wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548
 549         wpa_s->sched_scan_plans_num = 0;
 550         os_free(wpa_s->sched_scan_plans);
 551         wpa_s->sched_scan_plans = NULL;
 552
 553 #ifdef CONFIG_MBO
 554         wpa_s->non_pref_chan_num = 0;
 555         os_free(wpa_s->non_pref_chan);
 556         wpa_s->non_pref_chan = NULL;
 557 #endif /* CONFIG_MBO */
 558 }
 559
 560
 561 /**
 562  * wpa_clear_keys - Clear keys configured for the driver
 563  * @wpa_s: Pointer to wpa_supplicant data
 564  * @addr: Previously used BSSID or %NULL if not available
 565  *
 566  * This function clears the encryption keys that has been previously configured
 567  * for the driver.
 568  */
 569 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 570 {
 571         int i, max;
 572
 573 #ifdef CONFIG_IEEE80211W
 574         max = 6;
 575 #else /* CONFIG_IEEE80211W */
 576         max = 4;
 577 #endif /* CONFIG_IEEE80211W */
 578
 579         /* MLME-DELETEKEYS.request */
 580         for (i = 0; i < max; i++) {
 581                 if (wpa_s->keys_cleared & BIT(i))
 582                         continue;
 583                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 584                                 NULL, 0);
 585         }
 586         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 587             !is_zero_ether_addr(addr)) {
 588                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 589                                 0);
 590                 /* MLME-SETPROTECTION.request(None) */
 591                 wpa_drv_mlme_setprotection(
 592                         wpa_s, addr,
 593                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 594                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 595         }
 596         wpa_s->keys_cleared = (u32) -1;
 597 }
 598
 599
 600 /**
 601  * wpa_supplicant_state_txt - Get the connection state name as a text string
 602  * @state: State (wpa_state; WPA_*)
 603  * Returns: The state name as a printable text string
 604  */
 605 const char * wpa_supplicant_state_txt(enum wpa_states state)
 606 {
 607         switch (state) {
 608         case WPA_DISCONNECTED:
 609                 return "DISCONNECTED";
 610         case WPA_INACTIVE:
 611                 return "INACTIVE";
 612         case WPA_INTERFACE_DISABLED:
 613                 return "INTERFACE_DISABLED";
 614         case WPA_SCANNING:
 615                 return "SCANNING";
 616         case WPA_AUTHENTICATING:
 617                 return "AUTHENTICATING";
 618         case WPA_ASSOCIATING:
 619                 return "ASSOCIATING";
 620         case WPA_ASSOCIATED:
 621                 return "ASSOCIATED";
 622         case WPA_4WAY_HANDSHAKE:
 623                 return "4WAY_HANDSHAKE";
 624         case WPA_GROUP_HANDSHAKE:
 625                 return "GROUP_HANDSHAKE";
 626         case WPA_COMPLETED:
 627                 return "COMPLETED";
 628         default:
 629                 return "UNKNOWN";
 630         }
 631 }
 632
 633
 634 #ifdef CONFIG_BGSCAN
 635
 636 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 637 {
 638         const char *name;
 639
 640         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 641                 name = wpa_s->current_ssid->bgscan;
 642         else
 643                 name = wpa_s->conf->bgscan;
 644         if (name == NULL || name[0] == '\0')
 645                 return;
 646         if (wpas_driver_bss_selection(wpa_s))
 647                 return;
 648         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 649                 return;
 650 #ifdef CONFIG_P2P
 651         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 652                 return;
 653 #endif /* CONFIG_P2P */
 654
 655         bgscan_deinit(wpa_s);
 656         if (wpa_s->current_ssid) {
 657                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 658                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 659                                 "bgscan");
 660                         /*
 661                          * Live without bgscan; it is only used as a roaming
 662                          * optimization, so the initial connection is not
 663                          * affected.
 664                          */
 665                 } else {
 666                         struct wpa_scan_results *scan_res;
 667                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 668                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 669                                                                    0);
 670                         if (scan_res) {
 671                                 bgscan_notify_scan(wpa_s, scan_res);
 672                                 wpa_scan_results_free(scan_res);
 673                         }
 674                 }
 675         } else
 676                 wpa_s->bgscan_ssid = NULL;
 677 }
 678
 679
 680 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 681 {
 682         if (wpa_s->bgscan_ssid != NULL) {
 683                 bgscan_deinit(wpa_s);
 684                 wpa_s->bgscan_ssid = NULL;
 685         }
 686 }
 687
 688 #endif /* CONFIG_BGSCAN */
 689
 690
 691 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 692 {
 693         if (autoscan_init(wpa_s, 0))
 694                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 695 }
 696
 697
 698 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 699 {
 700         autoscan_deinit(wpa_s);
 701 }
 702
 703
 704 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 705 {
 706         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 707             wpa_s->wpa_state == WPA_SCANNING) {
 708                 autoscan_deinit(wpa_s);
 709                 wpa_supplicant_start_autoscan(wpa_s);
 710         }
 711 }
 712
 713
 714 /**
 715  * wpa_supplicant_set_state - Set current connection state
 716  * @wpa_s: Pointer to wpa_supplicant data
 717  * @state: The new connection state
 718  *
 719  * This function is called whenever the connection state changes, e.g.,
 720  * association is completed for WPA/WPA2 4-Way Handshake is started.
 721  */
 722 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 723                               enum wpa_states state)
 724 {
 725         enum wpa_states old_state = wpa_s->wpa_state;
 726
 727         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 728                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 729                 wpa_supplicant_state_txt(state));
 730
 731         if (state == WPA_INTERFACE_DISABLED) {
 732                 /* Assure normal scan when interface is restored */
 733                 wpa_s->normal_scans = 0;
 734         }
 735
 736         if (state == WPA_COMPLETED) {
 737                 wpas_connect_work_done(wpa_s);
 738                 /* Reinitialize normal_scan counter */
 739                 wpa_s->normal_scans = 0;
 740         }
 741
 742 #ifdef CONFIG_P2P
 743         /*
 744          * P2PS client has to reply to Probe Request frames received on the
 745          * group operating channel. Enable Probe Request frame reporting for
 746          * P2P connected client in case p2p_cli_probe configuration property is
 747          * set to 1.
 748          */
 749         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 750             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 751             wpa_s->current_ssid->p2p_group) {
 752                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 753                         wpa_dbg(wpa_s, MSG_DEBUG,
 754                                 "P2P: Enable CLI Probe Request RX reporting");
 755                         wpa_s->p2p_cli_probe =
 756                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 757                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 758                         wpa_dbg(wpa_s, MSG_DEBUG,
 759                                 "P2P: Disable CLI Probe Request RX reporting");
 760                         wpa_s->p2p_cli_probe = 0;
 761                         wpa_drv_probe_req_report(wpa_s, 0);
 762                 }
 763         }
 764 #endif /* CONFIG_P2P */
 765
 766         if (state != WPA_SCANNING)
 767                 wpa_supplicant_notify_scanning(wpa_s, 0);
 768
 769         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 770                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 771 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 772                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 773                         MACSTR " completed [id=%d id_str=%s]",
 774                         MAC2STR(wpa_s->bssid),
 775                         ssid ? ssid->id : -1,
 776                         ssid && ssid->id_str ? ssid->id_str : "");
 777 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 778                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 779                 wpa_blacklist_clear(wpa_s);
 780                 wpa_s->extra_blacklist_count = 0;
 781                 wpa_s->new_connection = 0;
 782                 wpa_drv_set_operstate(wpa_s, 1);
 783 #ifndef IEEE8021X_EAPOL
 784                 wpa_drv_set_supp_port(wpa_s, 1);
 785 #endif /* IEEE8021X_EAPOL */
 786                 wpa_s->after_wps = 0;
 787                 wpa_s->known_wps_freq = 0;
 788                 wpas_p2p_completed(wpa_s);
 789
 790                 sme_sched_obss_scan(wpa_s, 1);
 791         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 792                    state == WPA_ASSOCIATED) {
 793                 wpa_s->new_connection = 1;
 794                 wpa_drv_set_operstate(wpa_s, 0);
 795 #ifndef IEEE8021X_EAPOL
 796                 wpa_drv_set_supp_port(wpa_s, 0);
 797 #endif /* IEEE8021X_EAPOL */
 798                 sme_sched_obss_scan(wpa_s, 0);
 799         }
 800         wpa_s->wpa_state = state;
 801
 802 #ifdef CONFIG_BGSCAN
 803         if (state == WPA_COMPLETED)
 804                 wpa_supplicant_start_bgscan(wpa_s);
 805         else if (state < WPA_ASSOCIATED)
 806                 wpa_supplicant_stop_bgscan(wpa_s);
 807 #endif /* CONFIG_BGSCAN */
 808
 809         if (state == WPA_AUTHENTICATING)
 810                 wpa_supplicant_stop_autoscan(wpa_s);
 811
 812         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 813                 wpa_supplicant_start_autoscan(wpa_s);
 814
 815         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 816                 wmm_ac_notify_disassoc(wpa_s);
 817
 818         if (wpa_s->wpa_state != old_state) {
 819                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 820
 821                 /*
 822                  * Notify the P2P Device interface about a state change in one
 823                  * of the interfaces.
 824                  */
 825                 wpas_p2p_indicate_state_change(wpa_s);
 826
 827                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 828                     old_state == WPA_COMPLETED)
 829                         wpas_notify_auth_changed(wpa_s);
 830         }
 831 }
 832
 833
 834 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 835 {
 836         int pending = 0;
 837 #ifdef CONFIG_WPS
 838         struct wpa_supplicant *wpa_s = global->ifaces;
 839         while (wpa_s) {
 840                 struct wpa_supplicant *next = wpa_s->next;
 841                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 842                         pending = 1;
 843 #ifdef CONFIG_P2P
 844                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 845                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 846                         wpas_p2p_disconnect(wpa_s);
 847 #endif /* CONFIG_P2P */
 848                 wpa_s = next;
 849         }
 850 #endif /* CONFIG_WPS */
 851         if (pending)
 852                 return;
 853         eloop_terminate();
 854 }
 855
 856
 857 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 858 {
 859         struct wpa_global *global = signal_ctx;
 860         wpa_supplicant_terminate_proc(global);
 861 }
 862
 863
 864 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 865 {
 866         enum wpa_states old_state = wpa_s->wpa_state;
 867
 868         wpa_s->pairwise_cipher = 0;
 869         wpa_s->group_cipher = 0;
 870         wpa_s->mgmt_group_cipher = 0;
 871         wpa_s->key_mgmt = 0;
 872         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 873                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 874
 875         if (wpa_s->wpa_state != old_state)
 876                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 877 }
 878
 879
 880 /**
 881  * wpa_supplicant_reload_configuration - Reload configuration data
 882  * @wpa_s: Pointer to wpa_supplicant data
 883  * Returns: 0 on success or -1 if configuration parsing failed
 884  *
 885  * This function can be used to request that the configuration data is reloaded
 886  * (e.g., after configuration file change). This function is reloading
 887  * configuration only for one interface, so this may need to be called multiple
 888  * times if %wpa_supplicant is controlling multiple interfaces and all
 889  * interfaces need reconfiguration.
 890  */
 891 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 892 {
 893         struct wpa_config *conf;
 894         int reconf_ctrl;
 895         int old_ap_scan;
 896
 897         if (wpa_s->confname == NULL)
 898                 return -1;
 899         conf = wpa_config_read(wpa_s->confname, NULL);
 900         if (conf == NULL) {
 901                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 902                         "file '%s' - exiting", wpa_s->confname);
 903                 return -1;
 904         }
 905         wpa_config_read(wpa_s->confanother, conf);
 906
 907         conf->changed_parameters = (unsigned int) -1;
 908
 909         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 910                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 911                     os_strcmp(conf->ctrl_interface,
 912                               wpa_s->conf->ctrl_interface) != 0);
 913
 914         if (reconf_ctrl && wpa_s->ctrl_iface) {
 915                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 916                 wpa_s->ctrl_iface = NULL;
 917         }
 918
 919         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 920         if (wpa_s->current_ssid) {
 921                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 922                         wpa_s->own_disconnect_req = 1;
 923                 wpa_supplicant_deauthenticate(wpa_s,
 924                                               WLAN_REASON_DEAUTH_LEAVING);
 925         }
 926
 927         /*
 928          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 929          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 930          */
 931         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 932                 /*
 933                  * Clear forced success to clear EAP state for next
 934                  * authentication.
 935                  */
 936                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 937         }
 938         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 939         wpa_sm_set_config(wpa_s->wpa, NULL);
 940         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 941         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 942         rsn_preauth_deinit(wpa_s->wpa);
 943
 944         old_ap_scan = wpa_s->conf->ap_scan;
 945         wpa_config_free(wpa_s->conf);
 946         wpa_s->conf = conf;
 947         if (old_ap_scan != wpa_s->conf->ap_scan)
 948                 wpas_notify_ap_scan_changed(wpa_s);
 949
 950         if (reconf_ctrl)
 951                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 952
 953         wpa_supplicant_update_config(wpa_s);
 954
 955         wpa_supplicant_clear_status(wpa_s);
 956         if (wpa_supplicant_enabled_networks(wpa_s)) {
 957                 wpa_s->reassociate = 1;
 958                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 959         }
 960         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 961         return 0;
 962 }
 963
 964
 965 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 966 {
 967         struct wpa_global *global = signal_ctx;
 968         struct wpa_supplicant *wpa_s;
 969         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 970                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 971                         sig);
 972                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 973                         wpa_supplicant_terminate_proc(global);
 974                 }
 975         }
 976
 977         if (wpa_debug_reopen_file() < 0) {
 978                 /* Ignore errors since we cannot really do much to fix this */
 979                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 980         }
 981 }
 982
 983
 984 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 985                                          struct wpa_ssid *ssid,
 986                                          struct wpa_ie_data *ie)
 987 {
 988         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 989         if (ret) {
 990                 if (ret == -2) {
 991                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 992                                 "from association info");
 993                 }
 994                 return -1;
 995         }
 996
 997         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 998                 "cipher suites");
 999         if (!(ie->group_cipher & ssid->group_cipher)) {
1000                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1001                         "cipher 0x%x (mask 0x%x) - reject",
1002                         ie->group_cipher, ssid->group_cipher);
1003                 return -1;
1004         }
1005         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1007                         "cipher 0x%x (mask 0x%x) - reject",
1008                         ie->pairwise_cipher, ssid->pairwise_cipher);
1009                 return -1;
1010         }
1011         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1012                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1013                         "management 0x%x (mask 0x%x) - reject",
1014                         ie->key_mgmt, ssid->key_mgmt);
1015                 return -1;
1016         }
1017
1018 #ifdef CONFIG_IEEE80211W
1019         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1020             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1021                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1022                         "that does not support management frame protection - "
1023                         "reject");
1024                 return -1;
1025         }
1026 #endif /* CONFIG_IEEE80211W */
1027
1028         return 0;
1029 }
1030
1031
1032 /**
1033  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1034  * @wpa_s: Pointer to wpa_supplicant data
1035  * @bss: Scan results for the selected BSS, or %NULL if not available
1036  * @ssid: Configuration data for the selected network
1037  * @wpa_ie: Buffer for the WPA/RSN IE
1038  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1039  * used buffer length in case the functions returns success.
1040  * Returns: 0 on success or -1 on failure
1041  *
1042  * This function is used to configure authentication and encryption parameters
1043  * based on the network configuration and scan result for the selected BSS (if
1044  * available).
