wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (is_zero_ether_addr(bssid))
 196                 bssid = wpa_s->pending_bssid;
 197         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 198                 MAC2STR(bssid));
 199         wpa_blacklist_add(wpa_s, bssid);
 200         wpa_sm_notify_disassoc(wpa_s->wpa);
 201         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 202         wpa_s->reassociate = 1;
 203
 204         /*
 205          * If we timed out, the AP or the local radio may be busy.
 206          * So, wait a second until scanning again.
 207          */
 208         wpa_supplicant_req_scan(wpa_s, 1, 0);
 209 }
 210
 211
 212 /**
 213  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 214  * @wpa_s: Pointer to wpa_supplicant data
 215  * @sec: Number of seconds after which to time out authentication
 216  * @usec: Number of microseconds after which to time out authentication
 217  *
 218  * This function is used to schedule a timeout for the current authentication
 219  * attempt.
 220  */
 221 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 222                                      int sec, int usec)
 223 {
 224         if (wpa_s->conf->ap_scan == 0 &&
 225             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 226                 return;
 227
 228         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 229                 "%d usec", sec, usec);
 230         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 231         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 232 }
 233
 234
 235 /**
 236  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 237  * @wpa_s: Pointer to wpa_supplicant data
 238  *
 239  * This function is used to cancel authentication timeout scheduled with
 240  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 241  * been completed.
 242  */
 243 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 244 {
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 246         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 247         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 248 }
 249
 250
 251 /**
 252  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 253  * @wpa_s: Pointer to wpa_supplicant data
 254  *
 255  * This function is used to configure EAPOL state machine based on the selected
 256  * authentication mode.
 257  */
 258 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 259 {
 260 #ifdef IEEE8021X_EAPOL
 261         struct eapol_config eapol_conf;
 262         struct wpa_ssid *ssid = wpa_s->current_ssid;
 263
 264 #ifdef CONFIG_IBSS_RSN
 265         if (ssid->mode == WPAS_MODE_IBSS &&
 266             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 267             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 268                 /*
 269                  * RSN IBSS authentication is per-STA and we can disable the
 270                  * per-BSSID EAPOL authentication.
 271                  */
 272                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 273                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 274                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 275                 return;
 276         }
 277 #endif /* CONFIG_IBSS_RSN */
 278
 279         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 280         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 281
 282         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 283             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 284                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 285         else
 286                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 287
 288         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 289         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 290                 eapol_conf.accept_802_1x_keys = 1;
 291                 eapol_conf.required_keys = 0;
 292                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 293                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 294                 }
 295                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 296                         eapol_conf.required_keys |=
 297                                 EAPOL_REQUIRE_KEY_BROADCAST;
 298                 }
 299
 300                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 301                         eapol_conf.required_keys = 0;
 302         }
 303         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 304         eapol_conf.workaround = ssid->eap_workaround;
 305         eapol_conf.eap_disabled =
 306                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 307                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 308                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 309         eapol_conf.external_sim = wpa_s->conf->external_sim;
 310
 311 #ifdef CONFIG_WPS
 312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 313                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 314                 if (wpa_s->current_bss) {
 315                         struct wpabuf *ie;
 316                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 317                                                          WPS_IE_VENDOR_TYPE);
 318                         if (ie) {
 319                                 if (wps_is_20(ie))
 320                                         eapol_conf.wps |=
 321                                                 EAPOL_PEER_IS_WPS20_AP;
 322                                 wpabuf_free(ie);
 323                         }
 324                 }
 325         }
 326 #endif /* CONFIG_WPS */
 327
 328         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 329
 330         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 331 #endif /* IEEE8021X_EAPOL */
 332 }
 333
 334
 335 /**
 336  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 337  * @wpa_s: Pointer to wpa_supplicant data
 338  * @ssid: Configuration data for the network
 339  *
 340  * This function is used to configure WPA state machine and related parameters
 341  * to a mode where WPA is not enabled. This is called as part of the
 342  * authentication configuration when the selected network does not use WPA.
 343  */
 344 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 345                                        struct wpa_ssid *ssid)
 346 {
 347         int i;
 348
 349         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 351         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 353         else
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 355         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 356         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 357         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 359         wpa_s->group_cipher = WPA_CIPHER_NONE;
 360         wpa_s->mgmt_group_cipher = 0;
 361
 362         for (i = 0; i < NUM_WEP_KEYS; i++) {
 363                 if (ssid->wep_key_len[i] > 5) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 366                         break;
 367                 } else if (ssid->wep_key_len[i] > 0) {
 368                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 369                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 370                         break;
 371                 }
 372         }
 373
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 377                          wpa_s->pairwise_cipher);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 379 #ifdef CONFIG_IEEE80211W
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 381                          wpa_s->mgmt_group_cipher);
 382 #endif /* CONFIG_IEEE80211W */
 383
 384         pmksa_cache_clear_current(wpa_s->wpa);
 385 }
 386
 387
 388 void free_hw_features(struct wpa_supplicant *wpa_s)
 389 {
 390         int i;
 391         if (wpa_s->hw.modes == NULL)
 392                 return;
 393
 394         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 395                 os_free(wpa_s->hw.modes[i].channels);
 396                 os_free(wpa_s->hw.modes[i].rates);
 397         }
 398
 399         os_free(wpa_s->hw.modes);
 400         wpa_s->hw.modes = NULL;
 401 }
 402
 403
 404 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 405 {
 406         struct wpa_bss_tmp_disallowed *bss, *prev;
 407
 408         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 409                               struct wpa_bss_tmp_disallowed, list) {
 410                 dl_list_del(&bss->list);
 411                 os_free(bss);
 412         }
 413 }
 414
 415
 416 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 417 {
 418         int i;
 419
 420         bgscan_deinit(wpa_s);
 421         autoscan_deinit(wpa_s);
 422         scard_deinit(wpa_s->scard);
 423         wpa_s->scard = NULL;
 424         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 425         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 426         l2_packet_deinit(wpa_s->l2);
 427         wpa_s->l2 = NULL;
 428         if (wpa_s->l2_br) {
 429                 l2_packet_deinit(wpa_s->l2_br);
 430                 wpa_s->l2_br = NULL;
 431         }
 432 #ifdef CONFIG_TESTING_OPTIONS
 433         l2_packet_deinit(wpa_s->l2_test);
 434         wpa_s->l2_test = NULL;
 435 #endif /* CONFIG_TESTING_OPTIONS */
 436
 437         if (wpa_s->conf != NULL) {
 438                 struct wpa_ssid *ssid;
 439                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 440                         wpas_notify_network_removed(wpa_s, ssid);
 441         }
 442
 443         os_free(wpa_s->confname);
 444         wpa_s->confname = NULL;
 445
 446         os_free(wpa_s->confanother);
 447         wpa_s->confanother = NULL;
 448
 449         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 450         eapol_sm_deinit(wpa_s->eapol);
 451         wpa_s->eapol = NULL;
 452
 453         rsn_preauth_deinit(wpa_s->wpa);
 454
 455 #ifdef CONFIG_TDLS
 456         wpa_tdls_deinit(wpa_s->wpa);
 457 #endif /* CONFIG_TDLS */
 458
 459         wmm_ac_clear_saved_tspecs(wpa_s);
 460         pmksa_candidate_free(wpa_s->wpa);
 461         wpa_sm_deinit(wpa_s->wpa);
 462         wpa_s->wpa = NULL;
 463         wpa_blacklist_clear(wpa_s);
 464
 465         wpa_bss_deinit(wpa_s);
 466
 467         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 468         wpa_supplicant_cancel_scan(wpa_s);
 469         wpa_supplicant_cancel_auth_timeout(wpa_s);
 470         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 471 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 472         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 473                              wpa_s, NULL);
 474 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 475
 476         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 477
 478         wpas_wps_deinit(wpa_s);
 479
 480         wpabuf_free(wpa_s->pending_eapol_rx);
 481         wpa_s->pending_eapol_rx = NULL;
 482
 483 #ifdef CONFIG_IBSS_RSN
 484         ibss_rsn_deinit(wpa_s->ibss_rsn);
 485         wpa_s->ibss_rsn = NULL;
 486 #endif /* CONFIG_IBSS_RSN */
 487
 488         sme_deinit(wpa_s);
 489
 490 #ifdef CONFIG_AP
 491         wpa_supplicant_ap_deinit(wpa_s);
 492 #endif /* CONFIG_AP */
 493
 494         wpas_p2p_deinit(wpa_s);
 495
 496 #ifdef CONFIG_OFFCHANNEL
 497         offchannel_deinit(wpa_s);
 498 #endif /* CONFIG_OFFCHANNEL */
 499
 500         wpa_supplicant_cancel_sched_scan(wpa_s);
 501
 502         os_free(wpa_s->next_scan_freqs);
 503         wpa_s->next_scan_freqs = NULL;
 504
 505         os_free(wpa_s->manual_scan_freqs);
 506         wpa_s->manual_scan_freqs = NULL;
 507
 508         os_free(wpa_s->manual_sched_scan_freqs);
 509         wpa_s->manual_sched_scan_freqs = NULL;
 510
 511         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 512
 513         /*
 514          * Need to remove any pending gas-query radio work before the
 515          * gas_query_deinit() call because gas_query::work has not yet been set
 516          * for works that have not been started. gas_query_free() will be unable
 517          * to cancel such pending radio works and once the pending gas-query
 518          * radio work eventually gets removed, the deinit notification call to
 519          * gas_query_start_cb() would result in dereferencing freed memory.
 520          */
 521         if (wpa_s->radio)
 522                 radio_remove_works(wpa_s, "gas-query", 0);
 523         gas_query_deinit(wpa_s->gas);
 524         wpa_s->gas = NULL;
 525
 526         free_hw_features(wpa_s);
 527
 528         ieee802_1x_dealloc_kay_sm(wpa_s);
 529
 530         os_free(wpa_s->bssid_filter);
 531         wpa_s->bssid_filter = NULL;
 532
 533         os_free(wpa_s->disallow_aps_bssid);
 534         wpa_s->disallow_aps_bssid = NULL;
 535         os_free(wpa_s->disallow_aps_ssid);
 536         wpa_s->disallow_aps_ssid = NULL;
 537
 538         wnm_bss_keep_alive_deinit(wpa_s);
 539 #ifdef CONFIG_WNM
 540         wnm_deallocate_memory(wpa_s);
 541 #endif /* CONFIG_WNM */
 542
 543         ext_password_deinit(wpa_s->ext_pw);
 544         wpa_s->ext_pw = NULL;
 545
 546         wpabuf_free(wpa_s->last_gas_resp);
 547         wpa_s->last_gas_resp = NULL;
 548         wpabuf_free(wpa_s->prev_gas_resp);
 549         wpa_s->prev_gas_resp = NULL;
 550
 551         os_free(wpa_s->last_scan_res);
 552         wpa_s->last_scan_res = NULL;
 553
 554 #ifdef CONFIG_HS20
 555         if (wpa_s->drv_priv)
 556                 wpa_drv_configure_frame_filters(wpa_s, 0);
 557         hs20_deinit(wpa_s);
 558 #endif /* CONFIG_HS20 */
 559
 560         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 561                 wpabuf_free(wpa_s->vendor_elem[i]);
 562                 wpa_s->vendor_elem[i] = NULL;
 563         }
 564
 565         wmm_ac_notify_disassoc(wpa_s);
 566
 567         wpa_s->sched_scan_plans_num = 0;
 568         os_free(wpa_s->sched_scan_plans);
 569         wpa_s->sched_scan_plans = NULL;
 570
 571 #ifdef CONFIG_MBO
 572         wpa_s->non_pref_chan_num = 0;
 573         os_free(wpa_s->non_pref_chan);
 574         wpa_s->non_pref_chan = NULL;
 575 #endif /* CONFIG_MBO */
 576
 577         free_bss_tmp_disallowed(wpa_s);
 578
 579         wpabuf_free(wpa_s->lci);
 580         wpa_s->lci = NULL;
 581 }
 582
 583
 584 /**
 585  * wpa_clear_keys - Clear keys configured for the driver
 586  * @wpa_s: Pointer to wpa_supplicant data
 587  * @addr: Previously used BSSID or %NULL if not available
 588  *
 589  * This function clears the encryption keys that has been previously configured
 590  * for the driver.
 591  */
 592 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 593 {
 594         int i, max;
 595
 596 #ifdef CONFIG_IEEE80211W
 597         max = 6;
 598 #else /* CONFIG_IEEE80211W */
 599         max = 4;
 600 #endif /* CONFIG_IEEE80211W */
 601
 602         /* MLME-DELETEKEYS.request */
 603         for (i = 0; i < max; i++) {
 604                 if (wpa_s->keys_cleared & BIT(i))
 605                         continue;
 606                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 607                                 NULL, 0);
 608         }
 609         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 610             !is_zero_ether_addr(addr)) {
 611                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 612                                 0);
 613                 /* MLME-SETPROTECTION.request(None) */
 614                 wpa_drv_mlme_setprotection(
 615                         wpa_s, addr,
 616                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 617                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 618         }
 619         wpa_s->keys_cleared = (u32) -1;
 620 }
 621
 622
 623 /**
 624  * wpa_supplicant_state_txt - Get the connection state name as a text string
 625  * @state: State (wpa_state; WPA_*)
 626  * Returns: The state name as a printable text string
 627  */
 628 const char * wpa_supplicant_state_txt(enum wpa_states state)
 629 {
 630         switch (state) {
 631         case WPA_DISCONNECTED:
 632                 return "DISCONNECTED";
 633         case WPA_INACTIVE:
 634                 return "INACTIVE";
 635         case WPA_INTERFACE_DISABLED:
 636                 return "INTERFACE_DISABLED";
 637         case WPA_SCANNING:
 638                 return "SCANNING";
 639         case WPA_AUTHENTICATING:
 640                 return "AUTHENTICATING";
 641         case WPA_ASSOCIATING:
 642                 return "ASSOCIATING";
 643         case WPA_ASSOCIATED:
 644                 return "ASSOCIATED";
 645         case WPA_4WAY_HANDSHAKE:
 646                 return "4WAY_HANDSHAKE";
 647         case WPA_GROUP_HANDSHAKE:
 648                 return "GROUP_HANDSHAKE";
 649         case WPA_COMPLETED:
 650                 return "COMPLETED";
 651         default:
 652                 return "UNKNOWN";
 653         }
 654 }
 655
 656
 657 #ifdef CONFIG_BGSCAN
 658
 659 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 660 {
 661         const char *name;
 662
 663         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 664                 name = wpa_s->current_ssid->bgscan;
 665         else
 666                 name = wpa_s->conf->bgscan;
 667         if (name == NULL || name[0] == '\0')
 668                 return;
 669         if (wpas_driver_bss_selection(wpa_s))
 670                 return;
 671         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 672                 return;
 673 #ifdef CONFIG_P2P
 674         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 675                 return;
 676 #endif /* CONFIG_P2P */
 677
 678         bgscan_deinit(wpa_s);
 679         if (wpa_s->current_ssid) {
 680                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 681                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 682                                 "bgscan");
 683                         /*
 684                          * Live without bgscan; it is only used as a roaming
 685                          * optimization, so the initial connection is not
 686                          * affected.
 687                          */
 688                 } else {
 689                         struct wpa_scan_results *scan_res;
 690                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 691                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 692                                                                    0);
 693                         if (scan_res) {
 694                                 bgscan_notify_scan(wpa_s, scan_res);
 695                                 wpa_scan_results_free(scan_res);
 696                         }
 697                 }
 698         } else
 699                 wpa_s->bgscan_ssid = NULL;
 700 }
 701
 702
 703 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 704 {
 705         if (wpa_s->bgscan_ssid != NULL) {
 706                 bgscan_deinit(wpa_s);
 707                 wpa_s->bgscan_ssid = NULL;
 708         }
 709 }
 710
 711 #endif /* CONFIG_BGSCAN */
 712
 713
 714 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 715 {
 716         if (autoscan_init(wpa_s, 0))
 717                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 718 }
 719
 720
 721 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 722 {
 723         autoscan_deinit(wpa_s);
 724 }
 725
 726
 727 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 728 {
 729         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 730             wpa_s->wpa_state == WPA_SCANNING) {
 731                 autoscan_deinit(wpa_s);
 732                 wpa_supplicant_start_autoscan(wpa_s);
 733         }
 734 }
 735
 736
 737 /**
 738  * wpa_supplicant_set_state - Set current connection state
 739  * @wpa_s: Pointer to wpa_supplicant data
 740  * @state: The new connection state
 741  *
 742  * This function is called whenever the connection state changes, e.g.,
 743  * association is completed for WPA/WPA2 4-Way Handshake is started.
 744  */
 745 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 746                               enum wpa_states state)
 747 {
 748         enum wpa_states old_state = wpa_s->wpa_state;
 749
 750         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 751                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 752                 wpa_supplicant_state_txt(state));
 753
 754         if (state == WPA_INTERFACE_DISABLED) {
 755                 /* Assure normal scan when interface is restored */
 756                 wpa_s->normal_scans = 0;
 757         }
 758
 759         if (state == WPA_COMPLETED) {
 760                 wpas_connect_work_done(wpa_s);
 761                 /* Reinitialize normal_scan counter */
 762                 wpa_s->normal_scans = 0;
 763         }
 764
 765 #ifdef CONFIG_P2P
 766         /*
 767          * P2PS client has to reply to Probe Request frames received on the
 768          * group operating channel. Enable Probe Request frame reporting for
 769          * P2P connected client in case p2p_cli_probe configuration property is
 770          * set to 1.
 771          */
 772         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 773             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 774             wpa_s->current_ssid->p2p_group) {
 775                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 776                         wpa_dbg(wpa_s, MSG_DEBUG,
 777                                 "P2P: Enable CLI Probe Request RX reporting");
 778                         wpa_s->p2p_cli_probe =
 779                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 780                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 781                         wpa_dbg(wpa_s, MSG_DEBUG,
 782                                 "P2P: Disable CLI Probe Request RX reporting");
 783                         wpa_s->p2p_cli_probe = 0;
 784                         wpa_drv_probe_req_report(wpa_s, 0);
 785                 }
 786         }
 787 #endif /* CONFIG_P2P */
 788
 789         if (state != WPA_SCANNING)
 790                 wpa_supplicant_notify_scanning(wpa_s, 0);
 791
 792         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 793                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 794 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 795                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 796                         MACSTR " completed [id=%d id_str=%s]",
 797                         MAC2STR(wpa_s->bssid),
 798                         ssid ? ssid->id : -1,
 799                         ssid && ssid->id_str ? ssid->id_str : "");
 800 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 801                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 802                 wpa_blacklist_clear(wpa_s);
 803                 wpa_s->extra_blacklist_count = 0;
 804                 wpa_s->new_connection = 0;
 805                 wpa_drv_set_operstate(wpa_s, 1);
 806 #ifndef IEEE8021X_EAPOL
 807                 wpa_drv_set_supp_port(wpa_s, 1);
 808 #endif /* IEEE8021X_EAPOL */
 809                 wpa_s->after_wps = 0;
 810                 wpa_s->known_wps_freq = 0;
 811                 wpas_p2p_completed(wpa_s);
 812
 813                 sme_sched_obss_scan(wpa_s, 1);
 814         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 815                    state == WPA_ASSOCIATED) {
 816                 wpa_s->new_connection = 1;
 817                 wpa_drv_set_operstate(wpa_s, 0);
 818 #ifndef IEEE8021X_EAPOL
 819                 wpa_drv_set_supp_port(wpa_s, 0);
 820 #endif /* IEEE8021X_EAPOL */
 821                 sme_sched_obss_scan(wpa_s, 0);
 822         }
 823         wpa_s->wpa_state = state;
 824
 825 #ifdef CONFIG_BGSCAN
 826         if (state == WPA_COMPLETED)
 827                 wpa_supplicant_start_bgscan(wpa_s);
 828         else if (state < WPA_ASSOCIATED)
 829                 wpa_supplicant_stop_bgscan(wpa_s);
 830 #endif /* CONFIG_BGSCAN */
 831
 832         if (state == WPA_AUTHENTICATING)
 833                 wpa_supplicant_stop_autoscan(wpa_s);
 834
 835         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 836                 wpa_supplicant_start_autoscan(wpa_s);
 837
 838         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 839                 wmm_ac_notify_disassoc(wpa_s);
 840
 841         if (wpa_s->wpa_state != old_state) {
 842                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 843
 844                 /*
 845                  * Notify the P2P Device interface about a state change in one
 846                  * of the interfaces.
 847                  */
 848                 wpas_p2p_indicate_state_change(wpa_s);
 849
 850                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 851                     old_state == WPA_COMPLETED)
 852                         wpas_notify_auth_changed(wpa_s);
 853         }
 854 }
 855
 856
 857 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 858 {
 859         int pending = 0;
 860 #ifdef CONFIG_WPS
 861         struct wpa_supplicant *wpa_s = global->ifaces;
 862         while (wpa_s) {
 863                 struct wpa_supplicant *next = wpa_s->next;
 864                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 865                         pending = 1;
 866 #ifdef CONFIG_P2P
 867                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 868                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 869                         wpas_p2p_disconnect(wpa_s);
 870 #endif /* CONFIG_P2P */
 871                 wpa_s = next;
 872         }
 873 #endif /* CONFIG_WPS */
 874         if (pending)
 875                 return;
 876         eloop_terminate();
 877 }
 878
 879
 880 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 881 {
 882         struct wpa_global *global = signal_ctx;
 883         wpa_supplicant_terminate_proc(global);
 884 }
 885
 886
 887 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 888 {
 889         enum wpa_states old_state = wpa_s->wpa_state;
 890
 891         wpa_s->pairwise_cipher = 0;
 892         wpa_s->group_cipher = 0;
 893         wpa_s->mgmt_group_cipher = 0;
 894         wpa_s->key_mgmt = 0;
 895         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 896                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 897
 898         if (wpa_s->wpa_state != old_state)
 899                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 900 }
 901
 902
 903 /**
 904  * wpa_supplicant_reload_configuration - Reload configuration data
 905  * @wpa_s: Pointer to wpa_supplicant data
 906  * Returns: 0 on success or -1 if configuration parsing failed
 907  *
 908  * This function can be used to request that the configuration data is reloaded
 909  * (e.g., after configuration file change). This function is reloading
 910  * configuration only for one interface, so this may need to be called multiple
 911  * times if %wpa_supplicant is controlling multiple interfaces and all
 912  * interfaces need reconfiguration.
 913  */
 914 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 915 {
 916         struct wpa_config *conf;
 917         int reconf_ctrl;
 918         int old_ap_scan;
 919
 920         if (wpa_s->confname == NULL)
 921                 return -1;
 922         conf = wpa_config_read(wpa_s->confname, NULL);
 923         if (conf == NULL) {
 924                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 925                         "file '%s' - exiting", wpa_s->confname);
 926                 return -1;
 927         }
 928         wpa_config_read(wpa_s->confanother, conf);
 929
 930         conf->changed_parameters = (unsigned int) -1;
 931
 932         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 933                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 934                     os_strcmp(conf->ctrl_interface,
 935                               wpa_s->conf->ctrl_interface) != 0);
 936
 937         if (reconf_ctrl && wpa_s->ctrl_iface) {
 938                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 939                 wpa_s->ctrl_iface = NULL;
 940         }
 941
 942         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 943         if (wpa_s->current_ssid) {
 944                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 945                         wpa_s->own_disconnect_req = 1;
 946                 wpa_supplicant_deauthenticate(wpa_s,
 947                                               WLAN_REASON_DEAUTH_LEAVING);
 948         }
 949
 950         /*
 951          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 952          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 953          */
 954         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 955                 /*
 956                  * Clear forced success to clear EAP state for next
 957                  * authentication.
