s->global->p2p) {
1774                 u8 *pos;
1775                 size_t len;
1776                 int res;
1777                 pos = wpa_ie + wpa_ie_len;
1778                 len = sizeof(wpa_ie) - wpa_ie_len;
1779                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
1780                                             ssid->p2p_group);
1781                 if (res >= 0)
1782                         wpa_ie_len += res;
1783         }
1784
1785         wpa_s->cross_connect_disallowed = 0;
1786         if (bss) {
1787                 struct wpabuf *p2p;
1788                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
1789                 if (p2p) {
1790                         wpa_s->cross_connect_disallowed =
1791                                 p2p_get_cross_connect_disallowed(p2p);
1792                         wpabuf_free(p2p);
1793                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
1794                                 "connection",
1795                                 wpa_s->cross_connect_disallowed ?
1796                                 "disallows" : "allows");
1797                 }
1798         }
1799
1800         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
1801 #endif /* CONFIG_P2P */
1802
1803 #ifdef CONFIG_HS20
1804         if (is_hs20_network(wpa_s, ssid, bss)) {
1805                 struct wpabuf *hs20;
1806                 hs20 = wpabuf_alloc(20);
1807                 if (hs20) {
1808                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
1809                         size_t len;
1810
1811                         wpas_hs20_add_indication(hs20, pps_mo_id);
1812                         len = sizeof(wpa_ie) - wpa_ie_len;
1813                         if (wpabuf_len(hs20) <= len) {
1814                                 os_memcpy(wpa_ie + wpa_ie_len,
1815                                           wpabuf_head(hs20), wpabuf_len(hs20));
1816                                 wpa_ie_len += wpabuf_len(hs20);
1817                         }
1818                         wpabuf_free(hs20);
1819                 }
1820         }
1821 #endif /* CONFIG_HS20 */
1822
1823         /*
1824          * Workaround: Add Extended Capabilities element only if the AP
1825          * included this element in Beacon/Probe Response frames. Some older
1826          * APs seem to have interoperability issues if this element is
1827          * included, so while the standard may require us to include the
1828          * element in all cases, it is justifiable to skip it to avoid
1829          * interoperability issues.
1830          */
1831         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
1832                 u8 ext_capab[18];
1833                 int ext_capab_len;
1834                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
1835                                                      sizeof(ext_capab));
1836                 if (ext_capab_len > 0) {
1837                         u8 *pos = wpa_ie;
1838                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
1839                                 pos += 2 + pos[1];
1840                         os_memmove(pos + ext_capab_len, pos,
1841                                    wpa_ie_len - (pos - wpa_ie));
1842                         wpa_ie_len += ext_capab_len;
1843                         os_memcpy(pos, ext_capab, ext_capab_len);
1844                 }
1845         }
1846
1847         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
1848         use_crypt = 1;
1849         cipher_pairwise = wpa_s->pairwise_cipher;
1850         cipher_group = wpa_s->group_cipher;
1851         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1852             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1853                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
1854                         use_crypt = 0;
1855                 if (wpa_set_wep_keys(wpa_s, ssid)) {
1856                         use_crypt = 1;
1857                         wep_keys_set = 1;
1858                 }
1859         }
1860         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
1861                 use_crypt = 0;
1862
1863 #ifdef IEEE8021X_EAPOL
1864         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1865                 if ((ssid->eapol_flags &
1866                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
1867                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
1868                     !wep_keys_set) {
1869                         use_crypt = 0;
1870                 } else {
1871                         /* Assume that dynamic WEP-104 keys will be used and
1872                          * set cipher suites in order for drivers to expect
1873                          * encryption. */
1874                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
1875                 }
1876         }
1877 #endif /* IEEE8021X_EAPOL */
1878
1879         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
1880                 /* Set the key before (and later after) association */
1881                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
1882         }
1883
1884         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
1885         if (bss) {
1886                 params.ssid = bss->ssid;
1887                 params.ssid_len = bss->ssid_len;
1888                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
1889                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
1890                                    MACSTR " freq=%u MHz based on scan results "
1891                                    "(bssid_set=%d)",
1892                                    MAC2STR(bss->bssid), bss->freq,
1893                                    ssid->bssid_set);
1894                         params.bssid = bss->bssid;
1895                         params.freq.freq = bss->freq;
1896                 }
1897                 params.bssid_hint = bss->bssid;
1898                 params.freq_hint = bss->freq;
1899         } else {
1900                 params.ssid = ssid->ssid;
1901                 params.ssid_len = ssid->ssid_len;
1902         }
1903
1904         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
1905             wpa_s->conf->ap_scan == 2) {
1906                 params.bssid = ssid->bssid;
1907                 params.fixed_bssid = 1;
1908         }
1909
1910         /* Initial frequency for IBSS/mesh */
1911         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
1912             ssid->frequency > 0 && params.freq.freq == 0) {
1913                 enum hostapd_hw_mode hw_mode;
1914                 u8 channel;
1915
1916                 params.freq.freq = ssid->frequency;
1917
1918                 hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1919                 for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1920                         if (wpa_s->hw.modes[i].mode == hw_mode) {
1921                                 struct hostapd_hw_modes *mode;
1922
1923                                 mode = &wpa_s->hw.modes[i];
1924                                 params.freq.ht_enabled = ht_supported(mode);
1925                                 break;
1926                         }
1927                 }
1928         }
1929
1930         if (ssid->mode == WPAS_MODE_IBSS) {
1931                 if (ssid->beacon_int)
1932                         params.beacon_int = ssid->beacon_int;
1933                 else
1934                         params.beacon_int = wpa_s->conf->beacon_int;
1935         }
1936
1937         params.wpa_ie = wpa_ie;
1938         params.wpa_ie_len = wpa_ie_len;
1939         params.pairwise_suite = cipher_pairwise;
1940         params.group_suite = cipher_group;
1941         params.key_mgmt_suite = wpa_s->key_mgmt;
1942         params.wpa_proto = wpa_s->wpa_proto;
1943         params.auth_alg = algs;
1944         params.mode = ssid->mode;
1945         params.bg_scan_period = ssid->bg_scan_period;
1946         for (i = 0; i < NUM_WEP_KEYS; i++) {
1947                 if (ssid->wep_key_len[i])
1948                         params.wep_key[i] = ssid->wep_key[i];
1949                 params.wep_key_len[i] = ssid->wep_key_len[i];
1950         }
1951         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
1952
1953         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
1954             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
1955              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
1956                 params.passphrase = ssid->passphrase;
1957                 if (ssid->psk_set)
1958                         params.psk = ssid->psk;
1959         }
1960
1961         if (wpa_s->conf->key_mgmt_offload) {
1962                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
1963                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
1964                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B)
1965                         params.req_key_mgmt_offload =
1966                                 ssid->proactive_key_caching < 0 ?
1967                                 wpa_s->conf->okc : ssid->proactive_key_caching;
1968                 else
1969                         params.req_key_mgmt_offload = 1;
1970
1971                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
1972                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
1973                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
1974                     ssid->psk_set)
1975                         params.psk = ssid->psk;
1976         }
1977
1978         params.drop_unencrypted = use_crypt;
1979
1980 #ifdef CONFIG_IEEE80211W
1981         params.mgmt_frame_protection =
1982                 ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1983                 wpa_s->conf->pmf : ssid->ieee80211w;
1984         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
1985                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1986                 struct wpa_ie_data ie;
1987                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
1988                     ie.capabilities &
1989                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
1990                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
1991                                 "MFP: require MFP");
1992                         params.mgmt_frame_protection =
1993                                 MGMT_FRAME_PROTECTION_REQUIRED;
1994                 }
1995         }
1996 #endif /* CONFIG_IEEE80211W */
1997
1998         params.p2p = ssid->p2p_group;
1999
2000         if (wpa_s->parent->set_sta_uapsd)
2001                 params.uapsd = wpa_s->parent->sta_uapsd;
2002         else
2003                 params.uapsd = -1;
2004
2005 #ifdef CONFIG_HT_OVERRIDES
2006         os_memset(&htcaps, 0, sizeof(htcaps));
2007         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2008         params.htcaps = (u8 *) &htcaps;
2009         params.htcaps_mask = (u8 *) &htcaps_mask;
2010         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2011 #endif /* CONFIG_HT_OVERRIDES */
2012 #ifdef CONFIG_VHT_OVERRIDES
2013         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2014         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2015         params.vhtcaps = &vhtcaps;
2016         params.vhtcaps_mask = &vhtcaps_mask;
2017         wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
2018 #endif /* CONFIG_VHT_OVERRIDES */
2019
2020 #ifdef CONFIG_P2P
2021         /*
2022          * If multi-channel concurrency is not supported, check for any
2023          * frequency conflict. In case of any frequency conflict, remove the
2024          * least prioritized connection.
2025          */
2026         if (wpa_s->num_multichan_concurrent < 2) {
2027                 int freq, num;
2028                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2029                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2030                         wpa_printf(MSG_DEBUG,
2031                                    "Assoc conflicting freq found (%d != %d)",
2032                                    freq, params.freq.freq);
2033                         if (wpas_p2p_handle_frequency_conflicts(
2034                                     wpa_s, params.freq.freq, ssid) < 0) {
2035                                 wpas_connect_work_done(wpa_s);
2036                                 return;
2037                         }
2038                 }
2039         }
2040 #endif /* CONFIG_P2P */
2041
2042         ret = wpa_drv_associate(wpa_s, &params);
2043         if (ret < 0) {
2044                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2045                         "failed");
2046                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2047                         /*
2048                          * The driver is known to mean what is saying, so we
2049                          * can stop right here; the association will not
2050                          * succeed.
2051                          */
2052                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2053                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2054                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2055                         return;
2056                 }
2057                 /* try to continue anyway; new association will be tried again
2058                  * after timeout */
2059                 assoc_failed = 1;
2060         }
2061
2062         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2063                 /* Set the key after the association just in case association
2064                  * cleared the previously configured key. */
2065                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2066                 /* No need to timeout authentication since there is no key
2067                  * management. */
2068                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2069                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2070 #ifdef CONFIG_IBSS_RSN
2071         } else if (ssid->mode == WPAS_MODE_IBSS &&
2072                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2073                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2074                 /*
2075                  * RSN IBSS authentication is per-STA and we can disable the
2076                  * per-BSSID authentication.
2077                  */
2078                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2079 #endif /* CONFIG_IBSS_RSN */
2080         } else {
2081                 /* Timeout for IEEE 802.11 authentication and association */
2082                 int timeout = 60;
2083
2084                 if (assoc_failed) {
2085                         /* give IBSS a bit more time */
2086                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2087                 } else if (wpa_s->conf->ap_scan == 1) {
2088                         /* give IBSS a bit more time */
2089                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2090                 }
2091                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2092         }
2093
2094         if (wep_keys_set &&
2095             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2096                 /* Set static WEP keys again */
2097                 wpa_set_wep_keys(wpa_s, ssid);
2098         }
2099
2100         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2101                 /*
2102                  * Do not allow EAP session resumption between different
2103                  * network configurations.
2104                  */
2105                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2106         }
2107         old_ssid = wpa_s->current_ssid;
2108         wpa_s->current_ssid = ssid;
2109         wpa_s->current_bss = bss;
2110         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2111         wpa_supplicant_initiate_eapol(wpa_s);
2112         if (old_ssid != wpa_s->current_ssid)
2113                 wpas_notify_network_changed(wpa_s);
2114 }
2115
2116
2117 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2118                                             const u8 *addr)
2119 {
2120         struct wpa_ssid *old_ssid;
2121
2122         wpas_connect_work_done(wpa_s);
2123         wpa_clear_keys(wpa_s, addr);
2124         old_ssid = wpa_s->current_ssid;
2125         wpa_supplicant_mark_disassoc(wpa_s);
2126         wpa_sm_set_config(wpa_s->wpa, NULL);
2127         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2128         if (old_ssid != wpa_s->current_ssid)
2129                 wpas_notify_network_changed(wpa_s);
2130         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2131 }
2132
2133
2134 /**
2135  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2136  * @wpa_s: Pointer to wpa_supplicant data
2137  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2138  *
2139  * This function is used to request %wpa_supplicant to deauthenticate from the
2140  * current AP.
