wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548
 549         wpa_s->sched_scan_plans_num = 0;
 550         os_free(wpa_s->sched_scan_plans);
 551         wpa_s->sched_scan_plans = NULL;
 552 }
 553
 554
 555 /**
 556  * wpa_clear_keys - Clear keys configured for the driver
 557  * @wpa_s: Pointer to wpa_supplicant data
 558  * @addr: Previously used BSSID or %NULL if not available
 559  *
 560  * This function clears the encryption keys that has been previously configured
 561  * for the driver.
 562  */
 563 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 564 {
 565         int i, max;
 566
 567 #ifdef CONFIG_IEEE80211W
 568         max = 6;
 569 #else /* CONFIG_IEEE80211W */
 570         max = 4;
 571 #endif /* CONFIG_IEEE80211W */
 572
 573         /* MLME-DELETEKEYS.request */
 574         for (i = 0; i < max; i++) {
 575                 if (wpa_s->keys_cleared & BIT(i))
 576                         continue;
 577                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 578                                 NULL, 0);
 579         }
 580         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 581             !is_zero_ether_addr(addr)) {
 582                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 583                                 0);
 584                 /* MLME-SETPROTECTION.request(None) */
 585                 wpa_drv_mlme_setprotection(
 586                         wpa_s, addr,
 587                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 588                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 589         }
 590         wpa_s->keys_cleared = (u32) -1;
 591 }
 592
 593
 594 /**
 595  * wpa_supplicant_state_txt - Get the connection state name as a text string
 596  * @state: State (wpa_state; WPA_*)
 597  * Returns: The state name as a printable text string
 598  */
 599 const char * wpa_supplicant_state_txt(enum wpa_states state)
 600 {
 601         switch (state) {
 602         case WPA_DISCONNECTED:
 603                 return "DISCONNECTED";
 604         case WPA_INACTIVE:
 605                 return "INACTIVE";
 606         case WPA_INTERFACE_DISABLED:
 607                 return "INTERFACE_DISABLED";
 608         case WPA_SCANNING:
 609                 return "SCANNING";
 610         case WPA_AUTHENTICATING:
 611                 return "AUTHENTICATING";
 612         case WPA_ASSOCIATING:
 613                 return "ASSOCIATING";
 614         case WPA_ASSOCIATED:
 615                 return "ASSOCIATED";
 616         case WPA_4WAY_HANDSHAKE:
 617                 return "4WAY_HANDSHAKE";
 618         case WPA_GROUP_HANDSHAKE:
 619                 return "GROUP_HANDSHAKE";
 620         case WPA_COMPLETED:
 621                 return "COMPLETED";
 622         default:
 623                 return "UNKNOWN";
 624         }
 625 }
 626
 627
 628 #ifdef CONFIG_BGSCAN
 629
 630 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 631 {
 632         const char *name;
 633
 634         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 635                 name = wpa_s->current_ssid->bgscan;
 636         else
 637                 name = wpa_s->conf->bgscan;
 638         if (name == NULL || name[0] == '\0')
 639                 return;
 640         if (wpas_driver_bss_selection(wpa_s))
 641                 return;
 642         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 643                 return;
 644 #ifdef CONFIG_P2P
 645         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 646                 return;
 647 #endif /* CONFIG_P2P */
 648
 649         bgscan_deinit(wpa_s);
 650         if (wpa_s->current_ssid) {
 651                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 652                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 653                                 "bgscan");
 654                         /*
 655                          * Live without bgscan; it is only used as a roaming
 656                          * optimization, so the initial connection is not
 657                          * affected.
 658                          */
 659                 } else {
 660                         struct wpa_scan_results *scan_res;
 661                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 662                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 663                                                                    0);
 664                         if (scan_res) {
 665                                 bgscan_notify_scan(wpa_s, scan_res);
 666                                 wpa_scan_results_free(scan_res);
 667                         }
 668                 }
 669         } else
 670                 wpa_s->bgscan_ssid = NULL;
 671 }
 672
 673
 674 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 675 {
 676         if (wpa_s->bgscan_ssid != NULL) {
 677                 bgscan_deinit(wpa_s);
 678                 wpa_s->bgscan_ssid = NULL;
 679         }
 680 }
 681
 682 #endif /* CONFIG_BGSCAN */
 683
 684
 685 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 686 {
 687         if (autoscan_init(wpa_s, 0))
 688                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 689 }
 690
 691
 692 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 693 {
 694         autoscan_deinit(wpa_s);
 695 }
 696
 697
 698 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 699 {
 700         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 701             wpa_s->wpa_state == WPA_SCANNING) {
 702                 autoscan_deinit(wpa_s);
 703                 wpa_supplicant_start_autoscan(wpa_s);
 704         }
 705 }
 706
 707
 708 /**
 709  * wpa_supplicant_set_state - Set current connection state
 710  * @wpa_s: Pointer to wpa_supplicant data
 711  * @state: The new connection state
 712  *
 713  * This function is called whenever the connection state changes, e.g.,
 714  * association is completed for WPA/WPA2 4-Way Handshake is started.
 715  */
 716 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 717                               enum wpa_states state)
 718 {
 719         enum wpa_states old_state = wpa_s->wpa_state;
 720
 721         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 722                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 723                 wpa_supplicant_state_txt(state));
 724
 725         if (state == WPA_INTERFACE_DISABLED) {
 726                 /* Assure normal scan when interface is restored */
 727                 wpa_s->normal_scans = 0;
 728         }
 729
 730         if (state == WPA_COMPLETED) {
 731                 wpas_connect_work_done(wpa_s);
 732                 /* Reinitialize normal_scan counter */
 733                 wpa_s->normal_scans = 0;
 734         }
 735
 736 #ifdef CONFIG_P2P
 737         /*
 738          * P2PS client has to reply to Probe Request frames received on the
 739          * group operating channel. Enable Probe Request frame reporting for
 740          * P2P connected client in case p2p_cli_probe configuration property is
 741          * set to 1.
 742          */
 743         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 744             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 745             wpa_s->current_ssid->p2p_group) {
 746                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 747                         wpa_dbg(wpa_s, MSG_DEBUG,
 748                                 "P2P: Enable CLI Probe Request RX reporting");
 749                         wpa_s->p2p_cli_probe =
 750                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 751                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 752                         wpa_dbg(wpa_s, MSG_DEBUG,
 753                                 "P2P: Disable CLI Probe Request RX reporting");
 754                         wpa_s->p2p_cli_probe = 0;
 755                         wpa_drv_probe_req_report(wpa_s, 0);
 756                 }
 757         }
 758 #endif /* CONFIG_P2P */
 759
 760         if (state != WPA_SCANNING)
 761                 wpa_supplicant_notify_scanning(wpa_s, 0);
 762
 763         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 764                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 765 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 766                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 767                         MACSTR " completed [id=%d id_str=%s]",
 768                         MAC2STR(wpa_s->bssid),
 769                         ssid ? ssid->id : -1,
 770                         ssid && ssid->id_str ? ssid->id_str : "");
 771 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 772                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 773                 wpa_blacklist_clear(wpa_s);
 774                 wpa_s->extra_blacklist_count = 0;
 775                 wpa_s->new_connection = 0;
 776                 wpa_drv_set_operstate(wpa_s, 1);
 777 #ifndef IEEE8021X_EAPOL
 778                 wpa_drv_set_supp_port(wpa_s, 1);
 779 #endif /* IEEE8021X_EAPOL */
 780                 wpa_s->after_wps = 0;
 781                 wpa_s->known_wps_freq = 0;
 782                 wpas_p2p_completed(wpa_s);
 783
 784                 sme_sched_obss_scan(wpa_s, 1);
 785         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 786                    state == WPA_ASSOCIATED) {
 787                 wpa_s->new_connection = 1;
 788                 wpa_drv_set_operstate(wpa_s, 0);
 789 #ifndef IEEE8021X_EAPOL
 790                 wpa_drv_set_supp_port(wpa_s, 0);
 791 #endif /* IEEE8021X_EAPOL */
 792                 sme_sched_obss_scan(wpa_s, 0);
 793         }
 794         wpa_s->wpa_state = state;
 795
 796 #ifdef CONFIG_BGSCAN
 797         if (state == WPA_COMPLETED)
 798                 wpa_supplicant_start_bgscan(wpa_s);
 799         else if (state < WPA_ASSOCIATED)
 800                 wpa_supplicant_stop_bgscan(wpa_s);
 801 #endif /* CONFIG_BGSCAN */
 802
 803         if (state == WPA_AUTHENTICATING)
 804                 wpa_supplicant_stop_autoscan(wpa_s);
 805
 806         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 807                 wpa_supplicant_start_autoscan(wpa_s);
 808
 809         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 810                 wmm_ac_notify_disassoc(wpa_s);
 811
 812         if (wpa_s->wpa_state != old_state) {
 813                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 814
 815                 /*
 816                  * Notify the P2P Device interface about a state change in one
 817                  * of the interfaces.
 818                  */
 819                 wpas_p2p_indicate_state_change(wpa_s);
 820
 821                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 822                     old_state == WPA_COMPLETED)
 823                         wpas_notify_auth_changed(wpa_s);
 824         }
 825 }
 826
 827
 828 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 829 {
 830         int pending = 0;
 831 #ifdef CONFIG_WPS
 832         struct wpa_supplicant *wpa_s = global->ifaces;
 833         while (wpa_s) {
 834                 struct wpa_supplicant *next = wpa_s->next;
 835                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 836                         pending = 1;
 837 #ifdef CONFIG_P2P
 838                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 839                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 840                         wpas_p2p_disconnect(wpa_s);
 841 #endif /* CONFIG_P2P */
 842                 wpa_s = next;
 843         }
 844 #endif /* CONFIG_WPS */
 845         if (pending)
 846                 return;
 847         eloop_terminate();
 848 }
 849
 850
 851 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 852 {
 853         struct wpa_global *global = signal_ctx;
 854         wpa_supplicant_terminate_proc(global);
 855 }
 856
 857
 858 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 859 {
 860         enum wpa_states old_state = wpa_s->wpa_state;
 861
 862         wpa_s->pairwise_cipher = 0;
 863         wpa_s->group_cipher = 0;
 864         wpa_s->mgmt_group_cipher = 0;
 865         wpa_s->key_mgmt = 0;
 866         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 867                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 868
 869         if (wpa_s->wpa_state != old_state)
 870                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 871 }
 872
 873
 874 /**
 875  * wpa_supplicant_reload_configuration - Reload configuration data
 876  * @wpa_s: Pointer to wpa_supplicant data
 877  * Returns: 0 on success or -1 if configuration parsing failed
 878  *
 879  * This function can be used to request that the configuration data is reloaded
 880  * (e.g., after configuration file change). This function is reloading
 881  * configuration only for one interface, so this may need to be called multiple
 882  * times if %wpa_supplicant is controlling multiple interfaces and all
 883  * interfaces need reconfiguration.
 884  */
 885 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 886 {
 887         struct wpa_config *conf;
 888         int reconf_ctrl;
 889         int old_ap_scan;
 890
 891         if (wpa_s->confname == NULL)
 892                 return -1;
 893         conf = wpa_config_read(wpa_s->confname, NULL);
 894         if (conf == NULL) {
 895                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 896                         "file '%s' - exiting", wpa_s->confname);
 897                 return -1;
 898         }
 899         wpa_config_read(wpa_s->confanother, conf);
 900
 901         conf->changed_parameters = (unsigned int) -1;
 902
 903         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 904                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 905                     os_strcmp(conf->ctrl_interface,
 906                               wpa_s->conf->ctrl_interface) != 0);
 907
 908         if (reconf_ctrl && wpa_s->ctrl_iface) {
 909                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 910                 wpa_s->ctrl_iface = NULL;
 911         }
 912
 913         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 914         if (wpa_s->current_ssid) {
 915                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 916                         wpa_s->own_disconnect_req = 1;
 917                 wpa_supplicant_deauthenticate(wpa_s,
 918                                               WLAN_REASON_DEAUTH_LEAVING);
 919         }
 920
 921         /*
 922          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 923          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 924          */
 925         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 926                 /*
 927                  * Clear forced success to clear EAP state for next
 928                  * authentication.
 929                  */
 930                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 931         }
 932         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 933         wpa_sm_set_config(wpa_s->wpa, NULL);
 934         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 935         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 936         rsn_preauth_deinit(wpa_s->wpa);
 937
 938         old_ap_scan = wpa_s->conf->ap_scan;
 939         wpa_config_free(wpa_s->conf);
 940         wpa_s->conf = conf;
 941         if (old_ap_scan != wpa_s->conf->ap_scan)
 942                 wpas_notify_ap_scan_changed(wpa_s);
 943
 944         if (reconf_ctrl)
 945                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 946
 947         wpa_supplicant_update_config(wpa_s);
 948
 949         wpa_supplicant_clear_status(wpa_s);
 950         if (wpa_supplicant_enabled_networks(wpa_s)) {
 951                 wpa_s->reassociate = 1;
 952                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 953         }
 954         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 955         return 0;
 956 }
 957
 958
 959 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 960 {
 961         struct wpa_global *global = signal_ctx;
 962         struct wpa_supplicant *wpa_s;
 963         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 964                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 965                         sig);
 966                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 967                         wpa_supplicant_terminate_proc(global);
 968                 }
 969         }
 970
 971         if (wpa_debug_reopen_file() < 0) {
 972                 /* Ignore errors since we cannot really do much to fix this */
 973                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 974         }
 975 }
 976
 977
 978 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 979                                          struct wpa_ssid *ssid,
 980                                          struct wpa_ie_data *ie)
 981 {
 982         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 983         if (ret) {
 984                 if (ret == -2) {
 985                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 986                                 "from association info");
 987                 }
 988                 return -1;
 989         }
 990
 991         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 992                 "cipher suites");
 993         if (!(ie->group_cipher & ssid->group_cipher)) {
 994                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 995                         "cipher 0x%x (mask 0x%x) - reject",
 996                         ie->group_cipher, ssid->group_cipher);
 997                 return -1;
 998         }
 999         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1000                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1001                         "cipher 0x%x (mask 0x%x) - reject",
1002                         ie->pairwise_cipher, ssid->pairwise_cipher);
1003                 return -1;
1004         }
1005         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1007                         "management 0x%x (mask 0x%x) - reject",
1008                         ie->key_mgmt, ssid->key_mgmt);
1009                 return -1;
1010         }
1011
1012 #ifdef CONFIG_IEEE80211W
1013         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1014             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1015                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1016                         "that does not support management frame protection - "
1017                         "reject");
1018                 return -1;
1019         }
1020 #endif /* CONFIG_IEEE80211W */
1021
1022         return 0;
1023 }
1024
1025
1026 /**
1027  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1028  * @wpa_s: Pointer to wpa_supplicant data
1029  * @bss: Scan results for the selected BSS, or %NULL if not available
1030  * @ssid: Configuration data for the selected network
1031  * @wpa_ie: Buffer for the WPA/RSN IE
1032  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1033  * used buffer length in case the functions returns success.
1034  * Returns: 0 on success or -1 on failure
1035  *
1036  * This function is used to configure authentication and encryption parameters
1037  * based on the network configuration and scan result for the selected BSS (if
1038  * available).