 958                  */
 959                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 960         }
 961         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 962         wpa_sm_set_config(wpa_s->wpa, NULL);
 963         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 964         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 965         rsn_preauth_deinit(wpa_s->wpa);
 966
 967         old_ap_scan = wpa_s->conf->ap_scan;
 968         wpa_config_free(wpa_s->conf);
 969         wpa_s->conf = conf;
 970         if (old_ap_scan != wpa_s->conf->ap_scan)
 971                 wpas_notify_ap_scan_changed(wpa_s);
 972
 973         if (reconf_ctrl)
 974                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 975
 976         wpa_supplicant_update_config(wpa_s);
 977
 978         wpa_supplicant_clear_status(wpa_s);
 979         if (wpa_supplicant_enabled_networks(wpa_s)) {
 980                 wpa_s->reassociate = 1;
 981                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 982         }
 983         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 984         return 0;
 985 }
 986
 987
 988 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 989 {
 990         struct wpa_global *global = signal_ctx;
 991         struct wpa_supplicant *wpa_s;
 992         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 993                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 994                         sig);
 995                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 996                         wpa_supplicant_terminate_proc(global);
 997                 }
 998         }
 999
1000         if (wpa_debug_reopen_file() < 0) {
1001                 /* Ignore errors since we cannot really do much to fix this */
1002                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1003         }
1004 }
1005
1006
1007 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1008                                          struct wpa_ssid *ssid,
1009                                          struct wpa_ie_data *ie)
1010 {
1011         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1012         if (ret) {
1013                 if (ret == -2) {
1014                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1015                                 "from association info");
1016                 }
1017                 return -1;
1018         }
1019
1020         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1021                 "cipher suites");
1022         if (!(ie->group_cipher & ssid->group_cipher)) {
1023                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1024                         "cipher 0x%x (mask 0x%x) - reject",
1025                         ie->group_cipher, ssid->group_cipher);
1026                 return -1;
1027         }
1028         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1029                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1030                         "cipher 0x%x (mask 0x%x) - reject",
1031                         ie->pairwise_cipher, ssid->pairwise_cipher);
1032                 return -1;
1033         }
1034         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1036                         "management 0x%x (mask 0x%x) - reject",
1037                         ie->key_mgmt, ssid->key_mgmt);
1038                 return -1;
1039         }
1040
1041 #ifdef CONFIG_IEEE80211W
1042         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1043             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1044                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1045                         "that does not support management frame protection - "
1046                         "reject");
1047                 return -1;
1048         }
1049 #endif /* CONFIG_IEEE80211W */
1050
1051         return 0;
1052 }
1053
1054
1055 /**
1056  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1057  * @wpa_s: Pointer to wpa_supplicant data
1058  * @bss: Scan results for the selected BSS, or %NULL if not available
1059  * @ssid: Configuration data for the selected network
1060  * @wpa_ie: Buffer for the WPA/RSN IE
1061  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1062  * used buffer length in case the functions returns success.
1063  * Returns: 0 on success or -1 on failure
1064  *
1065  * This function is used to configure authentication and encryption parameters
1066  * based on the network configuration and scan result for the selected BSS (if
1067  * available).
1068  */
1069 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1070                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1071                               u8 *wpa_ie, size_t *wpa_ie_len)
1072 {
1073         struct wpa_ie_data ie;
1074         int sel, proto;
1075         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1076
1077         if (bss) {
1078                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1079                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1080                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1081         } else
1082                 bss_wpa = bss_rsn = bss_osen = NULL;
1083
1084         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1085             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1086             (ie.group_cipher & ssid->group_cipher) &&
1087             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1088             (ie.key_mgmt & ssid->key_mgmt)) {
1089                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1090                 proto = WPA_PROTO_RSN;
1091         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1092                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1093                    (ie.group_cipher & ssid->group_cipher) &&
1094                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1095                    (ie.key_mgmt & ssid->key_mgmt)) {
1096                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1097                 proto = WPA_PROTO_WPA;
1098 #ifdef CONFIG_HS20
1099         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1100                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1101                 /* TODO: parse OSEN element */
1102                 os_memset(&ie, 0, sizeof(ie));
1103                 ie.group_cipher = WPA_CIPHER_CCMP;
1104                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1105                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1106                 proto = WPA_PROTO_OSEN;
1107 #endif /* CONFIG_HS20 */
1108         } else if (bss) {
1109                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1110                 wpa_dbg(wpa_s, MSG_DEBUG,
1111                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1112                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1113                         ssid->key_mgmt);
1114                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1115                         MAC2STR(bss->bssid),
1116                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1117                         bss_wpa ? " WPA" : "",
1118                         bss_rsn ? " RSN" : "",
1119                         bss_osen ? " OSEN" : "");
1120                 if (bss_rsn) {
1121                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1122                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1123                                 wpa_dbg(wpa_s, MSG_DEBUG,
1124                                         "Could not parse RSN element");
1125                         } else {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1128                                         ie.pairwise_cipher, ie.group_cipher,
1129                                         ie.key_mgmt);
1130                         }
1131                 }
1132                 if (bss_wpa) {
1133                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1134                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1135                                 wpa_dbg(wpa_s, MSG_DEBUG,
1136                                         "Could not parse WPA element");
1137                         } else {
1138                                 wpa_dbg(wpa_s, MSG_DEBUG,
1139                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1140                                         ie.pairwise_cipher, ie.group_cipher,
1141                                         ie.key_mgmt);
1142                         }
1143                 }
1144                 return -1;
1145         } else {
1146                 if (ssid->proto & WPA_PROTO_OSEN)
1147                         proto = WPA_PROTO_OSEN;
1148                 else if (ssid->proto & WPA_PROTO_RSN)
1149                         proto = WPA_PROTO_RSN;
1150                 else
1151                         proto = WPA_PROTO_WPA;
1152                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1153                         os_memset(&ie, 0, sizeof(ie));
1154                         ie.group_cipher = ssid->group_cipher;
1155                         ie.pairwise_cipher = ssid->pairwise_cipher;
1156                         ie.key_mgmt = ssid->key_mgmt;
1157 #ifdef CONFIG_IEEE80211W
1158                         ie.mgmt_group_cipher =
1159                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1160                                 WPA_CIPHER_AES_128_CMAC : 0;
1161 #endif /* CONFIG_IEEE80211W */
1162                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1163                                 "based on configuration");
1164                 } else
1165                         proto = ie.proto;
1166         }
1167
1168         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1169                 "pairwise %d key_mgmt %d proto %d",
1170                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1171 #ifdef CONFIG_IEEE80211W
1172         if (ssid->ieee80211w) {
1173                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1174                         ie.mgmt_group_cipher);
1175         }
1176 #endif /* CONFIG_IEEE80211W */
1177
1178         wpa_s->wpa_proto = proto;
1179         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1180         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1181                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1182
1183         if (bss || !wpa_s->ap_ies_from_associnfo) {
1184                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1185                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1186                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1187                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1188                         return -1;
1189         }
1190
1191 #ifdef CONFIG_NO_WPA
1192         wpa_s->group_cipher = WPA_CIPHER_NONE;
1193         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1194 #else /* CONFIG_NO_WPA */
1195         sel = ie.group_cipher & ssid->group_cipher;
1196         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1197         if (wpa_s->group_cipher < 0) {
1198                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1199                         "cipher");
1200                 return -1;
1201         }
1202         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1203                 wpa_cipher_txt(wpa_s->group_cipher));
1204
1205         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1206         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1207         if (wpa_s->pairwise_cipher < 0) {
1208                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1209                         "cipher");
1210                 return -1;
1211         }
1212         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1213                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1214 #endif /* CONFIG_NO_WPA */
1215
1216         sel = ie.key_mgmt & ssid->key_mgmt;
1217 #ifdef CONFIG_SAE
1218         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1219                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1220 #endif /* CONFIG_SAE */
1221         if (0) {
1222 #ifdef CONFIG_SUITEB192
1223         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1225                 wpa_dbg(wpa_s, MSG_DEBUG,
1226                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1227 #endif /* CONFIG_SUITEB192 */
1228 #ifdef CONFIG_SUITEB
1229         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1231                 wpa_dbg(wpa_s, MSG_DEBUG,
1232                         "WPA: using KEY_MGMT 802.1X with Suite B");
1233 #endif /* CONFIG_SUITEB */
1234 #ifdef CONFIG_IEEE80211R
1235         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1236                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1237                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1238         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1239                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1240                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1241 #endif /* CONFIG_IEEE80211R */
1242 #ifdef CONFIG_SAE
1243         } else if (sel & WPA_KEY_MGMT_SAE) {
1244                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1245                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1246         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1248                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1249 #endif /* CONFIG_SAE */
1250 #ifdef CONFIG_IEEE80211W
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1253                 wpa_dbg(wpa_s, MSG_DEBUG,
1254                         "WPA: using KEY_MGMT 802.1X with SHA256");
1255         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1256                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1257                 wpa_dbg(wpa_s, MSG_DEBUG,
1258                         "WPA: using KEY_MGMT PSK with SHA256");
1259 #endif /* CONFIG_IEEE80211W */
1260         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1261                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1262                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1263         } else if (sel & WPA_KEY_MGMT_PSK) {
1264                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1266         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1267                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1268                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1269 #ifdef CONFIG_HS20
1270         } else if (sel & WPA_KEY_MGMT_OSEN) {
1271                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1272                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1273 #endif /* CONFIG_HS20 */
1274         } else {
1275                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1276                         "authenticated key management type");
1277                 return -1;
1278         }
1279
1280         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1282                          wpa_s->pairwise_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1284
1285 #ifdef CONFIG_IEEE80211W
1286         sel = ie.mgmt_group_cipher;
1287         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1288             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1289                 sel = 0;
1290         if (sel & WPA_CIPHER_AES_128_CMAC) {
1291                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1292                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1293                         "AES-128-CMAC");
1294         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1295                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1296                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1297                         "BIP-GMAC-128");
1298         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1299                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1300                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1301                         "BIP-GMAC-256");
1302         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1303                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1304                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1305                         "BIP-CMAC-256");
1306         } else {
1307                 wpa_s->mgmt_group_cipher = 0;
1308                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1309         }
1310         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1311                          wpa_s->mgmt_group_cipher);
1312         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1313                          wpas_get_ssid_pmf(wpa_s, ssid));
1314 #endif /* CONFIG_IEEE80211W */
1315
1316         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1317                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1318                 return -1;
1319         }
1320
1321         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1322                 int psk_set = 0;
1323
1324                 if (ssid->psk_set) {
1325                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1326                                        NULL);
1327                         psk_set = 1;
1328                 }
1329 #ifndef CONFIG_NO_PBKDF2
1330                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1331                     ssid->passphrase) {
1332                         u8 psk[PMK_LEN];
1333                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1334                                     4096, psk, PMK_LEN);
1335                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1336                                         psk, PMK_LEN);
1337                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1338                         psk_set = 1;
1339                         os_memset(psk, 0, sizeof(psk));
1340                 }
1341 #endif /* CONFIG_NO_PBKDF2 */
1342 #ifdef CONFIG_EXT_PASSWORD
1343                 if (ssid->ext_psk) {
1344                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1345                                                              ssid->ext_psk);
1346                         char pw_str[64 + 1];
1347                         u8 psk[PMK_LEN];
1348
1349                         if (pw == NULL) {
1350                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1351                                         "found from external storage");
1352                                 return -1;
1353                         }
1354
1355                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1356                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1357                                         "PSK length %d in external storage",
1358                                         (int) wpabuf_len(pw));
1359                                 ext_password_free(pw);
1360                                 return -1;
1361                         }
1362
1363                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1364                         pw_str[wpabuf_len(pw)] = '\0';
1365
1366 #ifndef CONFIG_NO_PBKDF2
1367                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1368                         {
1369                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1370                                             4096, psk, PMK_LEN);
1371                                 os_memset(pw_str, 0, sizeof(pw_str));
1372                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1373                                                 "external passphrase)",
1374                                                 psk, PMK_LEN);
1375                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1376                                                NULL);
1377                                 psk_set = 1;
1378                                 os_memset(psk, 0, sizeof(psk));
1379                         } else
1380 #endif /* CONFIG_NO_PBKDF2 */
1381                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1382                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1383                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1384                                                 "Invalid PSK hex string");
1385                                         os_memset(pw_str, 0, sizeof(pw_str));
1386                                         ext_password_free(pw);
1387                                         return -1;
1388                                 }
1389                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1390                                                NULL);
1391                                 psk_set = 1;
1392                                 os_memset(psk, 0, sizeof(psk));
1393                         } else {
1394                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1395                                         "PSK available");
1396                                 os_memset(pw_str, 0, sizeof(pw_str));
1397                                 ext_password_free(pw);
1398                                 return -1;
1399                         }
1400
1401                         os_memset(pw_str, 0, sizeof(pw_str));
1402                         ext_password_free(pw);
1403                 }
1404 #endif /* CONFIG_EXT_PASSWORD */
1405
1406                 if (!psk_set) {
1407                         wpa_msg(wpa_s, MSG_INFO,
1408                                 "No PSK available for association");
1409                         return -1;
1410                 }
1411         } else
1412                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1413
1414         return 0;
1415 }
1416
1417
1418 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1419 {
1420         *pos = 0x00;
1421
1422         switch (idx) {
1423         case 0: /* Bits 0-7 */
1424                 break;
1425         case 1: /* Bits 8-15 */
1426                 break;
1427         case 2: /* Bits 16-23 */
1428 #ifdef CONFIG_WNM
1429                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1430                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1431 #endif /* CONFIG_WNM */
1432                 break;
1433         case 3: /* Bits 24-31 */
1434 #ifdef CONFIG_WNM
1435                 *pos |= 0x02; /* Bit 25 - SSID List */
1436 #endif /* CONFIG_WNM */
1437 #ifdef CONFIG_INTERWORKING
1438                 if (wpa_s->conf->interworking)
1439                         *pos |= 0x80; /* Bit 31 - Interworking */
1440 #endif /* CONFIG_INTERWORKING */
1441                 break;
1442         case 4: /* Bits 32-39 */
1443 #ifdef CONFIG_INTERWORKING
1444                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1445                         *pos |= 0x01; /* Bit 32 - QoS Map */
1446 #endif /* CONFIG_INTERWORKING */
1447                 break;
1448         case 5: /* Bits 40-47 */
1449 #ifdef CONFIG_HS20
1450                 if (wpa_s->conf->hs20)
1451                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1452 #endif /* CONFIG_HS20 */
1453 #ifdef CONFIG_MBO
1454                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1455 #endif /* CONFIG_MBO */
1456                 break;
1457         case 6: /* Bits 48-55 */
1458                 break;
1459         }
1460 }
1461
1462
1463 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1464 {
1465         u8 *pos = buf;
1466         u8 len = 6, i;
1467
1468         if (len < wpa_s->extended_capa_len)
1469                 len = wpa_s->extended_capa_len;
1470         if (buflen < (size_t) len + 2) {
1471                 wpa_printf(MSG_INFO,
1472                            "Not enough room for building extended capabilities element");
1473                 return -1;
1474         }
1475
1476         *pos++ = WLAN_EID_EXT_CAPAB;
1477         *pos++ = len;
1478         for (i = 0; i < len; i++, pos++) {
1479                 wpas_ext_capab_byte(wpa_s, pos, i);
1480
1481                 if (i < wpa_s->extended_capa_len) {
1482                         *pos &= ~wpa_s->extended_capa_mask[i];
1483                         *pos |= wpa_s->extended_capa[i];
1484                 }
1485         }
1486
1487         while (len > 0 && buf[1 + len] == 0) {
1488                 len--;
1489                 buf[1] = len;
1490         }
1491         if (len == 0)
1492                 return 0;
1493
1494         return 2 + len;
1495 }
1496
1497
1498 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1499                           struct wpa_bss *test_bss)
1500 {
1501         struct wpa_bss *bss;
1502
1503         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1504                 if (bss == test_bss)
1505                         return 1;
1506         }
1507
1508         return 0;
1509 }
1510
1511
1512 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1513                            struct wpa_ssid *test_ssid)
1514 {
1515         struct wpa_ssid *ssid;
1516
1517         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1518                 if (ssid == test_ssid)
1519                         return 1;
1520         }
1521
1522         return 0;
1523 }
1524
1525
1526 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1527                         struct wpa_ssid *test_ssid)
1528 {
1529         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1530                 return 0;
1531
1532         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1533 }
1534
1535
1536 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1537 {
1538         if (cwork == NULL)
1539                 return;
1540         os_free(cwork);
1541 }
1542
1543
1544 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1545 {
1546         struct wpa_connect_work *cwork;
1547         struct wpa_radio_work *work = wpa_s->connect_work;
1548
1549         if (!work)
1550                 return;
1551
1552         wpa_s->connect_work = NULL;
1553         cwork = work->ctx;
1554         work->ctx = NULL;
1555         wpas_connect_work_free(cwork);
1556         radio_work_done(work);
1557 }
1558
1559
1560 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1561 {
1562         struct os_reltime now;
1563         u8 addr[ETH_ALEN];
1564
1565         os_get_reltime(&now);
1566         if (wpa_s->last_mac_addr_style == style &&
1567             wpa_s->last_mac_addr_change.sec != 0 &&
1568             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1569                                 wpa_s->conf->rand_addr_lifetime)) {
1570                 wpa_msg(wpa_s, MSG_DEBUG,
1571                         "Previously selected random MAC address has not yet expired");
1572                 return 0;
1573         }
1574
1575         switch (style) {
1576         case 1:
1577                 if (random_mac_addr(addr) < 0)
1578                         return -1;
1579                 break;
1580         case 2:
1581                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1582                 if (random_mac_addr_keep_oui(addr) < 0)
1583                         return -1;
1584                 break;
1585         default:
1586                 return -1;
1587         }
1588
1589         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1590                 wpa_msg(wpa_s, MSG_INFO,
1591                         "Failed to set random MAC address");
1592                 return -1;
1593         }
1594
1595         os_get_reltime(&wpa_s->last_mac_addr_change);
1596         wpa_s->mac_addr_changed = 1;
1597         wpa_s->last_mac_addr_style = style;
1598
1599         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1600                 wpa_msg(wpa_s, MSG_INFO,
1601                         "Could not update MAC address information");
1602                 return -1;
1603         }
1604
1605         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1606                 MAC2STR(addr));
1607
1608         return 0;
1609 }
1610
1611
1612 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1613 {
1614         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1615             !wpa_s->conf->preassoc_mac_addr)
1616                 return 0;
1617
1618         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1619 }
1620
1621
1622 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1623
1624 /**
1625  * wpa_supplicant_associate - Request association
1626  * @wpa_s: Pointer to wpa_supplicant data
1627  * @bss: Scan results for the selected BSS, or %NULL if not available
1628  * @ssid: Configuration data for the selected network
1629  *
1630  * This function is used to request %wpa_supplicant to associate with a BSS.
1631  */
1632 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1633                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1634 {
1635         struct wpa_connect_work *cwork;
1636         int rand_style;
1637
1638         wpa_s->own_disconnect_req = 0;
1639
1640         /*
1641          * If we are starting a new connection, any previously pending EAPOL
1642          * RX cannot be valid anymore.