1045  */
1046 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1047                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1048                               u8 *wpa_ie, size_t *wpa_ie_len)
1049 {
1050         struct wpa_ie_data ie;
1051         int sel, proto;
1052         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1053
1054         if (bss) {
1055                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1056                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1057                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1058         } else
1059                 bss_wpa = bss_rsn = bss_osen = NULL;
1060
1061         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1062             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1063             (ie.group_cipher & ssid->group_cipher) &&
1064             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1065             (ie.key_mgmt & ssid->key_mgmt)) {
1066                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1067                 proto = WPA_PROTO_RSN;
1068         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1069                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1070                    (ie.group_cipher & ssid->group_cipher) &&
1071                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1072                    (ie.key_mgmt & ssid->key_mgmt)) {
1073                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1074                 proto = WPA_PROTO_WPA;
1075 #ifdef CONFIG_HS20
1076         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1077                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1078                 /* TODO: parse OSEN element */
1079                 os_memset(&ie, 0, sizeof(ie));
1080                 ie.group_cipher = WPA_CIPHER_CCMP;
1081                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1082                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1083                 proto = WPA_PROTO_OSEN;
1084 #endif /* CONFIG_HS20 */
1085         } else if (bss) {
1086                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1087                 wpa_dbg(wpa_s, MSG_DEBUG,
1088                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1089                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1090                         ssid->key_mgmt);
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1092                         MAC2STR(bss->bssid),
1093                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1094                         bss_wpa ? " WPA" : "",
1095                         bss_rsn ? " RSN" : "",
1096                         bss_osen ? " OSEN" : "");
1097                 if (bss_rsn) {
1098                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1099                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1100                                 wpa_dbg(wpa_s, MSG_DEBUG,
1101                                         "Could not parse RSN element");
1102                         } else {
1103                                 wpa_dbg(wpa_s, MSG_DEBUG,
1104                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1105                                         ie.pairwise_cipher, ie.group_cipher,
1106                                         ie.key_mgmt);
1107                         }
1108                 }
1109                 if (bss_wpa) {
1110                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1111                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1112                                 wpa_dbg(wpa_s, MSG_DEBUG,
1113                                         "Could not parse WPA element");
1114                         } else {
1115                                 wpa_dbg(wpa_s, MSG_DEBUG,
1116                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1117                                         ie.pairwise_cipher, ie.group_cipher,
1118                                         ie.key_mgmt);
1119                         }
1120                 }
1121                 return -1;
1122         } else {
1123                 if (ssid->proto & WPA_PROTO_OSEN)
1124                         proto = WPA_PROTO_OSEN;
1125                 else if (ssid->proto & WPA_PROTO_RSN)
1126                         proto = WPA_PROTO_RSN;
1127                 else
1128                         proto = WPA_PROTO_WPA;
1129                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1130                         os_memset(&ie, 0, sizeof(ie));
1131                         ie.group_cipher = ssid->group_cipher;
1132                         ie.pairwise_cipher = ssid->pairwise_cipher;
1133                         ie.key_mgmt = ssid->key_mgmt;
1134 #ifdef CONFIG_IEEE80211W
1135                         ie.mgmt_group_cipher =
1136                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1137                                 WPA_CIPHER_AES_128_CMAC : 0;
1138 #endif /* CONFIG_IEEE80211W */
1139                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1140                                 "based on configuration");
1141                 } else
1142                         proto = ie.proto;
1143         }
1144
1145         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1146                 "pairwise %d key_mgmt %d proto %d",
1147                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1148 #ifdef CONFIG_IEEE80211W
1149         if (ssid->ieee80211w) {
1150                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1151                         ie.mgmt_group_cipher);
1152         }
1153 #endif /* CONFIG_IEEE80211W */
1154
1155         wpa_s->wpa_proto = proto;
1156         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1157         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1158                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1159
1160         if (bss || !wpa_s->ap_ies_from_associnfo) {
1161                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1162                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1163                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1164                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1165                         return -1;
1166         }
1167
1168 #ifdef CONFIG_NO_WPA
1169         wpa_s->group_cipher = WPA_CIPHER_NONE;
1170         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1171 #else /* CONFIG_NO_WPA */
1172         sel = ie.group_cipher & ssid->group_cipher;
1173         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1174         if (wpa_s->group_cipher < 0) {
1175                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1176                         "cipher");
1177                 return -1;
1178         }
1179         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1180                 wpa_cipher_txt(wpa_s->group_cipher));
1181
1182         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1183         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1184         if (wpa_s->pairwise_cipher < 0) {
1185                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1186                         "cipher");
1187                 return -1;
1188         }
1189         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1190                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1191 #endif /* CONFIG_NO_WPA */
1192
1193         sel = ie.key_mgmt & ssid->key_mgmt;
1194 #ifdef CONFIG_SAE
1195         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1196                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1197 #endif /* CONFIG_SAE */
1198         if (0) {
1199 #ifdef CONFIG_SUITEB192
1200         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1202                 wpa_dbg(wpa_s, MSG_DEBUG,
1203                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1204 #endif /* CONFIG_SUITEB192 */
1205 #ifdef CONFIG_SUITEB
1206         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1207                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1208                 wpa_dbg(wpa_s, MSG_DEBUG,
1209                         "WPA: using KEY_MGMT 802.1X with Suite B");
1210 #endif /* CONFIG_SUITEB */
1211 #ifdef CONFIG_IEEE80211R
1212         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1213                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1214                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1215         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1216                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1217                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1218 #endif /* CONFIG_IEEE80211R */
1219 #ifdef CONFIG_SAE
1220         } else if (sel & WPA_KEY_MGMT_SAE) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1222                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1223         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1225                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1226 #endif /* CONFIG_SAE */
1227 #ifdef CONFIG_IEEE80211W
1228         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1229                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1230                 wpa_dbg(wpa_s, MSG_DEBUG,
1231                         "WPA: using KEY_MGMT 802.1X with SHA256");
1232         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1233                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1234                 wpa_dbg(wpa_s, MSG_DEBUG,
1235                         "WPA: using KEY_MGMT PSK with SHA256");
1236 #endif /* CONFIG_IEEE80211W */
1237         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1240         } else if (sel & WPA_KEY_MGMT_PSK) {
1241                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1242                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1243         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1244                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1245                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1246 #ifdef CONFIG_HS20
1247         } else if (sel & WPA_KEY_MGMT_OSEN) {
1248                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1249                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1250 #endif /* CONFIG_HS20 */
1251         } else {
1252                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1253                         "authenticated key management type");
1254                 return -1;
1255         }
1256
1257         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1258         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1259                          wpa_s->pairwise_cipher);
1260         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1261
1262 #ifdef CONFIG_IEEE80211W
1263         sel = ie.mgmt_group_cipher;
1264         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1265             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1266                 sel = 0;
1267         if (sel & WPA_CIPHER_AES_128_CMAC) {
1268                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1269                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1270                         "AES-128-CMAC");
1271         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1272                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1273                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1274                         "BIP-GMAC-128");
1275         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1276                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1277                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1278                         "BIP-GMAC-256");
1279         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1280                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1281                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1282                         "BIP-CMAC-256");
1283         } else {
1284                 wpa_s->mgmt_group_cipher = 0;
1285                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1286         }
1287         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1288                          wpa_s->mgmt_group_cipher);
1289         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1290                          wpas_get_ssid_pmf(wpa_s, ssid));
1291 #endif /* CONFIG_IEEE80211W */
1292
1293         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1294                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1295                 return -1;
1296         }
1297
1298         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1299                 int psk_set = 0;
1300
1301                 if (ssid->psk_set) {
1302                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1303                                        NULL);
1304                         psk_set = 1;
1305                 }
1306 #ifndef CONFIG_NO_PBKDF2
1307                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1308                     ssid->passphrase) {
1309                         u8 psk[PMK_LEN];
1310                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1311                                     4096, psk, PMK_LEN);
1312                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1313                                         psk, PMK_LEN);
1314                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1315                         psk_set = 1;
1316                         os_memset(psk, 0, sizeof(psk));
1317                 }
1318 #endif /* CONFIG_NO_PBKDF2 */
1319 #ifdef CONFIG_EXT_PASSWORD
1320                 if (ssid->ext_psk) {
1321                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1322                                                              ssid->ext_psk);
1323                         char pw_str[64 + 1];
1324                         u8 psk[PMK_LEN];
1325
1326                         if (pw == NULL) {
1327                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1328                                         "found from external storage");
1329                                 return -1;
1330                         }
1331
1332                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1333                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1334                                         "PSK length %d in external storage",
1335                                         (int) wpabuf_len(pw));
1336                                 ext_password_free(pw);
1337                                 return -1;
1338                         }
1339
1340                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1341                         pw_str[wpabuf_len(pw)] = '\0';
1342
1343 #ifndef CONFIG_NO_PBKDF2
1344                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1345                         {
1346                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1347                                             4096, psk, PMK_LEN);
1348                                 os_memset(pw_str, 0, sizeof(pw_str));
1349                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1350                                                 "external passphrase)",
1351                                                 psk, PMK_LEN);
1352                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1353                                                NULL);
1354                                 psk_set = 1;
1355                                 os_memset(psk, 0, sizeof(psk));
1356                         } else
1357 #endif /* CONFIG_NO_PBKDF2 */
1358                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1359                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1360                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1361                                                 "Invalid PSK hex string");
1362                                         os_memset(pw_str, 0, sizeof(pw_str));
1363                                         ext_password_free(pw);
1364                                         return -1;
1365                                 }
1366                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1367                                                NULL);
1368                                 psk_set = 1;
1369                                 os_memset(psk, 0, sizeof(psk));
1370                         } else {
1371                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1372                                         "PSK available");
1373                                 os_memset(pw_str, 0, sizeof(pw_str));
1374                                 ext_password_free(pw);
1375                                 return -1;
1376                         }
1377
1378                         os_memset(pw_str, 0, sizeof(pw_str));
1379                         ext_password_free(pw);
1380                 }
1381 #endif /* CONFIG_EXT_PASSWORD */
1382
1383                 if (!psk_set) {
1384                         wpa_msg(wpa_s, MSG_INFO,
1385                                 "No PSK available for association");
1386                         return -1;
1387                 }
1388         } else
1389                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1390
1391         return 0;
1392 }
1393
1394
1395 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1396 {
1397         *pos = 0x00;
1398
1399         switch (idx) {
1400         case 0: /* Bits 0-7 */
1401                 break;
1402         case 1: /* Bits 8-15 */
1403                 break;
1404         case 2: /* Bits 16-23 */
1405 #ifdef CONFIG_WNM
1406                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1407                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1408 #endif /* CONFIG_WNM */
1409                 break;
1410         case 3: /* Bits 24-31 */
1411 #ifdef CONFIG_WNM
1412                 *pos |= 0x02; /* Bit 25 - SSID List */
1413 #endif /* CONFIG_WNM */
1414 #ifdef CONFIG_INTERWORKING
1415                 if (wpa_s->conf->interworking)
1416                         *pos |= 0x80; /* Bit 31 - Interworking */
1417 #endif /* CONFIG_INTERWORKING */
1418                 break;
1419         case 4: /* Bits 32-39 */
1420 #ifdef CONFIG_INTERWORKING
1421                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1422                         *pos |= 0x01; /* Bit 32 - QoS Map */
1423 #endif /* CONFIG_INTERWORKING */
1424                 break;
1425         case 5: /* Bits 40-47 */
1426 #ifdef CONFIG_HS20
1427                 if (wpa_s->conf->hs20)
1428                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1429 #endif /* CONFIG_HS20 */
1430 #ifdef CONFIG_MBO
1431                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1432 #endif /* CONFIG_MBO */
1433                 break;
1434         case 6: /* Bits 48-55 */
1435                 break;
1436         }
1437 }
1438
1439
1440 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1441 {
1442         u8 *pos = buf;
1443         u8 len = 6, i;
1444
1445         if (len < wpa_s->extended_capa_len)
1446                 len = wpa_s->extended_capa_len;
1447         if (buflen < (size_t) len + 2) {
1448                 wpa_printf(MSG_INFO,
1449                            "Not enough room for building extended capabilities element");
1450                 return -1;
1451         }
1452
1453         *pos++ = WLAN_EID_EXT_CAPAB;
1454         *pos++ = len;
1455         for (i = 0; i < len; i++, pos++) {
1456                 wpas_ext_capab_byte(wpa_s, pos, i);
1457
1458                 if (i < wpa_s->extended_capa_len) {
1459                         *pos &= ~wpa_s->extended_capa_mask[i];
1460                         *pos |= wpa_s->extended_capa[i];
1461                 }
1462         }
1463
1464         while (len > 0 && buf[1 + len] == 0) {
1465                 len--;
1466                 buf[1] = len;
1467         }
1468         if (len == 0)
1469                 return 0;
1470
1471         return 2 + len;
1472 }
1473
1474
1475 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1476                           struct wpa_bss *test_bss)
1477 {
1478         struct wpa_bss *bss;
1479
1480         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1481                 if (bss == test_bss)
1482                         return 1;
1483         }
1484
1485         return 0;
1486 }
1487
1488
1489 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1490                            struct wpa_ssid *test_ssid)
1491 {
1492         struct wpa_ssid *ssid;
1493
1494         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1495                 if (ssid == test_ssid)
1496                         return 1;
1497         }
1498
1499         return 0;
1500 }
1501
1502
1503 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1504                         struct wpa_ssid *test_ssid)
1505 {
1506         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1507                 return 0;
1508
1509         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1510 }
1511
1512
1513 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1514 {
1515         if (cwork == NULL)
1516                 return;
1517         os_free(cwork);
1518 }
1519
1520
1521 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1522 {
1523         struct wpa_connect_work *cwork;
1524         struct wpa_radio_work *work = wpa_s->connect_work;
1525
1526         if (!work)
1527                 return;
1528
1529         wpa_s->connect_work = NULL;
1530         cwork = work->ctx;
1531         work->ctx = NULL;
1532         wpas_connect_work_free(cwork);
1533         radio_work_done(work);
1534 }
1535
1536
1537 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1538 {
1539         struct os_reltime now;
1540         u8 addr[ETH_ALEN];
1541
1542         os_get_reltime(&now);
1543         if (wpa_s->last_mac_addr_style == style &&
1544             wpa_s->last_mac_addr_change.sec != 0 &&
1545             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1546                                 wpa_s->conf->rand_addr_lifetime)) {
1547                 wpa_msg(wpa_s, MSG_DEBUG,
1548                         "Previously selected random MAC address has not yet expired");
1549                 return 0;
1550         }
1551
1552         switch (style) {
1553         case 1:
1554                 if (random_mac_addr(addr) < 0)
1555                         return -1;
1556                 break;
1557         case 2:
1558                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1559                 if (random_mac_addr_keep_oui(addr) < 0)
1560                         return -1;
1561                 break;
1562         default:
1563                 return -1;
1564         }
1565
1566         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1567                 wpa_msg(wpa_s, MSG_INFO,
1568                         "Failed to set random MAC address");
1569                 return -1;
1570         }
1571
1572         os_get_reltime(&wpa_s->last_mac_addr_change);
1573         wpa_s->mac_addr_changed = 1;
1574         wpa_s->last_mac_addr_style = style;
1575
1576         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1577                 wpa_msg(wpa_s, MSG_INFO,
1578                         "Could not update MAC address information");
1579                 return -1;
1580         }
1581
1582         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1583                 MAC2STR(addr));
1584
1585         return 0;
1586 }
1587
1588
1589 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1590 {
1591         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1592             !wpa_s->conf->preassoc_mac_addr)
1593                 return 0;
1594
1595         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1596 }
1597
1598
1599 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1600
1601 /**
1602  * wpa_supplicant_associate - Request association
1603  * @wpa_s: Pointer to wpa_supplicant data
1604  * @bss: Scan results for the selected BSS, or %NULL if not available
1605  * @ssid: Configuration data for the selected network
1606  *
1607  * This function is used to request %wpa_supplicant to associate with a BSS.
1608  */
1609 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1610                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1611 {
1612         struct wpa_connect_work *cwork;
1613         int rand_style;
1614
1615         wpa_s->own_disconnect_req = 0;
1616
1617         /*
1618          * If we are starting a new connection, any previously pending EAPOL
1619          * RX cannot be valid anymore.
1620          */
1621         wpabuf_free(wpa_s->pending_eapol_rx);
1622         wpa_s->pending_eapol_rx = NULL;
1623
1624         if (ssid->mac_addr == -1)
1625                 rand_style = wpa_s->conf->mac_addr;
1626         else
1627                 rand_style = ssid->mac_addr;
1628
1629         wmm_ac_clear_saved_tspecs(wpa_s);
1630         wpa_s->reassoc_same_bss = 0;
1631
1632         if (wpa_s->last_ssid == ssid) {
1633                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1634                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1635                         wmm_ac_save_tspecs(wpa_s);
1636                         wpa_s->reassoc_same_bss = 1;
1637                 }
1638         } else if (rand_style > 0) {
1639                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1640                         return;
1641                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1642         } else if (wpa_s->mac_addr_changed) {
1643                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1644                         wpa_msg(wpa_s, MSG_INFO,
1645                                 "Could not restore permanent MAC address");
1646                         return;
1647                 }
1648                 wpa_s->mac_addr_changed = 0;
1649                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1650                         wpa_msg(wpa_s, MSG_INFO,
1651                                 "Could not update MAC address information");
1652                         return;
1653                 }
1654                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1655         }
1656         wpa_s->last_ssid = ssid;
1657
1658 #ifdef CONFIG_IBSS_RSN
1659         ibss_rsn_deinit(wpa_s->ibss_rsn);
1660         wpa_s->ibss_rsn = NULL;
1661 #endif /* CONFIG_IBSS_RSN */
1662
1663         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1664             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1665 #ifdef CONFIG_AP
1666                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1667                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1668                                 "mode");
1669                         return;
1670                 }
1671                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1672                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1673                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1674                                 wpas_p2p_ap_setup_failed(wpa_s);
1675                         return;
1676                 }
1677                 wpa_s->current_bss = bss;
1678 #else /* CONFIG_AP */
1679                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1680                         "the build");
1681 #endif /* CONFIG_AP */
1682                 return;
1683         }
1684
1685         if (ssid->mode == WPAS_MODE_MESH) {
1686 #ifdef CONFIG_MESH
1687                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1688                         wpa_msg(wpa_s, MSG_INFO,
1689                                 "Driver does not support mesh mode");
1690                         return;
1691                 }
1692                 if (bss)
1693                         ssid->frequency = bss->freq;
1694                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1695                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1696                         return;
1697                 }
1698                 wpa_s->current_bss = bss;
1699                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1700                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1701                         ssid->id);
1702 #else /* CONFIG_MESH */
1703                 wpa_msg(wpa_s, MSG_ERROR,
1704                         "mesh mode support not included in the build");
1705 #endif /* CONFIG_MESH */
1706                 return;
1707         }
1708
1709 #ifdef CONFIG_TDLS
1710         if (bss)
1711                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1712                                 bss->ie_len);
1713 #endif /* CONFIG_TDLS */
1714
1715         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1716             ssid->mode == IEEE80211_MODE_INFRA) {
1717                 sme_authenticate(wpa_s, bss, ssid);
1718                 return;
1719         }
1720
1721         if (wpa_s->connect_work) {
1722                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1723                 return;
1724         }
1725
1726         if (radio_work_pending(wpa_s, "connect")) {
1727                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1728                 return;
1729         }
1730
1731         wpas_abort_ongoing_scan(wpa_s);
1732
1733         cwork = os_zalloc(sizeof(*cwork));
1734         if (cwork == NULL)
1735                 return;
1736
1737         cwork->bss = bss;
1738         cwork->ssid = ssid;
1739
1740         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1741                            wpas_start_assoc_cb, cwork) < 0) {
1742                 os_free(cwork);
1743         }
1744 }
1745
1746
1747 static int bss_is_ibss(struct wpa_bss *bss)
1748 {
1749         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1750                 IEEE80211_CAP_IBSS;
1751 }
1752
1753
1754 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1755                             const struct wpa_ssid *ssid)
1756 {
1757         enum hostapd_hw_mode hw_mode;
1758         struct hostapd_hw_modes *mode = NULL;
1759         u8 channel;
1760         int i;
1761
1762 #ifdef CONFIG_HT_OVERRIDES
1763         if (ssid->disable_ht)
1764                 return 0;
1765 #endif /* CONFIG_HT_OVERRIDES */
1766
1767         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1768         if (hw_mode == NUM_HOSTAPD_MODES)
1769                 return 0;
1770         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1771                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1772                         mode = &wpa_s->hw.modes[i];
1773                         break;
1774                 }
1775         }
1776
1777         if (!mode)
1778                 return 0;
1779
1780         return mode->vht_capab != 0;
1781 }
1782
1783
1784 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1785                           const struct wpa_ssid *ssid,
1786                           struct hostapd_freq_params *freq)
1787 {
1788         enum hostapd_hw_mode hw_mode;
1789         struct hostapd_hw_modes *mode = NULL;
1790         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1791                            184, 192 };
1792         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1793         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1794         u8 channel;
1795         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1796         unsigned int j, k;
1797         struct hostapd_freq_params vht_freq;
1798         int chwidth, seg0, seg1;
1799         u32 vht_caps = 0;
1800
1801         freq->freq = ssid->frequency;
1802
1803         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1804                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1805
1806                 if (ssid->mode != WPAS_MODE_IBSS)
1807                         break;
1808
1809                 /* Don't adjust control freq in case of fixed_freq */
1810                 if (ssid->fixed_freq)
1811                         break;
1812
1813                 if (!bss_is_ibss(bss))
1814                         continue;
1815
1816                 if (ssid->ssid_len == bss->ssid_len &&
1817                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1818                         wpa_printf(MSG_DEBUG,
1819                                    "IBSS already found in scan results, adjust control freq: %d",
1820                                    bss->freq);
1821                         freq->freq = bss->freq;
1822                         obss_scan = 0;
1823                         break;
1824                 }
1825         }
1826
1827         /* For IBSS check HT_IBSS flag */
1828         if (ssid->mode == WPAS_MODE_IBSS &&
1829             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1830                 return;
1831
1832         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1833             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1834             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1835                 wpa_printf(MSG_DEBUG,
1836                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1837                 return;
1838         }
1839
1840         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1841         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1842                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1843                         mode = &wpa_s->hw.modes[i];
1844                         break;
1845                 }
1846         }
1847
1848         if (!mode)
1849                 return;
1850
1851         freq->ht_enabled = ht_supported(mode);
1852         if (!freq->ht_enabled)
1853                 return;
1854
1855         /* Setup higher BW only for 5 GHz */
1856         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1857                 return;
1858
1859         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1860                 pri_chan = &mode->channels[chan_idx];
1861                 if (pri_chan->chan == channel)
1862                         break;
1863                 pri_chan = NULL;
1864         }
1865         if (!pri_chan)
1866                 return;
1867
1868         /* Check primary channel flags */
1869         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1870                 return;
1871
1872         /* Check/setup HT40+/HT40- */
1873         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1874                 if (ht40plus[j] == channel) {
1875                         ht40 = 1;
1876                         break;
1877                 }
1878         }
1879
1880         /* Find secondary channel */
1881         for (i = 0; i < mode->num_channels; i++) {
1882                 sec_chan = &mode->channels[i];
1883                 if (sec_chan->chan == channel + ht40 * 4)
1884                         break;
1885                 sec_chan = NULL;
1886         }
1887         if (!sec_chan)
1888                 return;
1889
1890         /* Check secondary channel flags */
1891         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1892                 return;
1893
1894         freq->channel = pri_chan->chan;
1895
1896         switch (ht40) {
1897         case -1:
1898                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1899                         return;
1900                 freq->sec_channel_offset = -1;
1901                 break;
1902         case 1:
1903                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1904                         return;
1905                 freq->sec_channel_offset = 1;
1906                 break;
1907         default:
1908                 break;
1909         }
1910
1911         if (freq->sec_channel_offset && obss_scan) {
1912                 struct wpa_scan_results *scan_res;
1913
1914                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1915                 if (scan_res == NULL) {
1916                         /* Back to HT20 */
1917                         freq->sec_channel_offset = 0;
1918                         return;
1919                 }
1920
1921                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1922                                      sec_chan->chan);
1923                 switch (res) {
1924                 case 0:
1925                         /* Back to HT20 */
1926                         freq->sec_channel_offset = 0;
1927                         break;
1928                 case 1:
1929                         /* Configuration allowed */
1930                         break;
1931                 case 2:
1932                         /* Switch pri/sec channels */
1933                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1934                         freq->sec_channel_offset = -freq->sec_channel_offset;
1935                         freq->channel = sec_chan->chan;
1936                         break;
1937                 default:
1938                         freq->sec_channel_offset = 0;
1939                         break;
1940                 }
1941
1942                 wpa_scan_results_free(scan_res);
1943         }
1944
1945         wpa_printf(MSG_DEBUG,
1946                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1947                    freq->channel, freq->sec_channel_offset);
1948
1949         if (!drv_supports_vht(wpa_s, ssid))
1950                 return;
1951
1952         /* For IBSS check VHT_IBSS flag */
1953         if (ssid->mode == WPAS_MODE_IBSS &&
1954             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1955                 return;
1956
1957         vht_freq = *freq;
1958
1959         vht_freq.vht_enabled = vht_supported(mode);
1960         if (!vht_freq.vht_enabled)
1961                 return;
1962
1963         /* setup center_freq1, bandwidth */
1964         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1965                 if (freq->channel >= vht80[j] &&
1966                     freq->channel < vht80[j] + 16)
1967                         break;
1968         }
1969
1970         if (j == ARRAY_SIZE(vht80))
1971                 return;
1972
1973         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1974                 struct hostapd_channel_data *chan;
1975
1976                 chan = hw_get_channel_chan(mode, i, NULL);
1977                 if (!chan)
1978                         return;
1979
1980                 /* Back to HT configuration if channel not usable */
1981                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1982                         return;
1983         }
1984
1985         chwidth = VHT_CHANWIDTH_80MHZ;
1986         seg0 = vht80[j] + 6;
1987         seg1 = 0;
1988
1989         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
1990                 /* setup center_freq2, bandwidth */
1991                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
1992                         /* Only accept 80 MHz segments separated by a gap */
1993                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
1994                                 continue;
1995                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
1996                                 struct hostapd_channel_data *chan;
1997
1998                                 chan = hw_get_channel_chan(mode, i, NULL);
1999                                 if (!chan)
2000                                         continue;
2001
2002                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2003                                                   HOSTAPD_CHAN_NO_IR |
2004                                                   HOSTAPD_CHAN_RADAR))
2005                                         continue;
2006
2007                                 /* Found a suitable second segment for 80+80 */
2008                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2009                                 vht_caps |=
2010                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2011                                 seg1 = vht80[k] + 6;
2012                         }
2013
2014                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2015                                 break;
2016                 }
2017         }
2018
2019         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2020                                     freq->channel, freq->ht_enabled,
2021                                     vht_freq.vht_enabled,
2022                                     freq->sec_channel_offset,
2023                                     chwidth, seg0, seg1, vht_caps) != 0)
2024                 return;
2025
2026         *freq = vht_freq;
2027
2028         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2029                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2030 }
2031
2032
2033 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2034 {
2035         struct wpa_connect_work *cwork = work->ctx;
2036         struct wpa_bss *bss = cwork->bss;
2037         struct wpa_ssid *ssid = cwork->ssid;
2038         struct wpa_supplicant *wpa_s = work->wpa_s;
2039         u8 wpa_ie[200];
2040         size_t wpa_ie_len;
2041         int use_crypt, ret, i, bssid_changed;
2042         int algs = WPA_AUTH_ALG_OPEN;
2043         unsigned int cipher_pairwise, cipher_group;
2044         struct wpa_driver_associate_params params;
2045         int wep_keys_set = 0;
2046         int assoc_failed = 0;
2047         struct wpa_ssid *old_ssid;
2048 #ifdef CONFIG_HT_OVERRIDES
2049         struct ieee80211_ht_capabilities htcaps;
2050         struct ieee80211_ht_capabilities htcaps_mask;
2051 #endif /* CONFIG_HT_OVERRIDES */
2052 #ifdef CONFIG_VHT_OVERRIDES
2053        struct ieee80211_vht_capabilities vhtcaps;
2054        struct ieee80211_vht_capabilities vhtcaps_mask;
2055 #endif /* CONFIG_VHT_OVERRIDES */
2056 #ifdef CONFIG_MBO
2057         const u8 *mbo = NULL;
2058 #endif /* CONFIG_MBO */
2059
2060         if (deinit) {
2061                 if (work->started) {
2062                         wpa_s->connect_work = NULL;
2063
2064                         /* cancel possible auth. timeout */
2065                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2066                                              NULL);
2067                 }
2068                 wpas_connect_work_free(cwork);
2069                 return;
2070         }
2071
2072         wpa_s->connect_work = work;
2073
2074         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2075             wpas_network_disabled(wpa_s, ssid)) {
2076                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2077                 wpas_connect_work_done(wpa_s);
2078                 return;
2079         }
2080
2081         os_memset(&params, 0, sizeof(params));
2082         wpa_s->reassociate = 0;
2083         wpa_s->eap_expected_failure = 0;
2084         if (bss &&
2085             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2086 #ifdef CONFIG_IEEE80211R
2087                 const u8 *ie, *md = NULL;
2088 #endif /* CONFIG_IEEE80211R */
2089                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2090                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2091                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2092                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2093                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2094                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2095                 if (bssid_changed)
2096                         wpas_notify_bssid_changed(wpa_s);
2097 #ifdef CONFIG_IEEE80211R
2098                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2099                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2100                         md = ie + 2;
2101                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2102                 if (md) {
2103                         /* Prepare for the next transition */
2104                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2105                 }
2106 #endif /* CONFIG_IEEE80211R */
2107 #ifdef CONFIG_WPS
2108         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2109                    wpa_s->conf->ap_scan == 2 &&
2110                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2111                 /* Use ap_scan==1 style network selection to find the network
2112                  */
2113                 wpas_connect_work_done(wpa_s);
2114                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2115                 wpa_s->reassociate = 1;
2116                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2117                 return;
2118 #endif /* CONFIG_WPS */
2119         } else {
2120                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2121                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2122                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2123         }
2124         if (!wpa_s->pno)
2125                 wpa_supplicant_cancel_sched_scan(wpa_s);
2126
2127         wpa_supplicant_cancel_scan(wpa_s);
2128
2129         /* Starting new association, so clear the possibly used WPA IE from the
2130          * previous association. */
2131         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2132
2133 #ifdef IEEE8021X_EAPOL
2134         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2135                 if (ssid->leap) {
2136                         if (ssid->non_leap == 0)
2137                                 algs = WPA_AUTH_ALG_LEAP;
2138                         else
2139                                 algs |= WPA_AUTH_ALG_LEAP;
2140                 }
2141         }
2142 #endif /* IEEE8021X_EAPOL */
2143         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2144         if (ssid->auth_alg) {
2145                 algs = ssid->auth_alg;
2146                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2147                         "0x%x", algs);
2148         }
2149
2150         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2151                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2152             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2153                 int try_opportunistic;
2154                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2155                                      wpa_s->conf->okc :
2156                                      ssid->proactive_key_caching) &&
2157                         (ssid->proto & WPA_PROTO_RSN);
2158                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2159                                             ssid, try_opportunistic) == 0)
2160                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2161                 wpa_ie_len = sizeof(wpa_ie);
2162                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2163                                               wpa_ie, &wpa_ie_len)) {
2164                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2165                                 "key management and encryption suites");
2166                         wpas_connect_work_done(wpa_s);
2167                         return;
2168                 }
2169         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2170                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2171                 /*
2172                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2173                  * use non-WPA since the scan results did not indicate that the
2174                  * AP is using WPA or WPA2.
