wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
 196             (wpa_s->wpa_state == WPA_AUTHENTICATING ||
 197              wpa_s->wpa_state == WPA_ASSOCIATING))
 198                 bssid = wpa_s->pending_bssid;
 199         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 200                 MAC2STR(bssid));
 201         wpa_blacklist_add(wpa_s, bssid);
 202         wpa_sm_notify_disassoc(wpa_s->wpa);
 203         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 204         wpa_s->reassociate = 1;
 205
 206         /*
 207          * If we timed out, the AP or the local radio may be busy.
 208          * So, wait a second until scanning again.
 209          */
 210         wpa_supplicant_req_scan(wpa_s, 1, 0);
 211 }
 212
 213
 214 /**
 215  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 216  * @wpa_s: Pointer to wpa_supplicant data
 217  * @sec: Number of seconds after which to time out authentication
 218  * @usec: Number of microseconds after which to time out authentication
 219  *
 220  * This function is used to schedule a timeout for the current authentication
 221  * attempt.
 222  */
 223 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 224                                      int sec, int usec)
 225 {
 226         if (wpa_s->conf->ap_scan == 0 &&
 227             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 228                 return;
 229
 230         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 231                 "%d usec", sec, usec);
 232         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 233         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 234 }
 235
 236
 237 /**
 238  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 239  * @wpa_s: Pointer to wpa_supplicant data
 240  *
 241  * This function is used to cancel authentication timeout scheduled with
 242  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 243  * been completed.
 244  */
 245 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 246 {
 247         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 248         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 249         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 250 }
 251
 252
 253 /**
 254  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 255  * @wpa_s: Pointer to wpa_supplicant data
 256  *
 257  * This function is used to configure EAPOL state machine based on the selected
 258  * authentication mode.
 259  */
 260 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 261 {
 262 #ifdef IEEE8021X_EAPOL
 263         struct eapol_config eapol_conf;
 264         struct wpa_ssid *ssid = wpa_s->current_ssid;
 265
 266 #ifdef CONFIG_IBSS_RSN
 267         if (ssid->mode == WPAS_MODE_IBSS &&
 268             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 269             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 270                 /*
 271                  * RSN IBSS authentication is per-STA and we can disable the
 272                  * per-BSSID EAPOL authentication.
 273                  */
 274                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 275                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 276                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277                 return;
 278         }
 279 #endif /* CONFIG_IBSS_RSN */
 280
 281         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 282         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 283
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 285             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 286                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 287         else
 288                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 289
 290         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 291         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 292                 eapol_conf.accept_802_1x_keys = 1;
 293                 eapol_conf.required_keys = 0;
 294                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 295                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 296                 }
 297                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 298                         eapol_conf.required_keys |=
 299                                 EAPOL_REQUIRE_KEY_BROADCAST;
 300                 }
 301
 302                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 303                         eapol_conf.required_keys = 0;
 304         }
 305         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 306         eapol_conf.workaround = ssid->eap_workaround;
 307         eapol_conf.eap_disabled =
 308                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 309                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 310                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 311         eapol_conf.external_sim = wpa_s->conf->external_sim;
 312
 313 #ifdef CONFIG_WPS
 314         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 315                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 316                 if (wpa_s->current_bss) {
 317                         struct wpabuf *ie;
 318                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 319                                                          WPS_IE_VENDOR_TYPE);
 320                         if (ie) {
 321                                 if (wps_is_20(ie))
 322                                         eapol_conf.wps |=
 323                                                 EAPOL_PEER_IS_WPS20_AP;
 324                                 wpabuf_free(ie);
 325                         }
 326                 }
 327         }
 328 #endif /* CONFIG_WPS */
 329
 330         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 331
 332         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 333 #endif /* IEEE8021X_EAPOL */
 334 }
 335
 336
 337 /**
 338  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 339  * @wpa_s: Pointer to wpa_supplicant data
 340  * @ssid: Configuration data for the network
 341  *
 342  * This function is used to configure WPA state machine and related parameters
 343  * to a mode where WPA is not enabled. This is called as part of the
 344  * authentication configuration when the selected network does not use WPA.
 345  */
 346 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 347                                        struct wpa_ssid *ssid)
 348 {
 349         int i;
 350
 351         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 353         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 355         else
 356                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 357         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 359         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 360         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 361         wpa_s->group_cipher = WPA_CIPHER_NONE;
 362         wpa_s->mgmt_group_cipher = 0;
 363
 364         for (i = 0; i < NUM_WEP_KEYS; i++) {
 365                 if (ssid->wep_key_len[i] > 5) {
 366                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 367                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 368                         break;
 369                 } else if (ssid->wep_key_len[i] > 0) {
 370                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 371                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 372                         break;
 373                 }
 374         }
 375
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 377         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 379                          wpa_s->pairwise_cipher);
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 381 #ifdef CONFIG_IEEE80211W
 382         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 383                          wpa_s->mgmt_group_cipher);
 384 #endif /* CONFIG_IEEE80211W */
 385
 386         pmksa_cache_clear_current(wpa_s->wpa);
 387 }
 388
 389
 390 void free_hw_features(struct wpa_supplicant *wpa_s)
 391 {
 392         int i;
 393         if (wpa_s->hw.modes == NULL)
 394                 return;
 395
 396         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 397                 os_free(wpa_s->hw.modes[i].channels);
 398                 os_free(wpa_s->hw.modes[i].rates);
 399         }
 400
 401         os_free(wpa_s->hw.modes);
 402         wpa_s->hw.modes = NULL;
 403 }
 404
 405
 406 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 407 {
 408         struct wpa_bss_tmp_disallowed *bss, *prev;
 409
 410         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 411                               struct wpa_bss_tmp_disallowed, list) {
 412                 dl_list_del(&bss->list);
 413                 os_free(bss);
 414         }
 415 }
 416
 417
 418 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 419 {
 420         int i;
 421
 422         bgscan_deinit(wpa_s);
 423         autoscan_deinit(wpa_s);
 424         scard_deinit(wpa_s->scard);
 425         wpa_s->scard = NULL;
 426         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 427         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 428         l2_packet_deinit(wpa_s->l2);
 429         wpa_s->l2 = NULL;
 430         if (wpa_s->l2_br) {
 431                 l2_packet_deinit(wpa_s->l2_br);
 432                 wpa_s->l2_br = NULL;
 433         }
 434 #ifdef CONFIG_TESTING_OPTIONS
 435         l2_packet_deinit(wpa_s->l2_test);
 436         wpa_s->l2_test = NULL;
 437 #endif /* CONFIG_TESTING_OPTIONS */
 438
 439         if (wpa_s->conf != NULL) {
 440                 struct wpa_ssid *ssid;
 441                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 442                         wpas_notify_network_removed(wpa_s, ssid);
 443         }
 444
 445         os_free(wpa_s->confname);
 446         wpa_s->confname = NULL;
 447
 448         os_free(wpa_s->confanother);
 449         wpa_s->confanother = NULL;
 450
 451         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 452         eapol_sm_deinit(wpa_s->eapol);
 453         wpa_s->eapol = NULL;
 454
 455         rsn_preauth_deinit(wpa_s->wpa);
 456
 457 #ifdef CONFIG_TDLS
 458         wpa_tdls_deinit(wpa_s->wpa);
 459 #endif /* CONFIG_TDLS */
 460
 461         wmm_ac_clear_saved_tspecs(wpa_s);
 462         pmksa_candidate_free(wpa_s->wpa);
 463         wpa_sm_deinit(wpa_s->wpa);
 464         wpa_s->wpa = NULL;
 465         wpa_blacklist_clear(wpa_s);
 466
 467         wpa_bss_deinit(wpa_s);
 468
 469         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 470         wpa_supplicant_cancel_scan(wpa_s);
 471         wpa_supplicant_cancel_auth_timeout(wpa_s);
 472         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 473 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 474         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 475                              wpa_s, NULL);
 476 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 477
 478         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 479
 480         wpas_wps_deinit(wpa_s);
 481
 482         wpabuf_free(wpa_s->pending_eapol_rx);
 483         wpa_s->pending_eapol_rx = NULL;
 484
 485 #ifdef CONFIG_IBSS_RSN
 486         ibss_rsn_deinit(wpa_s->ibss_rsn);
 487         wpa_s->ibss_rsn = NULL;
 488 #endif /* CONFIG_IBSS_RSN */
 489
 490         sme_deinit(wpa_s);
 491
 492 #ifdef CONFIG_AP
 493         wpa_supplicant_ap_deinit(wpa_s);
 494 #endif /* CONFIG_AP */
 495
 496         wpas_p2p_deinit(wpa_s);
 497
 498 #ifdef CONFIG_OFFCHANNEL
 499         offchannel_deinit(wpa_s);
 500 #endif /* CONFIG_OFFCHANNEL */
 501
 502         wpa_supplicant_cancel_sched_scan(wpa_s);
 503
 504         os_free(wpa_s->next_scan_freqs);
 505         wpa_s->next_scan_freqs = NULL;
 506
 507         os_free(wpa_s->manual_scan_freqs);
 508         wpa_s->manual_scan_freqs = NULL;
 509
 510         os_free(wpa_s->manual_sched_scan_freqs);
 511         wpa_s->manual_sched_scan_freqs = NULL;
 512
 513         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 514
 515         /*
 516          * Need to remove any pending gas-query radio work before the
 517          * gas_query_deinit() call because gas_query::work has not yet been set
 518          * for works that have not been started. gas_query_free() will be unable
 519          * to cancel such pending radio works and once the pending gas-query
 520          * radio work eventually gets removed, the deinit notification call to
 521          * gas_query_start_cb() would result in dereferencing freed memory.
 522          */
 523         if (wpa_s->radio)
 524                 radio_remove_works(wpa_s, "gas-query", 0);
 525         gas_query_deinit(wpa_s->gas);
 526         wpa_s->gas = NULL;
 527
 528         free_hw_features(wpa_s);
 529
 530         ieee802_1x_dealloc_kay_sm(wpa_s);
 531
 532         os_free(wpa_s->bssid_filter);
 533         wpa_s->bssid_filter = NULL;
 534
 535         os_free(wpa_s->disallow_aps_bssid);
 536         wpa_s->disallow_aps_bssid = NULL;
 537         os_free(wpa_s->disallow_aps_ssid);
 538         wpa_s->disallow_aps_ssid = NULL;
 539
 540         wnm_bss_keep_alive_deinit(wpa_s);
 541 #ifdef CONFIG_WNM
 542         wnm_deallocate_memory(wpa_s);
 543 #endif /* CONFIG_WNM */
 544
 545         ext_password_deinit(wpa_s->ext_pw);
 546         wpa_s->ext_pw = NULL;
 547
 548         wpabuf_free(wpa_s->last_gas_resp);
 549         wpa_s->last_gas_resp = NULL;
 550         wpabuf_free(wpa_s->prev_gas_resp);
 551         wpa_s->prev_gas_resp = NULL;
 552
 553         os_free(wpa_s->last_scan_res);
 554         wpa_s->last_scan_res = NULL;
 555
 556 #ifdef CONFIG_HS20
 557         if (wpa_s->drv_priv)
 558                 wpa_drv_configure_frame_filters(wpa_s, 0);
 559         hs20_deinit(wpa_s);
 560 #endif /* CONFIG_HS20 */
 561
 562         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 563                 wpabuf_free(wpa_s->vendor_elem[i]);
 564                 wpa_s->vendor_elem[i] = NULL;
 565         }
 566
 567         wmm_ac_notify_disassoc(wpa_s);
 568
 569         wpa_s->sched_scan_plans_num = 0;
 570         os_free(wpa_s->sched_scan_plans);
 571         wpa_s->sched_scan_plans = NULL;
 572
 573 #ifdef CONFIG_MBO
 574         wpa_s->non_pref_chan_num = 0;
 575         os_free(wpa_s->non_pref_chan);
 576         wpa_s->non_pref_chan = NULL;
 577 #endif /* CONFIG_MBO */
 578
 579         free_bss_tmp_disallowed(wpa_s);
 580
 581         wpabuf_free(wpa_s->lci);
 582         wpa_s->lci = NULL;
 583 }
 584
 585
 586 /**
 587  * wpa_clear_keys - Clear keys configured for the driver
 588  * @wpa_s: Pointer to wpa_supplicant data
 589  * @addr: Previously used BSSID or %NULL if not available
 590  *
 591  * This function clears the encryption keys that has been previously configured
 592  * for the driver.
 593  */
 594 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 595 {
 596         int i, max;
 597
 598 #ifdef CONFIG_IEEE80211W
 599         max = 6;
 600 #else /* CONFIG_IEEE80211W */
 601         max = 4;
 602 #endif /* CONFIG_IEEE80211W */
 603
 604         /* MLME-DELETEKEYS.request */
 605         for (i = 0; i < max; i++) {
 606                 if (wpa_s->keys_cleared & BIT(i))
 607                         continue;
 608                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 609                                 NULL, 0);
 610         }
 611         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 612             !is_zero_ether_addr(addr)) {
 613                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 614                                 0);
 615                 /* MLME-SETPROTECTION.request(None) */
 616                 wpa_drv_mlme_setprotection(
 617                         wpa_s, addr,
 618                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 619                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 620         }
 621         wpa_s->keys_cleared = (u32) -1;
 622 }
 623
 624
 625 /**
 626  * wpa_supplicant_state_txt - Get the connection state name as a text string
 627  * @state: State (wpa_state; WPA_*)
 628  * Returns: The state name as a printable text string
 629  */
 630 const char * wpa_supplicant_state_txt(enum wpa_states state)
 631 {
 632         switch (state) {
 633         case WPA_DISCONNECTED:
 634                 return "DISCONNECTED";
 635         case WPA_INACTIVE:
 636                 return "INACTIVE";
 637         case WPA_INTERFACE_DISABLED:
 638                 return "INTERFACE_DISABLED";
 639         case WPA_SCANNING:
 640                 return "SCANNING";
 641         case WPA_AUTHENTICATING:
 642                 return "AUTHENTICATING";
 643         case WPA_ASSOCIATING:
 644                 return "ASSOCIATING";
 645         case WPA_ASSOCIATED:
 646                 return "ASSOCIATED";
 647         case WPA_4WAY_HANDSHAKE:
 648                 return "4WAY_HANDSHAKE";
 649         case WPA_GROUP_HANDSHAKE:
 650                 return "GROUP_HANDSHAKE";
 651         case WPA_COMPLETED:
 652                 return "COMPLETED";
 653         default:
 654                 return "UNKNOWN";
 655         }
 656 }
 657
 658
 659 #ifdef CONFIG_BGSCAN
 660
 661 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 662 {
 663         const char *name;
 664
 665         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 666                 name = wpa_s->current_ssid->bgscan;
 667         else
 668                 name = wpa_s->conf->bgscan;
 669         if (name == NULL || name[0] == '\0')
 670                 return;
 671         if (wpas_driver_bss_selection(wpa_s))
 672                 return;
 673         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 674                 return;
 675 #ifdef CONFIG_P2P
 676         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 677                 return;
 678 #endif /* CONFIG_P2P */
 679
 680         bgscan_deinit(wpa_s);
 681         if (wpa_s->current_ssid) {
 682                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 683                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 684                                 "bgscan");
 685                         /*
 686                          * Live without bgscan; it is only used as a roaming
 687                          * optimization, so the initial connection is not
 688                          * affected.
 689                          */
 690                 } else {
 691                         struct wpa_scan_results *scan_res;
 692                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 693                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 694                                                                    0);
 695                         if (scan_res) {
 696                                 bgscan_notify_scan(wpa_s, scan_res);
 697                                 wpa_scan_results_free(scan_res);
 698                         }
 699                 }
 700         } else
 701                 wpa_s->bgscan_ssid = NULL;
 702 }
 703
 704
 705 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 706 {
 707         if (wpa_s->bgscan_ssid != NULL) {
 708                 bgscan_deinit(wpa_s);
 709                 wpa_s->bgscan_ssid = NULL;
 710         }
 711 }
 712
 713 #endif /* CONFIG_BGSCAN */
 714
 715
 716 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 717 {
 718         if (autoscan_init(wpa_s, 0))
 719                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 720 }
 721
 722
 723 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 724 {
 725         autoscan_deinit(wpa_s);
 726 }
 727
 728
 729 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 730 {
 731         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 732             wpa_s->wpa_state == WPA_SCANNING) {
 733                 autoscan_deinit(wpa_s);
 734                 wpa_supplicant_start_autoscan(wpa_s);
 735         }
 736 }
 737
 738
 739 /**
 740  * wpa_supplicant_set_state - Set current connection state
 741  * @wpa_s: Pointer to wpa_supplicant data
 742  * @state: The new connection state
 743  *
 744  * This function is called whenever the connection state changes, e.g.,
 745  * association is completed for WPA/WPA2 4-Way Handshake is started.
 746  */
 747 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 748                               enum wpa_states state)
 749 {
 750         enum wpa_states old_state = wpa_s->wpa_state;
 751
 752         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 753                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 754                 wpa_supplicant_state_txt(state));
 755
 756         if (state == WPA_INTERFACE_DISABLED) {
 757                 /* Assure normal scan when interface is restored */
 758                 wpa_s->normal_scans = 0;
 759         }
 760
 761         if (state == WPA_COMPLETED) {
 762                 wpas_connect_work_done(wpa_s);
 763                 /* Reinitialize normal_scan counter */
 764                 wpa_s->normal_scans = 0;
 765         }
 766
 767 #ifdef CONFIG_P2P
 768         /*
 769          * P2PS client has to reply to Probe Request frames received on the
 770          * group operating channel. Enable Probe Request frame reporting for
 771          * P2P connected client in case p2p_cli_probe configuration property is
 772          * set to 1.
 773          */
 774         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 775             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 776             wpa_s->current_ssid->p2p_group) {
 777                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 778                         wpa_dbg(wpa_s, MSG_DEBUG,
 779                                 "P2P: Enable CLI Probe Request RX reporting");
 780                         wpa_s->p2p_cli_probe =
 781                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 782                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 783                         wpa_dbg(wpa_s, MSG_DEBUG,
 784                                 "P2P: Disable CLI Probe Request RX reporting");
 785                         wpa_s->p2p_cli_probe = 0;
 786                         wpa_drv_probe_req_report(wpa_s, 0);
 787                 }
 788         }
 789 #endif /* CONFIG_P2P */
 790
 791         if (state != WPA_SCANNING)
 792                 wpa_supplicant_notify_scanning(wpa_s, 0);
 793
 794         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 795                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 796 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 797                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 798                         MACSTR " completed [id=%d id_str=%s]",
 799                         MAC2STR(wpa_s->bssid),
 800                         ssid ? ssid->id : -1,
 801                         ssid && ssid->id_str ? ssid->id_str : "");
 802 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 803                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 804                 wpa_blacklist_clear(wpa_s);
 805                 wpa_s->extra_blacklist_count = 0;
 806                 wpa_s->new_connection = 0;
 807                 wpa_drv_set_operstate(wpa_s, 1);
 808 #ifndef IEEE8021X_EAPOL
 809                 wpa_drv_set_supp_port(wpa_s, 1);
 810 #endif /* IEEE8021X_EAPOL */
 811                 wpa_s->after_wps = 0;
 812                 wpa_s->known_wps_freq = 0;
 813                 wpas_p2p_completed(wpa_s);
 814
 815                 sme_sched_obss_scan(wpa_s, 1);
 816         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 817                    state == WPA_ASSOCIATED) {
 818                 wpa_s->new_connection = 1;
 819                 wpa_drv_set_operstate(wpa_s, 0);
 820 #ifndef IEEE8021X_EAPOL
 821                 wpa_drv_set_supp_port(wpa_s, 0);
 822 #endif /* IEEE8021X_EAPOL */
 823                 sme_sched_obss_scan(wpa_s, 0);
 824         }
 825         wpa_s->wpa_state = state;
 826
 827 #ifdef CONFIG_BGSCAN
 828         if (state == WPA_COMPLETED)
 829                 wpa_supplicant_start_bgscan(wpa_s);
 830         else if (state < WPA_ASSOCIATED)
 831                 wpa_supplicant_stop_bgscan(wpa_s);
 832 #endif /* CONFIG_BGSCAN */
 833
 834         if (state == WPA_AUTHENTICATING)
 835                 wpa_supplicant_stop_autoscan(wpa_s);
 836
 837         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 838                 wpa_supplicant_start_autoscan(wpa_s);
 839
 840         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 841                 wmm_ac_notify_disassoc(wpa_s);
 842
 843         if (wpa_s->wpa_state != old_state) {
 844                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 845
 846                 /*
 847                  * Notify the P2P Device interface about a state change in one
 848                  * of the interfaces.
 849                  */
 850                 wpas_p2p_indicate_state_change(wpa_s);
 851
 852                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 853                     old_state == WPA_COMPLETED)
 854                         wpas_notify_auth_changed(wpa_s);
 855         }
 856 }
 857
 858
 859 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 860 {
 861         int pending = 0;
 862 #ifdef CONFIG_WPS
 863         struct wpa_supplicant *wpa_s = global->ifaces;
 864         while (wpa_s) {
 865                 struct wpa_supplicant *next = wpa_s->next;
 866                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 867                         pending = 1;
 868 #ifdef CONFIG_P2P
 869                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 870                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 871                         wpas_p2p_disconnect(wpa_s);
 872 #endif /* CONFIG_P2P */
 873                 wpa_s = next;
 874         }
 875 #endif /* CONFIG_WPS */
 876         if (pending)
 877                 return;
 878         eloop_terminate();
 879 }
 880
 881
 882 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 883 {
 884         struct wpa_global *global = signal_ctx;
 885         wpa_supplicant_terminate_proc(global);
 886 }
 887
 888
 889 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 890 {
 891         enum wpa_states old_state = wpa_s->wpa_state;
 892
 893         wpa_s->pairwise_cipher = 0;
 894         wpa_s->group_cipher = 0;
 895         wpa_s->mgmt_group_cipher = 0;
 896         wpa_s->key_mgmt = 0;
 897         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 898                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 899
 900         if (wpa_s->wpa_state != old_state)
 901                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 902 }
 903
 904
 905 /**
 906  * wpa_supplicant_reload_configuration - Reload configuration data
 907  * @wpa_s: Pointer to wpa_supplicant data
 908  * Returns: 0 on success or -1 if configuration parsing failed
 909  *
 910  * This function can be used to request that the configuration data is reloaded
 911  * (e.g., after configuration file change). This function is reloading
 912  * configuration only for one interface, so this may need to be called multiple
 913  * times if %wpa_supplicant is controlling multiple interfaces and all
 914  * interfaces need reconfiguration.
 915  */
 916 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 917 {
 918         struct wpa_config *conf;
 919         int reconf_ctrl;
 920         int old_ap_scan;
 921
 922         if (wpa_s->confname == NULL)
 923                 return -1;
 924         conf = wpa_config_read(wpa_s->confname, NULL);
 925         if (conf == NULL) {
 926                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 927                         "file '%s' - exiting", wpa_s->confname);
 928                 return -1;
 929         }
 930         wpa_config_read(wpa_s->confanother, conf);
 931
 932         conf->changed_parameters = (unsigned int) -1;
 933
 934         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 935                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 936                     os_strcmp(conf->ctrl_interface,
 937                               wpa_s->conf->ctrl_interface) != 0);
 938
 939         if (reconf_ctrl && wpa_s->ctrl_iface) {
 940                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 941                 wpa_s->ctrl_iface = NULL;
 942         }
 943
 944         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 945         if (wpa_s->current_ssid) {
 946                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 947                         wpa_s->own_disconnect_req = 1;
 948                 wpa_supplicant_deauthenticate(wpa_s,
 949                                               WLAN_REASON_DEAUTH_LEAVING);
 950         }
 951
 952         /*
 953          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 954          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 955          */
 956         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 957                 /*
 958                  * Clear forced success to clear EAP state for next
 959                  * authentication.