1643          */
1644         wpabuf_free(wpa_s->pending_eapol_rx);
1645         wpa_s->pending_eapol_rx = NULL;
1646
1647         if (ssid->mac_addr == -1)
1648                 rand_style = wpa_s->conf->mac_addr;
1649         else
1650                 rand_style = ssid->mac_addr;
1651
1652         wmm_ac_clear_saved_tspecs(wpa_s);
1653         wpa_s->reassoc_same_bss = 0;
1654         wpa_s->reassoc_same_ess = 0;
1655
1656         if (wpa_s->last_ssid == ssid) {
1657                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1658                 wpa_s->reassoc_same_ess = 1;
1659                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1660                         wmm_ac_save_tspecs(wpa_s);
1661                         wpa_s->reassoc_same_bss = 1;
1662                 }
1663         } else if (rand_style > 0) {
1664                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1665                         return;
1666                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1667         } else if (wpa_s->mac_addr_changed) {
1668                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1669                         wpa_msg(wpa_s, MSG_INFO,
1670                                 "Could not restore permanent MAC address");
1671                         return;
1672                 }
1673                 wpa_s->mac_addr_changed = 0;
1674                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1675                         wpa_msg(wpa_s, MSG_INFO,
1676                                 "Could not update MAC address information");
1677                         return;
1678                 }
1679                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1680         }
1681         wpa_s->last_ssid = ssid;
1682
1683 #ifdef CONFIG_IBSS_RSN
1684         ibss_rsn_deinit(wpa_s->ibss_rsn);
1685         wpa_s->ibss_rsn = NULL;
1686 #endif /* CONFIG_IBSS_RSN */
1687
1688         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1689             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1690 #ifdef CONFIG_AP
1691                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1692                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1693                                 "mode");
1694                         return;
1695                 }
1696                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1697                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1698                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1699                                 wpas_p2p_ap_setup_failed(wpa_s);
1700                         return;
1701                 }
1702                 wpa_s->current_bss = bss;
1703 #else /* CONFIG_AP */
1704                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1705                         "the build");
1706 #endif /* CONFIG_AP */
1707                 return;
1708         }
1709
1710         if (ssid->mode == WPAS_MODE_MESH) {
1711 #ifdef CONFIG_MESH
1712                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1713                         wpa_msg(wpa_s, MSG_INFO,
1714                                 "Driver does not support mesh mode");
1715                         return;
1716                 }
1717                 if (bss)
1718                         ssid->frequency = bss->freq;
1719                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1720                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1721                         return;
1722                 }
1723                 wpa_s->current_bss = bss;
1724                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1725                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1726                         ssid->id);
1727 #else /* CONFIG_MESH */
1728                 wpa_msg(wpa_s, MSG_ERROR,
1729                         "mesh mode support not included in the build");
1730 #endif /* CONFIG_MESH */
1731                 return;
1732         }
1733
1734 #ifdef CONFIG_TDLS
1735         if (bss)
1736                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1737                                 bss->ie_len);
1738 #endif /* CONFIG_TDLS */
1739
1740         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1741             ssid->mode == IEEE80211_MODE_INFRA) {
1742                 sme_authenticate(wpa_s, bss, ssid);
1743                 return;
1744         }
1745
1746         if (wpa_s->connect_work) {
1747                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1748                 return;
1749         }
1750
1751         if (radio_work_pending(wpa_s, "connect")) {
1752                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1753                 return;
1754         }
1755
1756         wpas_abort_ongoing_scan(wpa_s);
1757
1758         cwork = os_zalloc(sizeof(*cwork));
1759         if (cwork == NULL)
1760                 return;
1761
1762         cwork->bss = bss;
1763         cwork->ssid = ssid;
1764
1765         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1766                            wpas_start_assoc_cb, cwork) < 0) {
1767                 os_free(cwork);
1768         }
1769 }
1770
1771
1772 static int bss_is_ibss(struct wpa_bss *bss)
1773 {
1774         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1775                 IEEE80211_CAP_IBSS;
1776 }
1777
1778
1779 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1780                             const struct wpa_ssid *ssid)
1781 {
1782         enum hostapd_hw_mode hw_mode;
1783         struct hostapd_hw_modes *mode = NULL;
1784         u8 channel;
1785         int i;
1786
1787 #ifdef CONFIG_HT_OVERRIDES
1788         if (ssid->disable_ht)
1789                 return 0;
1790 #endif /* CONFIG_HT_OVERRIDES */
1791
1792         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1793         if (hw_mode == NUM_HOSTAPD_MODES)
1794                 return 0;
1795         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1796                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1797                         mode = &wpa_s->hw.modes[i];
1798                         break;
1799                 }
1800         }
1801
1802         if (!mode)
1803                 return 0;
1804
1805         return mode->vht_capab != 0;
1806 }
1807
1808
1809 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1810                           const struct wpa_ssid *ssid,
1811                           struct hostapd_freq_params *freq)
1812 {
1813         enum hostapd_hw_mode hw_mode;
1814         struct hostapd_hw_modes *mode = NULL;
1815         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1816                            184, 192 };
1817         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1818         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1819         u8 channel;
1820         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1821         unsigned int j, k;
1822         struct hostapd_freq_params vht_freq;
1823         int chwidth, seg0, seg1;
1824         u32 vht_caps = 0;
1825
1826         freq->freq = ssid->frequency;
1827
1828         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1829                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1830
1831                 if (ssid->mode != WPAS_MODE_IBSS)
1832                         break;
1833
1834                 /* Don't adjust control freq in case of fixed_freq */
1835                 if (ssid->fixed_freq)
1836                         break;
1837
1838                 if (!bss_is_ibss(bss))
1839                         continue;
1840
1841                 if (ssid->ssid_len == bss->ssid_len &&
1842                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1843                         wpa_printf(MSG_DEBUG,
1844                                    "IBSS already found in scan results, adjust control freq: %d",
1845                                    bss->freq);
1846                         freq->freq = bss->freq;
1847                         obss_scan = 0;
1848                         break;
1849                 }
1850         }
1851
1852         /* For IBSS check HT_IBSS flag */
1853         if (ssid->mode == WPAS_MODE_IBSS &&
1854             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1855                 return;
1856
1857         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1858             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1859             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1860                 wpa_printf(MSG_DEBUG,
1861                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1862                 return;
1863         }
1864
1865         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1866         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1867                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1868                         mode = &wpa_s->hw.modes[i];
1869                         break;
1870                 }
1871         }
1872
1873         if (!mode)
1874                 return;
1875
1876         freq->ht_enabled = ht_supported(mode);
1877         if (!freq->ht_enabled)
1878                 return;
1879
1880         /* Setup higher BW only for 5 GHz */
1881         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1882                 return;
1883
1884         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1885                 pri_chan = &mode->channels[chan_idx];
1886                 if (pri_chan->chan == channel)
1887                         break;
1888                 pri_chan = NULL;
1889         }
1890         if (!pri_chan)
1891                 return;
1892
1893         /* Check primary channel flags */
1894         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1895                 return;
1896
1897         /* Check/setup HT40+/HT40- */
1898         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1899                 if (ht40plus[j] == channel) {
1900                         ht40 = 1;
1901                         break;
1902                 }
1903         }
1904
1905         /* Find secondary channel */
1906         for (i = 0; i < mode->num_channels; i++) {
1907                 sec_chan = &mode->channels[i];
1908                 if (sec_chan->chan == channel + ht40 * 4)
1909                         break;
1910                 sec_chan = NULL;
1911         }
1912         if (!sec_chan)
1913                 return;
1914
1915         /* Check secondary channel flags */
1916         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1917                 return;
1918
1919         freq->channel = pri_chan->chan;
1920
1921         switch (ht40) {
1922         case -1:
1923                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1924                         return;
1925                 freq->sec_channel_offset = -1;
1926                 break;
1927         case 1:
1928                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1929                         return;
1930                 freq->sec_channel_offset = 1;
1931                 break;
1932         default:
1933                 break;
1934         }
1935
1936         if (freq->sec_channel_offset && obss_scan) {
1937                 struct wpa_scan_results *scan_res;
1938
1939                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1940                 if (scan_res == NULL) {
1941                         /* Back to HT20 */
1942                         freq->sec_channel_offset = 0;
1943                         return;
1944                 }
1945
1946                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1947                                      sec_chan->chan);
1948                 switch (res) {
1949                 case 0:
1950                         /* Back to HT20 */
1951                         freq->sec_channel_offset = 0;
1952                         break;
1953                 case 1:
1954                         /* Configuration allowed */
1955                         break;
1956                 case 2:
1957                         /* Switch pri/sec channels */
1958                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1959                         freq->sec_channel_offset = -freq->sec_channel_offset;
1960                         freq->channel = sec_chan->chan;
1961                         break;
1962                 default:
1963                         freq->sec_channel_offset = 0;
1964                         break;
1965                 }
1966
1967                 wpa_scan_results_free(scan_res);
1968         }
1969
1970         wpa_printf(MSG_DEBUG,
1971                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1972                    freq->channel, freq->sec_channel_offset);
1973
1974         if (!drv_supports_vht(wpa_s, ssid))
1975                 return;
1976
1977         /* For IBSS check VHT_IBSS flag */
1978         if (ssid->mode == WPAS_MODE_IBSS &&
1979             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1980                 return;
1981
1982         vht_freq = *freq;
1983
1984         vht_freq.vht_enabled = vht_supported(mode);
1985         if (!vht_freq.vht_enabled)
1986                 return;
1987
1988         /* setup center_freq1, bandwidth */
1989         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1990                 if (freq->channel >= vht80[j] &&
1991                     freq->channel < vht80[j] + 16)
1992                         break;
1993         }
1994
1995         if (j == ARRAY_SIZE(vht80))
1996                 return;
1997
1998         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1999                 struct hostapd_channel_data *chan;
2000
2001                 chan = hw_get_channel_chan(mode, i, NULL);
2002                 if (!chan)
2003                         return;
2004
2005                 /* Back to HT configuration if channel not usable */
2006                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2007                         return;
2008         }
2009
2010         chwidth = VHT_CHANWIDTH_80MHZ;
2011         seg0 = vht80[j] + 6;
2012         seg1 = 0;
2013
2014         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2015                 /* setup center_freq2, bandwidth */
2016                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2017                         /* Only accept 80 MHz segments separated by a gap */
2018                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2019                                 continue;
2020                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2021                                 struct hostapd_channel_data *chan;
2022
2023                                 chan = hw_get_channel_chan(mode, i, NULL);
2024                                 if (!chan)
2025                                         continue;
2026
2027                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2028                                                   HOSTAPD_CHAN_NO_IR |
2029                                                   HOSTAPD_CHAN_RADAR))
2030                                         continue;
2031
2032                                 /* Found a suitable second segment for 80+80 */
2033                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2034                                 vht_caps |=
2035                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2036                                 seg1 = vht80[k] + 6;
2037                         }
2038
2039                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2040                                 break;
2041                 }
2042         }
2043
2044         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2045                                     freq->channel, freq->ht_enabled,
2046                                     vht_freq.vht_enabled,
2047                                     freq->sec_channel_offset,
2048                                     chwidth, seg0, seg1, vht_caps) != 0)
2049                 return;
2050
2051         *freq = vht_freq;
2052
2053         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2054                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2055 }
2056
2057
2058 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2059 {
2060         struct wpa_connect_work *cwork = work->ctx;
2061         struct wpa_bss *bss = cwork->bss;
2062         struct wpa_ssid *ssid = cwork->ssid;
2063         struct wpa_supplicant *wpa_s = work->wpa_s;
2064         u8 wpa_ie[200];
2065         size_t wpa_ie_len;
2066         int use_crypt, ret, i, bssid_changed;
2067         int algs = WPA_AUTH_ALG_OPEN;
2068         unsigned int cipher_pairwise, cipher_group;
2069         struct wpa_driver_associate_params params;
2070         int wep_keys_set = 0;
2071         int assoc_failed = 0;
2072         struct wpa_ssid *old_ssid;
2073         u8 prev_bssid[ETH_ALEN];
2074 #ifdef CONFIG_HT_OVERRIDES
2075         struct ieee80211_ht_capabilities htcaps;
2076         struct ieee80211_ht_capabilities htcaps_mask;
2077 #endif /* CONFIG_HT_OVERRIDES */
2078 #ifdef CONFIG_VHT_OVERRIDES
2079        struct ieee80211_vht_capabilities vhtcaps;
2080        struct ieee80211_vht_capabilities vhtcaps_mask;
2081 #endif /* CONFIG_VHT_OVERRIDES */
2082 #ifdef CONFIG_MBO
2083         const u8 *mbo = NULL;
2084 #endif /* CONFIG_MBO */
2085
2086         if (deinit) {
2087                 if (work->started) {
2088                         wpa_s->connect_work = NULL;
2089
2090                         /* cancel possible auth. timeout */
2091                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2092                                              NULL);
2093                 }
2094                 wpas_connect_work_free(cwork);
2095                 return;
2096         }
2097
2098         wpa_s->connect_work = work;
2099
2100         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2101             wpas_network_disabled(wpa_s, ssid)) {
2102                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2103                 wpas_connect_work_done(wpa_s);
2104                 return;
2105         }
2106
2107         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2108         os_memset(&params, 0, sizeof(params));
2109         wpa_s->reassociate = 0;
2110         wpa_s->eap_expected_failure = 0;
2111         if (bss &&
2112             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2113 #ifdef CONFIG_IEEE80211R
2114                 const u8 *ie, *md = NULL;
2115 #endif /* CONFIG_IEEE80211R */
2116                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2117                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2118                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2119                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2120                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2121                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2122                 if (bssid_changed)
2123                         wpas_notify_bssid_changed(wpa_s);
2124 #ifdef CONFIG_IEEE80211R
2125                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2126                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2127                         md = ie + 2;
2128                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2129                 if (md) {
2130                         /* Prepare for the next transition */
2131                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2132                 }
2133 #endif /* CONFIG_IEEE80211R */
2134 #ifdef CONFIG_WPS
2135         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2136                    wpa_s->conf->ap_scan == 2 &&
2137                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2138                 /* Use ap_scan==1 style network selection to find the network
2139                  */
2140                 wpas_connect_work_done(wpa_s);
2141                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2142                 wpa_s->reassociate = 1;
2143                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2144                 return;
2145 #endif /* CONFIG_WPS */
2146         } else {
2147                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2148                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2149                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2150         }
2151         if (!wpa_s->pno)
2152                 wpa_supplicant_cancel_sched_scan(wpa_s);
2153
2154         wpa_supplicant_cancel_scan(wpa_s);
2155
2156         /* Starting new association, so clear the possibly used WPA IE from the
2157          * previous association. */
2158         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2159
2160 #ifdef IEEE8021X_EAPOL
2161         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2162                 if (ssid->leap) {
2163                         if (ssid->non_leap == 0)
2164                                 algs = WPA_AUTH_ALG_LEAP;
2165                         else
2166                                 algs |= WPA_AUTH_ALG_LEAP;
2167                 }
2168         }
2169 #endif /* IEEE8021X_EAPOL */
2170         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2171         if (ssid->auth_alg) {
2172                 algs = ssid->auth_alg;
2173                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2174                         "0x%x", algs);
2175         }
2176
2177         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2178                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2179             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2180                 int try_opportunistic;
2181                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2182                                      wpa_s->conf->okc :
2183                                      ssid->proactive_key_caching) &&
2184                         (ssid->proto & WPA_PROTO_RSN);
2185                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2186                                             ssid, try_opportunistic) == 0)
2187                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2188                 wpa_ie_len = sizeof(wpa_ie);
2189                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2190                                               wpa_ie, &wpa_ie_len)) {
2191                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2192                                 "key management and encryption suites");
2193                         wpas_connect_work_done(wpa_s);
2194                         return;
2195                 }
2196         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2197                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2198                 /*
2199                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2200                  * use non-WPA since the scan results did not indicate that the
2201                  * AP is using WPA or WPA2.
2202                  */
2203                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2204                 wpa_ie_len = 0;
2205                 wpa_s->wpa_proto = 0;
2206         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2207                 wpa_ie_len = sizeof(wpa_ie);
2208                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2209                                               wpa_ie, &wpa_ie_len)) {
2210                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2211                                 "key management and encryption suites (no "
2212                                 "scan results)");
2213                         wpas_connect_work_done(wpa_s);
2214                         return;
2215                 }
2216 #ifdef CONFIG_WPS
2217         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2218                 struct wpabuf *wps_ie;
2219                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2220                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2221                         wpa_ie_len = wpabuf_len(wps_ie);
2222                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2223                 } else
2224                         wpa_ie_len = 0;
2225                 wpabuf_free(wps_ie);
2226                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2227                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2228                         params.wps = WPS_MODE_PRIVACY;
2229                 else
2230                         params.wps = WPS_MODE_OPEN;
2231                 wpa_s->wpa_proto = 0;
2232 #endif /* CONFIG_WPS */
2233         } else {
2234                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2235                 wpa_ie_len = 0;
2236                 wpa_s->wpa_proto = 0;
2237         }
2238
2239 #ifdef CONFIG_P2P
2240         if (wpa_s->global->p2p) {
2241                 u8 *pos;
2242                 size_t len;
2243                 int res;
2244                 pos = wpa_ie + wpa_ie_len;
2245                 len = sizeof(wpa_ie) - wpa_ie_len;
2246                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2247                                             ssid->p2p_group);
2248                 if (res >= 0)
2249                         wpa_ie_len += res;
2250         }
2251
2252         wpa_s->cross_connect_disallowed = 0;
2253         if (bss) {
2254                 struct wpabuf *p2p;
2255                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2256                 if (p2p) {
2257                         wpa_s->cross_connect_disallowed =
2258                                 p2p_get_cross_connect_disallowed(p2p);
2259                         wpabuf_free(p2p);
2260                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2261                                 "connection",
2262                                 wpa_s->cross_connect_disallowed ?
2263                                 "disallows" : "allows");
2264                 }
2265         }
2266
2267         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2268 #endif /* CONFIG_P2P */
2269
2270 #ifdef CONFIG_MBO
2271         if (bss) {
2272                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2273                 if (mbo) {
2274                         int len;
2275
2276                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2277                                                         wpa_ie + wpa_ie_len,
2278                                                         sizeof(wpa_ie) -
2279                                                         wpa_ie_len);
2280                         if (len > 0)
2281                                 wpa_ie_len += len;
2282                 }
2283         }
2284 #endif /* CONFIG_MBO */
2285
2286         /*
2287          * Workaround: Add Extended Capabilities element only if the AP
2288          * included this element in Beacon/Probe Response frames. Some older
2289          * APs seem to have interoperability issues if this element is
2290          * included, so while the standard may require us to include the
2291          * element in all cases, it is justifiable to skip it to avoid
2292          * interoperability issues.
2293          */
2294         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2295                 u8 ext_capab[18];
2296                 int ext_capab_len;
2297                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2298                                                      sizeof(ext_capab));
2299                 if (ext_capab_len > 0) {
2300                         u8 *pos = wpa_ie;
2301                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2302                                 pos += 2 + pos[1];
2303                         os_memmove(pos + ext_capab_len, pos,
2304                                    wpa_ie_len - (pos - wpa_ie));
2305                         wpa_ie_len += ext_capab_len;
2306                         os_memcpy(pos, ext_capab, ext_capab_len);
2307                 }
2308         }
2309
2310 #ifdef CONFIG_HS20
2311         if (is_hs20_network(wpa_s, ssid, bss)) {
2312                 struct wpabuf *hs20;
2313
2314                 hs20 = wpabuf_alloc(20);
2315                 if (hs20) {
2316                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2317                         size_t len;
2318
2319                         wpas_hs20_add_indication(hs20, pps_mo_id);
2320                         len = sizeof(wpa_ie) - wpa_ie_len;
2321                         if (wpabuf_len(hs20) <= len) {
2322                                 os_memcpy(wpa_ie + wpa_ie_len,
2323                                           wpabuf_head(hs20), wpabuf_len(hs20));
2324                                 wpa_ie_len += wpabuf_len(hs20);
2325                         }
2326                         wpabuf_free(hs20);
2327
2328                         hs20_configure_frame_filters(wpa_s);
2329                 }
2330         }
2331 #endif /* CONFIG_HS20 */
2332
2333         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2334                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2335                 size_t len;
2336
2337                 len = sizeof(wpa_ie) - wpa_ie_len;
2338                 if (wpabuf_len(buf) <= len) {
2339                         os_memcpy(wpa_ie + wpa_ie_len,
2340                                   wpabuf_head(buf), wpabuf_len(buf));
2341                         wpa_ie_len += wpabuf_len(buf);
2342                 }
2343         }
2344
2345 #ifdef CONFIG_FST
2346         if (wpa_s->fst_ies) {
2347                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2348
2349                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2350                         os_memcpy(wpa_ie + wpa_ie_len,
2351                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2352                         wpa_ie_len += fst_ies_len;
2353                 }
2354         }
2355 #endif /* CONFIG_FST */
2356
2357 #ifdef CONFIG_MBO
2358         if (mbo) {
2359                 int len;
2360
2361                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2362                                   sizeof(wpa_ie) - wpa_ie_len);
2363                 if (len >= 0)
2364                         wpa_ie_len += len;
2365         }
2366 #endif /* CONFIG_MBO */
2367
2368         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2369         use_crypt = 1;
2370         cipher_pairwise = wpa_s->pairwise_cipher;
2371         cipher_group = wpa_s->group_cipher;
2372         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2373             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2374                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2375                         use_crypt = 0;
2376                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2377                         use_crypt = 1;
2378                         wep_keys_set = 1;
2379                 }
2380         }
2381         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2382                 use_crypt = 0;
2383
2384 #ifdef IEEE8021X_EAPOL
2385         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2386                 if ((ssid->eapol_flags &
2387                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2388                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2389                     !wep_keys_set) {
2390                         use_crypt = 0;
2391                 } else {
2392                         /* Assume that dynamic WEP-104 keys will be used and
2393                          * set cipher suites in order for drivers to expect
2394                          * encryption. */
2395                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2396                 }
2397         }
2398 #endif /* IEEE8021X_EAPOL */
2399
2400         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2401                 /* Set the key before (and later after) association */
2402                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2403         }
2404
2405         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2406         if (bss) {
2407                 params.ssid = bss->ssid;
2408                 params.ssid_len = bss->ssid_len;
2409                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2410                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2411                                    MACSTR " freq=%u MHz based on scan results "
2412                                    "(bssid_set=%d)",
2413                                    MAC2STR(bss->bssid), bss->freq,
2414                                    ssid->bssid_set);
2415                         params.bssid = bss->bssid;
2416                         params.freq.freq = bss->freq;
2417                 }
2418                 params.bssid_hint = bss->bssid;
2419                 params.freq_hint = bss->freq;
2420                 params.pbss = bss_is_pbss(bss);
2421         } else {
2422                 params.ssid = ssid->ssid;
2423                 params.ssid_len = ssid->ssid_len;
2424                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2425         }
2426
2427         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2428             wpa_s->conf->ap_scan == 2) {
2429                 params.bssid = ssid->bssid;
2430                 params.fixed_bssid = 1;
2431         }
2432
2433         /* Initial frequency for IBSS/mesh */
2434         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2435             ssid->frequency > 0 && params.freq.freq == 0)
2436                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2437
2438         if (ssid->mode == WPAS_MODE_IBSS) {
2439                 params.fixed_freq = ssid->fixed_freq;
2440                 if (ssid->beacon_int)
2441                         params.beacon_int = ssid->beacon_int;
2442                 else
2443                         params.beacon_int = wpa_s->conf->beacon_int;
2444         }
2445
2446         params.wpa_ie = wpa_ie;
2447         params.wpa_ie_len = wpa_ie_len;
2448         params.pairwise_suite = cipher_pairwise;
2449         params.group_suite = cipher_group;
2450         params.key_mgmt_suite = wpa_s->key_mgmt;
2451         params.wpa_proto = wpa_s->wpa_proto;
2452         params.auth_alg = algs;
2453         params.mode = ssid->mode;
2454         params.bg_scan_period = ssid->bg_scan_period;
2455         for (i = 0; i < NUM_WEP_KEYS; i++) {
2456                 if (ssid->wep_key_len[i])
2457                         params.wep_key[i] = ssid->wep_key[i];
2458                 params.wep_key_len[i] = ssid->wep_key_len[i];
2459         }
2460         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2461
2462         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2463             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2464              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2465                 params.passphrase = ssid->passphrase;
2466                 if (ssid->psk_set)
2467                         params.psk = ssid->psk;
2468         }
2469
2470         if (wpa_s->conf->key_mgmt_offload) {
2471                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2472                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2473                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2474                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2475                         params.req_key_mgmt_offload =
2476                                 ssid->proactive_key_caching < 0 ?
2477                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2478                 else
2479                         params.req_key_mgmt_offload = 1;
2480
2481                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2482                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2483                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2484                     ssid->psk_set)
2485                         params.psk = ssid->psk;
2486         }
2487
2488         params.drop_unencrypted = use_crypt;
2489
2490 #ifdef CONFIG_IEEE80211W
2491         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2492         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2493                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2494                 struct wpa_ie_data ie;
2495                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2496                     ie.capabilities &
2497                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2498                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2499                                 "MFP: require MFP");
2500                         params.mgmt_frame_protection =
2501                                 MGMT_FRAME_PROTECTION_REQUIRED;
2502                 }
2503         }
2504 #endif /* CONFIG_IEEE80211W */
2505
2506         params.p2p = ssid->p2p_group;
2507
2508         if (wpa_s->p2pdev->set_sta_uapsd)
2509                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2510         else
2511                 params.uapsd = -1;
2512
2513 #ifdef CONFIG_HT_OVERRIDES
2514         os_memset(&htcaps, 0, sizeof(htcaps));
2515         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2516         params.htcaps = (u8 *) &htcaps;
2517         params.htcaps_mask = (u8 *) &htcaps_mask;
2518         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2519 #endif /* CONFIG_HT_OVERRIDES */
2520 #ifdef CONFIG_VHT_OVERRIDES
2521         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2522         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2523         params.vhtcaps = &vhtcaps;
2524         params.vhtcaps_mask = &vhtcaps_mask;
2525         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2526 #endif /* CONFIG_VHT_OVERRIDES */
2527
2528 #ifdef CONFIG_P2P
2529         /*
2530          * If multi-channel concurrency is not supported, check for any
2531          * frequency conflict. In case of any frequency conflict, remove the
2532          * least prioritized connection.
2533          */
2534         if (wpa_s->num_multichan_concurrent < 2) {
2535                 int freq, num;
2536                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2537                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2538                         wpa_printf(MSG_DEBUG,
2539                                    "Assoc conflicting freq found (%d != %d)",
2540                                    freq, params.freq.freq);
2541                         if (wpas_p2p_handle_frequency_conflicts(
2542                                     wpa_s, params.freq.freq, ssid) < 0) {
2543                                 wpas_connect_work_done(wpa_s);
2544                                 return;
2545                         }
2546                 }
2547         }
2548 #endif /* CONFIG_P2P */
2549
2550         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2551             wpa_s->current_ssid)
2552                 params.prev_bssid = prev_bssid;
2553
2554         ret = wpa_drv_associate(wpa_s, &params);
2555         if (ret < 0) {
2556                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2557                         "failed");
2558                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2559                         /*
2560                          * The driver is known to mean what is saying, so we
2561                          * can stop right here; the association will not
2562                          * succeed.
2563                          */
2564                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2565                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2566                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2567                         return;
2568                 }
2569                 /* try to continue anyway; new association will be tried again
2570                  * after timeout */
2571                 assoc_failed = 1;
2572         }
2573
2574         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2575                 /* Set the key after the association just in case association
2576                  * cleared the previously configured key. */
2577                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2578                 /* No need to timeout authentication since there is no key
2579                  * management. */
2580                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2581                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2582 #ifdef CONFIG_IBSS_RSN
2583         } else if (ssid->mode == WPAS_MODE_IBSS &&
2584                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2585                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2586                 /*
2587                  * RSN IBSS authentication is per-STA and we can disable the
2588                  * per-BSSID authentication.