2141  */
2142 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2143                                    int reason_code)
2144 {
2145         u8 *addr = NULL;
2146         union wpa_event_data event;
2147         int zero_addr = 0;
2148
2149         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2150                 " pending_bssid=" MACSTR " reason=%d state=%s",
2151                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2152                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2153
2154         if (!is_zero_ether_addr(wpa_s->bssid))
2155                 addr = wpa_s->bssid;
2156         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2157                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2158                   wpa_s->wpa_state == WPA_ASSOCIATING))
2159                 addr = wpa_s->pending_bssid;
2160         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2161                 /*
2162                  * When using driver-based BSS selection, we may not know the
2163                  * BSSID with which we are currently trying to associate. We
2164                  * need to notify the driver of this disconnection even in such
2165                  * a case, so use the all zeros address here.
2166                  */
2167                 addr = wpa_s->bssid;
2168                 zero_addr = 1;
2169         }
2170
2171 #ifdef CONFIG_TDLS
2172         wpa_tdls_teardown_peers(wpa_s->wpa);
2173 #endif /* CONFIG_TDLS */
2174
2175 #ifdef CONFIG_MESH
2176         if (wpa_s->ifmsh) {
2177                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2178                              wpa_s->ifname);
2179                 wpa_supplicant_leave_mesh(wpa_s);
2180         }
2181 #endif /* CONFIG_MESH */
2182
2183         if (addr) {
2184                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2185                 os_memset(&event, 0, sizeof(event));
2186                 event.deauth_info.reason_code = (u16) reason_code;
2187                 event.deauth_info.locally_generated = 1;
2188                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2189                 if (zero_addr)
2190                         addr = NULL;
2191         }
2192
2193         wpa_supplicant_clear_connection(wpa_s, addr);
2194 }
2195
2196 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2197                                               struct wpa_ssid *ssid)
2198 {
2199         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2200                 return;
2201
2202         ssid->disabled = 0;
2203         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2204         wpas_notify_network_enabled_changed(wpa_s, ssid);
2205
2206         /*
2207          * Try to reassociate since there is no current configuration and a new
2208          * network was made available.
2209          */
2210         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2211                 wpa_s->reassociate = 1;
2212 }
2213
2214
2215 /**
2216  * wpa_supplicant_enable_network - Mark a configured network as enabled
2217  * @wpa_s: wpa_supplicant structure for a network interface
2218  * @ssid: wpa_ssid structure for a configured network or %NULL
2219  *
2220  * Enables the specified network or all networks if no network specified.
2221  */
2222 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2223                                    struct wpa_ssid *ssid)
2224 {
2225         if (ssid == NULL) {
2226                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2227                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2228         } else
2229                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2230
2231         if (wpa_s->reassociate && !wpa_s->disconnected) {
2232                 if (wpa_s->sched_scanning) {
2233                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2234                                    "new network to scan filters");
2235                         wpa_supplicant_cancel_sched_scan(wpa_s);
2236                 }
2237
2238                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2239                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2240         }
2241 }
2242
2243
2244 /**
2245  * wpa_supplicant_disable_network - Mark a configured network as disabled
2246  * @wpa_s: wpa_supplicant structure for a network interface
2247  * @ssid: wpa_ssid structure for a configured network or %NULL
2248  *
2249  * Disables the specified network or all networks if no network specified.
2250  */
2251 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2252                                     struct wpa_ssid *ssid)
2253 {
2254         struct wpa_ssid *other_ssid;
2255         int was_disabled;
2256
2257         if (ssid == NULL) {
2258                 if (wpa_s->sched_scanning)
2259                         wpa_supplicant_cancel_sched_scan(wpa_s);
2260
2261                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2262                      other_ssid = other_ssid->next) {
2263                         was_disabled = other_ssid->disabled;
2264                         if (was_disabled == 2)
2265                                 continue; /* do not change persistent P2P group
2266                                            * data */
2267
2268                         other_ssid->disabled = 1;
2269
2270                         if (was_disabled != other_ssid->disabled)
2271                                 wpas_notify_network_enabled_changed(
2272                                         wpa_s, other_ssid);
2273                 }
2274                 if (wpa_s->current_ssid)
2275                         wpa_supplicant_deauthenticate(
2276                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2277         } else if (ssid->disabled != 2) {
2278                 if (ssid == wpa_s->current_ssid)
2279                         wpa_supplicant_deauthenticate(
2280                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2281
2282                 was_disabled = ssid->disabled;
2283
2284                 ssid->disabled = 1;
2285
2286                 if (was_disabled != ssid->disabled) {
2287                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2288                         if (wpa_s->sched_scanning) {
2289                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2290                                            "to remove network from filters");
2291                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2292                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2293                         }
2294                 }
2295         }
2296 }
2297
2298
2299 /**
2300  * wpa_supplicant_select_network - Attempt association with a network
2301  * @wpa_s: wpa_supplicant structure for a network interface
2302  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2303  */
2304 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2305                                    struct wpa_ssid *ssid)
2306 {
2307
2308         struct wpa_ssid *other_ssid;
2309         int disconnected = 0;
2310
2311         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2312                 wpa_supplicant_deauthenticate(
2313                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2314                 disconnected = 1;
2315         }
2316
2317         if (ssid)
2318                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2319
2320         /*
2321          * Mark all other networks disabled or mark all networks enabled if no
2322          * network specified.
2323          */
2324         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2325              other_ssid = other_ssid->next) {
2326                 int was_disabled = other_ssid->disabled;
2327                 if (was_disabled == 2)
2328                         continue; /* do not change persistent P2P group data */
2329
2330                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2331                 if (was_disabled && !other_ssid->disabled)
2332                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2333
2334                 if (was_disabled != other_ssid->disabled)
2335                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2336         }
2337
2338         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2339                 /* We are already associated with the selected network */
2340                 wpa_printf(MSG_DEBUG, "Already associated with the "
2341                            "selected network - do nothing");
2342                 return;
2343         }
2344
2345         if (ssid) {
2346                 wpa_s->current_ssid = ssid;
2347                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2348                 wpa_s->connect_without_scan =
2349                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2350         } else {
2351                 wpa_s->connect_without_scan = NULL;
2352         }
2353
2354         wpa_s->disconnected = 0;
2355         wpa_s->reassociate = 1;
2356
2357         if (wpa_s->connect_without_scan ||
2358             wpa_supplicant_fast_associate(wpa_s) != 1)
2359                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2360
2361         if (ssid)
2362                 wpas_notify_network_selected(wpa_s, ssid);
2363 }
2364
2365
2366 /**
2367  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2368  * @wpa_s: wpa_supplicant structure for a network interface
2369  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2370  * @pkcs11_module_path: PKCS #11 module path or NULL
2371  * Returns: 0 on success; -1 on failure
2372  *
2373  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2374  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2375  * module path fails the paths will be reset to the default value (NULL).
2376  */
2377 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2378                                            const char *pkcs11_engine_path,
2379                                            const char *pkcs11_module_path)
2380 {
2381         char *pkcs11_engine_path_copy = NULL;
2382         char *pkcs11_module_path_copy = NULL;
2383
2384         if (pkcs11_engine_path != NULL) {
2385                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2386                 if (pkcs11_engine_path_copy == NULL)
2387                         return -1;
2388         }
2389         if (pkcs11_module_path != NULL) {
2390                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2391                 if (pkcs11_module_path_copy == NULL) {
2392                         os_free(pkcs11_engine_path_copy);
2393                         return -1;
2394                 }
2395         }
2396
2397         os_free(wpa_s->conf->pkcs11_engine_path);
2398         os_free(wpa_s->conf->pkcs11_module_path);
2399         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2400         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2401
2402         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2403         eapol_sm_deinit(wpa_s->eapol);
2404         wpa_s->eapol = NULL;
2405         if (wpa_supplicant_init_eapol(wpa_s)) {
2406                 /* Error -> Reset paths to the default value (NULL) once. */
2407                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2408                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2409                                                                NULL);
2410
2411                 return -1;
2412         }
2413         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2414
2415         return 0;
2416 }
2417
2418
2419 /**
2420  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2421  * @wpa_s: wpa_supplicant structure for a network interface
2422  * @ap_scan: AP scan mode
2423  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2424  *
2425  */
2426 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2427 {
2428
2429         int old_ap_scan;
2430
2431         if (ap_scan < 0 || ap_scan > 2)
2432                 return -1;
2433
2434 #ifdef ANDROID
2435         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2436             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2437             wpa_s->wpa_state < WPA_COMPLETED) {
2438                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2439                            "associating", wpa_s->conf->ap_scan, ap_scan);
2440                 return 0;
2441         }
2442 #endif /* ANDROID */
2443
2444         old_ap_scan = wpa_s->conf->ap_scan;
2445         wpa_s->conf->ap_scan = ap_scan;
2446
2447         if (old_ap_scan != wpa_s->conf->ap_scan)
2448                 wpas_notify_ap_scan_changed(wpa_s);
2449
2450         return 0;
2451 }
2452
2453
2454 /**
2455  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2456  * @wpa_s: wpa_supplicant structure for a network interface
2457  * @expire_age: Expiration age in seconds
2458  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2459  *
2460  */
2461 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2462                                           unsigned int bss_expire_age)
2463 {
2464         if (bss_expire_age < 10) {
2465                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2466                         bss_expire_age);
2467                 return -1;
2468         }
2469         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2470                 bss_expire_age);
2471         wpa_s->conf->bss_expiration_age = bss_expire_age;
2472
2473         return 0;
2474 }
2475
2476
2477 /**
2478  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2479  * @wpa_s: wpa_supplicant structure for a network interface
2480  * @expire_count: number of scans after which an unseen BSS is reclaimed
2481  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2482  *
2483  */
2484 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2485                                             unsigned int bss_expire_count)
2486 {
2487         if (bss_expire_count < 1) {
2488                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2489                         bss_expire_count);
2490                 return -1;
2491         }
2492         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2493                 bss_expire_count);
2494         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2495
2496         return 0;
2497 }
2498
2499
2500 /**
2501  * wpa_supplicant_set_scan_interval - Set scan interval
2502  * @wpa_s: wpa_supplicant structure for a network interface
2503  * @scan_interval: scan interval in seconds
2504  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2505  *
2506  */
2507 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2508                                      int scan_interval)
2509 {
2510         if (scan_interval < 0) {
2511                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2512                         scan_interval);
2513                 return -1;
2514         }
2515         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2516                 scan_interval);
2517         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2518
2519         return 0;
2520 }
2521
2522
2523 /**
2524  * wpa_supplicant_set_debug_params - Set global debug params
2525  * @global: wpa_global structure
2526  * @debug_level: debug level
2527  * @debug_timestamp: determines if show timestamp in debug data
2528  * @debug_show_keys: determines if show keys in debug data
2529  * Returns: 0 if succeed or -1 if debug_level has wrong value
2530  */
2531 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2532                                     int debug_timestamp, int debug_show_keys)
2533 {
2534
2535         int old_level, old_timestamp, old_show_keys;
2536
2537         /* check for allowed debuglevels */
2538         if (debug_level != MSG_EXCESSIVE &&
2539             debug_level != MSG_MSGDUMP &&
2540             debug_level != MSG_DEBUG &&
2541             debug_level != MSG_INFO &&
2542             debug_level != MSG_WARNING &&
2543             debug_level != MSG_ERROR)
2544                 return -1;
2545
2546         old_level = wpa_debug_level;
2547         old_timestamp = wpa_debug_timestamp;
2548         old_show_keys = wpa_debug_show_keys;
2549
2550         wpa_debug_level = debug_level;
2551         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2552         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2553
2554         if (wpa_debug_level != old_level)
2555                 wpas_notify_debug_level_changed(global);
2556         if (wpa_debug_timestamp != old_timestamp)
2557                 wpas_notify_debug_timestamp_changed(global);
2558         if (wpa_debug_show_keys != old_show_keys)
2559                 wpas_notify_debug_show_keys_changed(global);
2560
2561         return 0;
2562 }
2563
2564
2565 /**
2566  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2567  * @wpa_s: Pointer to wpa_supplicant data
2568  * Returns: A pointer to the current network structure or %NULL on failure
2569  */
2570 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2571 {
2572         struct wpa_ssid *entry;
2573         u8 ssid[MAX_SSID_LEN];
2574         int res;
2575         size_t ssid_len;
2576         u8 bssid[ETH_ALEN];
2577         int wired;
2578
2579         res = wpa_drv_get_ssid(wpa_s, ssid);
2580         if (res < 0) {
2581                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2582                         "driver");
2583                 return NULL;
2584         }
2585         ssid_len = res;
2586
2587         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2588                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2589                         "driver");
2590                 return NULL;
2591         }
2592
2593         wired = wpa_s->conf->ap_scan == 0 &&
2594                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2595
2596         entry = wpa_s->conf->ssid;
2597         while (entry) {
2598                 if (!wpas_network_disabled(wpa_s, entry) &&
2599                     ((ssid_len == entry->ssid_len &&
2600                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2601                     (!entry->bssid_set ||
2602                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2603                         return entry;
2604 #ifdef CONFIG_WPS
2605                 if (!wpas_network_disabled(wpa_s, entry) &&
2606                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2607                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2608                     (!entry->bssid_set ||
2609                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2610                         return entry;
2611 #endif /* CONFIG_WPS */
2612
2613                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2614                     entry->ssid_len == 0 &&
2615                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2616                         return entry;
2617
2618                 entry = entry->next;
2619         }
2620
2621         return NULL;
2622 }
2623
2624
2625 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2626 {
2627         struct wpa_global *global = wpa_s->global;
2628
2629         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2630                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2631                 if (global->drv_priv[i] == NULL) {
2632                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2633                                    "'%s'", wpa_drivers[i]->name);
2634                         return -1;
2635                 }
2636         }
2637
2638         wpa_s->driver = wpa_drivers[i];
2639         wpa_s->global_drv_priv = global->drv_priv[i];
2640
2641         return 0;
2642 }
2643
2644
2645 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2646                                      const char *name)
2647 {
2648         int i;
2649         size_t len;
2650         const char *pos, *driver = name;
2651
2652         if (wpa_s == NULL)
2653                 return -1;
2654
2655         if (wpa_drivers[0] == NULL) {
2656                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2657                         "wpa_supplicant");
2658                 return -1;
2659         }
2660
2661         if (name == NULL) {
2662                 /* default to first driver in the list */
2663                 return select_driver(wpa_s, 0);
2664         }
2665
2666         do {
2667                 pos = os_strchr(driver, ',');
2668                 if (pos)
2669                         len = pos - driver;
2670                 else
2671                         len = os_strlen(driver);
2672
2673                 for (i = 0; wpa_drivers[i]; i++) {
2674                         if (os_strlen(wpa_drivers[i]->name) == len &&
2675                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2676                             0) {
2677                                 /* First driver that succeeds wins */
2678                                 if (select_driver(wpa_s, i) == 0)
2679                                         return 0;
2680                         }
2681                 }
2682
2683                 driver = pos + 1;
2684         } while (pos);
2685
2686         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2687         return -1;
2688 }
2689
2690
2691 /**
2692  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2693  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2694  *      with struct wpa_driver_ops::init()
2695  * @src_addr: Source address of the EAPOL frame
2696  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2697  * @len: Length of the EAPOL data
2698  *
2699  * This function is called for each received EAPOL frame. Most driver
2700  * interfaces rely on more generic OS mechanism for receiving frames through
2701  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2702  * take care of received EAPOL frames and deliver them to the core supplicant
2703  * code by calling this function.
