wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548
 549         wpa_s->sched_scan_plans_num = 0;
 550         os_free(wpa_s->sched_scan_plans);
 551         wpa_s->sched_scan_plans = NULL;
 552 }
 553
 554
 555 /**
 556  * wpa_clear_keys - Clear keys configured for the driver
 557  * @wpa_s: Pointer to wpa_supplicant data
 558  * @addr: Previously used BSSID or %NULL if not available
 559  *
 560  * This function clears the encryption keys that has been previously configured
 561  * for the driver.
 562  */
 563 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 564 {
 565         int i, max;
 566
 567 #ifdef CONFIG_IEEE80211W
 568         max = 6;
 569 #else /* CONFIG_IEEE80211W */
 570         max = 4;
 571 #endif /* CONFIG_IEEE80211W */
 572
 573         /* MLME-DELETEKEYS.request */
 574         for (i = 0; i < max; i++) {
 575                 if (wpa_s->keys_cleared & BIT(i))
 576                         continue;
 577                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 578                                 NULL, 0);
 579         }
 580         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 581             !is_zero_ether_addr(addr)) {
 582                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 583                                 0);
 584                 /* MLME-SETPROTECTION.request(None) */
 585                 wpa_drv_mlme_setprotection(
 586                         wpa_s, addr,
 587                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 588                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 589         }
 590         wpa_s->keys_cleared = (u32) -1;
 591 }
 592
 593
 594 /**
 595  * wpa_supplicant_state_txt - Get the connection state name as a text string
 596  * @state: State (wpa_state; WPA_*)
 597  * Returns: The state name as a printable text string
 598  */
 599 const char * wpa_supplicant_state_txt(enum wpa_states state)
 600 {
 601         switch (state) {
 602         case WPA_DISCONNECTED:
 603                 return "DISCONNECTED";
 604         case WPA_INACTIVE:
 605                 return "INACTIVE";
 606         case WPA_INTERFACE_DISABLED:
 607                 return "INTERFACE_DISABLED";
 608         case WPA_SCANNING:
 609                 return "SCANNING";
 610         case WPA_AUTHENTICATING:
 611                 return "AUTHENTICATING";
 612         case WPA_ASSOCIATING:
 613                 return "ASSOCIATING";
 614         case WPA_ASSOCIATED:
 615                 return "ASSOCIATED";
 616         case WPA_4WAY_HANDSHAKE:
 617                 return "4WAY_HANDSHAKE";
 618         case WPA_GROUP_HANDSHAKE:
 619                 return "GROUP_HANDSHAKE";
 620         case WPA_COMPLETED:
 621                 return "COMPLETED";
 622         default:
 623                 return "UNKNOWN";
 624         }
 625 }
 626
 627
 628 #ifdef CONFIG_BGSCAN
 629
 630 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 631 {
 632         const char *name;
 633
 634         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 635                 name = wpa_s->current_ssid->bgscan;
 636         else
 637                 name = wpa_s->conf->bgscan;
 638         if (name == NULL || name[0] == '\0')
 639                 return;
 640         if (wpas_driver_bss_selection(wpa_s))
 641                 return;
 642         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 643                 return;
 644 #ifdef CONFIG_P2P
 645         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 646                 return;
 647 #endif /* CONFIG_P2P */
 648
 649         bgscan_deinit(wpa_s);
 650         if (wpa_s->current_ssid) {
 651                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 652                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 653                                 "bgscan");
 654                         /*
 655                          * Live without bgscan; it is only used as a roaming
 656                          * optimization, so the initial connection is not
 657                          * affected.
 658                          */
 659                 } else {
 660                         struct wpa_scan_results *scan_res;
 661                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 662                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 663                                                                    0);
 664                         if (scan_res) {
 665                                 bgscan_notify_scan(wpa_s, scan_res);
 666                                 wpa_scan_results_free(scan_res);
 667                         }
 668                 }
 669         } else
 670                 wpa_s->bgscan_ssid = NULL;
 671 }
 672
 673
 674 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 675 {
 676         if (wpa_s->bgscan_ssid != NULL) {
 677                 bgscan_deinit(wpa_s);
 678                 wpa_s->bgscan_ssid = NULL;
 679         }
 680 }
 681
 682 #endif /* CONFIG_BGSCAN */
 683
 684
 685 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 686 {
 687         if (autoscan_init(wpa_s, 0))
 688                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 689 }
 690
 691
 692 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 693 {
 694         autoscan_deinit(wpa_s);
 695 }
 696
 697
 698 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 699 {
 700         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 701             wpa_s->wpa_state == WPA_SCANNING) {
 702                 autoscan_deinit(wpa_s);
 703                 wpa_supplicant_start_autoscan(wpa_s);
 704         }
 705 }
 706
 707
 708 /**
 709  * wpa_supplicant_set_state - Set current connection state
 710  * @wpa_s: Pointer to wpa_supplicant data
 711  * @state: The new connection state
 712  *
 713  * This function is called whenever the connection state changes, e.g.,
 714  * association is completed for WPA/WPA2 4-Way Handshake is started.
 715  */
 716 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 717                               enum wpa_states state)
 718 {
 719         enum wpa_states old_state = wpa_s->wpa_state;
 720
 721         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 722                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 723                 wpa_supplicant_state_txt(state));
 724
 725         if (state == WPA_INTERFACE_DISABLED) {
 726                 /* Assure normal scan when interface is restored */
 727                 wpa_s->normal_scans = 0;
 728         }
 729
 730         if (state == WPA_COMPLETED) {
 731                 wpas_connect_work_done(wpa_s);
 732                 /* Reinitialize normal_scan counter */
 733                 wpa_s->normal_scans = 0;
 734         }
 735
 736 #ifdef CONFIG_P2P
 737         /*
 738          * P2PS client has to reply to Probe Request frames received on the
 739          * group operating channel. Enable Probe Request frame reporting for
 740          * P2P connected client in case p2p_cli_probe configuration property is
 741          * set to 1.