2175                  */
2176                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2177                 wpa_ie_len = 0;
2178                 wpa_s->wpa_proto = 0;
2179         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2180                 wpa_ie_len = sizeof(wpa_ie);
2181                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2182                                               wpa_ie, &wpa_ie_len)) {
2183                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2184                                 "key management and encryption suites (no "
2185                                 "scan results)");
2186                         wpas_connect_work_done(wpa_s);
2187                         return;
2188                 }
2189 #ifdef CONFIG_WPS
2190         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2191                 struct wpabuf *wps_ie;
2192                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2193                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2194                         wpa_ie_len = wpabuf_len(wps_ie);
2195                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2196                 } else
2197                         wpa_ie_len = 0;
2198                 wpabuf_free(wps_ie);
2199                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2200                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2201                         params.wps = WPS_MODE_PRIVACY;
2202                 else
2203                         params.wps = WPS_MODE_OPEN;
2204                 wpa_s->wpa_proto = 0;
2205 #endif /* CONFIG_WPS */
2206         } else {
2207                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2208                 wpa_ie_len = 0;
2209                 wpa_s->wpa_proto = 0;
2210         }
2211
2212 #ifdef CONFIG_P2P
2213         if (wpa_s->global->p2p) {
2214                 u8 *pos;
2215                 size_t len;
2216                 int res;
2217                 pos = wpa_ie + wpa_ie_len;
2218                 len = sizeof(wpa_ie) - wpa_ie_len;
2219                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2220                                             ssid->p2p_group);
2221                 if (res >= 0)
2222                         wpa_ie_len += res;
2223         }
2224
2225         wpa_s->cross_connect_disallowed = 0;
2226         if (bss) {
2227                 struct wpabuf *p2p;
2228                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2229                 if (p2p) {
2230                         wpa_s->cross_connect_disallowed =
2231                                 p2p_get_cross_connect_disallowed(p2p);
2232                         wpabuf_free(p2p);
2233                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2234                                 "connection",
2235                                 wpa_s->cross_connect_disallowed ?
2236                                 "disallows" : "allows");
2237                 }
2238         }
2239
2240         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2241 #endif /* CONFIG_P2P */
2242
2243 #ifdef CONFIG_HS20
2244         if (is_hs20_network(wpa_s, ssid, bss)) {
2245                 struct wpabuf *hs20;
2246                 hs20 = wpabuf_alloc(20);
2247                 if (hs20) {
2248                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2249                         size_t len;
2250
2251                         wpas_hs20_add_indication(hs20, pps_mo_id);
2252                         len = sizeof(wpa_ie) - wpa_ie_len;
2253                         if (wpabuf_len(hs20) <= len) {
2254                                 os_memcpy(wpa_ie + wpa_ie_len,
2255                                           wpabuf_head(hs20), wpabuf_len(hs20));
2256                                 wpa_ie_len += wpabuf_len(hs20);
2257                         }
2258                         wpabuf_free(hs20);
2259                 }
2260         }
2261 #endif /* CONFIG_HS20 */
2262
2263 #ifdef CONFIG_MBO
2264         if (bss) {
2265                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2266                 if (mbo) {
2267                         int len;
2268
2269                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2270                                                         wpa_ie + wpa_ie_len,
2271                                                         sizeof(wpa_ie) -
2272                                                         wpa_ie_len);
2273                         if (len > 0)
2274                                 wpa_ie_len += len;
2275                 }
2276         }
2277 #endif /* CONFIG_MBO */
2278
2279         /*
2280          * Workaround: Add Extended Capabilities element only if the AP
2281          * included this element in Beacon/Probe Response frames. Some older
2282          * APs seem to have interoperability issues if this element is
2283          * included, so while the standard may require us to include the
2284          * element in all cases, it is justifiable to skip it to avoid
2285          * interoperability issues.
2286          */
2287         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2288                 u8 ext_capab[18];
2289                 int ext_capab_len;
2290                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2291                                                      sizeof(ext_capab));
2292                 if (ext_capab_len > 0) {
2293                         u8 *pos = wpa_ie;
2294                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2295                                 pos += 2 + pos[1];
2296                         os_memmove(pos + ext_capab_len, pos,
2297                                    wpa_ie_len - (pos - wpa_ie));
2298                         wpa_ie_len += ext_capab_len;
2299                         os_memcpy(pos, ext_capab, ext_capab_len);
2300                 }
2301         }
2302
2303         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2304                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2305                 size_t len;
2306
2307                 len = sizeof(wpa_ie) - wpa_ie_len;
2308                 if (wpabuf_len(buf) <= len) {
2309                         os_memcpy(wpa_ie + wpa_ie_len,
2310                                   wpabuf_head(buf), wpabuf_len(buf));
2311                         wpa_ie_len += wpabuf_len(buf);
2312                 }
2313         }
2314
2315 #ifdef CONFIG_FST
2316         if (wpa_s->fst_ies) {
2317                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2318
2319                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2320                         os_memcpy(wpa_ie + wpa_ie_len,
2321                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2322                         wpa_ie_len += fst_ies_len;
2323                 }
2324         }
2325 #endif /* CONFIG_FST */
2326
2327 #ifdef CONFIG_MBO
2328         if (mbo) {
2329                 int len;
2330
2331                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2332                                   sizeof(wpa_ie) - wpa_ie_len);
2333                 if (len >= 0)
2334                         wpa_ie_len += len;
2335         }
2336 #endif /* CONFIG_MBO */
2337
2338         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2339         use_crypt = 1;
2340         cipher_pairwise = wpa_s->pairwise_cipher;
2341         cipher_group = wpa_s->group_cipher;
2342         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2343             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2344                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2345                         use_crypt = 0;
2346                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2347                         use_crypt = 1;
2348                         wep_keys_set = 1;
2349                 }
2350         }
2351         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2352                 use_crypt = 0;
2353
2354 #ifdef IEEE8021X_EAPOL
2355         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2356                 if ((ssid->eapol_flags &
2357                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2358                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2359                     !wep_keys_set) {
2360                         use_crypt = 0;
2361                 } else {
2362                         /* Assume that dynamic WEP-104 keys will be used and
2363                          * set cipher suites in order for drivers to expect
2364                          * encryption. */
2365                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2366                 }
2367         }
2368 #endif /* IEEE8021X_EAPOL */
2369
2370         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2371                 /* Set the key before (and later after) association */
2372                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2373         }
2374
2375         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2376         if (bss) {
2377                 params.ssid = bss->ssid;
2378                 params.ssid_len = bss->ssid_len;
2379                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2380                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2381                                    MACSTR " freq=%u MHz based on scan results "
2382                                    "(bssid_set=%d)",
2383                                    MAC2STR(bss->bssid), bss->freq,
2384                                    ssid->bssid_set);
2385                         params.bssid = bss->bssid;
2386                         params.freq.freq = bss->freq;
2387                 }
2388                 params.bssid_hint = bss->bssid;
2389                 params.freq_hint = bss->freq;
2390                 params.pbss = bss_is_pbss(bss);
2391         } else {
2392                 params.ssid = ssid->ssid;
2393                 params.ssid_len = ssid->ssid_len;
2394                 params.pbss = ssid->pbss;
2395         }
2396
2397         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2398             wpa_s->conf->ap_scan == 2) {
2399                 params.bssid = ssid->bssid;
2400                 params.fixed_bssid = 1;
2401         }
2402
2403         /* Initial frequency for IBSS/mesh */
2404         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2405             ssid->frequency > 0 && params.freq.freq == 0)
2406                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2407
2408         if (ssid->mode == WPAS_MODE_IBSS) {
2409                 params.fixed_freq = ssid->fixed_freq;
2410                 if (ssid->beacon_int)
2411                         params.beacon_int = ssid->beacon_int;
2412                 else
2413                         params.beacon_int = wpa_s->conf->beacon_int;
2414         }
2415
2416         params.wpa_ie = wpa_ie;
2417         params.wpa_ie_len = wpa_ie_len;
2418         params.pairwise_suite = cipher_pairwise;
2419         params.group_suite = cipher_group;
2420         params.key_mgmt_suite = wpa_s->key_mgmt;
2421         params.wpa_proto = wpa_s->wpa_proto;
2422         params.auth_alg = algs;
2423         params.mode = ssid->mode;
2424         params.bg_scan_period = ssid->bg_scan_period;
2425         for (i = 0; i < NUM_WEP_KEYS; i++) {
2426                 if (ssid->wep_key_len[i])
2427                         params.wep_key[i] = ssid->wep_key[i];
2428                 params.wep_key_len[i] = ssid->wep_key_len[i];
2429         }
2430         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2431
2432         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2433             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2434              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2435                 params.passphrase = ssid->passphrase;
2436                 if (ssid->psk_set)
2437                         params.psk = ssid->psk;
2438         }
2439
2440         if (wpa_s->conf->key_mgmt_offload) {
2441                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2442                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2443                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2444                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2445                         params.req_key_mgmt_offload =
2446                                 ssid->proactive_key_caching < 0 ?
2447                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2448                 else
2449                         params.req_key_mgmt_offload = 1;
2450
2451                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2452                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2453                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2454                     ssid->psk_set)
2455                         params.psk = ssid->psk;
2456         }
2457
2458         params.drop_unencrypted = use_crypt;
2459
2460 #ifdef CONFIG_IEEE80211W
2461         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2462         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2463                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2464                 struct wpa_ie_data ie;
2465                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2466                     ie.capabilities &
2467                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2468                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2469                                 "MFP: require MFP");
2470                         params.mgmt_frame_protection =
2471                                 MGMT_FRAME_PROTECTION_REQUIRED;
2472                 }
2473         }
2474 #endif /* CONFIG_IEEE80211W */
2475
2476         params.p2p = ssid->p2p_group;
2477
2478         if (wpa_s->parent->set_sta_uapsd)
2479                 params.uapsd = wpa_s->parent->sta_uapsd;
2480         else
2481                 params.uapsd = -1;
2482
2483 #ifdef CONFIG_HT_OVERRIDES
2484         os_memset(&htcaps, 0, sizeof(htcaps));
2485         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2486         params.htcaps = (u8 *) &htcaps;
2487         params.htcaps_mask = (u8 *) &htcaps_mask;
2488         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2489 #endif /* CONFIG_HT_OVERRIDES */
2490 #ifdef CONFIG_VHT_OVERRIDES
2491         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2492         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2493         params.vhtcaps = &vhtcaps;
2494         params.vhtcaps_mask = &vhtcaps_mask;
2495         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2496 #endif /* CONFIG_VHT_OVERRIDES */
2497
2498 #ifdef CONFIG_P2P
2499         /*
2500          * If multi-channel concurrency is not supported, check for any
2501          * frequency conflict. In case of any frequency conflict, remove the
2502          * least prioritized connection.
2503          */
2504         if (wpa_s->num_multichan_concurrent < 2) {
2505                 int freq, num;
2506                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2507                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2508                         wpa_printf(MSG_DEBUG,
2509                                    "Assoc conflicting freq found (%d != %d)",
2510                                    freq, params.freq.freq);
2511                         if (wpas_p2p_handle_frequency_conflicts(
2512                                     wpa_s, params.freq.freq, ssid) < 0) {
2513                                 wpas_connect_work_done(wpa_s);
2514                                 return;
2515                         }
2516                 }
2517         }
2518 #endif /* CONFIG_P2P */
2519
2520         ret = wpa_drv_associate(wpa_s, &params);
2521         if (ret < 0) {
2522                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2523                         "failed");
2524                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2525                         /*
2526                          * The driver is known to mean what is saying, so we
2527                          * can stop right here; the association will not
2528                          * succeed.
2529                          */
2530                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2531                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2532                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2533                         return;
2534                 }
2535                 /* try to continue anyway; new association will be tried again
2536                  * after timeout */
2537                 assoc_failed = 1;
2538         }
2539
2540         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2541                 /* Set the key after the association just in case association
2542                  * cleared the previously configured key. */
2543                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2544                 /* No need to timeout authentication since there is no key
2545                  * management. */
2546                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2547                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2548 #ifdef CONFIG_IBSS_RSN
2549         } else if (ssid->mode == WPAS_MODE_IBSS &&
2550                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2551                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2552                 /*
2553                  * RSN IBSS authentication is per-STA and we can disable the
2554                  * per-BSSID authentication.
2555                  */
2556                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2557 #endif /* CONFIG_IBSS_RSN */
2558         } else {
2559                 /* Timeout for IEEE 802.11 authentication and association */
2560                 int timeout = 60;
2561
2562                 if (assoc_failed) {
2563                         /* give IBSS a bit more time */
2564                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2565                 } else if (wpa_s->conf->ap_scan == 1) {
2566                         /* give IBSS a bit more time */
2567                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2568                 }
2569                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2570         }
2571
2572         if (wep_keys_set &&
2573             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2574                 /* Set static WEP keys again */
2575                 wpa_set_wep_keys(wpa_s, ssid);
2576         }
2577
2578         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2579                 /*
2580                  * Do not allow EAP session resumption between different
2581                  * network configurations.
2582                  */
2583                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2584         }
2585         old_ssid = wpa_s->current_ssid;
2586         wpa_s->current_ssid = ssid;
2587         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2588                 wpa_s->current_bss = bss;
2589         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2590         wpa_supplicant_initiate_eapol(wpa_s);
2591         if (old_ssid != wpa_s->current_ssid)
2592                 wpas_notify_network_changed(wpa_s);
2593 }
2594
2595
2596 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2597                                             const u8 *addr)
2598 {
2599         struct wpa_ssid *old_ssid;
2600
2601         wpas_connect_work_done(wpa_s);
2602         wpa_clear_keys(wpa_s, addr);
2603         old_ssid = wpa_s->current_ssid;
2604         wpa_supplicant_mark_disassoc(wpa_s);
2605         wpa_sm_set_config(wpa_s->wpa, NULL);
2606         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2607         if (old_ssid != wpa_s->current_ssid)
2608                 wpas_notify_network_changed(wpa_s);
2609         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2610 }
2611
2612
2613 /**
2614  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2615  * @wpa_s: Pointer to wpa_supplicant data
2616  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2617  *
2618  * This function is used to request %wpa_supplicant to deauthenticate from the
2619  * current AP.
2620  */
2621 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2622                                    int reason_code)
2623 {
2624         u8 *addr = NULL;
2625         union wpa_event_data event;
2626         int zero_addr = 0;
2627
2628         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2629                 " pending_bssid=" MACSTR " reason=%d state=%s",
2630                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2631                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2632
2633         if (!is_zero_ether_addr(wpa_s->bssid))
2634                 addr = wpa_s->bssid;
2635         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2636                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2637                   wpa_s->wpa_state == WPA_ASSOCIATING))
2638                 addr = wpa_s->pending_bssid;
2639         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2640                 /*
2641                  * When using driver-based BSS selection, we may not know the
2642                  * BSSID with which we are currently trying to associate. We
2643                  * need to notify the driver of this disconnection even in such
2644                  * a case, so use the all zeros address here.