2704  */
2705 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2706                              const u8 *buf, size_t len)
2707 {
2708         struct wpa_supplicant *wpa_s = ctx;
2709
2710         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2711         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2712
2713 #ifdef CONFIG_PEERKEY
2714         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
2715             wpa_s->current_ssid->peerkey &&
2716             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2717             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
2718                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
2719                 return;
2720         }
2721 #endif /* CONFIG_PEERKEY */
2722
2723         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
2724             (wpa_s->last_eapol_matches_bssid &&
2725 #ifdef CONFIG_AP
2726              !wpa_s->ap_iface &&
2727 #endif /* CONFIG_AP */
2728              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
2729                 /*
2730                  * There is possible race condition between receiving the
2731                  * association event and the EAPOL frame since they are coming
2732                  * through different paths from the driver. In order to avoid
2733                  * issues in trying to process the EAPOL frame before receiving
2734                  * association information, lets queue it for processing until
2735                  * the association event is received. This may also be needed in
2736                  * driver-based roaming case, so also use src_addr != BSSID as a
2737                  * trigger if we have previously confirmed that the
2738                  * Authenticator uses BSSID as the src_addr (which is not the
2739                  * case with wired IEEE 802.1X).
2740                  */
2741                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
2742                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
2743                         wpa_supplicant_state_txt(wpa_s->wpa_state),
2744                         MAC2STR(wpa_s->bssid));
2745                 wpabuf_free(wpa_s->pending_eapol_rx);
2746                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
2747                 if (wpa_s->pending_eapol_rx) {
2748                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
2749                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
2750                                   ETH_ALEN);
2751                 }
2752                 return;
2753         }
2754
2755         wpa_s->last_eapol_matches_bssid =
2756                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
2757
2758 #ifdef CONFIG_AP
2759         if (wpa_s->ap_iface) {
2760                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
2761                 return;
2762         }
2763 #endif /* CONFIG_AP */
2764
2765         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2766                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
2767                         "no key management is configured");
2768                 return;
2769         }
2770
2771         if (wpa_s->eapol_received == 0 &&
2772             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
2773              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
2774              wpa_s->wpa_state != WPA_COMPLETED) &&
2775             (wpa_s->current_ssid == NULL ||
2776              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
2777                 /* Timeout for completing IEEE 802.1X and WPA authentication */
2778                 wpa_supplicant_req_auth_timeout(
2779                         wpa_s,
2780                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2781                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
2782                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
2783                         70 : 10, 0);
2784         }
2785         wpa_s->eapol_received++;
2786
2787         if (wpa_s->countermeasures) {
2788                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
2789                         "EAPOL packet");
2790                 return;
2791         }
2792
2793 #ifdef CONFIG_IBSS_RSN
2794         if (wpa_s->current_ssid &&
2795             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
2796                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
2797                 return;
2798         }
2799 #endif /* CONFIG_IBSS_RSN */
2800
2801         /* Source address of the incoming EAPOL frame could be compared to the
2802          * current BSSID. However, it is possible that a centralized
2803          * Authenticator could be using another MAC address than the BSSID of
2804          * an AP, so just allow any address to be used for now. The replies are
2805          * still sent to the current BSSID (if available), though. */
2806
2807         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
2808         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
2809             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
2810                 return;
2811         wpa_drv_poll(wpa_s);
2812         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
2813                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
2814         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
2815                 /*
2816                  * Set portValid = TRUE here since we are going to skip 4-way
2817                  * handshake processing which would normally set portValid. We
2818                  * need this to allow the EAPOL state machines to be completed
2819                  * without going through EAPOL-Key handshake.
2820                  */
2821                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
2822         }
2823 }
2824
2825
2826 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
2827 {
2828         if ((!wpa_s->p2p_mgmt ||
2829              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
2830             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
2831                 l2_packet_deinit(wpa_s->l2);
2832                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
2833                                            wpa_drv_get_mac_addr(wpa_s),
2834                                            ETH_P_EAPOL,
2835                                            wpa_supplicant_rx_eapol, wpa_s, 0);
2836                 if (wpa_s->l2 == NULL)
2837                         return -1;
2838         } else {
2839                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
2840                 if (addr)
2841                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
2842         }
2843
2844         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
2845                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
2846                 return -1;
2847         }
2848
2849         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
2850
2851         return 0;
2852 }
2853
2854
2855 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
2856                                            const u8 *buf, size_t len)
2857 {
2858         struct wpa_supplicant *wpa_s = ctx;
2859         const struct l2_ethhdr *eth;
2860
2861         if (len < sizeof(*eth))
2862                 return;
2863         eth = (const struct l2_ethhdr *) buf;
2864
2865         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
2866             !(eth->h_dest[0] & 0x01)) {
2867                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
2868                         " (bridge - not for this interface - ignore)",
2869                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
2870                 return;
2871         }
2872
2873         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
2874                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
2875         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
2876                                 len - sizeof(*eth));
2877 }
2878
2879
2880 /**
2881  * wpa_supplicant_driver_init - Initialize driver interface parameters
2882  * @wpa_s: Pointer to wpa_supplicant data
2883  * Returns: 0 on success, -1 on failure
2884  *
2885  * This function is called to initialize driver interface parameters.
2886  * wpa_drv_init() must have been called before this function to initialize the
2887  * driver interface.
2888  */
2889 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
2890 {
2891         static int interface_count = 0;
2892
2893         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
2894                 return -1;
2895
2896         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
2897                 MAC2STR(wpa_s->own_addr));
2898         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
2899         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
2900
2901         if (wpa_s->bridge_ifname[0]) {
2902                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
2903                         "interface '%s'", wpa_s->bridge_ifname);
2904                 wpa_s->l2_br = l2_packet_init(wpa_s->bridge_ifname,
2905                                               wpa_s->own_addr,
2906                                               ETH_P_EAPOL,
2907                                               wpa_supplicant_rx_eapol_bridge,
2908                                               wpa_s, 1);
2909                 if (wpa_s->l2_br == NULL) {
2910                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
2911                                 "connection for the bridge interface '%s'",
2912                                 wpa_s->bridge_ifname);
2913                         return -1;
2914                 }
2915         }
2916
2917         wpa_clear_keys(wpa_s, NULL);
2918
2919         /* Make sure that TKIP countermeasures are not left enabled (could
2920          * happen if wpa_supplicant is killed during countermeasures. */
2921         wpa_drv_set_countermeasures(wpa_s, 0);
2922
2923         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
2924         wpa_drv_flush_pmkid(wpa_s);
2925
2926         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
2927         wpa_s->prev_scan_wildcard = 0;
2928
2929         if (wpa_supplicant_enabled_networks(wpa_s)) {
2930                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
2931                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2932                         interface_count = 0;
2933                 }
2934                 if (!wpa_s->p2p_mgmt &&
2935                     wpa_supplicant_delayed_sched_scan(wpa_s,
2936                                                       interface_count % 3,
2937                                                       100000))
2938                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
2939                                                 100000);
2940                 interface_count++;
2941         } else
2942                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
2943
2944         return 0;
2945 }
2946
2947
2948 static int wpa_supplicant_daemon(const char *pid_file)
2949 {
2950         wpa_printf(MSG_DEBUG, "Daemonize..");
2951         return os_daemonize(pid_file);
2952 }
2953
2954
2955 static struct wpa_supplicant * wpa_supplicant_alloc(void)
2956 {
2957         struct wpa_supplicant *wpa_s;
2958
2959         wpa_s = os_zalloc(sizeof(*wpa_s));
2960         if (wpa_s == NULL)
2961                 return NULL;
2962         wpa_s->scan_req = INITIAL_SCAN_REQ;
2963         wpa_s->scan_interval = 5;
2964         wpa_s->new_connection = 1;
2965         wpa_s->parent = wpa_s;
2966         wpa_s->sched_scanning = 0;
2967
2968         return wpa_s;
2969 }
2970
2971
2972 #ifdef CONFIG_HT_OVERRIDES
2973
2974 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
2975                              struct ieee80211_ht_capabilities *htcaps,
2976                              struct ieee80211_ht_capabilities *htcaps_mask,
2977                              const char *ht_mcs)
2978 {
2979         /* parse ht_mcs into hex array */
2980         int i;
2981         const char *tmp = ht_mcs;
2982         char *end = NULL;
2983
2984         /* If ht_mcs is null, do not set anything */
2985         if (!ht_mcs)
2986                 return 0;
2987
2988         /* This is what we are setting in the kernel */
2989         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
2990
2991         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
2992
2993         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
2994                 errno = 0;
2995                 long v = strtol(tmp, &end, 16);
2996                 if (errno == 0) {
2997                         wpa_msg(wpa_s, MSG_DEBUG,
2998                                 "htcap value[%i]: %ld end: %p  tmp: %p",
2999                                 i, v, end, tmp);
3000                         if (end == tmp)
3001                                 break;
3002
3003                         htcaps->supported_mcs_set[i] = v;
3004                         tmp = end;
3005                 } else {
3006                         wpa_msg(wpa_s, MSG_ERROR,
3007                                 "Failed to parse ht-mcs: %s, error: %s\n",
3008                                 ht_mcs, strerror(errno));
3009                         return -1;
3010                 }
3011         }
3012
3013         /*
3014          * If we were able to parse any values, then set mask for the MCS set.