2589                  */
2590                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2591 #endif /* CONFIG_IBSS_RSN */
2592         } else {
2593                 /* Timeout for IEEE 802.11 authentication and association */
2594                 int timeout = 60;
2595
2596                 if (assoc_failed) {
2597                         /* give IBSS a bit more time */
2598                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2599                 } else if (wpa_s->conf->ap_scan == 1) {
2600                         /* give IBSS a bit more time */
2601                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2602                 }
2603                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2604         }
2605
2606         if (wep_keys_set &&
2607             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2608                 /* Set static WEP keys again */
2609                 wpa_set_wep_keys(wpa_s, ssid);
2610         }
2611
2612         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2613                 /*
2614                  * Do not allow EAP session resumption between different
2615                  * network configurations.
2616                  */
2617                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2618         }
2619         old_ssid = wpa_s->current_ssid;
2620         wpa_s->current_ssid = ssid;
2621
2622         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2623                 wpa_s->current_bss = bss;
2624 #ifdef CONFIG_HS20
2625                 hs20_configure_frame_filters(wpa_s);
2626 #endif /* CONFIG_HS20 */
2627         }
2628
2629         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2630         wpa_supplicant_initiate_eapol(wpa_s);
2631         if (old_ssid != wpa_s->current_ssid)
2632                 wpas_notify_network_changed(wpa_s);
2633 }
2634
2635
2636 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2637                                             const u8 *addr)
2638 {
2639         struct wpa_ssid *old_ssid;
2640
2641         wpas_connect_work_done(wpa_s);
2642         wpa_clear_keys(wpa_s, addr);
2643         old_ssid = wpa_s->current_ssid;
2644         wpa_supplicant_mark_disassoc(wpa_s);
2645         wpa_sm_set_config(wpa_s->wpa, NULL);
2646         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2647         if (old_ssid != wpa_s->current_ssid)
2648                 wpas_notify_network_changed(wpa_s);
2649         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2650 }
2651
2652
2653 /**
2654  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2655  * @wpa_s: Pointer to wpa_supplicant data
2656  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2657  *
2658  * This function is used to request %wpa_supplicant to deauthenticate from the
2659  * current AP.
2660  */
2661 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2662                                    int reason_code)
2663 {
2664         u8 *addr = NULL;
2665         union wpa_event_data event;
2666         int zero_addr = 0;
2667
2668         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2669                 " pending_bssid=" MACSTR " reason=%d state=%s",
2670                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2671                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2672
2673         if (!is_zero_ether_addr(wpa_s->bssid))
2674                 addr = wpa_s->bssid;
2675         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2676                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2677                   wpa_s->wpa_state == WPA_ASSOCIATING))
2678                 addr = wpa_s->pending_bssid;
2679         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2680                 /*
2681                  * When using driver-based BSS selection, we may not know the
2682                  * BSSID with which we are currently trying to associate. We
2683                  * need to notify the driver of this disconnection even in such
2684                  * a case, so use the all zeros address here.
2685                  */
2686                 addr = wpa_s->bssid;
2687                 zero_addr = 1;
2688         }
2689
2690 #ifdef CONFIG_TDLS
2691         wpa_tdls_teardown_peers(wpa_s->wpa);
2692 #endif /* CONFIG_TDLS */
2693
2694 #ifdef CONFIG_MESH
2695         if (wpa_s->ifmsh) {
2696                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2697                         wpa_s->ifname);
2698                 wpa_supplicant_leave_mesh(wpa_s);
2699         }
2700 #endif /* CONFIG_MESH */
2701
2702         if (addr) {
2703                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2704                 os_memset(&event, 0, sizeof(event));
2705                 event.deauth_info.reason_code = (u16) reason_code;
2706                 event.deauth_info.locally_generated = 1;
2707                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2708                 if (zero_addr)
2709                         addr = NULL;
2710         }
2711
2712         wpa_supplicant_clear_connection(wpa_s, addr);
2713 }
2714
2715 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2716                                               struct wpa_ssid *ssid)
2717 {
2718         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2719                 return;
2720
2721         ssid->disabled = 0;
2722         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2723         wpas_notify_network_enabled_changed(wpa_s, ssid);
2724
2725         /*
2726          * Try to reassociate since there is no current configuration and a new
2727          * network was made available.
2728          */
2729         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2730                 wpa_s->reassociate = 1;
2731 }
2732
2733
2734 /**
2735  * wpa_supplicant_enable_network - Mark a configured network as enabled
2736  * @wpa_s: wpa_supplicant structure for a network interface
2737  * @ssid: wpa_ssid structure for a configured network or %NULL
2738  *
2739  * Enables the specified network or all networks if no network specified.
2740  */
2741 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2742                                    struct wpa_ssid *ssid)
2743 {
2744         if (ssid == NULL) {
2745                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2746                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2747         } else
2748                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2749
2750         if (wpa_s->reassociate && !wpa_s->disconnected &&
2751             (!wpa_s->current_ssid ||
2752              wpa_s->wpa_state == WPA_DISCONNECTED ||
2753              wpa_s->wpa_state == WPA_SCANNING)) {
2754                 if (wpa_s->sched_scanning) {
2755                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2756                                    "new network to scan filters");
2757                         wpa_supplicant_cancel_sched_scan(wpa_s);
2758                 }
2759
2760                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2761                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2762                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2763                 }
2764         }
2765 }
2766
2767
2768 /**
2769  * wpa_supplicant_disable_network - Mark a configured network as disabled
2770  * @wpa_s: wpa_supplicant structure for a network interface
2771  * @ssid: wpa_ssid structure for a configured network or %NULL
2772  *
2773  * Disables the specified network or all networks if no network specified.
2774  */
2775 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2776                                     struct wpa_ssid *ssid)
2777 {
2778         struct wpa_ssid *other_ssid;
2779         int was_disabled;
2780
2781         if (ssid == NULL) {
2782                 if (wpa_s->sched_scanning)
2783                         wpa_supplicant_cancel_sched_scan(wpa_s);
2784
2785                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2786                      other_ssid = other_ssid->next) {
2787                         was_disabled = other_ssid->disabled;
2788                         if (was_disabled == 2)
2789                                 continue; /* do not change persistent P2P group
2790                                            * data */
2791
2792                         other_ssid->disabled = 1;
2793
2794                         if (was_disabled != other_ssid->disabled)
2795                                 wpas_notify_network_enabled_changed(
2796                                         wpa_s, other_ssid);
2797                 }
2798                 if (wpa_s->current_ssid)
2799                         wpa_supplicant_deauthenticate(
2800                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2801         } else if (ssid->disabled != 2) {
2802                 if (ssid == wpa_s->current_ssid)
2803                         wpa_supplicant_deauthenticate(
2804                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2805
2806                 was_disabled = ssid->disabled;
2807
2808                 ssid->disabled = 1;
2809
2810                 if (was_disabled != ssid->disabled) {
2811                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2812                         if (wpa_s->sched_scanning) {
2813                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2814                                            "to remove network from filters");
2815                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2816                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2817                         }
2818                 }
2819         }
2820 }
2821
2822
2823 /**
2824  * wpa_supplicant_select_network - Attempt association with a network
2825  * @wpa_s: wpa_supplicant structure for a network interface
2826  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2827  */
2828 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2829                                    struct wpa_ssid *ssid)
2830 {
2831
2832         struct wpa_ssid *other_ssid;
2833         int disconnected = 0;
2834
2835         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2836                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2837                         wpa_s->own_disconnect_req = 1;
2838                 wpa_supplicant_deauthenticate(
2839                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2840                 disconnected = 1;
2841         }
2842
2843         if (ssid)
2844                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2845
2846         /*
2847          * Mark all other networks disabled or mark all networks enabled if no
2848          * network specified.
2849          */
2850         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2851              other_ssid = other_ssid->next) {
2852                 int was_disabled = other_ssid->disabled;
2853                 if (was_disabled == 2)
2854                         continue; /* do not change persistent P2P group data */
2855
2856                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2857                 if (was_disabled && !other_ssid->disabled)
2858                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2859
2860                 if (was_disabled != other_ssid->disabled)
2861                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2862         }
2863
2864         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2865             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2866                 /* We are already associated with the selected network */
2867                 wpa_printf(MSG_DEBUG, "Already associated with the "
2868                            "selected network - do nothing");
2869                 return;
2870         }
2871
2872         if (ssid) {
2873                 wpa_s->current_ssid = ssid;
2874                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2875                 wpa_s->connect_without_scan =
2876                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2877
2878                 /*
2879                  * Don't optimize next scan freqs since a new ESS has been
2880                  * selected.
2881                  */
2882                 os_free(wpa_s->next_scan_freqs);
2883                 wpa_s->next_scan_freqs = NULL;
2884         } else {
2885                 wpa_s->connect_without_scan = NULL;
2886         }
2887
2888         wpa_s->disconnected = 0;
2889         wpa_s->reassociate = 1;
2890
2891         if (wpa_s->connect_without_scan ||
2892             wpa_supplicant_fast_associate(wpa_s) != 1) {
2893                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2894                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2895         }
2896
2897         if (ssid)
2898                 wpas_notify_network_selected(wpa_s, ssid);
2899 }
2900
2901
2902 /**
2903  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2904  * @wpa_s: wpa_supplicant structure for a network interface
2905  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2906  * @pkcs11_module_path: PKCS #11 module path or NULL
2907  * Returns: 0 on success; -1 on failure
2908  *
2909  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2910  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2911  * module path fails the paths will be reset to the default value (NULL).
2912  */
2913 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2914                                            const char *pkcs11_engine_path,
2915                                            const char *pkcs11_module_path)
2916 {
2917         char *pkcs11_engine_path_copy = NULL;
2918         char *pkcs11_module_path_copy = NULL;
2919
2920         if (pkcs11_engine_path != NULL) {
2921                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2922                 if (pkcs11_engine_path_copy == NULL)
2923                         return -1;
2924         }
2925         if (pkcs11_module_path != NULL) {
2926                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2927                 if (pkcs11_module_path_copy == NULL) {
2928                         os_free(pkcs11_engine_path_copy);
2929                         return -1;
2930                 }
2931         }
2932
2933         os_free(wpa_s->conf->pkcs11_engine_path);
2934         os_free(wpa_s->conf->pkcs11_module_path);
2935         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2936         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2937
2938         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2939         eapol_sm_deinit(wpa_s->eapol);
2940         wpa_s->eapol = NULL;
2941         if (wpa_supplicant_init_eapol(wpa_s)) {
2942                 /* Error -> Reset paths to the default value (NULL) once. */
2943                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2944                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2945                                                                NULL);
2946
2947                 return -1;
2948         }
2949         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2950
2951         return 0;
2952 }
2953
2954
2955 /**
2956  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2957  * @wpa_s: wpa_supplicant structure for a network interface
2958  * @ap_scan: AP scan mode
2959  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2960  *
2961  */
2962 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2963 {
2964
2965         int old_ap_scan;
2966
2967         if (ap_scan < 0 || ap_scan > 2)
2968                 return -1;
2969
2970         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2971                 wpa_printf(MSG_INFO,
2972                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2973         }
2974
2975 #ifdef ANDROID
2976         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2977             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2978             wpa_s->wpa_state < WPA_COMPLETED) {
2979                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2980                            "associating", wpa_s->conf->ap_scan, ap_scan);
2981                 return 0;
2982         }
2983 #endif /* ANDROID */
2984
2985         old_ap_scan = wpa_s->conf->ap_scan;
2986         wpa_s->conf->ap_scan = ap_scan;
2987
2988         if (old_ap_scan != wpa_s->conf->ap_scan)
2989                 wpas_notify_ap_scan_changed(wpa_s);
2990
2991         return 0;
2992 }
2993
2994
2995 /**
2996  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2997  * @wpa_s: wpa_supplicant structure for a network interface
2998  * @expire_age: Expiration age in seconds
2999  * Returns: 0 if succeed or -1 if expire_age has an invalid value
3000  *
3001  */
3002 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3003                                           unsigned int bss_expire_age)
3004 {
3005         if (bss_expire_age < 10) {
3006                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3007                         bss_expire_age);
3008                 return -1;
3009         }
3010         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3011                 bss_expire_age);
3012         wpa_s->conf->bss_expiration_age = bss_expire_age;
3013
3014         return 0;
3015 }
3016
3017
3018 /**
3019  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3020  * @wpa_s: wpa_supplicant structure for a network interface
3021  * @expire_count: number of scans after which an unseen BSS is reclaimed
3022  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3023  *
3024  */
3025 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3026                                             unsigned int bss_expire_count)
3027 {
3028         if (bss_expire_count < 1) {
3029                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3030                         bss_expire_count);
3031                 return -1;
3032         }
3033         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3034                 bss_expire_count);
3035         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3036
3037         return 0;
3038 }
3039
3040
3041 /**
3042  * wpa_supplicant_set_scan_interval - Set scan interval
3043  * @wpa_s: wpa_supplicant structure for a network interface
3044  * @scan_interval: scan interval in seconds
3045  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3046  *
3047  */
3048 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3049                                      int scan_interval)
3050 {
3051         if (scan_interval < 0) {
3052                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3053                         scan_interval);
3054                 return -1;
3055         }
3056         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3057                 scan_interval);
3058         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3059
3060         return 0;
3061 }
3062
3063
3064 /**
3065  * wpa_supplicant_set_debug_params - Set global debug params
3066  * @global: wpa_global structure
3067  * @debug_level: debug level
3068  * @debug_timestamp: determines if show timestamp in debug data
3069  * @debug_show_keys: determines if show keys in debug data
3070  * Returns: 0 if succeed or -1 if debug_level has wrong value
3071  */
3072 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3073                                     int debug_timestamp, int debug_show_keys)
3074 {
3075
3076         int old_level, old_timestamp, old_show_keys;
3077
3078         /* check for allowed debuglevels */
3079         if (debug_level != MSG_EXCESSIVE &&
3080             debug_level != MSG_MSGDUMP &&
3081             debug_level != MSG_DEBUG &&
3082             debug_level != MSG_INFO &&
3083             debug_level != MSG_WARNING &&
3084             debug_level != MSG_ERROR)
3085                 return -1;
3086
3087         old_level = wpa_debug_level;
3088         old_timestamp = wpa_debug_timestamp;
3089         old_show_keys = wpa_debug_show_keys;
3090
3091         wpa_debug_level = debug_level;
3092         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3093         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3094
3095         if (wpa_debug_level != old_level)
3096                 wpas_notify_debug_level_changed(global);
3097         if (wpa_debug_timestamp != old_timestamp)
3098                 wpas_notify_debug_timestamp_changed(global);
3099         if (wpa_debug_show_keys != old_show_keys)
3100                 wpas_notify_debug_show_keys_changed(global);
3101
3102         return 0;
3103 }
3104
3105
3106 /**
3107  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3108  * @wpa_s: Pointer to wpa_supplicant data
3109  * Returns: A pointer to the current network structure or %NULL on failure
3110  */
3111 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3112 {
3113         struct wpa_ssid *entry;
3114         u8 ssid[SSID_MAX_LEN];
3115         int res;
3116         size_t ssid_len;
3117         u8 bssid[ETH_ALEN];
3118         int wired;
3119
3120         res = wpa_drv_get_ssid(wpa_s, ssid);
3121         if (res < 0) {
3122                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3123                         "driver");
3124                 return NULL;
3125         }
3126         ssid_len = res;
3127
3128         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3129                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3130                         "driver");
3131                 return NULL;
3132         }
3133
3134         wired = wpa_s->conf->ap_scan == 0 &&
3135                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3136
3137         entry = wpa_s->conf->ssid;
3138         while (entry) {
3139                 if (!wpas_network_disabled(wpa_s, entry) &&
3140                     ((ssid_len == entry->ssid_len &&
3141                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3142                     (!entry->bssid_set ||
3143                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3144                         return entry;
3145 #ifdef CONFIG_WPS
3146                 if (!wpas_network_disabled(wpa_s, entry) &&
3147                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3148                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3149                     (!entry->bssid_set ||
3150                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3151                         return entry;
3152 #endif /* CONFIG_WPS */
3153
3154                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3155                     entry->ssid_len == 0 &&
3156                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3157                         return entry;
3158
3159                 entry = entry->next;
3160         }
3161
3162         return NULL;
3163 }
3164
3165
3166 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3167 {
3168         struct wpa_global *global = wpa_s->global;
3169
3170         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3171                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3172                 if (global->drv_priv[i] == NULL) {
3173                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3174                                    "'%s'", wpa_drivers[i]->name);
3175                         return -1;
3176                 }
3177         }
3178
3179         wpa_s->driver = wpa_drivers[i];
3180         wpa_s->global_drv_priv = global->drv_priv[i];
3181
3182         return 0;
3183 }
3184
3185
3186 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3187                                      const char *name)
3188 {
3189         int i;
3190         size_t len;
3191         const char *pos, *driver = name;
3192
3193         if (wpa_s == NULL)
3194                 return -1;
3195
3196         if (wpa_drivers[0] == NULL) {
3197                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3198                         "wpa_supplicant");
3199                 return -1;
3200         }
3201
3202         if (name == NULL) {
3203                 /* default to first driver in the list */
3204                 return select_driver(wpa_s, 0);
3205         }
3206
3207         do {
3208                 pos = os_strchr(driver, ',');
3209                 if (pos)
3210                         len = pos - driver;
3211                 else
3212                         len = os_strlen(driver);
3213
3214                 for (i = 0; wpa_drivers[i]; i++) {
3215                         if (os_strlen(wpa_drivers[i]->name) == len &&
3216                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3217                             0) {
3218                                 /* First driver that succeeds wins */
3219                                 if (select_driver(wpa_s, i) == 0)
3220                                         return 0;
3221                         }
3222                 }
3223
3224                 driver = pos + 1;
3225         } while (pos);
3226
3227         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3228         return -1;
3229 }
3230
3231
3232 /**
3233  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3234  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3235  *      with struct wpa_driver_ops::init()
3236  * @src_addr: Source address of the EAPOL frame
3237  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3238  * @len: Length of the EAPOL data
3239  *
3240  * This function is called for each received EAPOL frame. Most driver
3241  * interfaces rely on more generic OS mechanism for receiving frames through
3242  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3243  * take care of received EAPOL frames and deliver them to the core supplicant
3244  * code by calling this function.
3245  */
3246 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3247                              const u8 *buf, size_t len)
3248 {
3249         struct wpa_supplicant *wpa_s = ctx;
3250
3251         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3252         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3253
3254 #ifdef CONFIG_PEERKEY
3255         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3256             wpa_s->current_ssid->peerkey &&
3257             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3258             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3259                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3260                 return;
3261         }
3262 #endif /* CONFIG_PEERKEY */
3263
3264         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3265             (wpa_s->last_eapol_matches_bssid &&
3266 #ifdef CONFIG_AP
3267              !wpa_s->ap_iface &&
3268 #endif /* CONFIG_AP */
3269              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3270                 /*
3271                  * There is possible race condition between receiving the
3272                  * association event and the EAPOL frame since they are coming
3273                  * through different paths from the driver. In order to avoid
3274                  * issues in trying to process the EAPOL frame before receiving
3275                  * association information, lets queue it for processing until
3276                  * the association event is received. This may also be needed in
3277                  * driver-based roaming case, so also use src_addr != BSSID as a
3278                  * trigger if we have previously confirmed that the
3279                  * Authenticator uses BSSID as the src_addr (which is not the
3280                  * case with wired IEEE 802.1X).
3281                  */
3282                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3283                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3284                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3285                         MAC2STR(wpa_s->bssid));
3286                 wpabuf_free(wpa_s->pending_eapol_rx);
3287                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3288                 if (wpa_s->pending_eapol_rx) {
3289                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3290                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3291                                   ETH_ALEN);
3292                 }
3293                 return;
3294         }
3295
3296         wpa_s->last_eapol_matches_bssid =
3297                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3298
3299 #ifdef CONFIG_AP
3300         if (wpa_s->ap_iface) {
3301                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3302                 return;
3303         }
3304 #endif /* CONFIG_AP */
3305
3306         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3307                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3308                         "no key management is configured");
3309                 return;
3310         }
3311
3312         if (wpa_s->eapol_received == 0 &&
3313             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3314              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3315              wpa_s->wpa_state != WPA_COMPLETED) &&
3316             (wpa_s->current_ssid == NULL ||
3317              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3318                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3319                 int timeout = 10;
3320
3321                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3322                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3323                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3324                         /* Use longer timeout for IEEE 802.1X/EAP */
3325                         timeout = 70;
3326                 }
3327
3328 #ifdef CONFIG_WPS
3329                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3330                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3331                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3332                         /*
3333                          * Use shorter timeout if going through WPS AP iteration
3334                          * for PIN config method with an AP that does not
3335                          * advertise Selected Registrar.
3336                          */
3337                         struct wpabuf *wps_ie;
3338
3339                         wps_ie = wpa_bss_get_vendor_ie_multi(
3340                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3341                         if (wps_ie &&
3342                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3343                                 timeout = 10;
3344                         wpabuf_free(wps_ie);
3345                 }
3346 #endif /* CONFIG_WPS */
3347
3348                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3349         }
3350         wpa_s->eapol_received++;
3351
3352         if (wpa_s->countermeasures) {
3353                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3354                         "EAPOL packet");
3355                 return;
3356         }
3357
3358 #ifdef CONFIG_IBSS_RSN
3359         if (wpa_s->current_ssid &&
3360             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3361                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3362                 return;
3363         }
3364 #endif /* CONFIG_IBSS_RSN */
3365
3366         /* Source address of the incoming EAPOL frame could be compared to the
3367          * current BSSID. However, it is possible that a centralized
3368          * Authenticator could be using another MAC address than the BSSID of
3369          * an AP, so just allow any address to be used for now. The replies are
3370          * still sent to the current BSSID (if available), though. */
3371
3372         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3373         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3374             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3375                 return;
3376         wpa_drv_poll(wpa_s);
3377         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3378                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3379         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3380                 /*
3381                  * Set portValid = TRUE here since we are going to skip 4-way
3382                  * handshake processing which would normally set portValid. We
3383                  * need this to allow the EAPOL state machines to be completed
3384                  * without going through EAPOL-Key handshake.
3385                  */
3386                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3387         }
3388 }
3389
3390
3391 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3392 {
3393         if ((!wpa_s->p2p_mgmt ||
3394              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3395             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3396                 l2_packet_deinit(wpa_s->l2);
3397                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3398                                            wpa_drv_get_mac_addr(wpa_s),
3399                                            ETH_P_EAPOL,
3400                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3401                 if (wpa_s->l2 == NULL)
3402                         return -1;
3403         } else {
3404                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3405                 if (addr)
3406                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3407         }
3408
3409         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3410                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3411                 return -1;
3412         }
3413
3414         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3415
3416         return 0;
3417 }
3418
3419
3420 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3421                                            const u8 *buf, size_t len)
3422 {
3423         struct wpa_supplicant *wpa_s = ctx;
3424         const struct l2_ethhdr *eth;
3425
3426         if (len < sizeof(*eth))
3427                 return;
3428         eth = (const struct l2_ethhdr *) buf;
3429
3430         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3431             !(eth->h_dest[0] & 0x01)) {
3432                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3433                         " (bridge - not for this interface - ignore)",
3434                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3435                 return;
3436         }
3437
3438         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3439                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3440         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3441                                 len - sizeof(*eth));
3442 }
3443
3444
3445 /**
3446  * wpa_supplicant_driver_init - Initialize driver interface parameters
3447  * @wpa_s: Pointer to wpa_supplicant data
3448  * Returns: 0 on success, -1 on failure
3449  *
3450  * This function is called to initialize driver interface parameters.
3451  * wpa_drv_init() must have been called before this function to initialize the
3452  * driver interface.