2645                  */
2646                 addr = wpa_s->bssid;
2647                 zero_addr = 1;
2648         }
2649
2650 #ifdef CONFIG_TDLS
2651         wpa_tdls_teardown_peers(wpa_s->wpa);
2652 #endif /* CONFIG_TDLS */
2653
2654 #ifdef CONFIG_MESH
2655         if (wpa_s->ifmsh) {
2656                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2657                         wpa_s->ifname);
2658                 wpa_supplicant_leave_mesh(wpa_s);
2659         }
2660 #endif /* CONFIG_MESH */
2661
2662         if (addr) {
2663                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2664                 os_memset(&event, 0, sizeof(event));
2665                 event.deauth_info.reason_code = (u16) reason_code;
2666                 event.deauth_info.locally_generated = 1;
2667                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2668                 if (zero_addr)
2669                         addr = NULL;
2670         }
2671
2672         wpa_supplicant_clear_connection(wpa_s, addr);
2673 }
2674
2675 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2676                                               struct wpa_ssid *ssid)
2677 {
2678         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2679                 return;
2680
2681         ssid->disabled = 0;
2682         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2683         wpas_notify_network_enabled_changed(wpa_s, ssid);
2684
2685         /*
2686          * Try to reassociate since there is no current configuration and a new
2687          * network was made available.
2688          */
2689         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2690                 wpa_s->reassociate = 1;
2691 }
2692
2693
2694 /**
2695  * wpa_supplicant_enable_network - Mark a configured network as enabled
2696  * @wpa_s: wpa_supplicant structure for a network interface
2697  * @ssid: wpa_ssid structure for a configured network or %NULL
2698  *
2699  * Enables the specified network or all networks if no network specified.
2700  */
2701 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2702                                    struct wpa_ssid *ssid)
2703 {
2704         if (ssid == NULL) {
2705                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2706                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2707         } else
2708                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2709
2710         if (wpa_s->reassociate && !wpa_s->disconnected &&
2711             (!wpa_s->current_ssid ||
2712              wpa_s->wpa_state == WPA_DISCONNECTED ||
2713              wpa_s->wpa_state == WPA_SCANNING)) {
2714                 if (wpa_s->sched_scanning) {
2715                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2716                                    "new network to scan filters");
2717                         wpa_supplicant_cancel_sched_scan(wpa_s);
2718                 }
2719
2720                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2721                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2722                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2723                 }
2724         }
2725 }
2726
2727
2728 /**
2729  * wpa_supplicant_disable_network - Mark a configured network as disabled
2730  * @wpa_s: wpa_supplicant structure for a network interface
2731  * @ssid: wpa_ssid structure for a configured network or %NULL
2732  *
2733  * Disables the specified network or all networks if no network specified.
2734  */
2735 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2736                                     struct wpa_ssid *ssid)
2737 {
2738         struct wpa_ssid *other_ssid;
2739         int was_disabled;
2740
2741         if (ssid == NULL) {
2742                 if (wpa_s->sched_scanning)
2743                         wpa_supplicant_cancel_sched_scan(wpa_s);
2744
2745                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2746                      other_ssid = other_ssid->next) {
2747                         was_disabled = other_ssid->disabled;
2748                         if (was_disabled == 2)
2749                                 continue; /* do not change persistent P2P group
2750                                            * data */
2751
2752                         other_ssid->disabled = 1;
2753
2754                         if (was_disabled != other_ssid->disabled)
2755                                 wpas_notify_network_enabled_changed(
2756                                         wpa_s, other_ssid);
2757                 }
2758                 if (wpa_s->current_ssid)
2759                         wpa_supplicant_deauthenticate(
2760                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2761         } else if (ssid->disabled != 2) {
2762                 if (ssid == wpa_s->current_ssid)
2763                         wpa_supplicant_deauthenticate(
2764                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2765
2766                 was_disabled = ssid->disabled;
2767
2768                 ssid->disabled = 1;
2769
2770                 if (was_disabled != ssid->disabled) {
2771                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2772                         if (wpa_s->sched_scanning) {
2773                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2774                                            "to remove network from filters");
2775                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2776                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2777                         }
2778                 }
2779         }
2780 }
2781
2782
2783 /**
2784  * wpa_supplicant_select_network - Attempt association with a network
2785  * @wpa_s: wpa_supplicant structure for a network interface
2786  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2787  */
2788 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2789                                    struct wpa_ssid *ssid)
2790 {
2791
2792         struct wpa_ssid *other_ssid;
2793         int disconnected = 0;
2794
2795         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2796                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2797                         wpa_s->own_disconnect_req = 1;
2798                 wpa_supplicant_deauthenticate(
2799                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2800                 disconnected = 1;
2801         }
2802
2803         if (ssid)
2804                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2805
2806         /*
2807          * Mark all other networks disabled or mark all networks enabled if no
2808          * network specified.
2809          */
2810         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2811              other_ssid = other_ssid->next) {
2812                 int was_disabled = other_ssid->disabled;
2813                 if (was_disabled == 2)
2814                         continue; /* do not change persistent P2P group data */
2815
2816                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2817                 if (was_disabled && !other_ssid->disabled)
2818                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2819
2820                 if (was_disabled != other_ssid->disabled)
2821                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2822         }
2823
2824         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2825             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2826                 /* We are already associated with the selected network */
2827                 wpa_printf(MSG_DEBUG, "Already associated with the "
2828                            "selected network - do nothing");
2829                 return;
2830         }
2831
2832         if (ssid) {
2833                 wpa_s->current_ssid = ssid;
2834                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2835                 wpa_s->connect_without_scan =
2836                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2837
2838                 /*
2839                  * Don't optimize next scan freqs since a new ESS has been
2840                  * selected.
2841                  */
2842                 os_free(wpa_s->next_scan_freqs);
2843                 wpa_s->next_scan_freqs = NULL;
2844         } else {
2845                 wpa_s->connect_without_scan = NULL;
2846         }
2847
2848         wpa_s->disconnected = 0;
2849         wpa_s->reassociate = 1;
2850
2851         if (wpa_s->connect_without_scan ||
2852             wpa_supplicant_fast_associate(wpa_s) != 1) {
2853                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2854                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2855         }
2856
2857         if (ssid)
2858                 wpas_notify_network_selected(wpa_s, ssid);
2859 }
2860
2861
2862 /**
2863  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2864  * @wpa_s: wpa_supplicant structure for a network interface
2865  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2866  * @pkcs11_module_path: PKCS #11 module path or NULL
2867  * Returns: 0 on success; -1 on failure
2868  *
2869  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2870  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2871  * module path fails the paths will be reset to the default value (NULL).
2872  */
2873 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2874                                            const char *pkcs11_engine_path,
2875                                            const char *pkcs11_module_path)
2876 {
2877         char *pkcs11_engine_path_copy = NULL;
2878         char *pkcs11_module_path_copy = NULL;
2879
2880         if (pkcs11_engine_path != NULL) {
2881                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2882                 if (pkcs11_engine_path_copy == NULL)
2883                         return -1;
2884         }
2885         if (pkcs11_module_path != NULL) {
2886                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2887                 if (pkcs11_module_path_copy == NULL) {
2888                         os_free(pkcs11_engine_path_copy);
2889                         return -1;
2890                 }
2891         }
2892
2893         os_free(wpa_s->conf->pkcs11_engine_path);
2894         os_free(wpa_s->conf->pkcs11_module_path);
2895         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2896         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2897
2898         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2899         eapol_sm_deinit(wpa_s->eapol);
2900         wpa_s->eapol = NULL;
2901         if (wpa_supplicant_init_eapol(wpa_s)) {
2902                 /* Error -> Reset paths to the default value (NULL) once. */
2903                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2904                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2905                                                                NULL);
2906
2907                 return -1;
2908         }
2909         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2910
2911         return 0;
2912 }
2913
2914
2915 /**
2916  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2917  * @wpa_s: wpa_supplicant structure for a network interface
2918  * @ap_scan: AP scan mode
2919  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2920  *
2921  */
2922 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2923 {
2924
2925         int old_ap_scan;
2926
2927         if (ap_scan < 0 || ap_scan > 2)
2928                 return -1;
2929
2930         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2931                 wpa_printf(MSG_INFO,
2932                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2933         }
2934
2935 #ifdef ANDROID
2936         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2937             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2938             wpa_s->wpa_state < WPA_COMPLETED) {
2939                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2940                            "associating", wpa_s->conf->ap_scan, ap_scan);
2941                 return 0;
2942         }
2943 #endif /* ANDROID */
2944
2945         old_ap_scan = wpa_s->conf->ap_scan;
2946         wpa_s->conf->ap_scan = ap_scan;
2947
2948         if (old_ap_scan != wpa_s->conf->ap_scan)
2949                 wpas_notify_ap_scan_changed(wpa_s);
2950
2951         return 0;
2952 }
2953
2954
2955 /**
2956  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2957  * @wpa_s: wpa_supplicant structure for a network interface
2958  * @expire_age: Expiration age in seconds
2959  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2960  *
2961  */
2962 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2963                                           unsigned int bss_expire_age)
2964 {
2965         if (bss_expire_age < 10) {
2966                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2967                         bss_expire_age);
2968                 return -1;
2969         }
2970         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2971                 bss_expire_age);
2972         wpa_s->conf->bss_expiration_age = bss_expire_age;
2973
2974         return 0;
2975 }
2976
2977
2978 /**
2979  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2980  * @wpa_s: wpa_supplicant structure for a network interface
2981  * @expire_count: number of scans after which an unseen BSS is reclaimed
2982  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2983  *
2984  */
2985 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2986                                             unsigned int bss_expire_count)
2987 {
2988         if (bss_expire_count < 1) {
2989                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2990                         bss_expire_count);
2991                 return -1;
2992         }
2993         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2994                 bss_expire_count);
2995         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2996
2997         return 0;
2998 }
2999
3000
3001 /**
3002  * wpa_supplicant_set_scan_interval - Set scan interval
3003  * @wpa_s: wpa_supplicant structure for a network interface
3004  * @scan_interval: scan interval in seconds
3005  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3006  *
3007  */
3008 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3009                                      int scan_interval)
3010 {
3011         if (scan_interval < 0) {
3012                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3013                         scan_interval);
3014                 return -1;
3015         }
3016         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3017                 scan_interval);
3018         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3019
3020         return 0;
3021 }
3022
3023
3024 /**
3025  * wpa_supplicant_set_debug_params - Set global debug params
3026  * @global: wpa_global structure
3027  * @debug_level: debug level
3028  * @debug_timestamp: determines if show timestamp in debug data
3029  * @debug_show_keys: determines if show keys in debug data
3030  * Returns: 0 if succeed or -1 if debug_level has wrong value
3031  */
3032 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3033                                     int debug_timestamp, int debug_show_keys)
3034 {
3035
3036         int old_level, old_timestamp, old_show_keys;
3037
3038         /* check for allowed debuglevels */
3039         if (debug_level != MSG_EXCESSIVE &&
3040             debug_level != MSG_MSGDUMP &&
3041             debug_level != MSG_DEBUG &&
3042             debug_level != MSG_INFO &&
3043             debug_level != MSG_WARNING &&
3044             debug_level != MSG_ERROR)
3045                 return -1;
3046
3047         old_level = wpa_debug_level;
3048         old_timestamp = wpa_debug_timestamp;
3049         old_show_keys = wpa_debug_show_keys;
3050
3051         wpa_debug_level = debug_level;
3052         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3053         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3054
3055         if (wpa_debug_level != old_level)
3056                 wpas_notify_debug_level_changed(global);
3057         if (wpa_debug_timestamp != old_timestamp)
3058                 wpas_notify_debug_timestamp_changed(global);
3059         if (wpa_debug_show_keys != old_show_keys)
3060                 wpas_notify_debug_show_keys_changed(global);
3061
3062         return 0;
3063 }
3064
3065
3066 /**
3067  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3068  * @wpa_s: Pointer to wpa_supplicant data
3069  * Returns: A pointer to the current network structure or %NULL on failure
3070  */
3071 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3072 {
3073         struct wpa_ssid *entry;
3074         u8 ssid[SSID_MAX_LEN];
3075         int res;
3076         size_t ssid_len;
3077         u8 bssid[ETH_ALEN];
3078         int wired;
3079
3080         res = wpa_drv_get_ssid(wpa_s, ssid);
3081         if (res < 0) {
3082                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3083                         "driver");
3084                 return NULL;
3085         }
3086         ssid_len = res;
3087
3088         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3089                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3090                         "driver");
3091                 return NULL;
3092         }
3093
3094         wired = wpa_s->conf->ap_scan == 0 &&
3095                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3096
3097         entry = wpa_s->conf->ssid;
3098         while (entry) {
3099                 if (!wpas_network_disabled(wpa_s, entry) &&
3100                     ((ssid_len == entry->ssid_len &&
3101                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3102                     (!entry->bssid_set ||
3103                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3104                         return entry;
3105 #ifdef CONFIG_WPS
3106                 if (!wpas_network_disabled(wpa_s, entry) &&
3107                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3108                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3109                     (!entry->bssid_set ||
3110                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3111                         return entry;
3112 #endif /* CONFIG_WPS */
3113
3114                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3115                     entry->ssid_len == 0 &&
3116                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3117                         return entry;
3118
3119                 entry = entry->next;
3120         }
3121
3122         return NULL;
3123 }
3124
3125
3126 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3127 {
3128         struct wpa_global *global = wpa_s->global;
3129
3130         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3131                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3132                 if (global->drv_priv[i] == NULL) {
3133                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3134                                    "'%s'", wpa_drivers[i]->name);
3135                         return -1;
3136                 }
3137         }
3138
3139         wpa_s->driver = wpa_drivers[i];
3140         wpa_s->global_drv_priv = global->drv_priv[i];
3141
3142         return 0;
3143 }
3144
3145
3146 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3147                                      const char *name)
3148 {
3149         int i;
3150         size_t len;
3151         const char *pos, *driver = name;
3152
3153         if (wpa_s == NULL)
3154                 return -1;
3155
3156         if (wpa_drivers[0] == NULL) {
3157                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3158                         "wpa_supplicant");
3159                 return -1;
3160         }
3161
3162         if (name == NULL) {
3163                 /* default to first driver in the list */
3164                 return select_driver(wpa_s, 0);
3165         }
3166
3167         do {
3168                 pos = os_strchr(driver, ',');
3169                 if (pos)
3170                         len = pos - driver;
3171                 else
3172                         len = os_strlen(driver);
3173
3174                 for (i = 0; wpa_drivers[i]; i++) {
3175                         if (os_strlen(wpa_drivers[i]->name) == len &&
3176                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3177                             0) {
3178                                 /* First driver that succeeds wins */
3179                                 if (select_driver(wpa_s, i) == 0)
3180                                         return 0;
3181                         }
3182                 }
3183
3184                 driver = pos + 1;
3185         } while (pos);
3186
3187         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3188         return -1;
3189 }
3190
3191
3192 /**
3193  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3194  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3195  *      with struct wpa_driver_ops::init()
3196  * @src_addr: Source address of the EAPOL frame
3197  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3198  * @len: Length of the EAPOL data
3199  *
3200  * This function is called for each received EAPOL frame. Most driver
3201  * interfaces rely on more generic OS mechanism for receiving frames through
3202  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3203  * take care of received EAPOL frames and deliver them to the core supplicant
3204  * code by calling this function.
3205  */
3206 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3207                              const u8 *buf, size_t len)
3208 {
3209         struct wpa_supplicant *wpa_s = ctx;
3210
3211         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3212         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3213
3214 #ifdef CONFIG_PEERKEY
3215         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3216             wpa_s->current_ssid->peerkey &&
3217             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3218             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3219                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3220                 return;
3221         }
3222 #endif /* CONFIG_PEERKEY */
3223
3224         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3225             (wpa_s->last_eapol_matches_bssid &&
3226 #ifdef CONFIG_AP
3227              !wpa_s->ap_iface &&
3228 #endif /* CONFIG_AP */
3229              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3230                 /*
3231                  * There is possible race condition between receiving the
3232                  * association event and the EAPOL frame since they are coming
3233                  * through different paths from the driver. In order to avoid
3234                  * issues in trying to process the EAPOL frame before receiving
3235                  * association information, lets queue it for processing until
3236                  * the association event is received. This may also be needed in
3237                  * driver-based roaming case, so also use src_addr != BSSID as a
3238                  * trigger if we have previously confirmed that the
3239                  * Authenticator uses BSSID as the src_addr (which is not the
3240                  * case with wired IEEE 802.1X).
3241                  */
3242                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3243                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3244                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3245                         MAC2STR(wpa_s->bssid));
3246                 wpabuf_free(wpa_s->pending_eapol_rx);
3247                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3248                 if (wpa_s->pending_eapol_rx) {
3249                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3250                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3251                                   ETH_ALEN);
3252                 }
3253                 return;
3254         }
3255
3256         wpa_s->last_eapol_matches_bssid =
3257                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3258
3259 #ifdef CONFIG_AP
3260         if (wpa_s->ap_iface) {
3261                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3262                 return;
3263         }
3264 #endif /* CONFIG_AP */
3265
3266         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3267                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3268                         "no key management is configured");
3269                 return;
3270         }
3271
3272         if (wpa_s->eapol_received == 0 &&
3273             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3274              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3275              wpa_s->wpa_state != WPA_COMPLETED) &&
3276             (wpa_s->current_ssid == NULL ||
3277              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3278                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3279                 int timeout = 10;
3280
3281                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3282                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3283                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3284                         /* Use longer timeout for IEEE 802.1X/EAP */
3285                         timeout = 70;
3286                 }
3287
3288 #ifdef CONFIG_WPS
3289                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3290                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3291                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3292                         /*
3293                          * Use shorter timeout if going through WPS AP iteration
3294                          * for PIN config method with an AP that does not
3295                          * advertise Selected Registrar.
3296                          */
3297                         struct wpabuf *wps_ie;
3298
3299                         wps_ie = wpa_bss_get_vendor_ie_multi(
3300                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3301                         if (wps_ie &&
3302                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3303                                 timeout = 10;
3304                         wpabuf_free(wps_ie);
3305                 }
3306 #endif /* CONFIG_WPS */
3307
3308                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3309         }
3310         wpa_s->eapol_received++;
3311
3312         if (wpa_s->countermeasures) {
3313                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3314                         "EAPOL packet");
3315                 return;
3316         }
3317
3318 #ifdef CONFIG_IBSS_RSN
3319         if (wpa_s->current_ssid &&
3320             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3321                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3322                 return;
3323         }
3324 #endif /* CONFIG_IBSS_RSN */
3325
3326         /* Source address of the incoming EAPOL frame could be compared to the
3327          * current BSSID. However, it is possible that a centralized
3328          * Authenticator could be using another MAC address than the BSSID of
3329          * an AP, so just allow any address to be used for now. The replies are
3330          * still sent to the current BSSID (if available), though. */
3331
3332         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3333         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3334             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3335                 return;
3336         wpa_drv_poll(wpa_s);
3337         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3338                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3339         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3340                 /*
3341                  * Set portValid = TRUE here since we are going to skip 4-way
3342                  * handshake processing which would normally set portValid. We
3343                  * need this to allow the EAPOL state machines to be completed
3344                  * without going through EAPOL-Key handshake.
3345                  */
3346                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3347         }
3348 }
3349
3350
3351 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3352 {
3353         if ((!wpa_s->p2p_mgmt ||
3354              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3355             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3356                 l2_packet_deinit(wpa_s->l2);
3357                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3358                                            wpa_drv_get_mac_addr(wpa_s),
3359                                            ETH_P_EAPOL,
3360                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3361                 if (wpa_s->l2 == NULL)
3362                         return -1;
3363         } else {
3364                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3365                 if (addr)
3366                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3367         }
3368
3369         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3370                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3371                 return -1;
3372         }
3373
3374         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3375
3376         return 0;
3377 }
3378
3379
3380 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3381                                            const u8 *buf, size_t len)
3382 {
3383         struct wpa_supplicant *wpa_s = ctx;
3384         const struct l2_ethhdr *eth;
3385
3386         if (len < sizeof(*eth))
3387                 return;
3388         eth = (const struct l2_ethhdr *) buf;
3389
3390         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3391             !(eth->h_dest[0] & 0x01)) {
3392                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3393                         " (bridge - not for this interface - ignore)",
3394                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3395                 return;
3396         }
3397
3398         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3399                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3400         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3401                                 len - sizeof(*eth));
3402 }
3403
3404
3405 /**
3406  * wpa_supplicant_driver_init - Initialize driver interface parameters
3407  * @wpa_s: Pointer to wpa_supplicant data
3408  * Returns: 0 on success, -1 on failure
3409  *
3410  * This function is called to initialize driver interface parameters.
3411  * wpa_drv_init() must have been called before this function to initialize the
3412  * driver interface.