1039  */
1040 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1041                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1042                               u8 *wpa_ie, size_t *wpa_ie_len)
1043 {
1044         struct wpa_ie_data ie;
1045         int sel, proto;
1046         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1047
1048         if (bss) {
1049                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1050                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1051                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1052         } else
1053                 bss_wpa = bss_rsn = bss_osen = NULL;
1054
1055         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1056             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1057             (ie.group_cipher & ssid->group_cipher) &&
1058             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1059             (ie.key_mgmt & ssid->key_mgmt)) {
1060                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1061                 proto = WPA_PROTO_RSN;
1062         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1063                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1064                    (ie.group_cipher & ssid->group_cipher) &&
1065                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1066                    (ie.key_mgmt & ssid->key_mgmt)) {
1067                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1068                 proto = WPA_PROTO_WPA;
1069 #ifdef CONFIG_HS20
1070         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1071                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1072                 /* TODO: parse OSEN element */
1073                 os_memset(&ie, 0, sizeof(ie));
1074                 ie.group_cipher = WPA_CIPHER_CCMP;
1075                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1076                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1077                 proto = WPA_PROTO_OSEN;
1078 #endif /* CONFIG_HS20 */
1079         } else if (bss) {
1080                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1081                 wpa_dbg(wpa_s, MSG_DEBUG,
1082                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1083                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1084                         ssid->key_mgmt);
1085                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1086                         MAC2STR(bss->bssid),
1087                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1088                         bss_wpa ? " WPA" : "",
1089                         bss_rsn ? " RSN" : "",
1090                         bss_osen ? " OSEN" : "");
1091                 if (bss_rsn) {
1092                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1093                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1094                                 wpa_dbg(wpa_s, MSG_DEBUG,
1095                                         "Could not parse RSN element");
1096                         } else {
1097                                 wpa_dbg(wpa_s, MSG_DEBUG,
1098                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1099                                         ie.pairwise_cipher, ie.group_cipher,
1100                                         ie.key_mgmt);
1101                         }
1102                 }
1103                 if (bss_wpa) {
1104                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1105                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1106                                 wpa_dbg(wpa_s, MSG_DEBUG,
1107                                         "Could not parse WPA element");
1108                         } else {
1109                                 wpa_dbg(wpa_s, MSG_DEBUG,
1110                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1111                                         ie.pairwise_cipher, ie.group_cipher,
1112                                         ie.key_mgmt);
1113                         }
1114                 }
1115                 return -1;
1116         } else {
1117                 if (ssid->proto & WPA_PROTO_OSEN)
1118                         proto = WPA_PROTO_OSEN;
1119                 else if (ssid->proto & WPA_PROTO_RSN)
1120                         proto = WPA_PROTO_RSN;
1121                 else
1122                         proto = WPA_PROTO_WPA;
1123                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1124                         os_memset(&ie, 0, sizeof(ie));
1125                         ie.group_cipher = ssid->group_cipher;
1126                         ie.pairwise_cipher = ssid->pairwise_cipher;
1127                         ie.key_mgmt = ssid->key_mgmt;
1128 #ifdef CONFIG_IEEE80211W
1129                         ie.mgmt_group_cipher =
1130                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1131                                 WPA_CIPHER_AES_128_CMAC : 0;
1132 #endif /* CONFIG_IEEE80211W */
1133                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1134                                 "based on configuration");
1135                 } else
1136                         proto = ie.proto;
1137         }
1138
1139         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1140                 "pairwise %d key_mgmt %d proto %d",
1141                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1142 #ifdef CONFIG_IEEE80211W
1143         if (ssid->ieee80211w) {
1144                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1145                         ie.mgmt_group_cipher);
1146         }
1147 #endif /* CONFIG_IEEE80211W */
1148
1149         wpa_s->wpa_proto = proto;
1150         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1151         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1152                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1153
1154         if (bss || !wpa_s->ap_ies_from_associnfo) {
1155                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1156                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1157                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1158                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1159                         return -1;
1160         }
1161
1162 #ifdef CONFIG_NO_WPA
1163         wpa_s->group_cipher = WPA_CIPHER_NONE;
1164         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1165 #else /* CONFIG_NO_WPA */
1166         sel = ie.group_cipher & ssid->group_cipher;
1167         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1168         if (wpa_s->group_cipher < 0) {
1169                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1170                         "cipher");
1171                 return -1;
1172         }
1173         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1174                 wpa_cipher_txt(wpa_s->group_cipher));
1175
1176         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1177         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1178         if (wpa_s->pairwise_cipher < 0) {
1179                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1180                         "cipher");
1181                 return -1;
1182         }
1183         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1184                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1185 #endif /* CONFIG_NO_WPA */
1186
1187         sel = ie.key_mgmt & ssid->key_mgmt;
1188 #ifdef CONFIG_SAE
1189         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1190                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1191 #endif /* CONFIG_SAE */
1192         if (0) {
1193 #ifdef CONFIG_SUITEB192
1194         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1195                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1196                 wpa_dbg(wpa_s, MSG_DEBUG,
1197                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1198 #endif /* CONFIG_SUITEB192 */
1199 #ifdef CONFIG_SUITEB
1200         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1202                 wpa_dbg(wpa_s, MSG_DEBUG,
1203                         "WPA: using KEY_MGMT 802.1X with Suite B");
1204 #endif /* CONFIG_SUITEB */
1205 #ifdef CONFIG_IEEE80211R
1206         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1207                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1208                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1209         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1210                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1211                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1212 #endif /* CONFIG_IEEE80211R */
1213 #ifdef CONFIG_SAE
1214         } else if (sel & WPA_KEY_MGMT_SAE) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1217         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1218                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1219                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1220 #endif /* CONFIG_SAE */
1221 #ifdef CONFIG_IEEE80211W
1222         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1223                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG,
1225                         "WPA: using KEY_MGMT 802.1X with SHA256");
1226         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1228                 wpa_dbg(wpa_s, MSG_DEBUG,
1229                         "WPA: using KEY_MGMT PSK with SHA256");
1230 #endif /* CONFIG_IEEE80211W */
1231         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1232                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1233                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1234         } else if (sel & WPA_KEY_MGMT_PSK) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1237         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1240 #ifdef CONFIG_HS20
1241         } else if (sel & WPA_KEY_MGMT_OSEN) {
1242                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1243                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1244 #endif /* CONFIG_HS20 */
1245         } else {
1246                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1247                         "authenticated key management type");
1248                 return -1;
1249         }
1250
1251         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1252         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1253                          wpa_s->pairwise_cipher);
1254         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1255
1256 #ifdef CONFIG_IEEE80211W
1257         sel = ie.mgmt_group_cipher;
1258         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1259             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1260                 sel = 0;
1261         if (sel & WPA_CIPHER_AES_128_CMAC) {
1262                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1264                         "AES-128-CMAC");
1265         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1266                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1268                         "BIP-GMAC-128");
1269         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1270                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1271                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1272                         "BIP-GMAC-256");
1273         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1274                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1275                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1276                         "BIP-CMAC-256");
1277         } else {
1278                 wpa_s->mgmt_group_cipher = 0;
1279                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1280         }
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1282                          wpa_s->mgmt_group_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1284                          wpas_get_ssid_pmf(wpa_s, ssid));
1285 #endif /* CONFIG_IEEE80211W */
1286
1287         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1288                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1289                 return -1;
1290         }
1291
1292         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1293                 int psk_set = 0;
1294
1295                 if (ssid->psk_set) {
1296                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1297                         psk_set = 1;
1298                 }
1299 #ifndef CONFIG_NO_PBKDF2
1300                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1301                     ssid->passphrase) {
1302                         u8 psk[PMK_LEN];
1303                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1304                                     4096, psk, PMK_LEN);
1305                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1306                                         psk, PMK_LEN);
1307                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1308                         psk_set = 1;
1309                         os_memset(psk, 0, sizeof(psk));
1310                 }
1311 #endif /* CONFIG_NO_PBKDF2 */
1312 #ifdef CONFIG_EXT_PASSWORD
1313                 if (ssid->ext_psk) {
1314                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1315                                                              ssid->ext_psk);
1316                         char pw_str[64 + 1];
1317                         u8 psk[PMK_LEN];
1318
1319                         if (pw == NULL) {
1320                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1321                                         "found from external storage");
1322                                 return -1;
1323                         }
1324
1325                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1326                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1327                                         "PSK length %d in external storage",
1328                                         (int) wpabuf_len(pw));
1329                                 ext_password_free(pw);
1330                                 return -1;
1331                         }
1332
1333                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1334                         pw_str[wpabuf_len(pw)] = '\0';
1335
1336 #ifndef CONFIG_NO_PBKDF2
1337                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1338                         {
1339                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1340                                             4096, psk, PMK_LEN);
1341                                 os_memset(pw_str, 0, sizeof(pw_str));
1342                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1343                                                 "external passphrase)",
1344                                                 psk, PMK_LEN);
1345                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1346                                 psk_set = 1;
1347                                 os_memset(psk, 0, sizeof(psk));
1348                         } else
1349 #endif /* CONFIG_NO_PBKDF2 */
1350                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1351                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1352                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1353                                                 "Invalid PSK hex string");
1354                                         os_memset(pw_str, 0, sizeof(pw_str));
1355                                         ext_password_free(pw);
1356                                         return -1;
1357                                 }
1358                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1359                                 psk_set = 1;
1360                                 os_memset(psk, 0, sizeof(psk));
1361                         } else {
1362                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1363                                         "PSK available");
1364                                 os_memset(pw_str, 0, sizeof(pw_str));
1365                                 ext_password_free(pw);
1366                                 return -1;
1367                         }
1368
1369                         os_memset(pw_str, 0, sizeof(pw_str));
1370                         ext_password_free(pw);
1371                 }
1372 #endif /* CONFIG_EXT_PASSWORD */
1373
1374                 if (!psk_set) {
1375                         wpa_msg(wpa_s, MSG_INFO,
1376                                 "No PSK available for association");
1377                         return -1;
1378                 }
1379         } else
1380                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1381
1382         return 0;
1383 }
1384
1385
1386 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1387 {
1388         *pos = 0x00;
1389
1390         switch (idx) {
1391         case 0: /* Bits 0-7 */
1392                 break;
1393         case 1: /* Bits 8-15 */
1394                 break;
1395         case 2: /* Bits 16-23 */
1396 #ifdef CONFIG_WNM
1397                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1398                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1399 #endif /* CONFIG_WNM */
1400                 break;
1401         case 3: /* Bits 24-31 */
1402 #ifdef CONFIG_WNM
1403                 *pos |= 0x02; /* Bit 25 - SSID List */
1404 #endif /* CONFIG_WNM */
1405 #ifdef CONFIG_INTERWORKING
1406                 if (wpa_s->conf->interworking)
1407                         *pos |= 0x80; /* Bit 31 - Interworking */
1408 #endif /* CONFIG_INTERWORKING */
1409                 break;
1410         case 4: /* Bits 32-39 */
1411 #ifdef CONFIG_INTERWORKING
1412                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1413                         *pos |= 0x01; /* Bit 32 - QoS Map */
1414 #endif /* CONFIG_INTERWORKING */
1415                 break;
1416         case 5: /* Bits 40-47 */
1417 #ifdef CONFIG_HS20
1418                 if (wpa_s->conf->hs20)
1419                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1420 #endif /* CONFIG_HS20 */
1421                 break;
1422         case 6: /* Bits 48-55 */
1423                 break;
1424         }
1425 }
1426
1427
1428 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1429 {
1430         u8 *pos = buf;
1431         u8 len = 6, i;
1432
1433         if (len < wpa_s->extended_capa_len)
1434                 len = wpa_s->extended_capa_len;
1435         if (buflen < (size_t) len + 2) {
1436                 wpa_printf(MSG_INFO,
1437                            "Not enough room for building extended capabilities element");
1438                 return -1;
1439         }
1440
1441         *pos++ = WLAN_EID_EXT_CAPAB;
1442         *pos++ = len;
1443         for (i = 0; i < len; i++, pos++) {
1444                 wpas_ext_capab_byte(wpa_s, pos, i);
1445
1446                 if (i < wpa_s->extended_capa_len) {
1447                         *pos &= ~wpa_s->extended_capa_mask[i];
1448                         *pos |= wpa_s->extended_capa[i];
1449                 }
1450         }
1451
1452         while (len > 0 && buf[1 + len] == 0) {
1453                 len--;
1454                 buf[1] = len;
1455         }
1456         if (len == 0)
1457                 return 0;
1458
1459         return 2 + len;
1460 }
1461
1462
1463 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1464                           struct wpa_bss *test_bss)
1465 {
1466         struct wpa_bss *bss;
1467
1468         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1469                 if (bss == test_bss)
1470                         return 1;
1471         }
1472
1473         return 0;
1474 }
1475
1476
1477 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1478                            struct wpa_ssid *test_ssid)
1479 {
1480         struct wpa_ssid *ssid;
1481
1482         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1483                 if (ssid == test_ssid)
1484                         return 1;
1485         }
1486
1487         return 0;
1488 }
1489
1490
1491 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1492                         struct wpa_ssid *test_ssid)
1493 {
1494         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1495                 return 0;
1496
1497         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1498 }
1499
1500
1501 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1502 {
1503         if (cwork == NULL)
1504                 return;
1505         os_free(cwork);
1506 }
1507
1508
1509 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1510 {
1511         struct wpa_connect_work *cwork;
1512         struct wpa_radio_work *work = wpa_s->connect_work;
1513
1514         if (!work)
1515                 return;
1516
1517         wpa_s->connect_work = NULL;
1518         cwork = work->ctx;
1519         work->ctx = NULL;
1520         wpas_connect_work_free(cwork);
1521         radio_work_done(work);
1522 }
1523
1524
1525 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1526 {
1527         struct os_reltime now;
1528         u8 addr[ETH_ALEN];
1529
1530         os_get_reltime(&now);
1531         if (wpa_s->last_mac_addr_style == style &&
1532             wpa_s->last_mac_addr_change.sec != 0 &&
1533             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1534                                 wpa_s->conf->rand_addr_lifetime)) {
1535                 wpa_msg(wpa_s, MSG_DEBUG,
1536                         "Previously selected random MAC address has not yet expired");
1537                 return 0;
1538         }
1539
1540         switch (style) {
1541         case 1:
1542                 if (random_mac_addr(addr) < 0)
1543                         return -1;
1544                 break;
1545         case 2:
1546                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1547                 if (random_mac_addr_keep_oui(addr) < 0)
1548                         return -1;
1549                 break;
1550         default:
1551                 return -1;
1552         }
1553
1554         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1555                 wpa_msg(wpa_s, MSG_INFO,
1556                         "Failed to set random MAC address");
1557                 return -1;
1558         }
1559
1560         os_get_reltime(&wpa_s->last_mac_addr_change);
1561         wpa_s->mac_addr_changed = 1;
1562         wpa_s->last_mac_addr_style = style;
1563
1564         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1565                 wpa_msg(wpa_s, MSG_INFO,
1566                         "Could not update MAC address information");
1567                 return -1;
1568         }
1569
1570         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1571                 MAC2STR(addr));
1572
1573         return 0;
1574 }
1575
1576
1577 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1578 {
1579         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1580             !wpa_s->conf->preassoc_mac_addr)
1581                 return 0;
1582
1583         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1584 }
1585
1586
1587 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1588
1589 /**
1590  * wpa_supplicant_associate - Request association
1591  * @wpa_s: Pointer to wpa_supplicant data
1592  * @bss: Scan results for the selected BSS, or %NULL if not available
1593  * @ssid: Configuration data for the selected network
1594  *
1595  * This function is used to request %wpa_supplicant to associate with a BSS.
1596  */
1597 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1598                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1599 {
1600         struct wpa_connect_work *cwork;
1601         int rand_style;
1602
1603         wpa_s->own_disconnect_req = 0;
1604
1605         if (ssid->mac_addr == -1)
1606                 rand_style = wpa_s->conf->mac_addr;
1607         else
1608                 rand_style = ssid->mac_addr;
1609
1610         wmm_ac_clear_saved_tspecs(wpa_s);
1611         wpa_s->reassoc_same_bss = 0;
1612
1613         if (wpa_s->last_ssid == ssid) {
1614                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1615                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1616                         wmm_ac_save_tspecs(wpa_s);
1617                         wpa_s->reassoc_same_bss = 1;
1618                 }
1619         } else if (rand_style > 0) {
1620                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1621                         return;
1622                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1623         } else if (wpa_s->mac_addr_changed) {
1624                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1625                         wpa_msg(wpa_s, MSG_INFO,
1626                                 "Could not restore permanent MAC address");
1627                         return;
1628                 }
1629                 wpa_s->mac_addr_changed = 0;
1630                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1631                         wpa_msg(wpa_s, MSG_INFO,
1632                                 "Could not update MAC address information");
1633                         return;
1634                 }
1635                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1636         }
1637         wpa_s->last_ssid = ssid;
1638
1639 #ifdef CONFIG_IBSS_RSN
1640         ibss_rsn_deinit(wpa_s->ibss_rsn);
1641         wpa_s->ibss_rsn = NULL;
1642 #endif /* CONFIG_IBSS_RSN */
1643
1644         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1645             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1646 #ifdef CONFIG_AP
1647                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1648                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1649                                 "mode");
1650                         return;
1651                 }
1652                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1653                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1654                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1655                                 wpas_p2p_ap_setup_failed(wpa_s);
1656                         return;
1657                 }
1658                 wpa_s->current_bss = bss;
1659 #else /* CONFIG_AP */
1660                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1661                         "the build");
1662 #endif /* CONFIG_AP */
1663                 return;
1664         }
1665
1666         if (ssid->mode == WPAS_MODE_MESH) {
1667 #ifdef CONFIG_MESH
1668                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1669                         wpa_msg(wpa_s, MSG_INFO,
1670                                 "Driver does not support mesh mode");
1671                         return;
1672                 }
1673                 if (bss)
1674                         ssid->frequency = bss->freq;
1675                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1676                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1677                         return;
1678                 }
1679                 wpa_s->current_bss = bss;
1680                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1681                              "ssid=\"%s\" id=%d",
1682                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1683                              ssid->id);
1684 #else /* CONFIG_MESH */
1685                 wpa_msg(wpa_s, MSG_ERROR,
1686                         "mesh mode support not included in the build");
1687 #endif /* CONFIG_MESH */
1688                 return;
1689         }
1690
1691 #ifdef CONFIG_TDLS
1692         if (bss)
1693                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1694                                 bss->ie_len);
1695 #endif /* CONFIG_TDLS */
1696
1697         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1698             ssid->mode == IEEE80211_MODE_INFRA) {
1699                 sme_authenticate(wpa_s, bss, ssid);
1700                 return;
1701         }
1702
1703         if (wpa_s->connect_work) {
1704                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1705                 return;
1706         }
1707
1708         if (radio_work_pending(wpa_s, "connect")) {
1709                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1710                 return;
1711         }
1712
1713         wpas_abort_ongoing_scan(wpa_s);
1714
1715         cwork = os_zalloc(sizeof(*cwork));
1716         if (cwork == NULL)
1717                 return;
1718
1719         cwork->bss = bss;
1720         cwork->ssid = ssid;
1721
1722         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1723                            wpas_start_assoc_cb, cwork) < 0) {
1724                 os_free(cwork);
1725         }
1726 }
1727
1728
1729 static int bss_is_ibss(struct wpa_bss *bss)
1730 {
1731         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1732                 IEEE80211_CAP_IBSS;
1733 }
1734
1735
1736 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1737                             const struct wpa_ssid *ssid)
1738 {
1739         enum hostapd_hw_mode hw_mode;
1740         struct hostapd_hw_modes *mode = NULL;
1741         u8 channel;
1742         int i;
1743
1744 #ifdef CONFIG_HT_OVERRIDES
1745         if (ssid->disable_ht)
1746                 return 0;
1747 #endif /* CONFIG_HT_OVERRIDES */
1748
1749         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1750         if (hw_mode == NUM_HOSTAPD_MODES)
1751                 return 0;
1752         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1753                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1754                         mode = &wpa_s->hw.modes[i];
1755                         break;
1756                 }
1757         }
1758
1759         if (!mode)
1760                 return 0;
1761
1762         return mode->vht_capab != 0;
1763 }
1764
1765
1766 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1767                           const struct wpa_ssid *ssid,
1768                           struct hostapd_freq_params *freq)
1769 {
1770         enum hostapd_hw_mode hw_mode;
1771         struct hostapd_hw_modes *mode = NULL;
1772         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1773                            184, 192 };
1774         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1775         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1776         u8 channel;
1777         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1778         unsigned int j, k;
1779         struct hostapd_freq_params vht_freq;
1780         int chwidth, seg0, seg1;
1781         u32 vht_caps = 0;
1782
1783         freq->freq = ssid->frequency;
1784
1785         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1786                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1787
1788                 if (ssid->mode != WPAS_MODE_IBSS)
1789                         break;
1790
1791                 /* Don't adjust control freq in case of fixed_freq */
1792                 if (ssid->fixed_freq)
1793                         break;
1794
1795                 if (!bss_is_ibss(bss))
1796                         continue;
1797
1798                 if (ssid->ssid_len == bss->ssid_len &&
1799                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1800                         wpa_printf(MSG_DEBUG,
1801                                    "IBSS already found in scan results, adjust control freq: %d",
1802                                    bss->freq);
1803                         freq->freq = bss->freq;
1804                         obss_scan = 0;
1805                         break;
1806                 }
1807         }
1808
1809         /* For IBSS check HT_IBSS flag */
1810         if (ssid->mode == WPAS_MODE_IBSS &&
1811             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1812                 return;
1813
1814         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1815             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1816             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1817                 wpa_printf(MSG_DEBUG,
1818                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1819                 return;
1820         }
1821
1822         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1823         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1824                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1825                         mode = &wpa_s->hw.modes[i];
1826                         break;
1827                 }
1828         }
1829
1830         if (!mode)
1831                 return;
1832
1833         freq->ht_enabled = ht_supported(mode);
1834         if (!freq->ht_enabled)
1835                 return;
1836
1837         /* Setup higher BW only for 5 GHz */
1838         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1839                 return;
1840
1841         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1842                 pri_chan = &mode->channels[chan_idx];
1843                 if (pri_chan->chan == channel)
1844                         break;
1845                 pri_chan = NULL;
1846         }
1847         if (!pri_chan)
1848                 return;
1849
1850         /* Check primary channel flags */
1851         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1852                 return;
1853
1854         /* Check/setup HT40+/HT40- */
1855         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1856                 if (ht40plus[j] == channel) {
1857                         ht40 = 1;
1858                         break;
1859                 }
1860         }
1861
1862         /* Find secondary channel */
1863         for (i = 0; i < mode->num_channels; i++) {
1864                 sec_chan = &mode->channels[i];
1865                 if (sec_chan->chan == channel + ht40 * 4)
1866                         break;
1867                 sec_chan = NULL;
1868         }
1869         if (!sec_chan)
1870                 return;
1871
1872         /* Check secondary channel flags */
1873         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1874                 return;
1875
1876         freq->channel = pri_chan->chan;
1877
1878         switch (ht40) {
1879         case -1:
1880                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1881                         return;
1882                 freq->sec_channel_offset = -1;
1883                 break;
1884         case 1:
1885                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1886                         return;
1887                 freq->sec_channel_offset = 1;
1888                 break;
1889         default:
1890                 break;
1891         }
1892
1893         if (freq->sec_channel_offset && obss_scan) {
1894                 struct wpa_scan_results *scan_res;
1895
1896                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1897                 if (scan_res == NULL) {
1898                         /* Back to HT20 */
1899                         freq->sec_channel_offset = 0;
1900                         return;
1901                 }
1902
1903                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1904                                      sec_chan->chan);
1905                 switch (res) {
1906                 case 0:
1907                         /* Back to HT20 */
1908                         freq->sec_channel_offset = 0;
1909                         break;
1910                 case 1:
1911                         /* Configuration allowed */
1912                         break;
1913                 case 2:
1914                         /* Switch pri/sec channels */
1915                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1916                         freq->sec_channel_offset = -freq->sec_channel_offset;
1917                         freq->channel = sec_chan->chan;
1918                         break;
1919                 default:
1920                         freq->sec_channel_offset = 0;
1921                         break;
1922                 }
1923
1924                 wpa_scan_results_free(scan_res);
1925         }
1926
1927         wpa_printf(MSG_DEBUG,
1928                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1929                    freq->channel, freq->sec_channel_offset);
1930
1931         if (!drv_supports_vht(wpa_s, ssid))
1932                 return;
1933
1934         /* For IBSS check VHT_IBSS flag */
1935         if (ssid->mode == WPAS_MODE_IBSS &&
1936             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1937                 return;
1938
1939         vht_freq = *freq;
1940
1941         vht_freq.vht_enabled = vht_supported(mode);
1942         if (!vht_freq.vht_enabled)
1943                 return;
1944
1945         /* setup center_freq1, bandwidth */
1946         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1947                 if (freq->channel >= vht80[j] &&
1948                     freq->channel < vht80[j] + 16)
1949                         break;
1950         }
1951
1952         if (j == ARRAY_SIZE(vht80))
1953                 return;
1954
1955         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1956                 struct hostapd_channel_data *chan;
1957
1958                 chan = hw_get_channel_chan(mode, i, NULL);
1959                 if (!chan)
1960                         return;
1961
1962                 /* Back to HT configuration if channel not usable */
1963                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1964                         return;
1965         }
1966
1967         chwidth = VHT_CHANWIDTH_80MHZ;
1968         seg0 = vht80[j] + 6;
1969         seg1 = 0;
1970
1971         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
1972                 /* setup center_freq2, bandwidth */
1973                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
1974                         /* Only accept 80 MHz segments separated by a gap */
1975                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
1976                                 continue;
1977                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
1978                                 struct hostapd_channel_data *chan;
1979
1980                                 chan = hw_get_channel_chan(mode, i, NULL);
1981                                 if (!chan)
1982                                         continue;
1983
1984                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
1985                                                   HOSTAPD_CHAN_NO_IR |
1986                                                   HOSTAPD_CHAN_RADAR))
1987                                         continue;
1988
1989                                 /* Found a suitable second segment for 80+80 */
1990                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
1991                                 vht_caps |=
1992                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1993                                 seg1 = vht80[k] + 6;
1994                         }
1995
1996                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
1997                                 break;
1998                 }
1999         }
2000
2001         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2002                                     freq->channel, freq->ht_enabled,
2003                                     vht_freq.vht_enabled,
2004                                     freq->sec_channel_offset,
2005                                     chwidth, seg0, seg1, vht_caps) != 0)
2006                 return;
2007
2008         *freq = vht_freq;
2009
2010         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2011                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2012 }
2013
2014
2015 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2016 {
2017         struct wpa_connect_work *cwork = work->ctx;
2018         struct wpa_bss *bss = cwork->bss;
2019         struct wpa_ssid *ssid = cwork->ssid;
2020         struct wpa_supplicant *wpa_s = work->wpa_s;
2021         u8 wpa_ie[200];
2022         size_t wpa_ie_len;
2023         int use_crypt, ret, i, bssid_changed;
2024         int algs = WPA_AUTH_ALG_OPEN;
2025         unsigned int cipher_pairwise, cipher_group;
2026         struct wpa_driver_associate_params params;
2027         int wep_keys_set = 0;
2028         int assoc_failed = 0;
2029         struct wpa_ssid *old_ssid;
2030 #ifdef CONFIG_HT_OVERRIDES
2031         struct ieee80211_ht_capabilities htcaps;
2032         struct ieee80211_ht_capabilities htcaps_mask;
2033 #endif /* CONFIG_HT_OVERRIDES */
2034 #ifdef CONFIG_VHT_OVERRIDES
2035        struct ieee80211_vht_capabilities vhtcaps;
2036        struct ieee80211_vht_capabilities vhtcaps_mask;
2037 #endif /* CONFIG_VHT_OVERRIDES */
2038
2039         if (deinit) {
2040                 if (work->started) {
2041                         wpa_s->connect_work = NULL;
2042
2043                         /* cancel possible auth. timeout */
2044                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2045                                              NULL);
2046                 }
2047                 wpas_connect_work_free(cwork);
2048                 return;
2049         }
2050
2051         wpa_s->connect_work = work;
2052
2053         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2054             wpas_network_disabled(wpa_s, ssid)) {
2055                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2056                 wpas_connect_work_done(wpa_s);
2057                 return;
2058         }
2059
2060         os_memset(&params, 0, sizeof(params));
2061         wpa_s->reassociate = 0;
2062         wpa_s->eap_expected_failure = 0;
2063         if (bss &&
2064             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2065 #ifdef CONFIG_IEEE80211R
2066                 const u8 *ie, *md = NULL;
2067 #endif /* CONFIG_IEEE80211R */
2068                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2069                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2070                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2071                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2072                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2073                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2074                 if (bssid_changed)
2075                         wpas_notify_bssid_changed(wpa_s);
2076 #ifdef CONFIG_IEEE80211R
2077                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2078                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2079                         md = ie + 2;
2080                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2081                 if (md) {
2082                         /* Prepare for the next transition */
2083                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2084                 }
2085 #endif /* CONFIG_IEEE80211R */
2086 #ifdef CONFIG_WPS
2087         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2088                    wpa_s->conf->ap_scan == 2 &&
2089                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2090                 /* Use ap_scan==1 style network selection to find the network
2091                  */
2092                 wpas_connect_work_done(wpa_s);
2093                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2094                 wpa_s->reassociate = 1;
2095                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2096                 return;
2097 #endif /* CONFIG_WPS */
2098         } else {
2099                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2100                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2101                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2102         }
2103         if (!wpa_s->pno)
2104                 wpa_supplicant_cancel_sched_scan(wpa_s);
2105
2106         wpa_supplicant_cancel_scan(wpa_s);
2107
2108         /* Starting new association, so clear the possibly used WPA IE from the
2109          * previous association. */
2110         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2111
2112 #ifdef IEEE8021X_EAPOL
2113         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2114                 if (ssid->leap) {
2115                         if (ssid->non_leap == 0)
2116                                 algs = WPA_AUTH_ALG_LEAP;
2117                         else
2118                                 algs |= WPA_AUTH_ALG_LEAP;
2119                 }
2120         }
2121 #endif /* IEEE8021X_EAPOL */
2122         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2123         if (ssid->auth_alg) {
2124                 algs = ssid->auth_alg;
2125                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2126                         "0x%x", algs);
2127         }
2128
2129         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2130                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2131             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2132                 int try_opportunistic;
2133                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2134                                      wpa_s->conf->okc :
2135                                      ssid->proactive_key_caching) &&
2136                         (ssid->proto & WPA_PROTO_RSN);
2137                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2138                                             ssid, try_opportunistic) == 0)
2139                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2140                 wpa_ie_len = sizeof(wpa_ie);
2141                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2142                                               wpa_ie, &wpa_ie_len)) {
2143                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2144                                 "key management and encryption suites");
2145                         wpas_connect_work_done(wpa_s);
2146                         return;
2147                 }
2148         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2149                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2150                 /*
2151                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2152                  * use non-WPA since the scan results did not indicate that the
2153                  * AP is using WPA or WPA2.