3453  */
3454 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3455 {
3456         static int interface_count = 0;
3457
3458         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3459                 return -1;
3460
3461         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3462                 MAC2STR(wpa_s->own_addr));
3463         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3464         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3465
3466         if (wpa_s->bridge_ifname[0]) {
3467                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3468                         "interface '%s'", wpa_s->bridge_ifname);
3469                 wpa_s->l2_br = l2_packet_init_bridge(
3470                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3471                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3472                 if (wpa_s->l2_br == NULL) {
3473                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3474                                 "connection for the bridge interface '%s'",
3475                                 wpa_s->bridge_ifname);
3476                         return -1;
3477                 }
3478         }
3479
3480         if (wpa_s->conf->ap_scan == 2 &&
3481             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3482                 wpa_printf(MSG_INFO,
3483                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3484         }
3485
3486         wpa_clear_keys(wpa_s, NULL);
3487
3488         /* Make sure that TKIP countermeasures are not left enabled (could
3489          * happen if wpa_supplicant is killed during countermeasures. */
3490         wpa_drv_set_countermeasures(wpa_s, 0);
3491
3492         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3493         wpa_drv_flush_pmkid(wpa_s);
3494
3495         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3496         wpa_s->prev_scan_wildcard = 0;
3497
3498         if (wpa_supplicant_enabled_networks(wpa_s)) {
3499                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3500                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3501                         interface_count = 0;
3502                 }
3503 #ifndef ANDROID
3504                 if (!wpa_s->p2p_mgmt &&
3505                     wpa_supplicant_delayed_sched_scan(wpa_s,
3506                                                       interface_count % 3,
3507                                                       100000))
3508                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3509                                                 100000);
3510 #endif /* ANDROID */
3511                 interface_count++;
3512         } else
3513                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3514
3515         return 0;
3516 }
3517
3518
3519 static int wpa_supplicant_daemon(const char *pid_file)
3520 {
3521         wpa_printf(MSG_DEBUG, "Daemonize..");
3522         return os_daemonize(pid_file);
3523 }
3524
3525
3526 static struct wpa_supplicant *
3527 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3528 {
3529         struct wpa_supplicant *wpa_s;
3530
3531         wpa_s = os_zalloc(sizeof(*wpa_s));
3532         if (wpa_s == NULL)
3533                 return NULL;
3534         wpa_s->scan_req = INITIAL_SCAN_REQ;
3535         wpa_s->scan_interval = 5;
3536         wpa_s->new_connection = 1;
3537         wpa_s->parent = parent ? parent : wpa_s;
3538         wpa_s->p2pdev = wpa_s->parent;
3539         wpa_s->sched_scanning = 0;
3540
3541         dl_list_init(&wpa_s->bss_tmp_disallowed);
3542
3543         return wpa_s;
3544 }
3545
3546
3547 #ifdef CONFIG_HT_OVERRIDES
3548
3549 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3550                              struct ieee80211_ht_capabilities *htcaps,
3551                              struct ieee80211_ht_capabilities *htcaps_mask,
3552                              const char *ht_mcs)
3553 {
3554         /* parse ht_mcs into hex array */
3555         int i;
3556         const char *tmp = ht_mcs;
3557         char *end = NULL;
3558
3559         /* If ht_mcs is null, do not set anything */
3560         if (!ht_mcs)
3561                 return 0;
3562
3563         /* This is what we are setting in the kernel */
3564         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3565
3566         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3567
3568         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3569                 errno = 0;
3570                 long v = strtol(tmp, &end, 16);
3571                 if (errno == 0) {
3572                         wpa_msg(wpa_s, MSG_DEBUG,
3573                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3574                                 i, v, end, tmp);
3575                         if (end == tmp)
3576                                 break;
3577
3578                         htcaps->supported_mcs_set[i] = v;
3579                         tmp = end;
3580                 } else {
3581                         wpa_msg(wpa_s, MSG_ERROR,
3582                                 "Failed to parse ht-mcs: %s, error: %s\n",
3583                                 ht_mcs, strerror(errno));
3584                         return -1;
3585                 }
3586         }
3587
3588         /*
3589          * If we were able to parse any values, then set mask for the MCS set.
3590          */
3591         if (i) {
3592                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3593                           IEEE80211_HT_MCS_MASK_LEN - 1);
3594                 /* skip the 3 reserved bits */
3595                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3596                         0x1f;
3597         }
3598
3599         return 0;
3600 }
3601
3602
3603 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3604                                  struct ieee80211_ht_capabilities *htcaps,
3605                                  struct ieee80211_ht_capabilities *htcaps_mask,
3606                                  int disabled)
3607 {
3608         le16 msk;
3609
3610         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3611
3612         if (disabled == -1)
3613                 return 0;
3614
3615         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3616         htcaps_mask->ht_capabilities_info |= msk;
3617         if (disabled)
3618                 htcaps->ht_capabilities_info &= msk;
3619         else
3620                 htcaps->ht_capabilities_info |= msk;
3621
3622         return 0;
3623 }
3624
3625
3626 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3627                                 struct ieee80211_ht_capabilities *htcaps,
3628                                 struct ieee80211_ht_capabilities *htcaps_mask,
3629                                 int factor)
3630 {
3631         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3632
3633         if (factor == -1)
3634                 return 0;
3635
3636         if (factor < 0 || factor > 3) {
3637                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3638                         "Must be 0-3 or -1", factor);
3639                 return -EINVAL;
3640         }
3641
3642         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3643         htcaps->a_mpdu_params &= ~0x3;
3644         htcaps->a_mpdu_params |= factor & 0x3;
3645
3646         return 0;
3647 }
3648
3649
3650 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3651                                  struct ieee80211_ht_capabilities *htcaps,
3652                                  struct ieee80211_ht_capabilities *htcaps_mask,
3653                                  int density)
3654 {
3655         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3656
3657         if (density == -1)
3658                 return 0;
3659
3660         if (density < 0 || density > 7) {
3661                 wpa_msg(wpa_s, MSG_ERROR,
3662                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3663                         density);
3664                 return -EINVAL;
3665         }
3666
3667         htcaps_mask->a_mpdu_params |= 0x1C;
3668         htcaps->a_mpdu_params &= ~(0x1C);
3669         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3670
3671         return 0;
3672 }
3673
3674
3675 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3676                                 struct ieee80211_ht_capabilities *htcaps,
3677                                 struct ieee80211_ht_capabilities *htcaps_mask,
3678                                 int disabled)
3679 {
3680         /* Masking these out disables HT40 */
3681         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3682                                 HT_CAP_INFO_SHORT_GI40MHZ);
3683
3684         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3685
3686         if (disabled)
3687                 htcaps->ht_capabilities_info &= ~msk;
3688         else
3689                 htcaps->ht_capabilities_info |= msk;
3690
3691         htcaps_mask->ht_capabilities_info |= msk;
3692
3693         return 0;
3694 }
3695
3696
3697 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3698                                struct ieee80211_ht_capabilities *htcaps,
3699                                struct ieee80211_ht_capabilities *htcaps_mask,
3700                                int disabled)
3701 {
3702         /* Masking these out disables SGI */
3703         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3704                                 HT_CAP_INFO_SHORT_GI40MHZ);
3705
3706         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3707
3708         if (disabled)
3709                 htcaps->ht_capabilities_info &= ~msk;
3710         else
3711                 htcaps->ht_capabilities_info |= msk;
3712
3713         htcaps_mask->ht_capabilities_info |= msk;
3714
3715         return 0;
3716 }
3717
3718
3719 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3720                                struct ieee80211_ht_capabilities *htcaps,
3721                                struct ieee80211_ht_capabilities *htcaps_mask,
3722                                int disabled)
3723 {
3724         /* Masking these out disables LDPC */
3725         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3726
3727         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3728
3729         if (disabled)
3730                 htcaps->ht_capabilities_info &= ~msk;
3731         else
3732                 htcaps->ht_capabilities_info |= msk;
3733
3734         htcaps_mask->ht_capabilities_info |= msk;
3735
3736         return 0;
3737 }
3738
3739
3740 void wpa_supplicant_apply_ht_overrides(
3741         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3742         struct wpa_driver_associate_params *params)
3743 {
3744         struct ieee80211_ht_capabilities *htcaps;
3745         struct ieee80211_ht_capabilities *htcaps_mask;
3746
3747         if (!ssid)
3748                 return;
3749
3750         params->disable_ht = ssid->disable_ht;
3751         if (!params->htcaps || !params->htcaps_mask)
3752                 return;
3753
3754         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3755         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3756         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3757         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3758                               ssid->disable_max_amsdu);
3759         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3760         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3761         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3762         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3763         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3764
3765         if (ssid->ht40_intolerant) {
3766                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3767                 htcaps->ht_capabilities_info |= bit;
3768                 htcaps_mask->ht_capabilities_info |= bit;
3769         }
3770 }
3771
3772 #endif /* CONFIG_HT_OVERRIDES */
3773
3774
3775 #ifdef CONFIG_VHT_OVERRIDES
3776 void wpa_supplicant_apply_vht_overrides(
3777         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3778         struct wpa_driver_associate_params *params)
3779 {
3780         struct ieee80211_vht_capabilities *vhtcaps;
3781         struct ieee80211_vht_capabilities *vhtcaps_mask;
3782
3783         if (!ssid)
3784                 return;
3785
3786         params->disable_vht = ssid->disable_vht;
3787
3788         vhtcaps = (void *) params->vhtcaps;
3789         vhtcaps_mask = (void *) params->vhtcaps_mask;
3790
3791         if (!vhtcaps || !vhtcaps_mask)
3792                 return;
3793
3794         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3795         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3796
3797 #ifdef CONFIG_HT_OVERRIDES
3798         /* if max ampdu is <= 3, we have to make the HT cap the same */
3799         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3800                 int max_ampdu;
3801
3802                 max_ampdu = (ssid->vht_capa &
3803                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3804                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3805
3806                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3807                 wpa_set_ampdu_factor(wpa_s,
3808                                      (void *) params->htcaps,
3809                                      (void *) params->htcaps_mask,
3810                                      max_ampdu);
3811         }
3812 #endif /* CONFIG_HT_OVERRIDES */
3813
3814 #define OVERRIDE_MCS(i)                                                 \
3815         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3816                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3817                         3 << 2 * (i - 1);                               \
3818                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3819                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3820         }                                                               \
3821         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3822                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3823                         3 << 2 * (i - 1);                               \
3824                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3825                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3826         }
3827
3828         OVERRIDE_MCS(1);
3829         OVERRIDE_MCS(2);
3830         OVERRIDE_MCS(3);
3831         OVERRIDE_MCS(4);
3832         OVERRIDE_MCS(5);
3833         OVERRIDE_MCS(6);
3834         OVERRIDE_MCS(7);
3835         OVERRIDE_MCS(8);
3836 }
3837 #endif /* CONFIG_VHT_OVERRIDES */
3838
3839
3840 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3841 {
3842 #ifdef PCSC_FUNCS
3843         size_t len;
3844
3845         if (!wpa_s->conf->pcsc_reader)
3846                 return 0;
3847
3848         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3849         if (!wpa_s->scard)
3850                 return 1;
3851
3852         if (wpa_s->conf->pcsc_pin &&
3853             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3854                 scard_deinit(wpa_s->scard);
3855                 wpa_s->scard = NULL;
3856                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3857                 return -1;
3858         }
3859
3860         len = sizeof(wpa_s->imsi) - 1;
3861         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3862                 scard_deinit(wpa_s->scard);
3863                 wpa_s->scard = NULL;
3864                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3865                 return -1;
3866         }
3867         wpa_s->imsi[len] = '\0';
3868
3869         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3870
3871         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3872                    wpa_s->imsi, wpa_s->mnc_len);
3873
3874         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3875         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3876 #endif /* PCSC_FUNCS */
3877
3878         return 0;
3879 }
3880
3881
3882 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3883 {
3884         char *val, *pos;
3885
3886         ext_password_deinit(wpa_s->ext_pw);
3887         wpa_s->ext_pw = NULL;
3888         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3889
3890         if (!wpa_s->conf->ext_password_backend)
3891                 return 0;
3892
3893         val = os_strdup(wpa_s->conf->ext_password_backend);
3894         if (val == NULL)
3895                 return -1;
3896         pos = os_strchr(val, ':');
3897         if (pos)
3898                 *pos++ = '\0';
3899
3900         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3901
3902         wpa_s->ext_pw = ext_password_init(val, pos);
3903         os_free(val);
3904         if (wpa_s->ext_pw == NULL) {
3905                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3906                 return -1;
3907         }
3908         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3909
3910         return 0;
3911 }
3912
3913
3914 #ifdef CONFIG_FST
3915
3916 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3917 {
3918         struct wpa_supplicant *wpa_s = ctx;
3919
3920         return (is_zero_ether_addr(wpa_s->bssid) ||
3921                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3922 }
3923
3924
3925 static void wpas_fst_get_channel_info_cb(void *ctx,
3926                                          enum hostapd_hw_mode *hw_mode,
3927                                          u8 *channel)
3928 {
3929         struct wpa_supplicant *wpa_s = ctx;
3930
3931         if (wpa_s->current_bss) {
3932                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3933                                                   channel);
3934         } else if (wpa_s->hw.num_modes) {
3935                 *hw_mode = wpa_s->hw.modes[0].mode;
3936         } else {
3937                 WPA_ASSERT(0);
3938                 *hw_mode = 0;
3939         }
3940 }
3941
3942
3943 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3944 {
3945         struct wpa_supplicant *wpa_s = ctx;
3946
3947         *modes = wpa_s->hw.modes;
3948         return wpa_s->hw.num_modes;
3949 }
3950
3951
3952 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3953 {
3954         struct wpa_supplicant *wpa_s = ctx;
3955
3956         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3957         wpa_s->fst_ies = fst_ies;
3958 }
3959
3960
3961 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3962 {
3963         struct wpa_supplicant *wpa_s = ctx;
3964
3965         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3966         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3967                                           wpa_s->own_addr, wpa_s->bssid,
3968                                           wpabuf_head(data), wpabuf_len(data),
3969                                    0);
3970 }
3971
3972
3973 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3974 {
3975         struct wpa_supplicant *wpa_s = ctx;
3976
3977         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3978         return wpa_s->received_mb_ies;
3979 }
3980
3981
3982 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3983                                      const u8 *buf, size_t size)
3984 {
3985         struct wpa_supplicant *wpa_s = ctx;
3986         struct mb_ies_info info;
3987
3988         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3989
3990         if (!mb_ies_info_by_ies(&info, buf, size)) {
3991                 wpabuf_free(wpa_s->received_mb_ies);
3992                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3993         }
3994 }
3995
3996
3997 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3998                                    Boolean mb_only)
3999 {
4000         struct wpa_supplicant *wpa_s = ctx;
4001
4002         *get_ctx = NULL;
4003         if (!is_zero_ether_addr(wpa_s->bssid))
4004                 return (wpa_s->received_mb_ies || !mb_only) ?
4005                         wpa_s->bssid : NULL;
4006         return NULL;
4007 }
4008
4009
4010 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
4011                                   Boolean mb_only)
4012 {
4013         return NULL;
4014 }
4015
4016 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4017                                        struct fst_wpa_obj *iface_obj)
4018 {
4019         iface_obj->ctx              = wpa_s;
4020         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4021         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4022         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4023         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4024         iface_obj->send_action      = wpas_fst_send_action_cb;
4025         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4026         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4027         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4028         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4029 }
4030 #endif /* CONFIG_FST */
4031
4032 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4033                                     const struct wpa_driver_capa *capa)
4034 {
4035         struct wowlan_triggers *triggers;
4036         int ret = 0;
4037
4038         if (!wpa_s->conf->wowlan_triggers)
4039                 return 0;
4040
4041         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4042         if (triggers) {
4043                 ret = wpa_drv_wowlan(wpa_s, triggers);
4044                 os_free(triggers);
4045         }
4046         return ret;
4047 }
4048
4049
4050 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4051 {
4052         if (freq < 3000)
4053                 return BAND_2_4_GHZ;
4054         if (freq > 50000)
4055                 return BAND_60_GHZ;
4056         return BAND_5_GHZ;
4057 }
4058
4059
4060 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4061 {
4062         int i;
4063         unsigned int band = 0;
4064
4065         if (freqs) {
4066                 /* freqs are specified for the radio work */
4067                 for (i = 0; freqs[i]; i++)
4068                         band |= wpas_freq_to_band(freqs[i]);
4069         } else {
4070                 /*
4071                  * freqs are not specified, implies all
4072                  * the supported freqs by HW
4073                  */
4074                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4075                         if (wpa_s->hw.modes[i].num_channels != 0) {
4076                                 if (wpa_s->hw.modes[i].mode ==
4077                                     HOSTAPD_MODE_IEEE80211B ||
4078                                     wpa_s->hw.modes[i].mode ==
4079                                     HOSTAPD_MODE_IEEE80211G)
4080                                         band |= BAND_2_4_GHZ;
4081                                 else if (wpa_s->hw.modes[i].mode ==
4082                                          HOSTAPD_MODE_IEEE80211A)
4083                                         band |= BAND_5_GHZ;
4084                                 else if (wpa_s->hw.modes[i].mode ==
4085                                          HOSTAPD_MODE_IEEE80211AD)
4086                                         band |= BAND_60_GHZ;
4087                                 else if (wpa_s->hw.modes[i].mode ==
4088                                          HOSTAPD_MODE_IEEE80211ANY)
4089                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4090                                                 BAND_60_GHZ;
4091                         }
4092                 }
4093         }
4094
4095         return band;
4096 }
4097
4098
4099 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4100                                               const char *rn)
4101 {
4102         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4103         struct wpa_radio *radio;
4104
4105         while (rn && iface) {
4106                 radio = iface->radio;
4107                 if (radio && os_strcmp(rn, radio->name) == 0) {
4108                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4109                                    wpa_s->ifname, rn);
4110                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4111                         return radio;
4112                 }
4113
4114                 iface = iface->next;
4115         }
4116
4117         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4118                    wpa_s->ifname, rn ? rn : "N/A");
4119         radio = os_zalloc(sizeof(*radio));
4120         if (radio == NULL)
4121                 return NULL;
4122
4123         if (rn)
4124                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4125         dl_list_init(&radio->ifaces);
4126         dl_list_init(&radio->work);
4127         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4128
4129         return radio;
4130 }
4131
4132
4133 static void radio_work_free(struct wpa_radio_work *work)
4134 {
4135         if (work->wpa_s->scan_work == work) {
4136                 /* This should not really happen. */
4137                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4138                         work->type, work, work->started);
4139                 work->wpa_s->scan_work = NULL;
4140         }
4141
4142 #ifdef CONFIG_P2P
4143         if (work->wpa_s->p2p_scan_work == work) {
4144                 /* This should not really happen. */
4145                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4146                         work->type, work, work->started);
4147                 work->wpa_s->p2p_scan_work = NULL;
4148         }
4149 #endif /* CONFIG_P2P */
4150
4151         if (work->started) {
4152                 work->wpa_s->radio->num_active_works--;
4153                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4154                         "radio_work_free('%s'@%p: num_active_works --> %u",
4155                         work->type, work,
4156                         work->wpa_s->radio->num_active_works);
4157         }
4158
4159         dl_list_del(&work->list);
4160         os_free(work);
4161 }
4162
4163
4164 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4165 {
4166         struct wpa_radio_work *active_work = NULL;
4167         struct wpa_radio_work *tmp;
4168
4169         /* Get the active work to know the type and band. */
4170         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4171                 if (tmp->started) {
4172                         active_work = tmp;
4173                         break;
4174                 }
4175         }
4176
4177         if (!active_work) {
4178                 /* No active work, start one */
4179                 radio->num_active_works = 0;
4180                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4181                                  list) {
4182                         if (os_strcmp(tmp->type, "scan") == 0 &&
4183                             radio->external_scan_running &&
4184                             (((struct wpa_driver_scan_params *)
4185                               tmp->ctx)->only_new_results ||
4186                              tmp->wpa_s->clear_driver_scan_cache))
4187                                 continue;
4188                         return tmp;
4189                 }
4190                 return NULL;
4191         }
4192
4193         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4194             os_strcmp(active_work->type, "connect") == 0) {
4195                 /*
4196                  * If the active work is either connect or sme-connect,
4197                  * do not parallelize them with other radio works.
4198                  */
4199                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4200                         "Do not parallelize radio work with %s",
4201                         active_work->type);
4202                 return NULL;
4203         }
4204
4205         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4206                 if (tmp->started)
4207                         continue;
4208
4209                 /*
4210                  * If connect or sme-connect are enqueued, parallelize only
4211                  * those operations ahead of them in the queue.
4212                  */
4213                 if (os_strcmp(tmp->type, "connect") == 0 ||
4214                     os_strcmp(tmp->type, "sme-connect") == 0)
4215                         break;
4216
4217                 /*
4218                  * Check that the radio works are distinct and
4219                  * on different bands.
4220                  */
4221                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4222                     (active_work->bands != tmp->bands)) {
4223                         /*
4224                          * If a scan has to be scheduled through nl80211 scan
4225                          * interface and if an external scan is already running,
4226                          * do not schedule the scan since it is likely to get
4227                          * rejected by kernel.
4228                          */
4229                         if (os_strcmp(tmp->type, "scan") == 0 &&
4230                             radio->external_scan_running &&
4231                             (((struct wpa_driver_scan_params *)
4232                               tmp->ctx)->only_new_results ||
4233                              tmp->wpa_s->clear_driver_scan_cache))
4234                                 continue;
4235
4236                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4237                                 "active_work:%s new_work:%s",
4238                                 active_work->type, tmp->type);
4239                         return tmp;
4240                 }
4241         }
4242
4243         /* Did not find a radio work to schedule in parallel. */
4244         return NULL;
4245 }
4246
4247
4248 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4249 {
4250         struct wpa_radio *radio = eloop_ctx;
4251         struct wpa_radio_work *work;
4252         struct os_reltime now, diff;
4253         struct wpa_supplicant *wpa_s;
4254
4255         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4256         if (work == NULL) {
4257                 radio->num_active_works = 0;
4258                 return;
4259         }
4260
4261         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4262                               radio_list);
4263
4264         if (!(wpa_s &&
4265               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4266                 if (work->started)
4267                         return; /* already started and still in progress */
4268
4269                 if (wpa_s && wpa_s->radio->external_scan_running) {
4270                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4271                         return;
4272                 }
4273         } else {
4274                 work = NULL;
4275                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4276                         /* get the work to schedule next */
4277                         work = radio_work_get_next_work(radio);
4278                 }
4279                 if (!work)
4280                         return;
4281         }
4282
4283         wpa_s = work->wpa_s;
4284         os_get_reltime(&now);
4285         os_reltime_sub(&now, &work->time, &diff);
4286         wpa_dbg(wpa_s, MSG_DEBUG,
4287                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4288                 work->type, work, diff.sec, diff.usec);
4289         work->started = 1;
4290         work->time = now;
4291         radio->num_active_works++;
4292
4293         work->cb(work, 0);
4294
4295         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4296             radio->num_active_works < MAX_ACTIVE_WORKS)
4297                 radio_work_check_next(wpa_s);
4298 }
4299
4300
4301 /*
4302  * This function removes both started and pending radio works running on
4303  * the provided interface's radio.
4304  * Prior to the removal of the radio work, its callback (cb) is called with
4305  * deinit set to be 1. Each work's callback is responsible for clearing its
4306  * internal data and restoring to a correct state.
4307  * @wpa_s: wpa_supplicant data
4308  * @type: type of works to be removed
4309  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4310  * this interface's works.