3413  */
3414 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3415 {
3416         static int interface_count = 0;
3417
3418         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3419                 return -1;
3420
3421         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3422                 MAC2STR(wpa_s->own_addr));
3423         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3424         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3425
3426         if (wpa_s->bridge_ifname[0]) {
3427                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3428                         "interface '%s'", wpa_s->bridge_ifname);
3429                 wpa_s->l2_br = l2_packet_init_bridge(
3430                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3431                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3432                 if (wpa_s->l2_br == NULL) {
3433                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3434                                 "connection for the bridge interface '%s'",
3435                                 wpa_s->bridge_ifname);
3436                         return -1;
3437                 }
3438         }
3439
3440         if (wpa_s->conf->ap_scan == 2 &&
3441             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3442                 wpa_printf(MSG_INFO,
3443                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3444         }
3445
3446         wpa_clear_keys(wpa_s, NULL);
3447
3448         /* Make sure that TKIP countermeasures are not left enabled (could
3449          * happen if wpa_supplicant is killed during countermeasures. */
3450         wpa_drv_set_countermeasures(wpa_s, 0);
3451
3452         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3453         wpa_drv_flush_pmkid(wpa_s);
3454
3455         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3456         wpa_s->prev_scan_wildcard = 0;
3457
3458         if (wpa_supplicant_enabled_networks(wpa_s)) {
3459                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3460                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3461                         interface_count = 0;
3462                 }
3463 #ifndef ANDROID
3464                 if (!wpa_s->p2p_mgmt &&
3465                     wpa_supplicant_delayed_sched_scan(wpa_s,
3466                                                       interface_count % 3,
3467                                                       100000))
3468                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3469                                                 100000);
3470 #endif /* ANDROID */
3471                 interface_count++;
3472         } else
3473                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3474
3475         return 0;
3476 }
3477
3478
3479 static int wpa_supplicant_daemon(const char *pid_file)
3480 {
3481         wpa_printf(MSG_DEBUG, "Daemonize..");
3482         return os_daemonize(pid_file);
3483 }
3484
3485
3486 static struct wpa_supplicant *
3487 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3488 {
3489         struct wpa_supplicant *wpa_s;
3490
3491         wpa_s = os_zalloc(sizeof(*wpa_s));
3492         if (wpa_s == NULL)
3493                 return NULL;
3494         wpa_s->scan_req = INITIAL_SCAN_REQ;
3495         wpa_s->scan_interval = 5;
3496         wpa_s->new_connection = 1;
3497         wpa_s->parent = parent ? parent : wpa_s;
3498         wpa_s->sched_scanning = 0;
3499
3500         return wpa_s;
3501 }
3502
3503
3504 #ifdef CONFIG_HT_OVERRIDES
3505
3506 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3507                              struct ieee80211_ht_capabilities *htcaps,
3508                              struct ieee80211_ht_capabilities *htcaps_mask,
3509                              const char *ht_mcs)
3510 {
3511         /* parse ht_mcs into hex array */
3512         int i;
3513         const char *tmp = ht_mcs;
3514         char *end = NULL;
3515
3516         /* If ht_mcs is null, do not set anything */
3517         if (!ht_mcs)
3518                 return 0;
3519
3520         /* This is what we are setting in the kernel */
3521         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3522
3523         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3524
3525         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3526                 errno = 0;
3527                 long v = strtol(tmp, &end, 16);
3528                 if (errno == 0) {
3529                         wpa_msg(wpa_s, MSG_DEBUG,
3530                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3531                                 i, v, end, tmp);
3532                         if (end == tmp)
3533                                 break;
3534
3535                         htcaps->supported_mcs_set[i] = v;
3536                         tmp = end;
3537                 } else {
3538                         wpa_msg(wpa_s, MSG_ERROR,
3539                                 "Failed to parse ht-mcs: %s, error: %s\n",
3540                                 ht_mcs, strerror(errno));
3541                         return -1;
3542                 }
3543         }
3544
3545         /*
3546          * If we were able to parse any values, then set mask for the MCS set.
3547          */
3548         if (i) {
3549                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3550                           IEEE80211_HT_MCS_MASK_LEN - 1);
3551                 /* skip the 3 reserved bits */
3552                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3553                         0x1f;
3554         }
3555
3556         return 0;
3557 }
3558
3559
3560 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3561                                  struct ieee80211_ht_capabilities *htcaps,
3562                                  struct ieee80211_ht_capabilities *htcaps_mask,
3563                                  int disabled)
3564 {
3565         le16 msk;
3566
3567         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3568
3569         if (disabled == -1)
3570                 return 0;
3571
3572         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3573         htcaps_mask->ht_capabilities_info |= msk;
3574         if (disabled)
3575                 htcaps->ht_capabilities_info &= msk;
3576         else
3577                 htcaps->ht_capabilities_info |= msk;
3578
3579         return 0;
3580 }
3581
3582
3583 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3584                                 struct ieee80211_ht_capabilities *htcaps,
3585                                 struct ieee80211_ht_capabilities *htcaps_mask,
3586                                 int factor)
3587 {
3588         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3589
3590         if (factor == -1)
3591                 return 0;
3592
3593         if (factor < 0 || factor > 3) {
3594                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3595                         "Must be 0-3 or -1", factor);
3596                 return -EINVAL;
3597         }
3598
3599         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3600         htcaps->a_mpdu_params &= ~0x3;
3601         htcaps->a_mpdu_params |= factor & 0x3;
3602
3603         return 0;
3604 }
3605
3606
3607 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3608                                  struct ieee80211_ht_capabilities *htcaps,
3609                                  struct ieee80211_ht_capabilities *htcaps_mask,
3610                                  int density)
3611 {
3612         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3613
3614         if (density == -1)
3615                 return 0;
3616
3617         if (density < 0 || density > 7) {
3618                 wpa_msg(wpa_s, MSG_ERROR,
3619                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3620                         density);
3621                 return -EINVAL;
3622         }
3623
3624         htcaps_mask->a_mpdu_params |= 0x1C;
3625         htcaps->a_mpdu_params &= ~(0x1C);
3626         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3627
3628         return 0;
3629 }
3630
3631
3632 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3633                                 struct ieee80211_ht_capabilities *htcaps,
3634                                 struct ieee80211_ht_capabilities *htcaps_mask,
3635                                 int disabled)
3636 {
3637         /* Masking these out disables HT40 */
3638         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3639                                 HT_CAP_INFO_SHORT_GI40MHZ);
3640
3641         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3642
3643         if (disabled)
3644                 htcaps->ht_capabilities_info &= ~msk;
3645         else
3646                 htcaps->ht_capabilities_info |= msk;
3647
3648         htcaps_mask->ht_capabilities_info |= msk;
3649
3650         return 0;
3651 }
3652
3653
3654 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3655                                struct ieee80211_ht_capabilities *htcaps,
3656                                struct ieee80211_ht_capabilities *htcaps_mask,
3657                                int disabled)
3658 {
3659         /* Masking these out disables SGI */
3660         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3661                                 HT_CAP_INFO_SHORT_GI40MHZ);
3662
3663         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3664
3665         if (disabled)
3666                 htcaps->ht_capabilities_info &= ~msk;
3667         else
3668                 htcaps->ht_capabilities_info |= msk;
3669
3670         htcaps_mask->ht_capabilities_info |= msk;
3671
3672         return 0;
3673 }
3674
3675
3676 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3677                                struct ieee80211_ht_capabilities *htcaps,
3678                                struct ieee80211_ht_capabilities *htcaps_mask,
3679                                int disabled)
3680 {
3681         /* Masking these out disables LDPC */
3682         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3683
3684         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3685
3686         if (disabled)
3687                 htcaps->ht_capabilities_info &= ~msk;
3688         else
3689                 htcaps->ht_capabilities_info |= msk;
3690
3691         htcaps_mask->ht_capabilities_info |= msk;
3692
3693         return 0;
3694 }
3695
3696
3697 void wpa_supplicant_apply_ht_overrides(
3698         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3699         struct wpa_driver_associate_params *params)
3700 {
3701         struct ieee80211_ht_capabilities *htcaps;
3702         struct ieee80211_ht_capabilities *htcaps_mask;
3703
3704         if (!ssid)
3705                 return;
3706
3707         params->disable_ht = ssid->disable_ht;
3708         if (!params->htcaps || !params->htcaps_mask)
3709                 return;
3710
3711         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3712         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3713         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3714         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3715                               ssid->disable_max_amsdu);
3716         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3717         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3718         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3719         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3720         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3721
3722         if (ssid->ht40_intolerant) {
3723                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3724                 htcaps->ht_capabilities_info |= bit;
3725                 htcaps_mask->ht_capabilities_info |= bit;
3726         }
3727 }
3728
3729 #endif /* CONFIG_HT_OVERRIDES */
3730
3731
3732 #ifdef CONFIG_VHT_OVERRIDES
3733 void wpa_supplicant_apply_vht_overrides(
3734         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3735         struct wpa_driver_associate_params *params)
3736 {
3737         struct ieee80211_vht_capabilities *vhtcaps;
3738         struct ieee80211_vht_capabilities *vhtcaps_mask;
3739
3740         if (!ssid)
3741                 return;
3742
3743         params->disable_vht = ssid->disable_vht;
3744
3745         vhtcaps = (void *) params->vhtcaps;
3746         vhtcaps_mask = (void *) params->vhtcaps_mask;
3747
3748         if (!vhtcaps || !vhtcaps_mask)
3749                 return;
3750
3751         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3752         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3753
3754 #ifdef CONFIG_HT_OVERRIDES
3755         /* if max ampdu is <= 3, we have to make the HT cap the same */
3756         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3757                 int max_ampdu;
3758
3759                 max_ampdu = (ssid->vht_capa &
3760                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3761                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3762
3763                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3764                 wpa_set_ampdu_factor(wpa_s,
3765                                      (void *) params->htcaps,
3766                                      (void *) params->htcaps_mask,
3767                                      max_ampdu);
3768         }
3769 #endif /* CONFIG_HT_OVERRIDES */
3770
3771 #define OVERRIDE_MCS(i)                                                 \
3772         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3773                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3774                         3 << 2 * (i - 1);                               \
3775                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3776                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3777         }                                                               \
3778         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3779                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3780                         3 << 2 * (i - 1);                               \
3781                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3782                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3783         }
3784
3785         OVERRIDE_MCS(1);
3786         OVERRIDE_MCS(2);
3787         OVERRIDE_MCS(3);
3788         OVERRIDE_MCS(4);
3789         OVERRIDE_MCS(5);
3790         OVERRIDE_MCS(6);
3791         OVERRIDE_MCS(7);
3792         OVERRIDE_MCS(8);
3793 }
3794 #endif /* CONFIG_VHT_OVERRIDES */
3795
3796
3797 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3798 {
3799 #ifdef PCSC_FUNCS
3800         size_t len;
3801
3802         if (!wpa_s->conf->pcsc_reader)
3803                 return 0;
3804
3805         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3806         if (!wpa_s->scard)
3807                 return 1;
3808
3809         if (wpa_s->conf->pcsc_pin &&
3810             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3811                 scard_deinit(wpa_s->scard);
3812                 wpa_s->scard = NULL;
3813                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3814                 return -1;
3815         }
3816
3817         len = sizeof(wpa_s->imsi) - 1;
3818         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3819                 scard_deinit(wpa_s->scard);
3820                 wpa_s->scard = NULL;
3821                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3822                 return -1;
3823         }
3824         wpa_s->imsi[len] = '\0';
3825
3826         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3827
3828         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3829                    wpa_s->imsi, wpa_s->mnc_len);
3830
3831         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3832         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3833 #endif /* PCSC_FUNCS */
3834
3835         return 0;
3836 }
3837
3838
3839 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3840 {
3841         char *val, *pos;
3842
3843         ext_password_deinit(wpa_s->ext_pw);
3844         wpa_s->ext_pw = NULL;
3845         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3846
3847         if (!wpa_s->conf->ext_password_backend)
3848                 return 0;
3849
3850         val = os_strdup(wpa_s->conf->ext_password_backend);
3851         if (val == NULL)
3852                 return -1;
3853         pos = os_strchr(val, ':');
3854         if (pos)
3855                 *pos++ = '\0';
3856
3857         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3858
3859         wpa_s->ext_pw = ext_password_init(val, pos);
3860         os_free(val);
3861         if (wpa_s->ext_pw == NULL) {
3862                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3863                 return -1;
3864         }
3865         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3866
3867         return 0;
3868 }
3869
3870
3871 #ifdef CONFIG_FST
3872
3873 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3874 {
3875         struct wpa_supplicant *wpa_s = ctx;
3876
3877         return (is_zero_ether_addr(wpa_s->bssid) ||
3878                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3879 }
3880
3881
3882 static void wpas_fst_get_channel_info_cb(void *ctx,
3883                                          enum hostapd_hw_mode *hw_mode,
3884                                          u8 *channel)
3885 {
3886         struct wpa_supplicant *wpa_s = ctx;
3887
3888         if (wpa_s->current_bss) {
3889                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3890                                                   channel);
3891         } else if (wpa_s->hw.num_modes) {
3892                 *hw_mode = wpa_s->hw.modes[0].mode;
3893         } else {
3894                 WPA_ASSERT(0);
3895                 *hw_mode = 0;
3896         }
3897 }
3898
3899
3900 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3901 {
3902         struct wpa_supplicant *wpa_s = ctx;
3903
3904         *modes = wpa_s->hw.modes;
3905         return wpa_s->hw.num_modes;
3906 }
3907
3908
3909 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3910 {
3911         struct wpa_supplicant *wpa_s = ctx;
3912
3913         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3914         wpa_s->fst_ies = fst_ies;
3915 }
3916
3917
3918 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3919 {
3920         struct wpa_supplicant *wpa_s = ctx;
3921
3922         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3923         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3924                                           wpa_s->own_addr, wpa_s->bssid,
3925                                           wpabuf_head(data), wpabuf_len(data),
3926                                    0);
3927 }
3928
3929
3930 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3931 {
3932         struct wpa_supplicant *wpa_s = ctx;
3933
3934         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3935         return wpa_s->received_mb_ies;
3936 }
3937
3938
3939 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3940                                      const u8 *buf, size_t size)
3941 {
3942         struct wpa_supplicant *wpa_s = ctx;
3943         struct mb_ies_info info;
3944
3945         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3946
3947         if (!mb_ies_info_by_ies(&info, buf, size)) {
3948                 wpabuf_free(wpa_s->received_mb_ies);
3949                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3950         }
3951 }
3952
3953
3954 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3955                                    Boolean mb_only)
3956 {
3957         struct wpa_supplicant *wpa_s = ctx;
3958
3959         *get_ctx = NULL;
3960         if (!is_zero_ether_addr(wpa_s->bssid))
3961                 return (wpa_s->received_mb_ies || !mb_only) ?
3962                         wpa_s->bssid : NULL;
3963         return NULL;
3964 }
3965
3966
3967 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3968                                   Boolean mb_only)
3969 {
3970         return NULL;
3971 }
3972
3973 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3974                                        struct fst_wpa_obj *iface_obj)
3975 {
3976         iface_obj->ctx              = wpa_s;
3977         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3978         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3979         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3980         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3981         iface_obj->send_action      = wpas_fst_send_action_cb;
3982         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3983         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3984         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3985         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3986 }
3987 #endif /* CONFIG_FST */
3988
3989 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3990                                     const struct wpa_driver_capa *capa)
3991 {
3992         struct wowlan_triggers *triggers;
3993         int ret = 0;
3994
3995         if (!wpa_s->conf->wowlan_triggers)
3996                 return 0;
3997
3998         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3999         if (triggers) {
4000                 ret = wpa_drv_wowlan(wpa_s, triggers);
4001                 os_free(triggers);
4002         }
4003         return ret;
4004 }
4005
4006
4007 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
4008 {
4009         if (freq < 3000)
4010                 return BAND_2_4_GHZ;
4011         if (freq > 50000)
4012                 return BAND_60_GHZ;
4013         return BAND_5_GHZ;
4014 }
4015
4016
4017 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
4018                                    const int *freqs)
4019 {
4020         int i;
4021         unsigned int band = 0;
4022
4023         if (freqs) {
4024                 /* freqs are specified for the radio work */
4025                 for (i = 0; freqs[i]; i++)
4026                         band |= wpas_freq_to_band(freqs[i]);
4027         } else {
4028                 /*
4029                  * freqs are not specified, implies all
4030                  * the supported freqs by HW
4031                  */
4032                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4033                         if (wpa_s->hw.modes[i].num_channels != 0) {
4034                                 if (wpa_s->hw.modes[i].mode ==
4035                                     HOSTAPD_MODE_IEEE80211B ||
4036                                     wpa_s->hw.modes[i].mode ==
4037                                     HOSTAPD_MODE_IEEE80211G)
4038                                         band |= BAND_2_4_GHZ;
4039                                 else if (wpa_s->hw.modes[i].mode ==
4040                                          HOSTAPD_MODE_IEEE80211A)
4041                                         band |= BAND_5_GHZ;
4042                                 else if (wpa_s->hw.modes[i].mode ==
4043                                          HOSTAPD_MODE_IEEE80211AD)
4044                                         band |= BAND_60_GHZ;
4045                                 else if (wpa_s->hw.modes[i].mode ==
4046                                          HOSTAPD_MODE_IEEE80211ANY)
4047                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4048                                                 BAND_60_GHZ;
4049                         }
4050                 }
4051         }
4052
4053         return band;
4054 }
4055
4056
4057 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4058                                               const char *rn)
4059 {
4060         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4061         struct wpa_radio *radio;
4062
4063         while (rn && iface) {
4064                 radio = iface->radio;
4065                 if (radio && os_strcmp(rn, radio->name) == 0) {
4066                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4067                                    wpa_s->ifname, rn);
4068                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4069                         return radio;
4070                 }
4071
4072                 iface = iface->next;
4073         }
4074
4075         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4076                    wpa_s->ifname, rn ? rn : "N/A");
4077         radio = os_zalloc(sizeof(*radio));
4078         if (radio == NULL)
4079                 return NULL;
4080
4081         if (rn)
4082                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4083         dl_list_init(&radio->ifaces);
4084         dl_list_init(&radio->work);
4085         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4086
4087         return radio;
4088 }
4089
4090
4091 static void radio_work_free(struct wpa_radio_work *work)
4092 {
4093         if (work->wpa_s->scan_work == work) {
4094                 /* This should not really happen. */
4095                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4096                         work->type, work, work->started);
4097                 work->wpa_s->scan_work = NULL;
4098         }
4099
4100 #ifdef CONFIG_P2P
4101         if (work->wpa_s->p2p_scan_work == work) {
4102                 /* This should not really happen. */
4103                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4104                         work->type, work, work->started);
4105                 work->wpa_s->p2p_scan_work = NULL;
4106         }
4107 #endif /* CONFIG_P2P */
4108
4109         if (work->started) {
4110                 work->wpa_s->radio->num_active_works--;
4111                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4112                         "radio_work_free('%s'@%p: num_active_works --> %u",
4113                         work->type, work,
4114                         work->wpa_s->radio->num_active_works);
4115         }
4116
4117         dl_list_del(&work->list);
4118         os_free(work);
4119 }
4120
4121
4122 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4123 {
4124         struct wpa_radio_work *active_work = NULL;
4125         struct wpa_radio_work *tmp;
4126
4127         /* Get the active work to know the type and band. */
4128         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4129                 if (tmp->started) {
4130                         active_work = tmp;
4131                         break;
4132                 }
4133         }
4134
4135         if (!active_work) {
4136                 /* No active work, start one */
4137                 radio->num_active_works = 0;
4138                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4139                                  list) {
4140                         if (os_strcmp(tmp->type, "scan") == 0 &&
4141                             radio->external_scan_running &&
4142                             (((struct wpa_driver_scan_params *)
4143                               tmp->ctx)->only_new_results ||
4144                              tmp->wpa_s->clear_driver_scan_cache))
4145                                 continue;
4146                         return tmp;
4147                 }
4148                 return NULL;
4149         }
4150
4151         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4152             os_strcmp(active_work->type, "connect") == 0) {
4153                 /*
4154                  * If the active work is either connect or sme-connect,
4155                  * do not parallelize them with other radio works.
4156                  */
4157                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4158                         "Do not parallelize radio work with %s",
4159                         active_work->type);
4160                 return NULL;
4161         }
4162
4163         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4164                 if (tmp->started)
4165                         continue;
4166
4167                 /*
4168                  * If connect or sme-connect are enqueued, parallelize only
4169                  * those operations ahead of them in the queue.
4170                  */
4171                 if (os_strcmp(tmp->type, "connect") == 0 ||
4172                     os_strcmp(tmp->type, "sme-connect") == 0)
4173                         break;
4174
4175                 /*
4176                  * Check that the radio works are distinct and
4177                  * on different bands.