2154                  */
2155                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2156                 wpa_ie_len = 0;
2157                 wpa_s->wpa_proto = 0;
2158         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2159                 wpa_ie_len = sizeof(wpa_ie);
2160                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2161                                               wpa_ie, &wpa_ie_len)) {
2162                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2163                                 "key management and encryption suites (no "
2164                                 "scan results)");
2165                         wpas_connect_work_done(wpa_s);
2166                         return;
2167                 }
2168 #ifdef CONFIG_WPS
2169         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2170                 struct wpabuf *wps_ie;
2171                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2172                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2173                         wpa_ie_len = wpabuf_len(wps_ie);
2174                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2175                 } else
2176                         wpa_ie_len = 0;
2177                 wpabuf_free(wps_ie);
2178                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2179                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2180                         params.wps = WPS_MODE_PRIVACY;
2181                 else
2182                         params.wps = WPS_MODE_OPEN;
2183                 wpa_s->wpa_proto = 0;
2184 #endif /* CONFIG_WPS */
2185         } else {
2186                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2187                 wpa_ie_len = 0;
2188                 wpa_s->wpa_proto = 0;
2189         }
2190
2191 #ifdef CONFIG_P2P
2192         if (wpa_s->global->p2p) {
2193                 u8 *pos;
2194                 size_t len;
2195                 int res;
2196                 pos = wpa_ie + wpa_ie_len;
2197                 len = sizeof(wpa_ie) - wpa_ie_len;
2198                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2199                                             ssid->p2p_group);
2200                 if (res >= 0)
2201                         wpa_ie_len += res;
2202         }
2203
2204         wpa_s->cross_connect_disallowed = 0;
2205         if (bss) {
2206                 struct wpabuf *p2p;
2207                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2208                 if (p2p) {
2209                         wpa_s->cross_connect_disallowed =
2210                                 p2p_get_cross_connect_disallowed(p2p);
2211                         wpabuf_free(p2p);
2212                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2213                                 "connection",
2214                                 wpa_s->cross_connect_disallowed ?
2215                                 "disallows" : "allows");
2216                 }
2217         }
2218
2219         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2220 #endif /* CONFIG_P2P */
2221
2222 #ifdef CONFIG_HS20
2223         if (is_hs20_network(wpa_s, ssid, bss)) {
2224                 struct wpabuf *hs20;
2225                 hs20 = wpabuf_alloc(20);
2226                 if (hs20) {
2227                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2228                         size_t len;
2229
2230                         wpas_hs20_add_indication(hs20, pps_mo_id);
2231                         len = sizeof(wpa_ie) - wpa_ie_len;
2232                         if (wpabuf_len(hs20) <= len) {
2233                                 os_memcpy(wpa_ie + wpa_ie_len,
2234                                           wpabuf_head(hs20), wpabuf_len(hs20));
2235                                 wpa_ie_len += wpabuf_len(hs20);
2236                         }
2237                         wpabuf_free(hs20);
2238                 }
2239         }
2240 #endif /* CONFIG_HS20 */
2241
2242         /*
2243          * Workaround: Add Extended Capabilities element only if the AP
2244          * included this element in Beacon/Probe Response frames. Some older
2245          * APs seem to have interoperability issues if this element is
2246          * included, so while the standard may require us to include the
2247          * element in all cases, it is justifiable to skip it to avoid
2248          * interoperability issues.
2249          */
2250         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2251                 u8 ext_capab[18];
2252                 int ext_capab_len;
2253                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2254                                                      sizeof(ext_capab));
2255                 if (ext_capab_len > 0) {
2256                         u8 *pos = wpa_ie;
2257                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2258                                 pos += 2 + pos[1];
2259                         os_memmove(pos + ext_capab_len, pos,
2260                                    wpa_ie_len - (pos - wpa_ie));
2261                         wpa_ie_len += ext_capab_len;
2262                         os_memcpy(pos, ext_capab, ext_capab_len);
2263                 }
2264         }
2265
2266         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2267                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2268                 size_t len;
2269
2270                 len = sizeof(wpa_ie) - wpa_ie_len;
2271                 if (wpabuf_len(buf) <= len) {
2272                         os_memcpy(wpa_ie + wpa_ie_len,
2273                                   wpabuf_head(buf), wpabuf_len(buf));
2274                         wpa_ie_len += wpabuf_len(buf);
2275                 }
2276         }
2277
2278 #ifdef CONFIG_FST
2279         if (wpa_s->fst_ies) {
2280                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2281
2282                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2283                         os_memcpy(wpa_ie + wpa_ie_len,
2284                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2285                         wpa_ie_len += fst_ies_len;
2286                 }
2287         }
2288 #endif /* CONFIG_FST */
2289
2290         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2291         use_crypt = 1;
2292         cipher_pairwise = wpa_s->pairwise_cipher;
2293         cipher_group = wpa_s->group_cipher;
2294         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2295             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2296                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2297                         use_crypt = 0;
2298                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2299                         use_crypt = 1;
2300                         wep_keys_set = 1;
2301                 }
2302         }
2303         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2304                 use_crypt = 0;
2305
2306 #ifdef IEEE8021X_EAPOL
2307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2308                 if ((ssid->eapol_flags &
2309                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2310                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2311                     !wep_keys_set) {
2312                         use_crypt = 0;
2313                 } else {
2314                         /* Assume that dynamic WEP-104 keys will be used and
2315                          * set cipher suites in order for drivers to expect
2316                          * encryption. */
2317                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2318                 }
2319         }
2320 #endif /* IEEE8021X_EAPOL */
2321
2322         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2323                 /* Set the key before (and later after) association */
2324                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2325         }
2326
2327         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2328         if (bss) {
2329                 params.ssid = bss->ssid;
2330                 params.ssid_len = bss->ssid_len;
2331                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2332                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2333                                    MACSTR " freq=%u MHz based on scan results "
2334                                    "(bssid_set=%d)",
2335                                    MAC2STR(bss->bssid), bss->freq,
2336                                    ssid->bssid_set);
2337                         params.bssid = bss->bssid;
2338                         params.freq.freq = bss->freq;
2339                 }
2340                 params.bssid_hint = bss->bssid;
2341                 params.freq_hint = bss->freq;
2342         } else {
2343                 params.ssid = ssid->ssid;
2344                 params.ssid_len = ssid->ssid_len;
2345         }
2346
2347         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2348             wpa_s->conf->ap_scan == 2) {
2349                 params.bssid = ssid->bssid;
2350                 params.fixed_bssid = 1;
2351         }
2352
2353         /* Initial frequency for IBSS/mesh */
2354         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2355             ssid->frequency > 0 && params.freq.freq == 0)
2356                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2357
2358         if (ssid->mode == WPAS_MODE_IBSS) {
2359                 params.fixed_freq = ssid->fixed_freq;
2360                 if (ssid->beacon_int)
2361                         params.beacon_int = ssid->beacon_int;
2362                 else
2363                         params.beacon_int = wpa_s->conf->beacon_int;
2364         }
2365
2366         params.wpa_ie = wpa_ie;
2367         params.wpa_ie_len = wpa_ie_len;
2368         params.pairwise_suite = cipher_pairwise;
2369         params.group_suite = cipher_group;
2370         params.key_mgmt_suite = wpa_s->key_mgmt;
2371         params.wpa_proto = wpa_s->wpa_proto;
2372         params.auth_alg = algs;
2373         params.mode = ssid->mode;
2374         params.bg_scan_period = ssid->bg_scan_period;
2375         for (i = 0; i < NUM_WEP_KEYS; i++) {
2376                 if (ssid->wep_key_len[i])
2377                         params.wep_key[i] = ssid->wep_key[i];
2378                 params.wep_key_len[i] = ssid->wep_key_len[i];
2379         }
2380         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2381
2382         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2383             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2384              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2385                 params.passphrase = ssid->passphrase;
2386                 if (ssid->psk_set)
2387                         params.psk = ssid->psk;
2388         }
2389
2390         if (wpa_s->conf->key_mgmt_offload) {
2391                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2392                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2393                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2394                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2395                         params.req_key_mgmt_offload =
2396                                 ssid->proactive_key_caching < 0 ?
2397                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2398                 else
2399                         params.req_key_mgmt_offload = 1;
2400
2401                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2402                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2403                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2404                     ssid->psk_set)
2405                         params.psk = ssid->psk;
2406         }
2407
2408         params.drop_unencrypted = use_crypt;
2409
2410 #ifdef CONFIG_IEEE80211W
2411         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2412         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2413                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2414                 struct wpa_ie_data ie;
2415                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2416                     ie.capabilities &
2417                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2418                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2419                                 "MFP: require MFP");
2420                         params.mgmt_frame_protection =
2421                                 MGMT_FRAME_PROTECTION_REQUIRED;
2422                 }
2423         }
2424 #endif /* CONFIG_IEEE80211W */
2425
2426         params.p2p = ssid->p2p_group;
2427
2428         if (wpa_s->parent->set_sta_uapsd)
2429                 params.uapsd = wpa_s->parent->sta_uapsd;
2430         else
2431                 params.uapsd = -1;
2432
2433 #ifdef CONFIG_HT_OVERRIDES
2434         os_memset(&htcaps, 0, sizeof(htcaps));
2435         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2436         params.htcaps = (u8 *) &htcaps;
2437         params.htcaps_mask = (u8 *) &htcaps_mask;
2438         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2439 #endif /* CONFIG_HT_OVERRIDES */
2440 #ifdef CONFIG_VHT_OVERRIDES
2441         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2442         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2443         params.vhtcaps = &vhtcaps;
2444         params.vhtcaps_mask = &vhtcaps_mask;
2445         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2446 #endif /* CONFIG_VHT_OVERRIDES */
2447
2448 #ifdef CONFIG_P2P
2449         /*
2450          * If multi-channel concurrency is not supported, check for any
2451          * frequency conflict. In case of any frequency conflict, remove the
2452          * least prioritized connection.
2453          */
2454         if (wpa_s->num_multichan_concurrent < 2) {
2455                 int freq, num;
2456                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2457                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2458                         wpa_printf(MSG_DEBUG,
2459                                    "Assoc conflicting freq found (%d != %d)",
2460                                    freq, params.freq.freq);
2461                         if (wpas_p2p_handle_frequency_conflicts(
2462                                     wpa_s, params.freq.freq, ssid) < 0) {
2463                                 wpas_connect_work_done(wpa_s);
2464                                 return;
2465                         }
2466                 }
2467         }
2468 #endif /* CONFIG_P2P */
2469
2470         ret = wpa_drv_associate(wpa_s, &params);
2471         if (ret < 0) {
2472                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2473                         "failed");
2474                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2475                         /*
2476                          * The driver is known to mean what is saying, so we
2477                          * can stop right here; the association will not
2478                          * succeed.
2479                          */
2480                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2481                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2482                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2483                         return;
2484                 }
2485                 /* try to continue anyway; new association will be tried again
2486                  * after timeout */
2487                 assoc_failed = 1;
2488         }
2489
2490         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2491                 /* Set the key after the association just in case association
2492                  * cleared the previously configured key. */
2493                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2494                 /* No need to timeout authentication since there is no key
2495                  * management. */
2496                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2497                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2498 #ifdef CONFIG_IBSS_RSN
2499         } else if (ssid->mode == WPAS_MODE_IBSS &&
2500                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2501                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2502                 /*
2503                  * RSN IBSS authentication is per-STA and we can disable the
2504                  * per-BSSID authentication.
2505                  */
2506                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2507 #endif /* CONFIG_IBSS_RSN */
2508         } else {
2509                 /* Timeout for IEEE 802.11 authentication and association */
2510                 int timeout = 60;
2511
2512                 if (assoc_failed) {
2513                         /* give IBSS a bit more time */
2514                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2515                 } else if (wpa_s->conf->ap_scan == 1) {
2516                         /* give IBSS a bit more time */
2517                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2518                 }
2519                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2520         }
2521
2522         if (wep_keys_set &&
2523             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2524                 /* Set static WEP keys again */
2525                 wpa_set_wep_keys(wpa_s, ssid);
2526         }
2527
2528         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2529                 /*
2530                  * Do not allow EAP session resumption between different
2531                  * network configurations.
2532                  */
2533                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2534         }
2535         old_ssid = wpa_s->current_ssid;
2536         wpa_s->current_ssid = ssid;
2537         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2538                 wpa_s->current_bss = bss;
2539         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2540         wpa_supplicant_initiate_eapol(wpa_s);
2541         if (old_ssid != wpa_s->current_ssid)
2542                 wpas_notify_network_changed(wpa_s);
2543 }
2544
2545
2546 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2547                                             const u8 *addr)
2548 {
2549         struct wpa_ssid *old_ssid;
2550
2551         wpas_connect_work_done(wpa_s);
2552         wpa_clear_keys(wpa_s, addr);
2553         old_ssid = wpa_s->current_ssid;
2554         wpa_supplicant_mark_disassoc(wpa_s);
2555         wpa_sm_set_config(wpa_s->wpa, NULL);
2556         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2557         if (old_ssid != wpa_s->current_ssid)
2558                 wpas_notify_network_changed(wpa_s);
2559         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2560 }
2561
2562
2563 /**
2564  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2565  * @wpa_s: Pointer to wpa_supplicant data
2566  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2567  *
2568  * This function is used to request %wpa_supplicant to deauthenticate from the
2569  * current AP.
2570  */
2571 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2572                                    int reason_code)
2573 {
2574         u8 *addr = NULL;
2575         union wpa_event_data event;
2576         int zero_addr = 0;
2577
2578         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2579                 " pending_bssid=" MACSTR " reason=%d state=%s",
2580                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2581                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2582
2583         if (!is_zero_ether_addr(wpa_s->bssid))
2584                 addr = wpa_s->bssid;
2585         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2586                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2587                   wpa_s->wpa_state == WPA_ASSOCIATING))
2588                 addr = wpa_s->pending_bssid;
2589         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2590                 /*
2591                  * When using driver-based BSS selection, we may not know the
2592                  * BSSID with which we are currently trying to associate. We
2593                  * need to notify the driver of this disconnection even in such
2594                  * a case, so use the all zeros address here.
2595                  */
2596                 addr = wpa_s->bssid;
2597                 zero_addr = 1;
2598         }
2599
2600 #ifdef CONFIG_TDLS
2601         wpa_tdls_teardown_peers(wpa_s->wpa);
2602 #endif /* CONFIG_TDLS */
2603
2604 #ifdef CONFIG_MESH
2605         if (wpa_s->ifmsh) {
2606                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2607                              wpa_s->ifname);
2608                 wpa_supplicant_leave_mesh(wpa_s);
2609         }
2610 #endif /* CONFIG_MESH */
2611
2612         if (addr) {
2613                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2614                 os_memset(&event, 0, sizeof(event));
2615                 event.deauth_info.reason_code = (u16) reason_code;
2616                 event.deauth_info.locally_generated = 1;
2617                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2618                 if (zero_addr)
2619                         addr = NULL;
2620         }
2621
2622         wpa_supplicant_clear_connection(wpa_s, addr);
2623 }
2624
2625 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2626                                               struct wpa_ssid *ssid)
2627 {
2628         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2629                 return;
2630
2631         ssid->disabled = 0;
2632         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2633         wpas_notify_network_enabled_changed(wpa_s, ssid);
2634
2635         /*
2636          * Try to reassociate since there is no current configuration and a new
2637          * network was made available.