3015          */
3016         if (i) {
3017                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3018                           IEEE80211_HT_MCS_MASK_LEN - 1);
3019                 /* skip the 3 reserved bits */
3020                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3021                         0x1f;
3022         }
3023
3024         return 0;
3025 }
3026
3027
3028 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3029                                  struct ieee80211_ht_capabilities *htcaps,
3030                                  struct ieee80211_ht_capabilities *htcaps_mask,
3031                                  int disabled)
3032 {
3033         le16 msk;
3034
3035         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3036
3037         if (disabled == -1)
3038                 return 0;
3039
3040         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3041         htcaps_mask->ht_capabilities_info |= msk;
3042         if (disabled)
3043                 htcaps->ht_capabilities_info &= msk;
3044         else
3045                 htcaps->ht_capabilities_info |= msk;
3046
3047         return 0;
3048 }
3049
3050
3051 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3052                                 struct ieee80211_ht_capabilities *htcaps,
3053                                 struct ieee80211_ht_capabilities *htcaps_mask,
3054                                 int factor)
3055 {
3056         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3057
3058         if (factor == -1)
3059                 return 0;
3060
3061         if (factor < 0 || factor > 3) {
3062                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3063                         "Must be 0-3 or -1", factor);
3064                 return -EINVAL;
3065         }
3066
3067         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3068         htcaps->a_mpdu_params &= ~0x3;
3069         htcaps->a_mpdu_params |= factor & 0x3;
3070
3071         return 0;
3072 }
3073
3074
3075 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3076                                  struct ieee80211_ht_capabilities *htcaps,
3077                                  struct ieee80211_ht_capabilities *htcaps_mask,
3078                                  int density)
3079 {
3080         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3081
3082         if (density == -1)
3083                 return 0;
3084
3085         if (density < 0 || density > 7) {
3086                 wpa_msg(wpa_s, MSG_ERROR,
3087                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3088                         density);
3089                 return -EINVAL;
3090         }
3091
3092         htcaps_mask->a_mpdu_params |= 0x1C;
3093         htcaps->a_mpdu_params &= ~(0x1C);
3094         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3095
3096         return 0;
3097 }
3098
3099
3100 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3101                                 struct ieee80211_ht_capabilities *htcaps,
3102                                 struct ieee80211_ht_capabilities *htcaps_mask,
3103                                 int disabled)
3104 {
3105         /* Masking these out disables HT40 */
3106         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3107                                 HT_CAP_INFO_SHORT_GI40MHZ);
3108
3109         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3110
3111         if (disabled)
3112                 htcaps->ht_capabilities_info &= ~msk;
3113         else
3114                 htcaps->ht_capabilities_info |= msk;
3115
3116         htcaps_mask->ht_capabilities_info |= msk;
3117
3118         return 0;
3119 }
3120
3121
3122 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3123                                struct ieee80211_ht_capabilities *htcaps,
3124                                struct ieee80211_ht_capabilities *htcaps_mask,
3125                                int disabled)
3126 {
3127         /* Masking these out disables SGI */
3128         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3129                                 HT_CAP_INFO_SHORT_GI40MHZ);
3130
3131         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3132
3133         if (disabled)
3134                 htcaps->ht_capabilities_info &= ~msk;
3135         else
3136                 htcaps->ht_capabilities_info |= msk;
3137
3138         htcaps_mask->ht_capabilities_info |= msk;
3139
3140         return 0;
3141 }
3142
3143
3144 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3145                                struct ieee80211_ht_capabilities *htcaps,
3146                                struct ieee80211_ht_capabilities *htcaps_mask,
3147                                int disabled)
3148 {
3149         /* Masking these out disables LDPC */
3150         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3151
3152         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3153
3154         if (disabled)
3155                 htcaps->ht_capabilities_info &= ~msk;
3156         else
3157                 htcaps->ht_capabilities_info |= msk;
3158
3159         htcaps_mask->ht_capabilities_info |= msk;
3160
3161         return 0;
3162 }
3163
3164
3165 void wpa_supplicant_apply_ht_overrides(
3166         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3167         struct wpa_driver_associate_params *params)
3168 {
3169         struct ieee80211_ht_capabilities *htcaps;
3170         struct ieee80211_ht_capabilities *htcaps_mask;
3171
3172         if (!ssid)
3173                 return;
3174
3175         params->disable_ht = ssid->disable_ht;
3176         if (!params->htcaps || !params->htcaps_mask)
3177                 return;
3178
3179         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3180         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3181         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3182         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3183                               ssid->disable_max_amsdu);
3184         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3185         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3186         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3187         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3188         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3189
3190         if (ssid->ht40_intolerant) {
3191                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3192                 htcaps->ht_capabilities_info |= bit;
3193                 htcaps_mask->ht_capabilities_info |= bit;
3194         }
3195 }
3196
3197 #endif /* CONFIG_HT_OVERRIDES */
3198
3199
3200 #ifdef CONFIG_VHT_OVERRIDES
3201 void wpa_supplicant_apply_vht_overrides(
3202         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3203         struct wpa_driver_associate_params *params)
3204 {
3205         struct ieee80211_vht_capabilities *vhtcaps;
3206         struct ieee80211_vht_capabilities *vhtcaps_mask;
3207
3208         if (!ssid)
3209                 return;
3210
3211         params->disable_vht = ssid->disable_vht;
3212
3213         vhtcaps = (void *) params->vhtcaps;
3214         vhtcaps_mask = (void *) params->vhtcaps_mask;
3215
3216         if (!vhtcaps || !vhtcaps_mask)
3217                 return;
3218
3219         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3220         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3221
3222 #ifdef CONFIG_HT_OVERRIDES
3223         /* if max ampdu is <= 3, we have to make the HT cap the same */
3224         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3225                 int max_ampdu;
3226
3227                 max_ampdu = (ssid->vht_capa &
3228                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3229                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3230
3231                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3232                 wpa_set_ampdu_factor(wpa_s,
3233                                      (void *) params->htcaps,
3234                                      (void *) params->htcaps_mask,
3235                                      max_ampdu);
3236         }
3237 #endif /* CONFIG_HT_OVERRIDES */
3238
3239 #define OVERRIDE_MCS(i)                                                 \
3240         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3241                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3242                         3 << 2 * (i - 1);                               \
3243                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3244                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3245         }                                                               \
3246         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3247                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3248                         3 << 2 * (i - 1);                               \
3249                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3250                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3251         }
3252
3253         OVERRIDE_MCS(1);
3254         OVERRIDE_MCS(2);
3255         OVERRIDE_MCS(3);
3256         OVERRIDE_MCS(4);
3257         OVERRIDE_MCS(5);
3258         OVERRIDE_MCS(6);
3259         OVERRIDE_MCS(7);
3260         OVERRIDE_MCS(8);
3261 }
3262 #endif /* CONFIG_VHT_OVERRIDES */
3263
3264
3265 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3266 {
3267 #ifdef PCSC_FUNCS
3268         size_t len;
3269
3270         if (!wpa_s->conf->pcsc_reader)
3271                 return 0;
3272
3273         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3274         if (!wpa_s->scard)
3275                 return 1;
3276
3277         if (wpa_s->conf->pcsc_pin &&
3278             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3279                 scard_deinit(wpa_s->scard);
3280                 wpa_s->scard = NULL;
3281                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3282                 return -1;
3283         }
3284
3285         len = sizeof(wpa_s->imsi) - 1;
3286         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3287                 scard_deinit(wpa_s->scard);
3288                 wpa_s->scard = NULL;
3289                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3290                 return -1;
3291         }
3292         wpa_s->imsi[len] = '\0';
3293
3294         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3295
3296         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3297                    wpa_s->imsi, wpa_s->mnc_len);
3298
3299         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3300         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3301 #endif /* PCSC_FUNCS */
3302
3303         return 0;
3304 }
3305
3306
3307 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3308 {
3309         char *val, *pos;
3310
3311         ext_password_deinit(wpa_s->ext_pw);
3312         wpa_s->ext_pw = NULL;
3313         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3314
3315         if (!wpa_s->conf->ext_password_backend)
3316                 return 0;
3317
3318         val = os_strdup(wpa_s->conf->ext_password_backend);
3319         if (val == NULL)
3320                 return -1;
3321         pos = os_strchr(val, ':');
3322         if (pos)
3323                 *pos++ = '\0';
3324
3325         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3326
3327         wpa_s->ext_pw = ext_password_init(val, pos);
3328         os_free(val);
3329         if (wpa_s->ext_pw == NULL) {
3330                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3331                 return -1;
3332         }
3333         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3334
3335         return 0;
3336 }
3337
3338
3339 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3340                                     const struct wpa_driver_capa *capa)
3341 {
3342         struct wowlan_triggers *triggers;
3343         int ret = 0;
3344
3345         if (!wpa_s->conf->wowlan_triggers)
3346                 return 0;
3347
3348         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3349         if (triggers) {
3350                 ret = wpa_drv_wowlan(wpa_s, triggers);
3351                 os_free(triggers);
3352         }
3353         return ret;
3354 }
3355
3356
3357 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3358                                               const char *rn)
3359 {
3360         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3361         struct wpa_radio *radio;
3362
3363         while (rn && iface) {
3364                 radio = iface->radio;
3365                 if (radio && os_strcmp(rn, radio->name) == 0) {
3366                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3367                                    wpa_s->ifname, rn);
3368                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3369                         return radio;
3370                 }
3371
3372                 iface = iface->next;
3373         }
3374
3375         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3376                    wpa_s->ifname, rn ? rn : "N/A");
3377         radio = os_zalloc(sizeof(*radio));
3378         if (radio == NULL)
3379                 return NULL;
3380
3381         if (rn)
3382                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3383         dl_list_init(&radio->ifaces);
3384         dl_list_init(&radio->work);
3385         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3386
3387         return radio;
3388 }
3389
3390
3391 static void radio_work_free(struct wpa_radio_work *work)
3392 {
3393         if (work->wpa_s->scan_work == work) {
3394                 /* This should not really happen. */
3395                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3396                         work->type, work, work->started);
3397                 work->wpa_s->scan_work = NULL;
3398         }
3399
3400 #ifdef CONFIG_P2P
3401         if (work->wpa_s->p2p_scan_work == work) {
3402                 /* This should not really happen. */
3403                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3404                         work->type, work, work->started);
3405                 work->wpa_s->p2p_scan_work = NULL;
3406         }
3407 #endif /* CONFIG_P2P */
3408
3409         dl_list_del(&work->list);
3410         os_free(work);
3411 }
3412
3413
3414 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3415 {
3416         struct wpa_radio *radio = eloop_ctx;
3417         struct wpa_radio_work *work;
3418         struct os_reltime now, diff;
3419         struct wpa_supplicant *wpa_s;
3420
3421         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3422         if (work == NULL)
3423                 return;
3424
3425         if (work->started)
3426                 return; /* already started and still in progress */
3427
3428         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3429                               radio_list);
3430         if (wpa_s && wpa_s->external_scan_running) {
3431                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3432                 return;
3433         }
3434
3435         os_get_reltime(&now);
3436         os_reltime_sub(&now, &work->time, &diff);
3437         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3438                 work->type, work, diff.sec, diff.usec);
3439         work->started = 1;
3440         work->time = now;
3441         work->cb(work, 0);
3442 }
3443
3444
3445 /*
3446  * This function removes both started and pending radio works running on
3447  * the provided interface's radio.
3448  * Prior to the removal of the radio work, its callback (cb) is called with
3449  * deinit set to be 1. Each work's callback is responsible for clearing its
3450  * internal data and restoring to a correct state.
3451  * @wpa_s: wpa_supplicant data
3452  * @type: type of works to be removed
3453  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3454  * this interface's works.
3455  */
3456 void radio_remove_works(struct wpa_supplicant *wpa_s,
3457                         const char *type, int remove_all)
3458 {
3459         struct wpa_radio_work *work, *tmp;
3460         struct wpa_radio *radio = wpa_s->radio;
3461
3462         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3463                               list) {
3464                 if (type && os_strcmp(type, work->type) != 0)
3465                         continue;
3466
3467                 /* skip other ifaces' works */
3468                 if (!remove_all && work->wpa_s != wpa_s)
3469                         continue;
3470
3471                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3472                         work->type, work, work->started ? " (started)" : "");
3473                 work->cb(work, 1);
3474                 radio_work_free(work);
3475         }
3476
3477         /* in case we removed the started work */
3478         radio_work_check_next(wpa_s);
3479 }
3480
3481
3482 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3483 {
3484         struct wpa_radio *radio = wpa_s->radio;
3485
3486         if (!radio)
3487                 return;
3488
3489         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3490                    wpa_s->ifname, radio->name);
3491         dl_list_del(&wpa_s->radio_list);
3492         radio_remove_works(wpa_s, NULL, 0);
3493         wpa_s->radio = NULL;
3494         if (!dl_list_empty(&radio->ifaces))
3495                 return; /* Interfaces remain for this radio */
3496
3497         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3498         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3499         os_free(radio);
3500 }
3501
3502
3503 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3504 {
3505         struct wpa_radio *radio = wpa_s->radio;
3506
3507         if (dl_list_empty(&radio->work))
3508                 return;
3509         if (wpa_s->ext_work_in_progress) {
3510                 wpa_printf(MSG_DEBUG,
3511                            "External radio work in progress - delay start of pending item");
3512                 return;
3513         }
3514         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3515         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3516 }
3517
3518
3519 /**
3520  * radio_add_work - Add a radio work item
3521  * @wpa_s: Pointer to wpa_supplicant data
3522  * @freq: Frequency of the offchannel operation in MHz or 0
3523  * @type: Unique identifier for each type of work
3524  * @next: Force as the next work to be executed
3525  * @cb: Callback function for indicating when radio is available
3526  * @ctx: Context pointer for the work (work->ctx in cb())
3527  * Returns: 0 on success, -1 on failure
3528  *
3529  * This function is used to request time for an operation that requires
3530  * exclusive radio control. Once the radio is available, the registered callback
3531  * function will be called. radio_work_done() must be called once the exclusive
3532  * radio operation has been completed, so that the radio is freed for other
3533  * operations. The special case of deinit=1 is used to free the context data
3534  * during interface removal. That does not allow the callback function to start
3535  * the radio operation, i.e., it must free any resources allocated for the radio
3536  * work and return.