4178                  */
4179                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4180                     (active_work->bands != tmp->bands)) {
4181                         /*
4182                          * If a scan has to be scheduled through nl80211 scan
4183                          * interface and if an external scan is already running,
4184                          * do not schedule the scan since it is likely to get
4185                          * rejected by kernel.
4186                          */
4187                         if (os_strcmp(tmp->type, "scan") == 0 &&
4188                             radio->external_scan_running &&
4189                             (((struct wpa_driver_scan_params *)
4190                               tmp->ctx)->only_new_results ||
4191                              tmp->wpa_s->clear_driver_scan_cache))
4192                                 continue;
4193
4194                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4195                                 "active_work:%s new_work:%s",
4196                                 active_work->type, tmp->type);
4197                         return tmp;
4198                 }
4199         }
4200
4201         /* Did not find a radio work to schedule in parallel. */
4202         return NULL;
4203 }
4204
4205
4206 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4207 {
4208         struct wpa_radio *radio = eloop_ctx;
4209         struct wpa_radio_work *work;
4210         struct os_reltime now, diff;
4211         struct wpa_supplicant *wpa_s;
4212
4213         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4214         if (work == NULL) {
4215                 radio->num_active_works = 0;
4216                 return;
4217         }
4218
4219         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4220                               radio_list);
4221
4222         if (!(wpa_s &&
4223               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4224                 if (work->started)
4225                         return; /* already started and still in progress */
4226
4227                 if (wpa_s && wpa_s->radio->external_scan_running) {
4228                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4229                         return;
4230                 }
4231         } else {
4232                 work = NULL;
4233                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4234                         /* get the work to schedule next */
4235                         work = radio_work_get_next_work(radio);
4236                 }
4237                 if (!work)
4238                         return;
4239         }
4240
4241         wpa_s = work->wpa_s;
4242         os_get_reltime(&now);
4243         os_reltime_sub(&now, &work->time, &diff);
4244         wpa_dbg(wpa_s, MSG_DEBUG,
4245                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4246                 work->type, work, diff.sec, diff.usec);
4247         work->started = 1;
4248         work->time = now;
4249         radio->num_active_works++;
4250
4251         work->cb(work, 0);
4252
4253         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4254             radio->num_active_works < MAX_ACTIVE_WORKS)
4255                 radio_work_check_next(wpa_s);
4256 }
4257
4258
4259 /*
4260  * This function removes both started and pending radio works running on
4261  * the provided interface's radio.
4262  * Prior to the removal of the radio work, its callback (cb) is called with
4263  * deinit set to be 1. Each work's callback is responsible for clearing its
4264  * internal data and restoring to a correct state.
4265  * @wpa_s: wpa_supplicant data
4266  * @type: type of works to be removed
4267  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4268  * this interface's works.
4269  */
4270 void radio_remove_works(struct wpa_supplicant *wpa_s,
4271                         const char *type, int remove_all)
4272 {
4273         struct wpa_radio_work *work, *tmp;
4274         struct wpa_radio *radio = wpa_s->radio;
4275
4276         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4277                               list) {
4278                 if (type && os_strcmp(type, work->type) != 0)
4279                         continue;
4280
4281                 /* skip other ifaces' works */
4282                 if (!remove_all && work->wpa_s != wpa_s)
4283                         continue;
4284
4285                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4286                         work->type, work, work->started ? " (started)" : "");
4287                 work->cb(work, 1);
4288                 radio_work_free(work);
4289         }
4290
4291         /* in case we removed the started work */
4292         radio_work_check_next(wpa_s);
4293 }
4294
4295
4296 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4297 {
4298         struct wpa_radio *radio = wpa_s->radio;
4299
4300         if (!radio)
4301                 return;
4302
4303         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4304                    wpa_s->ifname, radio->name);
4305         dl_list_del(&wpa_s->radio_list);
4306         radio_remove_works(wpa_s, NULL, 0);
4307         wpa_s->radio = NULL;
4308         if (!dl_list_empty(&radio->ifaces))
4309                 return; /* Interfaces remain for this radio */
4310
4311         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4312         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4313         os_free(radio);
4314 }
4315
4316
4317 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4318 {
4319         struct wpa_radio *radio = wpa_s->radio;
4320
4321         if (dl_list_empty(&radio->work))
4322                 return;
4323         if (wpa_s->ext_work_in_progress) {
4324                 wpa_printf(MSG_DEBUG,
4325                            "External radio work in progress - delay start of pending item");
4326                 return;
4327         }
4328         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4329         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4330 }
4331
4332
4333 /**
4334  * radio_add_work - Add a radio work item
4335  * @wpa_s: Pointer to wpa_supplicant data
4336  * @freq: Frequency of the offchannel operation in MHz or 0
4337  * @type: Unique identifier for each type of work
4338  * @next: Force as the next work to be executed
4339  * @cb: Callback function for indicating when radio is available
4340  * @ctx: Context pointer for the work (work->ctx in cb())
4341  * Returns: 0 on success, -1 on failure
4342  *
4343  * This function is used to request time for an operation that requires
4344  * exclusive radio control. Once the radio is available, the registered callback
4345  * function will be called. radio_work_done() must be called once the exclusive
4346  * radio operation has been completed, so that the radio is freed for other
4347  * operations. The special case of deinit=1 is used to free the context data
4348  * during interface removal. That does not allow the callback function to start
4349  * the radio operation, i.e., it must free any resources allocated for the radio
4350  * work and return.
4351  *
4352  * The @freq parameter can be used to indicate a single channel on which the
4353  * offchannel operation will occur. This may allow multiple radio work
4354  * operations to be performed in parallel if they apply for the same channel.
4355  * Setting this to 0 indicates that the work item may use multiple channels or
4356  * requires exclusive control of the radio.
4357  */
4358 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4359                    const char *type, int next,
4360                    void (*cb)(struct wpa_radio_work *work, int deinit),
4361                    void *ctx)
4362 {
4363         struct wpa_radio *radio = wpa_s->radio;
4364         struct wpa_radio_work *work;
4365         int was_empty;
4366
4367         work = os_zalloc(sizeof(*work));
4368         if (work == NULL)
4369                 return -1;
4370         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4371         os_get_reltime(&work->time);
4372         work->freq = freq;
4373         work->type = type;
4374         work->wpa_s = wpa_s;
4375         work->cb = cb;
4376         work->ctx = ctx;
4377
4378         if (freq)
4379                 work->bands = wpas_freq_to_band(freq);
4380         else if (os_strcmp(type, "scan") == 0 ||
4381                  os_strcmp(type, "p2p-scan") == 0)
4382                 work->bands = wpas_get_bands(wpa_s,
4383                                              ((struct wpa_driver_scan_params *)
4384                                               ctx)->freqs);
4385         else
4386                 work->bands = wpas_get_bands(wpa_s, NULL);
4387
4388         was_empty = dl_list_empty(&wpa_s->radio->work);
4389         if (next)
4390                 dl_list_add(&wpa_s->radio->work, &work->list);
4391         else
4392                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4393         if (was_empty) {
4394                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4395                 radio_work_check_next(wpa_s);
4396         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4397                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4398                 wpa_dbg(wpa_s, MSG_DEBUG,
4399                         "Try to schedule a radio work (num_active_works=%u)",
4400                         radio->num_active_works);
4401                 radio_work_check_next(wpa_s);
4402         }
4403
4404         return 0;
4405 }
4406
4407
4408 /**
4409  * radio_work_done - Indicate that a radio work item has been completed
4410  * @work: Completed work
4411  *
4412  * This function is called once the callback function registered with
4413  * radio_add_work() has completed its work.
4414  */
4415 void radio_work_done(struct wpa_radio_work *work)
4416 {
4417         struct wpa_supplicant *wpa_s = work->wpa_s;
4418         struct os_reltime now, diff;
4419         unsigned int started = work->started;
4420
4421         os_get_reltime(&now);
4422         os_reltime_sub(&now, &work->time, &diff);
4423         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4424                 work->type, work, started ? "done" : "canceled",
4425                 diff.sec, diff.usec);
4426         radio_work_free(work);
4427         if (started)
4428                 radio_work_check_next(wpa_s);
4429 }
4430
4431
4432 struct wpa_radio_work *
4433 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4434 {
4435         struct wpa_radio_work *work;
4436         struct wpa_radio *radio = wpa_s->radio;
4437
4438         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4439                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4440                         return work;
4441         }
4442
4443         return NULL;
4444 }
4445
4446
4447 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4448                             struct wpa_interface *iface)
4449 {
4450         const char *ifname, *driver, *rn;
4451
4452         driver = iface->driver;
4453 next_driver:
4454         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4455                 return -1;
4456
4457         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4458         if (wpa_s->drv_priv == NULL) {
4459                 const char *pos;
4460                 pos = driver ? os_strchr(driver, ',') : NULL;
4461                 if (pos) {
4462                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4463                                 "driver interface - try next driver wrapper");
4464                         driver = pos + 1;
4465                         goto next_driver;
4466                 }
4467                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4468                         "interface");
4469                 return -1;
4470         }
4471         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4472                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4473                         "driver_param '%s'", wpa_s->conf->driver_param);
4474                 return -1;
4475         }
4476
4477         ifname = wpa_drv_get_ifname(wpa_s);
4478         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4479                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4480                         "interface name with '%s'", ifname);
4481                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4482         }
4483
4484         rn = wpa_driver_get_radio_name(wpa_s);
4485         if (rn && rn[0] == '\0')
4486                 rn = NULL;
4487
4488         wpa_s->radio = radio_add_interface(wpa_s, rn);
4489         if (wpa_s->radio == NULL)
4490                 return -1;
4491
4492         return 0;
4493 }
4494
4495
4496 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4497                                      struct wpa_interface *iface)
4498 {
4499         struct wpa_driver_capa capa;
4500         int capa_res;
4501
4502         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4503                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4504                    iface->confname ? iface->confname : "N/A",
4505                    iface->driver ? iface->driver : "default",
4506                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4507                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4508
4509         if (iface->confname) {
4510 #ifdef CONFIG_BACKEND_FILE
4511                 wpa_s->confname = os_rel2abs_path(iface->confname);
4512                 if (wpa_s->confname == NULL) {
4513                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4514                                    "for configuration file '%s'.",
4515                                    iface->confname);
4516                         return -1;
4517                 }
4518                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4519                            iface->confname, wpa_s->confname);
4520 #else /* CONFIG_BACKEND_FILE */
4521                 wpa_s->confname = os_strdup(iface->confname);
4522 #endif /* CONFIG_BACKEND_FILE */
4523                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4524                 if (wpa_s->conf == NULL) {
4525                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4526                                    "configuration '%s'.", wpa_s->confname);
4527                         return -1;
4528                 }
4529                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4530                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4531
4532                 /*
4533                  * Override ctrl_interface and driver_param if set on command
4534                  * line.
4535                  */
4536                 if (iface->ctrl_interface) {
4537                         os_free(wpa_s->conf->ctrl_interface);
4538                         wpa_s->conf->ctrl_interface =
4539                                 os_strdup(iface->ctrl_interface);
4540                 }
4541
4542                 if (iface->driver_param) {
4543                         os_free(wpa_s->conf->driver_param);
4544                         wpa_s->conf->driver_param =
4545                                 os_strdup(iface->driver_param);
4546                 }
4547
4548                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4549                         os_free(wpa_s->conf->ctrl_interface);
4550                         wpa_s->conf->ctrl_interface = NULL;
4551                 }
4552         } else
4553                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4554                                                      iface->driver_param);
4555
4556         if (wpa_s->conf == NULL) {
4557                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4558                 return -1;
4559         }
4560
4561         if (iface->ifname == NULL) {
4562                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4563                 return -1;
4564         }
4565         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4566                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4567                            iface->ifname);
4568                 return -1;
4569         }
4570         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4571
4572         if (iface->bridge_ifname) {
4573                 if (os_strlen(iface->bridge_ifname) >=
4574                     sizeof(wpa_s->bridge_ifname)) {
4575                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4576                                    "name '%s'.", iface->bridge_ifname);
4577                         return -1;
4578                 }
4579                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4580                            sizeof(wpa_s->bridge_ifname));
4581         }
4582
4583         /* RSNA Supplicant Key Management - INITIALIZE */
4584         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4585         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4586
4587         /* Initialize driver interface and register driver event handler before
4588          * L2 receive handler so that association events are processed before
4589          * EAPOL-Key packets if both become available for the same select()
4590          * call. */
4591         if (wpas_init_driver(wpa_s, iface) < 0)
4592                 return -1;
4593
4594         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4595                 return -1;
4596
4597         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4598                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4599                           NULL);
4600         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4601
4602         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4603             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4604                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4605                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4606                         "dot11RSNAConfigPMKLifetime");
4607                 return -1;
4608         }
4609
4610         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4611             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4612                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4613                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4614                         "dot11RSNAConfigPMKReauthThreshold");
4615                 return -1;
4616         }
4617
4618         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4619             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4620                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4621                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4622                         "dot11RSNAConfigSATimeout");
4623                 return -1;
4624         }
4625
4626         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4627                                                       &wpa_s->hw.num_modes,
4628                                                       &wpa_s->hw.flags);
4629         if (wpa_s->hw.modes) {
4630                 u16 i;
4631
4632                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4633                         if (wpa_s->hw.modes[i].vht_capab) {
4634                                 wpa_s->hw_capab = CAPAB_VHT;
4635                                 break;
4636                         }
4637
4638                         if (wpa_s->hw.modes[i].ht_capab &
4639                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4640                                 wpa_s->hw_capab = CAPAB_HT40;
4641                         else if (wpa_s->hw.modes[i].ht_capab &&
4642                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4643                                 wpa_s->hw_capab = CAPAB_HT;
4644                 }
4645         }
4646
4647         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4648         if (capa_res == 0) {
4649                 wpa_s->drv_capa_known = 1;
4650                 wpa_s->drv_flags = capa.flags;
4651                 wpa_s->drv_enc = capa.enc;
4652                 wpa_s->drv_smps_modes = capa.smps_modes;
4653                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4654                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4655                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4656                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4657                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4658                 wpa_s->max_sched_scan_plan_interval =
4659                         capa.max_sched_scan_plan_interval;
4660                 wpa_s->max_sched_scan_plan_iterations =
4661                         capa.max_sched_scan_plan_iterations;
4662                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4663                 wpa_s->max_match_sets = capa.max_match_sets;
4664                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4665                 wpa_s->max_stations = capa.max_stations;
4666                 wpa_s->extended_capa = capa.extended_capa;
4667                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4668                 wpa_s->extended_capa_len = capa.extended_capa_len;
4669                 wpa_s->num_multichan_concurrent =
4670                         capa.num_multichan_concurrent;
4671                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4672
4673                 if (capa.mac_addr_rand_scan_supported)
4674                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4675                 if (wpa_s->sched_scan_supported &&
4676                     capa.mac_addr_rand_sched_scan_supported)
4677                         wpa_s->mac_addr_rand_supported |=
4678                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4679         }
4680         if (wpa_s->max_remain_on_chan == 0)
4681                 wpa_s->max_remain_on_chan = 1000;
4682
4683         /*
4684          * Only take p2p_mgmt parameters when P2P Device is supported.
4685          * Doing it here as it determines whether l2_packet_init() will be done
4686          * during wpa_supplicant_driver_init().
4687          */
4688         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4689                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4690         else
4691                 iface->p2p_mgmt = 1;
4692
4693         if (wpa_s->num_multichan_concurrent == 0)
4694                 wpa_s->num_multichan_concurrent = 1;
4695
4696         if (wpa_supplicant_driver_init(wpa_s) < 0)
4697                 return -1;
4698
4699 #ifdef CONFIG_TDLS
4700         if ((!iface->p2p_mgmt ||
4701              !(wpa_s->drv_flags &
4702                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4703             wpa_tdls_init(wpa_s->wpa))
4704                 return -1;
4705 #endif /* CONFIG_TDLS */
4706
4707         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4708             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4709                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4710                 return -1;
4711         }
4712
4713 #ifdef CONFIG_FST
4714         if (wpa_s->conf->fst_group_id) {
4715                 struct fst_iface_cfg cfg;
4716                 struct fst_wpa_obj iface_obj;
4717
4718                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4719                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4720                            sizeof(cfg.group_id));
4721                 cfg.priority = wpa_s->conf->fst_priority;
4722                 cfg.llt = wpa_s->conf->fst_llt;
4723
4724                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4725                                         &iface_obj, &cfg);
4726                 if (!wpa_s->fst) {
4727                         wpa_msg(wpa_s, MSG_ERROR,
4728                                 "FST: Cannot attach iface %s to group %s",
4729                                 wpa_s->ifname, cfg.group_id);
4730                         return -1;
4731                 }
4732         }
4733 #endif /* CONFIG_FST */
4734
4735         if (wpas_wps_init(wpa_s))
4736                 return -1;
4737
4738         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4739                 return -1;
4740         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4741
4742         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4743         if (wpa_s->ctrl_iface == NULL) {
4744                 wpa_printf(MSG_ERROR,
4745                            "Failed to initialize control interface '%s'.\n"
4746                            "You may have another wpa_supplicant process "
4747                            "already running or the file was\n"
4748                            "left by an unclean termination of wpa_supplicant "
4749                            "in which case you will need\n"
4750                            "to manually remove this file before starting "
4751                            "wpa_supplicant again.\n",
4752                            wpa_s->conf->ctrl_interface);
4753                 return -1;
4754         }
4755
4756         wpa_s->gas = gas_query_init(wpa_s);
4757         if (wpa_s->gas == NULL) {
4758                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4759                 return -1;
4760         }
4761
4762         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4763                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4764                 return -1;
4765         }
4766
4767         if (wpa_bss_init(wpa_s) < 0)
4768                 return -1;
4769
4770         /*
4771          * Set Wake-on-WLAN triggers, if configured.
4772          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4773          * have effect anyway when the interface is down).
4774          */
4775         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4776                 return -1;
4777
4778 #ifdef CONFIG_EAP_PROXY
4779 {
4780         size_t len;
4781         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4782                                                      &len);
4783         if (wpa_s->mnc_len > 0) {
4784                 wpa_s->imsi[len] = '\0';
4785                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4786                            wpa_s->imsi, wpa_s->mnc_len);
4787         } else {
4788                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4789         }
4790 }
4791 #endif /* CONFIG_EAP_PROXY */
4792
4793         if (pcsc_reader_init(wpa_s) < 0)
4794                 return -1;
4795
4796         if (wpas_init_ext_pw(wpa_s) < 0)
4797                 return -1;
4798
4799         wpas_rrm_reset(wpa_s);
4800
4801         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4802
4803 #ifdef CONFIG_HS20
4804         hs20_init(wpa_s);
4805 #endif /* CONFIG_HS20 */
4806 #ifdef CONFIG_MBO
4807         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4808 #endif /* CONFIG_MBO */
4809
4810         return 0;
4811 }
4812
4813
4814 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4815                                         int notify, int terminate)
4816 {
4817         struct wpa_global *global = wpa_s->global;
4818         struct wpa_supplicant *iface, *prev;
4819
4820         if (wpa_s == wpa_s->parent)
4821                 wpas_p2p_group_remove(wpa_s, "*");
4822
4823         iface = global->ifaces;
4824         while (iface) {
4825                 if (iface == wpa_s || iface->parent != wpa_s) {
4826                         iface = iface->next;
4827                         continue;
4828                 }
4829                 wpa_printf(MSG_DEBUG,
4830                            "Remove remaining child interface %s from parent %s",
4831                            iface->ifname, wpa_s->ifname);
4832                 prev = iface;
4833                 iface = iface->next;
4834                 wpa_supplicant_remove_iface(global, prev, terminate);
4835         }
4836
4837         wpa_s->disconnected = 1;
4838         if (wpa_s->drv_priv) {
4839                 wpa_supplicant_deauthenticate(wpa_s,
4840                                               WLAN_REASON_DEAUTH_LEAVING);
4841
4842                 wpa_drv_set_countermeasures(wpa_s, 0);
4843                 wpa_clear_keys(wpa_s, NULL);
4844         }
4845
4846         wpa_supplicant_cleanup(wpa_s);
4847         wpas_p2p_deinit_iface(wpa_s);
4848
4849         wpas_ctrl_radio_work_flush(wpa_s);
4850         radio_remove_interface(wpa_s);
4851
4852 #ifdef CONFIG_FST
4853         if (wpa_s->fst) {
4854                 fst_detach(wpa_s->fst);
4855                 wpa_s->fst = NULL;
4856         }
4857         if (wpa_s->received_mb_ies) {
4858                 wpabuf_free(wpa_s->received_mb_ies);
4859                 wpa_s->received_mb_ies = NULL;
4860         }
4861 #endif /* CONFIG_FST */
4862
4863         if (wpa_s->drv_priv)
4864                 wpa_drv_deinit(wpa_s);
4865
4866         if (notify)
4867                 wpas_notify_iface_removed(wpa_s);
4868
4869         if (terminate)
4870                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4871
4872         if (wpa_s->ctrl_iface) {
4873                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4874                 wpa_s->ctrl_iface = NULL;
4875         }
4876
4877 #ifdef CONFIG_MESH
4878         if (wpa_s->ifmsh) {
4879                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4880                 wpa_s->ifmsh = NULL;
4881         }
4882 #endif /* CONFIG_MESH */
4883
4884         if (wpa_s->conf != NULL) {
4885                 wpa_config_free(wpa_s->conf);
4886                 wpa_s->conf = NULL;
4887         }
4888
4889         os_free(wpa_s->ssids_from_scan_req);
4890
4891         os_free(wpa_s);
4892 }
4893
4894
4895 /**
4896  * wpa_supplicant_add_iface - Add a new network interface
4897  * @global: Pointer to global data from wpa_supplicant_init()
4898  * @iface: Interface configuration options
4899  * @parent: Parent interface or %NULL to assign new interface as parent
4900  * Returns: Pointer to the created interface or %NULL on failure
4901  *
4902  * This function is used to add new network interfaces for %wpa_supplicant.