 960                  */
 961                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 962         }
 963         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 964         wpa_sm_set_config(wpa_s->wpa, NULL);
 965         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 966         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 967         rsn_preauth_deinit(wpa_s->wpa);
 968
 969         old_ap_scan = wpa_s->conf->ap_scan;
 970         wpa_config_free(wpa_s->conf);
 971         wpa_s->conf = conf;
 972         if (old_ap_scan != wpa_s->conf->ap_scan)
 973                 wpas_notify_ap_scan_changed(wpa_s);
 974
 975         if (reconf_ctrl)
 976                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 977
 978         wpa_supplicant_update_config(wpa_s);
 979
 980         wpa_supplicant_clear_status(wpa_s);
 981         if (wpa_supplicant_enabled_networks(wpa_s)) {
 982                 wpa_s->reassociate = 1;
 983                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 984         }
 985         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 986         return 0;
 987 }
 988
 989
 990 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 991 {
 992         struct wpa_global *global = signal_ctx;
 993         struct wpa_supplicant *wpa_s;
 994         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 995                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 996                         sig);
 997                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 998                         wpa_supplicant_terminate_proc(global);
 999                 }
1000         }
1001
1002         if (wpa_debug_reopen_file() < 0) {
1003                 /* Ignore errors since we cannot really do much to fix this */
1004                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
1005         }
1006 }
1007
1008
1009 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1010                                          struct wpa_ssid *ssid,
1011                                          struct wpa_ie_data *ie)
1012 {
1013         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1014         if (ret) {
1015                 if (ret == -2) {
1016                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1017                                 "from association info");
1018                 }
1019                 return -1;
1020         }
1021
1022         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1023                 "cipher suites");
1024         if (!(ie->group_cipher & ssid->group_cipher)) {
1025                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1026                         "cipher 0x%x (mask 0x%x) - reject",
1027                         ie->group_cipher, ssid->group_cipher);
1028                 return -1;
1029         }
1030         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1031                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1032                         "cipher 0x%x (mask 0x%x) - reject",
1033                         ie->pairwise_cipher, ssid->pairwise_cipher);
1034                 return -1;
1035         }
1036         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1037                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1038                         "management 0x%x (mask 0x%x) - reject",
1039                         ie->key_mgmt, ssid->key_mgmt);
1040                 return -1;
1041         }
1042
1043 #ifdef CONFIG_IEEE80211W
1044         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1045             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1046                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1047                         "that does not support management frame protection - "
1048                         "reject");
1049                 return -1;
1050         }
1051 #endif /* CONFIG_IEEE80211W */
1052
1053         return 0;
1054 }
1055
1056
1057 /**
1058  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1059  * @wpa_s: Pointer to wpa_supplicant data
1060  * @bss: Scan results for the selected BSS, or %NULL if not available
1061  * @ssid: Configuration data for the selected network
1062  * @wpa_ie: Buffer for the WPA/RSN IE
1063  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1064  * used buffer length in case the functions returns success.
1065  * Returns: 0 on success or -1 on failure
1066  *
1067  * This function is used to configure authentication and encryption parameters
1068  * based on the network configuration and scan result for the selected BSS (if
1069  * available).
1070  */
1071 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1072                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1073                               u8 *wpa_ie, size_t *wpa_ie_len)
1074 {
1075         struct wpa_ie_data ie;
1076         int sel, proto;
1077         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1078
1079         if (bss) {
1080                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1081                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1082                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1083         } else
1084                 bss_wpa = bss_rsn = bss_osen = NULL;
1085
1086         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1087             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1088             (ie.group_cipher & ssid->group_cipher) &&
1089             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1090             (ie.key_mgmt & ssid->key_mgmt)) {
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1092                 proto = WPA_PROTO_RSN;
1093         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1094                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1095                    (ie.group_cipher & ssid->group_cipher) &&
1096                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1097                    (ie.key_mgmt & ssid->key_mgmt)) {
1098                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1099                 proto = WPA_PROTO_WPA;
1100 #ifdef CONFIG_HS20
1101         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1102                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1103                 /* TODO: parse OSEN element */
1104                 os_memset(&ie, 0, sizeof(ie));
1105                 ie.group_cipher = WPA_CIPHER_CCMP;
1106                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1107                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1108                 proto = WPA_PROTO_OSEN;
1109 #endif /* CONFIG_HS20 */
1110         } else if (bss) {
1111                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1112                 wpa_dbg(wpa_s, MSG_DEBUG,
1113                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1114                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1115                         ssid->key_mgmt);
1116                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1117                         MAC2STR(bss->bssid),
1118                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1119                         bss_wpa ? " WPA" : "",
1120                         bss_rsn ? " RSN" : "",
1121                         bss_osen ? " OSEN" : "");
1122                 if (bss_rsn) {
1123                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1124                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1125                                 wpa_dbg(wpa_s, MSG_DEBUG,
1126                                         "Could not parse RSN element");
1127                         } else {
1128                                 wpa_dbg(wpa_s, MSG_DEBUG,
1129                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1130                                         ie.pairwise_cipher, ie.group_cipher,
1131                                         ie.key_mgmt);
1132                         }
1133                 }
1134                 if (bss_wpa) {
1135                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1136                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1137                                 wpa_dbg(wpa_s, MSG_DEBUG,
1138                                         "Could not parse WPA element");
1139                         } else {
1140                                 wpa_dbg(wpa_s, MSG_DEBUG,
1141                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1142                                         ie.pairwise_cipher, ie.group_cipher,
1143                                         ie.key_mgmt);
1144                         }
1145                 }
1146                 return -1;
1147         } else {
1148                 if (ssid->proto & WPA_PROTO_OSEN)
1149                         proto = WPA_PROTO_OSEN;
1150                 else if (ssid->proto & WPA_PROTO_RSN)
1151                         proto = WPA_PROTO_RSN;
1152                 else
1153                         proto = WPA_PROTO_WPA;
1154                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1155                         os_memset(&ie, 0, sizeof(ie));
1156                         ie.group_cipher = ssid->group_cipher;
1157                         ie.pairwise_cipher = ssid->pairwise_cipher;
1158                         ie.key_mgmt = ssid->key_mgmt;
1159 #ifdef CONFIG_IEEE80211W
1160                         ie.mgmt_group_cipher =
1161                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1162                                 WPA_CIPHER_AES_128_CMAC : 0;
1163 #endif /* CONFIG_IEEE80211W */
1164                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1165                                 "based on configuration");
1166                 } else
1167                         proto = ie.proto;
1168         }
1169
1170         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1171                 "pairwise %d key_mgmt %d proto %d",
1172                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1173 #ifdef CONFIG_IEEE80211W
1174         if (ssid->ieee80211w) {
1175                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1176                         ie.mgmt_group_cipher);
1177         }
1178 #endif /* CONFIG_IEEE80211W */
1179
1180         wpa_s->wpa_proto = proto;
1181         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1182         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1183                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1184
1185         if (bss || !wpa_s->ap_ies_from_associnfo) {
1186                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1187                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1188                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1189                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1190                         return -1;
1191         }
1192
1193 #ifdef CONFIG_NO_WPA
1194         wpa_s->group_cipher = WPA_CIPHER_NONE;
1195         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1196 #else /* CONFIG_NO_WPA */
1197         sel = ie.group_cipher & ssid->group_cipher;
1198         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1199         if (wpa_s->group_cipher < 0) {
1200                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1201                         "cipher");
1202                 return -1;
1203         }
1204         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1205                 wpa_cipher_txt(wpa_s->group_cipher));
1206
1207         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1208         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1209         if (wpa_s->pairwise_cipher < 0) {
1210                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1211                         "cipher");
1212                 return -1;
1213         }
1214         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1215                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1216 #endif /* CONFIG_NO_WPA */
1217
1218         sel = ie.key_mgmt & ssid->key_mgmt;
1219 #ifdef CONFIG_SAE
1220         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1221                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1222 #endif /* CONFIG_SAE */
1223         if (0) {
1224 #ifdef CONFIG_SUITEB192
1225         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1226                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1227                 wpa_dbg(wpa_s, MSG_DEBUG,
1228                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1229 #endif /* CONFIG_SUITEB192 */
1230 #ifdef CONFIG_SUITEB
1231         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1232                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1233                 wpa_dbg(wpa_s, MSG_DEBUG,
1234                         "WPA: using KEY_MGMT 802.1X with Suite B");
1235 #endif /* CONFIG_SUITEB */
1236 #ifdef CONFIG_IEEE80211R
1237         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1240         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1241                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1242                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1243 #endif /* CONFIG_IEEE80211R */
1244 #ifdef CONFIG_SAE
1245         } else if (sel & WPA_KEY_MGMT_SAE) {
1246                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1247                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1248         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1249                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1250                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1251 #endif /* CONFIG_SAE */
1252 #ifdef CONFIG_IEEE80211W
1253         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1254                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1255                 wpa_dbg(wpa_s, MSG_DEBUG,
1256                         "WPA: using KEY_MGMT 802.1X with SHA256");
1257         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1258                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1259                 wpa_dbg(wpa_s, MSG_DEBUG,
1260                         "WPA: using KEY_MGMT PSK with SHA256");
1261 #endif /* CONFIG_IEEE80211W */
1262         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1263                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1264                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1265         } else if (sel & WPA_KEY_MGMT_PSK) {
1266                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1268         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1269                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1270                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1271 #ifdef CONFIG_HS20
1272         } else if (sel & WPA_KEY_MGMT_OSEN) {
1273                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1274                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1275 #endif /* CONFIG_HS20 */
1276         } else {
1277                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1278                         "authenticated key management type");
1279                 return -1;
1280         }
1281
1282         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1284                          wpa_s->pairwise_cipher);
1285         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1286
1287 #ifdef CONFIG_IEEE80211W
1288         sel = ie.mgmt_group_cipher;
1289         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1290             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1291                 sel = 0;
1292         if (sel & WPA_CIPHER_AES_128_CMAC) {
1293                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1294                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1295                         "AES-128-CMAC");
1296         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1297                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1298                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1299                         "BIP-GMAC-128");
1300         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1301                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1302                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1303                         "BIP-GMAC-256");
1304         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1305                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1306                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1307                         "BIP-CMAC-256");
1308         } else {
1309                 wpa_s->mgmt_group_cipher = 0;
1310                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1311         }
1312         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1313                          wpa_s->mgmt_group_cipher);
1314         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1315                          wpas_get_ssid_pmf(wpa_s, ssid));
1316 #endif /* CONFIG_IEEE80211W */
1317
1318         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1319                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1320                 return -1;
1321         }
1322
1323         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1324                 int psk_set = 0;
1325
1326                 if (ssid->psk_set) {
1327                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1328                                        NULL);
1329                         psk_set = 1;
1330                 }
1331 #ifndef CONFIG_NO_PBKDF2
1332                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1333                     ssid->passphrase) {
1334                         u8 psk[PMK_LEN];
1335                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1336                                     4096, psk, PMK_LEN);
1337                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1338                                         psk, PMK_LEN);
1339                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1340                         psk_set = 1;
1341                         os_memset(psk, 0, sizeof(psk));
1342                 }
1343 #endif /* CONFIG_NO_PBKDF2 */
1344 #ifdef CONFIG_EXT_PASSWORD
1345                 if (ssid->ext_psk) {
1346                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1347                                                              ssid->ext_psk);
1348                         char pw_str[64 + 1];
1349                         u8 psk[PMK_LEN];
1350
1351                         if (pw == NULL) {
1352                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1353                                         "found from external storage");
1354                                 return -1;
1355                         }
1356
1357                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1358                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1359                                         "PSK length %d in external storage",
1360                                         (int) wpabuf_len(pw));
1361                                 ext_password_free(pw);
1362                                 return -1;
1363                         }
1364
1365                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1366                         pw_str[wpabuf_len(pw)] = '\0';
1367
1368 #ifndef CONFIG_NO_PBKDF2
1369                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1370                         {
1371                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1372                                             4096, psk, PMK_LEN);
1373                                 os_memset(pw_str, 0, sizeof(pw_str));
1374                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1375                                                 "external passphrase)",
1376                                                 psk, PMK_LEN);
1377                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1378                                                NULL);
1379                                 psk_set = 1;
1380                                 os_memset(psk, 0, sizeof(psk));
1381                         } else
1382 #endif /* CONFIG_NO_PBKDF2 */
1383                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1384                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1385                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1386                                                 "Invalid PSK hex string");
1387                                         os_memset(pw_str, 0, sizeof(pw_str));
1388                                         ext_password_free(pw);
1389                                         return -1;
1390                                 }
1391                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1392                                                NULL);
1393                                 psk_set = 1;
1394                                 os_memset(psk, 0, sizeof(psk));
1395                         } else {
1396                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1397                                         "PSK available");
1398                                 os_memset(pw_str, 0, sizeof(pw_str));
1399                                 ext_password_free(pw);
1400                                 return -1;
1401                         }
1402
1403                         os_memset(pw_str, 0, sizeof(pw_str));
1404                         ext_password_free(pw);
1405                 }
1406 #endif /* CONFIG_EXT_PASSWORD */
1407
1408                 if (!psk_set) {
1409                         wpa_msg(wpa_s, MSG_INFO,
1410                                 "No PSK available for association");
1411                         return -1;
1412                 }
1413         } else
1414                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1415
1416         return 0;
1417 }
1418
1419
1420 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1421 {
1422         *pos = 0x00;
1423
1424         switch (idx) {
1425         case 0: /* Bits 0-7 */
1426                 break;
1427         case 1: /* Bits 8-15 */
1428                 break;
1429         case 2: /* Bits 16-23 */
1430 #ifdef CONFIG_WNM
1431                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1432                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1433 #endif /* CONFIG_WNM */
1434                 break;
1435         case 3: /* Bits 24-31 */
1436 #ifdef CONFIG_WNM
1437                 *pos |= 0x02; /* Bit 25 - SSID List */
1438 #endif /* CONFIG_WNM */
1439 #ifdef CONFIG_INTERWORKING
1440                 if (wpa_s->conf->interworking)
1441                         *pos |= 0x80; /* Bit 31 - Interworking */
1442 #endif /* CONFIG_INTERWORKING */
1443                 break;
1444         case 4: /* Bits 32-39 */
1445 #ifdef CONFIG_INTERWORKING
1446                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1447                         *pos |= 0x01; /* Bit 32 - QoS Map */
1448 #endif /* CONFIG_INTERWORKING */
1449                 break;
1450         case 5: /* Bits 40-47 */
1451 #ifdef CONFIG_HS20
1452                 if (wpa_s->conf->hs20)
1453                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1454 #endif /* CONFIG_HS20 */
1455 #ifdef CONFIG_MBO
1456                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1457 #endif /* CONFIG_MBO */
1458                 break;
1459         case 6: /* Bits 48-55 */
1460                 break;
1461         case 7: /* Bits 56-63 */
1462                 break;
1463         case 8: /* Bits 64-71 */
1464                 if (wpa_s->conf->ftm_responder)
1465                         *pos |= 0x40; /* Bit 70 - FTM responder */
1466                 if (wpa_s->conf->ftm_initiator)
1467                         *pos |= 0x80; /* Bit 71 - FTM initiator */
1468                 break;
1469         }
1470 }
1471
1472
1473 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1474 {
1475         u8 *pos = buf;
1476         u8 len = 6, i;
1477
1478         if (len < 9 &&
1479             (wpa_s->conf->ftm_initiator || wpa_s->conf->ftm_responder))
1480                 len = 9;
1481         if (len < wpa_s->extended_capa_len)
1482                 len = wpa_s->extended_capa_len;
1483         if (buflen < (size_t) len + 2) {
1484                 wpa_printf(MSG_INFO,
1485                            "Not enough room for building extended capabilities element");
1486                 return -1;
1487         }
1488
1489         *pos++ = WLAN_EID_EXT_CAPAB;
1490         *pos++ = len;
1491         for (i = 0; i < len; i++, pos++) {
1492                 wpas_ext_capab_byte(wpa_s, pos, i);
1493
1494                 if (i < wpa_s->extended_capa_len) {
1495                         *pos &= ~wpa_s->extended_capa_mask[i];
1496                         *pos |= wpa_s->extended_capa[i];
1497                 }
1498         }
1499
1500         while (len > 0 && buf[1 + len] == 0) {
1501                 len--;
1502                 buf[1] = len;
1503         }
1504         if (len == 0)
1505                 return 0;
1506
1507         return 2 + len;
1508 }
1509
1510
1511 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1512                           struct wpa_bss *test_bss)
1513 {
1514         struct wpa_bss *bss;
1515
1516         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1517                 if (bss == test_bss)
1518                         return 1;
1519         }
1520
1521         return 0;
1522 }
1523
1524
1525 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1526                            struct wpa_ssid *test_ssid)
1527 {
1528         struct wpa_ssid *ssid;
1529
1530         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1531                 if (ssid == test_ssid)
1532                         return 1;
1533         }
1534
1535         return 0;
1536 }
1537
1538
1539 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1540                         struct wpa_ssid *test_ssid)
1541 {
1542         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1543                 return 0;
1544
1545         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1546 }
1547
1548
1549 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1550 {
1551         if (cwork == NULL)
1552                 return;
1553         os_free(cwork);
1554 }
1555
1556
1557 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1558 {
1559         struct wpa_connect_work *cwork;
1560         struct wpa_radio_work *work = wpa_s->connect_work;
1561
1562         if (!work)
1563                 return;
1564
1565         wpa_s->connect_work = NULL;
1566         cwork = work->ctx;
1567         work->ctx = NULL;
1568         wpas_connect_work_free(cwork);
1569         radio_work_done(work);
1570 }
1571
1572
1573 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1574 {
1575         struct os_reltime now;
1576         u8 addr[ETH_ALEN];
1577
1578         os_get_reltime(&now);
1579         if (wpa_s->last_mac_addr_style == style &&
1580             wpa_s->last_mac_addr_change.sec != 0 &&
1581             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1582                                 wpa_s->conf->rand_addr_lifetime)) {
1583                 wpa_msg(wpa_s, MSG_DEBUG,
1584                         "Previously selected random MAC address has not yet expired");
1585                 return 0;
1586         }
1587
1588         switch (style) {
1589         case 1:
1590                 if (random_mac_addr(addr) < 0)
1591                         return -1;
1592                 break;
1593         case 2:
1594                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1595                 if (random_mac_addr_keep_oui(addr) < 0)
1596                         return -1;
1597                 break;
1598         default:
1599                 return -1;
1600         }
1601
1602         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1603                 wpa_msg(wpa_s, MSG_INFO,
1604                         "Failed to set random MAC address");
1605                 return -1;
1606         }
1607
1608         os_get_reltime(&wpa_s->last_mac_addr_change);
1609         wpa_s->mac_addr_changed = 1;
1610         wpa_s->last_mac_addr_style = style;
1611
1612         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1613                 wpa_msg(wpa_s, MSG_INFO,
1614                         "Could not update MAC address information");
1615                 return -1;
1616         }
1617
1618         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1619                 MAC2STR(addr));
1620
1621         return 0;
1622 }
1623
1624
1625 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1626 {
1627         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1628             !wpa_s->conf->preassoc_mac_addr)
1629                 return 0;
1630
1631         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1632 }
1633
1634
1635 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1636
1637 /**
1638  * wpa_supplicant_associate - Request association
1639  * @wpa_s: Pointer to wpa_supplicant data
1640  * @bss: Scan results for the selected BSS, or %NULL if not available
1641  * @ssid: Configuration data for the selected network
1642  *
1643  * This function is used to request %wpa_supplicant to associate with a BSS.
1644  */
1645 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1646                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1647 {
1648         struct wpa_connect_work *cwork;
1649         int rand_style;
1650
1651         wpa_s->own_disconnect_req = 0;
1652
1653         /*
1654          * If we are starting a new connection, any previously pending EAPOL
1655          * RX cannot be valid anymore.