2638          */
2639         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2640                 wpa_s->reassociate = 1;
2641 }
2642
2643
2644 /**
2645  * wpa_supplicant_enable_network - Mark a configured network as enabled
2646  * @wpa_s: wpa_supplicant structure for a network interface
2647  * @ssid: wpa_ssid structure for a configured network or %NULL
2648  *
2649  * Enables the specified network or all networks if no network specified.
2650  */
2651 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2652                                    struct wpa_ssid *ssid)
2653 {
2654         if (ssid == NULL) {
2655                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2656                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2657         } else
2658                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2659
2660         if (wpa_s->reassociate && !wpa_s->disconnected &&
2661             (!wpa_s->current_ssid ||
2662              wpa_s->wpa_state == WPA_DISCONNECTED ||
2663              wpa_s->wpa_state == WPA_SCANNING)) {
2664                 if (wpa_s->sched_scanning) {
2665                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2666                                    "new network to scan filters");
2667                         wpa_supplicant_cancel_sched_scan(wpa_s);
2668                 }
2669
2670                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2671                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2672                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2673                 }
2674         }
2675 }
2676
2677
2678 /**
2679  * wpa_supplicant_disable_network - Mark a configured network as disabled
2680  * @wpa_s: wpa_supplicant structure for a network interface
2681  * @ssid: wpa_ssid structure for a configured network or %NULL
2682  *
2683  * Disables the specified network or all networks if no network specified.
2684  */
2685 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2686                                     struct wpa_ssid *ssid)
2687 {
2688         struct wpa_ssid *other_ssid;
2689         int was_disabled;
2690
2691         if (ssid == NULL) {
2692                 if (wpa_s->sched_scanning)
2693                         wpa_supplicant_cancel_sched_scan(wpa_s);
2694
2695                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2696                      other_ssid = other_ssid->next) {
2697                         was_disabled = other_ssid->disabled;
2698                         if (was_disabled == 2)
2699                                 continue; /* do not change persistent P2P group
2700                                            * data */
2701
2702                         other_ssid->disabled = 1;
2703
2704                         if (was_disabled != other_ssid->disabled)
2705                                 wpas_notify_network_enabled_changed(
2706                                         wpa_s, other_ssid);
2707                 }
2708                 if (wpa_s->current_ssid)
2709                         wpa_supplicant_deauthenticate(
2710                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2711         } else if (ssid->disabled != 2) {
2712                 if (ssid == wpa_s->current_ssid)
2713                         wpa_supplicant_deauthenticate(
2714                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2715
2716                 was_disabled = ssid->disabled;
2717
2718                 ssid->disabled = 1;
2719
2720                 if (was_disabled != ssid->disabled) {
2721                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2722                         if (wpa_s->sched_scanning) {
2723                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2724                                            "to remove network from filters");
2725                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2726                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2727                         }
2728                 }
2729         }
2730 }
2731
2732
2733 /**
2734  * wpa_supplicant_select_network - Attempt association with a network
2735  * @wpa_s: wpa_supplicant structure for a network interface
2736  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2737  */
2738 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2739                                    struct wpa_ssid *ssid)
2740 {
2741
2742         struct wpa_ssid *other_ssid;
2743         int disconnected = 0;
2744
2745         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2746                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2747                         wpa_s->own_disconnect_req = 1;
2748                 wpa_supplicant_deauthenticate(
2749                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2750                 disconnected = 1;
2751         }
2752
2753         if (ssid)
2754                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2755
2756         /*
2757          * Mark all other networks disabled or mark all networks enabled if no
2758          * network specified.
2759          */
2760         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2761              other_ssid = other_ssid->next) {
2762                 int was_disabled = other_ssid->disabled;
2763                 if (was_disabled == 2)
2764                         continue; /* do not change persistent P2P group data */
2765
2766                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2767                 if (was_disabled && !other_ssid->disabled)
2768                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2769
2770                 if (was_disabled != other_ssid->disabled)
2771                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2772         }
2773
2774         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2775             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2776                 /* We are already associated with the selected network */
2777                 wpa_printf(MSG_DEBUG, "Already associated with the "
2778                            "selected network - do nothing");
2779                 return;
2780         }
2781
2782         if (ssid) {
2783                 wpa_s->current_ssid = ssid;
2784                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2785                 wpa_s->connect_without_scan =
2786                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2787
2788                 /*
2789                  * Don't optimize next scan freqs since a new ESS has been
2790                  * selected.
2791                  */
2792                 os_free(wpa_s->next_scan_freqs);
2793                 wpa_s->next_scan_freqs = NULL;
2794         } else {
2795                 wpa_s->connect_without_scan = NULL;
2796         }
2797
2798         wpa_s->disconnected = 0;
2799         wpa_s->reassociate = 1;
2800
2801         if (wpa_s->connect_without_scan ||
2802             wpa_supplicant_fast_associate(wpa_s) != 1) {
2803                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2804                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2805         }
2806
2807         if (ssid)
2808                 wpas_notify_network_selected(wpa_s, ssid);
2809 }
2810
2811
2812 /**
2813  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2814  * @wpa_s: wpa_supplicant structure for a network interface
2815  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2816  * @pkcs11_module_path: PKCS #11 module path or NULL
2817  * Returns: 0 on success; -1 on failure
2818  *
2819  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2820  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2821  * module path fails the paths will be reset to the default value (NULL).
2822  */
2823 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2824                                            const char *pkcs11_engine_path,
2825                                            const char *pkcs11_module_path)
2826 {
2827         char *pkcs11_engine_path_copy = NULL;
2828         char *pkcs11_module_path_copy = NULL;
2829
2830         if (pkcs11_engine_path != NULL) {
2831                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2832                 if (pkcs11_engine_path_copy == NULL)
2833                         return -1;
2834         }
2835         if (pkcs11_module_path != NULL) {
2836                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2837                 if (pkcs11_module_path_copy == NULL) {
2838                         os_free(pkcs11_engine_path_copy);
2839                         return -1;
2840                 }
2841         }
2842
2843         os_free(wpa_s->conf->pkcs11_engine_path);
2844         os_free(wpa_s->conf->pkcs11_module_path);
2845         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2846         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2847
2848         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2849         eapol_sm_deinit(wpa_s->eapol);
2850         wpa_s->eapol = NULL;
2851         if (wpa_supplicant_init_eapol(wpa_s)) {
2852                 /* Error -> Reset paths to the default value (NULL) once. */
2853                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2854                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2855                                                                NULL);
2856
2857                 return -1;
2858         }
2859         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2860
2861         return 0;
2862 }
2863
2864
2865 /**
2866  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2867  * @wpa_s: wpa_supplicant structure for a network interface
2868  * @ap_scan: AP scan mode
2869  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2870  *
2871  */
2872 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2873 {
2874
2875         int old_ap_scan;
2876
2877         if (ap_scan < 0 || ap_scan > 2)
2878                 return -1;
2879
2880         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2881                 wpa_printf(MSG_INFO,
2882                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2883         }
2884
2885 #ifdef ANDROID
2886         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2887             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2888             wpa_s->wpa_state < WPA_COMPLETED) {
2889                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2890                            "associating", wpa_s->conf->ap_scan, ap_scan);
2891                 return 0;
2892         }
2893 #endif /* ANDROID */
2894
2895         old_ap_scan = wpa_s->conf->ap_scan;
2896         wpa_s->conf->ap_scan = ap_scan;
2897
2898         if (old_ap_scan != wpa_s->conf->ap_scan)
2899                 wpas_notify_ap_scan_changed(wpa_s);
2900
2901         return 0;
2902 }
2903
2904
2905 /**
2906  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2907  * @wpa_s: wpa_supplicant structure for a network interface
2908  * @expire_age: Expiration age in seconds
2909  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2910  *
2911  */
2912 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2913                                           unsigned int bss_expire_age)
2914 {
2915         if (bss_expire_age < 10) {
2916                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2917                         bss_expire_age);
2918                 return -1;
2919         }
2920         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2921                 bss_expire_age);
2922         wpa_s->conf->bss_expiration_age = bss_expire_age;
2923
2924         return 0;
2925 }
2926
2927
2928 /**
2929  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2930  * @wpa_s: wpa_supplicant structure for a network interface
2931  * @expire_count: number of scans after which an unseen BSS is reclaimed
2932  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2933  *
2934  */
2935 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2936                                             unsigned int bss_expire_count)
2937 {
2938         if (bss_expire_count < 1) {
2939                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2940                         bss_expire_count);
2941                 return -1;
2942         }
2943         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2944                 bss_expire_count);
2945         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2946
2947         return 0;
2948 }
2949
2950
2951 /**
2952  * wpa_supplicant_set_scan_interval - Set scan interval
2953  * @wpa_s: wpa_supplicant structure for a network interface
2954  * @scan_interval: scan interval in seconds
2955  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2956  *
2957  */
2958 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2959                                      int scan_interval)
2960 {
2961         if (scan_interval < 0) {
2962                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2963                         scan_interval);
2964                 return -1;
2965         }
2966         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2967                 scan_interval);
2968         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2969
2970         return 0;
2971 }
2972
2973
2974 /**
2975  * wpa_supplicant_set_debug_params - Set global debug params
2976  * @global: wpa_global structure
2977  * @debug_level: debug level
2978  * @debug_timestamp: determines if show timestamp in debug data
2979  * @debug_show_keys: determines if show keys in debug data
2980  * Returns: 0 if succeed or -1 if debug_level has wrong value
2981  */
2982 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2983                                     int debug_timestamp, int debug_show_keys)
2984 {
2985
2986         int old_level, old_timestamp, old_show_keys;
2987
2988         /* check for allowed debuglevels */
2989         if (debug_level != MSG_EXCESSIVE &&
2990             debug_level != MSG_MSGDUMP &&
2991             debug_level != MSG_DEBUG &&
2992             debug_level != MSG_INFO &&
2993             debug_level != MSG_WARNING &&
2994             debug_level != MSG_ERROR)
2995                 return -1;
2996
2997         old_level = wpa_debug_level;
2998         old_timestamp = wpa_debug_timestamp;
2999         old_show_keys = wpa_debug_show_keys;
3000
3001         wpa_debug_level = debug_level;
3002         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3003         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3004
3005         if (wpa_debug_level != old_level)
3006                 wpas_notify_debug_level_changed(global);
3007         if (wpa_debug_timestamp != old_timestamp)
3008                 wpas_notify_debug_timestamp_changed(global);
3009         if (wpa_debug_show_keys != old_show_keys)
3010                 wpas_notify_debug_show_keys_changed(global);
3011
3012         return 0;
3013 }
3014
3015
3016 /**
3017  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3018  * @wpa_s: Pointer to wpa_supplicant data
3019  * Returns: A pointer to the current network structure or %NULL on failure
3020  */
3021 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3022 {
3023         struct wpa_ssid *entry;
3024         u8 ssid[SSID_MAX_LEN];
3025         int res;
3026         size_t ssid_len;
3027         u8 bssid[ETH_ALEN];
3028         int wired;
3029
3030         res = wpa_drv_get_ssid(wpa_s, ssid);
3031         if (res < 0) {
3032                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3033                         "driver");
3034                 return NULL;
3035         }
3036         ssid_len = res;
3037
3038         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3039                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3040                         "driver");
3041                 return NULL;
3042         }
3043
3044         wired = wpa_s->conf->ap_scan == 0 &&
3045                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3046
3047         entry = wpa_s->conf->ssid;
3048         while (entry) {
3049                 if (!wpas_network_disabled(wpa_s, entry) &&
3050                     ((ssid_len == entry->ssid_len &&
3051                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3052                     (!entry->bssid_set ||
3053                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3054                         return entry;
3055 #ifdef CONFIG_WPS
3056                 if (!wpas_network_disabled(wpa_s, entry) &&
3057                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3058                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3059                     (!entry->bssid_set ||
3060                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3061                         return entry;
3062 #endif /* CONFIG_WPS */
3063
3064                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3065                     entry->ssid_len == 0 &&
3066                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3067                         return entry;
3068
3069                 entry = entry->next;
3070         }
3071
3072         return NULL;
3073 }
3074
3075
3076 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3077 {
3078         struct wpa_global *global = wpa_s->global;
3079
3080         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3081                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3082                 if (global->drv_priv[i] == NULL) {
3083                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3084                                    "'%s'", wpa_drivers[i]->name);
3085                         return -1;
3086                 }
3087         }
3088
3089         wpa_s->driver = wpa_drivers[i];
3090         wpa_s->global_drv_priv = global->drv_priv[i];
3091
3092         return 0;
3093 }
3094
3095
3096 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3097                                      const char *name)
3098 {
3099         int i;
3100         size_t len;
3101         const char *pos, *driver = name;
3102
3103         if (wpa_s == NULL)
3104                 return -1;
3105
3106         if (wpa_drivers[0] == NULL) {
3107                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3108                         "wpa_supplicant");
3109                 return -1;
3110         }
3111
3112         if (name == NULL) {
3113                 /* default to first driver in the list */
3114                 return select_driver(wpa_s, 0);
3115         }
3116
3117         do {
3118                 pos = os_strchr(driver, ',');
3119                 if (pos)
3120                         len = pos - driver;
3121                 else
3122                         len = os_strlen(driver);
3123
3124                 for (i = 0; wpa_drivers[i]; i++) {
3125                         if (os_strlen(wpa_drivers[i]->name) == len &&
3126                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3127                             0) {
3128                                 /* First driver that succeeds wins */
3129                                 if (select_driver(wpa_s, i) == 0)
3130                                         return 0;
3131                         }
3132                 }
3133
3134                 driver = pos + 1;
3135         } while (pos);
3136
3137         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3138         return -1;
3139 }
3140
3141
3142 /**
3143  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3144  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3145  *      with struct wpa_driver_ops::init()
3146  * @src_addr: Source address of the EAPOL frame
3147  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3148  * @len: Length of the EAPOL data
3149  *
3150  * This function is called for each received EAPOL frame. Most driver
3151  * interfaces rely on more generic OS mechanism for receiving frames through
3152  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3153  * take care of received EAPOL frames and deliver them to the core supplicant
3154  * code by calling this function.
3155  */
3156 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3157                              const u8 *buf, size_t len)
3158 {
3159         struct wpa_supplicant *wpa_s = ctx;
3160
3161         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3162         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3163
3164 #ifdef CONFIG_PEERKEY
3165         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3166             wpa_s->current_ssid->peerkey &&
3167             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3168             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3169                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3170                 return;
3171         }
3172 #endif /* CONFIG_PEERKEY */
3173
3174         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3175             (wpa_s->last_eapol_matches_bssid &&
3176 #ifdef CONFIG_AP
3177              !wpa_s->ap_iface &&
3178 #endif /* CONFIG_AP */
3179              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3180                 /*
3181                  * There is possible race condition between receiving the
3182                  * association event and the EAPOL frame since they are coming
3183                  * through different paths from the driver. In order to avoid
3184                  * issues in trying to process the EAPOL frame before receiving
3185                  * association information, lets queue it for processing until
3186                  * the association event is received. This may also be needed in
3187                  * driver-based roaming case, so also use src_addr != BSSID as a
3188                  * trigger if we have previously confirmed that the
3189                  * Authenticator uses BSSID as the src_addr (which is not the
3190                  * case with wired IEEE 802.1X).
3191                  */
3192                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3193                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3194                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3195                         MAC2STR(wpa_s->bssid));
3196                 wpabuf_free(wpa_s->pending_eapol_rx);
3197                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3198                 if (wpa_s->pending_eapol_rx) {
3199                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3200                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3201                                   ETH_ALEN);
3202                 }
3203                 return;
3204         }
3205
3206         wpa_s->last_eapol_matches_bssid =
3207                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3208
3209 #ifdef CONFIG_AP
3210         if (wpa_s->ap_iface) {
3211                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3212                 return;
3213         }
3214 #endif /* CONFIG_AP */
3215
3216         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3217                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3218                         "no key management is configured");
3219                 return;
3220         }
3221
3222         if (wpa_s->eapol_received == 0 &&
3223             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3224              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3225              wpa_s->wpa_state != WPA_COMPLETED) &&
3226             (wpa_s->current_ssid == NULL ||
3227              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3228                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3229                 int timeout = 10;
3230
3231                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3232                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3233                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3234                         /* Use longer timeout for IEEE 802.1X/EAP */
3235                         timeout = 70;
3236                 }
3237
3238 #ifdef CONFIG_WPS
3239                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3240                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3241                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3242                         /*
3243                          * Use shorter timeout if going through WPS AP iteration
3244                          * for PIN config method with an AP that does not
3245                          * advertise Selected Registrar.
3246                          */
3247                         struct wpabuf *wps_ie;
3248
3249                         wps_ie = wpa_bss_get_vendor_ie_multi(
3250                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3251                         if (wps_ie &&
3252                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3253                                 timeout = 10;
3254                         wpabuf_free(wps_ie);
3255                 }
3256 #endif /* CONFIG_WPS */
3257
3258                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3259         }
3260         wpa_s->eapol_received++;
3261
3262         if (wpa_s->countermeasures) {
3263                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3264                         "EAPOL packet");
3265                 return;
3266         }
3267
3268 #ifdef CONFIG_IBSS_RSN
3269         if (wpa_s->current_ssid &&
3270             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3271                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3272                 return;
3273         }
3274 #endif /* CONFIG_IBSS_RSN */
3275
3276         /* Source address of the incoming EAPOL frame could be compared to the
3277          * current BSSID. However, it is possible that a centralized
3278          * Authenticator could be using another MAC address than the BSSID of
3279          * an AP, so just allow any address to be used for now. The replies are
3280          * still sent to the current BSSID (if available), though. */
3281
3282         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3283         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3284             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3285                 return;
3286         wpa_drv_poll(wpa_s);
3287         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3288                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3289         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3290                 /*
3291                  * Set portValid = TRUE here since we are going to skip 4-way
3292                  * handshake processing which would normally set portValid. We
3293                  * need this to allow the EAPOL state machines to be completed
3294                  * without going through EAPOL-Key handshake.
3295                  */
3296                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3297         }
3298 }
3299
3300
3301 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3302 {
3303         if ((!wpa_s->p2p_mgmt ||
3304              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3305             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3306                 l2_packet_deinit(wpa_s->l2);
3307                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3308                                            wpa_drv_get_mac_addr(wpa_s),
3309                                            ETH_P_EAPOL,
3310                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3311                 if (wpa_s->l2 == NULL)
3312                         return -1;
3313         } else {
3314                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3315                 if (addr)
3316                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3317         }
3318
3319         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3320                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3321                 return -1;
3322         }
3323
3324         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3325
3326         return 0;
3327 }
3328
3329
3330 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3331                                            const u8 *buf, size_t len)
3332 {
3333         struct wpa_supplicant *wpa_s = ctx;
3334         const struct l2_ethhdr *eth;
3335
3336         if (len < sizeof(*eth))
3337                 return;
3338         eth = (const struct l2_ethhdr *) buf;
3339
3340         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3341             !(eth->h_dest[0] & 0x01)) {
3342                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3343                         " (bridge - not for this interface - ignore)",
3344                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3345                 return;
3346         }
3347
3348         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3349                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3350         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3351                                 len - sizeof(*eth));
3352 }
3353
3354
3355 /**
3356  * wpa_supplicant_driver_init - Initialize driver interface parameters
3357  * @wpa_s: Pointer to wpa_supplicant data
3358  * Returns: 0 on success, -1 on failure
3359  *
3360  * This function is called to initialize driver interface parameters.
3361  * wpa_drv_init() must have been called before this function to initialize the
3362  * driver interface.