4903  * This can be called before wpa_supplicant_run() to add interfaces before the
4904  * main event loop has been started. In addition, new interfaces can be added
4905  * dynamically while %wpa_supplicant is already running. This could happen,
4906  * e.g., when a hotplug network adapter is inserted.
4907  */
4908 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4909                                                  struct wpa_interface *iface,
4910                                                  struct wpa_supplicant *parent)
4911 {
4912         struct wpa_supplicant *wpa_s;
4913         struct wpa_interface t_iface;
4914         struct wpa_ssid *ssid;
4915
4916         if (global == NULL || iface == NULL)
4917                 return NULL;
4918
4919         wpa_s = wpa_supplicant_alloc(parent);
4920         if (wpa_s == NULL)
4921                 return NULL;
4922
4923         wpa_s->global = global;
4924
4925         t_iface = *iface;
4926         if (global->params.override_driver) {
4927                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4928                            "('%s' -> '%s')",
4929                            iface->driver, global->params.override_driver);
4930                 t_iface.driver = global->params.override_driver;
4931         }
4932         if (global->params.override_ctrl_interface) {
4933                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4934                            "ctrl_interface ('%s' -> '%s')",
4935                            iface->ctrl_interface,
4936                            global->params.override_ctrl_interface);
4937                 t_iface.ctrl_interface =
4938                         global->params.override_ctrl_interface;
4939         }
4940         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4941                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4942                            iface->ifname);
4943                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4944                 return NULL;
4945         }
4946
4947         if (iface->p2p_mgmt == 0) {
4948                 /* Notify the control interfaces about new iface */
4949                 if (wpas_notify_iface_added(wpa_s)) {
4950                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4951                         return NULL;
4952                 }
4953
4954                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4955                         wpas_notify_network_added(wpa_s, ssid);
4956         }
4957
4958         wpa_s->next = global->ifaces;
4959         global->ifaces = wpa_s;
4960
4961         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4962         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4963
4964 #ifdef CONFIG_P2P
4965         if (wpa_s->global->p2p == NULL &&
4966             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4967             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4968             wpas_p2p_add_p2pdev_interface(
4969                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4970                 wpa_printf(MSG_INFO,
4971                            "P2P: Failed to enable P2P Device interface");
4972                 /* Try to continue without. P2P will be disabled. */
4973         }
4974 #endif /* CONFIG_P2P */
4975
4976         return wpa_s;
4977 }
4978
4979
4980 /**
4981  * wpa_supplicant_remove_iface - Remove a network interface
4982  * @global: Pointer to global data from wpa_supplicant_init()
4983  * @wpa_s: Pointer to the network interface to be removed
4984  * Returns: 0 if interface was removed, -1 if interface was not found
4985  *
4986  * This function can be used to dynamically remove network interfaces from
4987  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4988  * addition, this function is used to remove all remaining interfaces when
4989  * %wpa_supplicant is terminated.
4990  */
4991 int wpa_supplicant_remove_iface(struct wpa_global *global,
4992                                 struct wpa_supplicant *wpa_s,
4993                                 int terminate)
4994 {
4995         struct wpa_supplicant *prev;
4996 #ifdef CONFIG_MESH
4997         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4998         char *ifname = NULL;
4999 #endif /* CONFIG_MESH */
5000
5001         /* Remove interface from the global list of interfaces */
5002         prev = global->ifaces;
5003         if (prev == wpa_s) {
5004                 global->ifaces = wpa_s->next;
5005         } else {
5006                 while (prev && prev->next != wpa_s)
5007                         prev = prev->next;
5008                 if (prev == NULL)
5009                         return -1;
5010                 prev->next = wpa_s->next;
5011         }
5012
5013         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5014
5015 #ifdef CONFIG_MESH
5016         if (mesh_if_created) {
5017                 ifname = os_strdup(wpa_s->ifname);
5018                 if (ifname == NULL) {
5019                         wpa_dbg(wpa_s, MSG_ERROR,
5020                                 "mesh: Failed to malloc ifname");
5021                         return -1;
5022                 }
5023         }
5024 #endif /* CONFIG_MESH */
5025
5026         if (global->p2p_group_formation == wpa_s)
5027                 global->p2p_group_formation = NULL;
5028         if (global->p2p_invite_group == wpa_s)
5029                 global->p2p_invite_group = NULL;
5030         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5031
5032 #ifdef CONFIG_MESH
5033         if (mesh_if_created) {
5034                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5035                 os_free(ifname);
5036         }
5037 #endif /* CONFIG_MESH */
5038
5039         return 0;
5040 }
5041
5042
5043 /**
5044  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5045  * @wpa_s: Pointer to the network interface
5046  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5047  */
5048 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5049 {
5050         const char *eapol_method;
5051
5052         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5053             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5054                 return "NO-EAP";
5055         }
5056
5057         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5058         if (eapol_method == NULL)
5059                 return "UNKNOWN-EAP";
5060
5061         return eapol_method;
5062 }
5063
5064
5065 /**
5066  * wpa_supplicant_get_iface - Get a new network interface
5067  * @global: Pointer to global data from wpa_supplicant_init()
5068  * @ifname: Interface name
5069  * Returns: Pointer to the interface or %NULL if not found
5070  */
5071 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5072                                                  const char *ifname)
5073 {
5074         struct wpa_supplicant *wpa_s;
5075
5076         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5077                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5078                         return wpa_s;
5079         }
5080         return NULL;
5081 }
5082
5083
5084 #ifndef CONFIG_NO_WPA_MSG
5085 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5086 {
5087         struct wpa_supplicant *wpa_s = ctx;
5088         if (wpa_s == NULL)
5089                 return NULL;
5090         return wpa_s->ifname;
5091 }
5092 #endif /* CONFIG_NO_WPA_MSG */
5093
5094
5095 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5096 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5097 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5098
5099 /* Periodic cleanup tasks */
5100 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5101 {
5102         struct wpa_global *global = eloop_ctx;
5103         struct wpa_supplicant *wpa_s;
5104
5105         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5106                                wpas_periodic, global, NULL);
5107
5108 #ifdef CONFIG_P2P
5109         if (global->p2p)
5110                 p2p_expire_peers(global->p2p);
5111 #endif /* CONFIG_P2P */
5112
5113         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5114                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5115 #ifdef CONFIG_AP
5116                 ap_periodic(wpa_s);
5117 #endif /* CONFIG_AP */
5118         }
5119 }
5120
5121
5122 /**
5123  * wpa_supplicant_init - Initialize %wpa_supplicant
5124  * @params: Parameters for %wpa_supplicant
5125  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5126  *
5127  * This function is used to initialize %wpa_supplicant. After successful
5128  * initialization, the returned data pointer can be used to add and remove
5129  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5130  */
5131 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5132 {
5133         struct wpa_global *global;
5134         int ret, i;
5135
5136         if (params == NULL)
5137                 return NULL;
5138
5139 #ifdef CONFIG_DRIVER_NDIS
5140         {
5141                 void driver_ndis_init_ops(void);
5142                 driver_ndis_init_ops();
5143         }
5144 #endif /* CONFIG_DRIVER_NDIS */
5145
5146 #ifndef CONFIG_NO_WPA_MSG
5147         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5148 #endif /* CONFIG_NO_WPA_MSG */
5149
5150         if (params->wpa_debug_file_path)
5151                 wpa_debug_open_file(params->wpa_debug_file_path);
5152         else
5153                 wpa_debug_setup_stdout();
5154         if (params->wpa_debug_syslog)
5155                 wpa_debug_open_syslog();
5156         if (params->wpa_debug_tracing) {
5157                 ret = wpa_debug_open_linux_tracing();
5158                 if (ret) {
5159                         wpa_printf(MSG_ERROR,
5160                                    "Failed to enable trace logging");
5161                         return NULL;
5162                 }
5163         }
5164
5165         ret = eap_register_methods();
5166         if (ret) {
5167                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5168                 if (ret == -2)
5169                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5170                                    "the same EAP type.");
5171                 return NULL;
5172         }
5173
5174         global = os_zalloc(sizeof(*global));
5175         if (global == NULL)
5176                 return NULL;
5177         dl_list_init(&global->p2p_srv_bonjour);
5178         dl_list_init(&global->p2p_srv_upnp);
5179         global->params.daemonize = params->daemonize;
5180         global->params.wait_for_monitor = params->wait_for_monitor;
5181         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5182         if (params->pid_file)
5183                 global->params.pid_file = os_strdup(params->pid_file);
5184         if (params->ctrl_interface)
5185                 global->params.ctrl_interface =
5186                         os_strdup(params->ctrl_interface);
5187         if (params->ctrl_interface_group)
5188                 global->params.ctrl_interface_group =
5189                         os_strdup(params->ctrl_interface_group);
5190         if (params->override_driver)
5191                 global->params.override_driver =
5192                         os_strdup(params->override_driver);
5193         if (params->override_ctrl_interface)
5194                 global->params.override_ctrl_interface =
5195                         os_strdup(params->override_ctrl_interface);
5196 #ifdef CONFIG_P2P
5197         if (params->conf_p2p_dev)
5198                 global->params.conf_p2p_dev =
5199                         os_strdup(params->conf_p2p_dev);
5200 #endif /* CONFIG_P2P */
5201         wpa_debug_level = global->params.wpa_debug_level =
5202                 params->wpa_debug_level;
5203         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5204                 params->wpa_debug_show_keys;
5205         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5206                 params->wpa_debug_timestamp;
5207
5208         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5209
5210         if (eloop_init()) {
5211                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5212                 wpa_supplicant_deinit(global);
5213                 return NULL;
5214         }
5215
5216         random_init(params->entropy_file);
5217
5218         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5219         if (global->ctrl_iface == NULL) {
5220                 wpa_supplicant_deinit(global);
5221                 return NULL;
5222         }
5223
5224         if (wpas_notify_supplicant_initialized(global)) {
5225                 wpa_supplicant_deinit(global);
5226                 return NULL;
5227         }
5228
5229         for (i = 0; wpa_drivers[i]; i++)
5230                 global->drv_count++;
5231         if (global->drv_count == 0) {
5232                 wpa_printf(MSG_ERROR, "No drivers enabled");
5233                 wpa_supplicant_deinit(global);
5234                 return NULL;
5235         }
5236         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5237         if (global->drv_priv == NULL) {
5238                 wpa_supplicant_deinit(global);
5239                 return NULL;
5240         }
5241
5242 #ifdef CONFIG_WIFI_DISPLAY
5243         if (wifi_display_init(global) < 0) {
5244                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5245                 wpa_supplicant_deinit(global);
5246                 return NULL;
5247         }
5248 #endif /* CONFIG_WIFI_DISPLAY */
5249
5250         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5251                                wpas_periodic, global, NULL);
5252
5253         return global;
5254 }
5255
5256
5257 /**
5258  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5259  * @global: Pointer to global data from wpa_supplicant_init()
5260  * Returns: 0 after successful event loop run, -1 on failure
5261  *
5262  * This function starts the main event loop and continues running as long as
5263  * there are any remaining events. In most cases, this function is running as
5264  * long as the %wpa_supplicant process in still in use.
5265  */
5266 int wpa_supplicant_run(struct wpa_global *global)
5267 {
5268         struct wpa_supplicant *wpa_s;
5269
5270         if (global->params.daemonize &&
5271             (wpa_supplicant_daemon(global->params.pid_file) ||
5272              eloop_sock_requeue()))
5273                 return -1;
5274
5275         if (global->params.wait_for_monitor) {
5276                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5277                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5278                                 wpa_supplicant_ctrl_iface_wait(
5279                                         wpa_s->ctrl_iface);
5280         }
5281
5282         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5283         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5284
5285         eloop_run();
5286
5287         return 0;
5288 }
5289
5290
5291 /**
5292  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5293  * @global: Pointer to global data from wpa_supplicant_init()
5294  *
5295  * This function is called to deinitialize %wpa_supplicant and to free all
5296  * allocated resources. Remaining network interfaces will also be removed.
5297  */
5298 void wpa_supplicant_deinit(struct wpa_global *global)
5299 {
5300         int i;
5301
5302         if (global == NULL)
5303                 return;
5304
5305         eloop_cancel_timeout(wpas_periodic, global, NULL);
5306
5307 #ifdef CONFIG_WIFI_DISPLAY
5308         wifi_display_deinit(global);
5309 #endif /* CONFIG_WIFI_DISPLAY */
5310
5311         while (global->ifaces)
5312                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5313
5314         if (global->ctrl_iface)
5315                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5316
5317         wpas_notify_supplicant_deinitialized(global);
5318
5319         eap_peer_unregister_methods();
5320 #ifdef CONFIG_AP
5321         eap_server_unregister_methods();
5322 #endif /* CONFIG_AP */
5323
5324         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5325                 if (!global->drv_priv[i])
5326                         continue;
5327                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5328         }
5329         os_free(global->drv_priv);
5330
5331         random_deinit();
5332
5333         eloop_destroy();
5334
5335         if (global->params.pid_file) {
5336                 os_daemonize_terminate(global->params.pid_file);
5337                 os_free(global->params.pid_file);
5338         }
5339         os_free(global->params.ctrl_interface);
5340         os_free(global->params.ctrl_interface_group);
5341         os_free(global->params.override_driver);
5342         os_free(global->params.override_ctrl_interface);
5343 #ifdef CONFIG_P2P
5344         os_free(global->params.conf_p2p_dev);
5345 #endif /* CONFIG_P2P */
5346
5347         os_free(global->p2p_disallow_freq.range);
5348         os_free(global->p2p_go_avoid_freq.range);
5349         os_free(global->add_psk);
5350
5351         os_free(global);
5352         wpa_debug_close_syslog();
5353         wpa_debug_close_file();
5354         wpa_debug_close_linux_tracing();
5355 }
5356
5357
5358 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5359 {
5360         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5361             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5362                 char country[3];
5363                 country[0] = wpa_s->conf->country[0];
5364                 country[1] = wpa_s->conf->country[1];
5365                 country[2] = '\0';
5366                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5367                         wpa_printf(MSG_ERROR, "Failed to set country code "
5368                                    "'%s'", country);
5369                 }
5370         }
5371
5372         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5373                 wpas_init_ext_pw(wpa_s);
5374
5375         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5376                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5377
5378 #ifdef CONFIG_WPS
5379         wpas_wps_update_config(wpa_s);
5380 #endif /* CONFIG_WPS */
5381         wpas_p2p_update_config(wpa_s);
5382         wpa_s->conf->changed_parameters = 0;
5383 }
5384
5385
5386 void add_freq(int *freqs, int *num_freqs, int freq)
5387 {
5388         int i;
5389
5390         for (i = 0; i < *num_freqs; i++) {
5391                 if (freqs[i] == freq)
5392                         return;
5393         }
5394
5395         freqs[*num_freqs] = freq;
5396         (*num_freqs)++;
5397 }
5398
5399
5400 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5401 {
5402         struct wpa_bss *bss, *cbss;
5403         const int max_freqs = 10;
5404         int *freqs;
5405         int num_freqs = 0;
5406
5407         freqs = os_calloc(max_freqs + 1, sizeof(int));
5408         if (freqs == NULL)
5409                 return NULL;
5410
5411         cbss = wpa_s->current_bss;
5412
5413         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5414                 if (bss == cbss)
5415                         continue;
5416                 if (bss->ssid_len == cbss->ssid_len &&
5417                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5418                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5419                         add_freq(freqs, &num_freqs, bss->freq);
5420                         if (num_freqs == max_freqs)
5421                                 break;
5422                 }
5423         }
5424
5425         if (num_freqs == 0) {
5426                 os_free(freqs);
5427                 freqs = NULL;
5428         }
5429
5430         return freqs;
5431 }
5432
5433
5434 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5435 {
5436         int timeout;
5437         int count;
5438         int *freqs = NULL;
5439
5440         wpas_connect_work_done(wpa_s);
5441
5442         /*
5443          * Remove possible authentication timeout since the connection failed.
5444          */
5445         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5446
5447         /*
5448          * There is no point in blacklisting the AP if this event is
5449          * generated based on local request to disconnect.
5450          */
5451         if (wpa_s->own_disconnect_req) {
5452                 wpa_s->own_disconnect_req = 0;
5453                 wpa_dbg(wpa_s, MSG_DEBUG,
5454                         "Ignore connection failure due to local request to disconnect");
5455                 return;
5456         }
5457         if (wpa_s->disconnected) {
5458                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5459                         "indication since interface has been put into "
5460                         "disconnected state");
5461                 return;
5462         }
5463
5464         /*
5465          * Add the failed BSSID into the blacklist and speed up next scan
5466          * attempt if there could be other APs that could accept association.
5467          * The current blacklist count indicates how many times we have tried
5468          * connecting to this AP and multiple attempts mean that other APs are
5469          * either not available or has already been tried, so that we can start
5470          * increasing the delay here to avoid constant scanning.
5471          */
5472         count = wpa_blacklist_add(wpa_s, bssid);
5473         if (count == 1 && wpa_s->current_bss) {
5474                 /*
5475                  * This BSS was not in the blacklist before. If there is
5476                  * another BSS available for the same ESS, we should try that
5477                  * next. Otherwise, we may as well try this one once more
5478                  * before allowing other, likely worse, ESSes to be considered.
5479                  */
5480                 freqs = get_bss_freqs_in_ess(wpa_s);
5481                 if (freqs) {
5482                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5483                                 "has been seen; try it next");
5484                         wpa_blacklist_add(wpa_s, bssid);
5485                         /*
5486                          * On the next scan, go through only the known channels
5487                          * used in this ESS based on previous scans to speed up
5488                          * common load balancing use case.
5489                          */
5490                         os_free(wpa_s->next_scan_freqs);
5491                         wpa_s->next_scan_freqs = freqs;
5492                 }
5493         }
5494
5495         /*
5496          * Add previous failure count in case the temporary blacklist was
5497          * cleared due to no other BSSes being available.
5498          */
5499         count += wpa_s->extra_blacklist_count;
5500
5501         if (count > 3 && wpa_s->current_ssid) {
5502                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5503                            "consider temporary network disabling");
5504                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5505         }
5506
5507         switch (count) {
5508         case 1:
5509                 timeout = 100;
5510                 break;
5511         case 2:
5512                 timeout = 500;
5513                 break;
5514         case 3:
5515                 timeout = 1000;
5516                 break;
5517         case 4:
5518                 timeout = 5000;
5519                 break;
5520         default:
5521                 timeout = 10000;
5522                 break;
5523         }
5524
5525         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5526                 "ms", count, timeout);
5527
5528         /*
5529          * TODO: if more than one possible AP is available in scan results,
5530          * could try the other ones before requesting a new scan.