1656          */
1657         wpabuf_free(wpa_s->pending_eapol_rx);
1658         wpa_s->pending_eapol_rx = NULL;
1659
1660         if (ssid->mac_addr == -1)
1661                 rand_style = wpa_s->conf->mac_addr;
1662         else
1663                 rand_style = ssid->mac_addr;
1664
1665         wmm_ac_clear_saved_tspecs(wpa_s);
1666         wpa_s->reassoc_same_bss = 0;
1667         wpa_s->reassoc_same_ess = 0;
1668
1669         if (wpa_s->last_ssid == ssid) {
1670                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1671                 wpa_s->reassoc_same_ess = 1;
1672                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1673                         wmm_ac_save_tspecs(wpa_s);
1674                         wpa_s->reassoc_same_bss = 1;
1675                 }
1676         } else if (rand_style > 0) {
1677                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1678                         return;
1679                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1680         } else if (wpa_s->mac_addr_changed) {
1681                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1682                         wpa_msg(wpa_s, MSG_INFO,
1683                                 "Could not restore permanent MAC address");
1684                         return;
1685                 }
1686                 wpa_s->mac_addr_changed = 0;
1687                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1688                         wpa_msg(wpa_s, MSG_INFO,
1689                                 "Could not update MAC address information");
1690                         return;
1691                 }
1692                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1693         }
1694         wpa_s->last_ssid = ssid;
1695
1696 #ifdef CONFIG_IBSS_RSN
1697         ibss_rsn_deinit(wpa_s->ibss_rsn);
1698         wpa_s->ibss_rsn = NULL;
1699 #endif /* CONFIG_IBSS_RSN */
1700
1701         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1702             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1703 #ifdef CONFIG_AP
1704                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1705                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1706                                 "mode");
1707                         return;
1708                 }
1709                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1710                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1711                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1712                                 wpas_p2p_ap_setup_failed(wpa_s);
1713                         return;
1714                 }
1715                 wpa_s->current_bss = bss;
1716 #else /* CONFIG_AP */
1717                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1718                         "the build");
1719 #endif /* CONFIG_AP */
1720                 return;
1721         }
1722
1723         if (ssid->mode == WPAS_MODE_MESH) {
1724 #ifdef CONFIG_MESH
1725                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1726                         wpa_msg(wpa_s, MSG_INFO,
1727                                 "Driver does not support mesh mode");
1728                         return;
1729                 }
1730                 if (bss)
1731                         ssid->frequency = bss->freq;
1732                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1733                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1734                         return;
1735                 }
1736                 wpa_s->current_bss = bss;
1737                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1738                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1739                         ssid->id);
1740 #else /* CONFIG_MESH */
1741                 wpa_msg(wpa_s, MSG_ERROR,
1742                         "mesh mode support not included in the build");
1743 #endif /* CONFIG_MESH */
1744                 return;
1745         }
1746
1747 #ifdef CONFIG_TDLS
1748         if (bss)
1749                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1750                                 bss->ie_len);
1751 #endif /* CONFIG_TDLS */
1752
1753         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1754             ssid->mode == IEEE80211_MODE_INFRA) {
1755                 sme_authenticate(wpa_s, bss, ssid);
1756                 return;
1757         }
1758
1759         if (wpa_s->connect_work) {
1760                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1761                 return;
1762         }
1763
1764         if (radio_work_pending(wpa_s, "connect")) {
1765                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1766                 return;
1767         }
1768
1769         wpas_abort_ongoing_scan(wpa_s);
1770
1771         cwork = os_zalloc(sizeof(*cwork));
1772         if (cwork == NULL)
1773                 return;
1774
1775         cwork->bss = bss;
1776         cwork->ssid = ssid;
1777
1778         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1779                            wpas_start_assoc_cb, cwork) < 0) {
1780                 os_free(cwork);
1781         }
1782 }
1783
1784
1785 static int bss_is_ibss(struct wpa_bss *bss)
1786 {
1787         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1788                 IEEE80211_CAP_IBSS;
1789 }
1790
1791
1792 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1793                             const struct wpa_ssid *ssid)
1794 {
1795         enum hostapd_hw_mode hw_mode;
1796         struct hostapd_hw_modes *mode = NULL;
1797         u8 channel;
1798         int i;
1799
1800 #ifdef CONFIG_HT_OVERRIDES
1801         if (ssid->disable_ht)
1802                 return 0;
1803 #endif /* CONFIG_HT_OVERRIDES */
1804
1805         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1806         if (hw_mode == NUM_HOSTAPD_MODES)
1807                 return 0;
1808         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1809                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1810                         mode = &wpa_s->hw.modes[i];
1811                         break;
1812                 }
1813         }
1814
1815         if (!mode)
1816                 return 0;
1817
1818         return mode->vht_capab != 0;
1819 }
1820
1821
1822 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1823                           const struct wpa_ssid *ssid,
1824                           struct hostapd_freq_params *freq)
1825 {
1826         enum hostapd_hw_mode hw_mode;
1827         struct hostapd_hw_modes *mode = NULL;
1828         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1829                            184, 192 };
1830         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1831         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1832         u8 channel;
1833         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1834         unsigned int j, k;
1835         struct hostapd_freq_params vht_freq;
1836         int chwidth, seg0, seg1;
1837         u32 vht_caps = 0;
1838
1839         freq->freq = ssid->frequency;
1840
1841         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1842                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1843
1844                 if (ssid->mode != WPAS_MODE_IBSS)
1845                         break;
1846
1847                 /* Don't adjust control freq in case of fixed_freq */
1848                 if (ssid->fixed_freq)
1849                         break;
1850
1851                 if (!bss_is_ibss(bss))
1852                         continue;
1853
1854                 if (ssid->ssid_len == bss->ssid_len &&
1855                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1856                         wpa_printf(MSG_DEBUG,
1857                                    "IBSS already found in scan results, adjust control freq: %d",
1858                                    bss->freq);
1859                         freq->freq = bss->freq;
1860                         obss_scan = 0;
1861                         break;
1862                 }
1863         }
1864
1865         /* For IBSS check HT_IBSS flag */
1866         if (ssid->mode == WPAS_MODE_IBSS &&
1867             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1868                 return;
1869
1870         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1871             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1872             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1873                 wpa_printf(MSG_DEBUG,
1874                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1875                 return;
1876         }
1877
1878         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1879         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1880                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1881                         mode = &wpa_s->hw.modes[i];
1882                         break;
1883                 }
1884         }
1885
1886         if (!mode)
1887                 return;
1888
1889 #ifdef CONFIG_HT_OVERRIDES
1890         if (ssid->disable_ht) {
1891                 freq->ht_enabled = 0;
1892                 return;
1893         }
1894 #endif /* CONFIG_HT_OVERRIDES */
1895
1896         freq->ht_enabled = ht_supported(mode);
1897         if (!freq->ht_enabled)
1898                 return;
1899
1900         /* Setup higher BW only for 5 GHz */
1901         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1902                 return;
1903
1904         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1905                 pri_chan = &mode->channels[chan_idx];
1906                 if (pri_chan->chan == channel)
1907                         break;
1908                 pri_chan = NULL;
1909         }
1910         if (!pri_chan)
1911                 return;
1912
1913         /* Check primary channel flags */
1914         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1915                 return;
1916
1917 #ifdef CONFIG_HT_OVERRIDES
1918         if (ssid->disable_ht40)
1919                 return;
1920 #endif /* CONFIG_HT_OVERRIDES */
1921
1922         /* Check/setup HT40+/HT40- */
1923         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1924                 if (ht40plus[j] == channel) {
1925                         ht40 = 1;
1926                         break;
1927                 }
1928         }
1929
1930         /* Find secondary channel */
1931         for (i = 0; i < mode->num_channels; i++) {
1932                 sec_chan = &mode->channels[i];
1933                 if (sec_chan->chan == channel + ht40 * 4)
1934                         break;
1935                 sec_chan = NULL;
1936         }
1937         if (!sec_chan)
1938                 return;
1939
1940         /* Check secondary channel flags */
1941         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1942                 return;
1943
1944         freq->channel = pri_chan->chan;
1945
1946         if (ht40 == -1) {
1947                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1948                         return;
1949         } else {
1950                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1951                         return;
1952         }
1953         freq->sec_channel_offset = ht40;
1954
1955         if (obss_scan) {
1956                 struct wpa_scan_results *scan_res;
1957
1958                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1959                 if (scan_res == NULL) {
1960                         /* Back to HT20 */
1961                         freq->sec_channel_offset = 0;
1962                         return;
1963                 }
1964
1965                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1966                                      sec_chan->chan);
1967                 switch (res) {
1968                 case 0:
1969                         /* Back to HT20 */
1970                         freq->sec_channel_offset = 0;
1971                         break;
1972                 case 1:
1973                         /* Configuration allowed */
1974                         break;
1975                 case 2:
1976                         /* Switch pri/sec channels */
1977                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1978                         freq->sec_channel_offset = -freq->sec_channel_offset;
1979                         freq->channel = sec_chan->chan;
1980                         break;
1981                 default:
1982                         freq->sec_channel_offset = 0;
1983                         break;
1984                 }
1985
1986                 wpa_scan_results_free(scan_res);
1987         }
1988
1989         wpa_printf(MSG_DEBUG,
1990                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1991                    freq->channel, freq->sec_channel_offset);
1992
1993         if (!drv_supports_vht(wpa_s, ssid))
1994                 return;
1995
1996         /* For IBSS check VHT_IBSS flag */
1997         if (ssid->mode == WPAS_MODE_IBSS &&
1998             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1999                 return;
2000
2001         vht_freq = *freq;
2002
2003         vht_freq.vht_enabled = vht_supported(mode);
2004         if (!vht_freq.vht_enabled)
2005                 return;
2006
2007         /* setup center_freq1, bandwidth */
2008         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
2009                 if (freq->channel >= vht80[j] &&
2010                     freq->channel < vht80[j] + 16)
2011                         break;
2012         }
2013
2014         if (j == ARRAY_SIZE(vht80))
2015                 return;
2016
2017         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
2018                 struct hostapd_channel_data *chan;
2019
2020                 chan = hw_get_channel_chan(mode, i, NULL);
2021                 if (!chan)
2022                         return;
2023
2024                 /* Back to HT configuration if channel not usable */
2025                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2026                         return;
2027         }
2028
2029         chwidth = VHT_CHANWIDTH_80MHZ;
2030         seg0 = vht80[j] + 6;
2031         seg1 = 0;
2032
2033         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2034                 /* setup center_freq2, bandwidth */
2035                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2036                         /* Only accept 80 MHz segments separated by a gap */
2037                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2038                                 continue;
2039                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2040                                 struct hostapd_channel_data *chan;
2041
2042                                 chan = hw_get_channel_chan(mode, i, NULL);
2043                                 if (!chan)
2044                                         continue;
2045
2046                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2047                                                   HOSTAPD_CHAN_NO_IR |
2048                                                   HOSTAPD_CHAN_RADAR))
2049                                         continue;
2050
2051                                 /* Found a suitable second segment for 80+80 */
2052                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2053                                 vht_caps |=
2054                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2055                                 seg1 = vht80[k] + 6;
2056                         }
2057
2058                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2059                                 break;
2060                 }
2061         } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_160MHZ) {
2062                 if (freq->freq == 5180) {
2063                         chwidth = VHT_CHANWIDTH_160MHZ;
2064                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2065                         seg0 = 50;
2066                 } else if (freq->freq == 5520) {
2067                         chwidth = VHT_CHANWIDTH_160MHZ;
2068                         vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
2069                         seg0 = 114;
2070                 }
2071         }
2072
2073         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2074                                     freq->channel, freq->ht_enabled,
2075                                     vht_freq.vht_enabled,
2076                                     freq->sec_channel_offset,
2077                                     chwidth, seg0, seg1, vht_caps) != 0)
2078                 return;
2079
2080         *freq = vht_freq;
2081
2082         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2083                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2084 }
2085
2086
2087 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2088 {
2089         struct wpa_connect_work *cwork = work->ctx;
2090         struct wpa_bss *bss = cwork->bss;
2091         struct wpa_ssid *ssid = cwork->ssid;
2092         struct wpa_supplicant *wpa_s = work->wpa_s;
2093         u8 wpa_ie[200];
2094         size_t wpa_ie_len;
2095         int use_crypt, ret, i, bssid_changed;
2096         int algs = WPA_AUTH_ALG_OPEN;
2097         unsigned int cipher_pairwise, cipher_group;
2098         struct wpa_driver_associate_params params;
2099         int wep_keys_set = 0;
2100         int assoc_failed = 0;
2101         struct wpa_ssid *old_ssid;
2102         u8 prev_bssid[ETH_ALEN];
2103 #ifdef CONFIG_HT_OVERRIDES
2104         struct ieee80211_ht_capabilities htcaps;
2105         struct ieee80211_ht_capabilities htcaps_mask;
2106 #endif /* CONFIG_HT_OVERRIDES */
2107 #ifdef CONFIG_VHT_OVERRIDES
2108        struct ieee80211_vht_capabilities vhtcaps;
2109        struct ieee80211_vht_capabilities vhtcaps_mask;
2110 #endif /* CONFIG_VHT_OVERRIDES */
2111 #ifdef CONFIG_MBO
2112         const u8 *mbo = NULL;
2113 #endif /* CONFIG_MBO */
2114
2115         if (deinit) {
2116                 if (work->started) {
2117                         wpa_s->connect_work = NULL;
2118
2119                         /* cancel possible auth. timeout */
2120                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2121                                              NULL);
2122                 }
2123                 wpas_connect_work_free(cwork);
2124                 return;
2125         }
2126
2127         wpa_s->connect_work = work;
2128
2129         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2130             wpas_network_disabled(wpa_s, ssid)) {
2131                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2132                 wpas_connect_work_done(wpa_s);
2133                 return;
2134         }
2135
2136         os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
2137         os_memset(&params, 0, sizeof(params));
2138         wpa_s->reassociate = 0;
2139         wpa_s->eap_expected_failure = 0;
2140         if (bss &&
2141             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2142 #ifdef CONFIG_IEEE80211R
2143                 const u8 *ie, *md = NULL;
2144 #endif /* CONFIG_IEEE80211R */
2145                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2146                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2147                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2148                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2149                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2150                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2151                 if (bssid_changed)
2152                         wpas_notify_bssid_changed(wpa_s);
2153 #ifdef CONFIG_IEEE80211R
2154                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2155                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2156                         md = ie + 2;
2157                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2158                 if (md) {
2159                         /* Prepare for the next transition */
2160                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2161                 }
2162 #endif /* CONFIG_IEEE80211R */
2163 #ifdef CONFIG_WPS
2164         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2165                    wpa_s->conf->ap_scan == 2 &&
2166                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2167                 /* Use ap_scan==1 style network selection to find the network
2168                  */
2169                 wpas_connect_work_done(wpa_s);
2170                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2171                 wpa_s->reassociate = 1;
2172                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2173                 return;
2174 #endif /* CONFIG_WPS */
2175         } else {
2176                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2177                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2178                 if (bss)
2179                         os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2180                 else
2181                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2182         }
2183         if (!wpa_s->pno)
2184                 wpa_supplicant_cancel_sched_scan(wpa_s);
2185
2186         wpa_supplicant_cancel_scan(wpa_s);
2187
2188         /* Starting new association, so clear the possibly used WPA IE from the
2189          * previous association. */
2190         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2191
2192 #ifdef IEEE8021X_EAPOL
2193         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2194                 if (ssid->leap) {
2195                         if (ssid->non_leap == 0)
2196                                 algs = WPA_AUTH_ALG_LEAP;
2197                         else
2198                                 algs |= WPA_AUTH_ALG_LEAP;
2199                 }
2200         }
2201 #endif /* IEEE8021X_EAPOL */
2202         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2203         if (ssid->auth_alg) {
2204                 algs = ssid->auth_alg;
2205                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2206                         "0x%x", algs);
2207         }
2208
2209         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2210                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2211             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2212                 int try_opportunistic;
2213                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2214                                      wpa_s->conf->okc :
2215                                      ssid->proactive_key_caching) &&
2216                         (ssid->proto & WPA_PROTO_RSN);
2217                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2218                                             ssid, try_opportunistic) == 0)
2219                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2220                 wpa_ie_len = sizeof(wpa_ie);
2221                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2222                                               wpa_ie, &wpa_ie_len)) {
2223                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2224                                 "key management and encryption suites");
2225                         wpas_connect_work_done(wpa_s);
2226                         return;
2227                 }
2228         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2229                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2230                 /*
2231                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2232                  * use non-WPA since the scan results did not indicate that the
2233                  * AP is using WPA or WPA2.
2234                  */
2235                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2236                 wpa_ie_len = 0;
2237                 wpa_s->wpa_proto = 0;
2238         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2239                 wpa_ie_len = sizeof(wpa_ie);
2240                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2241                                               wpa_ie, &wpa_ie_len)) {
2242                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2243                                 "key management and encryption suites (no "
2244                                 "scan results)");
2245                         wpas_connect_work_done(wpa_s);
2246                         return;
2247                 }
2248 #ifdef CONFIG_WPS
2249         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2250                 struct wpabuf *wps_ie;
2251                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2252                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2253                         wpa_ie_len = wpabuf_len(wps_ie);
2254                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2255                 } else
2256                         wpa_ie_len = 0;
2257                 wpabuf_free(wps_ie);
2258                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2259                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2260                         params.wps = WPS_MODE_PRIVACY;
2261                 else
2262                         params.wps = WPS_MODE_OPEN;
2263                 wpa_s->wpa_proto = 0;
2264 #endif /* CONFIG_WPS */
2265         } else {
2266                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2267                 wpa_ie_len = 0;
2268                 wpa_s->wpa_proto = 0;
2269         }
2270
2271 #ifdef CONFIG_P2P
2272         if (wpa_s->global->p2p) {
2273                 u8 *pos;
2274                 size_t len;
2275                 int res;
2276                 pos = wpa_ie + wpa_ie_len;
2277                 len = sizeof(wpa_ie) - wpa_ie_len;
2278                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2279                                             ssid->p2p_group);
2280                 if (res >= 0)
2281                         wpa_ie_len += res;
2282         }
2283
2284         wpa_s->cross_connect_disallowed = 0;
2285         if (bss) {
2286                 struct wpabuf *p2p;
2287                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2288                 if (p2p) {
2289                         wpa_s->cross_connect_disallowed =
2290                                 p2p_get_cross_connect_disallowed(p2p);
2291                         wpabuf_free(p2p);
2292                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2293                                 "connection",
2294                                 wpa_s->cross_connect_disallowed ?
2295                                 "disallows" : "allows");
2296                 }
2297         }
2298
2299         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2300 #endif /* CONFIG_P2P */
2301
2302 #ifdef CONFIG_MBO
2303         if (bss) {
2304                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2305                 if (mbo) {
2306                         int len;
2307
2308                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2309                                                         wpa_ie + wpa_ie_len,
2310                                                         sizeof(wpa_ie) -
2311                                                         wpa_ie_len);
2312                         if (len > 0)
2313                                 wpa_ie_len += len;
2314                 }
2315         }
2316 #endif /* CONFIG_MBO */
2317
2318         /*
2319          * Workaround: Add Extended Capabilities element only if the AP
2320          * included this element in Beacon/Probe Response frames. Some older
2321          * APs seem to have interoperability issues if this element is
2322          * included, so while the standard may require us to include the
2323          * element in all cases, it is justifiable to skip it to avoid
2324          * interoperability issues.
2325          */
2326         if (ssid->p2p_group)
2327                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
2328         else
2329                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
2330
2331         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2332                 u8 ext_capab[18];
2333                 int ext_capab_len;
2334                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2335                                                      sizeof(ext_capab));
2336                 if (ext_capab_len > 0) {
2337                         u8 *pos = wpa_ie;
2338                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2339                                 pos += 2 + pos[1];
2340                         os_memmove(pos + ext_capab_len, pos,
2341                                    wpa_ie_len - (pos - wpa_ie));
2342                         wpa_ie_len += ext_capab_len;
2343                         os_memcpy(pos, ext_capab, ext_capab_len);
2344                 }
2345         }
2346
2347 #ifdef CONFIG_HS20
2348         if (is_hs20_network(wpa_s, ssid, bss)) {
2349                 struct wpabuf *hs20;
2350
2351                 hs20 = wpabuf_alloc(20);
2352                 if (hs20) {
2353                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2354                         size_t len;
2355
2356                         wpas_hs20_add_indication(hs20, pps_mo_id);
2357                         len = sizeof(wpa_ie) - wpa_ie_len;
2358                         if (wpabuf_len(hs20) <= len) {
2359                                 os_memcpy(wpa_ie + wpa_ie_len,
2360                                           wpabuf_head(hs20), wpabuf_len(hs20));
2361                                 wpa_ie_len += wpabuf_len(hs20);
2362                         }
2363                         wpabuf_free(hs20);
2364
2365                         hs20_configure_frame_filters(wpa_s);
2366                 }
2367         }
2368 #endif /* CONFIG_HS20 */
2369
2370         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2371                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2372                 size_t len;
2373
2374                 len = sizeof(wpa_ie) - wpa_ie_len;
2375                 if (wpabuf_len(buf) <= len) {
2376                         os_memcpy(wpa_ie + wpa_ie_len,
2377                                   wpabuf_head(buf), wpabuf_len(buf));
2378                         wpa_ie_len += wpabuf_len(buf);
2379                 }
2380         }
2381
2382 #ifdef CONFIG_FST
2383         if (wpa_s->fst_ies) {
2384                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2385
2386                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2387                         os_memcpy(wpa_ie + wpa_ie_len,
2388                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2389                         wpa_ie_len += fst_ies_len;
2390                 }
2391         }
2392 #endif /* CONFIG_FST */
2393
2394 #ifdef CONFIG_MBO
2395         if (mbo) {
2396                 int len;
2397
2398                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2399                                   sizeof(wpa_ie) - wpa_ie_len);
2400                 if (len >= 0)
2401                         wpa_ie_len += len;
2402         }
2403 #endif /* CONFIG_MBO */
2404
2405         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2406         use_crypt = 1;
2407         cipher_pairwise = wpa_s->pairwise_cipher;
2408         cipher_group = wpa_s->group_cipher;
2409         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2410             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2411                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2412                         use_crypt = 0;
2413                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2414                         use_crypt = 1;
2415                         wep_keys_set = 1;
2416                 }
2417         }
2418         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2419                 use_crypt = 0;
2420
2421 #ifdef IEEE8021X_EAPOL
2422         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2423                 if ((ssid->eapol_flags &
2424                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2425                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2426                     !wep_keys_set) {
2427                         use_crypt = 0;
2428                 } else {
2429                         /* Assume that dynamic WEP-104 keys will be used and
2430                          * set cipher suites in order for drivers to expect
2431                          * encryption. */
2432                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2433                 }
2434         }
2435 #endif /* IEEE8021X_EAPOL */
2436
2437         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2438                 /* Set the key before (and later after) association */
2439                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2440         }
2441
2442         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2443         if (bss) {
2444                 params.ssid = bss->ssid;
2445                 params.ssid_len = bss->ssid_len;
2446                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2447                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2448                                    MACSTR " freq=%u MHz based on scan results "
2449                                    "(bssid_set=%d)",
2450                                    MAC2STR(bss->bssid), bss->freq,
2451                                    ssid->bssid_set);
2452                         params.bssid = bss->bssid;
2453                         params.freq.freq = bss->freq;
2454                 }
2455                 params.bssid_hint = bss->bssid;
2456                 params.freq_hint = bss->freq;
2457                 params.pbss = bss_is_pbss(bss);
2458         } else {
2459                 params.ssid = ssid->ssid;
2460                 params.ssid_len = ssid->ssid_len;
2461                 params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
2462         }
2463
2464         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2465             wpa_s->conf->ap_scan == 2) {
2466                 params.bssid = ssid->bssid;
2467                 params.fixed_bssid = 1;
2468         }
2469
2470         /* Initial frequency for IBSS/mesh */
2471         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2472             ssid->frequency > 0 && params.freq.freq == 0)
2473                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2474
2475         if (ssid->mode == WPAS_MODE_IBSS) {
2476                 params.fixed_freq = ssid->fixed_freq;
2477                 if (ssid->beacon_int)
2478                         params.beacon_int = ssid->beacon_int;
2479                 else
2480                         params.beacon_int = wpa_s->conf->beacon_int;
2481         }
2482
2483         params.wpa_ie = wpa_ie;
2484         params.wpa_ie_len = wpa_ie_len;
2485         params.pairwise_suite = cipher_pairwise;
2486         params.group_suite = cipher_group;
2487         params.key_mgmt_suite = wpa_s->key_mgmt;
2488         params.wpa_proto = wpa_s->wpa_proto;
2489         params.auth_alg = algs;
2490         params.mode = ssid->mode;
2491         params.bg_scan_period = ssid->bg_scan_period;
2492         for (i = 0; i < NUM_WEP_KEYS; i++) {
2493                 if (ssid->wep_key_len[i])
2494                         params.wep_key[i] = ssid->wep_key[i];
2495                 params.wep_key_len[i] = ssid->wep_key_len[i];
2496         }
2497         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2498
2499         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2500             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2501              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2502                 params.passphrase = ssid->passphrase;
2503                 if (ssid->psk_set)
2504                         params.psk = ssid->psk;
2505         }
2506
2507         if (wpa_s->conf->key_mgmt_offload) {
2508                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2509                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2510                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2511                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2512                         params.req_key_mgmt_offload =
2513                                 ssid->proactive_key_caching < 0 ?
2514                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2515                 else
2516                         params.req_key_mgmt_offload = 1;
2517
2518                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2519                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2520                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2521                     ssid->psk_set)
2522                         params.psk = ssid->psk;
2523         }
2524
2525         params.drop_unencrypted = use_crypt;
2526
2527 #ifdef CONFIG_IEEE80211W
2528         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2529         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2530                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2531                 struct wpa_ie_data ie;
2532                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2533                     ie.capabilities &
2534                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2535                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2536                                 "MFP: require MFP");
2537                         params.mgmt_frame_protection =
2538                                 MGMT_FRAME_PROTECTION_REQUIRED;
2539                 }
2540         }
2541 #endif /* CONFIG_IEEE80211W */
2542
2543         params.p2p = ssid->p2p_group;
2544
2545         if (wpa_s->p2pdev->set_sta_uapsd)
2546                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2547         else
2548                 params.uapsd = -1;
2549
2550 #ifdef CONFIG_HT_OVERRIDES
2551         os_memset(&htcaps, 0, sizeof(htcaps));
2552         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2553         params.htcaps = (u8 *) &htcaps;
2554         params.htcaps_mask = (u8 *) &htcaps_mask;
2555         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2556 #endif /* CONFIG_HT_OVERRIDES */
2557 #ifdef CONFIG_VHT_OVERRIDES
2558         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2559         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2560         params.vhtcaps = &vhtcaps;
2561         params.vhtcaps_mask = &vhtcaps_mask;
2562         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2563 #endif /* CONFIG_VHT_OVERRIDES */
2564
2565 #ifdef CONFIG_P2P
2566         /*
2567          * If multi-channel concurrency is not supported, check for any
2568          * frequency conflict. In case of any frequency conflict, remove the
2569          * least prioritized connection.
2570          */
2571         if (wpa_s->num_multichan_concurrent < 2) {
2572                 int freq, num;
2573                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2574                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2575                         wpa_printf(MSG_DEBUG,
2576                                    "Assoc conflicting freq found (%d != %d)",
2577                                    freq, params.freq.freq);
2578                         if (wpas_p2p_handle_frequency_conflicts(
2579                                     wpa_s, params.freq.freq, ssid) < 0) {
2580                                 wpas_connect_work_done(wpa_s);
2581                                 return;
2582                         }
2583                 }
2584         }
2585 #endif /* CONFIG_P2P */
2586
2587         if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
2588             wpa_s->current_ssid)
2589                 params.prev_bssid = prev_bssid;
2590
2591         ret = wpa_drv_associate(wpa_s, &params);
2592         if (ret < 0) {
2593                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2594                         "failed");
2595                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2596                         /*
2597                          * The driver is known to mean what is saying, so we
2598                          * can stop right here; the association will not
2599                          * succeed.
2600                          */
2601                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2602                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2603                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2604                         return;
2605                 }
2606                 /* try to continue anyway; new association will be tried again
2607                  * after timeout */
2608                 assoc_failed = 1;
2609         }
2610
2611         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2612                 /* Set the key after the association just in case association
2613                  * cleared the previously configured key. */
2614                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2615                 /* No need to timeout authentication since there is no key
2616                  * management. */
2617                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2618                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2619 #ifdef CONFIG_IBSS_RSN
2620         } else if (ssid->mode == WPAS_MODE_IBSS &&
2621                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2622                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2623                 /*
2624                  * RSN IBSS authentication is per-STA and we can disable the
2625                  * per-BSSID authentication.
2626                  */
2627                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2628 #endif /* CONFIG_IBSS_RSN */
2629         } else {
2630                 /* Timeout for IEEE 802.11 authentication and association */
2631                 int timeout = 60;
2632
2633                 if (assoc_failed) {
2634                         /* give IBSS a bit more time */
2635                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2636                 } else if (wpa_s->conf->ap_scan == 1) {
2637                         /* give IBSS a bit more time */
2638                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2639                 }
2640                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2641         }
2642
2643         if (wep_keys_set &&
2644             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2645                 /* Set static WEP keys again */
2646                 wpa_set_wep_keys(wpa_s, ssid);
2647         }
2648
2649         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2650                 /*
2651                  * Do not allow EAP session resumption between different
2652                  * network configurations.