3363  */
3364 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3365 {
3366         static int interface_count = 0;
3367
3368         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3369                 return -1;
3370
3371         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3372                 MAC2STR(wpa_s->own_addr));
3373         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3374         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3375
3376         if (wpa_s->bridge_ifname[0]) {
3377                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3378                         "interface '%s'", wpa_s->bridge_ifname);
3379                 wpa_s->l2_br = l2_packet_init_bridge(
3380                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3381                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3382                 if (wpa_s->l2_br == NULL) {
3383                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3384                                 "connection for the bridge interface '%s'",
3385                                 wpa_s->bridge_ifname);
3386                         return -1;
3387                 }
3388         }
3389
3390         if (wpa_s->conf->ap_scan == 2 &&
3391             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3392                 wpa_printf(MSG_INFO,
3393                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3394         }
3395
3396         wpa_clear_keys(wpa_s, NULL);
3397
3398         /* Make sure that TKIP countermeasures are not left enabled (could
3399          * happen if wpa_supplicant is killed during countermeasures. */
3400         wpa_drv_set_countermeasures(wpa_s, 0);
3401
3402         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3403         wpa_drv_flush_pmkid(wpa_s);
3404
3405         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3406         wpa_s->prev_scan_wildcard = 0;
3407
3408         if (wpa_supplicant_enabled_networks(wpa_s)) {
3409                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3410                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3411                         interface_count = 0;
3412                 }
3413 #ifndef ANDROID
3414                 if (!wpa_s->p2p_mgmt &&
3415                     wpa_supplicant_delayed_sched_scan(wpa_s,
3416                                                       interface_count % 3,
3417                                                       100000))
3418                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3419                                                 100000);
3420 #endif /* ANDROID */
3421                 interface_count++;
3422         } else
3423                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3424
3425         return 0;
3426 }
3427
3428
3429 static int wpa_supplicant_daemon(const char *pid_file)
3430 {
3431         wpa_printf(MSG_DEBUG, "Daemonize..");
3432         return os_daemonize(pid_file);
3433 }
3434
3435
3436 static struct wpa_supplicant *
3437 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3438 {
3439         struct wpa_supplicant *wpa_s;
3440
3441         wpa_s = os_zalloc(sizeof(*wpa_s));
3442         if (wpa_s == NULL)
3443                 return NULL;
3444         wpa_s->scan_req = INITIAL_SCAN_REQ;
3445         wpa_s->scan_interval = 5;
3446         wpa_s->new_connection = 1;
3447         wpa_s->parent = parent ? parent : wpa_s;
3448         wpa_s->sched_scanning = 0;
3449
3450         return wpa_s;
3451 }
3452
3453
3454 #ifdef CONFIG_HT_OVERRIDES
3455
3456 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3457                              struct ieee80211_ht_capabilities *htcaps,
3458                              struct ieee80211_ht_capabilities *htcaps_mask,
3459                              const char *ht_mcs)
3460 {
3461         /* parse ht_mcs into hex array */
3462         int i;
3463         const char *tmp = ht_mcs;
3464         char *end = NULL;
3465
3466         /* If ht_mcs is null, do not set anything */
3467         if (!ht_mcs)
3468                 return 0;
3469
3470         /* This is what we are setting in the kernel */
3471         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3472
3473         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3474
3475         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3476                 errno = 0;
3477                 long v = strtol(tmp, &end, 16);
3478                 if (errno == 0) {
3479                         wpa_msg(wpa_s, MSG_DEBUG,
3480                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3481                                 i, v, end, tmp);
3482                         if (end == tmp)
3483                                 break;
3484
3485                         htcaps->supported_mcs_set[i] = v;
3486                         tmp = end;
3487                 } else {
3488                         wpa_msg(wpa_s, MSG_ERROR,
3489                                 "Failed to parse ht-mcs: %s, error: %s\n",
3490                                 ht_mcs, strerror(errno));
3491                         return -1;
3492                 }
3493         }
3494
3495         /*
3496          * If we were able to parse any values, then set mask for the MCS set.
3497          */
3498         if (i) {
3499                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3500                           IEEE80211_HT_MCS_MASK_LEN - 1);
3501                 /* skip the 3 reserved bits */
3502                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3503                         0x1f;
3504         }
3505
3506         return 0;
3507 }
3508
3509
3510 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3511                                  struct ieee80211_ht_capabilities *htcaps,
3512                                  struct ieee80211_ht_capabilities *htcaps_mask,
3513                                  int disabled)
3514 {
3515         le16 msk;
3516
3517         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3518
3519         if (disabled == -1)
3520                 return 0;
3521
3522         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3523         htcaps_mask->ht_capabilities_info |= msk;
3524         if (disabled)
3525                 htcaps->ht_capabilities_info &= msk;
3526         else
3527                 htcaps->ht_capabilities_info |= msk;
3528
3529         return 0;
3530 }
3531
3532
3533 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3534                                 struct ieee80211_ht_capabilities *htcaps,
3535                                 struct ieee80211_ht_capabilities *htcaps_mask,
3536                                 int factor)
3537 {
3538         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3539
3540         if (factor == -1)
3541                 return 0;
3542
3543         if (factor < 0 || factor > 3) {
3544                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3545                         "Must be 0-3 or -1", factor);
3546                 return -EINVAL;
3547         }
3548
3549         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3550         htcaps->a_mpdu_params &= ~0x3;
3551         htcaps->a_mpdu_params |= factor & 0x3;
3552
3553         return 0;
3554 }
3555
3556
3557 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3558                                  struct ieee80211_ht_capabilities *htcaps,
3559                                  struct ieee80211_ht_capabilities *htcaps_mask,
3560                                  int density)
3561 {
3562         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3563
3564         if (density == -1)
3565                 return 0;
3566
3567         if (density < 0 || density > 7) {
3568                 wpa_msg(wpa_s, MSG_ERROR,
3569                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3570                         density);
3571                 return -EINVAL;
3572         }
3573
3574         htcaps_mask->a_mpdu_params |= 0x1C;
3575         htcaps->a_mpdu_params &= ~(0x1C);
3576         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3577
3578         return 0;
3579 }
3580
3581
3582 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3583                                 struct ieee80211_ht_capabilities *htcaps,
3584                                 struct ieee80211_ht_capabilities *htcaps_mask,
3585                                 int disabled)
3586 {
3587         /* Masking these out disables HT40 */
3588         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3589                                 HT_CAP_INFO_SHORT_GI40MHZ);
3590
3591         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3592
3593         if (disabled)
3594                 htcaps->ht_capabilities_info &= ~msk;
3595         else
3596                 htcaps->ht_capabilities_info |= msk;
3597
3598         htcaps_mask->ht_capabilities_info |= msk;
3599
3600         return 0;
3601 }
3602
3603
3604 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3605                                struct ieee80211_ht_capabilities *htcaps,
3606                                struct ieee80211_ht_capabilities *htcaps_mask,
3607                                int disabled)
3608 {
3609         /* Masking these out disables SGI */
3610         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3611                                 HT_CAP_INFO_SHORT_GI40MHZ);
3612
3613         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3614
3615         if (disabled)
3616                 htcaps->ht_capabilities_info &= ~msk;
3617         else
3618                 htcaps->ht_capabilities_info |= msk;
3619
3620         htcaps_mask->ht_capabilities_info |= msk;
3621
3622         return 0;
3623 }
3624
3625
3626 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3627                                struct ieee80211_ht_capabilities *htcaps,
3628                                struct ieee80211_ht_capabilities *htcaps_mask,
3629                                int disabled)
3630 {
3631         /* Masking these out disables LDPC */
3632         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3633
3634         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3635
3636         if (disabled)
3637                 htcaps->ht_capabilities_info &= ~msk;
3638         else
3639                 htcaps->ht_capabilities_info |= msk;
3640
3641         htcaps_mask->ht_capabilities_info |= msk;
3642
3643         return 0;
3644 }
3645
3646
3647 void wpa_supplicant_apply_ht_overrides(
3648         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3649         struct wpa_driver_associate_params *params)
3650 {
3651         struct ieee80211_ht_capabilities *htcaps;
3652         struct ieee80211_ht_capabilities *htcaps_mask;
3653
3654         if (!ssid)
3655                 return;
3656
3657         params->disable_ht = ssid->disable_ht;
3658         if (!params->htcaps || !params->htcaps_mask)
3659                 return;
3660
3661         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3662         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3663         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3664         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3665                               ssid->disable_max_amsdu);
3666         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3667         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3668         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3669         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3670         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3671
3672         if (ssid->ht40_intolerant) {
3673                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3674                 htcaps->ht_capabilities_info |= bit;
3675                 htcaps_mask->ht_capabilities_info |= bit;
3676         }
3677 }
3678
3679 #endif /* CONFIG_HT_OVERRIDES */
3680
3681
3682 #ifdef CONFIG_VHT_OVERRIDES
3683 void wpa_supplicant_apply_vht_overrides(
3684         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3685         struct wpa_driver_associate_params *params)
3686 {
3687         struct ieee80211_vht_capabilities *vhtcaps;
3688         struct ieee80211_vht_capabilities *vhtcaps_mask;
3689
3690         if (!ssid)
3691                 return;
3692
3693         params->disable_vht = ssid->disable_vht;
3694
3695         vhtcaps = (void *) params->vhtcaps;
3696         vhtcaps_mask = (void *) params->vhtcaps_mask;
3697
3698         if (!vhtcaps || !vhtcaps_mask)
3699                 return;
3700
3701         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3702         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3703
3704 #ifdef CONFIG_HT_OVERRIDES
3705         /* if max ampdu is <= 3, we have to make the HT cap the same */
3706         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3707                 int max_ampdu;
3708
3709                 max_ampdu = (ssid->vht_capa &
3710                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3711                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3712
3713                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3714                 wpa_set_ampdu_factor(wpa_s,
3715                                      (void *) params->htcaps,
3716                                      (void *) params->htcaps_mask,
3717                                      max_ampdu);
3718         }
3719 #endif /* CONFIG_HT_OVERRIDES */
3720
3721 #define OVERRIDE_MCS(i)                                                 \
3722         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3723                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3724                         3 << 2 * (i - 1);                               \
3725                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3726                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3727         }                                                               \
3728         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3729                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3730                         3 << 2 * (i - 1);                               \
3731                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3732                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3733         }
3734
3735         OVERRIDE_MCS(1);
3736         OVERRIDE_MCS(2);
3737         OVERRIDE_MCS(3);
3738         OVERRIDE_MCS(4);
3739         OVERRIDE_MCS(5);
3740         OVERRIDE_MCS(6);
3741         OVERRIDE_MCS(7);
3742         OVERRIDE_MCS(8);
3743 }
3744 #endif /* CONFIG_VHT_OVERRIDES */
3745
3746
3747 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3748 {
3749 #ifdef PCSC_FUNCS
3750         size_t len;
3751
3752         if (!wpa_s->conf->pcsc_reader)
3753                 return 0;
3754
3755         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3756         if (!wpa_s->scard)
3757                 return 1;
3758
3759         if (wpa_s->conf->pcsc_pin &&
3760             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3761                 scard_deinit(wpa_s->scard);
3762                 wpa_s->scard = NULL;
3763                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3764                 return -1;
3765         }
3766
3767         len = sizeof(wpa_s->imsi) - 1;
3768         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3769                 scard_deinit(wpa_s->scard);
3770                 wpa_s->scard = NULL;
3771                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3772                 return -1;
3773         }
3774         wpa_s->imsi[len] = '\0';
3775
3776         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3777
3778         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3779                    wpa_s->imsi, wpa_s->mnc_len);
3780
3781         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3782         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3783 #endif /* PCSC_FUNCS */
3784
3785         return 0;
3786 }
3787
3788
3789 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3790 {
3791         char *val, *pos;
3792
3793         ext_password_deinit(wpa_s->ext_pw);
3794         wpa_s->ext_pw = NULL;
3795         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3796
3797         if (!wpa_s->conf->ext_password_backend)
3798                 return 0;
3799
3800         val = os_strdup(wpa_s->conf->ext_password_backend);
3801         if (val == NULL)
3802                 return -1;
3803         pos = os_strchr(val, ':');
3804         if (pos)
3805                 *pos++ = '\0';
3806
3807         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3808
3809         wpa_s->ext_pw = ext_password_init(val, pos);
3810         os_free(val);
3811         if (wpa_s->ext_pw == NULL) {
3812                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3813                 return -1;
3814         }
3815         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3816
3817         return 0;
3818 }
3819
3820
3821 #ifdef CONFIG_FST
3822
3823 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3824 {
3825         struct wpa_supplicant *wpa_s = ctx;
3826
3827         return (is_zero_ether_addr(wpa_s->bssid) ||
3828                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3829 }
3830
3831
3832 static void wpas_fst_get_channel_info_cb(void *ctx,
3833                                          enum hostapd_hw_mode *hw_mode,
3834                                          u8 *channel)
3835 {
3836         struct wpa_supplicant *wpa_s = ctx;
3837
3838         if (wpa_s->current_bss) {
3839                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3840                                                   channel);
3841         } else if (wpa_s->hw.num_modes) {
3842                 *hw_mode = wpa_s->hw.modes[0].mode;
3843         } else {
3844                 WPA_ASSERT(0);
3845                 *hw_mode = 0;
3846         }
3847 }
3848
3849
3850 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3851 {
3852         struct wpa_supplicant *wpa_s = ctx;
3853
3854         *modes = wpa_s->hw.modes;
3855         return wpa_s->hw.num_modes;
3856 }
3857
3858
3859 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3860 {
3861         struct wpa_supplicant *wpa_s = ctx;
3862
3863         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3864         wpa_s->fst_ies = fst_ies;
3865 }
3866
3867
3868 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3869 {
3870         struct wpa_supplicant *wpa_s = ctx;
3871
3872         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3873         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3874                                           wpa_s->own_addr, wpa_s->bssid,
3875                                           wpabuf_head(data), wpabuf_len(data),
3876                                    0);
3877 }
3878
3879
3880 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3881 {
3882         struct wpa_supplicant *wpa_s = ctx;
3883
3884         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3885         return wpa_s->received_mb_ies;
3886 }
3887
3888
3889 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3890                                      const u8 *buf, size_t size)
3891 {
3892         struct wpa_supplicant *wpa_s = ctx;
3893         struct mb_ies_info info;
3894
3895         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3896
3897         if (!mb_ies_info_by_ies(&info, buf, size)) {
3898                 wpabuf_free(wpa_s->received_mb_ies);
3899                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3900         }
3901 }
3902
3903
3904 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3905                                    Boolean mb_only)
3906 {
3907         struct wpa_supplicant *wpa_s = ctx;
3908
3909         *get_ctx = NULL;
3910         if (!is_zero_ether_addr(wpa_s->bssid))
3911                 return (wpa_s->received_mb_ies || !mb_only) ?
3912                         wpa_s->bssid : NULL;
3913         return NULL;
3914 }
3915
3916
3917 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3918                                   Boolean mb_only)
3919 {
3920         return NULL;
3921 }
3922
3923 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3924                                        struct fst_wpa_obj *iface_obj)
3925 {
3926         iface_obj->ctx              = wpa_s;
3927         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3928         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3929         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3930         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3931         iface_obj->send_action      = wpas_fst_send_action_cb;
3932         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3933         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3934         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3935         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3936 }
3937 #endif /* CONFIG_FST */
3938
3939 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3940                                     const struct wpa_driver_capa *capa)
3941 {
3942         struct wowlan_triggers *triggers;
3943         int ret = 0;
3944
3945         if (!wpa_s->conf->wowlan_triggers)
3946                 return 0;
3947
3948         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3949         if (triggers) {
3950                 ret = wpa_drv_wowlan(wpa_s, triggers);
3951                 os_free(triggers);
3952         }
3953         return ret;
3954 }
3955
3956
3957 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3958 {
3959         if (freq < 3000)
3960                 return BAND_2_4_GHZ;
3961         if (freq > 50000)
3962                 return BAND_60_GHZ;
3963         return BAND_5_GHZ;
3964 }
3965
3966
3967 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3968                                    const int *freqs)
3969 {
3970         int i;
3971         unsigned int band = 0;
3972
3973         if (freqs) {
3974                 /* freqs are specified for the radio work */
3975                 for (i = 0; freqs[i]; i++)
3976                         band |= wpas_freq_to_band(freqs[i]);
3977         } else {
3978                 /*
3979                  * freqs are not specified, implies all
3980                  * the supported freqs by HW
3981                  */
3982                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3983                         if (wpa_s->hw.modes[i].num_channels != 0) {
3984                                 if (wpa_s->hw.modes[i].mode ==
3985                                     HOSTAPD_MODE_IEEE80211B ||
3986                                     wpa_s->hw.modes[i].mode ==
3987                                     HOSTAPD_MODE_IEEE80211G)
3988                                         band |= BAND_2_4_GHZ;
3989                                 else if (wpa_s->hw.modes[i].mode ==
3990                                          HOSTAPD_MODE_IEEE80211A)
3991                                         band |= BAND_5_GHZ;
3992                                 else if (wpa_s->hw.modes[i].mode ==
3993                                          HOSTAPD_MODE_IEEE80211AD)
3994                                         band |= BAND_60_GHZ;
3995                                 else if (wpa_s->hw.modes[i].mode ==
3996                                          HOSTAPD_MODE_IEEE80211ANY)
3997                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
3998                                                 BAND_60_GHZ;
3999                         }
4000                 }
4001         }
4002
4003         return band;
4004 }
4005
4006
4007 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4008                                               const char *rn)
4009 {
4010         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4011         struct wpa_radio *radio;
4012
4013         while (rn && iface) {
4014                 radio = iface->radio;
4015                 if (radio && os_strcmp(rn, radio->name) == 0) {
4016                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4017                                    wpa_s->ifname, rn);
4018                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4019                         return radio;
4020                 }
4021
4022                 iface = iface->next;
4023         }
4024
4025         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4026                    wpa_s->ifname, rn ? rn : "N/A");
4027         radio = os_zalloc(sizeof(*radio));
4028         if (radio == NULL)
4029                 return NULL;
4030
4031         if (rn)
4032                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4033         dl_list_init(&radio->ifaces);
4034         dl_list_init(&radio->work);
4035         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4036
4037         return radio;
4038 }
4039
4040
4041 static void radio_work_free(struct wpa_radio_work *work)
4042 {
4043         if (work->wpa_s->scan_work == work) {
4044                 /* This should not really happen. */
4045                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4046                         work->type, work, work->started);
4047                 work->wpa_s->scan_work = NULL;
4048         }
4049
4050 #ifdef CONFIG_P2P
4051         if (work->wpa_s->p2p_scan_work == work) {
4052                 /* This should not really happen. */
4053                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4054                         work->type, work, work->started);
4055                 work->wpa_s->p2p_scan_work = NULL;
4056         }
4057 #endif /* CONFIG_P2P */
4058
4059         if (work->started) {
4060                 work->wpa_s->radio->num_active_works--;
4061                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4062                         "radio_work_free('%s'@%p: num_active_works --> %u",
4063                         work->type, work,
4064                         work->wpa_s->radio->num_active_works);
4065         }
4066
4067         dl_list_del(&work->list);
4068         os_free(work);
4069 }
4070
4071
4072 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4073 {
4074         struct wpa_radio_work *active_work = NULL;
4075         struct wpa_radio_work *tmp;
4076
4077         /* Get the active work to know the type and band. */
4078         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4079                 if (tmp->started) {
4080                         active_work = tmp;
4081                         break;
4082                 }
4083         }
4084
4085         if (!active_work) {
4086                 /* No active work, start one */
4087                 radio->num_active_works = 0;
4088                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4089                                  list) {
4090                         if (os_strcmp(tmp->type, "scan") == 0 &&
4091                             radio->external_scan_running &&
4092                             (((struct wpa_driver_scan_params *)
4093                               tmp->ctx)->only_new_results ||
4094                              tmp->wpa_s->clear_driver_scan_cache))
4095                                 continue;
4096                         return tmp;
4097                 }
4098                 return NULL;
4099         }
4100
4101         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4102             os_strcmp(active_work->type, "connect") == 0) {
4103                 /*
4104                  * If the active work is either connect or sme-connect,
4105                  * do not parallelize them with other radio works.
4106                  */
4107                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4108                         "Do not parallelize radio work with %s",
4109                         active_work->type);
4110                 return NULL;
4111         }
4112
4113         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4114                 if (tmp->started)
4115                         continue;
4116
4117                 /*
4118                  * If connect or sme-connect are enqueued, parallelize only
4119                  * those operations ahead of them in the queue.
4120                  */
4121                 if (os_strcmp(tmp->type, "connect") == 0 ||
4122                     os_strcmp(tmp->type, "sme-connect") == 0)
4123                         break;
4124
4125                 /*
4126                  * Check that the radio works are distinct and
4127                  * on different bands.
4128                  */
4129                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4130                     (active_work->bands != tmp->bands)) {
4131                         /*
4132                          * If a scan has to be scheduled through nl80211 scan
4133                          * interface and if an external scan is already running,
4134                          * do not schedule the scan since it is likely to get
4135                          * rejected by kernel.