 742          */
 743         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 744             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 745             wpa_s->current_ssid->p2p_group) {
 746                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 747                         wpa_dbg(wpa_s, MSG_DEBUG,
 748                                 "P2P: Enable CLI Probe Request RX reporting");
 749                         wpa_s->p2p_cli_probe =
 750                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 751                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 752                         wpa_dbg(wpa_s, MSG_DEBUG,
 753                                 "P2P: Disable CLI Probe Request RX reporting");
 754                         wpa_s->p2p_cli_probe = 0;
 755                         wpa_drv_probe_req_report(wpa_s, 0);
 756                 }
 757         }
 758 #endif /* CONFIG_P2P */
 759
 760         if (state != WPA_SCANNING)
 761                 wpa_supplicant_notify_scanning(wpa_s, 0);
 762
 763         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 764                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 765 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 766                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 767                         MACSTR " completed [id=%d id_str=%s]",
 768                         MAC2STR(wpa_s->bssid),
 769                         ssid ? ssid->id : -1,
 770                         ssid && ssid->id_str ? ssid->id_str : "");
 771 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 772                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 773                 wpa_blacklist_clear(wpa_s);
 774                 wpa_s->extra_blacklist_count = 0;
 775                 wpa_s->new_connection = 0;
 776                 wpa_drv_set_operstate(wpa_s, 1);
 777 #ifndef IEEE8021X_EAPOL
 778                 wpa_drv_set_supp_port(wpa_s, 1);
 779 #endif /* IEEE8021X_EAPOL */
 780                 wpa_s->after_wps = 0;
 781                 wpa_s->known_wps_freq = 0;
 782                 wpas_p2p_completed(wpa_s);
 783
 784                 sme_sched_obss_scan(wpa_s, 1);
 785         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 786                    state == WPA_ASSOCIATED) {
 787                 wpa_s->new_connection = 1;
 788                 wpa_drv_set_operstate(wpa_s, 0);
 789 #ifndef IEEE8021X_EAPOL
 790                 wpa_drv_set_supp_port(wpa_s, 0);
 791 #endif /* IEEE8021X_EAPOL */
 792                 sme_sched_obss_scan(wpa_s, 0);
 793         }
 794         wpa_s->wpa_state = state;
 795
 796 #ifdef CONFIG_BGSCAN
 797         if (state == WPA_COMPLETED)
 798                 wpa_supplicant_start_bgscan(wpa_s);
 799         else if (state < WPA_ASSOCIATED)
 800                 wpa_supplicant_stop_bgscan(wpa_s);
 801 #endif /* CONFIG_BGSCAN */
 802
 803         if (state == WPA_AUTHENTICATING)
 804                 wpa_supplicant_stop_autoscan(wpa_s);
 805
 806         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 807                 wpa_supplicant_start_autoscan(wpa_s);
 808
 809         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 810                 wmm_ac_notify_disassoc(wpa_s);
 811
 812         if (wpa_s->wpa_state != old_state) {
 813                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 814
 815                 /*
 816                  * Notify the P2P Device interface about a state change in one
 817                  * of the interfaces.
 818                  */
 819                 wpas_p2p_indicate_state_change(wpa_s);
 820
 821                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 822                     old_state == WPA_COMPLETED)
 823                         wpas_notify_auth_changed(wpa_s);
 824         }
 825 }
 826
 827
 828 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 829 {
 830         int pending = 0;
 831 #ifdef CONFIG_WPS
 832         struct wpa_supplicant *wpa_s = global->ifaces;
 833         while (wpa_s) {
 834                 struct wpa_supplicant *next = wpa_s->next;
 835                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 836                         pending = 1;
 837 #ifdef CONFIG_P2P
 838                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 839                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 840                         wpas_p2p_disconnect(wpa_s);
 841 #endif /* CONFIG_P2P */
 842                 wpa_s = next;
 843         }
 844 #endif /* CONFIG_WPS */
 845         if (pending)
 846                 return;
 847         eloop_terminate();
 848 }
 849
 850
 851 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 852 {
 853         struct wpa_global *global = signal_ctx;
 854         wpa_supplicant_terminate_proc(global);
 855 }
 856
 857
 858 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 859 {
 860         enum wpa_states old_state = wpa_s->wpa_state;
 861
 862         wpa_s->pairwise_cipher = 0;
 863         wpa_s->group_cipher = 0;
 864         wpa_s->mgmt_group_cipher = 0;
 865         wpa_s->key_mgmt = 0;
 866         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 867                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 868
 869         if (wpa_s->wpa_state != old_state)
 870                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 871 }
 872
 873
 874 /**
 875  * wpa_supplicant_reload_configuration - Reload configuration data
 876  * @wpa_s: Pointer to wpa_supplicant data
 877  * Returns: 0 on success or -1 if configuration parsing failed
 878  *
 879  * This function can be used to request that the configuration data is reloaded
 880  * (e.g., after configuration file change). This function is reloading
 881  * configuration only for one interface, so this may need to be called multiple
 882  * times if %wpa_supplicant is controlling multiple interfaces and all
 883  * interfaces need reconfiguration.
 884  */
 885 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 886 {
 887         struct wpa_config *conf;
 888         int reconf_ctrl;
 889         int old_ap_scan;
 890
 891         if (wpa_s->confname == NULL)
 892                 return -1;
 893         conf = wpa_config_read(wpa_s->confname, NULL);
 894         if (conf == NULL) {
 895                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 896                         "file '%s' - exiting", wpa_s->confname);
 897                 return -1;
 898         }
 899         wpa_config_read(wpa_s->confanother, conf);
 900
 901         conf->changed_parameters = (unsigned int) -1;
 902
 903         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 904                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 905                     os_strcmp(conf->ctrl_interface,
 906                               wpa_s->conf->ctrl_interface) != 0);
 907
 908         if (reconf_ctrl && wpa_s->ctrl_iface) {
 909                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 910                 wpa_s->ctrl_iface = NULL;
 911         }
 912
 913         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 914         if (wpa_s->current_ssid) {
 915                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 916                         wpa_s->own_disconnect_req = 1;
 917                 wpa_supplicant_deauthenticate(wpa_s,
 918                                               WLAN_REASON_DEAUTH_LEAVING);
 919         }
 920
 921         /*
 922          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 923          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 924          */
 925         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 926                 /*
 927                  * Clear forced success to clear EAP state for next
 928                  * authentication.