2653                  */
2654                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2655         }
2656         old_ssid = wpa_s->current_ssid;
2657         wpa_s->current_ssid = ssid;
2658
2659         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2660                 wpa_s->current_bss = bss;
2661 #ifdef CONFIG_HS20
2662                 hs20_configure_frame_filters(wpa_s);
2663 #endif /* CONFIG_HS20 */
2664         }
2665
2666         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2667         wpa_supplicant_initiate_eapol(wpa_s);
2668         if (old_ssid != wpa_s->current_ssid)
2669                 wpas_notify_network_changed(wpa_s);
2670 }
2671
2672
2673 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2674                                             const u8 *addr)
2675 {
2676         struct wpa_ssid *old_ssid;
2677
2678         wpas_connect_work_done(wpa_s);
2679         wpa_clear_keys(wpa_s, addr);
2680         old_ssid = wpa_s->current_ssid;
2681         wpa_supplicant_mark_disassoc(wpa_s);
2682         wpa_sm_set_config(wpa_s->wpa, NULL);
2683         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2684         if (old_ssid != wpa_s->current_ssid)
2685                 wpas_notify_network_changed(wpa_s);
2686         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2687 }
2688
2689
2690 /**
2691  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2692  * @wpa_s: Pointer to wpa_supplicant data
2693  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2694  *
2695  * This function is used to request %wpa_supplicant to deauthenticate from the
2696  * current AP.
2697  */
2698 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2699                                    int reason_code)
2700 {
2701         u8 *addr = NULL;
2702         union wpa_event_data event;
2703         int zero_addr = 0;
2704
2705         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2706                 " pending_bssid=" MACSTR " reason=%d state=%s",
2707                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2708                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2709
2710         if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2711             (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2712              wpa_s->wpa_state == WPA_ASSOCIATING))
2713                 addr = wpa_s->pending_bssid;
2714         else if (!is_zero_ether_addr(wpa_s->bssid))
2715                 addr = wpa_s->bssid;
2716         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2717                 /*
2718                  * When using driver-based BSS selection, we may not know the
2719                  * BSSID with which we are currently trying to associate. We
2720                  * need to notify the driver of this disconnection even in such
2721                  * a case, so use the all zeros address here.
2722                  */
2723                 addr = wpa_s->bssid;
2724                 zero_addr = 1;
2725         }
2726
2727 #ifdef CONFIG_TDLS
2728         wpa_tdls_teardown_peers(wpa_s->wpa);
2729 #endif /* CONFIG_TDLS */
2730
2731 #ifdef CONFIG_MESH
2732         if (wpa_s->ifmsh) {
2733                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2734                         wpa_s->ifname);
2735                 wpa_supplicant_leave_mesh(wpa_s);
2736         }
2737 #endif /* CONFIG_MESH */
2738
2739         if (addr) {
2740                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2741                 os_memset(&event, 0, sizeof(event));
2742                 event.deauth_info.reason_code = (u16) reason_code;
2743                 event.deauth_info.locally_generated = 1;
2744                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2745                 if (zero_addr)
2746                         addr = NULL;
2747         }
2748
2749         wpa_supplicant_clear_connection(wpa_s, addr);
2750 }
2751
2752 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2753                                               struct wpa_ssid *ssid)
2754 {
2755         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2756                 return;
2757
2758         ssid->disabled = 0;
2759         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2760         wpas_notify_network_enabled_changed(wpa_s, ssid);
2761
2762         /*
2763          * Try to reassociate since there is no current configuration and a new
2764          * network was made available.
2765          */
2766         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2767                 wpa_s->reassociate = 1;
2768 }
2769
2770
2771 /**
2772  * wpa_supplicant_add_network - Add a new network
2773  * @wpa_s: wpa_supplicant structure for a network interface
2774  * Returns: The new network configuration or %NULL if operation failed
2775  *
2776  * This function performs the following operations:
2777  * 1. Adds a new network.
2778  * 2. Send network addition notification.
2779  * 3. Marks the network disabled.
2780  * 4. Set network default parameters.
2781  */
2782 struct wpa_ssid * wpa_supplicant_add_network(struct wpa_supplicant *wpa_s)
2783 {
2784         struct wpa_ssid *ssid;
2785
2786         ssid = wpa_config_add_network(wpa_s->conf);
2787         if (!ssid)
2788                 return NULL;
2789         wpas_notify_network_added(wpa_s, ssid);
2790         ssid->disabled = 1;
2791         wpa_config_set_network_defaults(ssid);
2792
2793         return ssid;
2794 }
2795
2796
2797 /**
2798  * wpa_supplicant_remove_network - Remove a configured network based on id
2799  * @wpa_s: wpa_supplicant structure for a network interface
2800  * @id: Unique network id to search for
2801  * Returns: 0 on success, or -1 if the network was not found, -2 if the network
2802  * could not be removed
2803  *
2804  * This function performs the following operations:
2805  * 1. Removes the network.
2806  * 2. Send network removal notification.
2807  * 3. Update internal state machines.
2808  * 4. Stop any running sched scans.
2809  */
2810 int wpa_supplicant_remove_network(struct wpa_supplicant *wpa_s, int id)
2811 {
2812         struct wpa_ssid *ssid;
2813         int was_disabled;
2814
2815         ssid = wpa_config_get_network(wpa_s->conf, id);
2816         if (!ssid)
2817                 return -1;
2818         wpas_notify_network_removed(wpa_s, ssid);
2819
2820         if (wpa_s->last_ssid == ssid)
2821                 wpa_s->last_ssid = NULL;
2822
2823         if (ssid == wpa_s->current_ssid || !wpa_s->current_ssid) {
2824 #ifdef CONFIG_SME
2825                 wpa_s->sme.prev_bssid_set = 0;
2826 #endif /* CONFIG_SME */
2827                 /*
2828                  * Invalidate the EAP session cache if the current or
2829                  * previously used network is removed.
2830                  */
2831                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2832         }
2833
2834         if (ssid == wpa_s->current_ssid) {
2835                 wpa_sm_set_config(wpa_s->wpa, NULL);
2836                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2837
2838                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2839                         wpa_s->own_disconnect_req = 1;
2840                 wpa_supplicant_deauthenticate(wpa_s,
2841                                               WLAN_REASON_DEAUTH_LEAVING);
2842         }
2843
2844         was_disabled = ssid->disabled;
2845
2846         if (wpa_config_remove_network(wpa_s->conf, id) < 0)
2847                 return -2;
2848
2849         if (!was_disabled && wpa_s->sched_scanning) {
2850                 wpa_printf(MSG_DEBUG,
2851                            "Stop ongoing sched_scan to remove network from filters");
2852                 wpa_supplicant_cancel_sched_scan(wpa_s);
2853                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2854         }
2855
2856         return 0;
2857 }
2858
2859
2860 /**
2861  * wpa_supplicant_enable_network - Mark a configured network as enabled
2862  * @wpa_s: wpa_supplicant structure for a network interface
2863  * @ssid: wpa_ssid structure for a configured network or %NULL
2864  *
2865  * Enables the specified network or all networks if no network specified.
2866  */
2867 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2868                                    struct wpa_ssid *ssid)
2869 {
2870         if (ssid == NULL) {
2871                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2872                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2873         } else
2874                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2875
2876         if (wpa_s->reassociate && !wpa_s->disconnected &&
2877             (!wpa_s->current_ssid ||
2878              wpa_s->wpa_state == WPA_DISCONNECTED ||
2879              wpa_s->wpa_state == WPA_SCANNING)) {
2880                 if (wpa_s->sched_scanning) {
2881                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2882                                    "new network to scan filters");
2883                         wpa_supplicant_cancel_sched_scan(wpa_s);
2884                 }
2885
2886                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2887                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2888                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2889                 }
2890         }
2891 }
2892
2893
2894 /**
2895  * wpa_supplicant_disable_network - Mark a configured network as disabled
2896  * @wpa_s: wpa_supplicant structure for a network interface
2897  * @ssid: wpa_ssid structure for a configured network or %NULL
2898  *
2899  * Disables the specified network or all networks if no network specified.
2900  */
2901 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2902                                     struct wpa_ssid *ssid)
2903 {
2904         struct wpa_ssid *other_ssid;
2905         int was_disabled;
2906
2907         if (ssid == NULL) {
2908                 if (wpa_s->sched_scanning)
2909                         wpa_supplicant_cancel_sched_scan(wpa_s);
2910
2911                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2912                      other_ssid = other_ssid->next) {
2913                         was_disabled = other_ssid->disabled;
2914                         if (was_disabled == 2)
2915                                 continue; /* do not change persistent P2P group
2916                                            * data */
2917
2918                         other_ssid->disabled = 1;
2919
2920                         if (was_disabled != other_ssid->disabled)
2921                                 wpas_notify_network_enabled_changed(
2922                                         wpa_s, other_ssid);
2923                 }
2924                 if (wpa_s->current_ssid)
2925                         wpa_supplicant_deauthenticate(
2926                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2927         } else if (ssid->disabled != 2) {
2928                 if (ssid == wpa_s->current_ssid)
2929                         wpa_supplicant_deauthenticate(
2930                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2931
2932                 was_disabled = ssid->disabled;
2933
2934                 ssid->disabled = 1;
2935
2936                 if (was_disabled != ssid->disabled) {
2937                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2938                         if (wpa_s->sched_scanning) {
2939                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2940                                            "to remove network from filters");
2941                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2942                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2943                         }
2944                 }
2945         }
2946 }
2947
2948
2949 /**
2950  * wpa_supplicant_select_network - Attempt association with a network
2951  * @wpa_s: wpa_supplicant structure for a network interface
2952  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2953  */
2954 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2955                                    struct wpa_ssid *ssid)
2956 {
2957
2958         struct wpa_ssid *other_ssid;
2959         int disconnected = 0;
2960
2961         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2962                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2963                         wpa_s->own_disconnect_req = 1;
2964                 wpa_supplicant_deauthenticate(
2965                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2966                 disconnected = 1;
2967         }
2968
2969         if (ssid)
2970                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2971
2972         /*
2973          * Mark all other networks disabled or mark all networks enabled if no
2974          * network specified.
2975          */
2976         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2977              other_ssid = other_ssid->next) {
2978                 int was_disabled = other_ssid->disabled;
2979                 if (was_disabled == 2)
2980                         continue; /* do not change persistent P2P group data */
2981
2982                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2983                 if (was_disabled && !other_ssid->disabled)
2984                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2985
2986                 if (was_disabled != other_ssid->disabled)
2987                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2988         }
2989
2990         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2991             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2992                 /* We are already associated with the selected network */
2993                 wpa_printf(MSG_DEBUG, "Already associated with the "
2994                            "selected network - do nothing");
2995                 return;
2996         }
2997
2998         if (ssid) {
2999                 wpa_s->current_ssid = ssid;
3000                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
3001                 wpa_s->connect_without_scan =
3002                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
3003
3004                 /*
3005                  * Don't optimize next scan freqs since a new ESS has been
3006                  * selected.
3007                  */
3008                 os_free(wpa_s->next_scan_freqs);
3009                 wpa_s->next_scan_freqs = NULL;
3010         } else {
3011                 wpa_s->connect_without_scan = NULL;
3012         }
3013
3014         wpa_s->disconnected = 0;
3015         wpa_s->reassociate = 1;
3016
3017         if (wpa_s->connect_without_scan ||
3018             wpa_supplicant_fast_associate(wpa_s) != 1) {
3019                 wpa_s->scan_req = NORMAL_SCAN_REQ;
3020                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
3021         }
3022
3023         if (ssid)
3024                 wpas_notify_network_selected(wpa_s, ssid);
3025 }
3026
3027
3028 /**
3029  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
3030  * @wpa_s: wpa_supplicant structure for a network interface
3031  * @pkcs11_engine_path: PKCS #11 engine path or NULL
3032  * @pkcs11_module_path: PKCS #11 module path or NULL
3033  * Returns: 0 on success; -1 on failure
3034  *
3035  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
3036  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
3037  * module path fails the paths will be reset to the default value (NULL).
3038  */
3039 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
3040                                            const char *pkcs11_engine_path,
3041                                            const char *pkcs11_module_path)
3042 {
3043         char *pkcs11_engine_path_copy = NULL;
3044         char *pkcs11_module_path_copy = NULL;
3045
3046         if (pkcs11_engine_path != NULL) {
3047                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
3048                 if (pkcs11_engine_path_copy == NULL)
3049                         return -1;
3050         }
3051         if (pkcs11_module_path != NULL) {
3052                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
3053                 if (pkcs11_module_path_copy == NULL) {
3054                         os_free(pkcs11_engine_path_copy);
3055                         return -1;
3056                 }
3057         }
3058
3059         os_free(wpa_s->conf->pkcs11_engine_path);
3060         os_free(wpa_s->conf->pkcs11_module_path);
3061         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
3062         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
3063
3064         wpa_sm_set_eapol(wpa_s->wpa, NULL);
3065         eapol_sm_deinit(wpa_s->eapol);
3066         wpa_s->eapol = NULL;
3067         if (wpa_supplicant_init_eapol(wpa_s)) {
3068                 /* Error -> Reset paths to the default value (NULL) once. */
3069                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
3070                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
3071                                                                NULL);
3072
3073                 return -1;
3074         }
3075         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
3076
3077         return 0;
3078 }
3079
3080
3081 /**
3082  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
3083  * @wpa_s: wpa_supplicant structure for a network interface
3084  * @ap_scan: AP scan mode
3085  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
3086  *
3087  */
3088 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
3089 {
3090
3091         int old_ap_scan;
3092
3093         if (ap_scan < 0 || ap_scan > 2)
3094                 return -1;
3095
3096         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3097                 wpa_printf(MSG_INFO,
3098                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3099         }
3100
3101 #ifdef ANDROID
3102         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
3103             wpa_s->wpa_state >= WPA_ASSOCIATING &&
3104             wpa_s->wpa_state < WPA_COMPLETED) {
3105                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
3106                            "associating", wpa_s->conf->ap_scan, ap_scan);
3107                 return 0;
3108         }
3109 #endif /* ANDROID */
3110
3111         old_ap_scan = wpa_s->conf->ap_scan;
3112         wpa_s->conf->ap_scan = ap_scan;
3113
3114         if (old_ap_scan != wpa_s->conf->ap_scan)
3115                 wpas_notify_ap_scan_changed(wpa_s);
3116
3117         return 0;
3118 }
3119
3120
3121 /**
3122  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
3123  * @wpa_s: wpa_supplicant structure for a network interface
3124  * @expire_age: Expiration age in seconds
3125  * Returns: 0 if succeed or -1 if expire_age has an invalid value
3126  *
3127  */
3128 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
3129                                           unsigned int bss_expire_age)
3130 {
3131         if (bss_expire_age < 10) {
3132                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
3133                         bss_expire_age);
3134                 return -1;
3135         }
3136         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
3137                 bss_expire_age);
3138         wpa_s->conf->bss_expiration_age = bss_expire_age;
3139
3140         return 0;
3141 }
3142
3143
3144 /**
3145  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
3146  * @wpa_s: wpa_supplicant structure for a network interface
3147  * @expire_count: number of scans after which an unseen BSS is reclaimed
3148  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3149  *
3150  */
3151 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3152                                             unsigned int bss_expire_count)
3153 {
3154         if (bss_expire_count < 1) {
3155                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3156                         bss_expire_count);
3157                 return -1;
3158         }
3159         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3160                 bss_expire_count);
3161         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3162
3163         return 0;
3164 }
3165
3166
3167 /**
3168  * wpa_supplicant_set_scan_interval - Set scan interval
3169  * @wpa_s: wpa_supplicant structure for a network interface
3170  * @scan_interval: scan interval in seconds
3171  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3172  *
3173  */
3174 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3175                                      int scan_interval)
3176 {
3177         if (scan_interval < 0) {
3178                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3179                         scan_interval);
3180                 return -1;
3181         }
3182         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3183                 scan_interval);
3184         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3185
3186         return 0;
3187 }
3188
3189
3190 /**
3191  * wpa_supplicant_set_debug_params - Set global debug params
3192  * @global: wpa_global structure
3193  * @debug_level: debug level
3194  * @debug_timestamp: determines if show timestamp in debug data
3195  * @debug_show_keys: determines if show keys in debug data
3196  * Returns: 0 if succeed or -1 if debug_level has wrong value
3197  */
3198 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3199                                     int debug_timestamp, int debug_show_keys)
3200 {
3201
3202         int old_level, old_timestamp, old_show_keys;
3203
3204         /* check for allowed debuglevels */
3205         if (debug_level != MSG_EXCESSIVE &&
3206             debug_level != MSG_MSGDUMP &&
3207             debug_level != MSG_DEBUG &&
3208             debug_level != MSG_INFO &&
3209             debug_level != MSG_WARNING &&
3210             debug_level != MSG_ERROR)
3211                 return -1;
3212
3213         old_level = wpa_debug_level;
3214         old_timestamp = wpa_debug_timestamp;
3215         old_show_keys = wpa_debug_show_keys;
3216
3217         wpa_debug_level = debug_level;
3218         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3219         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3220
3221         if (wpa_debug_level != old_level)
3222                 wpas_notify_debug_level_changed(global);
3223         if (wpa_debug_timestamp != old_timestamp)
3224                 wpas_notify_debug_timestamp_changed(global);
3225         if (wpa_debug_show_keys != old_show_keys)
3226                 wpas_notify_debug_show_keys_changed(global);
3227
3228         return 0;
3229 }
3230
3231
3232 /**
3233  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3234  * @wpa_s: Pointer to wpa_supplicant data
3235  * Returns: A pointer to the current network structure or %NULL on failure
3236  */
3237 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3238 {
3239         struct wpa_ssid *entry;
3240         u8 ssid[SSID_MAX_LEN];
3241         int res;
3242         size_t ssid_len;
3243         u8 bssid[ETH_ALEN];
3244         int wired;
3245
3246         res = wpa_drv_get_ssid(wpa_s, ssid);
3247         if (res < 0) {
3248                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3249                         "driver");
3250                 return NULL;
3251         }
3252         ssid_len = res;
3253
3254         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3255                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3256                         "driver");
3257                 return NULL;
3258         }
3259
3260         wired = wpa_s->conf->ap_scan == 0 &&
3261                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3262
3263         entry = wpa_s->conf->ssid;
3264         while (entry) {
3265                 if (!wpas_network_disabled(wpa_s, entry) &&
3266                     ((ssid_len == entry->ssid_len &&
3267                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3268                     (!entry->bssid_set ||
3269                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3270                         return entry;
3271 #ifdef CONFIG_WPS
3272                 if (!wpas_network_disabled(wpa_s, entry) &&
3273                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3274                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3275                     (!entry->bssid_set ||
3276                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3277                         return entry;
3278 #endif /* CONFIG_WPS */
3279
3280                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3281                     entry->ssid_len == 0 &&
3282                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3283                         return entry;
3284
3285                 entry = entry->next;
3286         }
3287
3288         return NULL;
3289 }
3290
3291
3292 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3293 {
3294         struct wpa_global *global = wpa_s->global;
3295
3296         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3297                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3298                 if (global->drv_priv[i] == NULL) {
3299                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3300                                    "'%s'", wpa_drivers[i]->name);
3301                         return -1;
3302                 }
3303         }
3304
3305         wpa_s->driver = wpa_drivers[i];
3306         wpa_s->global_drv_priv = global->drv_priv[i];
3307
3308         return 0;
3309 }
3310
3311
3312 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3313                                      const char *name)
3314 {
3315         int i;
3316         size_t len;
3317         const char *pos, *driver = name;
3318
3319         if (wpa_s == NULL)
3320                 return -1;
3321
3322         if (wpa_drivers[0] == NULL) {
3323                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3324                         "wpa_supplicant");
3325                 return -1;
3326         }
3327
3328         if (name == NULL) {
3329                 /* default to first driver in the list */
3330                 return select_driver(wpa_s, 0);
3331         }
3332
3333         do {
3334                 pos = os_strchr(driver, ',');
3335                 if (pos)
3336                         len = pos - driver;
3337                 else
3338                         len = os_strlen(driver);
3339
3340                 for (i = 0; wpa_drivers[i]; i++) {
3341                         if (os_strlen(wpa_drivers[i]->name) == len &&
3342                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3343                             0) {
3344                                 /* First driver that succeeds wins */
3345                                 if (select_driver(wpa_s, i) == 0)
3346                                         return 0;
3347                         }
3348                 }
3349
3350                 driver = pos + 1;
3351         } while (pos);
3352
3353         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3354         return -1;
3355 }
3356
3357
3358 /**
3359  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3360  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3361  *      with struct wpa_driver_ops::init()
3362  * @src_addr: Source address of the EAPOL frame
3363  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3364  * @len: Length of the EAPOL data
3365  *
3366  * This function is called for each received EAPOL frame. Most driver
3367  * interfaces rely on more generic OS mechanism for receiving frames through
3368  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3369  * take care of received EAPOL frames and deliver them to the core supplicant
3370  * code by calling this function.
3371  */
3372 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3373                              const u8 *buf, size_t len)
3374 {
3375         struct wpa_supplicant *wpa_s = ctx;
3376
3377         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3378         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3379
3380 #ifdef CONFIG_PEERKEY
3381         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3382             wpa_s->current_ssid->peerkey &&
3383             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3384             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3385                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3386                 return;
3387         }
3388 #endif /* CONFIG_PEERKEY */
3389
3390         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3391             (wpa_s->last_eapol_matches_bssid &&
3392 #ifdef CONFIG_AP
3393              !wpa_s->ap_iface &&
3394 #endif /* CONFIG_AP */
3395              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3396                 /*
3397                  * There is possible race condition between receiving the
3398                  * association event and the EAPOL frame since they are coming
3399                  * through different paths from the driver. In order to avoid
3400                  * issues in trying to process the EAPOL frame before receiving
3401                  * association information, lets queue it for processing until
3402                  * the association event is received. This may also be needed in
3403                  * driver-based roaming case, so also use src_addr != BSSID as a
3404                  * trigger if we have previously confirmed that the
3405                  * Authenticator uses BSSID as the src_addr (which is not the
3406                  * case with wired IEEE 802.1X).
3407                  */
3408                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3409                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3410                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3411                         MAC2STR(wpa_s->bssid));
3412                 wpabuf_free(wpa_s->pending_eapol_rx);
3413                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3414                 if (wpa_s->pending_eapol_rx) {
3415                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3416                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3417                                   ETH_ALEN);
3418                 }
3419                 return;
3420         }
3421
3422         wpa_s->last_eapol_matches_bssid =
3423                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3424
3425 #ifdef CONFIG_AP
3426         if (wpa_s->ap_iface) {
3427                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3428                 return;
3429         }
3430 #endif /* CONFIG_AP */
3431
3432         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3433                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3434                         "no key management is configured");
3435                 return;
3436         }
3437
3438         if (wpa_s->eapol_received == 0 &&
3439             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3440              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3441              wpa_s->wpa_state != WPA_COMPLETED) &&
3442             (wpa_s->current_ssid == NULL ||
3443              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3444                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3445                 int timeout = 10;
3446
3447                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3448                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3449                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3450                         /* Use longer timeout for IEEE 802.1X/EAP */
3451                         timeout = 70;
3452                 }
3453
3454 #ifdef CONFIG_WPS
3455                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3456                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3457                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3458                         /*
3459                          * Use shorter timeout if going through WPS AP iteration
3460                          * for PIN config method with an AP that does not
3461                          * advertise Selected Registrar.
3462                          */
3463                         struct wpabuf *wps_ie;
3464
3465                         wps_ie = wpa_bss_get_vendor_ie_multi(
3466                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3467                         if (wps_ie &&
3468                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3469                                 timeout = 10;
3470                         wpabuf_free(wps_ie);
3471                 }
3472 #endif /* CONFIG_WPS */
3473
3474                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3475         }
3476         wpa_s->eapol_received++;
3477
3478         if (wpa_s->countermeasures) {
3479                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3480                         "EAPOL packet");
3481                 return;
3482         }
3483
3484 #ifdef CONFIG_IBSS_RSN
3485         if (wpa_s->current_ssid &&
3486             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3487                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3488                 return;
3489         }
3490 #endif /* CONFIG_IBSS_RSN */
3491
3492         /* Source address of the incoming EAPOL frame could be compared to the
3493          * current BSSID. However, it is possible that a centralized
3494          * Authenticator could be using another MAC address than the BSSID of
3495          * an AP, so just allow any address to be used for now. The replies are
3496          * still sent to the current BSSID (if available), though. */
3497
3498         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3499         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3500             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3501                 return;
3502         wpa_drv_poll(wpa_s);
3503         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3504                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3505         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3506                 /*
3507                  * Set portValid = TRUE here since we are going to skip 4-way
3508                  * handshake processing which would normally set portValid. We
3509                  * need this to allow the EAPOL state machines to be completed
3510                  * without going through EAPOL-Key handshake.