4311  */
4312 void radio_remove_works(struct wpa_supplicant *wpa_s,
4313                         const char *type, int remove_all)
4314 {
4315         struct wpa_radio_work *work, *tmp;
4316         struct wpa_radio *radio = wpa_s->radio;
4317
4318         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4319                               list) {
4320                 if (type && os_strcmp(type, work->type) != 0)
4321                         continue;
4322
4323                 /* skip other ifaces' works */
4324                 if (!remove_all && work->wpa_s != wpa_s)
4325                         continue;
4326
4327                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4328                         work->type, work, work->started ? " (started)" : "");
4329                 work->cb(work, 1);
4330                 radio_work_free(work);
4331         }
4332
4333         /* in case we removed the started work */
4334         radio_work_check_next(wpa_s);
4335 }
4336
4337
4338 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4339 {
4340         struct wpa_radio *radio = wpa_s->radio;
4341
4342         if (!radio)
4343                 return;
4344
4345         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4346                    wpa_s->ifname, radio->name);
4347         dl_list_del(&wpa_s->radio_list);
4348         radio_remove_works(wpa_s, NULL, 0);
4349         wpa_s->radio = NULL;
4350         if (!dl_list_empty(&radio->ifaces))
4351                 return; /* Interfaces remain for this radio */
4352
4353         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4354         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4355         os_free(radio);
4356 }
4357
4358
4359 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4360 {
4361         struct wpa_radio *radio = wpa_s->radio;
4362
4363         if (dl_list_empty(&radio->work))
4364                 return;
4365         if (wpa_s->ext_work_in_progress) {
4366                 wpa_printf(MSG_DEBUG,
4367                            "External radio work in progress - delay start of pending item");
4368                 return;
4369         }
4370         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4371         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4372 }
4373
4374
4375 /**
4376  * radio_add_work - Add a radio work item
4377  * @wpa_s: Pointer to wpa_supplicant data
4378  * @freq: Frequency of the offchannel operation in MHz or 0
4379  * @type: Unique identifier for each type of work
4380  * @next: Force as the next work to be executed
4381  * @cb: Callback function for indicating when radio is available
4382  * @ctx: Context pointer for the work (work->ctx in cb())
4383  * Returns: 0 on success, -1 on failure
4384  *
4385  * This function is used to request time for an operation that requires
4386  * exclusive radio control. Once the radio is available, the registered callback
4387  * function will be called. radio_work_done() must be called once the exclusive
4388  * radio operation has been completed, so that the radio is freed for other
4389  * operations. The special case of deinit=1 is used to free the context data
4390  * during interface removal. That does not allow the callback function to start
4391  * the radio operation, i.e., it must free any resources allocated for the radio
4392  * work and return.
4393  *
4394  * The @freq parameter can be used to indicate a single channel on which the
4395  * offchannel operation will occur. This may allow multiple radio work
4396  * operations to be performed in parallel if they apply for the same channel.
4397  * Setting this to 0 indicates that the work item may use multiple channels or
4398  * requires exclusive control of the radio.
4399  */
4400 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4401                    const char *type, int next,
4402                    void (*cb)(struct wpa_radio_work *work, int deinit),
4403                    void *ctx)
4404 {
4405         struct wpa_radio *radio = wpa_s->radio;
4406         struct wpa_radio_work *work;
4407         int was_empty;
4408
4409         work = os_zalloc(sizeof(*work));
4410         if (work == NULL)
4411                 return -1;
4412         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4413         os_get_reltime(&work->time);
4414         work->freq = freq;
4415         work->type = type;
4416         work->wpa_s = wpa_s;
4417         work->cb = cb;
4418         work->ctx = ctx;
4419
4420         if (freq)
4421                 work->bands = wpas_freq_to_band(freq);
4422         else if (os_strcmp(type, "scan") == 0 ||
4423                  os_strcmp(type, "p2p-scan") == 0)
4424                 work->bands = wpas_get_bands(wpa_s,
4425                                              ((struct wpa_driver_scan_params *)
4426                                               ctx)->freqs);
4427         else
4428                 work->bands = wpas_get_bands(wpa_s, NULL);
4429
4430         was_empty = dl_list_empty(&wpa_s->radio->work);
4431         if (next)
4432                 dl_list_add(&wpa_s->radio->work, &work->list);
4433         else
4434                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4435         if (was_empty) {
4436                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4437                 radio_work_check_next(wpa_s);
4438         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4439                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4440                 wpa_dbg(wpa_s, MSG_DEBUG,
4441                         "Try to schedule a radio work (num_active_works=%u)",
4442                         radio->num_active_works);
4443                 radio_work_check_next(wpa_s);
4444         }
4445
4446         return 0;
4447 }
4448
4449
4450 /**
4451  * radio_work_done - Indicate that a radio work item has been completed
4452  * @work: Completed work
4453  *
4454  * This function is called once the callback function registered with
4455  * radio_add_work() has completed its work.
4456  */
4457 void radio_work_done(struct wpa_radio_work *work)
4458 {
4459         struct wpa_supplicant *wpa_s = work->wpa_s;
4460         struct os_reltime now, diff;
4461         unsigned int started = work->started;
4462
4463         os_get_reltime(&now);
4464         os_reltime_sub(&now, &work->time, &diff);
4465         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4466                 work->type, work, started ? "done" : "canceled",
4467                 diff.sec, diff.usec);
4468         radio_work_free(work);
4469         if (started)
4470                 radio_work_check_next(wpa_s);
4471 }
4472
4473
4474 struct wpa_radio_work *
4475 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4476 {
4477         struct wpa_radio_work *work;
4478         struct wpa_radio *radio = wpa_s->radio;
4479
4480         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4481                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4482                         return work;
4483         }
4484
4485         return NULL;
4486 }
4487
4488
4489 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4490                             struct wpa_interface *iface)
4491 {
4492         const char *ifname, *driver, *rn;
4493
4494         driver = iface->driver;
4495 next_driver:
4496         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4497                 return -1;
4498
4499         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4500         if (wpa_s->drv_priv == NULL) {
4501                 const char *pos;
4502                 pos = driver ? os_strchr(driver, ',') : NULL;
4503                 if (pos) {
4504                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4505                                 "driver interface - try next driver wrapper");
4506                         driver = pos + 1;
4507                         goto next_driver;
4508                 }
4509                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4510                         "interface");
4511                 return -1;
4512         }
4513         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4514                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4515                         "driver_param '%s'", wpa_s->conf->driver_param);
4516                 return -1;
4517         }
4518
4519         ifname = wpa_drv_get_ifname(wpa_s);
4520         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4521                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4522                         "interface name with '%s'", ifname);
4523                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4524         }
4525
4526         rn = wpa_driver_get_radio_name(wpa_s);
4527         if (rn && rn[0] == '\0')
4528                 rn = NULL;
4529
4530         wpa_s->radio = radio_add_interface(wpa_s, rn);
4531         if (wpa_s->radio == NULL)
4532                 return -1;
4533
4534         return 0;
4535 }
4536
4537
4538 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4539                                      struct wpa_interface *iface)
4540 {
4541         struct wpa_driver_capa capa;
4542         int capa_res;
4543
4544         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4545                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4546                    iface->confname ? iface->confname : "N/A",
4547                    iface->driver ? iface->driver : "default",
4548                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4549                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4550
4551         if (iface->confname) {
4552 #ifdef CONFIG_BACKEND_FILE
4553                 wpa_s->confname = os_rel2abs_path(iface->confname);
4554                 if (wpa_s->confname == NULL) {
4555                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4556                                    "for configuration file '%s'.",
4557                                    iface->confname);
4558                         return -1;
4559                 }
4560                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4561                            iface->confname, wpa_s->confname);
4562 #else /* CONFIG_BACKEND_FILE */
4563                 wpa_s->confname = os_strdup(iface->confname);
4564 #endif /* CONFIG_BACKEND_FILE */
4565                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4566                 if (wpa_s->conf == NULL) {
4567                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4568                                    "configuration '%s'.", wpa_s->confname);
4569                         return -1;
4570                 }
4571                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4572                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4573
4574                 /*
4575                  * Override ctrl_interface and driver_param if set on command
4576                  * line.
4577                  */
4578                 if (iface->ctrl_interface) {
4579                         os_free(wpa_s->conf->ctrl_interface);
4580                         wpa_s->conf->ctrl_interface =
4581                                 os_strdup(iface->ctrl_interface);
4582                 }
4583
4584                 if (iface->driver_param) {
4585                         os_free(wpa_s->conf->driver_param);
4586                         wpa_s->conf->driver_param =
4587                                 os_strdup(iface->driver_param);
4588                 }
4589
4590                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4591                         os_free(wpa_s->conf->ctrl_interface);
4592                         wpa_s->conf->ctrl_interface = NULL;
4593                 }
4594         } else
4595                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4596                                                      iface->driver_param);
4597
4598         if (wpa_s->conf == NULL) {
4599                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4600                 return -1;
4601         }
4602
4603         if (iface->ifname == NULL) {
4604                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4605                 return -1;
4606         }
4607         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4608                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4609                            iface->ifname);
4610                 return -1;
4611         }
4612         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4613
4614         if (iface->bridge_ifname) {
4615                 if (os_strlen(iface->bridge_ifname) >=
4616                     sizeof(wpa_s->bridge_ifname)) {
4617                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4618                                    "name '%s'.", iface->bridge_ifname);
4619                         return -1;
4620                 }
4621                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4622                            sizeof(wpa_s->bridge_ifname));
4623         }
4624
4625         /* RSNA Supplicant Key Management - INITIALIZE */
4626         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4627         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4628
4629         /* Initialize driver interface and register driver event handler before
4630          * L2 receive handler so that association events are processed before
4631          * EAPOL-Key packets if both become available for the same select()
4632          * call. */
4633         if (wpas_init_driver(wpa_s, iface) < 0)
4634                 return -1;
4635
4636         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4637                 return -1;
4638
4639         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4640                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4641                           NULL);
4642         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4643
4644         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4645             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4646                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4647                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4648                         "dot11RSNAConfigPMKLifetime");
4649                 return -1;
4650         }
4651
4652         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4653             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4654                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4655                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4656                         "dot11RSNAConfigPMKReauthThreshold");
4657                 return -1;
4658         }
4659
4660         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4661             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4662                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4663                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4664                         "dot11RSNAConfigSATimeout");
4665                 return -1;
4666         }
4667
4668         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4669                                                       &wpa_s->hw.num_modes,
4670                                                       &wpa_s->hw.flags);
4671         if (wpa_s->hw.modes) {
4672                 u16 i;
4673
4674                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4675                         if (wpa_s->hw.modes[i].vht_capab) {
4676                                 wpa_s->hw_capab = CAPAB_VHT;
4677                                 break;
4678                         }
4679
4680                         if (wpa_s->hw.modes[i].ht_capab &
4681                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4682                                 wpa_s->hw_capab = CAPAB_HT40;
4683                         else if (wpa_s->hw.modes[i].ht_capab &&
4684                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4685                                 wpa_s->hw_capab = CAPAB_HT;
4686                 }
4687         }
4688
4689         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4690         if (capa_res == 0) {
4691                 wpa_s->drv_capa_known = 1;
4692                 wpa_s->drv_flags = capa.flags;
4693                 wpa_s->drv_enc = capa.enc;
4694                 wpa_s->drv_smps_modes = capa.smps_modes;
4695                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4696                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4697                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4698                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4699                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4700                 wpa_s->max_sched_scan_plan_interval =
4701                         capa.max_sched_scan_plan_interval;
4702                 wpa_s->max_sched_scan_plan_iterations =
4703                         capa.max_sched_scan_plan_iterations;
4704                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4705                 wpa_s->max_match_sets = capa.max_match_sets;
4706                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4707                 wpa_s->max_stations = capa.max_stations;
4708                 wpa_s->extended_capa = capa.extended_capa;
4709                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4710                 wpa_s->extended_capa_len = capa.extended_capa_len;
4711                 wpa_s->num_multichan_concurrent =
4712                         capa.num_multichan_concurrent;
4713                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4714
4715                 if (capa.mac_addr_rand_scan_supported)
4716                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4717                 if (wpa_s->sched_scan_supported &&
4718                     capa.mac_addr_rand_sched_scan_supported)
4719                         wpa_s->mac_addr_rand_supported |=
4720                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4721         }
4722         if (wpa_s->max_remain_on_chan == 0)
4723                 wpa_s->max_remain_on_chan = 1000;
4724
4725         /*
4726          * Only take p2p_mgmt parameters when P2P Device is supported.
4727          * Doing it here as it determines whether l2_packet_init() will be done
4728          * during wpa_supplicant_driver_init().
4729          */
4730         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4731                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4732         else
4733                 iface->p2p_mgmt = 1;
4734
4735         if (wpa_s->num_multichan_concurrent == 0)
4736                 wpa_s->num_multichan_concurrent = 1;
4737
4738         if (wpa_supplicant_driver_init(wpa_s) < 0)
4739                 return -1;
4740
4741 #ifdef CONFIG_TDLS
4742         if ((!iface->p2p_mgmt ||
4743              !(wpa_s->drv_flags &
4744                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4745             wpa_tdls_init(wpa_s->wpa))
4746                 return -1;
4747 #endif /* CONFIG_TDLS */
4748
4749         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4750             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4751                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4752                 return -1;
4753         }
4754
4755 #ifdef CONFIG_FST
4756         if (wpa_s->conf->fst_group_id) {
4757                 struct fst_iface_cfg cfg;
4758                 struct fst_wpa_obj iface_obj;
4759
4760                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4761                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4762                            sizeof(cfg.group_id));
4763                 cfg.priority = wpa_s->conf->fst_priority;
4764                 cfg.llt = wpa_s->conf->fst_llt;
4765
4766                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4767                                         &iface_obj, &cfg);
4768                 if (!wpa_s->fst) {
4769                         wpa_msg(wpa_s, MSG_ERROR,
4770                                 "FST: Cannot attach iface %s to group %s",
4771                                 wpa_s->ifname, cfg.group_id);
4772                         return -1;
4773                 }
4774         }
4775 #endif /* CONFIG_FST */
4776
4777         if (wpas_wps_init(wpa_s))
4778                 return -1;
4779
4780         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4781                 return -1;
4782         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4783
4784         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4785         if (wpa_s->ctrl_iface == NULL) {
4786                 wpa_printf(MSG_ERROR,
4787                            "Failed to initialize control interface '%s'.\n"
4788                            "You may have another wpa_supplicant process "
4789                            "already running or the file was\n"
4790                            "left by an unclean termination of wpa_supplicant "
4791                            "in which case you will need\n"
4792                            "to manually remove this file before starting "
4793                            "wpa_supplicant again.\n",
4794                            wpa_s->conf->ctrl_interface);
4795                 return -1;
4796         }
4797
4798         wpa_s->gas = gas_query_init(wpa_s);
4799         if (wpa_s->gas == NULL) {
4800                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4801                 return -1;
4802         }
4803
4804         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4805                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4806                 return -1;
4807         }
4808
4809         if (wpa_bss_init(wpa_s) < 0)
4810                 return -1;
4811
4812         /*
4813          * Set Wake-on-WLAN triggers, if configured.
4814          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4815          * have effect anyway when the interface is down).
4816          */
4817         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4818                 return -1;
4819
4820 #ifdef CONFIG_EAP_PROXY
4821 {
4822         size_t len;
4823         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4824                                                      &len);
4825         if (wpa_s->mnc_len > 0) {
4826                 wpa_s->imsi[len] = '\0';
4827                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4828                            wpa_s->imsi, wpa_s->mnc_len);
4829         } else {
4830                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4831         }
4832 }
4833 #endif /* CONFIG_EAP_PROXY */
4834
4835         if (pcsc_reader_init(wpa_s) < 0)
4836                 return -1;
4837
4838         if (wpas_init_ext_pw(wpa_s) < 0)
4839                 return -1;
4840
4841         wpas_rrm_reset(wpa_s);
4842
4843         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4844
4845 #ifdef CONFIG_HS20
4846         hs20_init(wpa_s);
4847 #endif /* CONFIG_HS20 */
4848 #ifdef CONFIG_MBO
4849         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4850 #endif /* CONFIG_MBO */
4851
4852         return 0;
4853 }
4854
4855
4856 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4857                                         int notify, int terminate)
4858 {
4859         struct wpa_global *global = wpa_s->global;
4860         struct wpa_supplicant *iface, *prev;
4861
4862         if (wpa_s == wpa_s->parent)
4863                 wpas_p2p_group_remove(wpa_s, "*");
4864
4865         iface = global->ifaces;
4866         while (iface) {
4867                 if (iface->p2pdev == wpa_s)
4868                         iface->p2pdev = iface->parent;
4869                 if (iface == wpa_s || iface->parent != wpa_s) {
4870                         iface = iface->next;
4871                         continue;
4872                 }
4873                 wpa_printf(MSG_DEBUG,
4874                            "Remove remaining child interface %s from parent %s",
4875                            iface->ifname, wpa_s->ifname);
4876                 prev = iface;
4877                 iface = iface->next;
4878                 wpa_supplicant_remove_iface(global, prev, terminate);
4879         }
4880
4881         wpa_s->disconnected = 1;
4882         if (wpa_s->drv_priv) {
4883                 wpa_supplicant_deauthenticate(wpa_s,
4884                                               WLAN_REASON_DEAUTH_LEAVING);
4885
4886                 wpa_drv_set_countermeasures(wpa_s, 0);
4887                 wpa_clear_keys(wpa_s, NULL);
4888         }
4889
4890         wpa_supplicant_cleanup(wpa_s);
4891         wpas_p2p_deinit_iface(wpa_s);
4892
4893         wpas_ctrl_radio_work_flush(wpa_s);
4894         radio_remove_interface(wpa_s);
4895
4896 #ifdef CONFIG_FST
4897         if (wpa_s->fst) {
4898                 fst_detach(wpa_s->fst);
4899                 wpa_s->fst = NULL;
4900         }
4901         if (wpa_s->received_mb_ies) {
4902                 wpabuf_free(wpa_s->received_mb_ies);
4903                 wpa_s->received_mb_ies = NULL;
4904         }
4905 #endif /* CONFIG_FST */
4906
4907         if (wpa_s->drv_priv)
4908                 wpa_drv_deinit(wpa_s);
4909
4910         if (notify)
4911                 wpas_notify_iface_removed(wpa_s);
4912
4913         if (terminate)
4914                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4915
4916         if (wpa_s->ctrl_iface) {
4917                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4918                 wpa_s->ctrl_iface = NULL;
4919         }
4920
4921 #ifdef CONFIG_MESH
4922         if (wpa_s->ifmsh) {
4923                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4924                 wpa_s->ifmsh = NULL;
4925         }
4926 #endif /* CONFIG_MESH */
4927
4928         if (wpa_s->conf != NULL) {
4929                 wpa_config_free(wpa_s->conf);
4930                 wpa_s->conf = NULL;
4931         }
4932
4933         os_free(wpa_s->ssids_from_scan_req);
4934
4935         os_free(wpa_s);
4936 }
4937
4938
4939 #ifdef CONFIG_MATCH_IFACE
4940
4941 /**
4942  * wpa_supplicant_match_iface - Match an interface description to a name
4943  * @global: Pointer to global data from wpa_supplicant_init()
4944  * @ifname: Name of the interface to match
4945  * Returns: Pointer to the created interface description or %NULL on failure
4946  */
4947 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
4948                                                   const char *ifname)
4949 {
4950         int i;
4951         struct wpa_interface *iface, *miface;
4952
4953         for (i = 0; i < global->params.match_iface_count; i++) {
4954                 miface = &global->params.match_ifaces[i];
4955                 if (!miface->ifname ||
4956                     fnmatch(miface->ifname, ifname, 0) == 0) {
4957                         iface = os_zalloc(sizeof(*iface));
4958                         if (!iface)
4959                                 return NULL;
4960                         *iface = *miface;
4961                         iface->ifname = ifname;
4962                         return iface;
4963                 }
4964         }
4965
4966         return NULL;
4967 }
4968
4969
4970 /**
4971  * wpa_supplicant_match_existing - Match existing interfaces
4972  * @global: Pointer to global data from wpa_supplicant_init()
4973  * Returns: 0 on success, -1 on failure
4974  */
4975 static int wpa_supplicant_match_existing(struct wpa_global *global)
4976 {
4977         struct if_nameindex *ifi, *ifp;
4978         struct wpa_supplicant *wpa_s;
4979         struct wpa_interface *iface;
4980
4981         ifp = if_nameindex();
4982         if (!ifp) {
4983                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
4984                 return -1;
4985         }
4986
4987         for (ifi = ifp; ifi->if_name; ifi++) {
4988                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
4989                 if (wpa_s)
4990                         continue;
4991                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
4992                 if (iface) {
4993                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
4994                         os_free(iface);
4995                         if (wpa_s)
4996                                 wpa_s->matched = 1;
4997                 }
4998         }
4999
5000         if_freenameindex(ifp);
5001         return 0;
5002 }
5003
5004 #endif /* CONFIG_MATCH_IFACE */
5005
5006
5007 /**
5008  * wpa_supplicant_add_iface - Add a new network interface
5009  * @global: Pointer to global data from wpa_supplicant_init()
5010  * @iface: Interface configuration options
5011  * @parent: Parent interface or %NULL to assign new interface as parent
5012  * Returns: Pointer to the created interface or %NULL on failure
5013  *
5014  * This function is used to add new network interfaces for %wpa_supplicant.
5015  * This can be called before wpa_supplicant_run() to add interfaces before the
5016  * main event loop has been started. In addition, new interfaces can be added
5017  * dynamically while %wpa_supplicant is already running. This could happen,
5018  * e.g., when a hotplug network adapter is inserted.
5019  */
5020 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5021                                                  struct wpa_interface *iface,
5022                                                  struct wpa_supplicant *parent)
5023 {
5024         struct wpa_supplicant *wpa_s;
5025         struct wpa_interface t_iface;
5026         struct wpa_ssid *ssid;
5027
5028         if (global == NULL || iface == NULL)
5029                 return NULL;
5030
5031         wpa_s = wpa_supplicant_alloc(parent);
5032         if (wpa_s == NULL)
5033                 return NULL;
5034
5035         wpa_s->global = global;
5036
5037         t_iface = *iface;
5038         if (global->params.override_driver) {
5039                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5040                            "('%s' -> '%s')",
5041                            iface->driver, global->params.override_driver);
5042                 t_iface.driver = global->params.override_driver;
5043         }
5044         if (global->params.override_ctrl_interface) {
5045                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5046                            "ctrl_interface ('%s' -> '%s')",
5047                            iface->ctrl_interface,
5048                            global->params.override_ctrl_interface);
5049                 t_iface.ctrl_interface =
5050                         global->params.override_ctrl_interface;
5051         }
5052         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5053                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5054                            iface->ifname);
5055                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5056                 return NULL;
5057         }
5058
5059         if (iface->p2p_mgmt == 0) {
5060                 /* Notify the control interfaces about new iface */
5061                 if (wpas_notify_iface_added(wpa_s)) {
5062                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5063                         return NULL;
5064                 }
5065
5066                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5067                         wpas_notify_network_added(wpa_s, ssid);
5068         }
5069
5070         wpa_s->next = global->ifaces;
5071         global->ifaces = wpa_s;
5072
5073         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5074         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5075
5076 #ifdef CONFIG_P2P
5077         if (wpa_s->global->p2p == NULL &&
5078             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5079             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5080             wpas_p2p_add_p2pdev_interface(
5081                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5082                 wpa_printf(MSG_INFO,
5083                            "P2P: Failed to enable P2P Device interface");
5084                 /* Try to continue without. P2P will be disabled. */
5085         }
5086 #endif /* CONFIG_P2P */
5087
5088         return wpa_s;
5089 }
5090
5091
5092 /**
5093  * wpa_supplicant_remove_iface - Remove a network interface
5094  * @global: Pointer to global data from wpa_supplicant_init()
5095  * @wpa_s: Pointer to the network interface to be removed
5096  * Returns: 0 if interface was removed, -1 if interface was not found
5097  *
5098  * This function can be used to dynamically remove network interfaces from
5099  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5100  * addition, this function is used to remove all remaining interfaces when
5101  * %wpa_supplicant is terminated.