3537  *
3538  * The @freq parameter can be used to indicate a single channel on which the
3539  * offchannel operation will occur. This may allow multiple radio work
3540  * operations to be performed in parallel if they apply for the same channel.
3541  * Setting this to 0 indicates that the work item may use multiple channels or
3542  * requires exclusive control of the radio.
3543  */
3544 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3545                    const char *type, int next,
3546                    void (*cb)(struct wpa_radio_work *work, int deinit),
3547                    void *ctx)
3548 {
3549         struct wpa_radio_work *work;
3550         int was_empty;
3551
3552         work = os_zalloc(sizeof(*work));
3553         if (work == NULL)
3554                 return -1;
3555         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3556         os_get_reltime(&work->time);
3557         work->freq = freq;
3558         work->type = type;
3559         work->wpa_s = wpa_s;
3560         work->cb = cb;
3561         work->ctx = ctx;
3562
3563         was_empty = dl_list_empty(&wpa_s->radio->work);
3564         if (next)
3565                 dl_list_add(&wpa_s->radio->work, &work->list);
3566         else
3567                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3568         if (was_empty) {
3569                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3570                 radio_work_check_next(wpa_s);
3571         }
3572
3573         return 0;
3574 }
3575
3576
3577 /**
3578  * radio_work_done - Indicate that a radio work item has been completed
3579  * @work: Completed work
3580  *
3581  * This function is called once the callback function registered with
3582  * radio_add_work() has completed its work.
3583  */
3584 void radio_work_done(struct wpa_radio_work *work)
3585 {
3586         struct wpa_supplicant *wpa_s = work->wpa_s;
3587         struct os_reltime now, diff;
3588         unsigned int started = work->started;
3589
3590         os_get_reltime(&now);
3591         os_reltime_sub(&now, &work->time, &diff);
3592         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3593                 work->type, work, started ? "done" : "canceled",
3594                 diff.sec, diff.usec);
3595         radio_work_free(work);
3596         if (started)
3597                 radio_work_check_next(wpa_s);
3598 }
3599
3600
3601 struct wpa_radio_work *
3602 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3603 {
3604         struct wpa_radio_work *work;
3605         struct wpa_radio *radio = wpa_s->radio;
3606
3607         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3608                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3609                         return work;
3610         }
3611
3612         return NULL;
3613 }
3614
3615
3616 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3617                             struct wpa_interface *iface)
3618 {
3619         const char *ifname, *driver, *rn;
3620
3621         driver = iface->driver;
3622 next_driver:
3623         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3624                 return -1;
3625
3626         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3627         if (wpa_s->drv_priv == NULL) {
3628                 const char *pos;
3629                 pos = driver ? os_strchr(driver, ',') : NULL;
3630                 if (pos) {
3631                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3632                                 "driver interface - try next driver wrapper");
3633                         driver = pos + 1;
3634                         goto next_driver;
3635                 }
3636                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3637                         "interface");
3638                 return -1;
3639         }
3640         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3641                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3642                         "driver_param '%s'", wpa_s->conf->driver_param);
3643                 return -1;
3644         }
3645
3646         ifname = wpa_drv_get_ifname(wpa_s);
3647         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3648                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3649                         "interface name with '%s'", ifname);
3650                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3651         }
3652
3653         rn = wpa_driver_get_radio_name(wpa_s);
3654         if (rn && rn[0] == '\0')
3655                 rn = NULL;
3656
3657         wpa_s->radio = radio_add_interface(wpa_s, rn);
3658         if (wpa_s->radio == NULL)
3659                 return -1;
3660
3661         return 0;
3662 }
3663
3664
3665 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3666                                      struct wpa_interface *iface)
3667 {
3668         struct wpa_driver_capa capa;
3669         int capa_res;
3670
3671         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3672                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3673                    iface->confname ? iface->confname : "N/A",
3674                    iface->driver ? iface->driver : "default",
3675                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3676                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3677
3678         if (iface->confname) {
3679 #ifdef CONFIG_BACKEND_FILE
3680                 wpa_s->confname = os_rel2abs_path(iface->confname);
3681                 if (wpa_s->confname == NULL) {
3682                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3683                                    "for configuration file '%s'.",
3684                                    iface->confname);
3685                         return -1;
3686                 }
3687                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3688                            iface->confname, wpa_s->confname);
3689 #else /* CONFIG_BACKEND_FILE */
3690                 wpa_s->confname = os_strdup(iface->confname);
3691 #endif /* CONFIG_BACKEND_FILE */
3692                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3693                 if (wpa_s->conf == NULL) {
3694                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3695                                    "configuration '%s'.", wpa_s->confname);
3696                         return -1;
3697                 }
3698                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3699                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3700
3701                 /*
3702                  * Override ctrl_interface and driver_param if set on command
3703                  * line.
3704                  */
3705                 if (iface->ctrl_interface) {
3706                         os_free(wpa_s->conf->ctrl_interface);
3707                         wpa_s->conf->ctrl_interface =
3708                                 os_strdup(iface->ctrl_interface);
3709                 }
3710
3711                 if (iface->driver_param) {
3712                         os_free(wpa_s->conf->driver_param);
3713                         wpa_s->conf->driver_param =
3714                                 os_strdup(iface->driver_param);
3715                 }
3716
3717                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
3718                         os_free(wpa_s->conf->ctrl_interface);
3719                         wpa_s->conf->ctrl_interface = NULL;
3720                 }
3721         } else
3722                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
3723                                                      iface->driver_param);
3724
3725         if (wpa_s->conf == NULL) {
3726                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
3727                 return -1;
3728         }
3729
3730         if (iface->ifname == NULL) {
3731                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
3732                 return -1;
3733         }
3734         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
3735                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
3736                            iface->ifname);
3737                 return -1;
3738         }
3739         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
3740
3741         if (iface->bridge_ifname) {
3742                 if (os_strlen(iface->bridge_ifname) >=
3743                     sizeof(wpa_s->bridge_ifname)) {
3744                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
3745                                    "name '%s'.", iface->bridge_ifname);
3746                         return -1;
3747                 }
3748                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
3749                            sizeof(wpa_s->bridge_ifname));
3750         }
3751
3752         /* RSNA Supplicant Key Management - INITIALIZE */
3753         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
3754         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
3755
3756         /* Initialize driver interface and register driver event handler before
3757          * L2 receive handler so that association events are processed before
3758          * EAPOL-Key packets if both become available for the same select()
3759          * call. */
3760         if (wpas_init_driver(wpa_s, iface) < 0)
3761                 return -1;
3762
3763         if (wpa_supplicant_init_wpa(wpa_s) < 0)
3764                 return -1;
3765
3766         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
3767                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
3768                           NULL);
3769         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
3770
3771         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
3772             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
3773                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
3774                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3775                         "dot11RSNAConfigPMKLifetime");
3776                 return -1;
3777         }
3778
3779         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
3780             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
3781                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
3782                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3783                         "dot11RSNAConfigPMKReauthThreshold");
3784                 return -1;
3785         }
3786
3787         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
3788             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
3789                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
3790                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3791                         "dot11RSNAConfigSATimeout");
3792                 return -1;
3793         }
3794
3795         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
3796                                                       &wpa_s->hw.num_modes,
3797                                                       &wpa_s->hw.flags);
3798
3799         capa_res = wpa_drv_get_capa(wpa_s, &capa);
3800         if (capa_res == 0) {
3801                 wpa_s->drv_capa_known = 1;
3802                 wpa_s->drv_flags = capa.flags;
3803                 wpa_s->drv_enc = capa.enc;
3804                 wpa_s->drv_smps_modes = capa.smps_modes;
3805                 wpa_s->drv_rrm_flags = capa.rrm_flags;
3806                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
3807                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
3808                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
3809                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
3810                 wpa_s->max_match_sets = capa.max_match_sets;
3811                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
3812                 wpa_s->max_stations = capa.max_stations;
3813                 wpa_s->extended_capa = capa.extended_capa;
3814                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
3815                 wpa_s->extended_capa_len = capa.extended_capa_len;
3816                 wpa_s->num_multichan_concurrent =
3817                         capa.num_multichan_concurrent;
3818                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
3819         }
3820         if (wpa_s->max_remain_on_chan == 0)
3821                 wpa_s->max_remain_on_chan = 1000;
3822
3823         /*
3824          * Only take p2p_mgmt parameters when P2P Device is supported.
3825          * Doing it here as it determines whether l2_packet_init() will be done
3826          * during wpa_supplicant_driver_init().
3827          */
3828         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
3829                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
3830         else
3831                 iface->p2p_mgmt = 1;
3832
3833         if (wpa_s->num_multichan_concurrent == 0)
3834                 wpa_s->num_multichan_concurrent = 1;
3835
3836         if (wpa_supplicant_driver_init(wpa_s) < 0)
3837                 return -1;
3838
3839 #ifdef CONFIG_TDLS
3840         if ((!iface->p2p_mgmt ||
3841              !(wpa_s->drv_flags &
3842                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3843             wpa_tdls_init(wpa_s->wpa))
3844                 return -1;
3845 #endif /* CONFIG_TDLS */
3846
3847         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
3848             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
3849                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
3850                 return -1;
3851         }
3852
3853         if (wpas_wps_init(wpa_s))
3854                 return -1;
3855
3856         if (wpa_supplicant_init_eapol(wpa_s) < 0)
3857                 return -1;
3858         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
3859
3860         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
3861         if (wpa_s->ctrl_iface == NULL) {
3862                 wpa_printf(MSG_ERROR,
3863                            "Failed to initialize control interface '%s'.\n"
3864                            "You may have another wpa_supplicant process "
3865                            "already running or the file was\n"
3866                            "left by an unclean termination of wpa_supplicant "
3867                            "in which case you will need\n"
3868                            "to manually remove this file before starting "
3869                            "wpa_supplicant again.\n",
3870                            wpa_s->conf->ctrl_interface);
3871                 return -1;
3872         }
3873
3874         wpa_s->gas = gas_query_init(wpa_s);
3875         if (wpa_s->gas == NULL) {
3876                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
3877                 return -1;
3878         }
3879
3880         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
3881                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
3882                 return -1;
3883         }
3884
3885         if (wpa_bss_init(wpa_s) < 0)
3886                 return -1;
3887
3888         /*
3889          * Set Wake-on-WLAN triggers, if configured.
3890          * Note: We don't restore/remove the triggers on shutdown (it doesn't
3891          * have effect anyway when the interface is down).