3511                  */
3512                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3513         }
3514 }
3515
3516
3517 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3518 {
3519         if ((!wpa_s->p2p_mgmt ||
3520              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3521             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3522                 l2_packet_deinit(wpa_s->l2);
3523                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3524                                            wpa_drv_get_mac_addr(wpa_s),
3525                                            ETH_P_EAPOL,
3526                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3527                 if (wpa_s->l2 == NULL)
3528                         return -1;
3529         } else {
3530                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3531                 if (addr)
3532                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3533         }
3534
3535         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3536                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3537                 return -1;
3538         }
3539
3540         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3541
3542         return 0;
3543 }
3544
3545
3546 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3547                                            const u8 *buf, size_t len)
3548 {
3549         struct wpa_supplicant *wpa_s = ctx;
3550         const struct l2_ethhdr *eth;
3551
3552         if (len < sizeof(*eth))
3553                 return;
3554         eth = (const struct l2_ethhdr *) buf;
3555
3556         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3557             !(eth->h_dest[0] & 0x01)) {
3558                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3559                         " (bridge - not for this interface - ignore)",
3560                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3561                 return;
3562         }
3563
3564         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3565                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3566         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3567                                 len - sizeof(*eth));
3568 }
3569
3570
3571 /**
3572  * wpa_supplicant_driver_init - Initialize driver interface parameters
3573  * @wpa_s: Pointer to wpa_supplicant data
3574  * Returns: 0 on success, -1 on failure
3575  *
3576  * This function is called to initialize driver interface parameters.
3577  * wpa_drv_init() must have been called before this function to initialize the
3578  * driver interface.
3579  */
3580 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3581 {
3582         static int interface_count = 0;
3583
3584         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3585                 return -1;
3586
3587         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3588                 MAC2STR(wpa_s->own_addr));
3589         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3590         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3591
3592         if (wpa_s->bridge_ifname[0]) {
3593                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3594                         "interface '%s'", wpa_s->bridge_ifname);
3595                 wpa_s->l2_br = l2_packet_init_bridge(
3596                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3597                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3598                 if (wpa_s->l2_br == NULL) {
3599                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3600                                 "connection for the bridge interface '%s'",
3601                                 wpa_s->bridge_ifname);
3602                         return -1;
3603                 }
3604         }
3605
3606         if (wpa_s->conf->ap_scan == 2 &&
3607             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3608                 wpa_printf(MSG_INFO,
3609                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3610         }
3611
3612         wpa_clear_keys(wpa_s, NULL);
3613
3614         /* Make sure that TKIP countermeasures are not left enabled (could
3615          * happen if wpa_supplicant is killed during countermeasures. */
3616         wpa_drv_set_countermeasures(wpa_s, 0);
3617
3618         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3619         wpa_drv_flush_pmkid(wpa_s);
3620
3621         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3622         wpa_s->prev_scan_wildcard = 0;
3623
3624         if (wpa_supplicant_enabled_networks(wpa_s)) {
3625                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3626                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3627                         interface_count = 0;
3628                 }
3629 #ifndef ANDROID
3630                 if (!wpa_s->p2p_mgmt &&
3631                     wpa_supplicant_delayed_sched_scan(wpa_s,
3632                                                       interface_count % 3,
3633                                                       100000))
3634                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3635                                                 100000);
3636 #endif /* ANDROID */
3637                 interface_count++;
3638         } else
3639                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3640
3641         return 0;
3642 }
3643
3644
3645 static int wpa_supplicant_daemon(const char *pid_file)
3646 {
3647         wpa_printf(MSG_DEBUG, "Daemonize..");
3648         return os_daemonize(pid_file);
3649 }
3650
3651
3652 static struct wpa_supplicant *
3653 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3654 {
3655         struct wpa_supplicant *wpa_s;
3656
3657         wpa_s = os_zalloc(sizeof(*wpa_s));
3658         if (wpa_s == NULL)
3659                 return NULL;
3660         wpa_s->scan_req = INITIAL_SCAN_REQ;
3661         wpa_s->scan_interval = 5;
3662         wpa_s->new_connection = 1;
3663         wpa_s->parent = parent ? parent : wpa_s;
3664         wpa_s->p2pdev = wpa_s->parent;
3665         wpa_s->sched_scanning = 0;
3666
3667         dl_list_init(&wpa_s->bss_tmp_disallowed);
3668
3669         return wpa_s;
3670 }
3671
3672
3673 #ifdef CONFIG_HT_OVERRIDES
3674
3675 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3676                              struct ieee80211_ht_capabilities *htcaps,
3677                              struct ieee80211_ht_capabilities *htcaps_mask,
3678                              const char *ht_mcs)
3679 {
3680         /* parse ht_mcs into hex array */
3681         int i;
3682         const char *tmp = ht_mcs;
3683         char *end = NULL;
3684
3685         /* If ht_mcs is null, do not set anything */
3686         if (!ht_mcs)
3687                 return 0;
3688
3689         /* This is what we are setting in the kernel */
3690         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3691
3692         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3693
3694         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3695                 errno = 0;
3696                 long v = strtol(tmp, &end, 16);
3697                 if (errno == 0) {
3698                         wpa_msg(wpa_s, MSG_DEBUG,
3699                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3700                                 i, v, end, tmp);
3701                         if (end == tmp)
3702                                 break;
3703
3704                         htcaps->supported_mcs_set[i] = v;
3705                         tmp = end;
3706                 } else {
3707                         wpa_msg(wpa_s, MSG_ERROR,
3708                                 "Failed to parse ht-mcs: %s, error: %s\n",
3709                                 ht_mcs, strerror(errno));
3710                         return -1;
3711                 }
3712         }
3713
3714         /*
3715          * If we were able to parse any values, then set mask for the MCS set.
3716          */
3717         if (i) {
3718                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3719                           IEEE80211_HT_MCS_MASK_LEN - 1);
3720                 /* skip the 3 reserved bits */
3721                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3722                         0x1f;
3723         }
3724
3725         return 0;
3726 }
3727
3728
3729 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3730                                  struct ieee80211_ht_capabilities *htcaps,
3731                                  struct ieee80211_ht_capabilities *htcaps_mask,
3732                                  int disabled)
3733 {
3734         le16 msk;
3735
3736         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3737
3738         if (disabled == -1)
3739                 return 0;
3740
3741         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3742         htcaps_mask->ht_capabilities_info |= msk;
3743         if (disabled)
3744                 htcaps->ht_capabilities_info &= msk;
3745         else
3746                 htcaps->ht_capabilities_info |= msk;
3747
3748         return 0;
3749 }
3750
3751
3752 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3753                                 struct ieee80211_ht_capabilities *htcaps,
3754                                 struct ieee80211_ht_capabilities *htcaps_mask,
3755                                 int factor)
3756 {
3757         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3758
3759         if (factor == -1)
3760                 return 0;
3761
3762         if (factor < 0 || factor > 3) {
3763                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3764                         "Must be 0-3 or -1", factor);
3765                 return -EINVAL;
3766         }
3767
3768         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3769         htcaps->a_mpdu_params &= ~0x3;
3770         htcaps->a_mpdu_params |= factor & 0x3;
3771
3772         return 0;
3773 }
3774
3775
3776 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3777                                  struct ieee80211_ht_capabilities *htcaps,
3778                                  struct ieee80211_ht_capabilities *htcaps_mask,
3779                                  int density)
3780 {
3781         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3782
3783         if (density == -1)
3784                 return 0;
3785
3786         if (density < 0 || density > 7) {
3787                 wpa_msg(wpa_s, MSG_ERROR,
3788                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3789                         density);
3790                 return -EINVAL;
3791         }
3792
3793         htcaps_mask->a_mpdu_params |= 0x1C;
3794         htcaps->a_mpdu_params &= ~(0x1C);
3795         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3796
3797         return 0;
3798 }
3799
3800
3801 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3802                                 struct ieee80211_ht_capabilities *htcaps,
3803                                 struct ieee80211_ht_capabilities *htcaps_mask,
3804                                 int disabled)
3805 {
3806         /* Masking these out disables HT40 */
3807         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3808                                 HT_CAP_INFO_SHORT_GI40MHZ);
3809
3810         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3811
3812         if (disabled)
3813                 htcaps->ht_capabilities_info &= ~msk;
3814         else
3815                 htcaps->ht_capabilities_info |= msk;
3816
3817         htcaps_mask->ht_capabilities_info |= msk;
3818
3819         return 0;
3820 }
3821
3822
3823 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3824                                struct ieee80211_ht_capabilities *htcaps,
3825                                struct ieee80211_ht_capabilities *htcaps_mask,
3826                                int disabled)
3827 {
3828         /* Masking these out disables SGI */
3829         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3830                                 HT_CAP_INFO_SHORT_GI40MHZ);
3831
3832         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3833
3834         if (disabled)
3835                 htcaps->ht_capabilities_info &= ~msk;
3836         else
3837                 htcaps->ht_capabilities_info |= msk;
3838
3839         htcaps_mask->ht_capabilities_info |= msk;
3840
3841         return 0;
3842 }
3843
3844
3845 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3846                                struct ieee80211_ht_capabilities *htcaps,
3847                                struct ieee80211_ht_capabilities *htcaps_mask,
3848                                int disabled)
3849 {
3850         /* Masking these out disables LDPC */
3851         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3852
3853         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3854
3855         if (disabled)
3856                 htcaps->ht_capabilities_info &= ~msk;
3857         else
3858                 htcaps->ht_capabilities_info |= msk;
3859
3860         htcaps_mask->ht_capabilities_info |= msk;
3861
3862         return 0;
3863 }
3864
3865
3866 void wpa_supplicant_apply_ht_overrides(
3867         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3868         struct wpa_driver_associate_params *params)
3869 {
3870         struct ieee80211_ht_capabilities *htcaps;
3871         struct ieee80211_ht_capabilities *htcaps_mask;
3872
3873         if (!ssid)
3874                 return;
3875
3876         params->disable_ht = ssid->disable_ht;
3877         if (!params->htcaps || !params->htcaps_mask)
3878                 return;
3879
3880         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3881         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3882         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3883         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3884                               ssid->disable_max_amsdu);
3885         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3886         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3887         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3888         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3889         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3890
3891         if (ssid->ht40_intolerant) {
3892                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3893                 htcaps->ht_capabilities_info |= bit;
3894                 htcaps_mask->ht_capabilities_info |= bit;
3895         }
3896 }
3897
3898 #endif /* CONFIG_HT_OVERRIDES */
3899
3900
3901 #ifdef CONFIG_VHT_OVERRIDES
3902 void wpa_supplicant_apply_vht_overrides(
3903         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3904         struct wpa_driver_associate_params *params)
3905 {
3906         struct ieee80211_vht_capabilities *vhtcaps;
3907         struct ieee80211_vht_capabilities *vhtcaps_mask;
3908
3909         if (!ssid)
3910                 return;
3911
3912         params->disable_vht = ssid->disable_vht;
3913
3914         vhtcaps = (void *) params->vhtcaps;
3915         vhtcaps_mask = (void *) params->vhtcaps_mask;
3916
3917         if (!vhtcaps || !vhtcaps_mask)
3918                 return;
3919
3920         vhtcaps->vht_capabilities_info = host_to_le32(ssid->vht_capa);
3921         vhtcaps_mask->vht_capabilities_info = host_to_le32(ssid->vht_capa_mask);
3922
3923 #ifdef CONFIG_HT_OVERRIDES
3924         /* if max ampdu is <= 3, we have to make the HT cap the same */
3925         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3926                 int max_ampdu;
3927
3928                 max_ampdu = (ssid->vht_capa &
3929                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3930                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3931
3932                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3933                 wpa_set_ampdu_factor(wpa_s,
3934                                      (void *) params->htcaps,
3935                                      (void *) params->htcaps_mask,
3936                                      max_ampdu);
3937         }
3938 #endif /* CONFIG_HT_OVERRIDES */
3939
3940 #define OVERRIDE_MCS(i)                                                 \
3941         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3942                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3943                         host_to_le16(3 << 2 * (i - 1));                 \
3944                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3945                         host_to_le16(ssid->vht_tx_mcs_nss_ ##i <<       \
3946                                      2 * (i - 1));                      \
3947         }                                                               \
3948         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3949                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3950                         host_to_le16(3 << 2 * (i - 1));                 \
3951                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3952                         host_to_le16(ssid->vht_rx_mcs_nss_ ##i <<       \
3953                                      2 * (i - 1));                      \
3954         }
3955
3956         OVERRIDE_MCS(1);
3957         OVERRIDE_MCS(2);
3958         OVERRIDE_MCS(3);
3959         OVERRIDE_MCS(4);
3960         OVERRIDE_MCS(5);
3961         OVERRIDE_MCS(6);
3962         OVERRIDE_MCS(7);
3963         OVERRIDE_MCS(8);
3964 }
3965 #endif /* CONFIG_VHT_OVERRIDES */
3966
3967
3968 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3969 {
3970 #ifdef PCSC_FUNCS
3971         size_t len;
3972
3973         if (!wpa_s->conf->pcsc_reader)
3974                 return 0;
3975
3976         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3977         if (!wpa_s->scard)
3978                 return 1;
3979
3980         if (wpa_s->conf->pcsc_pin &&
3981             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3982                 scard_deinit(wpa_s->scard);
3983                 wpa_s->scard = NULL;
3984                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3985                 return -1;
3986         }
3987
3988         len = sizeof(wpa_s->imsi) - 1;
3989         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3990                 scard_deinit(wpa_s->scard);
3991                 wpa_s->scard = NULL;
3992                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3993                 return -1;
3994         }
3995         wpa_s->imsi[len] = '\0';
3996
3997         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3998
3999         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
4000                    wpa_s->imsi, wpa_s->mnc_len);
4001
4002         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
4003         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
4004 #endif /* PCSC_FUNCS */
4005
4006         return 0;
4007 }
4008
4009
4010 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
4011 {
4012         char *val, *pos;
4013
4014         ext_password_deinit(wpa_s->ext_pw);
4015         wpa_s->ext_pw = NULL;
4016         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
4017
4018         if (!wpa_s->conf->ext_password_backend)
4019                 return 0;
4020
4021         val = os_strdup(wpa_s->conf->ext_password_backend);
4022         if (val == NULL)
4023                 return -1;
4024         pos = os_strchr(val, ':');
4025         if (pos)
4026                 *pos++ = '\0';
4027
4028         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
4029
4030         wpa_s->ext_pw = ext_password_init(val, pos);
4031         os_free(val);
4032         if (wpa_s->ext_pw == NULL) {
4033                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
4034                 return -1;
4035         }
4036         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
4037
4038         return 0;
4039 }
4040
4041
4042 #ifdef CONFIG_FST
4043
4044 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
4045 {
4046         struct wpa_supplicant *wpa_s = ctx;
4047
4048         return (is_zero_ether_addr(wpa_s->bssid) ||
4049                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
4050 }
4051
4052
4053 static void wpas_fst_get_channel_info_cb(void *ctx,
4054                                          enum hostapd_hw_mode *hw_mode,
4055                                          u8 *channel)
4056 {
4057         struct wpa_supplicant *wpa_s = ctx;
4058
4059         if (wpa_s->current_bss) {
4060                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
4061                                                   channel);
4062         } else if (wpa_s->hw.num_modes) {
4063                 *hw_mode = wpa_s->hw.modes[0].mode;
4064         } else {
4065                 WPA_ASSERT(0);
4066                 *hw_mode = 0;
4067         }
4068 }
4069
4070
4071 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
4072 {
4073         struct wpa_supplicant *wpa_s = ctx;
4074
4075         *modes = wpa_s->hw.modes;
4076         return wpa_s->hw.num_modes;
4077 }
4078
4079
4080 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
4081 {
4082         struct wpa_supplicant *wpa_s = ctx;
4083
4084         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
4085         wpa_s->fst_ies = fst_ies;
4086 }
4087
4088
4089 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
4090 {
4091         struct wpa_supplicant *wpa_s = ctx;
4092
4093         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
4094         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
4095                                           wpa_s->own_addr, wpa_s->bssid,
4096                                           wpabuf_head(data), wpabuf_len(data),
4097                                    0);
4098 }
4099
4100
4101 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
4102 {
4103         struct wpa_supplicant *wpa_s = ctx;
4104
4105         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4106         return wpa_s->received_mb_ies;
4107 }
4108
4109
4110 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
4111                                      const u8 *buf, size_t size)
4112 {
4113         struct wpa_supplicant *wpa_s = ctx;
4114         struct mb_ies_info info;
4115
4116         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
4117
4118         if (!mb_ies_info_by_ies(&info, buf, size)) {
4119                 wpabuf_free(wpa_s->received_mb_ies);
4120                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
4121         }
4122 }
4123
4124
4125 static const u8 * wpas_fst_get_peer_first(void *ctx,
4126                                           struct fst_get_peer_ctx **get_ctx,
4127                                           Boolean mb_only)
4128 {
4129         struct wpa_supplicant *wpa_s = ctx;
4130
4131         *get_ctx = NULL;
4132         if (!is_zero_ether_addr(wpa_s->bssid))
4133                 return (wpa_s->received_mb_ies || !mb_only) ?
4134                         wpa_s->bssid : NULL;
4135         return NULL;
4136 }
4137
4138
4139 static const u8 * wpas_fst_get_peer_next(void *ctx,
4140                                          struct fst_get_peer_ctx **get_ctx,
4141                                          Boolean mb_only)
4142 {
4143         return NULL;
4144 }
4145
4146 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
4147                                        struct fst_wpa_obj *iface_obj)
4148 {
4149         iface_obj->ctx              = wpa_s;
4150         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4151         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4152         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4153         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4154         iface_obj->send_action      = wpas_fst_send_action_cb;
4155         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4156         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4157         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4158         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4159 }
4160 #endif /* CONFIG_FST */
4161
4162 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4163                                     const struct wpa_driver_capa *capa)
4164 {
4165         struct wowlan_triggers *triggers;
4166         int ret = 0;
4167
4168         if (!wpa_s->conf->wowlan_triggers)
4169                 return 0;
4170
4171         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4172         if (triggers) {
4173                 ret = wpa_drv_wowlan(wpa_s, triggers);
4174                 os_free(triggers);
4175         }
4176         return ret;
4177 }
4178
4179
4180 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4181 {
4182         if (freq < 3000)
4183                 return BAND_2_4_GHZ;
4184         if (freq > 50000)
4185                 return BAND_60_GHZ;
4186         return BAND_5_GHZ;
4187 }
4188
4189
4190 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4191 {
4192         int i;
4193         unsigned int band = 0;
4194
4195         if (freqs) {
4196                 /* freqs are specified for the radio work */
4197                 for (i = 0; freqs[i]; i++)
4198                         band |= wpas_freq_to_band(freqs[i]);
4199         } else {
4200                 /*
4201                  * freqs are not specified, implies all
4202                  * the supported freqs by HW
4203                  */
4204                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4205                         if (wpa_s->hw.modes[i].num_channels != 0) {
4206                                 if (wpa_s->hw.modes[i].mode ==
4207                                     HOSTAPD_MODE_IEEE80211B ||
4208                                     wpa_s->hw.modes[i].mode ==
4209                                     HOSTAPD_MODE_IEEE80211G)
4210                                         band |= BAND_2_4_GHZ;
4211                                 else if (wpa_s->hw.modes[i].mode ==
4212                                          HOSTAPD_MODE_IEEE80211A)
4213                                         band |= BAND_5_GHZ;
4214                                 else if (wpa_s->hw.modes[i].mode ==
4215                                          HOSTAPD_MODE_IEEE80211AD)
4216                                         band |= BAND_60_GHZ;
4217                                 else if (wpa_s->hw.modes[i].mode ==
4218                                          HOSTAPD_MODE_IEEE80211ANY)
4219                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4220                                                 BAND_60_GHZ;
4221                         }
4222                 }
4223         }
4224
4225         return band;
4226 }
4227
4228
4229 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4230                                               const char *rn)
4231 {
4232         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4233         struct wpa_radio *radio;
4234
4235         while (rn && iface) {
4236                 radio = iface->radio;
4237                 if (radio && os_strcmp(rn, radio->name) == 0) {
4238                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4239                                    wpa_s->ifname, rn);
4240                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4241                         return radio;
4242                 }
4243
4244                 iface = iface->next;
4245         }
4246
4247         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4248                    wpa_s->ifname, rn ? rn : "N/A");
4249         radio = os_zalloc(sizeof(*radio));
4250         if (radio == NULL)
4251                 return NULL;
4252
4253         if (rn)
4254                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4255         dl_list_init(&radio->ifaces);
4256         dl_list_init(&radio->work);
4257         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4258
4259         return radio;
4260 }
4261
4262
4263 static void radio_work_free(struct wpa_radio_work *work)
4264 {
4265         if (work->wpa_s->scan_work == work) {
4266                 /* This should not really happen. */
4267                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4268                         work->type, work, work->started);
4269                 work->wpa_s->scan_work = NULL;
4270         }
4271
4272 #ifdef CONFIG_P2P
4273         if (work->wpa_s->p2p_scan_work == work) {
4274                 /* This should not really happen. */
4275                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4276                         work->type, work, work->started);
4277                 work->wpa_s->p2p_scan_work = NULL;
4278         }
4279 #endif /* CONFIG_P2P */
4280
4281         if (work->started) {
4282                 work->wpa_s->radio->num_active_works--;
4283                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4284                         "radio_work_free('%s'@%p: num_active_works --> %u",
4285                         work->type, work,
4286                         work->wpa_s->radio->num_active_works);
4287         }
4288
4289         dl_list_del(&work->list);
4290         os_free(work);
4291 }
4292
4293
4294 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4295 {
4296         struct wpa_radio_work *active_work = NULL;
4297         struct wpa_radio_work *tmp;
4298
4299         /* Get the active work to know the type and band. */
4300         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4301                 if (tmp->started) {
4302                         active_work = tmp;
4303                         break;
4304                 }
4305         }
4306
4307         if (!active_work) {
4308                 /* No active work, start one */
4309                 radio->num_active_works = 0;
4310                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4311                                  list) {
4312                         if (os_strcmp(tmp->type, "scan") == 0 &&
4313                             radio->external_scan_running &&
4314                             (((struct wpa_driver_scan_params *)
4315                               tmp->ctx)->only_new_results ||
4316                              tmp->wpa_s->clear_driver_scan_cache))
4317                                 continue;
4318                         return tmp;
4319                 }
4320                 return NULL;
4321         }
4322
4323         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4324             os_strcmp(active_work->type, "connect") == 0) {
4325                 /*
4326                  * If the active work is either connect or sme-connect,
4327                  * do not parallelize them with other radio works.
4328                  */
4329                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4330                         "Do not parallelize radio work with %s",
4331                         active_work->type);
4332                 return NULL;
4333         }
4334
4335         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4336                 if (tmp->started)
4337                         continue;
4338
4339                 /*
4340                  * If connect or sme-connect are enqueued, parallelize only
4341                  * those operations ahead of them in the queue.
4342                  */
4343                 if (os_strcmp(tmp->type, "connect") == 0 ||
4344                     os_strcmp(tmp->type, "sme-connect") == 0)
4345                         break;
4346
4347                 /*
4348                  * Check that the radio works are distinct and
4349                  * on different bands.
4350                  */
4351                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4352                     (active_work->bands != tmp->bands)) {
4353                         /*
4354                          * If a scan has to be scheduled through nl80211 scan
4355                          * interface and if an external scan is already running,
4356                          * do not schedule the scan since it is likely to get
4357                          * rejected by kernel.
4358                          */
4359                         if (os_strcmp(tmp->type, "scan") == 0 &&
4360                             radio->external_scan_running &&
4361                             (((struct wpa_driver_scan_params *)
4362                               tmp->ctx)->only_new_results ||
4363                              tmp->wpa_s->clear_driver_scan_cache))
4364                                 continue;
4365
4366                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4367                                 "active_work:%s new_work:%s",
4368                                 active_work->type, tmp->type);
4369                         return tmp;
4370                 }
4371         }
4372
4373         /* Did not find a radio work to schedule in parallel. */
4374         return NULL;
4375 }
4376
4377
4378 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4379 {
4380         struct wpa_radio *radio = eloop_ctx;
4381         struct wpa_radio_work *work;
4382         struct os_reltime now, diff;
4383         struct wpa_supplicant *wpa_s;
4384
4385         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4386         if (work == NULL) {
4387                 radio->num_active_works = 0;
4388                 return;
4389         }
4390
4391         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4392                               radio_list);
4393
4394         if (!(wpa_s &&
4395               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4396                 if (work->started)
4397                         return; /* already started and still in progress */
4398
4399                 if (wpa_s && wpa_s->radio->external_scan_running) {
4400                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4401                         return;
4402                 }
4403         } else {
4404                 work = NULL;
4405                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4406                         /* get the work to schedule next */
4407                         work = radio_work_get_next_work(radio);
4408                 }
4409                 if (!work)
4410                         return;
4411         }
4412
4413         wpa_s = work->wpa_s;
4414         os_get_reltime(&now);
4415         os_reltime_sub(&now, &work->time, &diff);
4416         wpa_dbg(wpa_s, MSG_DEBUG,
4417                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4418                 work->type, work, diff.sec, diff.usec);
4419         work->started = 1;
4420         work->time = now;
4421         radio->num_active_works++;
4422
4423         work->cb(work, 0);
4424
4425         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4426             radio->num_active_works < MAX_ACTIVE_WORKS)
4427                 radio_work_check_next(wpa_s);
4428 }
4429
4430
4431 /*
4432  * This function removes both started and pending radio works running on
4433  * the provided interface's radio.