5102  */
5103 int wpa_supplicant_remove_iface(struct wpa_global *global,
5104                                 struct wpa_supplicant *wpa_s,
5105                                 int terminate)
5106 {
5107         struct wpa_supplicant *prev;
5108 #ifdef CONFIG_MESH
5109         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5110         char *ifname = NULL;
5111 #endif /* CONFIG_MESH */
5112
5113         /* Remove interface from the global list of interfaces */
5114         prev = global->ifaces;
5115         if (prev == wpa_s) {
5116                 global->ifaces = wpa_s->next;
5117         } else {
5118                 while (prev && prev->next != wpa_s)
5119                         prev = prev->next;
5120                 if (prev == NULL)
5121                         return -1;
5122                 prev->next = wpa_s->next;
5123         }
5124
5125         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5126
5127 #ifdef CONFIG_MESH
5128         if (mesh_if_created) {
5129                 ifname = os_strdup(wpa_s->ifname);
5130                 if (ifname == NULL) {
5131                         wpa_dbg(wpa_s, MSG_ERROR,
5132                                 "mesh: Failed to malloc ifname");
5133                         return -1;
5134                 }
5135         }
5136 #endif /* CONFIG_MESH */
5137
5138         if (global->p2p_group_formation == wpa_s)
5139                 global->p2p_group_formation = NULL;
5140         if (global->p2p_invite_group == wpa_s)
5141                 global->p2p_invite_group = NULL;
5142         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5143
5144 #ifdef CONFIG_MESH
5145         if (mesh_if_created) {
5146                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5147                 os_free(ifname);
5148         }
5149 #endif /* CONFIG_MESH */
5150
5151         return 0;
5152 }
5153
5154
5155 /**
5156  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5157  * @wpa_s: Pointer to the network interface
5158  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5159  */
5160 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5161 {
5162         const char *eapol_method;
5163
5164         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5165             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5166                 return "NO-EAP";
5167         }
5168
5169         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5170         if (eapol_method == NULL)
5171                 return "UNKNOWN-EAP";
5172
5173         return eapol_method;
5174 }
5175
5176
5177 /**
5178  * wpa_supplicant_get_iface - Get a new network interface
5179  * @global: Pointer to global data from wpa_supplicant_init()
5180  * @ifname: Interface name
5181  * Returns: Pointer to the interface or %NULL if not found
5182  */
5183 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5184                                                  const char *ifname)
5185 {
5186         struct wpa_supplicant *wpa_s;
5187
5188         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5189                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5190                         return wpa_s;
5191         }
5192         return NULL;
5193 }
5194
5195
5196 #ifndef CONFIG_NO_WPA_MSG
5197 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5198 {
5199         struct wpa_supplicant *wpa_s = ctx;
5200         if (wpa_s == NULL)
5201                 return NULL;
5202         return wpa_s->ifname;
5203 }
5204 #endif /* CONFIG_NO_WPA_MSG */
5205
5206
5207 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5208 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5209 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5210
5211 /* Periodic cleanup tasks */
5212 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5213 {
5214         struct wpa_global *global = eloop_ctx;
5215         struct wpa_supplicant *wpa_s;
5216
5217         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5218                                wpas_periodic, global, NULL);
5219
5220 #ifdef CONFIG_P2P
5221         if (global->p2p)
5222                 p2p_expire_peers(global->p2p);
5223 #endif /* CONFIG_P2P */
5224
5225         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5226                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5227 #ifdef CONFIG_AP
5228                 ap_periodic(wpa_s);
5229 #endif /* CONFIG_AP */
5230         }
5231 }
5232
5233
5234 /**
5235  * wpa_supplicant_init - Initialize %wpa_supplicant
5236  * @params: Parameters for %wpa_supplicant
5237  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5238  *
5239  * This function is used to initialize %wpa_supplicant. After successful
5240  * initialization, the returned data pointer can be used to add and remove
5241  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5242  */
5243 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5244 {
5245         struct wpa_global *global;
5246         int ret, i;
5247
5248         if (params == NULL)
5249                 return NULL;
5250
5251 #ifdef CONFIG_DRIVER_NDIS
5252         {
5253                 void driver_ndis_init_ops(void);
5254                 driver_ndis_init_ops();
5255         }
5256 #endif /* CONFIG_DRIVER_NDIS */
5257
5258 #ifndef CONFIG_NO_WPA_MSG
5259         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5260 #endif /* CONFIG_NO_WPA_MSG */
5261
5262         if (params->wpa_debug_file_path)
5263                 wpa_debug_open_file(params->wpa_debug_file_path);
5264         else
5265                 wpa_debug_setup_stdout();
5266         if (params->wpa_debug_syslog)
5267                 wpa_debug_open_syslog();
5268         if (params->wpa_debug_tracing) {
5269                 ret = wpa_debug_open_linux_tracing();
5270                 if (ret) {
5271                         wpa_printf(MSG_ERROR,
5272                                    "Failed to enable trace logging");
5273                         return NULL;
5274                 }
5275         }
5276
5277         ret = eap_register_methods();
5278         if (ret) {
5279                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5280                 if (ret == -2)
5281                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5282                                    "the same EAP type.");
5283                 return NULL;
5284         }
5285
5286         global = os_zalloc(sizeof(*global));
5287         if (global == NULL)
5288                 return NULL;
5289         dl_list_init(&global->p2p_srv_bonjour);
5290         dl_list_init(&global->p2p_srv_upnp);
5291         global->params.daemonize = params->daemonize;
5292         global->params.wait_for_monitor = params->wait_for_monitor;
5293         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5294         if (params->pid_file)
5295                 global->params.pid_file = os_strdup(params->pid_file);
5296         if (params->ctrl_interface)
5297                 global->params.ctrl_interface =
5298                         os_strdup(params->ctrl_interface);
5299         if (params->ctrl_interface_group)
5300                 global->params.ctrl_interface_group =
5301                         os_strdup(params->ctrl_interface_group);
5302         if (params->override_driver)
5303                 global->params.override_driver =
5304                         os_strdup(params->override_driver);
5305         if (params->override_ctrl_interface)
5306                 global->params.override_ctrl_interface =
5307                         os_strdup(params->override_ctrl_interface);
5308 #ifdef CONFIG_MATCH_IFACE
5309         global->params.match_iface_count = params->match_iface_count;
5310         if (params->match_iface_count) {
5311                 global->params.match_ifaces =
5312                         os_calloc(params->match_iface_count,
5313                                   sizeof(struct wpa_interface));
5314                 os_memcpy(global->params.match_ifaces,
5315                           params->match_ifaces,
5316                           params->match_iface_count *
5317                           sizeof(struct wpa_interface));
5318         }
5319 #endif /* CONFIG_MATCH_IFACE */
5320 #ifdef CONFIG_P2P
5321         if (params->conf_p2p_dev)
5322                 global->params.conf_p2p_dev =
5323                         os_strdup(params->conf_p2p_dev);
5324 #endif /* CONFIG_P2P */
5325         wpa_debug_level = global->params.wpa_debug_level =
5326                 params->wpa_debug_level;
5327         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5328                 params->wpa_debug_show_keys;
5329         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5330                 params->wpa_debug_timestamp;
5331
5332         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5333
5334         if (eloop_init()) {
5335                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5336                 wpa_supplicant_deinit(global);
5337                 return NULL;
5338         }
5339
5340         random_init(params->entropy_file);
5341
5342         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5343         if (global->ctrl_iface == NULL) {
5344                 wpa_supplicant_deinit(global);
5345                 return NULL;
5346         }
5347
5348         if (wpas_notify_supplicant_initialized(global)) {
5349                 wpa_supplicant_deinit(global);
5350                 return NULL;
5351         }
5352
5353         for (i = 0; wpa_drivers[i]; i++)
5354                 global->drv_count++;
5355         if (global->drv_count == 0) {
5356                 wpa_printf(MSG_ERROR, "No drivers enabled");
5357                 wpa_supplicant_deinit(global);
5358                 return NULL;
5359         }
5360         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5361         if (global->drv_priv == NULL) {
5362                 wpa_supplicant_deinit(global);
5363                 return NULL;
5364         }
5365
5366 #ifdef CONFIG_WIFI_DISPLAY
5367         if (wifi_display_init(global) < 0) {
5368                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5369                 wpa_supplicant_deinit(global);
5370                 return NULL;
5371         }
5372 #endif /* CONFIG_WIFI_DISPLAY */
5373
5374         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5375                                wpas_periodic, global, NULL);
5376
5377         return global;
5378 }
5379
5380
5381 /**
5382  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5383  * @global: Pointer to global data from wpa_supplicant_init()
5384  * Returns: 0 after successful event loop run, -1 on failure
5385  *
5386  * This function starts the main event loop and continues running as long as
5387  * there are any remaining events. In most cases, this function is running as
5388  * long as the %wpa_supplicant process in still in use.
5389  */
5390 int wpa_supplicant_run(struct wpa_global *global)
5391 {
5392         struct wpa_supplicant *wpa_s;
5393
5394         if (global->params.daemonize &&
5395             (wpa_supplicant_daemon(global->params.pid_file) ||
5396              eloop_sock_requeue()))
5397                 return -1;
5398
5399 #ifdef CONFIG_MATCH_IFACE
5400         if (wpa_supplicant_match_existing(global))
5401                 return -1;
5402 #endif
5403
5404         if (global->params.wait_for_monitor) {
5405                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5406                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5407                                 wpa_supplicant_ctrl_iface_wait(
5408                                         wpa_s->ctrl_iface);
5409         }
5410
5411         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5412         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5413
5414         eloop_run();
5415
5416         return 0;
5417 }
5418
5419
5420 /**
5421  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5422  * @global: Pointer to global data from wpa_supplicant_init()
5423  *
5424  * This function is called to deinitialize %wpa_supplicant and to free all
5425  * allocated resources. Remaining network interfaces will also be removed.
5426  */
5427 void wpa_supplicant_deinit(struct wpa_global *global)
5428 {
5429         int i;
5430
5431         if (global == NULL)
5432                 return;
5433
5434         eloop_cancel_timeout(wpas_periodic, global, NULL);
5435
5436 #ifdef CONFIG_WIFI_DISPLAY
5437         wifi_display_deinit(global);
5438 #endif /* CONFIG_WIFI_DISPLAY */
5439
5440         while (global->ifaces)
5441                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5442
5443         if (global->ctrl_iface)
5444                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5445
5446         wpas_notify_supplicant_deinitialized(global);
5447
5448         eap_peer_unregister_methods();
5449 #ifdef CONFIG_AP
5450         eap_server_unregister_methods();
5451 #endif /* CONFIG_AP */
5452
5453         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5454                 if (!global->drv_priv[i])
5455                         continue;
5456                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5457         }
5458         os_free(global->drv_priv);
5459
5460         random_deinit();
5461
5462         eloop_destroy();
5463
5464         if (global->params.pid_file) {
5465                 os_daemonize_terminate(global->params.pid_file);
5466                 os_free(global->params.pid_file);
5467         }
5468         os_free(global->params.ctrl_interface);
5469         os_free(global->params.ctrl_interface_group);
5470         os_free(global->params.override_driver);
5471         os_free(global->params.override_ctrl_interface);
5472 #ifdef CONFIG_MATCH_IFACE
5473         os_free(global->params.match_ifaces);
5474 #endif /* CONFIG_MATCH_IFACE */
5475 #ifdef CONFIG_P2P
5476         os_free(global->params.conf_p2p_dev);
5477 #endif /* CONFIG_P2P */
5478
5479         os_free(global->p2p_disallow_freq.range);
5480         os_free(global->p2p_go_avoid_freq.range);
5481         os_free(global->add_psk);
5482
5483         os_free(global);
5484         wpa_debug_close_syslog();
5485         wpa_debug_close_file();
5486         wpa_debug_close_linux_tracing();
5487 }
5488
5489
5490 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5491 {
5492         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5493             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5494                 char country[3];
5495                 country[0] = wpa_s->conf->country[0];
5496                 country[1] = wpa_s->conf->country[1];
5497                 country[2] = '\0';
5498                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5499                         wpa_printf(MSG_ERROR, "Failed to set country code "
5500                                    "'%s'", country);
5501                 }
5502         }
5503
5504         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5505                 wpas_init_ext_pw(wpa_s);
5506
5507         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5508                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5509
5510 #ifdef CONFIG_WPS
5511         wpas_wps_update_config(wpa_s);
5512 #endif /* CONFIG_WPS */
5513         wpas_p2p_update_config(wpa_s);
5514         wpa_s->conf->changed_parameters = 0;
5515 }
5516
5517
5518 void add_freq(int *freqs, int *num_freqs, int freq)
5519 {
5520         int i;
5521
5522         for (i = 0; i < *num_freqs; i++) {
5523                 if (freqs[i] == freq)
5524                         return;
5525         }
5526
5527         freqs[*num_freqs] = freq;
5528         (*num_freqs)++;
5529 }
5530
5531
5532 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5533 {
5534         struct wpa_bss *bss, *cbss;
5535         const int max_freqs = 10;
5536         int *freqs;
5537         int num_freqs = 0;
5538
5539         freqs = os_calloc(max_freqs + 1, sizeof(int));
5540         if (freqs == NULL)
5541                 return NULL;
5542
5543         cbss = wpa_s->current_bss;
5544
5545         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5546                 if (bss == cbss)
5547                         continue;
5548                 if (bss->ssid_len == cbss->ssid_len &&
5549                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5550                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5551                         add_freq(freqs, &num_freqs, bss->freq);
5552                         if (num_freqs == max_freqs)
5553                                 break;
5554                 }
5555         }
5556
5557         if (num_freqs == 0) {
5558                 os_free(freqs);
5559                 freqs = NULL;
5560         }
5561
5562         return freqs;
5563 }
5564
5565
5566 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5567 {
5568         int timeout;
5569         int count;
5570         int *freqs = NULL;
5571
5572         wpas_connect_work_done(wpa_s);
5573
5574         /*
5575          * Remove possible authentication timeout since the connection failed.
5576          */
5577         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5578
5579         /*
5580          * There is no point in blacklisting the AP if this event is
5581          * generated based on local request to disconnect.
5582          */
5583         if (wpa_s->own_disconnect_req) {
5584                 wpa_s->own_disconnect_req = 0;
5585                 wpa_dbg(wpa_s, MSG_DEBUG,
5586                         "Ignore connection failure due to local request to disconnect");
5587                 return;
5588         }
5589         if (wpa_s->disconnected) {
5590                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5591                         "indication since interface has been put into "
5592                         "disconnected state");
5593                 return;
5594         }
5595
5596         /*
5597          * Add the failed BSSID into the blacklist and speed up next scan
5598          * attempt if there could be other APs that could accept association.
5599          * The current blacklist count indicates how many times we have tried
5600          * connecting to this AP and multiple attempts mean that other APs are
5601          * either not available or has already been tried, so that we can start
5602          * increasing the delay here to avoid constant scanning.
5603          */
5604         count = wpa_blacklist_add(wpa_s, bssid);
5605         if (count == 1 && wpa_s->current_bss) {
5606                 /*
5607                  * This BSS was not in the blacklist before. If there is
5608                  * another BSS available for the same ESS, we should try that
5609                  * next. Otherwise, we may as well try this one once more
5610                  * before allowing other, likely worse, ESSes to be considered.
5611                  */
5612                 freqs = get_bss_freqs_in_ess(wpa_s);
5613                 if (freqs) {
5614                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5615                                 "has been seen; try it next");
5616                         wpa_blacklist_add(wpa_s, bssid);
5617                         /*
5618                          * On the next scan, go through only the known channels
5619                          * used in this ESS based on previous scans to speed up
5620                          * common load balancing use case.
5621                          */
5622                         os_free(wpa_s->next_scan_freqs);
5623                         wpa_s->next_scan_freqs = freqs;
5624                 }
5625         }
5626
5627         /*
5628          * Add previous failure count in case the temporary blacklist was
5629          * cleared due to no other BSSes being available.
5630          */
5631         count += wpa_s->extra_blacklist_count;
5632
5633         if (count > 3 && wpa_s->current_ssid) {
5634                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5635                            "consider temporary network disabling");
5636                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5637         }
5638
5639         switch (count) {
5640         case 1:
5641                 timeout = 100;
5642                 break;
5643         case 2:
5644                 timeout = 500;
5645                 break;
5646         case 3:
5647                 timeout = 1000;
5648                 break;
5649         case 4:
5650                 timeout = 5000;
5651                 break;
5652         default:
5653                 timeout = 10000;
5654                 break;
5655         }
5656
5657         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5658                 "ms", count, timeout);
5659
5660         /*
5661          * TODO: if more than one possible AP is available in scan results,
5662          * could try the other ones before requesting a new scan.
5663          */
5664         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5665                                 1000 * (timeout % 1000));
5666 }
5667
5668
5669 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5670 {
5671         return wpa_s->conf->ap_scan == 2 ||
5672                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5673 }
5674
5675
5676 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5677 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5678                                               struct wpa_ssid *ssid,
5679                                               const char *field,
5680                                               const char *value)
5681 {
5682 #ifdef IEEE8021X_EAPOL
5683         struct eap_peer_config *eap = &ssid->eap;
5684
5685         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5686         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5687                               (const u8 *) value, os_strlen(value));
5688
5689         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5690         case WPA_CTRL_REQ_EAP_IDENTITY:
5691                 os_free(eap->identity);
5692                 eap->identity = (u8 *) os_strdup(value);
5693                 eap->identity_len = os_strlen(value);
5694                 eap->pending_req_identity = 0;
5695                 if (ssid == wpa_s->current_ssid)
5696                         wpa_s->reassociate = 1;
5697                 break;
5698         case WPA_CTRL_REQ_EAP_PASSWORD:
5699                 bin_clear_free(eap->password, eap->password_len);
5700                 eap->password = (u8 *) os_strdup(value);
5701                 eap->password_len = os_strlen(value);
5702                 eap->pending_req_password = 0;
5703                 if (ssid == wpa_s->current_ssid)
5704                         wpa_s->reassociate = 1;
5705                 break;
5706         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5707                 bin_clear_free(eap->new_password, eap->new_password_len);
5708                 eap->new_password = (u8 *) os_strdup(value);
5709                 eap->new_password_len = os_strlen(value);
5710                 eap->pending_req_new_password = 0;
5711                 if (ssid == wpa_s->current_ssid)
5712                         wpa_s->reassociate = 1;
5713                 break;
5714         case WPA_CTRL_REQ_EAP_PIN:
5715                 str_clear_free(eap->pin);
5716                 eap->pin = os_strdup(value);
5717                 eap->pending_req_pin = 0;
5718                 if (ssid == wpa_s->current_ssid)
5719                         wpa_s->reassociate = 1;
5720                 break;
5721         case WPA_CTRL_REQ_EAP_OTP:
5722                 bin_clear_free(eap->otp, eap->otp_len);
5723                 eap->otp = (u8 *) os_strdup(value);
5724                 eap->otp_len = os_strlen(value);
5725                 os_free(eap->pending_req_otp);
5726                 eap->pending_req_otp = NULL;
5727                 eap->pending_req_otp_len = 0;
5728                 break;
5729         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5730                 str_clear_free(eap->private_key_passwd);
5731                 eap->private_key_passwd = os_strdup(value);
5732                 eap->pending_req_passphrase = 0;
5733                 if (ssid == wpa_s->current_ssid)
5734                         wpa_s->reassociate = 1;
5735                 break;
5736         case WPA_CTRL_REQ_SIM:
5737                 str_clear_free(eap->external_sim_resp);
5738                 eap->external_sim_resp = os_strdup(value);
5739                 break;
5740         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5741                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5742                         return -1;
5743                 ssid->mem_only_psk = 1;
5744                 if (ssid->passphrase)
5745                         wpa_config_update_psk(ssid);
5746                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5747                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5748                 break;
5749         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5750                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5751                         return -1;
5752                 if (os_strcmp(value, "good") == 0)
5753                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5754                 else if (os_strcmp(value, "bad") == 0)
5755                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5756                 else
5757                         return -1;
5758                 break;
5759         default:
5760                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5761                 return -1;
5762         }
5763
5764         return 0;
5765 #else /* IEEE8021X_EAPOL */
5766         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5767         return -1;
5768 #endif /* IEEE8021X_EAPOL */
5769 }
5770 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5771
5772
5773 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5774 {
5775         int i;
5776         unsigned int drv_enc;
5777
5778         if (wpa_s->p2p_mgmt)
5779                 return 1; /* no normal network profiles on p2p_mgmt interface */
5780
5781         if (ssid == NULL)
5782                 return 1;
5783
5784         if (ssid->disabled)
5785                 return 1;
5786
5787         if (wpa_s->drv_capa_known)
5788                 drv_enc = wpa_s->drv_enc;
5789         else
5790                 drv_enc = (unsigned int) -1;
5791
5792         for (i = 0; i < NUM_WEP_KEYS; i++) {
5793                 size_t len = ssid->wep_key_len[i];
5794                 if (len == 0)
5795                         continue;
5796                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5797                         continue;
5798                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5799                         continue;
5800                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5801                         continue;
5802                 return 1; /* invalid WEP key */
5803         }
5804
5805         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5806             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5807             !ssid->mem_only_psk)
5808                 return 1;
5809
5810         return 0;
5811 }
5812
5813
5814 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5815 {
5816 #ifdef CONFIG_IEEE80211W
5817         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5818                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5819                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5820                         /*
5821                          * Driver does not support BIP -- ignore pmf=1 default
5822                          * since the connection with PMF would fail and the
5823                          * configuration does not require PMF to be enabled.
5824                          */
5825                         return NO_MGMT_FRAME_PROTECTION;
5826                 }
5827
5828                 if (ssid &&
5829                     (ssid->key_mgmt &
5830                      ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
5831                        WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
5832                         /*
5833                          * Do not use the default PMF value for non-RSN networks
5834                          * since PMF is available only with RSN and pmf=2
5835                          * configuration would otherwise prevent connections to
5836                          * all open networks.
5837                          */
5838                         return NO_MGMT_FRAME_PROTECTION;
5839                 }
5840
5841                 return wpa_s->conf->pmf;
5842         }
5843
5844         return ssid->ieee80211w;
5845 #else /* CONFIG_IEEE80211W */
5846         return NO_MGMT_FRAME_PROTECTION;
5847 #endif /* CONFIG_IEEE80211W */
5848 }
5849
5850
5851 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5852 {
5853         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5854                 return 1;
5855         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5856                 return 0;
5857         return -1;
5858 }
5859
5860
5861 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5862 {
5863         struct wpa_ssid *ssid = wpa_s->current_ssid;
5864         int dur;
5865         struct os_reltime now;
5866
5867         if (ssid == NULL) {
5868                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5869                            "SSID block");
5870                 return;
5871         }
5872
5873         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5874                 return;
5875
5876         ssid->auth_failures++;
5877
5878 #ifdef CONFIG_P2P
5879         if (ssid->p2p_group &&
5880             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5881                 /*
5882                  * Skip the wait time since there is a short timeout on the
5883                  * connection to a P2P group.