 929                  */
 930                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 931         }
 932         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 933         wpa_sm_set_config(wpa_s->wpa, NULL);
 934         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 935         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 936         rsn_preauth_deinit(wpa_s->wpa);
 937
 938         old_ap_scan = wpa_s->conf->ap_scan;
 939         wpa_config_free(wpa_s->conf);
 940         wpa_s->conf = conf;
 941         if (old_ap_scan != wpa_s->conf->ap_scan)
 942                 wpas_notify_ap_scan_changed(wpa_s);
 943
 944         if (reconf_ctrl)
 945                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 946
 947         wpa_supplicant_update_config(wpa_s);
 948
 949         wpa_supplicant_clear_status(wpa_s);
 950         if (wpa_supplicant_enabled_networks(wpa_s)) {
 951                 wpa_s->reassociate = 1;
 952                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 953         }
 954         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 955         return 0;
 956 }
 957
 958
 959 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 960 {
 961         struct wpa_global *global = signal_ctx;
 962         struct wpa_supplicant *wpa_s;
 963         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 964                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 965                         sig);
 966                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 967                         wpa_supplicant_terminate_proc(global);
 968                 }
 969         }
 970
 971         if (wpa_debug_reopen_file() < 0) {
 972                 /* Ignore errors since we cannot really do much to fix this */
 973                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 974         }
 975 }
 976
 977
 978 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 979                                          struct wpa_ssid *ssid,
 980                                          struct wpa_ie_data *ie)
 981 {
 982         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 983         if (ret) {
 984                 if (ret == -2) {
 985                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 986                                 "from association info");
 987                 }
 988                 return -1;
 989         }
 990
 991         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 992                 "cipher suites");
 993         if (!(ie->group_cipher & ssid->group_cipher)) {
 994                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 995                         "cipher 0x%x (mask 0x%x) - reject",
 996                         ie->group_cipher, ssid->group_cipher);
 997                 return -1;
 998         }
 999         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1000                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1001                         "cipher 0x%x (mask 0x%x) - reject",
1002                         ie->pairwise_cipher, ssid->pairwise_cipher);
1003                 return -1;
1004         }
1005         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1007                         "management 0x%x (mask 0x%x) - reject",
1008                         ie->key_mgmt, ssid->key_mgmt);
1009                 return -1;
1010         }
1011
1012 #ifdef CONFIG_IEEE80211W
1013         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1014             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1015                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1016                         "that does not support management frame protection - "
1017                         "reject");
1018                 return -1;
1019         }
1020 #endif /* CONFIG_IEEE80211W */
1021
1022         return 0;
1023 }
1024
1025
1026 /**
1027  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1028  * @wpa_s: Pointer to wpa_supplicant data
1029  * @bss: Scan results for the selected BSS, or %NULL if not available
1030  * @ssid: Configuration data for the selected network
1031  * @wpa_ie: Buffer for the WPA/RSN IE
1032  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1033  * used buffer length in case the functions returns success.
1034  * Returns: 0 on success or -1 on failure
1035  *
1036  * This function is used to configure authentication and encryption parameters
1037  * based on the network configuration and scan result for the selected BSS (if
1038  * available).
1039  */
1040 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1041                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1042                               u8 *wpa_ie, size_t *wpa_ie_len)
1043 {
1044         struct wpa_ie_data ie;
1045         int sel, proto;
1046         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1047
1048         if (bss) {
1049                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1050                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1051                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1052         } else
1053                 bss_wpa = bss_rsn = bss_osen = NULL;
1054
1055         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1056             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1057             (ie.group_cipher & ssid->group_cipher) &&
1058             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1059             (ie.key_mgmt & ssid->key_mgmt)) {
1060                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1061                 proto = WPA_PROTO_RSN;
1062         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1063                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1064                    (ie.group_cipher & ssid->group_cipher) &&
1065                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1066                    (ie.key_mgmt & ssid->key_mgmt)) {
1067                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1068                 proto = WPA_PROTO_WPA;
1069 #ifdef CONFIG_HS20
1070         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1071                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1072                 /* TODO: parse OSEN element */
1073                 os_memset(&ie, 0, sizeof(ie));
1074                 ie.group_cipher = WPA_CIPHER_CCMP;
1075                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1076                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1077                 proto = WPA_PROTO_OSEN;
1078 #endif /* CONFIG_HS20 */
1079         } else if (bss) {
1080                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1081                 wpa_dbg(wpa_s, MSG_DEBUG,
1082                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1083                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1084                         ssid->key_mgmt);
1085                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1086                         MAC2STR(bss->bssid),
1087                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1088                         bss_wpa ? " WPA" : "",
1089                         bss_rsn ? " RSN" : "",
1090                         bss_osen ? " OSEN" : "");
1091                 if (bss_rsn) {
1092                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1093                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1094                                 wpa_dbg(wpa_s, MSG_DEBUG,
1095                                         "Could not parse RSN element");
1096                         } else {
1097                                 wpa_dbg(wpa_s, MSG_DEBUG,
1098                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1099                                         ie.pairwise_cipher, ie.group_cipher,
1100                                         ie.key_mgmt);
1101                         }
1102                 }
1103                 if (bss_wpa) {
1104                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1105                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1106                                 wpa_dbg(wpa_s, MSG_DEBUG,
1107                                         "Could not parse WPA element");
1108                         } else {
1109                                 wpa_dbg(wpa_s, MSG_DEBUG,
1110                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1111                                         ie.pairwise_cipher, ie.group_cipher,
1112                                         ie.key_mgmt);
1113                         }
1114                 }
1115                 return -1;
1116         } else {
1117                 if (ssid->proto & WPA_PROTO_OSEN)
1118                         proto = WPA_PROTO_OSEN;
1119                 else if (ssid->proto & WPA_PROTO_RSN)
1120                         proto = WPA_PROTO_RSN;
1121                 else
1122                         proto = WPA_PROTO_WPA;
1123                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1124                         os_memset(&ie, 0, sizeof(ie));
1125                         ie.group_cipher = ssid->group_cipher;
1126                         ie.pairwise_cipher = ssid->pairwise_cipher;
1127                         ie.key_mgmt = ssid->key_mgmt;
1128 #ifdef CONFIG_IEEE80211W
1129                         ie.mgmt_group_cipher =