4434  * Prior to the removal of the radio work, its callback (cb) is called with
4435  * deinit set to be 1. Each work's callback is responsible for clearing its
4436  * internal data and restoring to a correct state.
4437  * @wpa_s: wpa_supplicant data
4438  * @type: type of works to be removed
4439  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4440  * this interface's works.
4441  */
4442 void radio_remove_works(struct wpa_supplicant *wpa_s,
4443                         const char *type, int remove_all)
4444 {
4445         struct wpa_radio_work *work, *tmp;
4446         struct wpa_radio *radio = wpa_s->radio;
4447
4448         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4449                               list) {
4450                 if (type && os_strcmp(type, work->type) != 0)
4451                         continue;
4452
4453                 /* skip other ifaces' works */
4454                 if (!remove_all && work->wpa_s != wpa_s)
4455                         continue;
4456
4457                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4458                         work->type, work, work->started ? " (started)" : "");
4459                 work->cb(work, 1);
4460                 radio_work_free(work);
4461         }
4462
4463         /* in case we removed the started work */
4464         radio_work_check_next(wpa_s);
4465 }
4466
4467
4468 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4469 {
4470         struct wpa_radio *radio = wpa_s->radio;
4471
4472         if (!radio)
4473                 return;
4474
4475         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4476                    wpa_s->ifname, radio->name);
4477         dl_list_del(&wpa_s->radio_list);
4478         radio_remove_works(wpa_s, NULL, 0);
4479         wpa_s->radio = NULL;
4480         if (!dl_list_empty(&radio->ifaces))
4481                 return; /* Interfaces remain for this radio */
4482
4483         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4484         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4485         os_free(radio);
4486 }
4487
4488
4489 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4490 {
4491         struct wpa_radio *radio = wpa_s->radio;
4492
4493         if (dl_list_empty(&radio->work))
4494                 return;
4495         if (wpa_s->ext_work_in_progress) {
4496                 wpa_printf(MSG_DEBUG,
4497                            "External radio work in progress - delay start of pending item");
4498                 return;
4499         }
4500         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4501         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4502 }
4503
4504
4505 /**
4506  * radio_add_work - Add a radio work item
4507  * @wpa_s: Pointer to wpa_supplicant data
4508  * @freq: Frequency of the offchannel operation in MHz or 0
4509  * @type: Unique identifier for each type of work
4510  * @next: Force as the next work to be executed
4511  * @cb: Callback function for indicating when radio is available
4512  * @ctx: Context pointer for the work (work->ctx in cb())
4513  * Returns: 0 on success, -1 on failure
4514  *
4515  * This function is used to request time for an operation that requires
4516  * exclusive radio control. Once the radio is available, the registered callback
4517  * function will be called. radio_work_done() must be called once the exclusive
4518  * radio operation has been completed, so that the radio is freed for other
4519  * operations. The special case of deinit=1 is used to free the context data
4520  * during interface removal. That does not allow the callback function to start
4521  * the radio operation, i.e., it must free any resources allocated for the radio
4522  * work and return.
4523  *
4524  * The @freq parameter can be used to indicate a single channel on which the
4525  * offchannel operation will occur. This may allow multiple radio work
4526  * operations to be performed in parallel if they apply for the same channel.
4527  * Setting this to 0 indicates that the work item may use multiple channels or
4528  * requires exclusive control of the radio.
4529  */
4530 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4531                    const char *type, int next,
4532                    void (*cb)(struct wpa_radio_work *work, int deinit),
4533                    void *ctx)
4534 {
4535         struct wpa_radio *radio = wpa_s->radio;
4536         struct wpa_radio_work *work;
4537         int was_empty;
4538
4539         work = os_zalloc(sizeof(*work));
4540         if (work == NULL)
4541                 return -1;
4542         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4543         os_get_reltime(&work->time);
4544         work->freq = freq;
4545         work->type = type;
4546         work->wpa_s = wpa_s;
4547         work->cb = cb;
4548         work->ctx = ctx;
4549
4550         if (freq)
4551                 work->bands = wpas_freq_to_band(freq);
4552         else if (os_strcmp(type, "scan") == 0 ||
4553                  os_strcmp(type, "p2p-scan") == 0)
4554                 work->bands = wpas_get_bands(wpa_s,
4555                                              ((struct wpa_driver_scan_params *)
4556                                               ctx)->freqs);
4557         else
4558                 work->bands = wpas_get_bands(wpa_s, NULL);
4559
4560         was_empty = dl_list_empty(&wpa_s->radio->work);
4561         if (next)
4562                 dl_list_add(&wpa_s->radio->work, &work->list);
4563         else
4564                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4565         if (was_empty) {
4566                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4567                 radio_work_check_next(wpa_s);
4568         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4569                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4570                 wpa_dbg(wpa_s, MSG_DEBUG,
4571                         "Try to schedule a radio work (num_active_works=%u)",
4572                         radio->num_active_works);
4573                 radio_work_check_next(wpa_s);
4574         }
4575
4576         return 0;
4577 }
4578
4579
4580 /**
4581  * radio_work_done - Indicate that a radio work item has been completed
4582  * @work: Completed work
4583  *
4584  * This function is called once the callback function registered with
4585  * radio_add_work() has completed its work.
4586  */
4587 void radio_work_done(struct wpa_radio_work *work)
4588 {
4589         struct wpa_supplicant *wpa_s = work->wpa_s;
4590         struct os_reltime now, diff;
4591         unsigned int started = work->started;
4592
4593         os_get_reltime(&now);
4594         os_reltime_sub(&now, &work->time, &diff);
4595         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4596                 work->type, work, started ? "done" : "canceled",
4597                 diff.sec, diff.usec);
4598         radio_work_free(work);
4599         if (started)
4600                 radio_work_check_next(wpa_s);
4601 }
4602
4603
4604 struct wpa_radio_work *
4605 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4606 {
4607         struct wpa_radio_work *work;
4608         struct wpa_radio *radio = wpa_s->radio;
4609
4610         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4611                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4612                         return work;
4613         }
4614
4615         return NULL;
4616 }
4617
4618
4619 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4620                             struct wpa_interface *iface)
4621 {
4622         const char *ifname, *driver, *rn;
4623
4624         driver = iface->driver;
4625 next_driver:
4626         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4627                 return -1;
4628
4629         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4630         if (wpa_s->drv_priv == NULL) {
4631                 const char *pos;
4632                 pos = driver ? os_strchr(driver, ',') : NULL;
4633                 if (pos) {
4634                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4635                                 "driver interface - try next driver wrapper");
4636                         driver = pos + 1;
4637                         goto next_driver;
4638                 }
4639                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4640                         "interface");
4641                 return -1;
4642         }
4643         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4644                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4645                         "driver_param '%s'", wpa_s->conf->driver_param);
4646                 return -1;
4647         }
4648
4649         ifname = wpa_drv_get_ifname(wpa_s);
4650         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4651                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4652                         "interface name with '%s'", ifname);
4653                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4654         }
4655
4656         rn = wpa_driver_get_radio_name(wpa_s);
4657         if (rn && rn[0] == '\0')
4658                 rn = NULL;
4659
4660         wpa_s->radio = radio_add_interface(wpa_s, rn);
4661         if (wpa_s->radio == NULL)
4662                 return -1;
4663
4664         return 0;
4665 }
4666
4667
4668 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4669                                      struct wpa_interface *iface)
4670 {
4671         struct wpa_driver_capa capa;
4672         int capa_res;
4673
4674         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4675                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4676                    iface->confname ? iface->confname : "N/A",
4677                    iface->driver ? iface->driver : "default",
4678                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4679                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4680
4681         if (iface->confname) {
4682 #ifdef CONFIG_BACKEND_FILE
4683                 wpa_s->confname = os_rel2abs_path(iface->confname);
4684                 if (wpa_s->confname == NULL) {
4685                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4686                                    "for configuration file '%s'.",
4687                                    iface->confname);
4688                         return -1;
4689                 }
4690                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4691                            iface->confname, wpa_s->confname);
4692 #else /* CONFIG_BACKEND_FILE */
4693                 wpa_s->confname = os_strdup(iface->confname);
4694 #endif /* CONFIG_BACKEND_FILE */
4695                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4696                 if (wpa_s->conf == NULL) {
4697                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4698                                    "configuration '%s'.", wpa_s->confname);
4699                         return -1;
4700                 }
4701                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4702                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4703
4704                 /*
4705                  * Override ctrl_interface and driver_param if set on command
4706                  * line.
4707                  */
4708                 if (iface->ctrl_interface) {
4709                         os_free(wpa_s->conf->ctrl_interface);
4710                         wpa_s->conf->ctrl_interface =
4711                                 os_strdup(iface->ctrl_interface);
4712                 }
4713
4714                 if (iface->driver_param) {
4715                         os_free(wpa_s->conf->driver_param);
4716                         wpa_s->conf->driver_param =
4717                                 os_strdup(iface->driver_param);
4718                 }
4719
4720                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4721                         os_free(wpa_s->conf->ctrl_interface);
4722                         wpa_s->conf->ctrl_interface = NULL;
4723                 }
4724         } else
4725                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4726                                                      iface->driver_param);
4727
4728         if (wpa_s->conf == NULL) {
4729                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4730                 return -1;
4731         }
4732
4733         if (iface->ifname == NULL) {
4734                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4735                 return -1;
4736         }
4737         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4738                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4739                            iface->ifname);
4740                 return -1;
4741         }
4742         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4743
4744         if (iface->bridge_ifname) {
4745                 if (os_strlen(iface->bridge_ifname) >=
4746                     sizeof(wpa_s->bridge_ifname)) {
4747                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4748                                    "name '%s'.", iface->bridge_ifname);
4749                         return -1;
4750                 }
4751                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4752                            sizeof(wpa_s->bridge_ifname));
4753         }
4754
4755         /* RSNA Supplicant Key Management - INITIALIZE */
4756         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4757         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4758
4759         /* Initialize driver interface and register driver event handler before
4760          * L2 receive handler so that association events are processed before
4761          * EAPOL-Key packets if both become available for the same select()
4762          * call. */
4763         if (wpas_init_driver(wpa_s, iface) < 0)
4764                 return -1;
4765
4766         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4767                 return -1;
4768
4769         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4770                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4771                           NULL);
4772         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4773
4774         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4775             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4776                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4777                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4778                         "dot11RSNAConfigPMKLifetime");
4779                 return -1;
4780         }
4781
4782         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4783             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4784                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4785                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4786                         "dot11RSNAConfigPMKReauthThreshold");
4787                 return -1;
4788         }
4789
4790         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4791             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4792                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4793                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4794                         "dot11RSNAConfigSATimeout");
4795                 return -1;
4796         }
4797
4798         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4799                                                       &wpa_s->hw.num_modes,
4800                                                       &wpa_s->hw.flags);
4801         if (wpa_s->hw.modes) {
4802                 u16 i;
4803
4804                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4805                         if (wpa_s->hw.modes[i].vht_capab) {
4806                                 wpa_s->hw_capab = CAPAB_VHT;
4807                                 break;
4808                         }
4809
4810                         if (wpa_s->hw.modes[i].ht_capab &
4811                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4812                                 wpa_s->hw_capab = CAPAB_HT40;
4813                         else if (wpa_s->hw.modes[i].ht_capab &&
4814                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4815                                 wpa_s->hw_capab = CAPAB_HT;
4816                 }
4817         }
4818
4819         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4820         if (capa_res == 0) {
4821                 wpa_s->drv_capa_known = 1;
4822                 wpa_s->drv_flags = capa.flags;
4823                 wpa_s->drv_enc = capa.enc;
4824                 wpa_s->drv_smps_modes = capa.smps_modes;
4825                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4826                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4827                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4828                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4829                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4830                 wpa_s->max_sched_scan_plan_interval =
4831                         capa.max_sched_scan_plan_interval;
4832                 wpa_s->max_sched_scan_plan_iterations =
4833                         capa.max_sched_scan_plan_iterations;
4834                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4835                 wpa_s->max_match_sets = capa.max_match_sets;
4836                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4837                 wpa_s->max_stations = capa.max_stations;
4838                 wpa_s->extended_capa = capa.extended_capa;
4839                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4840                 wpa_s->extended_capa_len = capa.extended_capa_len;
4841                 wpa_s->num_multichan_concurrent =
4842                         capa.num_multichan_concurrent;
4843                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4844
4845                 if (capa.mac_addr_rand_scan_supported)
4846                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4847                 if (wpa_s->sched_scan_supported &&
4848                     capa.mac_addr_rand_sched_scan_supported)
4849                         wpa_s->mac_addr_rand_supported |=
4850                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4851         }
4852         if (wpa_s->max_remain_on_chan == 0)
4853                 wpa_s->max_remain_on_chan = 1000;
4854
4855         /*
4856          * Only take p2p_mgmt parameters when P2P Device is supported.
4857          * Doing it here as it determines whether l2_packet_init() will be done
4858          * during wpa_supplicant_driver_init().
4859          */
4860         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4861                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4862         else
4863                 iface->p2p_mgmt = 1;
4864
4865         if (wpa_s->num_multichan_concurrent == 0)
4866                 wpa_s->num_multichan_concurrent = 1;
4867
4868         if (wpa_supplicant_driver_init(wpa_s) < 0)
4869                 return -1;
4870
4871 #ifdef CONFIG_TDLS
4872         if ((!iface->p2p_mgmt ||
4873              !(wpa_s->drv_flags &
4874                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4875             wpa_tdls_init(wpa_s->wpa))
4876                 return -1;
4877 #endif /* CONFIG_TDLS */
4878
4879         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4880             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4881                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4882                 return -1;
4883         }
4884
4885 #ifdef CONFIG_FST
4886         if (wpa_s->conf->fst_group_id) {
4887                 struct fst_iface_cfg cfg;
4888                 struct fst_wpa_obj iface_obj;
4889
4890                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4891                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4892                            sizeof(cfg.group_id));
4893                 cfg.priority = wpa_s->conf->fst_priority;
4894                 cfg.llt = wpa_s->conf->fst_llt;
4895
4896                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4897                                         &iface_obj, &cfg);
4898                 if (!wpa_s->fst) {
4899                         wpa_msg(wpa_s, MSG_ERROR,
4900                                 "FST: Cannot attach iface %s to group %s",
4901                                 wpa_s->ifname, cfg.group_id);
4902                         return -1;
4903                 }
4904         }
4905 #endif /* CONFIG_FST */
4906
4907         if (wpas_wps_init(wpa_s))
4908                 return -1;
4909
4910         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4911                 return -1;
4912         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4913
4914         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4915         if (wpa_s->ctrl_iface == NULL) {
4916                 wpa_printf(MSG_ERROR,
4917                            "Failed to initialize control interface '%s'.\n"
4918                            "You may have another wpa_supplicant process "
4919                            "already running or the file was\n"
4920                            "left by an unclean termination of wpa_supplicant "
4921                            "in which case you will need\n"
4922                            "to manually remove this file before starting "
4923                            "wpa_supplicant again.\n",
4924                            wpa_s->conf->ctrl_interface);
4925                 return -1;
4926         }
4927
4928         wpa_s->gas = gas_query_init(wpa_s);
4929         if (wpa_s->gas == NULL) {
4930                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4931                 return -1;
4932         }
4933
4934         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4935                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4936                 return -1;
4937         }
4938
4939         if (wpa_bss_init(wpa_s) < 0)
4940                 return -1;
4941
4942         /*
4943          * Set Wake-on-WLAN triggers, if configured.
4944          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4945          * have effect anyway when the interface is down).
4946          */
4947         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4948                 return -1;
4949
4950 #ifdef CONFIG_EAP_PROXY
4951 {
4952         size_t len;
4953         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4954                                                      &len);
4955         if (wpa_s->mnc_len > 0) {
4956                 wpa_s->imsi[len] = '\0';
4957                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4958                            wpa_s->imsi, wpa_s->mnc_len);
4959         } else {
4960                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4961         }
4962 }
4963 #endif /* CONFIG_EAP_PROXY */
4964
4965         if (pcsc_reader_init(wpa_s) < 0)
4966                 return -1;
4967
4968         if (wpas_init_ext_pw(wpa_s) < 0)
4969                 return -1;
4970
4971         wpas_rrm_reset(wpa_s);
4972
4973         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4974
4975 #ifdef CONFIG_HS20
4976         hs20_init(wpa_s);
4977 #endif /* CONFIG_HS20 */
4978 #ifdef CONFIG_MBO
4979         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4980 #endif /* CONFIG_MBO */
4981
4982         wpa_supplicant_set_default_scan_ies(wpa_s);
4983
4984         return 0;
4985 }
4986
4987
4988 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4989                                         int notify, int terminate)
4990 {
4991         struct wpa_global *global = wpa_s->global;
4992         struct wpa_supplicant *iface, *prev;
4993
4994         if (wpa_s == wpa_s->parent)
4995                 wpas_p2p_group_remove(wpa_s, "*");
4996
4997         iface = global->ifaces;
4998         while (iface) {
4999                 if (iface->p2pdev == wpa_s)
5000                         iface->p2pdev = iface->parent;
5001                 if (iface == wpa_s || iface->parent != wpa_s) {
5002                         iface = iface->next;
5003                         continue;
5004                 }
5005                 wpa_printf(MSG_DEBUG,
5006                            "Remove remaining child interface %s from parent %s",
5007                            iface->ifname, wpa_s->ifname);
5008                 prev = iface;
5009                 iface = iface->next;
5010                 wpa_supplicant_remove_iface(global, prev, terminate);
5011         }
5012
5013         wpa_s->disconnected = 1;
5014         if (wpa_s->drv_priv) {
5015                 wpa_supplicant_deauthenticate(wpa_s,
5016                                               WLAN_REASON_DEAUTH_LEAVING);
5017
5018                 wpa_drv_set_countermeasures(wpa_s, 0);
5019                 wpa_clear_keys(wpa_s, NULL);
5020         }
5021
5022         wpa_supplicant_cleanup(wpa_s);
5023         wpas_p2p_deinit_iface(wpa_s);
5024
5025         wpas_ctrl_radio_work_flush(wpa_s);
5026         radio_remove_interface(wpa_s);
5027
5028 #ifdef CONFIG_FST
5029         if (wpa_s->fst) {
5030                 fst_detach(wpa_s->fst);
5031                 wpa_s->fst = NULL;
5032         }
5033         if (wpa_s->received_mb_ies) {
5034                 wpabuf_free(wpa_s->received_mb_ies);
5035                 wpa_s->received_mb_ies = NULL;
5036         }
5037 #endif /* CONFIG_FST */
5038
5039         if (wpa_s->drv_priv)
5040                 wpa_drv_deinit(wpa_s);
5041
5042         if (notify)
5043                 wpas_notify_iface_removed(wpa_s);
5044
5045         if (terminate)
5046                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
5047
5048         if (wpa_s->ctrl_iface) {
5049                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
5050                 wpa_s->ctrl_iface = NULL;
5051         }
5052
5053 #ifdef CONFIG_MESH
5054         if (wpa_s->ifmsh) {
5055                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
5056                 wpa_s->ifmsh = NULL;
5057         }
5058 #endif /* CONFIG_MESH */
5059
5060         if (wpa_s->conf != NULL) {
5061                 wpa_config_free(wpa_s->conf);
5062                 wpa_s->conf = NULL;
5063         }
5064
5065         os_free(wpa_s->ssids_from_scan_req);
5066
5067         os_free(wpa_s);
5068 }
5069
5070
5071 #ifdef CONFIG_MATCH_IFACE
5072
5073 /**
5074  * wpa_supplicant_match_iface - Match an interface description to a name
5075  * @global: Pointer to global data from wpa_supplicant_init()
5076  * @ifname: Name of the interface to match
5077  * Returns: Pointer to the created interface description or %NULL on failure
5078  */
5079 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
5080                                                   const char *ifname)
5081 {
5082         int i;
5083         struct wpa_interface *iface, *miface;
5084
5085         for (i = 0; i < global->params.match_iface_count; i++) {
5086                 miface = &global->params.match_ifaces[i];
5087                 if (!miface->ifname ||
5088                     fnmatch(miface->ifname, ifname, 0) == 0) {
5089                         iface = os_zalloc(sizeof(*iface));
5090                         if (!iface)
5091                                 return NULL;
5092                         *iface = *miface;
5093                         iface->ifname = ifname;
5094                         return iface;
5095                 }
5096         }
5097
5098         return NULL;
5099 }
5100
5101
5102 /**
5103  * wpa_supplicant_match_existing - Match existing interfaces
5104  * @global: Pointer to global data from wpa_supplicant_init()
5105  * Returns: 0 on success, -1 on failure
5106  */
5107 static int wpa_supplicant_match_existing(struct wpa_global *global)
5108 {
5109         struct if_nameindex *ifi, *ifp;
5110         struct wpa_supplicant *wpa_s;
5111         struct wpa_interface *iface;
5112
5113         ifp = if_nameindex();
5114         if (!ifp) {
5115                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
5116                 return -1;
5117         }
5118
5119         for (ifi = ifp; ifi->if_name; ifi++) {
5120                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
5121                 if (wpa_s)
5122                         continue;
5123                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
5124                 if (iface) {
5125                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
5126                         os_free(iface);
5127                         if (wpa_s)
5128                                 wpa_s->matched = 1;
5129                 }
5130         }
5131
5132         if_freenameindex(ifp);
5133         return 0;
5134 }
5135
5136 #endif /* CONFIG_MATCH_IFACE */
5137
5138
5139 /**
5140  * wpa_supplicant_add_iface - Add a new network interface
5141  * @global: Pointer to global data from wpa_supplicant_init()
5142  * @iface: Interface configuration options
5143  * @parent: Parent interface or %NULL to assign new interface as parent
5144  * Returns: Pointer to the created interface or %NULL on failure
5145  *
5146  * This function is used to add new network interfaces for %wpa_supplicant.
5147  * This can be called before wpa_supplicant_run() to add interfaces before the
5148  * main event loop has been started. In addition, new interfaces can be added
5149  * dynamically while %wpa_supplicant is already running. This could happen,
5150  * e.g., when a hotplug network adapter is inserted.
5151  */
5152 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5153                                                  struct wpa_interface *iface,
5154                                                  struct wpa_supplicant *parent)
5155 {
5156         struct wpa_supplicant *wpa_s;
5157         struct wpa_interface t_iface;
5158         struct wpa_ssid *ssid;
5159
5160         if (global == NULL || iface == NULL)
5161                 return NULL;
5162
5163         wpa_s = wpa_supplicant_alloc(parent);
5164         if (wpa_s == NULL)
5165                 return NULL;
5166
5167         wpa_s->global = global;
5168
5169         t_iface = *iface;
5170         if (global->params.override_driver) {
5171                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5172                            "('%s' -> '%s')",
5173                            iface->driver, global->params.override_driver);
5174                 t_iface.driver = global->params.override_driver;
5175         }
5176         if (global->params.override_ctrl_interface) {
5177                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5178                            "ctrl_interface ('%s' -> '%s')",
5179                            iface->ctrl_interface,
5180                            global->params.override_ctrl_interface);
5181                 t_iface.ctrl_interface =
5182                         global->params.override_ctrl_interface;
5183         }
5184         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5185                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5186                            iface->ifname);
5187                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5188                 return NULL;
5189         }
5190
5191         if (iface->p2p_mgmt == 0) {
5192                 /* Notify the control interfaces about new iface */
5193                 if (wpas_notify_iface_added(wpa_s)) {
5194                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5195                         return NULL;
5196                 }
5197
5198                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5199                         wpas_notify_network_added(wpa_s, ssid);
5200         }
5201
5202         wpa_s->next = global->ifaces;
5203         global->ifaces = wpa_s;
5204
5205         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5206         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5207
5208 #ifdef CONFIG_P2P
5209         if (wpa_s->global->p2p == NULL &&
5210             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5211             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5212             wpas_p2p_add_p2pdev_interface(
5213                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5214                 wpa_printf(MSG_INFO,
5215                            "P2P: Failed to enable P2P Device interface");
5216                 /* Try to continue without. P2P will be disabled. */
5217         }
5218 #endif /* CONFIG_P2P */
5219
5220         return wpa_s;
5221 }
5222
5223
5224 /**
5225  * wpa_supplicant_remove_iface - Remove a network interface
5226  * @global: Pointer to global data from wpa_supplicant_init()
5227  * @wpa_s: Pointer to the network interface to be removed
5228  * Returns: 0 if interface was removed, -1 if interface was not found
5229  *
5230  * This function can be used to dynamically remove network interfaces from
5231  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5232  * addition, this function is used to remove all remaining interfaces when
5233  * %wpa_supplicant is terminated.