5884                  */
5885                 return;
5886         }
5887 #endif /* CONFIG_P2P */
5888
5889         if (ssid->auth_failures > 50)
5890                 dur = 300;
5891         else if (ssid->auth_failures > 10)
5892                 dur = 120;
5893         else if (ssid->auth_failures > 5)
5894                 dur = 90;
5895         else if (ssid->auth_failures > 3)
5896                 dur = 60;
5897         else if (ssid->auth_failures > 2)
5898                 dur = 30;
5899         else if (ssid->auth_failures > 1)
5900                 dur = 20;
5901         else
5902                 dur = 10;
5903
5904         if (ssid->auth_failures > 1 &&
5905             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5906                 dur += os_random() % (ssid->auth_failures * 10);
5907
5908         os_get_reltime(&now);
5909         if (now.sec + dur <= ssid->disabled_until.sec)
5910                 return;
5911
5912         ssid->disabled_until.sec = now.sec + dur;
5913
5914         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5915                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5916                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5917                 ssid->auth_failures, dur, reason);
5918 }
5919
5920
5921 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5922                               struct wpa_ssid *ssid, int clear_failures)
5923 {
5924         if (ssid == NULL)
5925                 return;
5926
5927         if (ssid->disabled_until.sec) {
5928                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5929                         "id=%d ssid=\"%s\"",
5930                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5931         }
5932         ssid->disabled_until.sec = 0;
5933         ssid->disabled_until.usec = 0;
5934         if (clear_failures)
5935                 ssid->auth_failures = 0;
5936 }
5937
5938
5939 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5940 {
5941         size_t i;
5942
5943         if (wpa_s->disallow_aps_bssid == NULL)
5944                 return 0;
5945
5946         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5947                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5948                               bssid, ETH_ALEN) == 0)
5949                         return 1;
5950         }
5951
5952         return 0;
5953 }
5954
5955
5956 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5957                     size_t ssid_len)
5958 {
5959         size_t i;
5960
5961         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5962                 return 0;
5963
5964         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5965                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5966                 if (ssid_len == s->ssid_len &&
5967                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5968                         return 1;
5969         }
5970
5971         return 0;
5972 }
5973
5974
5975 /**
5976  * wpas_request_connection - Request a new connection
5977  * @wpa_s: Pointer to the network interface
5978  *
5979  * This function is used to request a new connection to be found. It will mark
5980  * the interface to allow reassociation and request a new scan to find a
5981  * suitable network to connect to.
5982  */
5983 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5984 {
5985         wpa_s->normal_scans = 0;
5986         wpa_s->scan_req = NORMAL_SCAN_REQ;
5987         wpa_supplicant_reinit_autoscan(wpa_s);
5988         wpa_s->extra_blacklist_count = 0;
5989         wpa_s->disconnected = 0;
5990         wpa_s->reassociate = 1;
5991
5992         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5993                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5994         else
5995                 wpa_s->reattach = 0;
5996 }
5997
5998
5999 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
6000                     struct wpa_used_freq_data *freqs_data,
6001                     unsigned int len)
6002 {
6003         unsigned int i;
6004
6005         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
6006                 len, title);
6007         for (i = 0; i < len; i++) {
6008                 struct wpa_used_freq_data *cur = &freqs_data[i];
6009                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
6010                         i, cur->freq, cur->flags);
6011         }
6012 }
6013
6014
6015 /*
6016  * Find the operating frequencies of any of the virtual interfaces that
6017  * are using the same radio as the current interface, and in addition, get
6018  * information about the interface types that are using the frequency.
6019  */
6020 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6021                                 struct wpa_used_freq_data *freqs_data,
6022                                 unsigned int len)
6023 {
6024         struct wpa_supplicant *ifs;
6025         u8 bssid[ETH_ALEN];
6026         int freq;
6027         unsigned int idx = 0, i;
6028
6029         wpa_dbg(wpa_s, MSG_DEBUG,
6030                 "Determining shared radio frequencies (max len %u)", len);
6031         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6032
6033         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6034                          radio_list) {
6035                 if (idx == len)
6036                         break;
6037
6038                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6039                         continue;
6040
6041                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6042                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6043                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6044                         freq = ifs->current_ssid->frequency;
6045                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6046                         freq = ifs->assoc_freq;
6047                 else
6048                         continue;
6049
6050                 /* Hold only distinct freqs */
6051                 for (i = 0; i < idx; i++)
6052                         if (freqs_data[i].freq == freq)
6053                                 break;
6054
6055                 if (i == idx)
6056                         freqs_data[idx++].freq = freq;
6057
6058                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6059                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6060                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6061                                 WPA_FREQ_USED_BY_INFRA_STATION;
6062                 }
6063         }
6064
6065         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6066         return idx;
6067 }
6068
6069
6070 /*
6071  * Find the operating frequencies of any of the virtual interfaces that
6072  * are using the same radio as the current interface.
6073  */
6074 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6075                            int *freq_array, unsigned int len)
6076 {
6077         struct wpa_used_freq_data *freqs_data;
6078         int num, i;
6079
6080         os_memset(freq_array, 0, sizeof(int) * len);
6081
6082         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6083         if (!freqs_data)
6084                 return -1;
6085
6086         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6087         for (i = 0; i < num; i++)
6088                 freq_array[i] = freqs_data[i].freq;
6089
6090         os_free(freqs_data);
6091
6092         return num;
6093 }
6094
6095
6096 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6097 {
6098         struct rrm_data *rrm = data;
6099
6100         if (!rrm->notify_neighbor_rep) {
6101                 wpa_printf(MSG_ERROR,
6102                            "RRM: Unexpected neighbor report timeout");
6103                 return;
6104         }
6105
6106         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6107         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6108
6109         rrm->notify_neighbor_rep = NULL;
6110         rrm->neighbor_rep_cb_ctx = NULL;
6111 }
6112
6113
6114 /*
6115  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6116  * @wpa_s: Pointer to wpa_supplicant
6117  */
6118 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6119 {
6120         wpa_s->rrm.rrm_used = 0;
6121
6122         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6123                              NULL);
6124         if (wpa_s->rrm.notify_neighbor_rep)
6125                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6126         wpa_s->rrm.next_neighbor_rep_token = 1;
6127 }
6128
6129
6130 /*
6131  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6132  * @wpa_s: Pointer to wpa_supplicant
6133  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6134  * @report_len: Length of neighbor report buffer
6135  */
6136 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6137                                    const u8 *report, size_t report_len)
6138 {
6139         struct wpabuf *neighbor_rep;
6140
6141         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6142         if (report_len < 1)
6143                 return;
6144
6145         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6146                 wpa_printf(MSG_DEBUG,
6147                            "RRM: Discarding neighbor report with token %d (expected %d)",
6148                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6149                 return;
6150         }
6151
6152         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6153                              NULL);
6154
6155         if (!wpa_s->rrm.notify_neighbor_rep) {
6156                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6157                 return;
6158         }
6159
6160         /* skipping the first byte, which is only an id (dialog token) */
6161         neighbor_rep = wpabuf_alloc(report_len - 1);
6162         if (neighbor_rep == NULL)
6163                 return;
6164         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6165         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6166                    report[0]);
6167         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6168                                        neighbor_rep);
6169         wpa_s->rrm.notify_neighbor_rep = NULL;
6170         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6171 }
6172
6173
6174 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6175 /* Workaround different, undefined for Windows, error codes used here */
6176 #define ENOTCONN -1
6177 #define EOPNOTSUPP -1
6178 #define ECANCELED -1
6179 #endif
6180
6181 /* Measurement Request element + Location Subject + Maximum Age subelement */
6182 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
6183 /* Measurement Request element + Location Civic Request */
6184 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
6185
6186
6187 /**
6188  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6189  * @wpa_s: Pointer to wpa_supplicant
6190  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6191  *        is sent in the request.
6192  * @lci: if set, neighbor request will include LCI request
6193  * @civic: if set, neighbor request will include civic location request
6194  * @cb: Callback function to be called once the requested report arrives, or
6195  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6196  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6197  *      the requester's responsibility to free it.
6198  *      In the latter case NULL will be sent in 'neighbor_rep'.
6199  * @cb_ctx: Context value to send the callback function
6200  * Returns: 0 in case of success, negative error code otherwise
6201  *
6202  * In case there is a previous request which has not been answered yet, the
6203  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6204  * Request must contain a callback function.
6205  */
6206 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6207                                        const struct wpa_ssid_value *ssid,
6208                                        int lci, int civic,
6209                                        void (*cb)(void *ctx,
6210                                                   struct wpabuf *neighbor_rep),
6211                                        void *cb_ctx)
6212 {
6213         struct wpabuf *buf;
6214         const u8 *rrm_ie;
6215
6216         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6217                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6218                 return -ENOTCONN;
6219         }
6220
6221         if (!wpa_s->rrm.rrm_used) {
6222                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6223                 return -EOPNOTSUPP;
6224         }
6225
6226         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6227                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6228         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6229             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6230                 wpa_printf(MSG_DEBUG,
6231                            "RRM: No network support for Neighbor Report.");
6232                 return -EOPNOTSUPP;
6233         }
6234
6235         if (!cb) {
6236                 wpa_printf(MSG_DEBUG,
6237                            "RRM: Neighbor Report request must provide a callback.");
6238                 return -EINVAL;
6239         }
6240
6241         /* Refuse if there's a live request */
6242         if (wpa_s->rrm.notify_neighbor_rep) {
6243                 wpa_printf(MSG_DEBUG,
6244                            "RRM: Currently handling previous Neighbor Report.");
6245                 return -EBUSY;
6246         }
6247
6248         /* 3 = action category + action code + dialog token */
6249         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
6250                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
6251                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
6252         if (buf == NULL) {
6253                 wpa_printf(MSG_DEBUG,
6254                            "RRM: Failed to allocate Neighbor Report Request");
6255                 return -ENOMEM;
6256         }
6257
6258         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6259                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6260                    wpa_s->rrm.next_neighbor_rep_token);
6261
6262         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6263         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6264         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6265         if (ssid) {
6266                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6267                 wpabuf_put_u8(buf, ssid->ssid_len);
6268                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6269         }
6270
6271         if (lci) {
6272                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6273                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6274                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
6275
6276                 /*
6277                  * Measurement token; nonzero number that is unique among the
6278                  * Measurement Request elements in a particular frame.
6279                  */
6280                 wpabuf_put_u8(buf, 1); /* Measurement Token */
6281
6282                 /*
6283                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6284                  * reserved.
6285                  */
6286                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6287                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
6288
6289                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
6290                 /* Location Subject */
6291                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6292
6293                 /* Optional Subelements */
6294                 /*
6295                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
6296                  * The Maximum Age subelement is required, otherwise the AP can
6297                  * send only data that was determined after receiving the
6298                  * request. Setting it here to unlimited age.
6299                  */
6300                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
6301                 wpabuf_put_u8(buf, 2);
6302                 wpabuf_put_le16(buf, 0xffff);
6303         }
6304
6305         if (civic) {
6306                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6307                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6308                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
6309
6310                 /*
6311                  * Measurement token; nonzero number that is unique among the
6312                  * Measurement Request elements in a particular frame.
6313                  */
6314                 wpabuf_put_u8(buf, 2); /* Measurement Token */
6315
6316                 /*
6317                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6318                  * reserved.
6319                  */
6320                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6321                 /* Measurement Type */
6322                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
6323
6324                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
6325                  * Location Civic request */
6326                 /* Location Subject */
6327                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6328                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
6329                 /* Location Service Interval Units: Seconds */
6330                 wpabuf_put_u8(buf, 0);
6331                 /* Location Service Interval: 0 - Only one report is requested
6332                  */
6333                 wpabuf_put_le16(buf, 0);
6334                 /* No optional subelements */
6335         }
6336
6337         wpa_s->rrm.next_neighbor_rep_token++;
6338
6339         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6340                                 wpa_s->own_addr, wpa_s->bssid,
6341                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6342                 wpa_printf(MSG_DEBUG,
6343                            "RRM: Failed to send Neighbor Report Request");
6344                 wpabuf_free(buf);
6345                 return -ECANCELED;
6346         }
6347
6348         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6349         wpa_s->rrm.notify_neighbor_rep = cb;
6350         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6351                                wpas_rrm_neighbor_rep_timeout_handler,
6352                                &wpa_s->rrm, NULL);
6353
6354         wpabuf_free(buf);
6355         return 0;
6356 }
6357
6358
6359 static struct wpabuf * wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
6360                                                  const u8 *request, size_t len,
6361                                                  struct wpabuf *report)
6362 {
6363         u8 token, type, subject;
6364         u16 max_age = 0;
6365         struct os_reltime t, diff;
6366         unsigned long diff_l;
6367         u8 *ptoken;
6368         const u8 *subelem;
6369
6370         if (!wpa_s->lci || len < 3 + 4)
6371                 return report;
6372
6373         token = *request++;
6374         /* Measurement request mode isn't used */
6375         request++;
6376         type = *request++;
6377         subject = *request++;
6378
6379         wpa_printf(MSG_DEBUG,
6380                    "Measurement request token %u type %u location subject %u",
6381                    token, type, subject);
6382
6383         if (type != MEASURE_TYPE_LCI || subject != LOCATION_SUBJECT_REMOTE) {
6384                 wpa_printf(MSG_INFO,
6385                            "Not building LCI report - bad type or location subject");
6386                 return report;
6387         }
6388
6389         /* Subelements are formatted exactly like elements */
6390         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
6391         if (subelem && subelem[1] == 2)
6392                 max_age = WPA_GET_LE16(subelem + 2);
6393
6394         if (os_get_reltime(&t))
6395                 return report;
6396
6397         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
6398         /* LCI age is calculated in 10th of a second units. */
6399         diff_l = diff.sec * 10 + diff.usec / 100000;
6400
6401         if (max_age != 0xffff && max_age < diff_l)
6402                 return report;
6403
6404         if (wpabuf_resize(&report, 2 + wpabuf_len(wpa_s->lci)))
6405                 return report;
6406
6407         wpabuf_put_u8(report, WLAN_EID_MEASURE_REPORT);
6408         wpabuf_put_u8(report, wpabuf_len(wpa_s->lci));
6409         /* We'll override user's measurement token */
6410         ptoken = wpabuf_put(report, 0);
6411         wpabuf_put_buf(report, wpa_s->lci);
6412         *ptoken = token;
6413
6414         return report;
6415 }
6416
6417
6418 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
6419                                                const u8 *src,
6420                                                const u8 *frame, size_t len)
6421 {
6422         struct wpabuf *buf, *report;
6423         u8 token;
6424         const u8 *ie, *end;
6425
6426         if (wpa_s->wpa_state != WPA_COMPLETED) {
6427                 wpa_printf(MSG_INFO,
6428                            "RRM: Ignoring radio measurement request: Not associated");
6429                 return;
6430         }
6431
6432         if (!wpa_s->rrm.rrm_used) {
6433                 wpa_printf(MSG_INFO,
6434                            "RRM: Ignoring radio measurement request: Not RRM network");
6435                 return;
6436         }
6437
6438         if (len < 3) {
6439                 wpa_printf(MSG_INFO,
6440                            "RRM: Ignoring too short radio measurement request");
6441                 return;
6442         }
6443
6444         end = frame + len;
6445
6446         token = *frame++;
6447
6448         /* Ignore number of repetitions because it's not used in LCI request */
6449         frame += 2;
6450
6451         report = NULL;
6452         while ((ie = get_ie(frame, end - frame, WLAN_EID_MEASURE_REQUEST)) &&
6453                ie[1] >= 3) {
6454                 u8 msmt_type;
6455
6456                 msmt_type = ie[4];
6457                 wpa_printf(MSG_DEBUG, "RRM request %d", msmt_type);
6458
6459                 switch (msmt_type) {
6460                 case MEASURE_TYPE_LCI:
6461                         report = wpas_rrm_build_lci_report(wpa_s, ie + 2, ie[1],
6462                                                            report);
6463                         break;
6464                 default:
6465                         wpa_printf(MSG_INFO,
6466                                    "RRM: Unsupported radio measurement request %d",
6467                                    msmt_type);
6468                         break;
6469                 }
6470
6471                 frame = ie + ie[1] + 2;
6472         }
6473
6474         if (!report)
6475                 return;
6476
6477         buf = wpabuf_alloc(3 + wpabuf_len(report));
6478         if (!buf) {
6479                 wpabuf_free(report);
6480                 return;
6481         }
6482
6483         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6484         wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
6485         wpabuf_put_u8(buf, token);
6486
6487         wpabuf_put_buf(buf, report);
6488         wpabuf_free(report);
6489
6490         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6491                                 wpa_s->own_addr, wpa_s->bssid,
6492                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6493                 wpa_printf(MSG_ERROR,
6494                            "RRM: Radio measurement report failed: Sending Action frame failed");
6495         }
6496         wpabuf_free(buf);
6497 }
6498
6499
6500 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6501                                               const u8 *src,
6502                                               const u8 *frame, size_t len,
6503                                               int rssi)
6504 {
6505         struct wpabuf *buf;
6506         const struct rrm_link_measurement_request *req;
6507         struct rrm_link_measurement_report report;
6508
6509         if (wpa_s->wpa_state != WPA_COMPLETED) {
6510                 wpa_printf(MSG_INFO,
6511                            "RRM: Ignoring link measurement request. Not associated");
6512                 return;
6513         }
6514
6515         if (!wpa_s->rrm.rrm_used) {
6516                 wpa_printf(MSG_INFO,
6517                            "RRM: Ignoring link measurement request. Not RRM network");
6518                 return;
6519         }
6520
6521         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6522                 wpa_printf(MSG_INFO,
6523                            "RRM: Measurement report failed. TX power insertion not supported");
6524                 return;
6525         }
6526
6527         req = (const struct rrm_link_measurement_request *) frame;
6528         if (len < sizeof(*req)) {
6529                 wpa_printf(MSG_INFO,
6530                            "RRM: Link measurement report failed. Request too short");
6531                 return;
6532         }
6533
6534         os_memset(&report, 0, sizeof(report));
6535         report.tpc.eid = WLAN_EID_TPC_REPORT;
6536         report.tpc.len = 2;
6537         report.rsni = 255; /* 255 indicates that RSNI is not available */
6538         report.dialog_token = req->dialog_token;
6539
6540         /*
6541          * It's possible to estimate RCPI based on RSSI in dBm. This
6542          * calculation will not reflect the correct value for high rates,
6543          * but it's good enough for Action frames which are transmitted
6544          * with up to 24 Mbps rates.
6545          */
6546         if (!rssi)
6547                 report.rcpi = 255; /* not available */
6548         else if (rssi < -110)
6549                 report.rcpi = 0;
6550         else if (rssi > 0)
6551                 report.rcpi = 220;
6552         else
6553                 report.rcpi = (rssi + 110) * 2;
6554
6555         /* action_category + action_code */
6556         buf = wpabuf_alloc(2 + sizeof(report));
6557         if (buf == NULL) {
6558                 wpa_printf(MSG_ERROR,
6559                            "RRM: Link measurement report failed. Buffer allocation failed");
6560                 return;
6561         }
6562
6563         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6564         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6565         wpabuf_put_data(buf, &report, sizeof(report));
6566         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6567                     wpabuf_head(buf), wpabuf_len(buf));
6568
6569         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6570                                 wpa_s->own_addr, wpa_s->bssid,
6571                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6572                 wpa_printf(MSG_ERROR,
6573                            "RRM: Link measurement report failed. Send action failed");
6574         }
6575         wpabuf_free(buf);
6576 }
6577
6578
6579 struct wpa_supplicant *
6580 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6581 {
6582         switch (frame) {
6583 #ifdef CONFIG_P2P
6584         case VENDOR_ELEM_PROBE_REQ_P2P:
6585         case VENDOR_ELEM_PROBE_RESP_P2P:
6586         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6587         case VENDOR_ELEM_BEACON_P2P_GO:
6588         case VENDOR_ELEM_P2P_PD_REQ:
6589         case VENDOR_ELEM_P2P_PD_RESP:
6590         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6591         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6592         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6593         case VENDOR_ELEM_P2P_INV_REQ:
6594         case VENDOR_ELEM_P2P_INV_RESP:
6595         case VENDOR_ELEM_P2P_ASSOC_REQ:
6596         case VENDOR_ELEM_P2P_ASSOC_RESP:
6597                 return wpa_s->p2pdev;
6598 #endif /* CONFIG_P2P */
6599         default:
6600                 return wpa_s;
6601         }
6602 }
6603
6604
6605 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6606 {
6607         unsigned int i;
6608         char buf[30];
6609
6610         wpa_printf(MSG_DEBUG, "Update vendor elements");
6611
6612         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6613                 if (wpa_s->vendor_elem[i]) {
6614                         int res;
6615
6616                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6617                         if (!os_snprintf_error(sizeof(buf), res)) {
6618                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6619                                                 wpa_s->vendor_elem[i]);
6620                         }
6621                 }
6622         }
6623
6624 #ifdef CONFIG_P2P
6625         if (wpa_s->parent == wpa_s &&
6626             wpa_s->global->p2p &&
6627             !wpa_s->global->p2p_disabled)
6628                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6629 #endif /* CONFIG_P2P */
6630 }
6631
6632
6633 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6634                             const u8 *elem, size_t len)
6635 {
6636         u8 *ie, *end;
6637
6638         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6639         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6640
6641         for (; ie + 1 < end; ie += 2 + ie[1]) {
6642                 if (ie + len > end)
6643                         break;
6644                 if (os_memcmp(ie, elem, len) != 0)
6645                         continue;
6646
6647                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6648                         wpabuf_free(wpa_s->vendor_elem[frame]);
6649                         wpa_s->vendor_elem[frame] = NULL;
6650                 } else {
6651                         os_memmove(ie, ie + len, end - (ie + len));
6652                         wpa_s->vendor_elem[frame]->used -= len;
6653                 }
6654                 wpas_vendor_elem_update(wpa_s);
6655                 return 0;
6656         }
6657
6658         return -1;
6659 }
6660
6661
6662 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6663                                    u16 num_modes, enum hostapd_hw_mode mode)
6664 {
6665         u16 i;
6666
6667         for (i = 0; i < num_modes; i++) {
6668                 if (modes[i].mode == mode)
6669                         return &modes[i];
6670         }
6671
6672         return NULL;
6673 }
6674
6675
6676 static struct
6677 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6678                                                  const u8 *bssid)
6679 {
6680         struct wpa_bss_tmp_disallowed *bss;
6681
6682         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6683                          struct wpa_bss_tmp_disallowed, list) {
6684                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6685                         return bss;
6686         }
6687
6688         return NULL;
6689 }
6690
6691
6692 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6693                           unsigned int sec)
6694 {
6695         struct wpa_bss_tmp_disallowed *bss;
6696         struct os_reltime until;
6697
6698         os_get_reltime(&until);
6699         until.sec += sec;
6700
6701         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6702         if (bss) {
6703                 bss->disallowed_until = until;
6704                 return;
6705         }
6706
6707         bss = os_malloc(sizeof(*bss));
6708         if (!bss) {
6709                 wpa_printf(MSG_DEBUG,
6710                            "Failed to allocate memory for temp disallow BSS");
6711                 return;
6712         }
6713
6714         bss->disallowed_until = until;
6715         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6716         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6717 }
6718
6719
6720 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6721 {
6722         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6723         struct os_reltime now, age;
6724
6725         os_get_reltime(&now);
6726
6727         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6728                          struct wpa_bss_tmp_disallowed, list) {
6729                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6730                         /* This BSS is not disallowed anymore */
6731                         dl_list_del(&tmp->list);
6732                         os_free(tmp);
6733                         continue;
6734                 }
6735                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6736                         bss = tmp;
6737                         break;
6738                 }
6739         }
6740         if (!bss)
6741                 return 0;
6742
6743         os_reltime_sub(&bss->disallowed_until, &now, &age);
6744         wpa_printf(MSG_DEBUG,
6745                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6746                    MAC2STR(bss->bssid), age.sec, age.usec);
6747         return 1;
6748 }