4136                          */
4137                         if (os_strcmp(tmp->type, "scan") == 0 &&
4138                             radio->external_scan_running &&
4139                             (((struct wpa_driver_scan_params *)
4140                               tmp->ctx)->only_new_results ||
4141                              tmp->wpa_s->clear_driver_scan_cache))
4142                                 continue;
4143
4144                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4145                                 "active_work:%s new_work:%s",
4146                                 active_work->type, tmp->type);
4147                         return tmp;
4148                 }
4149         }
4150
4151         /* Did not find a radio work to schedule in parallel. */
4152         return NULL;
4153 }
4154
4155
4156 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4157 {
4158         struct wpa_radio *radio = eloop_ctx;
4159         struct wpa_radio_work *work;
4160         struct os_reltime now, diff;
4161         struct wpa_supplicant *wpa_s;
4162
4163         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4164         if (work == NULL) {
4165                 radio->num_active_works = 0;
4166                 return;
4167         }
4168
4169         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4170                               radio_list);
4171
4172         if (!(wpa_s &&
4173               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4174                 if (work->started)
4175                         return; /* already started and still in progress */
4176
4177                 if (wpa_s && wpa_s->radio->external_scan_running) {
4178                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4179                         return;
4180                 }
4181         } else {
4182                 work = NULL;
4183                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4184                         /* get the work to schedule next */
4185                         work = radio_work_get_next_work(radio);
4186                 }
4187                 if (!work)
4188                         return;
4189         }
4190
4191         wpa_s = work->wpa_s;
4192         os_get_reltime(&now);
4193         os_reltime_sub(&now, &work->time, &diff);
4194         wpa_dbg(wpa_s, MSG_DEBUG,
4195                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4196                 work->type, work, diff.sec, diff.usec);
4197         work->started = 1;
4198         work->time = now;
4199         radio->num_active_works++;
4200
4201         work->cb(work, 0);
4202
4203         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4204             radio->num_active_works < MAX_ACTIVE_WORKS)
4205                 radio_work_check_next(wpa_s);
4206 }
4207
4208
4209 /*
4210  * This function removes both started and pending radio works running on
4211  * the provided interface's radio.
4212  * Prior to the removal of the radio work, its callback (cb) is called with
4213  * deinit set to be 1. Each work's callback is responsible for clearing its
4214  * internal data and restoring to a correct state.
4215  * @wpa_s: wpa_supplicant data
4216  * @type: type of works to be removed
4217  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4218  * this interface's works.
4219  */
4220 void radio_remove_works(struct wpa_supplicant *wpa_s,
4221                         const char *type, int remove_all)
4222 {
4223         struct wpa_radio_work *work, *tmp;
4224         struct wpa_radio *radio = wpa_s->radio;
4225
4226         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4227                               list) {
4228                 if (type && os_strcmp(type, work->type) != 0)
4229                         continue;
4230
4231                 /* skip other ifaces' works */
4232                 if (!remove_all && work->wpa_s != wpa_s)
4233                         continue;
4234
4235                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4236                         work->type, work, work->started ? " (started)" : "");
4237                 work->cb(work, 1);
4238                 radio_work_free(work);
4239         }
4240
4241         /* in case we removed the started work */
4242         radio_work_check_next(wpa_s);
4243 }
4244
4245
4246 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4247 {
4248         struct wpa_radio *radio = wpa_s->radio;
4249
4250         if (!radio)
4251                 return;
4252
4253         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4254                    wpa_s->ifname, radio->name);
4255         dl_list_del(&wpa_s->radio_list);
4256         radio_remove_works(wpa_s, NULL, 0);
4257         wpa_s->radio = NULL;
4258         if (!dl_list_empty(&radio->ifaces))
4259                 return; /* Interfaces remain for this radio */
4260
4261         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4262         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4263         os_free(radio);
4264 }
4265
4266
4267 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4268 {
4269         struct wpa_radio *radio = wpa_s->radio;
4270
4271         if (dl_list_empty(&radio->work))
4272                 return;
4273         if (wpa_s->ext_work_in_progress) {
4274                 wpa_printf(MSG_DEBUG,
4275                            "External radio work in progress - delay start of pending item");
4276                 return;
4277         }
4278         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4279         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4280 }
4281
4282
4283 /**
4284  * radio_add_work - Add a radio work item
4285  * @wpa_s: Pointer to wpa_supplicant data
4286  * @freq: Frequency of the offchannel operation in MHz or 0
4287  * @type: Unique identifier for each type of work
4288  * @next: Force as the next work to be executed
4289  * @cb: Callback function for indicating when radio is available
4290  * @ctx: Context pointer for the work (work->ctx in cb())
4291  * Returns: 0 on success, -1 on failure
4292  *
4293  * This function is used to request time for an operation that requires
4294  * exclusive radio control. Once the radio is available, the registered callback
4295  * function will be called. radio_work_done() must be called once the exclusive
4296  * radio operation has been completed, so that the radio is freed for other
4297  * operations. The special case of deinit=1 is used to free the context data
4298  * during interface removal. That does not allow the callback function to start
4299  * the radio operation, i.e., it must free any resources allocated for the radio
4300  * work and return.
4301  *
4302  * The @freq parameter can be used to indicate a single channel on which the
4303  * offchannel operation will occur. This may allow multiple radio work
4304  * operations to be performed in parallel if they apply for the same channel.
4305  * Setting this to 0 indicates that the work item may use multiple channels or
4306  * requires exclusive control of the radio.
4307  */
4308 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4309                    const char *type, int next,
4310                    void (*cb)(struct wpa_radio_work *work, int deinit),
4311                    void *ctx)
4312 {
4313         struct wpa_radio *radio = wpa_s->radio;
4314         struct wpa_radio_work *work;
4315         int was_empty;
4316
4317         work = os_zalloc(sizeof(*work));
4318         if (work == NULL)
4319                 return -1;
4320         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4321         os_get_reltime(&work->time);
4322         work->freq = freq;
4323         work->type = type;
4324         work->wpa_s = wpa_s;
4325         work->cb = cb;
4326         work->ctx = ctx;
4327
4328         if (freq)
4329                 work->bands = wpas_freq_to_band(freq);
4330         else if (os_strcmp(type, "scan") == 0 ||
4331                  os_strcmp(type, "p2p-scan") == 0)
4332                 work->bands = wpas_get_bands(wpa_s,
4333                                              ((struct wpa_driver_scan_params *)
4334                                               ctx)->freqs);
4335         else
4336                 work->bands = wpas_get_bands(wpa_s, NULL);
4337
4338         was_empty = dl_list_empty(&wpa_s->radio->work);
4339         if (next)
4340                 dl_list_add(&wpa_s->radio->work, &work->list);
4341         else
4342                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4343         if (was_empty) {
4344                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4345                 radio_work_check_next(wpa_s);
4346         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4347                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4348                 wpa_dbg(wpa_s, MSG_DEBUG,
4349                         "Try to schedule a radio work (num_active_works=%u)",
4350                         radio->num_active_works);
4351                 radio_work_check_next(wpa_s);
4352         }
4353
4354         return 0;
4355 }
4356
4357
4358 /**
4359  * radio_work_done - Indicate that a radio work item has been completed
4360  * @work: Completed work
4361  *
4362  * This function is called once the callback function registered with
4363  * radio_add_work() has completed its work.
4364  */
4365 void radio_work_done(struct wpa_radio_work *work)
4366 {
4367         struct wpa_supplicant *wpa_s = work->wpa_s;
4368         struct os_reltime now, diff;
4369         unsigned int started = work->started;
4370
4371         os_get_reltime(&now);
4372         os_reltime_sub(&now, &work->time, &diff);
4373         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4374                 work->type, work, started ? "done" : "canceled",
4375                 diff.sec, diff.usec);
4376         radio_work_free(work);
4377         if (started)
4378                 radio_work_check_next(wpa_s);
4379 }
4380
4381
4382 struct wpa_radio_work *
4383 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4384 {
4385         struct wpa_radio_work *work;
4386         struct wpa_radio *radio = wpa_s->radio;
4387
4388         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4389                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4390                         return work;
4391         }
4392
4393         return NULL;
4394 }
4395
4396
4397 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4398                             struct wpa_interface *iface)
4399 {
4400         const char *ifname, *driver, *rn;
4401
4402         driver = iface->driver;
4403 next_driver:
4404         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4405                 return -1;
4406
4407         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4408         if (wpa_s->drv_priv == NULL) {
4409                 const char *pos;
4410                 pos = driver ? os_strchr(driver, ',') : NULL;
4411                 if (pos) {
4412                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4413                                 "driver interface - try next driver wrapper");
4414                         driver = pos + 1;
4415                         goto next_driver;
4416                 }
4417                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4418                         "interface");
4419                 return -1;
4420         }
4421         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4422                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4423                         "driver_param '%s'", wpa_s->conf->driver_param);
4424                 return -1;
4425         }
4426
4427         ifname = wpa_drv_get_ifname(wpa_s);
4428         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4429                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4430                         "interface name with '%s'", ifname);
4431                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4432         }
4433
4434         rn = wpa_driver_get_radio_name(wpa_s);
4435         if (rn && rn[0] == '\0')
4436                 rn = NULL;
4437
4438         wpa_s->radio = radio_add_interface(wpa_s, rn);
4439         if (wpa_s->radio == NULL)
4440                 return -1;
4441
4442         return 0;
4443 }
4444
4445
4446 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4447                                      struct wpa_interface *iface)
4448 {
4449         struct wpa_driver_capa capa;
4450         int capa_res;
4451
4452         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4453                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4454                    iface->confname ? iface->confname : "N/A",
4455                    iface->driver ? iface->driver : "default",
4456                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4457                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4458
4459         if (iface->confname) {
4460 #ifdef CONFIG_BACKEND_FILE
4461                 wpa_s->confname = os_rel2abs_path(iface->confname);
4462                 if (wpa_s->confname == NULL) {
4463                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4464                                    "for configuration file '%s'.",
4465                                    iface->confname);
4466                         return -1;
4467                 }
4468                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4469                            iface->confname, wpa_s->confname);
4470 #else /* CONFIG_BACKEND_FILE */
4471                 wpa_s->confname = os_strdup(iface->confname);
4472 #endif /* CONFIG_BACKEND_FILE */
4473                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4474                 if (wpa_s->conf == NULL) {
4475                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4476                                    "configuration '%s'.", wpa_s->confname);
4477                         return -1;
4478                 }
4479                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4480                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4481
4482                 /*
4483                  * Override ctrl_interface and driver_param if set on command
4484                  * line.
4485                  */
4486                 if (iface->ctrl_interface) {
4487                         os_free(wpa_s->conf->ctrl_interface);
4488                         wpa_s->conf->ctrl_interface =
4489                                 os_strdup(iface->ctrl_interface);
4490                 }
4491
4492                 if (iface->driver_param) {
4493                         os_free(wpa_s->conf->driver_param);
4494                         wpa_s->conf->driver_param =
4495                                 os_strdup(iface->driver_param);
4496                 }
4497
4498                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4499                         os_free(wpa_s->conf->ctrl_interface);
4500                         wpa_s->conf->ctrl_interface = NULL;
4501                 }
4502         } else
4503                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4504                                                      iface->driver_param);
4505
4506         if (wpa_s->conf == NULL) {
4507                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4508                 return -1;
4509         }
4510
4511         if (iface->ifname == NULL) {
4512                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4513                 return -1;
4514         }
4515         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4516                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4517                            iface->ifname);
4518                 return -1;
4519         }
4520         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4521
4522         if (iface->bridge_ifname) {
4523                 if (os_strlen(iface->bridge_ifname) >=
4524                     sizeof(wpa_s->bridge_ifname)) {
4525                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4526                                    "name '%s'.", iface->bridge_ifname);
4527                         return -1;
4528                 }
4529                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4530                            sizeof(wpa_s->bridge_ifname));
4531         }
4532
4533         /* RSNA Supplicant Key Management - INITIALIZE */
4534         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4535         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4536
4537         /* Initialize driver interface and register driver event handler before
4538          * L2 receive handler so that association events are processed before
4539          * EAPOL-Key packets if both become available for the same select()
4540          * call. */
4541         if (wpas_init_driver(wpa_s, iface) < 0)
4542                 return -1;
4543
4544         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4545                 return -1;
4546
4547         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4548                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4549                           NULL);
4550         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4551
4552         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4553             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4554                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4555                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4556                         "dot11RSNAConfigPMKLifetime");
4557                 return -1;
4558         }
4559
4560         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4561             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4562                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4563                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4564                         "dot11RSNAConfigPMKReauthThreshold");
4565                 return -1;
4566         }
4567
4568         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4569             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4570                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4571                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4572                         "dot11RSNAConfigSATimeout");
4573                 return -1;
4574         }
4575
4576         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4577                                                       &wpa_s->hw.num_modes,
4578                                                       &wpa_s->hw.flags);
4579         if (wpa_s->hw.modes) {
4580                 u16 i;
4581
4582                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4583                         if (wpa_s->hw.modes[i].vht_capab) {
4584                                 wpa_s->hw_capab = CAPAB_VHT;
4585                                 break;
4586                         }
4587
4588                         if (wpa_s->hw.modes[i].ht_capab &
4589                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4590                                 wpa_s->hw_capab = CAPAB_HT40;
4591                         else if (wpa_s->hw.modes[i].ht_capab &&
4592                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4593                                 wpa_s->hw_capab = CAPAB_HT;
4594                 }
4595         }
4596
4597         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4598         if (capa_res == 0) {
4599                 wpa_s->drv_capa_known = 1;
4600                 wpa_s->drv_flags = capa.flags;
4601                 wpa_s->drv_enc = capa.enc;
4602                 wpa_s->drv_smps_modes = capa.smps_modes;
4603                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4604                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4605                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4606                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4607                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4608                 wpa_s->max_sched_scan_plan_interval =
4609                         capa.max_sched_scan_plan_interval;
4610                 wpa_s->max_sched_scan_plan_iterations =
4611                         capa.max_sched_scan_plan_iterations;
4612                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4613                 wpa_s->max_match_sets = capa.max_match_sets;
4614                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4615                 wpa_s->max_stations = capa.max_stations;
4616                 wpa_s->extended_capa = capa.extended_capa;
4617                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4618                 wpa_s->extended_capa_len = capa.extended_capa_len;
4619                 wpa_s->num_multichan_concurrent =
4620                         capa.num_multichan_concurrent;
4621                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4622
4623                 if (capa.mac_addr_rand_scan_supported)
4624                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4625                 if (wpa_s->sched_scan_supported &&
4626                     capa.mac_addr_rand_sched_scan_supported)
4627                         wpa_s->mac_addr_rand_supported |=
4628                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4629         }
4630         if (wpa_s->max_remain_on_chan == 0)
4631                 wpa_s->max_remain_on_chan = 1000;
4632
4633         /*
4634          * Only take p2p_mgmt parameters when P2P Device is supported.
4635          * Doing it here as it determines whether l2_packet_init() will be done
4636          * during wpa_supplicant_driver_init().
4637          */
4638         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4639                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4640         else
4641                 iface->p2p_mgmt = 1;
4642
4643         if (wpa_s->num_multichan_concurrent == 0)
4644                 wpa_s->num_multichan_concurrent = 1;
4645
4646         if (wpa_supplicant_driver_init(wpa_s) < 0)
4647                 return -1;
4648
4649 #ifdef CONFIG_TDLS
4650         if ((!iface->p2p_mgmt ||
4651              !(wpa_s->drv_flags &
4652                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4653             wpa_tdls_init(wpa_s->wpa))
4654                 return -1;
4655 #endif /* CONFIG_TDLS */
4656
4657         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4658             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4659                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4660                 return -1;
4661         }
4662
4663 #ifdef CONFIG_FST
4664         if (wpa_s->conf->fst_group_id) {
4665                 struct fst_iface_cfg cfg;
4666                 struct fst_wpa_obj iface_obj;
4667
4668                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4669                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4670                            sizeof(cfg.group_id));
4671                 cfg.priority = wpa_s->conf->fst_priority;
4672                 cfg.llt = wpa_s->conf->fst_llt;
4673
4674                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4675                                         &iface_obj, &cfg);
4676                 if (!wpa_s->fst) {
4677                         wpa_msg(wpa_s, MSG_ERROR,
4678                                 "FST: Cannot attach iface %s to group %s",
4679                                 wpa_s->ifname, cfg.group_id);
4680                         return -1;
4681                 }
4682         }
4683 #endif /* CONFIG_FST */
4684
4685         if (wpas_wps_init(wpa_s))
4686                 return -1;
4687
4688         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4689                 return -1;
4690         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4691
4692         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4693         if (wpa_s->ctrl_iface == NULL) {
4694                 wpa_printf(MSG_ERROR,
4695                            "Failed to initialize control interface '%s'.\n"
4696                            "You may have another wpa_supplicant process "
4697                            "already running or the file was\n"
4698                            "left by an unclean termination of wpa_supplicant "
4699                            "in which case you will need\n"
4700                            "to manually remove this file before starting "
4701                            "wpa_supplicant again.\n",
4702                            wpa_s->conf->ctrl_interface);
4703                 return -1;
4704         }
4705
4706         wpa_s->gas = gas_query_init(wpa_s);
4707         if (wpa_s->gas == NULL) {
4708                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4709                 return -1;
4710         }
4711
4712         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4713                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4714                 return -1;
4715         }
4716
4717         if (wpa_bss_init(wpa_s) < 0)
4718                 return -1;
4719
4720         /*
4721          * Set Wake-on-WLAN triggers, if configured.
4722          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4723          * have effect anyway when the interface is down).
4724          */
4725         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4726                 return -1;
4727
4728 #ifdef CONFIG_EAP_PROXY
4729 {
4730         size_t len;
4731         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4732                                                      &len);
4733         if (wpa_s->mnc_len > 0) {
4734                 wpa_s->imsi[len] = '\0';
4735                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4736                            wpa_s->imsi, wpa_s->mnc_len);
4737         } else {
4738                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4739         }
4740 }
4741 #endif /* CONFIG_EAP_PROXY */
4742
4743         if (pcsc_reader_init(wpa_s) < 0)
4744                 return -1;
4745
4746         if (wpas_init_ext_pw(wpa_s) < 0)
4747                 return -1;
4748
4749         wpas_rrm_reset(wpa_s);
4750
4751         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4752
4753 #ifdef CONFIG_HS20
4754         hs20_init(wpa_s);
4755 #endif /* CONFIG_HS20 */
4756
4757         return 0;
4758 }
4759
4760
4761 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4762                                         int notify, int terminate)
4763 {
4764         struct wpa_global *global = wpa_s->global;
4765         struct wpa_supplicant *iface, *prev;
4766
4767         if (wpa_s == wpa_s->parent)
4768                 wpas_p2p_group_remove(wpa_s, "*");
4769
4770         iface = global->ifaces;
4771         while (iface) {
4772                 if (iface == wpa_s || iface->parent != wpa_s) {
4773                         iface = iface->next;
4774                         continue;
4775                 }
4776                 wpa_printf(MSG_DEBUG,
4777                            "Remove remaining child interface %s from parent %s",
4778                            iface->ifname, wpa_s->ifname);
4779                 prev = iface;
4780                 iface = iface->next;
4781                 wpa_supplicant_remove_iface(global, prev, terminate);
4782         }
4783
4784         wpa_s->disconnected = 1;
4785         if (wpa_s->drv_priv) {
4786                 wpa_supplicant_deauthenticate(wpa_s,
4787                                               WLAN_REASON_DEAUTH_LEAVING);
4788
4789                 wpa_drv_set_countermeasures(wpa_s, 0);
4790                 wpa_clear_keys(wpa_s, NULL);
4791         }
4792
4793         wpa_supplicant_cleanup(wpa_s);
4794         wpas_p2p_deinit_iface(wpa_s);
4795
4796         wpas_ctrl_radio_work_flush(wpa_s);
4797         radio_remove_interface(wpa_s);
4798
4799 #ifdef CONFIG_FST
4800         if (wpa_s->fst) {
4801                 fst_detach(wpa_s->fst);
4802                 wpa_s->fst = NULL;
4803         }
4804         if (wpa_s->received_mb_ies) {
4805                 wpabuf_free(wpa_s->received_mb_ies);
4806                 wpa_s->received_mb_ies = NULL;
4807         }
4808 #endif /* CONFIG_FST */
4809
4810         if (wpa_s->drv_priv)
4811                 wpa_drv_deinit(wpa_s);
4812
4813         if (notify)
4814                 wpas_notify_iface_removed(wpa_s);
4815
4816         if (terminate)
4817                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4818
4819         if (wpa_s->ctrl_iface) {
4820                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4821                 wpa_s->ctrl_iface = NULL;
4822         }
4823
4824 #ifdef CONFIG_MESH
4825         if (wpa_s->ifmsh) {
4826                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4827                 wpa_s->ifmsh = NULL;
4828         }
4829 #endif /* CONFIG_MESH */
4830
4831         if (wpa_s->conf != NULL) {
4832                 wpa_config_free(wpa_s->conf);
4833                 wpa_s->conf = NULL;
4834         }
4835
4836         os_free(wpa_s->ssids_from_scan_req);
4837
4838         os_free(wpa_s);
4839 }
4840
4841
4842 /**
4843  * wpa_supplicant_add_iface - Add a new network interface
4844  * @global: Pointer to global data from wpa_supplicant_init()
4845  * @iface: Interface configuration options
4846  * @parent: Parent interface or %NULL to assign new interface as parent
4847  * Returns: Pointer to the created interface or %NULL on failure
4848  *
4849  * This function is used to add new network interfaces for %wpa_supplicant.