5234  */
5235 int wpa_supplicant_remove_iface(struct wpa_global *global,
5236                                 struct wpa_supplicant *wpa_s,
5237                                 int terminate)
5238 {
5239         struct wpa_supplicant *prev;
5240 #ifdef CONFIG_MESH
5241         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5242         char *ifname = NULL;
5243 #endif /* CONFIG_MESH */
5244
5245         /* Remove interface from the global list of interfaces */
5246         prev = global->ifaces;
5247         if (prev == wpa_s) {
5248                 global->ifaces = wpa_s->next;
5249         } else {
5250                 while (prev && prev->next != wpa_s)
5251                         prev = prev->next;
5252                 if (prev == NULL)
5253                         return -1;
5254                 prev->next = wpa_s->next;
5255         }
5256
5257         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5258
5259 #ifdef CONFIG_MESH
5260         if (mesh_if_created) {
5261                 ifname = os_strdup(wpa_s->ifname);
5262                 if (ifname == NULL) {
5263                         wpa_dbg(wpa_s, MSG_ERROR,
5264                                 "mesh: Failed to malloc ifname");
5265                         return -1;
5266                 }
5267         }
5268 #endif /* CONFIG_MESH */
5269
5270         if (global->p2p_group_formation == wpa_s)
5271                 global->p2p_group_formation = NULL;
5272         if (global->p2p_invite_group == wpa_s)
5273                 global->p2p_invite_group = NULL;
5274         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5275
5276 #ifdef CONFIG_MESH
5277         if (mesh_if_created) {
5278                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5279                 os_free(ifname);
5280         }
5281 #endif /* CONFIG_MESH */
5282
5283         return 0;
5284 }
5285
5286
5287 /**
5288  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5289  * @wpa_s: Pointer to the network interface
5290  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5291  */
5292 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5293 {
5294         const char *eapol_method;
5295
5296         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5297             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5298                 return "NO-EAP";
5299         }
5300
5301         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5302         if (eapol_method == NULL)
5303                 return "UNKNOWN-EAP";
5304
5305         return eapol_method;
5306 }
5307
5308
5309 /**
5310  * wpa_supplicant_get_iface - Get a new network interface
5311  * @global: Pointer to global data from wpa_supplicant_init()
5312  * @ifname: Interface name
5313  * Returns: Pointer to the interface or %NULL if not found
5314  */
5315 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5316                                                  const char *ifname)
5317 {
5318         struct wpa_supplicant *wpa_s;
5319
5320         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5321                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5322                         return wpa_s;
5323         }
5324         return NULL;
5325 }
5326
5327
5328 #ifndef CONFIG_NO_WPA_MSG
5329 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5330 {
5331         struct wpa_supplicant *wpa_s = ctx;
5332         if (wpa_s == NULL)
5333                 return NULL;
5334         return wpa_s->ifname;
5335 }
5336 #endif /* CONFIG_NO_WPA_MSG */
5337
5338
5339 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5340 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5341 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5342
5343 /* Periodic cleanup tasks */
5344 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5345 {
5346         struct wpa_global *global = eloop_ctx;
5347         struct wpa_supplicant *wpa_s;
5348
5349         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5350                                wpas_periodic, global, NULL);
5351
5352 #ifdef CONFIG_P2P
5353         if (global->p2p)
5354                 p2p_expire_peers(global->p2p);
5355 #endif /* CONFIG_P2P */
5356
5357         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5358                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5359 #ifdef CONFIG_AP
5360                 ap_periodic(wpa_s);
5361 #endif /* CONFIG_AP */
5362         }
5363 }
5364
5365
5366 /**
5367  * wpa_supplicant_init - Initialize %wpa_supplicant
5368  * @params: Parameters for %wpa_supplicant
5369  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5370  *
5371  * This function is used to initialize %wpa_supplicant. After successful
5372  * initialization, the returned data pointer can be used to add and remove
5373  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5374  */
5375 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5376 {
5377         struct wpa_global *global;
5378         int ret, i;
5379
5380         if (params == NULL)
5381                 return NULL;
5382
5383 #ifdef CONFIG_DRIVER_NDIS
5384         {
5385                 void driver_ndis_init_ops(void);
5386                 driver_ndis_init_ops();
5387         }
5388 #endif /* CONFIG_DRIVER_NDIS */
5389
5390 #ifndef CONFIG_NO_WPA_MSG
5391         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5392 #endif /* CONFIG_NO_WPA_MSG */
5393
5394         if (params->wpa_debug_file_path)
5395                 wpa_debug_open_file(params->wpa_debug_file_path);
5396         else
5397                 wpa_debug_setup_stdout();
5398         if (params->wpa_debug_syslog)
5399                 wpa_debug_open_syslog();
5400         if (params->wpa_debug_tracing) {
5401                 ret = wpa_debug_open_linux_tracing();
5402                 if (ret) {
5403                         wpa_printf(MSG_ERROR,
5404                                    "Failed to enable trace logging");
5405                         return NULL;
5406                 }
5407         }
5408
5409         ret = eap_register_methods();
5410         if (ret) {
5411                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5412                 if (ret == -2)
5413                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5414                                    "the same EAP type.");
5415                 return NULL;
5416         }
5417
5418         global = os_zalloc(sizeof(*global));
5419         if (global == NULL)
5420                 return NULL;
5421         dl_list_init(&global->p2p_srv_bonjour);
5422         dl_list_init(&global->p2p_srv_upnp);
5423         global->params.daemonize = params->daemonize;
5424         global->params.wait_for_monitor = params->wait_for_monitor;
5425         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5426         if (params->pid_file)
5427                 global->params.pid_file = os_strdup(params->pid_file);
5428         if (params->ctrl_interface)
5429                 global->params.ctrl_interface =
5430                         os_strdup(params->ctrl_interface);
5431         if (params->ctrl_interface_group)
5432                 global->params.ctrl_interface_group =
5433                         os_strdup(params->ctrl_interface_group);
5434         if (params->override_driver)
5435                 global->params.override_driver =
5436                         os_strdup(params->override_driver);
5437         if (params->override_ctrl_interface)
5438                 global->params.override_ctrl_interface =
5439                         os_strdup(params->override_ctrl_interface);
5440 #ifdef CONFIG_MATCH_IFACE
5441         global->params.match_iface_count = params->match_iface_count;
5442         if (params->match_iface_count) {
5443                 global->params.match_ifaces =
5444                         os_calloc(params->match_iface_count,
5445                                   sizeof(struct wpa_interface));
5446                 os_memcpy(global->params.match_ifaces,
5447                           params->match_ifaces,
5448                           params->match_iface_count *
5449                           sizeof(struct wpa_interface));
5450         }
5451 #endif /* CONFIG_MATCH_IFACE */
5452 #ifdef CONFIG_P2P
5453         if (params->conf_p2p_dev)
5454                 global->params.conf_p2p_dev =
5455                         os_strdup(params->conf_p2p_dev);
5456 #endif /* CONFIG_P2P */
5457         wpa_debug_level = global->params.wpa_debug_level =
5458                 params->wpa_debug_level;
5459         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5460                 params->wpa_debug_show_keys;
5461         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5462                 params->wpa_debug_timestamp;
5463
5464         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5465
5466         if (eloop_init()) {
5467                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5468                 wpa_supplicant_deinit(global);
5469                 return NULL;
5470         }
5471
5472         random_init(params->entropy_file);
5473
5474         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5475         if (global->ctrl_iface == NULL) {
5476                 wpa_supplicant_deinit(global);
5477                 return NULL;
5478         }
5479
5480         if (wpas_notify_supplicant_initialized(global)) {
5481                 wpa_supplicant_deinit(global);
5482                 return NULL;
5483         }
5484
5485         for (i = 0; wpa_drivers[i]; i++)
5486                 global->drv_count++;
5487         if (global->drv_count == 0) {
5488                 wpa_printf(MSG_ERROR, "No drivers enabled");
5489                 wpa_supplicant_deinit(global);
5490                 return NULL;
5491         }
5492         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5493         if (global->drv_priv == NULL) {
5494                 wpa_supplicant_deinit(global);
5495                 return NULL;
5496         }
5497
5498 #ifdef CONFIG_WIFI_DISPLAY
5499         if (wifi_display_init(global) < 0) {
5500                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5501                 wpa_supplicant_deinit(global);
5502                 return NULL;
5503         }
5504 #endif /* CONFIG_WIFI_DISPLAY */
5505
5506         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5507                                wpas_periodic, global, NULL);
5508
5509         return global;
5510 }
5511
5512
5513 /**
5514  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5515  * @global: Pointer to global data from wpa_supplicant_init()
5516  * Returns: 0 after successful event loop run, -1 on failure
5517  *
5518  * This function starts the main event loop and continues running as long as
5519  * there are any remaining events. In most cases, this function is running as
5520  * long as the %wpa_supplicant process in still in use.
5521  */
5522 int wpa_supplicant_run(struct wpa_global *global)
5523 {
5524         struct wpa_supplicant *wpa_s;
5525
5526         if (global->params.daemonize &&
5527             (wpa_supplicant_daemon(global->params.pid_file) ||
5528              eloop_sock_requeue()))
5529                 return -1;
5530
5531 #ifdef CONFIG_MATCH_IFACE
5532         if (wpa_supplicant_match_existing(global))
5533                 return -1;
5534 #endif
5535
5536         if (global->params.wait_for_monitor) {
5537                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5538                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5539                                 wpa_supplicant_ctrl_iface_wait(
5540                                         wpa_s->ctrl_iface);
5541         }
5542
5543         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5544         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5545
5546         eloop_run();
5547
5548         return 0;
5549 }
5550
5551
5552 /**
5553  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5554  * @global: Pointer to global data from wpa_supplicant_init()
5555  *
5556  * This function is called to deinitialize %wpa_supplicant and to free all
5557  * allocated resources. Remaining network interfaces will also be removed.
5558  */
5559 void wpa_supplicant_deinit(struct wpa_global *global)
5560 {
5561         int i;
5562
5563         if (global == NULL)
5564                 return;
5565
5566         eloop_cancel_timeout(wpas_periodic, global, NULL);
5567
5568 #ifdef CONFIG_WIFI_DISPLAY
5569         wifi_display_deinit(global);
5570 #endif /* CONFIG_WIFI_DISPLAY */
5571
5572         while (global->ifaces)
5573                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5574
5575         if (global->ctrl_iface)
5576                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5577
5578         wpas_notify_supplicant_deinitialized(global);
5579
5580         eap_peer_unregister_methods();
5581 #ifdef CONFIG_AP
5582         eap_server_unregister_methods();
5583 #endif /* CONFIG_AP */
5584
5585         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5586                 if (!global->drv_priv[i])
5587                         continue;
5588                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5589         }
5590         os_free(global->drv_priv);
5591
5592         random_deinit();
5593
5594         eloop_destroy();
5595
5596         if (global->params.pid_file) {
5597                 os_daemonize_terminate(global->params.pid_file);
5598                 os_free(global->params.pid_file);
5599         }
5600         os_free(global->params.ctrl_interface);
5601         os_free(global->params.ctrl_interface_group);
5602         os_free(global->params.override_driver);
5603         os_free(global->params.override_ctrl_interface);
5604 #ifdef CONFIG_MATCH_IFACE
5605         os_free(global->params.match_ifaces);
5606 #endif /* CONFIG_MATCH_IFACE */
5607 #ifdef CONFIG_P2P
5608         os_free(global->params.conf_p2p_dev);
5609 #endif /* CONFIG_P2P */
5610
5611         os_free(global->p2p_disallow_freq.range);
5612         os_free(global->p2p_go_avoid_freq.range);
5613         os_free(global->add_psk);
5614
5615         os_free(global);
5616         wpa_debug_close_syslog();
5617         wpa_debug_close_file();
5618         wpa_debug_close_linux_tracing();
5619 }
5620
5621
5622 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5623 {
5624         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5625             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5626                 char country[3];
5627                 country[0] = wpa_s->conf->country[0];
5628                 country[1] = wpa_s->conf->country[1];
5629                 country[2] = '\0';
5630                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5631                         wpa_printf(MSG_ERROR, "Failed to set country code "
5632                                    "'%s'", country);
5633                 }
5634         }
5635
5636         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5637                 wpas_init_ext_pw(wpa_s);
5638
5639         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5640                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5641
5642 #ifdef CONFIG_WPS
5643         wpas_wps_update_config(wpa_s);
5644 #endif /* CONFIG_WPS */
5645         wpas_p2p_update_config(wpa_s);
5646         wpa_s->conf->changed_parameters = 0;
5647 }
5648
5649
5650 void add_freq(int *freqs, int *num_freqs, int freq)
5651 {
5652         int i;
5653
5654         for (i = 0; i < *num_freqs; i++) {
5655                 if (freqs[i] == freq)
5656                         return;
5657         }
5658
5659         freqs[*num_freqs] = freq;
5660         (*num_freqs)++;
5661 }
5662
5663
5664 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5665 {
5666         struct wpa_bss *bss, *cbss;
5667         const int max_freqs = 10;
5668         int *freqs;
5669         int num_freqs = 0;
5670
5671         freqs = os_calloc(max_freqs + 1, sizeof(int));
5672         if (freqs == NULL)
5673                 return NULL;
5674
5675         cbss = wpa_s->current_bss;
5676
5677         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5678                 if (bss == cbss)
5679                         continue;
5680                 if (bss->ssid_len == cbss->ssid_len &&
5681                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5682                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5683                         add_freq(freqs, &num_freqs, bss->freq);
5684                         if (num_freqs == max_freqs)
5685                                 break;
5686                 }
5687         }
5688
5689         if (num_freqs == 0) {
5690                 os_free(freqs);
5691                 freqs = NULL;
5692         }
5693
5694         return freqs;
5695 }
5696
5697
5698 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5699 {
5700         int timeout;
5701         int count;
5702         int *freqs = NULL;
5703
5704         wpas_connect_work_done(wpa_s);
5705
5706         /*
5707          * Remove possible authentication timeout since the connection failed.
5708          */
5709         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5710
5711         /*
5712          * There is no point in blacklisting the AP if this event is
5713          * generated based on local request to disconnect.
5714          */
5715         if (wpa_s->own_disconnect_req) {
5716                 wpa_s->own_disconnect_req = 0;
5717                 wpa_dbg(wpa_s, MSG_DEBUG,
5718                         "Ignore connection failure due to local request to disconnect");
5719                 return;
5720         }
5721         if (wpa_s->disconnected) {
5722                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5723                         "indication since interface has been put into "
5724                         "disconnected state");
5725                 return;
5726         }
5727
5728         /*
5729          * Add the failed BSSID into the blacklist and speed up next scan
5730          * attempt if there could be other APs that could accept association.
5731          * The current blacklist count indicates how many times we have tried
5732          * connecting to this AP and multiple attempts mean that other APs are
5733          * either not available or has already been tried, so that we can start
5734          * increasing the delay here to avoid constant scanning.
5735          */
5736         count = wpa_blacklist_add(wpa_s, bssid);
5737         if (count == 1 && wpa_s->current_bss) {
5738                 /*
5739                  * This BSS was not in the blacklist before. If there is
5740                  * another BSS available for the same ESS, we should try that
5741                  * next. Otherwise, we may as well try this one once more
5742                  * before allowing other, likely worse, ESSes to be considered.
5743                  */
5744                 freqs = get_bss_freqs_in_ess(wpa_s);
5745                 if (freqs) {
5746                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5747                                 "has been seen; try it next");
5748                         wpa_blacklist_add(wpa_s, bssid);
5749                         /*
5750                          * On the next scan, go through only the known channels
5751                          * used in this ESS based on previous scans to speed up
5752                          * common load balancing use case.
5753                          */
5754                         os_free(wpa_s->next_scan_freqs);
5755                         wpa_s->next_scan_freqs = freqs;
5756                 }
5757         }
5758
5759         /*
5760          * Add previous failure count in case the temporary blacklist was
5761          * cleared due to no other BSSes being available.
5762          */
5763         count += wpa_s->extra_blacklist_count;
5764
5765         if (count > 3 && wpa_s->current_ssid) {
5766                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5767                            "consider temporary network disabling");
5768                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5769         }
5770
5771         switch (count) {
5772         case 1:
5773                 timeout = 100;
5774                 break;
5775         case 2:
5776                 timeout = 500;
5777                 break;
5778         case 3:
5779                 timeout = 1000;
5780                 break;
5781         case 4:
5782                 timeout = 5000;
5783                 break;
5784         default:
5785                 timeout = 10000;
5786                 break;
5787         }
5788
5789         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5790                 "ms", count, timeout);
5791
5792         /*
5793          * TODO: if more than one possible AP is available in scan results,
5794          * could try the other ones before requesting a new scan.
5795          */
5796         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5797                                 1000 * (timeout % 1000));
5798 }
5799
5800
5801 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5802 {
5803         return wpa_s->conf->ap_scan == 2 ||
5804                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5805 }
5806
5807
5808 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5809 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5810                                               struct wpa_ssid *ssid,
5811                                               const char *field,
5812                                               const char *value)
5813 {
5814 #ifdef IEEE8021X_EAPOL
5815         struct eap_peer_config *eap = &ssid->eap;
5816
5817         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5818         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5819                               (const u8 *) value, os_strlen(value));
5820
5821         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5822         case WPA_CTRL_REQ_EAP_IDENTITY:
5823                 os_free(eap->identity);
5824                 eap->identity = (u8 *) os_strdup(value);
5825                 eap->identity_len = os_strlen(value);
5826                 eap->pending_req_identity = 0;
5827                 if (ssid == wpa_s->current_ssid)
5828                         wpa_s->reassociate = 1;
5829                 break;
5830         case WPA_CTRL_REQ_EAP_PASSWORD:
5831                 bin_clear_free(eap->password, eap->password_len);
5832                 eap->password = (u8 *) os_strdup(value);
5833                 eap->password_len = os_strlen(value);
5834                 eap->pending_req_password = 0;
5835                 if (ssid == wpa_s->current_ssid)
5836                         wpa_s->reassociate = 1;
5837                 break;
5838         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5839                 bin_clear_free(eap->new_password, eap->new_password_len);
5840                 eap->new_password = (u8 *) os_strdup(value);
5841                 eap->new_password_len = os_strlen(value);
5842                 eap->pending_req_new_password = 0;
5843                 if (ssid == wpa_s->current_ssid)
5844                         wpa_s->reassociate = 1;
5845                 break;
5846         case WPA_CTRL_REQ_EAP_PIN:
5847                 str_clear_free(eap->pin);
5848                 eap->pin = os_strdup(value);
5849                 eap->pending_req_pin = 0;
5850                 if (ssid == wpa_s->current_ssid)
5851                         wpa_s->reassociate = 1;
5852                 break;
5853         case WPA_CTRL_REQ_EAP_OTP:
5854                 bin_clear_free(eap->otp, eap->otp_len);
5855                 eap->otp = (u8 *) os_strdup(value);
5856                 eap->otp_len = os_strlen(value);
5857                 os_free(eap->pending_req_otp);
5858                 eap->pending_req_otp = NULL;
5859                 eap->pending_req_otp_len = 0;
5860                 break;
5861         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5862                 str_clear_free(eap->private_key_passwd);
5863                 eap->private_key_passwd = os_strdup(value);
5864                 eap->pending_req_passphrase = 0;
5865                 if (ssid == wpa_s->current_ssid)
5866                         wpa_s->reassociate = 1;
5867                 break;
5868         case WPA_CTRL_REQ_SIM:
5869                 str_clear_free(eap->external_sim_resp);
5870                 eap->external_sim_resp = os_strdup(value);
5871                 break;
5872         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5873                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5874                         return -1;
5875                 ssid->mem_only_psk = 1;
5876                 if (ssid->passphrase)
5877                         wpa_config_update_psk(ssid);
5878                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5879                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5880                 break;
5881         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5882                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5883                         return -1;
5884                 if (os_strcmp(value, "good") == 0)
5885                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5886                 else if (os_strcmp(value, "bad") == 0)
5887                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5888                 else
5889                         return -1;
5890                 break;
5891         default:
5892                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5893                 return -1;
5894         }
5895
5896         return 0;
5897 #else /* IEEE8021X_EAPOL */
5898         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5899         return -1;
5900 #endif /* IEEE8021X_EAPOL */
5901 }
5902 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5903
5904
5905 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5906 {
5907         int i;
5908         unsigned int drv_enc;
5909
5910         if (wpa_s->p2p_mgmt)
5911                 return 1; /* no normal network profiles on p2p_mgmt interface */
5912
5913         if (ssid == NULL)
5914                 return 1;
5915
5916         if (ssid->disabled)
5917                 return 1;
5918
5919         if (wpa_s->drv_capa_known)
5920                 drv_enc = wpa_s->drv_enc;
5921         else
5922                 drv_enc = (unsigned int) -1;
5923
5924         for (i = 0; i < NUM_WEP_KEYS; i++) {
5925                 size_t len = ssid->wep_key_len[i];
5926                 if (len == 0)
5927                         continue;
5928                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5929                         continue;
5930                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5931                         continue;
5932                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5933                         continue;
5934                 return 1; /* invalid WEP key */
5935         }
5936
5937         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5938             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5939             !ssid->mem_only_psk)
5940                 return 1;
5941
5942         return 0;
5943 }
5944
5945
5946 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5947 {
5948 #ifdef CONFIG_IEEE80211W
5949         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5950                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5951                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5952                         /*
5953                          * Driver does not support BIP -- ignore pmf=1 default
5954                          * since the connection with PMF would fail and the
5955                          * configuration does not require PMF to be enabled.
5956                          */
5957                         return NO_MGMT_FRAME_PROTECTION;
5958                 }
5959
5960                 if (ssid &&
5961                     (ssid->key_mgmt &
5962                      ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
5963                        WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
5964                         /*
5965                          * Do not use the default PMF value for non-RSN networks
5966                          * since PMF is available only with RSN and pmf=2
5967                          * configuration would otherwise prevent connections to
5968                          * all open networks.
5969                          */
5970                         return NO_MGMT_FRAME_PROTECTION;
5971                 }
5972
5973                 return wpa_s->conf->pmf;
5974         }
5975
5976         return ssid->ieee80211w;
5977 #else /* CONFIG_IEEE80211W */
5978         return NO_MGMT_FRAME_PROTECTION;
5979 #endif /* CONFIG_IEEE80211W */
5980 }
5981
5982
5983 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5984 {
5985         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5986                 return 1;
5987         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5988                 return 0;
5989         return -1;
5990 }
5991
5992
5993 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5994 {
5995         struct wpa_ssid *ssid = wpa_s->current_ssid;
5996         int dur;
5997         struct os_reltime now;
5998
5999         if (ssid == NULL) {
6000                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
6001                            "SSID block");
6002                 return;
6003         }
6004
6005         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
6006                 return;
6007
6008         ssid->auth_failures++;
6009
6010 #ifdef CONFIG_P2P
6011         if (ssid->p2p_group &&
6012             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
6013                 /*
6014                  * Skip the wait time since there is a short timeout on the
6015                  * connection to a P2P group.