5531          */
5532         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5533                                 1000 * (timeout % 1000));
5534 }
5535
5536
5537 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5538 {
5539         return wpa_s->conf->ap_scan == 2 ||
5540                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5541 }
5542
5543
5544 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5545 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5546                                               struct wpa_ssid *ssid,
5547                                               const char *field,
5548                                               const char *value)
5549 {
5550 #ifdef IEEE8021X_EAPOL
5551         struct eap_peer_config *eap = &ssid->eap;
5552
5553         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5554         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5555                               (const u8 *) value, os_strlen(value));
5556
5557         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5558         case WPA_CTRL_REQ_EAP_IDENTITY:
5559                 os_free(eap->identity);
5560                 eap->identity = (u8 *) os_strdup(value);
5561                 eap->identity_len = os_strlen(value);
5562                 eap->pending_req_identity = 0;
5563                 if (ssid == wpa_s->current_ssid)
5564                         wpa_s->reassociate = 1;
5565                 break;
5566         case WPA_CTRL_REQ_EAP_PASSWORD:
5567                 bin_clear_free(eap->password, eap->password_len);
5568                 eap->password = (u8 *) os_strdup(value);
5569                 eap->password_len = os_strlen(value);
5570                 eap->pending_req_password = 0;
5571                 if (ssid == wpa_s->current_ssid)
5572                         wpa_s->reassociate = 1;
5573                 break;
5574         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5575                 bin_clear_free(eap->new_password, eap->new_password_len);
5576                 eap->new_password = (u8 *) os_strdup(value);
5577                 eap->new_password_len = os_strlen(value);
5578                 eap->pending_req_new_password = 0;
5579                 if (ssid == wpa_s->current_ssid)
5580                         wpa_s->reassociate = 1;
5581                 break;
5582         case WPA_CTRL_REQ_EAP_PIN:
5583                 str_clear_free(eap->pin);
5584                 eap->pin = os_strdup(value);
5585                 eap->pending_req_pin = 0;
5586                 if (ssid == wpa_s->current_ssid)
5587                         wpa_s->reassociate = 1;
5588                 break;
5589         case WPA_CTRL_REQ_EAP_OTP:
5590                 bin_clear_free(eap->otp, eap->otp_len);
5591                 eap->otp = (u8 *) os_strdup(value);
5592                 eap->otp_len = os_strlen(value);
5593                 os_free(eap->pending_req_otp);
5594                 eap->pending_req_otp = NULL;
5595                 eap->pending_req_otp_len = 0;
5596                 break;
5597         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5598                 str_clear_free(eap->private_key_passwd);
5599                 eap->private_key_passwd = os_strdup(value);
5600                 eap->pending_req_passphrase = 0;
5601                 if (ssid == wpa_s->current_ssid)
5602                         wpa_s->reassociate = 1;
5603                 break;
5604         case WPA_CTRL_REQ_SIM:
5605                 str_clear_free(eap->external_sim_resp);
5606                 eap->external_sim_resp = os_strdup(value);
5607                 break;
5608         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5609                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5610                         return -1;
5611                 ssid->mem_only_psk = 1;
5612                 if (ssid->passphrase)
5613                         wpa_config_update_psk(ssid);
5614                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5615                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5616                 break;
5617         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5618                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5619                         return -1;
5620                 if (os_strcmp(value, "good") == 0)
5621                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5622                 else if (os_strcmp(value, "bad") == 0)
5623                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5624                 else
5625                         return -1;
5626                 break;
5627         default:
5628                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5629                 return -1;
5630         }
5631
5632         return 0;
5633 #else /* IEEE8021X_EAPOL */
5634         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5635         return -1;
5636 #endif /* IEEE8021X_EAPOL */
5637 }
5638 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5639
5640
5641 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5642 {
5643         int i;
5644         unsigned int drv_enc;
5645
5646         if (wpa_s->p2p_mgmt)
5647                 return 1; /* no normal network profiles on p2p_mgmt interface */
5648
5649         if (ssid == NULL)
5650                 return 1;
5651
5652         if (ssid->disabled)
5653                 return 1;
5654
5655         if (wpa_s->drv_capa_known)
5656                 drv_enc = wpa_s->drv_enc;
5657         else
5658                 drv_enc = (unsigned int) -1;
5659
5660         for (i = 0; i < NUM_WEP_KEYS; i++) {
5661                 size_t len = ssid->wep_key_len[i];
5662                 if (len == 0)
5663                         continue;
5664                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5665                         continue;
5666                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5667                         continue;
5668                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5669                         continue;
5670                 return 1; /* invalid WEP key */
5671         }
5672
5673         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5674             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5675             !ssid->mem_only_psk)
5676                 return 1;
5677
5678         return 0;
5679 }
5680
5681
5682 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5683 {
5684 #ifdef CONFIG_IEEE80211W
5685         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5686                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5687                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5688                         /*
5689                          * Driver does not support BIP -- ignore pmf=1 default
5690                          * since the connection with PMF would fail and the
5691                          * configuration does not require PMF to be enabled.
5692                          */
5693                         return NO_MGMT_FRAME_PROTECTION;
5694                 }
5695
5696                 return wpa_s->conf->pmf;
5697         }
5698
5699         return ssid->ieee80211w;
5700 #else /* CONFIG_IEEE80211W */
5701         return NO_MGMT_FRAME_PROTECTION;
5702 #endif /* CONFIG_IEEE80211W */
5703 }
5704
5705
5706 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5707 {
5708         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5709                 return 1;
5710         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5711                 return 0;
5712         return -1;
5713 }
5714
5715
5716 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5717 {
5718         struct wpa_ssid *ssid = wpa_s->current_ssid;
5719         int dur;
5720         struct os_reltime now;
5721
5722         if (ssid == NULL) {
5723                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5724                            "SSID block");
5725                 return;
5726         }
5727
5728         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5729                 return;
5730
5731         ssid->auth_failures++;
5732
5733 #ifdef CONFIG_P2P
5734         if (ssid->p2p_group &&
5735             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5736                 /*
5737                  * Skip the wait time since there is a short timeout on the
5738                  * connection to a P2P group.
5739                  */
5740                 return;
5741         }
5742 #endif /* CONFIG_P2P */
5743
5744         if (ssid->auth_failures > 50)
5745                 dur = 300;
5746         else if (ssid->auth_failures > 10)
5747                 dur = 120;
5748         else if (ssid->auth_failures > 5)
5749                 dur = 90;
5750         else if (ssid->auth_failures > 3)
5751                 dur = 60;
5752         else if (ssid->auth_failures > 2)
5753                 dur = 30;
5754         else if (ssid->auth_failures > 1)
5755                 dur = 20;
5756         else
5757                 dur = 10;
5758
5759         if (ssid->auth_failures > 1 &&
5760             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5761                 dur += os_random() % (ssid->auth_failures * 10);
5762
5763         os_get_reltime(&now);
5764         if (now.sec + dur <= ssid->disabled_until.sec)
5765                 return;
5766
5767         ssid->disabled_until.sec = now.sec + dur;
5768
5769         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5770                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5771                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5772                 ssid->auth_failures, dur, reason);
5773 }
5774
5775
5776 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5777                               struct wpa_ssid *ssid, int clear_failures)
5778 {
5779         if (ssid == NULL)
5780                 return;
5781
5782         if (ssid->disabled_until.sec) {
5783                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5784                         "id=%d ssid=\"%s\"",
5785                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5786         }
5787         ssid->disabled_until.sec = 0;
5788         ssid->disabled_until.usec = 0;
5789         if (clear_failures)
5790                 ssid->auth_failures = 0;
5791 }
5792
5793
5794 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5795 {
5796         size_t i;
5797
5798         if (wpa_s->disallow_aps_bssid == NULL)
5799                 return 0;
5800
5801         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5802                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5803                               bssid, ETH_ALEN) == 0)
5804                         return 1;
5805         }
5806
5807         return 0;
5808 }
5809
5810
5811 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5812                     size_t ssid_len)
5813 {
5814         size_t i;
5815
5816         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5817                 return 0;
5818
5819         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5820                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5821                 if (ssid_len == s->ssid_len &&
5822                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5823                         return 1;
5824         }
5825
5826         return 0;
5827 }
5828
5829
5830 /**
5831  * wpas_request_connection - Request a new connection
5832  * @wpa_s: Pointer to the network interface
5833  *
5834  * This function is used to request a new connection to be found. It will mark
5835  * the interface to allow reassociation and request a new scan to find a
5836  * suitable network to connect to.
5837  */
5838 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5839 {
5840         wpa_s->normal_scans = 0;
5841         wpa_s->scan_req = NORMAL_SCAN_REQ;
5842         wpa_supplicant_reinit_autoscan(wpa_s);
5843         wpa_s->extra_blacklist_count = 0;
5844         wpa_s->disconnected = 0;
5845         wpa_s->reassociate = 1;
5846
5847         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5848                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5849         else
5850                 wpa_s->reattach = 0;
5851 }
5852
5853
5854 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5855                     struct wpa_used_freq_data *freqs_data,
5856                     unsigned int len)
5857 {
5858         unsigned int i;
5859
5860         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5861                 len, title);
5862         for (i = 0; i < len; i++) {
5863                 struct wpa_used_freq_data *cur = &freqs_data[i];
5864                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5865                         i, cur->freq, cur->flags);
5866         }
5867 }
5868
5869
5870 /*
5871  * Find the operating frequencies of any of the virtual interfaces that
5872  * are using the same radio as the current interface, and in addition, get
5873  * information about the interface types that are using the frequency.
5874  */
5875 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5876                                 struct wpa_used_freq_data *freqs_data,
5877                                 unsigned int len)
5878 {
5879         struct wpa_supplicant *ifs;
5880         u8 bssid[ETH_ALEN];
5881         int freq;
5882         unsigned int idx = 0, i;
5883
5884         wpa_dbg(wpa_s, MSG_DEBUG,
5885                 "Determining shared radio frequencies (max len %u)", len);
5886         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5887
5888         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5889                          radio_list) {
5890                 if (idx == len)
5891                         break;
5892
5893                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5894                         continue;
5895
5896                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5897                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5898                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5899                         freq = ifs->current_ssid->frequency;
5900                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5901                         freq = ifs->assoc_freq;
5902                 else
5903                         continue;
5904
5905                 /* Hold only distinct freqs */
5906                 for (i = 0; i < idx; i++)
5907                         if (freqs_data[i].freq == freq)
5908                                 break;
5909
5910                 if (i == idx)
5911                         freqs_data[idx++].freq = freq;
5912
5913                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5914                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5915                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5916                                 WPA_FREQ_USED_BY_INFRA_STATION;
5917                 }
5918         }
5919
5920         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5921         return idx;
5922 }
5923
5924
5925 /*
5926  * Find the operating frequencies of any of the virtual interfaces that
5927  * are using the same radio as the current interface.
5928  */
5929 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5930                            int *freq_array, unsigned int len)
5931 {
5932         struct wpa_used_freq_data *freqs_data;
5933         int num, i;
5934
5935         os_memset(freq_array, 0, sizeof(int) * len);
5936
5937         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5938         if (!freqs_data)
5939                 return -1;
5940
5941         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5942         for (i = 0; i < num; i++)
5943                 freq_array[i] = freqs_data[i].freq;
5944
5945         os_free(freqs_data);
5946
5947         return num;
5948 }
5949
5950
5951 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5952 {
5953         struct rrm_data *rrm = data;
5954
5955         if (!rrm->notify_neighbor_rep) {
5956                 wpa_printf(MSG_ERROR,
5957                            "RRM: Unexpected neighbor report timeout");
5958                 return;
5959         }
5960
5961         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5962         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5963
5964         rrm->notify_neighbor_rep = NULL;
5965         rrm->neighbor_rep_cb_ctx = NULL;
5966 }
5967
5968
5969 /*
5970  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5971  * @wpa_s: Pointer to wpa_supplicant
5972  */
5973 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5974 {
5975         wpa_s->rrm.rrm_used = 0;
5976
5977         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5978                              NULL);
5979         if (wpa_s->rrm.notify_neighbor_rep)
5980                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5981         wpa_s->rrm.next_neighbor_rep_token = 1;
5982 }
5983
5984
5985 /*
5986  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5987  * @wpa_s: Pointer to wpa_supplicant
5988  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5989  * @report_len: Length of neighbor report buffer
5990  */
5991 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5992                                    const u8 *report, size_t report_len)
5993 {
5994         struct wpabuf *neighbor_rep;
5995
5996         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5997         if (report_len < 1)
5998                 return;
5999
6000         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6001                 wpa_printf(MSG_DEBUG,
6002                            "RRM: Discarding neighbor report with token %d (expected %d)",
6003                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6004                 return;
6005         }
6006
6007         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6008                              NULL);
6009
6010         if (!wpa_s->rrm.notify_neighbor_rep) {
6011                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6012                 return;
6013         }
6014
6015         /* skipping the first byte, which is only an id (dialog token) */
6016         neighbor_rep = wpabuf_alloc(report_len - 1);
6017         if (neighbor_rep == NULL)
6018                 return;
6019         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6020         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6021                    report[0]);
6022         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6023                                        neighbor_rep);
6024         wpa_s->rrm.notify_neighbor_rep = NULL;
6025         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6026 }
6027
6028
6029 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6030 /* Workaround different, undefined for Windows, error codes used here */
6031 #define ENOTCONN -1
6032 #define EOPNOTSUPP -1
6033 #define ECANCELED -1
6034 #endif
6035
6036 /**
6037  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6038  * @wpa_s: Pointer to wpa_supplicant
6039  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6040  *        is sent in the request.
6041  * @cb: Callback function to be called once the requested report arrives, or
6042  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6043  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6044  *      the requester's responsibility to free it.
6045  *      In the latter case NULL will be sent in 'neighbor_rep'.
6046  * @cb_ctx: Context value to send the callback function
6047  * Returns: 0 in case of success, negative error code otherwise
6048  *
6049  * In case there is a previous request which has not been answered yet, the
6050  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6051  * Request must contain a callback function.
6052  */
6053 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6054                                        const struct wpa_ssid *ssid,
6055                                        void (*cb)(void *ctx,
6056                                                   struct wpabuf *neighbor_rep),
6057                                        void *cb_ctx)
6058 {
6059         struct wpabuf *buf;
6060         const u8 *rrm_ie;
6061
6062         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6063                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6064                 return -ENOTCONN;
6065         }
6066
6067         if (!wpa_s->rrm.rrm_used) {
6068                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6069                 return -EOPNOTSUPP;
6070         }
6071
6072         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6073                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6074         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6075             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6076                 wpa_printf(MSG_DEBUG,
6077                            "RRM: No network support for Neighbor Report.");
6078                 return -EOPNOTSUPP;
6079         }
6080
6081         if (!cb) {
6082                 wpa_printf(MSG_DEBUG,
6083                            "RRM: Neighbor Report request must provide a callback.");
6084                 return -EINVAL;
6085         }
6086
6087         /* Refuse if there's a live request */
6088         if (wpa_s->rrm.notify_neighbor_rep) {
6089                 wpa_printf(MSG_DEBUG,
6090                            "RRM: Currently handling previous Neighbor Report.");
6091                 return -EBUSY;
6092         }
6093
6094         /* 3 = action category + action code + dialog token */
6095         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6096         if (buf == NULL) {
6097                 wpa_printf(MSG_DEBUG,
6098                            "RRM: Failed to allocate Neighbor Report Request");
6099                 return -ENOMEM;
6100         }
6101
6102         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6103                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6104                    wpa_s->rrm.next_neighbor_rep_token);
6105
6106         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6107         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6108         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6109         if (ssid) {
6110                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6111                 wpabuf_put_u8(buf, ssid->ssid_len);
6112                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6113         }
6114
6115         wpa_s->rrm.next_neighbor_rep_token++;
6116
6117         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6118                                 wpa_s->own_addr, wpa_s->bssid,
6119                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6120                 wpa_printf(MSG_DEBUG,
6121                            "RRM: Failed to send Neighbor Report Request");
6122                 wpabuf_free(buf);
6123                 return -ECANCELED;
6124         }
6125
6126         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6127         wpa_s->rrm.notify_neighbor_rep = cb;
6128         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6129                                wpas_rrm_neighbor_rep_timeout_handler,
6130                                &wpa_s->rrm, NULL);
6131
6132         wpabuf_free(buf);
6133         return 0;
6134 }
6135
6136
6137 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6138                                               const u8 *src,
6139                                               const u8 *frame, size_t len,
6140                                               int rssi)
6141 {
6142         struct wpabuf *buf;
6143         const struct rrm_link_measurement_request *req;
6144         struct rrm_link_measurement_report report;
6145
6146         if (wpa_s->wpa_state != WPA_COMPLETED) {
6147                 wpa_printf(MSG_INFO,
6148                            "RRM: Ignoring link measurement request. Not associated");
6149                 return;
6150         }
6151
6152         if (!wpa_s->rrm.rrm_used) {
6153                 wpa_printf(MSG_INFO,
6154                            "RRM: Ignoring link measurement request. Not RRM network");
6155                 return;
6156         }
6157
6158         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6159                 wpa_printf(MSG_INFO,
6160                            "RRM: Measurement report failed. TX power insertion not supported");
6161                 return;
6162         }
6163
6164         req = (const struct rrm_link_measurement_request *) frame;
6165         if (len < sizeof(*req)) {
6166                 wpa_printf(MSG_INFO,
6167                            "RRM: Link measurement report failed. Request too short");
6168                 return;
6169         }
6170
6171         os_memset(&report, 0, sizeof(report));
6172         report.tpc.eid = WLAN_EID_TPC_REPORT;
6173         report.tpc.len = 2;
6174         report.rsni = 255; /* 255 indicates that RSNI is not available */
6175         report.dialog_token = req->dialog_token;
6176
6177         /*
6178          * It's possible to estimate RCPI based on RSSI in dBm. This
6179          * calculation will not reflect the correct value for high rates,
6180          * but it's good enough for Action frames which are transmitted
6181          * with up to 24 Mbps rates.
6182          */
6183         if (!rssi)
6184                 report.rcpi = 255; /* not available */
6185         else if (rssi < -110)
6186                 report.rcpi = 0;
6187         else if (rssi > 0)
6188                 report.rcpi = 220;
6189         else
6190                 report.rcpi = (rssi + 110) * 2;
6191
6192         /* action_category + action_code */
6193         buf = wpabuf_alloc(2 + sizeof(report));
6194         if (buf == NULL) {
6195                 wpa_printf(MSG_ERROR,
6196                            "RRM: Link measurement report failed. Buffer allocation failed");
6197                 return;
6198         }
6199
6200         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6201         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6202         wpabuf_put_data(buf, &report, sizeof(report));
6203         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6204                     wpabuf_head(buf), wpabuf_len(buf));
6205
6206         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6207                                 wpa_s->own_addr, wpa_s->bssid,
6208                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6209                 wpa_printf(MSG_ERROR,
6210                            "RRM: Link measurement report failed. Send action failed");
6211         }
6212         wpabuf_free(buf);
6213 }
6214
6215
6216 struct wpa_supplicant *
6217 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6218 {
6219         switch (frame) {
6220 #ifdef CONFIG_P2P
6221         case VENDOR_ELEM_PROBE_REQ_P2P:
6222         case VENDOR_ELEM_PROBE_RESP_P2P:
6223         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6224         case VENDOR_ELEM_BEACON_P2P_GO:
6225         case VENDOR_ELEM_P2P_PD_REQ:
6226         case VENDOR_ELEM_P2P_PD_RESP:
6227         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6228         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6229         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6230         case VENDOR_ELEM_P2P_INV_REQ:
6231         case VENDOR_ELEM_P2P_INV_RESP:
6232         case VENDOR_ELEM_P2P_ASSOC_REQ:
6233         case VENDOR_ELEM_P2P_ASSOC_RESP:
6234                 return wpa_s->parent;
6235 #endif /* CONFIG_P2P */
6236         default:
6237                 return wpa_s;
6238         }
6239 }
6240
6241
6242 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6243 {
6244         unsigned int i;
6245         char buf[30];
6246
6247         wpa_printf(MSG_DEBUG, "Update vendor elements");
6248
6249         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6250                 if (wpa_s->vendor_elem[i]) {
6251                         int res;
6252
6253                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6254                         if (!os_snprintf_error(sizeof(buf), res)) {
6255                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6256                                                 wpa_s->vendor_elem[i]);
6257                         }
6258                 }
6259         }
6260
6261 #ifdef CONFIG_P2P
6262         if (wpa_s->parent == wpa_s &&
6263             wpa_s->global->p2p &&
6264             !wpa_s->global->p2p_disabled)
6265                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6266 #endif /* CONFIG_P2P */
6267 }
6268
6269
6270 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6271                             const u8 *elem, size_t len)
6272 {
6273         u8 *ie, *end;
6274
6275         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6276         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6277
6278         for (; ie + 1 < end; ie += 2 + ie[1]) {
6279                 if (ie + len > end)
6280                         break;
6281                 if (os_memcmp(ie, elem, len) != 0)
6282                         continue;
6283
6284                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6285                         wpabuf_free(wpa_s->vendor_elem[frame]);
6286                         wpa_s->vendor_elem[frame] = NULL;
6287                 } else {
6288                         os_memmove(ie, ie + len, end - (ie + len));
6289                         wpa_s->vendor_elem[frame]->used -= len;
6290                 }
6291                 wpas_vendor_elem_update(wpa_s);
6292                 return 0;
6293         }
6294
6295         return -1;
6296 }
6297
6298
6299 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6300                                    u16 num_modes, enum hostapd_hw_mode mode)
6301 {
6302         u16 i;
6303
6304         for (i = 0; i < num_modes; i++) {
6305                 if (modes[i].mode == mode)
6306                         return &modes[i];
6307         }
6308
6309         return NULL;
6310 }