1130                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1131                                 WPA_CIPHER_AES_128_CMAC : 0;
1132 #endif /* CONFIG_IEEE80211W */
1133                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1134                                 "based on configuration");
1135                 } else
1136                         proto = ie.proto;
1137         }
1138
1139         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1140                 "pairwise %d key_mgmt %d proto %d",
1141                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1142 #ifdef CONFIG_IEEE80211W
1143         if (ssid->ieee80211w) {
1144                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1145                         ie.mgmt_group_cipher);
1146         }
1147 #endif /* CONFIG_IEEE80211W */
1148
1149         wpa_s->wpa_proto = proto;
1150         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1151         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1152                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1153
1154         if (bss || !wpa_s->ap_ies_from_associnfo) {
1155                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1156                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1157                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1158                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1159                         return -1;
1160         }
1161
1162 #ifdef CONFIG_NO_WPA
1163         wpa_s->group_cipher = WPA_CIPHER_NONE;
1164         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1165 #else /* CONFIG_NO_WPA */
1166         sel = ie.group_cipher & ssid->group_cipher;
1167         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1168         if (wpa_s->group_cipher < 0) {
1169                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1170                         "cipher");
1171                 return -1;
1172         }
1173         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1174                 wpa_cipher_txt(wpa_s->group_cipher));
1175
1176         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1177         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1178         if (wpa_s->pairwise_cipher < 0) {
1179                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1180                         "cipher");
1181                 return -1;
1182         }
1183         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1184                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1185 #endif /* CONFIG_NO_WPA */
1186
1187         sel = ie.key_mgmt & ssid->key_mgmt;
1188 #ifdef CONFIG_SAE
1189         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1190                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1191 #endif /* CONFIG_SAE */
1192         if (0) {
1193 #ifdef CONFIG_SUITEB192
1194         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1195                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1196                 wpa_dbg(wpa_s, MSG_DEBUG,
1197                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1198 #endif /* CONFIG_SUITEB192 */
1199 #ifdef CONFIG_SUITEB
1200         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1202                 wpa_dbg(wpa_s, MSG_DEBUG,
1203                         "WPA: using KEY_MGMT 802.1X with Suite B");
1204 #endif /* CONFIG_SUITEB */
1205 #ifdef CONFIG_IEEE80211R
1206         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1207                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1208                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1209         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1210                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1211                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1212 #endif /* CONFIG_IEEE80211R */
1213 #ifdef CONFIG_SAE
1214         } else if (sel & WPA_KEY_MGMT_SAE) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1217         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1218                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1219                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1220 #endif /* CONFIG_SAE */
1221 #ifdef CONFIG_IEEE80211W
1222         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1223                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG,
1225                         "WPA: using KEY_MGMT 802.1X with SHA256");
1226         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1228                 wpa_dbg(wpa_s, MSG_DEBUG,
1229                         "WPA: using KEY_MGMT PSK with SHA256");
1230 #endif /* CONFIG_IEEE80211W */
1231         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1232                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1233                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1234         } else if (sel & WPA_KEY_MGMT_PSK) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1237         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1240 #ifdef CONFIG_HS20
1241         } else if (sel & WPA_KEY_MGMT_OSEN) {
1242                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1243                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1244 #endif /* CONFIG_HS20 */
1245         } else {
1246                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1247                         "authenticated key management type");
1248                 return -1;
1249         }
1250
1251         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1252         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1253                          wpa_s->pairwise_cipher);
1254         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1255
1256 #ifdef CONFIG_IEEE80211W
1257         sel = ie.mgmt_group_cipher;
1258         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1259             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1260                 sel = 0;
1261         if (sel & WPA_CIPHER_AES_128_CMAC) {
1262                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1264                         "AES-128-CMAC");
1265         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1266                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1268                         "BIP-GMAC-128");
1269         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1270                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1271                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1272                         "BIP-GMAC-256");
1273         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1274                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1275                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1276                         "BIP-CMAC-256");
1277         } else {
1278                 wpa_s->mgmt_group_cipher = 0;
1279                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1280         }
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1282                          wpa_s->mgmt_group_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1284                          wpas_get_ssid_pmf(wpa_s, ssid));
1285 #endif /* CONFIG_IEEE80211W */
1286
1287         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1288                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1289                 return -1;
1290         }
1291
1292         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1293                 int psk_set = 0;
1294
1295                 if (ssid->psk_set) {
1296                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1297                         psk_set = 1;
1298                 }
1299 #ifndef CONFIG_NO_PBKDF2
1300                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1301                     ssid->passphrase) {
1302                         u8 psk[PMK_LEN];
1303                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1304                                     4096, psk, PMK_LEN);
1305                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1306                                         psk, PMK_LEN);
1307                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1308                         psk_set = 1;
1309                         os_memset(psk, 0, sizeof(psk));
1310                 }
1311 #endif /* CONFIG_NO_PBKDF2 */
1312 #ifdef CONFIG_EXT_PASSWORD
1313                 if (ssid->ext_psk) {
1314                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1315                                                              ssid->ext_psk);
1316                         char pw_str[64 + 1];
1317                         u8 psk[PMK_LEN];
1318
1319                         if (pw == NULL) {
1320                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1321                                         "found from external storage");
1322                                 return -1;
1323                         }
1324
1325                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1326                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1327                                         "PSK length %d in external storage",
1328                                         (int) wpabuf_len(pw));
1329                                 ext_password_free(pw);