6016                  */
6017                 return;
6018         }
6019 #endif /* CONFIG_P2P */
6020
6021         if (ssid->auth_failures > 50)
6022                 dur = 300;
6023         else if (ssid->auth_failures > 10)
6024                 dur = 120;
6025         else if (ssid->auth_failures > 5)
6026                 dur = 90;
6027         else if (ssid->auth_failures > 3)
6028                 dur = 60;
6029         else if (ssid->auth_failures > 2)
6030                 dur = 30;
6031         else if (ssid->auth_failures > 1)
6032                 dur = 20;
6033         else
6034                 dur = 10;
6035
6036         if (ssid->auth_failures > 1 &&
6037             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
6038                 dur += os_random() % (ssid->auth_failures * 10);
6039
6040         os_get_reltime(&now);
6041         if (now.sec + dur <= ssid->disabled_until.sec)
6042                 return;
6043
6044         ssid->disabled_until.sec = now.sec + dur;
6045
6046         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
6047                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
6048                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
6049                 ssid->auth_failures, dur, reason);
6050 }
6051
6052
6053 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
6054                               struct wpa_ssid *ssid, int clear_failures)
6055 {
6056         if (ssid == NULL)
6057                 return;
6058
6059         if (ssid->disabled_until.sec) {
6060                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
6061                         "id=%d ssid=\"%s\"",
6062                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
6063         }
6064         ssid->disabled_until.sec = 0;
6065         ssid->disabled_until.usec = 0;
6066         if (clear_failures)
6067                 ssid->auth_failures = 0;
6068 }
6069
6070
6071 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
6072 {
6073         size_t i;
6074
6075         if (wpa_s->disallow_aps_bssid == NULL)
6076                 return 0;
6077
6078         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
6079                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
6080                               bssid, ETH_ALEN) == 0)
6081                         return 1;
6082         }
6083
6084         return 0;
6085 }
6086
6087
6088 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
6089                     size_t ssid_len)
6090 {
6091         size_t i;
6092
6093         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
6094                 return 0;
6095
6096         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
6097                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
6098                 if (ssid_len == s->ssid_len &&
6099                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
6100                         return 1;
6101         }
6102
6103         return 0;
6104 }
6105
6106
6107 /**
6108  * wpas_request_connection - Request a new connection
6109  * @wpa_s: Pointer to the network interface
6110  *
6111  * This function is used to request a new connection to be found. It will mark
6112  * the interface to allow reassociation and request a new scan to find a
6113  * suitable network to connect to.
6114  */
6115 void wpas_request_connection(struct wpa_supplicant *wpa_s)
6116 {
6117         wpa_s->normal_scans = 0;
6118         wpa_s->scan_req = NORMAL_SCAN_REQ;
6119         wpa_supplicant_reinit_autoscan(wpa_s);
6120         wpa_s->extra_blacklist_count = 0;
6121         wpa_s->disconnected = 0;
6122         wpa_s->reassociate = 1;
6123
6124         if (wpa_supplicant_fast_associate(wpa_s) != 1)
6125                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6126         else
6127                 wpa_s->reattach = 0;
6128 }
6129
6130
6131 /**
6132  * wpas_request_disconnection - Request disconnection
6133  * @wpa_s: Pointer to the network interface
6134  *
6135  * This function is used to request disconnection from the currently connected
6136  * network. This will stop any ongoing scans and initiate deauthentication.
6137  */
6138 void wpas_request_disconnection(struct wpa_supplicant *wpa_s)
6139 {
6140 #ifdef CONFIG_SME
6141         wpa_s->sme.prev_bssid_set = 0;
6142 #endif /* CONFIG_SME */
6143         wpa_s->reassociate = 0;
6144         wpa_s->disconnected = 1;
6145         wpa_supplicant_cancel_sched_scan(wpa_s);
6146         wpa_supplicant_cancel_scan(wpa_s);
6147         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
6148         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
6149 }
6150
6151
6152 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
6153                     struct wpa_used_freq_data *freqs_data,
6154                     unsigned int len)
6155 {
6156         unsigned int i;
6157
6158         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
6159                 len, title);
6160         for (i = 0; i < len; i++) {
6161                 struct wpa_used_freq_data *cur = &freqs_data[i];
6162                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
6163                         i, cur->freq, cur->flags);
6164         }
6165 }
6166
6167
6168 /*
6169  * Find the operating frequencies of any of the virtual interfaces that
6170  * are using the same radio as the current interface, and in addition, get
6171  * information about the interface types that are using the frequency.
6172  */
6173 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
6174                                 struct wpa_used_freq_data *freqs_data,
6175                                 unsigned int len)
6176 {
6177         struct wpa_supplicant *ifs;
6178         u8 bssid[ETH_ALEN];
6179         int freq;
6180         unsigned int idx = 0, i;
6181
6182         wpa_dbg(wpa_s, MSG_DEBUG,
6183                 "Determining shared radio frequencies (max len %u)", len);
6184         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
6185
6186         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6187                          radio_list) {
6188                 if (idx == len)
6189                         break;
6190
6191                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6192                         continue;
6193
6194                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6195                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6196                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6197                         freq = ifs->current_ssid->frequency;
6198                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6199                         freq = ifs->assoc_freq;
6200                 else
6201                         continue;
6202
6203                 /* Hold only distinct freqs */
6204                 for (i = 0; i < idx; i++)
6205                         if (freqs_data[i].freq == freq)
6206                                 break;
6207
6208                 if (i == idx)
6209                         freqs_data[idx++].freq = freq;
6210
6211                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6212                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6213                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6214                                 WPA_FREQ_USED_BY_INFRA_STATION;
6215                 }
6216         }
6217
6218         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6219         return idx;
6220 }
6221
6222
6223 /*
6224  * Find the operating frequencies of any of the virtual interfaces that
6225  * are using the same radio as the current interface.
6226  */
6227 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6228                            int *freq_array, unsigned int len)
6229 {
6230         struct wpa_used_freq_data *freqs_data;
6231         int num, i;
6232
6233         os_memset(freq_array, 0, sizeof(int) * len);
6234
6235         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6236         if (!freqs_data)
6237                 return -1;
6238
6239         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6240         for (i = 0; i < num; i++)
6241                 freq_array[i] = freqs_data[i].freq;
6242
6243         os_free(freqs_data);
6244
6245         return num;
6246 }
6247
6248
6249 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6250 {
6251         struct rrm_data *rrm = data;
6252
6253         if (!rrm->notify_neighbor_rep) {
6254                 wpa_printf(MSG_ERROR,
6255                            "RRM: Unexpected neighbor report timeout");
6256                 return;
6257         }
6258
6259         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6260         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6261
6262         rrm->notify_neighbor_rep = NULL;
6263         rrm->neighbor_rep_cb_ctx = NULL;
6264 }
6265
6266
6267 /*
6268  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6269  * @wpa_s: Pointer to wpa_supplicant
6270  */
6271 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6272 {
6273         wpa_s->rrm.rrm_used = 0;
6274
6275         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6276                              NULL);
6277         if (wpa_s->rrm.notify_neighbor_rep)
6278                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6279         wpa_s->rrm.next_neighbor_rep_token = 1;
6280 }
6281
6282
6283 /*
6284  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6285  * @wpa_s: Pointer to wpa_supplicant
6286  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6287  * @report_len: Length of neighbor report buffer
6288  */
6289 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6290                                    const u8 *report, size_t report_len)
6291 {
6292         struct wpabuf *neighbor_rep;
6293
6294         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6295         if (report_len < 1)
6296                 return;
6297
6298         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6299                 wpa_printf(MSG_DEBUG,
6300                            "RRM: Discarding neighbor report with token %d (expected %d)",
6301                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6302                 return;
6303         }
6304
6305         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6306                              NULL);
6307
6308         if (!wpa_s->rrm.notify_neighbor_rep) {
6309                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6310                 return;
6311         }
6312
6313         /* skipping the first byte, which is only an id (dialog token) */
6314         neighbor_rep = wpabuf_alloc(report_len - 1);
6315         if (neighbor_rep == NULL)
6316                 return;
6317         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6318         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6319                    report[0]);
6320         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6321                                        neighbor_rep);
6322         wpa_s->rrm.notify_neighbor_rep = NULL;
6323         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6324 }
6325
6326
6327 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6328 /* Workaround different, undefined for Windows, error codes used here */
6329 #define ENOTCONN -1
6330 #define EOPNOTSUPP -1
6331 #define ECANCELED -1
6332 #endif
6333
6334 /* Measurement Request element + Location Subject + Maximum Age subelement */
6335 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
6336 /* Measurement Request element + Location Civic Request */
6337 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
6338
6339
6340 /**
6341  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6342  * @wpa_s: Pointer to wpa_supplicant
6343  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6344  *        is sent in the request.
6345  * @lci: if set, neighbor request will include LCI request
6346  * @civic: if set, neighbor request will include civic location request
6347  * @cb: Callback function to be called once the requested report arrives, or
6348  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6349  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6350  *      the requester's responsibility to free it.
6351  *      In the latter case NULL will be sent in 'neighbor_rep'.
6352  * @cb_ctx: Context value to send the callback function
6353  * Returns: 0 in case of success, negative error code otherwise
6354  *
6355  * In case there is a previous request which has not been answered yet, the
6356  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6357  * Request must contain a callback function.
6358  */
6359 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6360                                        const struct wpa_ssid_value *ssid,
6361                                        int lci, int civic,
6362                                        void (*cb)(void *ctx,
6363                                                   struct wpabuf *neighbor_rep),
6364                                        void *cb_ctx)
6365 {
6366         struct wpabuf *buf;
6367         const u8 *rrm_ie;
6368
6369         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6370                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6371                 return -ENOTCONN;
6372         }
6373
6374         if (!wpa_s->rrm.rrm_used) {
6375                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6376                 return -EOPNOTSUPP;
6377         }
6378
6379         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6380                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6381         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6382             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6383                 wpa_printf(MSG_DEBUG,
6384                            "RRM: No network support for Neighbor Report.");
6385                 return -EOPNOTSUPP;
6386         }
6387
6388         if (!cb) {
6389                 wpa_printf(MSG_DEBUG,
6390                            "RRM: Neighbor Report request must provide a callback.");
6391                 return -EINVAL;
6392         }
6393
6394         /* Refuse if there's a live request */
6395         if (wpa_s->rrm.notify_neighbor_rep) {
6396                 wpa_printf(MSG_DEBUG,
6397                            "RRM: Currently handling previous Neighbor Report.");
6398                 return -EBUSY;
6399         }
6400
6401         /* 3 = action category + action code + dialog token */
6402         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
6403                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
6404                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
6405         if (buf == NULL) {
6406                 wpa_printf(MSG_DEBUG,
6407                            "RRM: Failed to allocate Neighbor Report Request");
6408                 return -ENOMEM;
6409         }
6410
6411         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6412                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6413                    wpa_s->rrm.next_neighbor_rep_token);
6414
6415         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6416         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6417         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6418         if (ssid) {
6419                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6420                 wpabuf_put_u8(buf, ssid->ssid_len);
6421                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6422         }
6423
6424         if (lci) {
6425                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6426                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6427                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
6428
6429                 /*
6430                  * Measurement token; nonzero number that is unique among the
6431                  * Measurement Request elements in a particular frame.
6432                  */
6433                 wpabuf_put_u8(buf, 1); /* Measurement Token */
6434
6435                 /*
6436                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6437                  * reserved.
6438                  */
6439                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6440                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
6441
6442                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
6443                 /* Location Subject */
6444                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6445
6446                 /* Optional Subelements */
6447                 /*
6448                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
6449                  * The Maximum Age subelement is required, otherwise the AP can
6450                  * send only data that was determined after receiving the
6451                  * request. Setting it here to unlimited age.
6452                  */
6453                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
6454                 wpabuf_put_u8(buf, 2);
6455                 wpabuf_put_le16(buf, 0xffff);
6456         }
6457
6458         if (civic) {
6459                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
6460                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
6461                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
6462
6463                 /*
6464                  * Measurement token; nonzero number that is unique among the
6465                  * Measurement Request elements in a particular frame.
6466                  */
6467                 wpabuf_put_u8(buf, 2); /* Measurement Token */
6468
6469                 /*
6470                  * Parallel, Enable, Request, and Report bits are 0, Duration is
6471                  * reserved.
6472                  */
6473                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
6474                 /* Measurement Type */
6475                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
6476
6477                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
6478                  * Location Civic request */
6479                 /* Location Subject */
6480                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
6481                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
6482                 /* Location Service Interval Units: Seconds */
6483                 wpabuf_put_u8(buf, 0);
6484                 /* Location Service Interval: 0 - Only one report is requested
6485                  */
6486                 wpabuf_put_le16(buf, 0);
6487                 /* No optional subelements */
6488         }
6489
6490         wpa_s->rrm.next_neighbor_rep_token++;
6491
6492         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6493                                 wpa_s->own_addr, wpa_s->bssid,
6494                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6495                 wpa_printf(MSG_DEBUG,
6496                            "RRM: Failed to send Neighbor Report Request");
6497                 wpabuf_free(buf);
6498                 return -ECANCELED;
6499         }
6500
6501         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6502         wpa_s->rrm.notify_neighbor_rep = cb;
6503         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6504                                wpas_rrm_neighbor_rep_timeout_handler,
6505                                &wpa_s->rrm, NULL);
6506
6507         wpabuf_free(buf);
6508         return 0;
6509 }
6510
6511
6512 static struct wpabuf * wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
6513                                                  const u8 *request, size_t len,
6514                                                  struct wpabuf *report)
6515 {
6516         u8 token, type, subject;
6517         u16 max_age = 0;
6518         struct os_reltime t, diff;
6519         unsigned long diff_l;
6520         u8 *ptoken;
6521         const u8 *subelem;
6522
6523         if (!wpa_s->lci || len < 3 + 4)
6524                 return report;
6525
6526         token = *request++;
6527         /* Measurement request mode isn't used */
6528         request++;
6529         type = *request++;
6530         subject = *request++;
6531
6532         wpa_printf(MSG_DEBUG,
6533                    "Measurement request token %u type %u location subject %u",
6534                    token, type, subject);
6535
6536         if (type != MEASURE_TYPE_LCI || subject != LOCATION_SUBJECT_REMOTE) {
6537                 wpa_printf(MSG_INFO,
6538                            "Not building LCI report - bad type or location subject");
6539                 return report;
6540         }
6541
6542         /* Subelements are formatted exactly like elements */
6543         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
6544         if (subelem && subelem[1] == 2)
6545                 max_age = WPA_GET_LE16(subelem + 2);
6546
6547         if (os_get_reltime(&t))
6548                 return report;
6549
6550         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
6551         /* LCI age is calculated in 10th of a second units. */
6552         diff_l = diff.sec * 10 + diff.usec / 100000;
6553
6554         if (max_age != 0xffff && max_age < diff_l)
6555                 return report;
6556
6557         if (wpabuf_resize(&report, 2 + wpabuf_len(wpa_s->lci)))
6558                 return report;
6559
6560         wpabuf_put_u8(report, WLAN_EID_MEASURE_REPORT);
6561         wpabuf_put_u8(report, wpabuf_len(wpa_s->lci));
6562         /* We'll override user's measurement token */
6563         ptoken = wpabuf_put(report, 0);
6564         wpabuf_put_buf(report, wpa_s->lci);
6565         *ptoken = token;
6566
6567         return report;
6568 }
6569
6570
6571 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
6572                                                const u8 *src,
6573                                                const u8 *frame, size_t len)
6574 {
6575         struct wpabuf *buf, *report;
6576         u8 token;
6577         const u8 *ie, *end;
6578
6579         if (wpa_s->wpa_state != WPA_COMPLETED) {
6580                 wpa_printf(MSG_INFO,
6581                            "RRM: Ignoring radio measurement request: Not associated");
6582                 return;
6583         }
6584
6585         if (!wpa_s->rrm.rrm_used) {
6586                 wpa_printf(MSG_INFO,
6587                            "RRM: Ignoring radio measurement request: Not RRM network");
6588                 return;
6589         }
6590
6591         if (len < 3) {
6592                 wpa_printf(MSG_INFO,
6593                            "RRM: Ignoring too short radio measurement request");
6594                 return;
6595         }
6596
6597         end = frame + len;
6598
6599         token = *frame++;
6600
6601         /* Ignore number of repetitions because it's not used in LCI request */
6602         frame += 2;
6603
6604         report = NULL;
6605         while ((ie = get_ie(frame, end - frame, WLAN_EID_MEASURE_REQUEST)) &&
6606                ie[1] >= 3) {
6607                 u8 msmt_type;
6608
6609                 msmt_type = ie[4];
6610                 wpa_printf(MSG_DEBUG, "RRM request %d", msmt_type);
6611
6612                 switch (msmt_type) {
6613                 case MEASURE_TYPE_LCI:
6614                         report = wpas_rrm_build_lci_report(wpa_s, ie + 2, ie[1],
6615                                                            report);
6616                         break;
6617                 default:
6618                         wpa_printf(MSG_INFO,
6619                                    "RRM: Unsupported radio measurement request %d",
6620                                    msmt_type);
6621                         break;
6622                 }
6623
6624                 frame = ie + ie[1] + 2;
6625         }
6626
6627         if (!report)
6628                 return;
6629
6630         buf = wpabuf_alloc(3 + wpabuf_len(report));
6631         if (!buf) {
6632                 wpabuf_free(report);
6633                 return;
6634         }
6635
6636         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6637         wpabuf_put_u8(buf, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
6638         wpabuf_put_u8(buf, token);
6639
6640         wpabuf_put_buf(buf, report);
6641         wpabuf_free(report);
6642
6643         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6644                                 wpa_s->own_addr, wpa_s->bssid,
6645                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6646                 wpa_printf(MSG_ERROR,
6647                            "RRM: Radio measurement report failed: Sending Action frame failed");
6648         }
6649         wpabuf_free(buf);
6650 }
6651
6652
6653 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6654                                               const u8 *src,
6655                                               const u8 *frame, size_t len,
6656                                               int rssi)
6657 {
6658         struct wpabuf *buf;
6659         const struct rrm_link_measurement_request *req;
6660         struct rrm_link_measurement_report report;
6661
6662         if (wpa_s->wpa_state != WPA_COMPLETED) {
6663                 wpa_printf(MSG_INFO,
6664                            "RRM: Ignoring link measurement request. Not associated");
6665                 return;
6666         }
6667
6668         if (!wpa_s->rrm.rrm_used) {
6669                 wpa_printf(MSG_INFO,
6670                            "RRM: Ignoring link measurement request. Not RRM network");
6671                 return;
6672         }
6673
6674         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6675                 wpa_printf(MSG_INFO,
6676                            "RRM: Measurement report failed. TX power insertion not supported");
6677                 return;
6678         }
6679
6680         req = (const struct rrm_link_measurement_request *) frame;
6681         if (len < sizeof(*req)) {
6682                 wpa_printf(MSG_INFO,
6683                            "RRM: Link measurement report failed. Request too short");
6684                 return;
6685         }
6686
6687         os_memset(&report, 0, sizeof(report));
6688         report.tpc.eid = WLAN_EID_TPC_REPORT;
6689         report.tpc.len = 2;
6690         report.rsni = 255; /* 255 indicates that RSNI is not available */
6691         report.dialog_token = req->dialog_token;
6692
6693         /*
6694          * It's possible to estimate RCPI based on RSSI in dBm. This
6695          * calculation will not reflect the correct value for high rates,
6696          * but it's good enough for Action frames which are transmitted
6697          * with up to 24 Mbps rates.
6698          */
6699         if (!rssi)
6700                 report.rcpi = 255; /* not available */
6701         else if (rssi < -110)
6702                 report.rcpi = 0;
6703         else if (rssi > 0)
6704                 report.rcpi = 220;
6705         else
6706                 report.rcpi = (rssi + 110) * 2;
6707
6708         /* action_category + action_code */
6709         buf = wpabuf_alloc(2 + sizeof(report));
6710         if (buf == NULL) {
6711                 wpa_printf(MSG_ERROR,
6712                            "RRM: Link measurement report failed. Buffer allocation failed");
6713                 return;
6714         }
6715
6716         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6717         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6718         wpabuf_put_data(buf, &report, sizeof(report));
6719         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6720                     wpabuf_head(buf), wpabuf_len(buf));
6721
6722         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6723                                 wpa_s->own_addr, wpa_s->bssid,
6724                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6725                 wpa_printf(MSG_ERROR,
6726                            "RRM: Link measurement report failed. Send action failed");
6727         }
6728         wpabuf_free(buf);
6729 }
6730
6731
6732 struct wpa_supplicant *
6733 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6734 {
6735         switch (frame) {
6736 #ifdef CONFIG_P2P
6737         case VENDOR_ELEM_PROBE_REQ_P2P:
6738         case VENDOR_ELEM_PROBE_RESP_P2P:
6739         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6740         case VENDOR_ELEM_BEACON_P2P_GO:
6741         case VENDOR_ELEM_P2P_PD_REQ:
6742         case VENDOR_ELEM_P2P_PD_RESP:
6743         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6744         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6745         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6746         case VENDOR_ELEM_P2P_INV_REQ:
6747         case VENDOR_ELEM_P2P_INV_RESP:
6748         case VENDOR_ELEM_P2P_ASSOC_REQ:
6749         case VENDOR_ELEM_P2P_ASSOC_RESP:
6750                 return wpa_s->p2pdev;
6751 #endif /* CONFIG_P2P */
6752         default:
6753                 return wpa_s;
6754         }
6755 }
6756
6757
6758 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6759 {
6760         unsigned int i;
6761         char buf[30];
6762
6763         wpa_printf(MSG_DEBUG, "Update vendor elements");
6764
6765         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6766                 if (wpa_s->vendor_elem[i]) {
6767                         int res;
6768
6769                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6770                         if (!os_snprintf_error(sizeof(buf), res)) {
6771                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6772                                                 wpa_s->vendor_elem[i]);
6773                         }
6774                 }
6775         }
6776
6777 #ifdef CONFIG_P2P
6778         if (wpa_s->parent == wpa_s &&
6779             wpa_s->global->p2p &&
6780             !wpa_s->global->p2p_disabled)
6781                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6782 #endif /* CONFIG_P2P */
6783 }
6784
6785
6786 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6787                             const u8 *elem, size_t len)
6788 {
6789         u8 *ie, *end;
6790
6791         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6792         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6793
6794         for (; ie + 1 < end; ie += 2 + ie[1]) {
6795                 if (ie + len > end)
6796                         break;
6797                 if (os_memcmp(ie, elem, len) != 0)
6798                         continue;
6799
6800                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6801                         wpabuf_free(wpa_s->vendor_elem[frame]);
6802                         wpa_s->vendor_elem[frame] = NULL;
6803                 } else {
6804                         os_memmove(ie, ie + len, end - (ie + len));
6805                         wpa_s->vendor_elem[frame]->used -= len;
6806                 }
6807                 wpas_vendor_elem_update(wpa_s);
6808                 return 0;
6809         }
6810
6811         return -1;
6812 }
6813
6814
6815 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6816                                    u16 num_modes, enum hostapd_hw_mode mode)
6817 {
6818         u16 i;
6819
6820         for (i = 0; i < num_modes; i++) {
6821                 if (modes[i].mode == mode)
6822                         return &modes[i];
6823         }
6824
6825         return NULL;
6826 }
6827
6828
6829 static struct
6830 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6831                                                  const u8 *bssid)
6832 {
6833         struct wpa_bss_tmp_disallowed *bss;
6834
6835         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6836                          struct wpa_bss_tmp_disallowed, list) {
6837                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6838                         return bss;
6839         }
6840
6841         return NULL;
6842 }
6843
6844
6845 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6846                           unsigned int sec)
6847 {
6848         struct wpa_bss_tmp_disallowed *bss;
6849         struct os_reltime until;
6850
6851         os_get_reltime(&until);
6852         until.sec += sec;
6853
6854         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6855         if (bss) {
6856                 bss->disallowed_until = until;
6857                 return;
6858         }
6859
6860         bss = os_malloc(sizeof(*bss));
6861         if (!bss) {
6862                 wpa_printf(MSG_DEBUG,
6863                            "Failed to allocate memory for temp disallow BSS");
6864                 return;
6865         }
6866
6867         bss->disallowed_until = until;
6868         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6869         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6870 }
6871
6872
6873 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6874 {
6875         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6876         struct os_reltime now, age;
6877
6878         os_get_reltime(&now);
6879
6880         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6881                          struct wpa_bss_tmp_disallowed, list) {
6882                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6883                         /* This BSS is not disallowed anymore */
6884                         dl_list_del(&tmp->list);
6885                         os_free(tmp);
6886                         continue;
6887                 }
6888                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6889                         bss = tmp;
6890                         break;
6891                 }
6892         }
6893         if (!bss)
6894                 return 0;
6895
6896         os_reltime_sub(&bss->disallowed_until, &now, &age);
6897         wpa_printf(MSG_DEBUG,
6898                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6899                    MAC2STR(bss->bssid), age.sec, age.usec);
6900         return 1;
6901 }