3892          */
3893         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
3894                 return -1;
3895
3896 #ifdef CONFIG_EAP_PROXY
3897 {
3898         size_t len;
3899         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
3900                                                      &len);
3901         if (wpa_s->mnc_len > 0) {
3902                 wpa_s->imsi[len] = '\0';
3903                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
3904                            wpa_s->imsi, wpa_s->mnc_len);
3905         } else {
3906                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
3907         }
3908 }
3909 #endif /* CONFIG_EAP_PROXY */
3910
3911         if (pcsc_reader_init(wpa_s) < 0)
3912                 return -1;
3913
3914         if (wpas_init_ext_pw(wpa_s) < 0)
3915                 return -1;
3916
3917         wpas_rrm_reset(wpa_s);
3918
3919         return 0;
3920 }
3921
3922
3923 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
3924                                         int notify, int terminate)
3925 {
3926         struct wpa_global *global = wpa_s->global;
3927         struct wpa_supplicant *iface, *prev;
3928
3929         if (wpa_s == wpa_s->parent)
3930                 wpas_p2p_group_remove(wpa_s, "*");
3931
3932         iface = global->ifaces;
3933         while (iface) {
3934                 if (iface == wpa_s || iface->parent != wpa_s) {
3935                         iface = iface->next;
3936                         continue;
3937                 }
3938                 wpa_printf(MSG_DEBUG,
3939                            "Remove remaining child interface %s from parent %s",
3940                            iface->ifname, wpa_s->ifname);
3941                 prev = iface;
3942                 iface = iface->next;
3943                 wpa_supplicant_remove_iface(global, prev, terminate);
3944         }
3945
3946         wpa_s->disconnected = 1;
3947         if (wpa_s->drv_priv) {
3948                 wpa_supplicant_deauthenticate(wpa_s,
3949                                               WLAN_REASON_DEAUTH_LEAVING);
3950
3951                 wpa_drv_set_countermeasures(wpa_s, 0);
3952                 wpa_clear_keys(wpa_s, NULL);
3953         }
3954
3955         wpa_supplicant_cleanup(wpa_s);
3956         wpas_p2p_deinit_iface(wpa_s);
3957
3958         wpas_ctrl_radio_work_flush(wpa_s);
3959         radio_remove_interface(wpa_s);
3960
3961         if (wpa_s->drv_priv)
3962                 wpa_drv_deinit(wpa_s);
3963
3964         if (notify)
3965                 wpas_notify_iface_removed(wpa_s);
3966
3967         if (terminate)
3968                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
3969
3970         if (wpa_s->ctrl_iface) {
3971                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
3972                 wpa_s->ctrl_iface = NULL;
3973         }
3974
3975 #ifdef CONFIG_MESH
3976         if (wpa_s->ifmsh) {
3977                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
3978                 wpa_s->ifmsh = NULL;
3979         }
3980 #endif /* CONFIG_MESH */
3981
3982         if (wpa_s->conf != NULL) {
3983                 wpa_config_free(wpa_s->conf);
3984                 wpa_s->conf = NULL;
3985         }
3986
3987         os_free(wpa_s);
3988 }
3989
3990
3991 /**
3992  * wpa_supplicant_add_iface - Add a new network interface
3993  * @global: Pointer to global data from wpa_supplicant_init()
3994  * @iface: Interface configuration options
3995  * Returns: Pointer to the created interface or %NULL on failure
3996  *
3997  * This function is used to add new network interfaces for %wpa_supplicant.
3998  * This can be called before wpa_supplicant_run() to add interfaces before the
3999  * main event loop has been started. In addition, new interfaces can be added
4000  * dynamically while %wpa_supplicant is already running. This could happen,
4001  * e.g., when a hotplug network adapter is inserted.
4002  */
4003 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4004                                                  struct wpa_interface *iface)
4005 {
4006         struct wpa_supplicant *wpa_s;
4007         struct wpa_interface t_iface;
4008         struct wpa_ssid *ssid;
4009
4010         if (global == NULL || iface == NULL)
4011                 return NULL;
4012
4013         wpa_s = wpa_supplicant_alloc();
4014         if (wpa_s == NULL)
4015                 return NULL;
4016
4017         wpa_s->global = global;
4018
4019         t_iface = *iface;
4020         if (global->params.override_driver) {
4021                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4022                            "('%s' -> '%s')",
4023                            iface->driver, global->params.override_driver);
4024                 t_iface.driver = global->params.override_driver;
4025         }
4026         if (global->params.override_ctrl_interface) {
4027                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4028                            "ctrl_interface ('%s' -> '%s')",
4029                            iface->ctrl_interface,
4030                            global->params.override_ctrl_interface);
4031                 t_iface.ctrl_interface =
4032                         global->params.override_ctrl_interface;
4033         }
4034         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4035                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4036                            iface->ifname);
4037                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4038                 return NULL;
4039         }
4040
4041         if (iface->p2p_mgmt == 0) {
4042                 /* Notify the control interfaces about new iface */
4043                 if (wpas_notify_iface_added(wpa_s)) {
4044                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4045                         return NULL;
4046                 }
4047
4048                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4049                         wpas_notify_network_added(wpa_s, ssid);
4050         }
4051
4052         wpa_s->next = global->ifaces;
4053         global->ifaces = wpa_s;
4054
4055         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4056         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4057
4058 #ifdef CONFIG_P2P
4059         if (wpa_s->global->p2p == NULL &&
4060             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4061             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4062                 wpa_printf(MSG_INFO,
4063                            "P2P: Failed to enable P2P Device interface");
4064                 /* Try to continue without. P2P will be disabled. */
4065         }
4066 #endif /* CONFIG_P2P */
4067
4068         return wpa_s;
4069 }
4070
4071
4072 /**
4073  * wpa_supplicant_remove_iface - Remove a network interface
4074  * @global: Pointer to global data from wpa_supplicant_init()
4075  * @wpa_s: Pointer to the network interface to be removed
4076  * Returns: 0 if interface was removed, -1 if interface was not found
4077  *
4078  * This function can be used to dynamically remove network interfaces from
4079  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4080  * addition, this function is used to remove all remaining interfaces when
4081  * %wpa_supplicant is terminated.
4082  */
4083 int wpa_supplicant_remove_iface(struct wpa_global *global,
4084                                 struct wpa_supplicant *wpa_s,
4085                                 int terminate)
4086 {
4087         struct wpa_supplicant *prev;
4088 #ifdef CONFIG_MESH
4089         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4090         char *ifname = NULL;
4091 #endif /* CONFIG_MESH */
4092
4093         /* Remove interface from the global list of interfaces */
4094         prev = global->ifaces;
4095         if (prev == wpa_s) {
4096                 global->ifaces = wpa_s->next;
4097         } else {
4098                 while (prev && prev->next != wpa_s)
4099                         prev = prev->next;
4100                 if (prev == NULL)
4101                         return -1;
4102                 prev->next = wpa_s->next;
4103         }
4104
4105         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4106
4107 #ifdef CONFIG_MESH
4108         if (mesh_if_created) {
4109                 ifname = os_strdup(wpa_s->ifname);
4110                 if (ifname == NULL) {
4111                         wpa_dbg(wpa_s, MSG_ERROR,
4112                                 "mesh: Failed to malloc ifname");
4113                         return -1;
4114                 }
4115         }
4116 #endif /* CONFIG_MESH */
4117
4118         if (global->p2p_group_formation == wpa_s)
4119                 global->p2p_group_formation = NULL;
4120         if (global->p2p_invite_group == wpa_s)
4121                 global->p2p_invite_group = NULL;
4122         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4123
4124 #ifdef CONFIG_MESH
4125         if (mesh_if_created) {
4126                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4127                 os_free(ifname);
4128         }
4129 #endif /* CONFIG_MESH */
4130
4131         return 0;
4132 }
4133
4134
4135 /**
4136  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4137  * @wpa_s: Pointer to the network interface
4138  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4139  */
4140 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4141 {
4142         const char *eapol_method;
4143
4144         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4145             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4146                 return "NO-EAP";
4147         }
4148
4149         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4150         if (eapol_method == NULL)
4151                 return "UNKNOWN-EAP";
4152
4153         return eapol_method;
4154 }
4155
4156
4157 /**
4158  * wpa_supplicant_get_iface - Get a new network interface
4159  * @global: Pointer to global data from wpa_supplicant_init()
4160  * @ifname: Interface name
4161  * Returns: Pointer to the interface or %NULL if not found
4162  */
4163 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4164                                                  const char *ifname)
4165 {
4166         struct wpa_supplicant *wpa_s;
4167
4168         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4169                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4170                         return wpa_s;
4171         }
4172         return NULL;
4173 }
4174
4175
4176 #ifndef CONFIG_NO_WPA_MSG
4177 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4178 {
4179         struct wpa_supplicant *wpa_s = ctx;
4180         if (wpa_s == NULL)
4181                 return NULL;
4182         return wpa_s->ifname;
4183 }
4184 #endif /* CONFIG_NO_WPA_MSG */
4185
4186
4187 /**
4188  * wpa_supplicant_init - Initialize %wpa_supplicant
4189  * @params: Parameters for %wpa_supplicant
4190  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4191  *
4192  * This function is used to initialize %wpa_supplicant. After successful
4193  * initialization, the returned data pointer can be used to add and remove
4194  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4195  */
4196 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4197 {
4198         struct wpa_global *global;
4199         int ret, i;
4200
4201         if (params == NULL)
4202                 return NULL;
4203
4204 #ifdef CONFIG_DRIVER_NDIS
4205         {
4206                 void driver_ndis_init_ops(void);
4207                 driver_ndis_init_ops();
4208         }
4209 #endif /* CONFIG_DRIVER_NDIS */
4210
4211 #ifndef CONFIG_NO_WPA_MSG
4212         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4213 #endif /* CONFIG_NO_WPA_MSG */
4214
4215         wpa_debug_open_file(params->wpa_debug_file_path);
4216         if (params->wpa_debug_syslog)
4217                 wpa_debug_open_syslog();
4218         if (params->wpa_debug_tracing) {
4219                 ret = wpa_debug_open_linux_tracing();
4220                 if (ret) {
4221                         wpa_printf(MSG_ERROR,
4222                                    "Failed to enable trace logging");
4223                         return NULL;
4224                 }
4225         }
4226
4227         ret = eap_register_methods();
4228         if (ret) {
4229                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4230                 if (ret == -2)
4231                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4232                                    "the same EAP type.");
4233                 return NULL;
4234         }
4235
4236         global = os_zalloc(sizeof(*global));
4237         if (global == NULL)
4238                 return NULL;
4239         dl_list_init(&global->p2p_srv_bonjour);
4240         dl_list_init(&global->p2p_srv_upnp);
4241         global->params.daemonize = params->daemonize;
4242         global->params.wait_for_monitor = params->wait_for_monitor;
4243         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4244         if (params->pid_file)
4245                 global->params.pid_file = os_strdup(params->pid_file);
4246         if (params->ctrl_interface)
4247                 global->params.ctrl_interface =
4248                         os_strdup(params->ctrl_interface);
4249         if (params->ctrl_interface_group)
4250                 global->params.ctrl_interface_group =
4251                         os_strdup(params->ctrl_interface_group);
4252         if (params->override_driver)
4253                 global->params.override_driver =
4254                         os_strdup(params->override_driver);
4255         if (params->override_ctrl_interface)
4256                 global->params.override_ctrl_interface =
4257                         os_strdup(params->override_ctrl_interface);
4258         wpa_debug_level = global->params.wpa_debug_level =
4259                 params->wpa_debug_level;
4260         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4261                 params->wpa_debug_show_keys;
4262         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4263                 params->wpa_debug_timestamp;
4264
4265         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4266
4267         if (eloop_init()) {
4268                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4269                 wpa_supplicant_deinit(global);
4270                 return NULL;
4271         }
4272
4273         random_init(params->entropy_file);
4274
4275         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4276         if (global->ctrl_iface == NULL) {
4277                 wpa_supplicant_deinit(global);
4278                 return NULL;
4279         }
4280
4281         if (wpas_notify_supplicant_initialized(global)) {
4282                 wpa_supplicant_deinit(global);
4283                 return NULL;
4284         }
4285
4286         for (i = 0; wpa_drivers[i]; i++)
4287                 global->drv_count++;
4288         if (global->drv_count == 0) {
4289                 wpa_printf(MSG_ERROR, "No drivers enabled");
4290                 wpa_supplicant_deinit(global);
4291                 return NULL;
4292         }
4293         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4294         if (global->drv_priv == NULL) {
4295                 wpa_supplicant_deinit(global);
4296                 return NULL;
4297         }
4298
4299 #ifdef CONFIG_WIFI_DISPLAY
4300         if (wifi_display_init(global) < 0) {
4301                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4302                 wpa_supplicant_deinit(global);
4303                 return NULL;
4304         }
4305 #endif /* CONFIG_WIFI_DISPLAY */
4306
4307         return global;
4308 }
4309
4310
4311 /**
4312  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4313  * @global: Pointer to global data from wpa_supplicant_init()
4314  * Returns: 0 after successful event loop run, -1 on failure
4315  *
4316  * This function starts the main event loop and continues running as long as
4317  * there are any remaining events. In most cases, this function is running as
4318  * long as the %wpa_supplicant process in still in use.