1330                                 return -1;
1331                         }
1332
1333                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1334                         pw_str[wpabuf_len(pw)] = '\0';
1335
1336 #ifndef CONFIG_NO_PBKDF2
1337                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1338                         {
1339                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1340                                             4096, psk, PMK_LEN);
1341                                 os_memset(pw_str, 0, sizeof(pw_str));
1342                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1343                                                 "external passphrase)",
1344                                                 psk, PMK_LEN);
1345                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1346                                 psk_set = 1;
1347                                 os_memset(psk, 0, sizeof(psk));
1348                         } else
1349 #endif /* CONFIG_NO_PBKDF2 */
1350                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1351                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1352                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1353                                                 "Invalid PSK hex string");
1354                                         os_memset(pw_str, 0, sizeof(pw_str));
1355                                         ext_password_free(pw);
1356                                         return -1;
1357                                 }
1358                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1359                                 psk_set = 1;
1360                                 os_memset(psk, 0, sizeof(psk));
1361                         } else {
1362                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1363                                         "PSK available");
1364                                 os_memset(pw_str, 0, sizeof(pw_str));
1365                                 ext_password_free(pw);
1366                                 return -1;
1367                         }
1368
1369                         os_memset(pw_str, 0, sizeof(pw_str));
1370                         ext_password_free(pw);
1371                 }
1372 #endif /* CONFIG_EXT_PASSWORD */
1373
1374                 if (!psk_set) {
1375                         wpa_msg(wpa_s, MSG_INFO,
1376                                 "No PSK available for association");
1377                         return -1;
1378                 }
1379         } else
1380                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1381
1382         return 0;
1383 }
1384
1385
1386 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1387 {
1388         *pos = 0x00;
1389
1390         switch (idx) {
1391         case 0: /* Bits 0-7 */
1392                 break;
1393         case 1: /* Bits 8-15 */
1394                 break;
1395         case 2: /* Bits 16-23 */
1396 #ifdef CONFIG_WNM
1397                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1398                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1399 #endif /* CONFIG_WNM */
1400                 break;
1401         case 3: /* Bits 24-31 */
1402 #ifdef CONFIG_WNM
1403                 *pos |= 0x02; /* Bit 25 - SSID List */
1404 #endif /* CONFIG_WNM */
1405 #ifdef CONFIG_INTERWORKING
1406                 if (wpa_s->conf->interworking)
1407                         *pos |= 0x80; /* Bit 31 - Interworking */
1408 #endif /* CONFIG_INTERWORKING */
1409                 break;
1410         case 4: /* Bits 32-39 */
1411 #ifdef CONFIG_INTERWORKING
1412                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1413                         *pos |= 0x01; /* Bit 32 - QoS Map */
1414 #endif /* CONFIG_INTERWORKING */
1415                 break;
1416         case 5: /* Bits 40-47 */
1417 #ifdef CONFIG_HS20
1418                 if (wpa_s->conf->hs20)
1419                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1420 #endif /* CONFIG_HS20 */
1421                 break;
1422         case 6: /* Bits 48-55 */
1423                 break;
1424         }
1425 }
1426
1427
1428 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1429 {
1430         u8 *pos = buf;
1431         u8 len = 6, i;
1432
1433         if (len < wpa_s->extended_capa_len)
1434                 len = wpa_s->extended_capa_len;
1435         if (buflen < (size_t) len + 2) {
1436                 wpa_printf(MSG_INFO,
1437                            "Not enough room for building extended capabilities element");
1438                 return -1;
1439         }
1440
1441         *pos++ = WLAN_EID_EXT_CAPAB;
1442         *pos++ = len;
1443         for (i = 0; i < len; i++, pos++) {
1444                 wpas_ext_capab_byte(wpa_s, pos, i);
1445
1446                 if (i < wpa_s->extended_capa_len) {
1447                         *pos &= ~wpa_s->extended_capa_mask[i];
1448                         *pos |= wpa_s->extended_capa[i];
1449                 }
1450         }
1451
1452         while (len > 0 && buf[1 + len] == 0) {
1453                 len--;
1454                 buf[1] = len;
1455         }
1456         if (len == 0)
1457                 return 0;
1458
1459         return 2 + len;
1460 }
1461
1462
1463 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1464                           struct wpa_bss *test_bss)
1465 {
1466         struct wpa_bss *bss;
1467
1468         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1469                 if (bss == test_bss)
1470                         return 1;
1471         }
1472
1473         return 0;
1474 }
1475
1476
1477 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1478                            struct wpa_ssid *test_ssid)
1479 {
1480         struct wpa_ssid *ssid;
1481
1482         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1483                 if (ssid == test_ssid)
1484                         return 1;
1485         }
1486
1487         return 0;
1488 }
1489
1490
1491 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1492                         struct wpa_ssid *test_ssid)
1493 {
1494         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1495                 return 0;
1496
1497         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1498 }
1499
1500
1501 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1502 {
1503         if (cwork == NULL)
1504                 return;
1505         os_free(cwork);
1506 }
1507
1508
1509 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1510 {
1511         struct wpa_connect_work *cwork;
1512         struct wpa_radio_work *work = wpa_s->connect_work;
1513
1514         if (!work)
1515                 return;
1516
1517         wpa_s->connect_work = NULL;
1518         cwork = work->ctx;
1519         work->ctx = NULL;
1520         wpas_connect_work_free(cwork);
1521         radio_work_done(work);
1522 }
1523
1524
1525 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1526 {
1527         struct os_reltime now;
1528         u8 addr[ETH_ALEN];
1529
1530         os_get_reltime(&now);
1531         if (wpa_s->last_mac_addr_style == style &&
1532             wpa_s->last_mac_addr_change.sec != 0 &&
1533             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1534                                 wpa_s->conf->rand_addr_lifetime)) {
1535                 wpa_msg(wpa_s, MSG_DEBUG,
1536                         "Previously selected random MAC address has not yet expired");
1537                 return 0;
1538         }
1539
1540         switch (style) {
1541         case 1:
1542                 if (random_mac_addr(addr) < 0)
1543                         return -1;
1544                 break;
1545         case 2:
1546                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1547                 if (random_mac_addr_keep_oui(addr) < 0)
1548                         return -1;
1549                 break;
1550         default:
1551                 return -1;
1552         }
1553
1554         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1555                 wpa_msg(wpa_s, MSG_INFO,
1556                         "Failed to set random MAC address");
1557                 return -1;
1558         }
1559
1560         os_get_reltime(&wpa_s->last_mac_addr_change);
1561         wpa_s->mac_addr_changed = 1;
1562         wpa_s->last_mac_addr_style = style;
1563
1564         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1565                 wpa_msg(wpa_s, MSG_INFO,
1566                         "Could not update MAC address information");
1567                 return -1;
1568         }
1569
1570         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1571                 MAC2STR(addr));
1572
1573         return 0;
1574 }
1575
1576
1577 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1578 {
1579         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1580             !wpa_s->conf->preassoc_mac_addr)
1581                 return 0;
1582
1583         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1584 }
1585
1586
1587 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1588
1589 /**
1590  * wpa_supplicant_associate - Request association
1591  * @wpa_s: Pointer to wpa_supplicant data
1592  * @bss: Scan results for the selected BSS, or %NULL if not available
1593  * @ssid: Configuration data for the selected network
1594  *
1595  * This function is used to request %wpa_supplicant to associate with a BSS.