4850  * This can be called before wpa_supplicant_run() to add interfaces before the
4851  * main event loop has been started. In addition, new interfaces can be added
4852  * dynamically while %wpa_supplicant is already running. This could happen,
4853  * e.g., when a hotplug network adapter is inserted.
4854  */
4855 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4856                                                  struct wpa_interface *iface,
4857                                                  struct wpa_supplicant *parent)
4858 {
4859         struct wpa_supplicant *wpa_s;
4860         struct wpa_interface t_iface;
4861         struct wpa_ssid *ssid;
4862
4863         if (global == NULL || iface == NULL)
4864                 return NULL;
4865
4866         wpa_s = wpa_supplicant_alloc(parent);
4867         if (wpa_s == NULL)
4868                 return NULL;
4869
4870         wpa_s->global = global;
4871
4872         t_iface = *iface;
4873         if (global->params.override_driver) {
4874                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4875                            "('%s' -> '%s')",
4876                            iface->driver, global->params.override_driver);
4877                 t_iface.driver = global->params.override_driver;
4878         }
4879         if (global->params.override_ctrl_interface) {
4880                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4881                            "ctrl_interface ('%s' -> '%s')",
4882                            iface->ctrl_interface,
4883                            global->params.override_ctrl_interface);
4884                 t_iface.ctrl_interface =
4885                         global->params.override_ctrl_interface;
4886         }
4887         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4888                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4889                            iface->ifname);
4890                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4891                 return NULL;
4892         }
4893
4894         if (iface->p2p_mgmt == 0) {
4895                 /* Notify the control interfaces about new iface */
4896                 if (wpas_notify_iface_added(wpa_s)) {
4897                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4898                         return NULL;
4899                 }
4900
4901                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4902                         wpas_notify_network_added(wpa_s, ssid);
4903         }
4904
4905         wpa_s->next = global->ifaces;
4906         global->ifaces = wpa_s;
4907
4908         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4909         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4910
4911 #ifdef CONFIG_P2P
4912         if (wpa_s->global->p2p == NULL &&
4913             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4914             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4915             wpas_p2p_add_p2pdev_interface(
4916                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4917                 wpa_printf(MSG_INFO,
4918                            "P2P: Failed to enable P2P Device interface");
4919                 /* Try to continue without. P2P will be disabled. */
4920         }
4921 #endif /* CONFIG_P2P */
4922
4923         return wpa_s;
4924 }
4925
4926
4927 /**
4928  * wpa_supplicant_remove_iface - Remove a network interface
4929  * @global: Pointer to global data from wpa_supplicant_init()
4930  * @wpa_s: Pointer to the network interface to be removed
4931  * Returns: 0 if interface was removed, -1 if interface was not found
4932  *
4933  * This function can be used to dynamically remove network interfaces from
4934  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4935  * addition, this function is used to remove all remaining interfaces when
4936  * %wpa_supplicant is terminated.
4937  */
4938 int wpa_supplicant_remove_iface(struct wpa_global *global,
4939                                 struct wpa_supplicant *wpa_s,
4940                                 int terminate)
4941 {
4942         struct wpa_supplicant *prev;
4943 #ifdef CONFIG_MESH
4944         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4945         char *ifname = NULL;
4946 #endif /* CONFIG_MESH */
4947
4948         /* Remove interface from the global list of interfaces */
4949         prev = global->ifaces;
4950         if (prev == wpa_s) {
4951                 global->ifaces = wpa_s->next;
4952         } else {
4953                 while (prev && prev->next != wpa_s)
4954                         prev = prev->next;
4955                 if (prev == NULL)
4956                         return -1;
4957                 prev->next = wpa_s->next;
4958         }
4959
4960         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4961
4962 #ifdef CONFIG_MESH
4963         if (mesh_if_created) {
4964                 ifname = os_strdup(wpa_s->ifname);
4965                 if (ifname == NULL) {
4966                         wpa_dbg(wpa_s, MSG_ERROR,
4967                                 "mesh: Failed to malloc ifname");
4968                         return -1;
4969                 }
4970         }
4971 #endif /* CONFIG_MESH */
4972
4973         if (global->p2p_group_formation == wpa_s)
4974                 global->p2p_group_formation = NULL;
4975         if (global->p2p_invite_group == wpa_s)
4976                 global->p2p_invite_group = NULL;
4977         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4978
4979 #ifdef CONFIG_MESH
4980         if (mesh_if_created) {
4981                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4982                 os_free(ifname);
4983         }
4984 #endif /* CONFIG_MESH */
4985
4986         return 0;
4987 }
4988
4989
4990 /**
4991  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4992  * @wpa_s: Pointer to the network interface
4993  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4994  */
4995 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4996 {
4997         const char *eapol_method;
4998
4999         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5000             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5001                 return "NO-EAP";
5002         }
5003
5004         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5005         if (eapol_method == NULL)
5006                 return "UNKNOWN-EAP";
5007
5008         return eapol_method;
5009 }
5010
5011
5012 /**
5013  * wpa_supplicant_get_iface - Get a new network interface
5014  * @global: Pointer to global data from wpa_supplicant_init()
5015  * @ifname: Interface name
5016  * Returns: Pointer to the interface or %NULL if not found
5017  */
5018 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5019                                                  const char *ifname)
5020 {
5021         struct wpa_supplicant *wpa_s;
5022
5023         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5024                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5025                         return wpa_s;
5026         }
5027         return NULL;
5028 }
5029
5030
5031 #ifndef CONFIG_NO_WPA_MSG
5032 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5033 {
5034         struct wpa_supplicant *wpa_s = ctx;
5035         if (wpa_s == NULL)
5036                 return NULL;
5037         return wpa_s->ifname;
5038 }
5039 #endif /* CONFIG_NO_WPA_MSG */
5040
5041
5042 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5043 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5044 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5045
5046 /* Periodic cleanup tasks */
5047 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5048 {
5049         struct wpa_global *global = eloop_ctx;
5050         struct wpa_supplicant *wpa_s;
5051
5052         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5053                                wpas_periodic, global, NULL);
5054
5055 #ifdef CONFIG_P2P
5056         if (global->p2p)
5057                 p2p_expire_peers(global->p2p);
5058 #endif /* CONFIG_P2P */
5059
5060         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5061                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5062 #ifdef CONFIG_AP
5063                 ap_periodic(wpa_s);
5064 #endif /* CONFIG_AP */
5065         }
5066 }
5067
5068
5069 /**
5070  * wpa_supplicant_init - Initialize %wpa_supplicant
5071  * @params: Parameters for %wpa_supplicant
5072  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5073  *
5074  * This function is used to initialize %wpa_supplicant. After successful
5075  * initialization, the returned data pointer can be used to add and remove
5076  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5077  */
5078 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5079 {
5080         struct wpa_global *global;
5081         int ret, i;
5082
5083         if (params == NULL)
5084                 return NULL;
5085
5086 #ifdef CONFIG_DRIVER_NDIS
5087         {
5088                 void driver_ndis_init_ops(void);
5089                 driver_ndis_init_ops();
5090         }
5091 #endif /* CONFIG_DRIVER_NDIS */
5092
5093 #ifndef CONFIG_NO_WPA_MSG
5094         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5095 #endif /* CONFIG_NO_WPA_MSG */
5096
5097         if (params->wpa_debug_file_path)
5098                 wpa_debug_open_file(params->wpa_debug_file_path);
5099         else
5100                 wpa_debug_setup_stdout();
5101         if (params->wpa_debug_syslog)
5102                 wpa_debug_open_syslog();
5103         if (params->wpa_debug_tracing) {
5104                 ret = wpa_debug_open_linux_tracing();
5105                 if (ret) {
5106                         wpa_printf(MSG_ERROR,
5107                                    "Failed to enable trace logging");
5108                         return NULL;
5109                 }
5110         }
5111
5112         ret = eap_register_methods();
5113         if (ret) {
5114                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5115                 if (ret == -2)
5116                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5117                                    "the same EAP type.");
5118                 return NULL;
5119         }
5120
5121         global = os_zalloc(sizeof(*global));
5122         if (global == NULL)
5123                 return NULL;
5124         dl_list_init(&global->p2p_srv_bonjour);
5125         dl_list_init(&global->p2p_srv_upnp);
5126         global->params.daemonize = params->daemonize;
5127         global->params.wait_for_monitor = params->wait_for_monitor;
5128         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5129         if (params->pid_file)
5130                 global->params.pid_file = os_strdup(params->pid_file);
5131         if (params->ctrl_interface)
5132                 global->params.ctrl_interface =
5133                         os_strdup(params->ctrl_interface);
5134         if (params->ctrl_interface_group)
5135                 global->params.ctrl_interface_group =
5136                         os_strdup(params->ctrl_interface_group);
5137         if (params->override_driver)
5138                 global->params.override_driver =
5139                         os_strdup(params->override_driver);
5140         if (params->override_ctrl_interface)
5141                 global->params.override_ctrl_interface =
5142                         os_strdup(params->override_ctrl_interface);
5143 #ifdef CONFIG_P2P
5144         if (params->conf_p2p_dev)
5145                 global->params.conf_p2p_dev =
5146                         os_strdup(params->conf_p2p_dev);
5147 #endif /* CONFIG_P2P */
5148         wpa_debug_level = global->params.wpa_debug_level =
5149                 params->wpa_debug_level;
5150         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5151                 params->wpa_debug_show_keys;
5152         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5153                 params->wpa_debug_timestamp;
5154
5155         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5156
5157         if (eloop_init()) {
5158                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5159                 wpa_supplicant_deinit(global);
5160                 return NULL;
5161         }
5162
5163         random_init(params->entropy_file);
5164
5165         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5166         if (global->ctrl_iface == NULL) {
5167                 wpa_supplicant_deinit(global);
5168                 return NULL;
5169         }
5170
5171         if (wpas_notify_supplicant_initialized(global)) {
5172                 wpa_supplicant_deinit(global);
5173                 return NULL;
5174         }
5175
5176         for (i = 0; wpa_drivers[i]; i++)
5177                 global->drv_count++;
5178         if (global->drv_count == 0) {
5179                 wpa_printf(MSG_ERROR, "No drivers enabled");
5180                 wpa_supplicant_deinit(global);
5181                 return NULL;
5182         }
5183         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5184         if (global->drv_priv == NULL) {
5185                 wpa_supplicant_deinit(global);
5186                 return NULL;
5187         }
5188
5189 #ifdef CONFIG_WIFI_DISPLAY
5190         if (wifi_display_init(global) < 0) {
5191                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5192                 wpa_supplicant_deinit(global);
5193                 return NULL;
5194         }
5195 #endif /* CONFIG_WIFI_DISPLAY */
5196
5197         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5198                                wpas_periodic, global, NULL);
5199
5200         return global;
5201 }
5202
5203
5204 /**
5205  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5206  * @global: Pointer to global data from wpa_supplicant_init()
5207  * Returns: 0 after successful event loop run, -1 on failure
5208  *
5209  * This function starts the main event loop and continues running as long as
5210  * there are any remaining events. In most cases, this function is running as
5211  * long as the %wpa_supplicant process in still in use.
5212  */
5213 int wpa_supplicant_run(struct wpa_global *global)
5214 {
5215         struct wpa_supplicant *wpa_s;
5216
5217         if (global->params.daemonize &&
5218             wpa_supplicant_daemon(global->params.pid_file))
5219                 return -1;
5220
5221         if (global->params.wait_for_monitor) {
5222                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5223                         if (wpa_s->ctrl_iface)
5224                                 wpa_supplicant_ctrl_iface_wait(
5225                                         wpa_s->ctrl_iface);
5226         }
5227
5228         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5229         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5230
5231         eloop_run();
5232
5233         return 0;
5234 }
5235
5236
5237 /**
5238  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5239  * @global: Pointer to global data from wpa_supplicant_init()
5240  *
5241  * This function is called to deinitialize %wpa_supplicant and to free all
5242  * allocated resources. Remaining network interfaces will also be removed.
5243  */
5244 void wpa_supplicant_deinit(struct wpa_global *global)
5245 {
5246         int i;
5247
5248         if (global == NULL)
5249                 return;
5250
5251         eloop_cancel_timeout(wpas_periodic, global, NULL);
5252
5253 #ifdef CONFIG_WIFI_DISPLAY
5254         wifi_display_deinit(global);
5255 #endif /* CONFIG_WIFI_DISPLAY */
5256
5257         while (global->ifaces)
5258                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5259
5260         if (global->ctrl_iface)
5261                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5262
5263         wpas_notify_supplicant_deinitialized(global);
5264
5265         eap_peer_unregister_methods();
5266 #ifdef CONFIG_AP
5267         eap_server_unregister_methods();
5268 #endif /* CONFIG_AP */
5269
5270         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5271                 if (!global->drv_priv[i])
5272                         continue;
5273                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5274         }
5275         os_free(global->drv_priv);
5276
5277         random_deinit();
5278
5279         eloop_destroy();
5280
5281         if (global->params.pid_file) {
5282                 os_daemonize_terminate(global->params.pid_file);
5283                 os_free(global->params.pid_file);
5284         }
5285         os_free(global->params.ctrl_interface);
5286         os_free(global->params.ctrl_interface_group);
5287         os_free(global->params.override_driver);
5288         os_free(global->params.override_ctrl_interface);
5289 #ifdef CONFIG_P2P
5290         os_free(global->params.conf_p2p_dev);
5291 #endif /* CONFIG_P2P */
5292
5293         os_free(global->p2p_disallow_freq.range);
5294         os_free(global->p2p_go_avoid_freq.range);
5295         os_free(global->add_psk);
5296
5297         os_free(global);
5298         wpa_debug_close_syslog();
5299         wpa_debug_close_file();
5300         wpa_debug_close_linux_tracing();
5301 }
5302
5303
5304 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5305 {
5306         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5307             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5308                 char country[3];
5309                 country[0] = wpa_s->conf->country[0];
5310                 country[1] = wpa_s->conf->country[1];
5311                 country[2] = '\0';
5312                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5313                         wpa_printf(MSG_ERROR, "Failed to set country code "
5314                                    "'%s'", country);
5315                 }
5316         }
5317
5318         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5319                 wpas_init_ext_pw(wpa_s);
5320
5321         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5322                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5323
5324 #ifdef CONFIG_WPS
5325         wpas_wps_update_config(wpa_s);
5326 #endif /* CONFIG_WPS */
5327         wpas_p2p_update_config(wpa_s);
5328         wpa_s->conf->changed_parameters = 0;
5329 }
5330
5331
5332 void add_freq(int *freqs, int *num_freqs, int freq)
5333 {
5334         int i;
5335
5336         for (i = 0; i < *num_freqs; i++) {
5337                 if (freqs[i] == freq)
5338                         return;
5339         }
5340
5341         freqs[*num_freqs] = freq;
5342         (*num_freqs)++;
5343 }
5344
5345
5346 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5347 {
5348         struct wpa_bss *bss, *cbss;
5349         const int max_freqs = 10;
5350         int *freqs;
5351         int num_freqs = 0;
5352
5353         freqs = os_calloc(max_freqs + 1, sizeof(int));
5354         if (freqs == NULL)
5355                 return NULL;
5356
5357         cbss = wpa_s->current_bss;
5358
5359         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5360                 if (bss == cbss)
5361                         continue;
5362                 if (bss->ssid_len == cbss->ssid_len &&
5363                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5364                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5365                         add_freq(freqs, &num_freqs, bss->freq);
5366                         if (num_freqs == max_freqs)
5367                                 break;
5368                 }
5369         }
5370
5371         if (num_freqs == 0) {
5372                 os_free(freqs);
5373                 freqs = NULL;
5374         }
5375
5376         return freqs;
5377 }
5378
5379
5380 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5381 {
5382         int timeout;
5383         int count;
5384         int *freqs = NULL;
5385
5386         wpas_connect_work_done(wpa_s);
5387
5388         /*
5389          * Remove possible authentication timeout since the connection failed.
5390          */
5391         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5392
5393         /*
5394          * There is no point in blacklisting the AP if this event is
5395          * generated based on local request to disconnect.
5396          */
5397         if (wpa_s->own_disconnect_req) {
5398                 wpa_s->own_disconnect_req = 0;
5399                 wpa_dbg(wpa_s, MSG_DEBUG,
5400                         "Ignore connection failure due to local request to disconnect");
5401                 return;
5402         }
5403         if (wpa_s->disconnected) {
5404                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5405                         "indication since interface has been put into "
5406                         "disconnected state");
5407                 return;
5408         }
5409
5410         /*
5411          * Add the failed BSSID into the blacklist and speed up next scan
5412          * attempt if there could be other APs that could accept association.
5413          * The current blacklist count indicates how many times we have tried
5414          * connecting to this AP and multiple attempts mean that other APs are
5415          * either not available or has already been tried, so that we can start
5416          * increasing the delay here to avoid constant scanning.
5417          */
5418         count = wpa_blacklist_add(wpa_s, bssid);
5419         if (count == 1 && wpa_s->current_bss) {
5420                 /*
5421                  * This BSS was not in the blacklist before. If there is
5422                  * another BSS available for the same ESS, we should try that
5423                  * next. Otherwise, we may as well try this one once more
5424                  * before allowing other, likely worse, ESSes to be considered.
5425                  */
5426                 freqs = get_bss_freqs_in_ess(wpa_s);
5427                 if (freqs) {
5428                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5429                                 "has been seen; try it next");
5430                         wpa_blacklist_add(wpa_s, bssid);
5431                         /*
5432                          * On the next scan, go through only the known channels
5433                          * used in this ESS based on previous scans to speed up
5434                          * common load balancing use case.
5435                          */
5436                         os_free(wpa_s->next_scan_freqs);
5437                         wpa_s->next_scan_freqs = freqs;
5438                 }
5439         }
5440
5441         /*
5442          * Add previous failure count in case the temporary blacklist was
5443          * cleared due to no other BSSes being available.
5444          */
5445         count += wpa_s->extra_blacklist_count;
5446
5447         if (count > 3 && wpa_s->current_ssid) {
5448                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5449                            "consider temporary network disabling");
5450                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5451         }
5452
5453         switch (count) {
5454         case 1:
5455                 timeout = 100;
5456                 break;
5457         case 2:
5458                 timeout = 500;
5459                 break;
5460         case 3:
5461                 timeout = 1000;
5462                 break;
5463         case 4:
5464                 timeout = 5000;
5465                 break;
5466         default:
5467                 timeout = 10000;
5468                 break;
5469         }
5470
5471         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5472                 "ms", count, timeout);
5473
5474         /*
5475          * TODO: if more than one possible AP is available in scan results,
5476          * could try the other ones before requesting a new scan.