4319  */
4320 int wpa_supplicant_run(struct wpa_global *global)
4321 {
4322         struct wpa_supplicant *wpa_s;
4323
4324         if (global->params.daemonize &&
4325             wpa_supplicant_daemon(global->params.pid_file))
4326                 return -1;
4327
4328         if (global->params.wait_for_monitor) {
4329                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4330                         if (wpa_s->ctrl_iface)
4331                                 wpa_supplicant_ctrl_iface_wait(
4332                                         wpa_s->ctrl_iface);
4333         }
4334
4335         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4336         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4337
4338         eloop_run();
4339
4340         return 0;
4341 }
4342
4343
4344 /**
4345  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4346  * @global: Pointer to global data from wpa_supplicant_init()
4347  *
4348  * This function is called to deinitialize %wpa_supplicant and to free all
4349  * allocated resources. Remaining network interfaces will also be removed.
4350  */
4351 void wpa_supplicant_deinit(struct wpa_global *global)
4352 {
4353         int i;
4354
4355         if (global == NULL)
4356                 return;
4357
4358 #ifdef CONFIG_WIFI_DISPLAY
4359         wifi_display_deinit(global);
4360 #endif /* CONFIG_WIFI_DISPLAY */
4361
4362         while (global->ifaces)
4363                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4364
4365         if (global->ctrl_iface)
4366                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4367
4368         wpas_notify_supplicant_deinitialized(global);
4369
4370         eap_peer_unregister_methods();
4371 #ifdef CONFIG_AP
4372         eap_server_unregister_methods();
4373 #endif /* CONFIG_AP */
4374
4375         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4376                 if (!global->drv_priv[i])
4377                         continue;
4378                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4379         }
4380         os_free(global->drv_priv);
4381
4382         random_deinit();
4383
4384         eloop_destroy();
4385
4386         if (global->params.pid_file) {
4387                 os_daemonize_terminate(global->params.pid_file);
4388                 os_free(global->params.pid_file);
4389         }
4390         os_free(global->params.ctrl_interface);
4391         os_free(global->params.ctrl_interface_group);
4392         os_free(global->params.override_driver);
4393         os_free(global->params.override_ctrl_interface);
4394
4395         os_free(global->p2p_disallow_freq.range);
4396         os_free(global->p2p_go_avoid_freq.range);
4397         os_free(global->add_psk);
4398
4399         os_free(global);
4400         wpa_debug_close_syslog();
4401         wpa_debug_close_file();
4402         wpa_debug_close_linux_tracing();
4403 }
4404
4405
4406 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4407 {
4408         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4409             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4410                 char country[3];
4411                 country[0] = wpa_s->conf->country[0];
4412                 country[1] = wpa_s->conf->country[1];
4413                 country[2] = '\0';
4414                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4415                         wpa_printf(MSG_ERROR, "Failed to set country code "
4416                                    "'%s'", country);
4417                 }
4418         }
4419
4420         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4421                 wpas_init_ext_pw(wpa_s);
4422
4423 #ifdef CONFIG_WPS
4424         wpas_wps_update_config(wpa_s);
4425 #endif /* CONFIG_WPS */
4426         wpas_p2p_update_config(wpa_s);
4427         wpa_s->conf->changed_parameters = 0;
4428 }
4429
4430
4431 void add_freq(int *freqs, int *num_freqs, int freq)
4432 {
4433         int i;
4434
4435         for (i = 0; i < *num_freqs; i++) {
4436                 if (freqs[i] == freq)
4437                         return;
4438         }
4439
4440         freqs[*num_freqs] = freq;
4441         (*num_freqs)++;
4442 }
4443
4444
4445 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4446 {
4447         struct wpa_bss *bss, *cbss;
4448         const int max_freqs = 10;
4449         int *freqs;
4450         int num_freqs = 0;
4451
4452         freqs = os_calloc(max_freqs + 1, sizeof(int));
4453         if (freqs == NULL)
4454                 return NULL;
4455
4456         cbss = wpa_s->current_bss;
4457
4458         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4459                 if (bss == cbss)
4460                         continue;
4461                 if (bss->ssid_len == cbss->ssid_len &&
4462                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4463                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4464                         add_freq(freqs, &num_freqs, bss->freq);
4465                         if (num_freqs == max_freqs)
4466                                 break;
4467                 }
4468         }
4469
4470         if (num_freqs == 0) {
4471                 os_free(freqs);
4472                 freqs = NULL;
4473         }
4474
4475         return freqs;
4476 }
4477
4478
4479 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4480 {
4481         int timeout;
4482         int count;
4483         int *freqs = NULL;
4484
4485         wpas_connect_work_done(wpa_s);
4486
4487         /*
4488          * Remove possible authentication timeout since the connection failed.
4489          */
4490         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4491
4492         if (wpa_s->disconnected) {
4493                 /*
4494                  * There is no point in blacklisting the AP if this event is
4495                  * generated based on local request to disconnect.
4496                  */
4497                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4498                         "indication since interface has been put into "
4499                         "disconnected state");
4500                 return;
4501         }
4502
4503         /*
4504          * Add the failed BSSID into the blacklist and speed up next scan
4505          * attempt if there could be other APs that could accept association.
4506          * The current blacklist count indicates how many times we have tried
4507          * connecting to this AP and multiple attempts mean that other APs are
4508          * either not available or has already been tried, so that we can start
4509          * increasing the delay here to avoid constant scanning.
4510          */
4511         count = wpa_blacklist_add(wpa_s, bssid);
4512         if (count == 1 && wpa_s->current_bss) {
4513                 /*
4514                  * This BSS was not in the blacklist before. If there is
4515                  * another BSS available for the same ESS, we should try that
4516                  * next. Otherwise, we may as well try this one once more
4517                  * before allowing other, likely worse, ESSes to be considered.
4518                  */
4519                 freqs = get_bss_freqs_in_ess(wpa_s);
4520                 if (freqs) {
4521                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4522                                 "has been seen; try it next");
4523                         wpa_blacklist_add(wpa_s, bssid);
4524                         /*
4525                          * On the next scan, go through only the known channels
4526                          * used in this ESS based on previous scans to speed up
4527                          * common load balancing use case.
4528                          */
4529                         os_free(wpa_s->next_scan_freqs);
4530                         wpa_s->next_scan_freqs = freqs;
4531                 }
4532         }
4533
4534         /*
4535          * Add previous failure count in case the temporary blacklist was
4536          * cleared due to no other BSSes being available.
4537          */
4538         count += wpa_s->extra_blacklist_count;
4539
4540         if (count > 3 && wpa_s->current_ssid) {
4541                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4542                            "consider temporary network disabling");
4543                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4544         }
4545
4546         switch (count) {
4547         case 1:
4548                 timeout = 100;
4549                 break;
4550         case 2:
4551                 timeout = 500;
4552                 break;
4553         case 3:
4554                 timeout = 1000;
4555                 break;
4556         case 4:
4557                 timeout = 5000;
4558                 break;
4559         default:
4560                 timeout = 10000;
4561                 break;
4562         }
4563
4564         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4565                 "ms", count, timeout);
4566
4567         /*
4568          * TODO: if more than one possible AP is available in scan results,
4569          * could try the other ones before requesting a new scan.
4570          */
4571         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4572                                 1000 * (timeout % 1000));
4573 }
4574
4575
4576 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4577 {
4578         return wpa_s->conf->ap_scan == 2 ||
4579                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4580 }
4581
4582
4583 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4584 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4585                                               struct wpa_ssid *ssid,
4586                                               const char *field,
4587                                               const char *value)
4588 {
4589 #ifdef IEEE8021X_EAPOL
4590         struct eap_peer_config *eap = &ssid->eap;
4591
4592         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4593         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4594                               (const u8 *) value, os_strlen(value));
4595
4596         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4597         case WPA_CTRL_REQ_EAP_IDENTITY:
4598                 os_free(eap->identity);
4599                 eap->identity = (u8 *) os_strdup(value);
4600                 eap->identity_len = os_strlen(value);
4601                 eap->pending_req_identity = 0;
4602                 if (ssid == wpa_s->current_ssid)
4603                         wpa_s->reassociate = 1;
4604                 break;
4605         case WPA_CTRL_REQ_EAP_PASSWORD:
4606                 bin_clear_free(eap->password, eap->password_len);
4607                 eap->password = (u8 *) os_strdup(value);
4608                 eap->password_len = os_strlen(value);
4609                 eap->pending_req_password = 0;
4610                 if (ssid == wpa_s->current_ssid)
4611                         wpa_s->reassociate = 1;
4612                 break;
4613         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4614                 bin_clear_free(eap->new_password, eap->new_password_len);
4615                 eap->new_password = (u8 *) os_strdup(value);
4616                 eap->new_password_len = os_strlen(value);
4617                 eap->pending_req_new_password = 0;
4618                 if (ssid == wpa_s->current_ssid)
4619                         wpa_s->reassociate = 1;
4620                 break;
4621         case WPA_CTRL_REQ_EAP_PIN:
4622                 str_clear_free(eap->pin);
4623                 eap->pin = os_strdup(value);
4624                 eap->pending_req_pin = 0;
4625                 if (ssid == wpa_s->current_ssid)
4626                         wpa_s->reassociate = 1;
4627                 break;
4628         case WPA_CTRL_REQ_EAP_OTP:
4629                 bin_clear_free(eap->otp, eap->otp_len);
4630                 eap->otp = (u8 *) os_strdup(value);
4631                 eap->otp_len = os_strlen(value);
4632                 os_free(eap->pending_req_otp);
4633                 eap->pending_req_otp = NULL;
4634                 eap->pending_req_otp_len = 0;
4635                 break;
4636         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4637                 str_clear_free(eap->private_key_passwd);
4638                 eap->private_key_passwd = os_strdup(value);
4639                 eap->pending_req_passphrase = 0;
4640                 if (ssid == wpa_s->current_ssid)
4641                         wpa_s->reassociate = 1;
4642                 break;
4643         case WPA_CTRL_REQ_SIM:
4644                 str_clear_free(eap->external_sim_resp);
4645                 eap->external_sim_resp = os_strdup(value);
4646                 break;
4647         default:
4648                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4649                 return -1;
4650         }
4651
4652         return 0;
4653 #else /* IEEE8021X_EAPOL */
4654         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4655         return -1;
4656 #endif /* IEEE8021X_EAPOL */
4657 }
4658 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4659
4660
4661 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4662 {
4663         int i;
4664         unsigned int drv_enc;
4665
4666         if (ssid == NULL)
4667                 return 1;
4668
4669         if (ssid->disabled)
4670                 return 1;
4671
4672         if (wpa_s && wpa_s->drv_capa_known)
4673                 drv_enc = wpa_s->drv_enc;
4674         else
4675                 drv_enc = (unsigned int) -1;
4676
4677         for (i = 0; i < NUM_WEP_KEYS; i++) {
4678                 size_t len = ssid->wep_key_len[i];
4679                 if (len == 0)
4680                         continue;
4681                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
4682                         continue;
4683                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
4684                         continue;
4685                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
4686                         continue;
4687                 return 1; /* invalid WEP key */
4688         }
4689
4690         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
4691             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
4692                 return 1;
4693
4694         return 0;
4695 }
4696
4697
4698 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
4699 {
4700         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
4701                 return 1;
4702         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
4703                 return 0;
4704         return -1;
4705 }
4706
4707
4708 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
4709 {
4710         struct wpa_ssid *ssid = wpa_s->current_ssid;
4711         int dur;
4712         struct os_reltime now;
4713
4714         if (ssid == NULL) {
4715                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
4716                            "SSID block");
4717                 return;
4718         }
4719
4720         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
4721                 return;
4722
4723         ssid->auth_failures++;
4724
4725 #ifdef CONFIG_P2P
4726         if (ssid->p2p_group &&
4727             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
4728                 /*
4729                  * Skip the wait time since there is a short timeout on the
4730                  * connection to a P2P group.