1596  */
1597 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1598                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1599 {
1600         struct wpa_connect_work *cwork;
1601         int rand_style;
1602
1603         wpa_s->own_disconnect_req = 0;
1604
1605         /*
1606          * If we are starting a new connection, any previously pending EAPOL
1607          * RX cannot be valid anymore.
1608          */
1609         wpabuf_free(wpa_s->pending_eapol_rx);
1610         wpa_s->pending_eapol_rx = NULL;
1611
1612         if (ssid->mac_addr == -1)
1613                 rand_style = wpa_s->conf->mac_addr;
1614         else
1615                 rand_style = ssid->mac_addr;
1616
1617         wmm_ac_clear_saved_tspecs(wpa_s);
1618         wpa_s->reassoc_same_bss = 0;
1619
1620         if (wpa_s->last_ssid == ssid) {
1621                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1622                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1623                         wmm_ac_save_tspecs(wpa_s);
1624                         wpa_s->reassoc_same_bss = 1;
1625                 }
1626         } else if (rand_style > 0) {
1627                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1628                         return;
1629                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1630         } else if (wpa_s->mac_addr_changed) {
1631                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1632                         wpa_msg(wpa_s, MSG_INFO,
1633                                 "Could not restore permanent MAC address");
1634                         return;
1635                 }
1636                 wpa_s->mac_addr_changed = 0;
1637                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1638                         wpa_msg(wpa_s, MSG_INFO,
1639                                 "Could not update MAC address information");
1640                         return;
1641                 }
1642                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1643         }
1644         wpa_s->last_ssid = ssid;
1645
1646 #ifdef CONFIG_IBSS_RSN
1647         ibss_rsn_deinit(wpa_s->ibss_rsn);
1648         wpa_s->ibss_rsn = NULL;
1649 #endif /* CONFIG_IBSS_RSN */
1650
1651         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1652             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1653 #ifdef CONFIG_AP
1654                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1655                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1656                                 "mode");
1657                         return;
1658                 }
1659                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1660                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1661                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1662                                 wpas_p2p_ap_setup_failed(wpa_s);
1663                         return;
1664                 }
1665                 wpa_s->current_bss = bss;
1666 #else /* CONFIG_AP */
1667                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1668                         "the build");
1669 #endif /* CONFIG_AP */
1670                 return;
1671         }
1672
1673         if (ssid->mode == WPAS_MODE_MESH) {
1674 #ifdef CONFIG_MESH
1675                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1676                         wpa_msg(wpa_s, MSG_INFO,
1677                                 "Driver does not support mesh mode");
1678                         return;
1679                 }
1680                 if (bss)
1681                         ssid->frequency = bss->freq;
1682                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1683                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1684                         return;
1685                 }
1686                 wpa_s->current_bss = bss;
1687                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1688                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1689                         ssid->id);
1690 #else /* CONFIG_MESH */
1691                 wpa_msg(wpa_s, MSG_ERROR,
1692                         "mesh mode support not included in the build");
1693 #endif /* CONFIG_MESH */
1694                 return;
1695         }
1696
1697 #ifdef CONFIG_TDLS
1698         if (bss)
1699                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1700                                 bss->ie_len);
1701 #endif /* CONFIG_TDLS */
1702
1703         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1704             ssid->mode == IEEE80211_MODE_INFRA) {
1705                 sme_authenticate(wpa_s, bss, ssid);
1706                 return;
1707         }
1708
1709         if (wpa_s->connect_work) {
1710                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1711                 return;
1712         }
1713
1714         if (radio_work_pending(wpa_s, "connect")) {
1715                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1716                 return;
1717         }
1718
1719         wpas_abort_ongoing_scan(wpa_s);
1720
1721         cwork = os_zalloc(sizeof(*cwork));
1722         if (cwork == NULL)
1723                 return;
1724
1725         cwork->bss = bss;
1726         cwork->ssid = ssid;
1727
1728         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1729                            wpas_start_assoc_cb, cwork) < 0) {
1730                 os_free(cwork);
1731         }
1732 }
1733
1734
1735 static int bss_is_ibss(struct wpa_bss *bss)
1736 {
1737         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1738                 IEEE80211_CAP_IBSS;
1739 }
1740
1741
1742 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1743                             const struct wpa_ssid *ssid)
1744 {
1745         enum hostapd_hw_mode hw_mode;
1746         struct hostapd_hw_modes *mode = NULL;
1747         u8 channel;
1748         int i;
1749
1750 #ifdef CONFIG_HT_OVERRIDES
1751         if (ssid->disable_ht)
1752                 return 0;
1753 #endif /* CONFIG_HT_OVERRIDES */
1754
1755         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1756         if (hw_mode == NUM_HOSTAPD_MODES)
1757                 return 0;
1758         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1759                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1760                         mode = &wpa_s->hw.modes[i];
1761                         break;
1762                 }
1763         }
1764
1765         if (!mode)
1766                 return 0;
1767
1768         return mode->vht_capab != 0;
1769 }
1770
1771
1772 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1773                           const struct wpa_ssid *ssid,
1774                           struct hostapd_freq_params *freq)
1775 {
1776         enum hostapd_hw_mode hw_mode;
1777         struct hostapd_hw_modes *mode = NULL;
1778         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1779                            184, 192 };
1780         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1781         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1782         u8 channel;
1783         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1784         unsigned int j, k;
1785         struct hostapd_freq_params vht_freq;
1786         int chwidth, seg0, seg1;
1787         u32 vht_caps = 0;
1788
1789         freq->freq = ssid->frequency;
1790
1791         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1792                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1793
1794                 if (ssid->mode != WPAS_MODE_IBSS)
1795                         break;
1796
1797                 /* Don't adjust control freq in case of fixed_freq */
1798                 if (ssid->fixed_freq)
1799                         break;
1800
1801                 if (!bss_is_ibss(bss))
1802                         continue;
1803
1804                 if (ssid->ssid_len == bss->ssid_len &&
1805                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1806                         wpa_printf(MSG_DEBUG,
1807                                    "IBSS already found in scan results, adjust control freq: %d",
1808                                    bss->freq);
1809                         freq->freq = bss->freq;
1810                         obss_scan = 0;