5477          */
5478         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5479                                 1000 * (timeout % 1000));
5480 }
5481
5482
5483 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5484 {
5485         return wpa_s->conf->ap_scan == 2 ||
5486                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5487 }
5488
5489
5490 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5491 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5492                                               struct wpa_ssid *ssid,
5493                                               const char *field,
5494                                               const char *value)
5495 {
5496 #ifdef IEEE8021X_EAPOL
5497         struct eap_peer_config *eap = &ssid->eap;
5498
5499         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5500         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5501                               (const u8 *) value, os_strlen(value));
5502
5503         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5504         case WPA_CTRL_REQ_EAP_IDENTITY:
5505                 os_free(eap->identity);
5506                 eap->identity = (u8 *) os_strdup(value);
5507                 eap->identity_len = os_strlen(value);
5508                 eap->pending_req_identity = 0;
5509                 if (ssid == wpa_s->current_ssid)
5510                         wpa_s->reassociate = 1;
5511                 break;
5512         case WPA_CTRL_REQ_EAP_PASSWORD:
5513                 bin_clear_free(eap->password, eap->password_len);
5514                 eap->password = (u8 *) os_strdup(value);
5515                 eap->password_len = os_strlen(value);
5516                 eap->pending_req_password = 0;
5517                 if (ssid == wpa_s->current_ssid)
5518                         wpa_s->reassociate = 1;
5519                 break;
5520         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5521                 bin_clear_free(eap->new_password, eap->new_password_len);
5522                 eap->new_password = (u8 *) os_strdup(value);
5523                 eap->new_password_len = os_strlen(value);
5524                 eap->pending_req_new_password = 0;
5525                 if (ssid == wpa_s->current_ssid)
5526                         wpa_s->reassociate = 1;
5527                 break;
5528         case WPA_CTRL_REQ_EAP_PIN:
5529                 str_clear_free(eap->pin);
5530                 eap->pin = os_strdup(value);
5531                 eap->pending_req_pin = 0;
5532                 if (ssid == wpa_s->current_ssid)
5533                         wpa_s->reassociate = 1;
5534                 break;
5535         case WPA_CTRL_REQ_EAP_OTP:
5536                 bin_clear_free(eap->otp, eap->otp_len);
5537                 eap->otp = (u8 *) os_strdup(value);
5538                 eap->otp_len = os_strlen(value);
5539                 os_free(eap->pending_req_otp);
5540                 eap->pending_req_otp = NULL;
5541                 eap->pending_req_otp_len = 0;
5542                 break;
5543         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5544                 str_clear_free(eap->private_key_passwd);
5545                 eap->private_key_passwd = os_strdup(value);
5546                 eap->pending_req_passphrase = 0;
5547                 if (ssid == wpa_s->current_ssid)
5548                         wpa_s->reassociate = 1;
5549                 break;
5550         case WPA_CTRL_REQ_SIM:
5551                 str_clear_free(eap->external_sim_resp);
5552                 eap->external_sim_resp = os_strdup(value);
5553                 break;
5554         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5555                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5556                         return -1;
5557                 ssid->mem_only_psk = 1;
5558                 if (ssid->passphrase)
5559                         wpa_config_update_psk(ssid);
5560                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5561                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5562                 break;
5563         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5564                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5565                         return -1;
5566                 if (os_strcmp(value, "good") == 0)
5567                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5568                 else if (os_strcmp(value, "bad") == 0)
5569                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5570                 else
5571                         return -1;
5572                 break;
5573         default:
5574                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5575                 return -1;
5576         }
5577
5578         return 0;
5579 #else /* IEEE8021X_EAPOL */
5580         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5581         return -1;
5582 #endif /* IEEE8021X_EAPOL */
5583 }
5584 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5585
5586
5587 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5588 {
5589         int i;
5590         unsigned int drv_enc;
5591
5592         if (wpa_s->p2p_mgmt)
5593                 return 1; /* no normal network profiles on p2p_mgmt interface */
5594
5595         if (ssid == NULL)
5596                 return 1;
5597
5598         if (ssid->disabled)
5599                 return 1;
5600
5601         if (wpa_s->drv_capa_known)
5602                 drv_enc = wpa_s->drv_enc;
5603         else
5604                 drv_enc = (unsigned int) -1;
5605
5606         for (i = 0; i < NUM_WEP_KEYS; i++) {
5607                 size_t len = ssid->wep_key_len[i];
5608                 if (len == 0)
5609                         continue;
5610                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5611                         continue;
5612                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5613                         continue;
5614                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5615                         continue;
5616                 return 1; /* invalid WEP key */
5617         }
5618
5619         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5620             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5621             !ssid->mem_only_psk)
5622                 return 1;
5623
5624         return 0;
5625 }
5626
5627
5628 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5629 {
5630 #ifdef CONFIG_IEEE80211W
5631         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5632                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5633                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5634                         /*
5635                          * Driver does not support BIP -- ignore pmf=1 default
5636                          * since the connection with PMF would fail and the
5637                          * configuration does not require PMF to be enabled.
5638                          */
5639                         return NO_MGMT_FRAME_PROTECTION;
5640                 }
5641
5642                 return wpa_s->conf->pmf;
5643         }
5644
5645         return ssid->ieee80211w;
5646 #else /* CONFIG_IEEE80211W */
5647         return NO_MGMT_FRAME_PROTECTION;
5648 #endif /* CONFIG_IEEE80211W */
5649 }
5650
5651
5652 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5653 {
5654         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5655                 return 1;
5656         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5657                 return 0;
5658         return -1;
5659 }
5660
5661
5662 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5663 {
5664         struct wpa_ssid *ssid = wpa_s->current_ssid;
5665         int dur;
5666         struct os_reltime now;
5667
5668         if (ssid == NULL) {
5669                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5670                            "SSID block");
5671                 return;
5672         }
5673
5674         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5675                 return;
5676
5677         ssid->auth_failures++;
5678
5679 #ifdef CONFIG_P2P
5680         if (ssid->p2p_group &&
5681             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5682                 /*
5683                  * Skip the wait time since there is a short timeout on the
5684                  * connection to a P2P group.
5685                  */
5686                 return;
5687         }
5688 #endif /* CONFIG_P2P */
5689
5690         if (ssid->auth_failures > 50)
5691                 dur = 300;
5692         else if (ssid->auth_failures > 10)
5693                 dur = 120;
5694         else if (ssid->auth_failures > 5)
5695                 dur = 90;
5696         else if (ssid->auth_failures > 3)
5697                 dur = 60;
5698         else if (ssid->auth_failures > 2)
5699                 dur = 30;
5700         else if (ssid->auth_failures > 1)
5701                 dur = 20;
5702         else
5703                 dur = 10;
5704
5705         if (ssid->auth_failures > 1 &&
5706             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5707                 dur += os_random() % (ssid->auth_failures * 10);
5708
5709         os_get_reltime(&now);
5710         if (now.sec + dur <= ssid->disabled_until.sec)
5711                 return;
5712
5713         ssid->disabled_until.sec = now.sec + dur;
5714
5715         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5716                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5717                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5718                 ssid->auth_failures, dur, reason);
5719 }
5720
5721
5722 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5723                               struct wpa_ssid *ssid, int clear_failures)
5724 {
5725         if (ssid == NULL)
5726                 return;
5727
5728         if (ssid->disabled_until.sec) {
5729                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5730                         "id=%d ssid=\"%s\"",
5731                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5732         }
5733         ssid->disabled_until.sec = 0;
5734         ssid->disabled_until.usec = 0;
5735         if (clear_failures)
5736                 ssid->auth_failures = 0;
5737 }
5738
5739
5740 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5741 {
5742         size_t i;
5743
5744         if (wpa_s->disallow_aps_bssid == NULL)
5745                 return 0;
5746
5747         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5748                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5749                               bssid, ETH_ALEN) == 0)
5750                         return 1;
5751         }
5752
5753         return 0;
5754 }
5755
5756
5757 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5758                     size_t ssid_len)
5759 {
5760         size_t i;
5761
5762         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5763                 return 0;
5764
5765         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5766                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5767                 if (ssid_len == s->ssid_len &&
5768                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5769                         return 1;
5770         }
5771
5772         return 0;
5773 }
5774
5775
5776 /**
5777  * wpas_request_connection - Request a new connection
5778  * @wpa_s: Pointer to the network interface
5779  *
5780  * This function is used to request a new connection to be found. It will mark
5781  * the interface to allow reassociation and request a new scan to find a
5782  * suitable network to connect to.
5783  */
5784 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5785 {
5786         wpa_s->normal_scans = 0;
5787         wpa_s->scan_req = NORMAL_SCAN_REQ;
5788         wpa_supplicant_reinit_autoscan(wpa_s);
5789         wpa_s->extra_blacklist_count = 0;
5790         wpa_s->disconnected = 0;
5791         wpa_s->reassociate = 1;
5792
5793         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5794                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5795         else
5796                 wpa_s->reattach = 0;
5797 }
5798
5799
5800 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5801                     struct wpa_used_freq_data *freqs_data,
5802                     unsigned int len)
5803 {
5804         unsigned int i;
5805
5806         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5807                 len, title);
5808         for (i = 0; i < len; i++) {
5809                 struct wpa_used_freq_data *cur = &freqs_data[i];
5810                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5811                         i, cur->freq, cur->flags);
5812         }
5813 }
5814
5815
5816 /*
5817  * Find the operating frequencies of any of the virtual interfaces that
5818  * are using the same radio as the current interface, and in addition, get
5819  * information about the interface types that are using the frequency.
5820  */
5821 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5822                                 struct wpa_used_freq_data *freqs_data,
5823                                 unsigned int len)
5824 {
5825         struct wpa_supplicant *ifs;
5826         u8 bssid[ETH_ALEN];
5827         int freq;
5828         unsigned int idx = 0, i;
5829
5830         wpa_dbg(wpa_s, MSG_DEBUG,
5831                 "Determining shared radio frequencies (max len %u)", len);
5832         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5833
5834         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5835                          radio_list) {
5836                 if (idx == len)
5837                         break;
5838
5839                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5840                         continue;
5841
5842                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5843                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5844                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5845                         freq = ifs->current_ssid->frequency;
5846                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5847                         freq = ifs->assoc_freq;
5848                 else
5849                         continue;
5850
5851                 /* Hold only distinct freqs */
5852                 for (i = 0; i < idx; i++)
5853                         if (freqs_data[i].freq == freq)
5854                                 break;
5855
5856                 if (i == idx)
5857                         freqs_data[idx++].freq = freq;
5858
5859                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5860                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5861                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5862                                 WPA_FREQ_USED_BY_INFRA_STATION;
5863                 }
5864         }
5865
5866         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5867         return idx;
5868 }
5869
5870
5871 /*
5872  * Find the operating frequencies of any of the virtual interfaces that
5873  * are using the same radio as the current interface.
5874  */
5875 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5876                            int *freq_array, unsigned int len)
5877 {
5878         struct wpa_used_freq_data *freqs_data;
5879         int num, i;
5880
5881         os_memset(freq_array, 0, sizeof(int) * len);
5882
5883         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5884         if (!freqs_data)
5885                 return -1;
5886
5887         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5888         for (i = 0; i < num; i++)
5889                 freq_array[i] = freqs_data[i].freq;
5890
5891         os_free(freqs_data);
5892
5893         return num;
5894 }
5895
5896
5897 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5898 {
5899         struct rrm_data *rrm = data;
5900
5901         if (!rrm->notify_neighbor_rep) {
5902                 wpa_printf(MSG_ERROR,
5903                            "RRM: Unexpected neighbor report timeout");
5904                 return;
5905         }
5906
5907         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5908         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5909
5910         rrm->notify_neighbor_rep = NULL;
5911         rrm->neighbor_rep_cb_ctx = NULL;
5912 }
5913
5914
5915 /*
5916  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5917  * @wpa_s: Pointer to wpa_supplicant
5918  */
5919 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5920 {
5921         wpa_s->rrm.rrm_used = 0;
5922
5923         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5924                              NULL);
5925         if (wpa_s->rrm.notify_neighbor_rep)
5926                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5927         wpa_s->rrm.next_neighbor_rep_token = 1;
5928 }
5929
5930
5931 /*
5932  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5933  * @wpa_s: Pointer to wpa_supplicant
5934  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5935  * @report_len: Length of neighbor report buffer
5936  */
5937 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5938                                    const u8 *report, size_t report_len)
5939 {
5940         struct wpabuf *neighbor_rep;
5941
5942         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5943         if (report_len < 1)
5944                 return;
5945
5946         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5947                 wpa_printf(MSG_DEBUG,
5948                            "RRM: Discarding neighbor report with token %d (expected %d)",
5949                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5950                 return;
5951         }
5952
5953         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5954                              NULL);
5955
5956         if (!wpa_s->rrm.notify_neighbor_rep) {
5957                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5958                 return;
5959         }
5960
5961         /* skipping the first byte, which is only an id (dialog token) */
5962         neighbor_rep = wpabuf_alloc(report_len - 1);
5963         if (neighbor_rep == NULL)
5964                 return;
5965         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5966         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5967                    report[0]);
5968         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5969                                        neighbor_rep);
5970         wpa_s->rrm.notify_neighbor_rep = NULL;
5971         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5972 }
5973
5974
5975 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5976 /* Workaround different, undefined for Windows, error codes used here */
5977 #define ENOTCONN -1
5978 #define EOPNOTSUPP -1
5979 #define ECANCELED -1
5980 #endif
5981
5982 /**
5983  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5984  * @wpa_s: Pointer to wpa_supplicant
5985  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5986  *        is sent in the request.
5987  * @cb: Callback function to be called once the requested report arrives, or
5988  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5989  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5990  *      the requester's responsibility to free it.
5991  *      In the latter case NULL will be sent in 'neighbor_rep'.
5992  * @cb_ctx: Context value to send the callback function
5993  * Returns: 0 in case of success, negative error code otherwise
5994  *
5995  * In case there is a previous request which has not been answered yet, the
5996  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5997  * Request must contain a callback function.
5998  */
5999 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6000                                        const struct wpa_ssid *ssid,
6001                                        void (*cb)(void *ctx,
6002                                                   struct wpabuf *neighbor_rep),
6003                                        void *cb_ctx)
6004 {
6005         struct wpabuf *buf;
6006         const u8 *rrm_ie;
6007
6008         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6009                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6010                 return -ENOTCONN;
6011         }
6012
6013         if (!wpa_s->rrm.rrm_used) {
6014                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6015                 return -EOPNOTSUPP;
6016         }
6017
6018         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6019                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6020         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6021             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6022                 wpa_printf(MSG_DEBUG,
6023                            "RRM: No network support for Neighbor Report.");
6024                 return -EOPNOTSUPP;
6025         }
6026
6027         if (!cb) {
6028                 wpa_printf(MSG_DEBUG,
6029                            "RRM: Neighbor Report request must provide a callback.");
6030                 return -EINVAL;
6031         }
6032
6033         /* Refuse if there's a live request */
6034         if (wpa_s->rrm.notify_neighbor_rep) {
6035                 wpa_printf(MSG_DEBUG,
6036                            "RRM: Currently handling previous Neighbor Report.");
6037                 return -EBUSY;
6038         }
6039
6040         /* 3 = action category + action code + dialog token */
6041         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6042         if (buf == NULL) {
6043                 wpa_printf(MSG_DEBUG,
6044                            "RRM: Failed to allocate Neighbor Report Request");
6045                 return -ENOMEM;
6046         }
6047
6048         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6049                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6050                    wpa_s->rrm.next_neighbor_rep_token);
6051
6052         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6053         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6054         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6055         if (ssid) {
6056                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6057                 wpabuf_put_u8(buf, ssid->ssid_len);
6058                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6059         }
6060
6061         wpa_s->rrm.next_neighbor_rep_token++;
6062
6063         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6064                                 wpa_s->own_addr, wpa_s->bssid,
6065                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6066                 wpa_printf(MSG_DEBUG,
6067                            "RRM: Failed to send Neighbor Report Request");
6068                 wpabuf_free(buf);
6069                 return -ECANCELED;
6070         }
6071
6072         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6073         wpa_s->rrm.notify_neighbor_rep = cb;
6074         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6075                                wpas_rrm_neighbor_rep_timeout_handler,
6076                                &wpa_s->rrm, NULL);
6077
6078         wpabuf_free(buf);
6079         return 0;
6080 }
6081
6082
6083 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6084                                               const u8 *src,
6085                                               const u8 *frame, size_t len,
6086                                               int rssi)
6087 {
6088         struct wpabuf *buf;
6089         const struct rrm_link_measurement_request *req;
6090         struct rrm_link_measurement_report report;
6091
6092         if (wpa_s->wpa_state != WPA_COMPLETED) {
6093                 wpa_printf(MSG_INFO,
6094                            "RRM: Ignoring link measurement request. Not associated");
6095                 return;
6096         }
6097
6098         if (!wpa_s->rrm.rrm_used) {
6099                 wpa_printf(MSG_INFO,
6100                            "RRM: Ignoring link measurement request. Not RRM network");
6101                 return;
6102         }
6103
6104         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6105                 wpa_printf(MSG_INFO,
6106                            "RRM: Measurement report failed. TX power insertion not supported");
6107                 return;
6108         }
6109
6110         req = (const struct rrm_link_measurement_request *) frame;
6111         if (len < sizeof(*req)) {
6112                 wpa_printf(MSG_INFO,
6113                            "RRM: Link measurement report failed. Request too short");
6114                 return;
6115         }
6116
6117         os_memset(&report, 0, sizeof(report));
6118         report.tpc.eid = WLAN_EID_TPC_REPORT;
6119         report.tpc.len = 2;
6120         report.rsni = 255; /* 255 indicates that RSNI is not available */
6121         report.dialog_token = req->dialog_token;
6122
6123         /*
6124          * It's possible to estimate RCPI based on RSSI in dBm. This
6125          * calculation will not reflect the correct value for high rates,
6126          * but it's good enough for Action frames which are transmitted
6127          * with up to 24 Mbps rates.
6128          */
6129         if (!rssi)
6130                 report.rcpi = 255; /* not available */
6131         else if (rssi < -110)
6132                 report.rcpi = 0;
6133         else if (rssi > 0)
6134                 report.rcpi = 220;
6135         else
6136                 report.rcpi = (rssi + 110) * 2;
6137
6138         /* action_category + action_code */
6139         buf = wpabuf_alloc(2 + sizeof(report));
6140         if (buf == NULL) {
6141                 wpa_printf(MSG_ERROR,
6142                            "RRM: Link measurement report failed. Buffer allocation failed");
6143                 return;
6144         }
6145
6146         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6147         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6148         wpabuf_put_data(buf, &report, sizeof(report));
6149         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6150                     wpabuf_head(buf), wpabuf_len(buf));
6151
6152         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6153                                 wpa_s->own_addr, wpa_s->bssid,
6154                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6155                 wpa_printf(MSG_ERROR,
6156                            "RRM: Link measurement report failed. Send action failed");
6157         }
6158         wpabuf_free(buf);
6159 }
6160
6161
6162 struct wpa_supplicant *
6163 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6164 {
6165         switch (frame) {
6166 #ifdef CONFIG_P2P
6167         case VENDOR_ELEM_PROBE_REQ_P2P:
6168         case VENDOR_ELEM_PROBE_RESP_P2P:
6169         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6170         case VENDOR_ELEM_BEACON_P2P_GO:
6171         case VENDOR_ELEM_P2P_PD_REQ:
6172         case VENDOR_ELEM_P2P_PD_RESP:
6173         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6174         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6175         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6176         case VENDOR_ELEM_P2P_INV_REQ:
6177         case VENDOR_ELEM_P2P_INV_RESP:
6178         case VENDOR_ELEM_P2P_ASSOC_REQ:
6179         case VENDOR_ELEM_P2P_ASSOC_RESP:
6180                 return wpa_s->parent;
6181 #endif /* CONFIG_P2P */
6182         default:
6183                 return wpa_s;
6184         }
6185 }
6186
6187
6188 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6189 {
6190         unsigned int i;
6191         char buf[30];
6192
6193         wpa_printf(MSG_DEBUG, "Update vendor elements");
6194
6195         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6196                 if (wpa_s->vendor_elem[i]) {
6197                         int res;
6198
6199                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6200                         if (!os_snprintf_error(sizeof(buf), res)) {
6201                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6202                                                 wpa_s->vendor_elem[i]);
6203                         }
6204                 }
6205         }
6206
6207 #ifdef CONFIG_P2P
6208         if (wpa_s->parent == wpa_s &&
6209             wpa_s->global->p2p &&
6210             !wpa_s->global->p2p_disabled)
6211                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6212 #endif /* CONFIG_P2P */
6213 }
6214
6215
6216 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6217                             const u8 *elem, size_t len)
6218 {
6219         u8 *ie, *end;
6220
6221         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6222         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6223
6224         for (; ie + 1 < end; ie += 2 + ie[1]) {
6225                 if (ie + len > end)
6226                         break;
6227                 if (os_memcmp(ie, elem, len) != 0)
6228                         continue;
6229
6230                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6231                         wpabuf_free(wpa_s->vendor_elem[frame]);
6232                         wpa_s->vendor_elem[frame] = NULL;
6233                 } else {
6234                         os_memmove(ie, ie + len, end - (ie + len));
6235                         wpa_s->vendor_elem[frame]->used -= len;
6236                 }
6237                 wpas_vendor_elem_update(wpa_s);
6238                 return 0;
6239         }
6240
6241         return -1;
6242 }