4731                  */
4732                 return;
4733         }
4734 #endif /* CONFIG_P2P */
4735
4736         if (ssid->auth_failures > 50)
4737                 dur = 300;
4738         else if (ssid->auth_failures > 10)
4739                 dur = 120;
4740         else if (ssid->auth_failures > 5)
4741                 dur = 90;
4742         else if (ssid->auth_failures > 3)
4743                 dur = 60;
4744         else if (ssid->auth_failures > 2)
4745                 dur = 30;
4746         else if (ssid->auth_failures > 1)
4747                 dur = 20;
4748         else
4749                 dur = 10;
4750
4751         if (ssid->auth_failures > 1 &&
4752             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
4753                 dur += os_random() % (ssid->auth_failures * 10);
4754
4755         os_get_reltime(&now);
4756         if (now.sec + dur <= ssid->disabled_until.sec)
4757                 return;
4758
4759         ssid->disabled_until.sec = now.sec + dur;
4760
4761         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
4762                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
4763                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
4764                 ssid->auth_failures, dur, reason);
4765 }
4766
4767
4768 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
4769                               struct wpa_ssid *ssid, int clear_failures)
4770 {
4771         if (ssid == NULL)
4772                 return;
4773
4774         if (ssid->disabled_until.sec) {
4775                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
4776                         "id=%d ssid=\"%s\"",
4777                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
4778         }
4779         ssid->disabled_until.sec = 0;
4780         ssid->disabled_until.usec = 0;
4781         if (clear_failures)
4782                 ssid->auth_failures = 0;
4783 }
4784
4785
4786 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
4787 {
4788         size_t i;
4789
4790         if (wpa_s->disallow_aps_bssid == NULL)
4791                 return 0;
4792
4793         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
4794                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
4795                               bssid, ETH_ALEN) == 0)
4796                         return 1;
4797         }
4798
4799         return 0;
4800 }
4801
4802
4803 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
4804                     size_t ssid_len)
4805 {
4806         size_t i;
4807
4808         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
4809                 return 0;
4810
4811         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
4812                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
4813                 if (ssid_len == s->ssid_len &&
4814                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
4815                         return 1;
4816         }
4817
4818         return 0;
4819 }
4820
4821
4822 /**
4823  * wpas_request_connection - Request a new connection
4824  * @wpa_s: Pointer to the network interface
4825  *
4826  * This function is used to request a new connection to be found. It will mark
4827  * the interface to allow reassociation and request a new scan to find a
4828  * suitable network to connect to.
4829  */
4830 void wpas_request_connection(struct wpa_supplicant *wpa_s)
4831 {
4832         wpa_s->normal_scans = 0;
4833         wpa_s->scan_req = NORMAL_SCAN_REQ;
4834         wpa_supplicant_reinit_autoscan(wpa_s);
4835         wpa_s->extra_blacklist_count = 0;
4836         wpa_s->disconnected = 0;
4837         wpa_s->reassociate = 1;
4838
4839         if (wpa_supplicant_fast_associate(wpa_s) != 1)
4840                 wpa_supplicant_req_scan(wpa_s, 0, 0);
4841 }
4842
4843
4844 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
4845                     struct wpa_used_freq_data *freqs_data,
4846                     unsigned int len)
4847 {
4848         unsigned int i;
4849
4850         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
4851                 len, title);
4852         for (i = 0; i < len; i++) {
4853                 struct wpa_used_freq_data *cur = &freqs_data[i];
4854                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
4855                         i, cur->freq, cur->flags);
4856         }
4857 }
4858
4859
4860 /*
4861  * Find the operating frequencies of any of the virtual interfaces that
4862  * are using the same radio as the current interface, and in addition, get
4863  * information about the interface types that are using the frequency.
4864  */
4865 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
4866                                 struct wpa_used_freq_data *freqs_data,
4867                                 unsigned int len)
4868 {
4869         struct wpa_supplicant *ifs;
4870         u8 bssid[ETH_ALEN];
4871         int freq;
4872         unsigned int idx = 0, i;
4873
4874         wpa_dbg(wpa_s, MSG_DEBUG,
4875                 "Determining shared radio frequencies (max len %u)", len);
4876         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
4877
4878         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
4879                          radio_list) {
4880                 if (idx == len)
4881                         break;
4882
4883                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
4884                         continue;
4885
4886                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
4887                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
4888                         freq = ifs->current_ssid->frequency;
4889                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
4890                         freq = ifs->assoc_freq;
4891                 else
4892                         continue;
4893
4894                 /* Hold only distinct freqs */
4895                 for (i = 0; i < idx; i++)
4896                         if (freqs_data[i].freq == freq)
4897                                 break;
4898
4899                 if (i == idx)
4900                         freqs_data[idx++].freq = freq;
4901
4902                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
4903                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
4904                                 WPA_FREQ_USED_BY_P2P_CLIENT :
4905                                 WPA_FREQ_USED_BY_INFRA_STATION;
4906                 }
4907         }
4908
4909         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
4910         return idx;
4911 }
4912
4913
4914 /*
4915  * Find the operating frequencies of any of the virtual interfaces that
4916  * are using the same radio as the current interface.
4917  */
4918 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
4919                            int *freq_array, unsigned int len)
4920 {
4921         struct wpa_used_freq_data *freqs_data;
4922         int num, i;
4923
4924         os_memset(freq_array, 0, sizeof(int) * len);
4925
4926         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
4927         if (!freqs_data)
4928                 return -1;
4929
4930         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
4931         for (i = 0; i < num; i++)
4932                 freq_array[i] = freqs_data[i].freq;
4933
4934         os_free(freqs_data);
4935
4936         return num;
4937 }
4938
4939
4940 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
4941 {
4942         struct rrm_data *rrm = data;
4943
4944         if (!rrm->notify_neighbor_rep) {
4945                 wpa_printf(MSG_ERROR,
4946                            "RRM: Unexpected neighbor report timeout");
4947                 return;
4948         }
4949
4950         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
4951         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
4952
4953         rrm->notify_neighbor_rep = NULL;
4954         rrm->neighbor_rep_cb_ctx = NULL;
4955 }
4956
4957
4958 /*
4959  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
4960  * @wpa_s: Pointer to wpa_supplicant
4961  */
4962 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
4963 {
4964         wpa_s->rrm.rrm_used = 0;
4965
4966         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
4967                              NULL);
4968         if (wpa_s->rrm.notify_neighbor_rep)
4969                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
4970         wpa_s->rrm.next_neighbor_rep_token = 1;
4971 }
4972
4973
4974 /*
4975  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
4976  * @wpa_s: Pointer to wpa_supplicant
4977  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
4978  * @report_len: Length of neighbor report buffer
4979  */
4980 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
4981                                    const u8 *report, size_t report_len)
4982 {
4983         struct wpabuf *neighbor_rep;
4984
4985         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
4986         if (report_len < 1)
4987                 return;
4988
4989         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
4990                 wpa_printf(MSG_DEBUG,
4991                            "RRM: Discarding neighbor report with token %d (expected %d)",
4992                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
4993                 return;
4994         }
4995
4996         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
4997                              NULL);
4998
4999         if (!wpa_s->rrm.notify_neighbor_rep) {
5000                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5001                 return;
5002         }
5003
5004         /* skipping the first byte, which is only an id (dialog token) */
5005         neighbor_rep = wpabuf_alloc(report_len - 1);
5006         if (neighbor_rep == NULL)
5007                 return;
5008         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5009         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5010                    report[0]);
5011         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5012                                        neighbor_rep);
5013         wpa_s->rrm.notify_neighbor_rep = NULL;
5014         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5015 }
5016
5017
5018 /**
5019  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5020  * @wpa_s: Pointer to wpa_supplicant
5021  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5022  *        is sent in the request.
5023  * @cb: Callback function to be called once the requested report arrives, or
5024  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5025  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5026  *      the requester's responsibility to free it.
5027  *      In the latter case NULL will be sent in 'neighbor_rep'.
5028  * @cb_ctx: Context value to send the callback function
5029  * Returns: 0 in case of success, negative error code otherwise
5030  *
5031  * In case there is a previous request which has not been answered yet, the
5032  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5033  * Request must contain a callback function.
5034  */
5035 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5036                                        const struct wpa_ssid *ssid,
5037                                        void (*cb)(void *ctx,
5038                                                   struct wpabuf *neighbor_rep),
5039                                        void *cb_ctx)
5040 {
5041         struct wpabuf *buf;
5042         const u8 *rrm_ie;
5043
5044         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5045                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5046                 return -ENOTCONN;
5047         }
5048
5049         if (!wpa_s->rrm.rrm_used) {
5050                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5051                 return -EOPNOTSUPP;
5052         }
5053
5054         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5055                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5056         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5057             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5058                 wpa_printf(MSG_DEBUG,
5059                            "RRM: No network support for Neighbor Report.");
5060                 return -EOPNOTSUPP;
5061         }
5062
5063         if (!cb) {
5064                 wpa_printf(MSG_DEBUG,
5065                            "RRM: Neighbor Report request must provide a callback.");
5066                 return -EINVAL;
5067         }
5068
5069         /* Refuse if there's a live request */
5070         if (wpa_s->rrm.notify_neighbor_rep) {
5071                 wpa_printf(MSG_DEBUG,
5072                            "RRM: Currently handling previous Neighbor Report.");
5073                 return -EBUSY;
5074         }
5075
5076         /* 3 = action category + action code + dialog token */
5077         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5078         if (buf == NULL) {
5079                 wpa_printf(MSG_DEBUG,
5080                            "RRM: Failed to allocate Neighbor Report Request");
5081                 return -ENOMEM;
5082         }
5083
5084         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5085                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5086                    wpa_s->rrm.next_neighbor_rep_token);
5087
5088         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5089         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5090         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5091         if (ssid) {
5092                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5093                 wpabuf_put_u8(buf, ssid->ssid_len);
5094                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5095         }
5096
5097         wpa_s->rrm.next_neighbor_rep_token++;
5098
5099         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5100                                 wpa_s->own_addr, wpa_s->bssid,
5101                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5102                 wpa_printf(MSG_DEBUG,
5103                            "RRM: Failed to send Neighbor Report Request");
5104                 wpabuf_free(buf);
5105                 return -ECANCELED;
5106         }
5107
5108         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5109         wpa_s->rrm.notify_neighbor_rep = cb;
5110         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5111                                wpas_rrm_neighbor_rep_timeout_handler,
5112                                &wpa_s->rrm, NULL);
5113
5114         wpabuf_free(buf);
5115         return 0;
5116 }
5117
5118
5119 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5120                                               const u8 *src,
5121                                               const u8 *frame, size_t len,
5122                                               int rssi)
5123 {
5124         struct wpabuf *buf;
5125         const struct rrm_link_measurement_request *req;
5126         struct rrm_link_measurement_report report;
5127
5128         if (wpa_s->wpa_state != WPA_COMPLETED) {
5129                 wpa_printf(MSG_INFO,
5130                            "RRM: Ignoring link measurement request. Not associated");
5131                 return;
5132         }
5133
5134         if (!wpa_s->rrm.rrm_used) {
5135                 wpa_printf(MSG_INFO,
5136                            "RRM: Ignoring link measurement request. Not RRM network");
5137                 return;
5138         }
5139
5140         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5141                 wpa_printf(MSG_INFO,
5142                            "RRM: Measurement report failed. TX power insertion not supported");
5143                 return;
5144         }
5145
5146         req = (const struct rrm_link_measurement_request *) frame;
5147         if (len < sizeof(*req)) {
5148                 wpa_printf(MSG_INFO,
5149                            "RRM: Link measurement report failed. Request too short");
5150                 return;
5151         }
5152
5153         os_memset(&report, 0, sizeof(report));
5154         report.tpc.eid = WLAN_EID_TPC_REPORT;
5155         report.tpc.len = 2;
5156         report.rsni = 255; /* 255 indicates that RSNI is not available */
5157         report.dialog_token = req->dialog_token;
5158
5159         /*
5160          * It's possible to estimate RCPI based on RSSI in dBm. This
5161          * calculation will not reflect the correct value for high rates,
5162          * but it's good enough for Action frames which are transmitted
5163          * with up to 24 Mbps rates.
5164          */
5165         if (!rssi)
5166                 report.rcpi = 255; /* not available */
5167         else if (rssi < -110)
5168                 report.rcpi = 0;
5169         else if (rssi > 0)
5170                 report.rcpi = 220;
5171         else
5172                 report.rcpi = (rssi + 110) * 2;
5173
5174         /* action_category + action_code */
5175         buf = wpabuf_alloc(2 + sizeof(report));
5176         if (buf == NULL) {
5177                 wpa_printf(MSG_ERROR,
5178                            "RRM: Link measurement report failed. Buffer allocation failed");
5179                 return;
5180         }
5181
5182         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5183         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5184         wpabuf_put_data(buf, &report, sizeof(report));
5185         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5186                     wpabuf_head(buf), wpabuf_len(buf));
5187
5188         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5189                                 wpa_s->own_addr, wpa_s->bssid,
5190                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5191                 wpa_printf(MSG_ERROR,
5192                            "RRM: Link measurement report failed. Send action failed");
5193         }
5194         wpabuf_free(buf);
5195 }