1811                         break;
1812                 }
1813         }
1814
1815         /* For IBSS check HT_IBSS flag */
1816         if (ssid->mode == WPAS_MODE_IBSS &&
1817             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1818                 return;
1819
1820         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1821             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1822             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1823                 wpa_printf(MSG_DEBUG,
1824                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1825                 return;
1826         }
1827
1828         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1829         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1830                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1831                         mode = &wpa_s->hw.modes[i];
1832                         break;
1833                 }
1834         }
1835
1836         if (!mode)
1837                 return;
1838
1839         freq->ht_enabled = ht_supported(mode);
1840         if (!freq->ht_enabled)
1841                 return;
1842
1843         /* Setup higher BW only for 5 GHz */
1844         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1845                 return;
1846
1847         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1848                 pri_chan = &mode->channels[chan_idx];
1849                 if (pri_chan->chan == channel)
1850                         break;
1851                 pri_chan = NULL;
1852         }
1853         if (!pri_chan)
1854                 return;
1855
1856         /* Check primary channel flags */
1857         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1858                 return;
1859
1860         /* Check/setup HT40+/HT40- */
1861         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1862                 if (ht40plus[j] == channel) {
1863                         ht40 = 1;
1864                         break;
1865                 }
1866         }
1867
1868         /* Find secondary channel */
1869         for (i = 0; i < mode->num_channels; i++) {
1870                 sec_chan = &mode->channels[i];
1871                 if (sec_chan->chan == channel + ht40 * 4)
1872                         break;
1873                 sec_chan = NULL;
1874         }
1875         if (!sec_chan)
1876                 return;
1877
1878         /* Check secondary channel flags */
1879         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1880                 return;
1881
1882         freq->channel = pri_chan->chan;
1883
1884         switch (ht40) {
1885         case -1:
1886                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1887                         return;
1888                 freq->sec_channel_offset = -1;
1889                 break;
1890         case 1:
1891                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1892                         return;
1893                 freq->sec_channel_offset = 1;
1894                 break;
1895         default:
1896                 break;
1897         }
1898
1899         if (freq->sec_channel_offset && obss_scan) {
1900                 struct wpa_scan_results *scan_res;
1901
1902                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1903                 if (scan_res == NULL) {
1904                         /* Back to HT20 */
1905                         freq->sec_channel_offset = 0;
1906                         return;
1907                 }
1908
1909                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1910                                      sec_chan->chan);
1911                 switch (res) {
1912                 case 0:
1913                         /* Back to HT20 */
1914                         freq->sec_channel_offset = 0;
1915                         break;
1916                 case 1:
1917                         /* Configuration allowed */
1918                         break;
1919                 case 2:
1920                         /* Switch pri/sec channels */
1921                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1922                         freq->sec_channel_offset = -freq->sec_channel_offset;
1923                         freq->channel = sec_chan->chan;
1924                         break;
1925                 default:
1926                         freq->sec_channel_offset = 0;
1927                         break;
1928                 }
1929
1930                 wpa_scan_results_free(scan_res);
1931         }
1932
1933         wpa_printf(MSG_DEBUG,
1934                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1935                    freq->channel, freq->sec_channel_offset);
1936
1937         if (!drv_supports_vht(wpa_s, ssid))
1938                 return;
1939
1940         /* For IBSS check VHT_IBSS flag */
1941         if (ssid->mode == WPAS_MODE_IBSS &&
1942             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1943                 return;
1944
1945         vht_freq = *freq;
1946
1947         vht_freq.vht_enabled = vht_supported(mode);
1948         if (!vht_freq.vht_enabled)
1949                 return;
1950
1951         /* setup center_freq1, bandwidth */
1952         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1953                 if (freq->channel >= vht80[j] &&
1954                     freq->channel < vht80[j] + 16)
1955                         break;
1956         }
1957
1958         if (j == ARRAY_SIZE(vht80))
1959                 return;
1960
1961         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1962                 struct hostapd_channel_data *chan;
1963
1964                 chan = hw_get_channel_chan(mode, i, NULL);
1965                 if (!chan)
1966                         return;
1967
1968                 /* Back to HT configuration if channel not usable */
1969                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1970                         return;
1971         }
1972
1973         chwidth = VHT_CHANWIDTH_80MHZ;
1974         seg0 = vht80[j] + 6;
1975         seg1 = 0;
1976
1977         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
1978                 /* setup center_freq2, bandwidth */
1979                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
1980                         /* Only accept 80 MHz segments separated by a gap */
1981                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
1982                                 continue;
1983                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
1984                                 struct hostapd_channel_data *chan;
1985
1986                                 chan = hw_get_channel_chan(mode, i, NULL);
1987                                 if (!chan)
1988                                         continue;
1989
1990                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
1991                                                   HOSTAPD_CHAN_NO_IR |
1992                                                   HOSTAPD_CHAN_RADAR))
1993                                         continue;
1994
1995                                 /* Found a suitable second segment for 80+80 */
1996                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
1997                                 vht_caps |=
1998                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1999                                 seg1 = vht80[k] + 6;
2000                         }
2001
2002                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2003                                 break;
2004                 }
2005         }
2006
2007         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2008                                     freq->channel, freq->ht_enabled,
2009                                     vht_freq.vht_enabled,
2010                                     freq->sec_channel_offset,
2011                                     chwidth, seg0, seg1, vht_caps) != 0)
2012                 return;
2013
2014         *freq = vht_freq;
2015
2016         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2017                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2018 }
2019
2020
2021 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2022 {
2023         struct wpa_connect_work *cwork = work->ctx;
2024         struct wpa_bss *bss = cwork->bss;
2025         struct wpa_ssid *ssid = cwork->ssid;
2026         struct wpa_supplicant *wpa_s = work->wpa_s;
2027         u8 wpa_ie[200];
2028         size_t wpa_ie_len;
2029         int use_crypt, ret, i, bssid_changed;
2030         int algs = WPA_AUTH_ALG_OPEN;
2031         unsigned int cipher_pairwise, cipher_group;
2032         struct wpa_driver_associate_params params;
2033         int wep_keys_set = 0;
2034         int assoc_failed = 0;
2035         struct wpa_ssid *old_ssid;
2036 #ifdef CONFIG_HT_OVERRIDES
2037         struct ieee80211_ht_capabilities htcaps;
2038         struct ieee80211_ht_capabilities htcaps_mask;
2039 #endif /* CONFIG_HT_OVERRIDES */
2040 #ifdef CONFIG_VHT_OVERRIDES
2041        struct ieee80211_vht_capabilities vhtcaps;
2042        struct ieee80211_vht_capabilities vhtcaps_mask;
2043 #endif /* CONFIG_VHT_OVERRIDES */
2044
2045         if (deinit) {
2046                 if (work->started) {
2047                         wpa_s->connect_work = NULL;
2048
2049                         /* cancel possible auth. timeout */
2050                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2051                                              NULL);
2052                 }
2053                 wpas_connect_work_free(cwork);
2054                 return;
2055         }
2056
2057         wpa_s->connect_work = work;
2058
2059         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2060             wpas_network_disabled(wpa_s, ssid)) {
2061                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2062                 wpas_connect_work_done(wpa_s);
2063                 return;
2064         }
2065
2066         os_memset(&params, 0, sizeof(params));
2067         wpa_s->reassociate = 0;
2068         wpa_s->eap_expected_failure = 0;
2069         if (bss &&
2070             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2071 #ifdef CONFIG_IEEE80211R
2072                 const u8 *ie, *md = NULL;
2073 #endif /* CONFIG_IEEE80211R */
2074                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2075                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2076                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2077                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2078                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2079                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2080                 if (bssid_changed)
2081                         wpas_notify_bssid_changed(wpa_s);
2082 #ifdef CONFIG_IEEE80211R
2083                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2084                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2085                         md = ie + 2;
2086                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2087                 if (md) {
2088                         /* Prepare for the next transition */
2089                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2090                 }
2091 #endif /* CONFIG_IEEE80211R */
2092 #ifdef CONFIG_WPS
2093         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2094                    wpa_s->conf->ap_scan == 2 &&
2095                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2096                 /* Use ap_scan==1 style network selection to find the network
2097                  */
2098                 wpas_connect_work_done(wpa_s);
2099                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2100                 wpa_s->reassociate = 1;
2101                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2102                 return;
2103 #endif /* CONFIG_WPS */
2104         } else {
2105                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2106                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2107                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2108         }
2109         if (!wpa_s->pno)
2110                 wpa_supplicant_cancel_sched_scan(wpa_s);
2111
2112         wpa_supplicant_cancel_scan(wpa_s);
2113
2114         /* Starting new association, so clear the possibly used WPA IE from the
2115          * previous association. */
2116         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2117
2118 #ifdef IEEE8021X_EAPOL
2119         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2120                 if (ssid->leap) {
2121                         if (ssid->non_leap == 0)
2122                                 algs = WPA_AUTH_ALG_LEAP;
2123                         else
2124                                 algs |= WPA_AUTH_ALG_LEAP;
2125                 }
2126         }
2127 #endif /* IEEE8021X_EAPOL */
2128         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2129         if (ssid->auth_alg) {
2130                 algs = ssid->auth_alg;
2131                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2132                         "0x%x", algs);
2133         }
2134
2135         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2136                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2137             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2138                 int try_opportunistic;
2139                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2140                                      wpa_s->conf->okc :
2141                                      ssid->proactive_key_caching) &&
2142                         (ssid->proto & WPA_PROTO_RSN);
2143                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2144                                             ssid, try_opportunistic) == 0)
2145                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2146                 wpa_ie_len = sizeof(wpa_ie);
2147                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2148                                               wpa_ie, &wpa_ie_len)) {
2149                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2150                                 "key management and encryption suites");
2151                         wpas_connect_work_done(wpa_s);
2152                         return;
2153                 }
2154         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2155                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2156                 /*
2157                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2158                  * use non-WPA since the scan results did not indicate that the
2159                  * AP is using WPA or WPA2.
2160                  */
2161                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2162                 wpa_ie_len = 0;
2163                 wpa_s->wpa_proto = 0;
2164         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2165                 wpa_ie_len = sizeof(wpa_ie);
2166                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2167                                               wpa_ie, &wpa_ie_len)) {
2168                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2169                                 "key management and encryption suites (no "
2170                                 "scan results)");
2171                         wpas_connect_work_done(wpa_s);
2172                         return;
2173                 }
2174 #ifdef CONFIG_WPS
2175         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2176                 struct wpabuf *wps_ie;
2177                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2178                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2179                         wpa_ie_len = wpabuf_len(wps_ie);
2180                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2181                 } else
2182                         wpa_ie_len = 0;
2183                 wpabuf_free(wps_ie);
2184                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2185                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2186                         params.wps = WPS_MODE_PRIVACY;
2187                 else
2188                         params.wps = WPS_MODE_OPEN;
2189                 wpa_s->wpa_proto = 0;
2190 #endif /* CONFIG_WPS */
2191         } else {
2192                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2193                 wpa_ie_len = 0;
2194                 wpa_s->wpa_proto = 0;
2195         }
2196
2197 #ifdef CONFIG_P2P
2198         if (wpa_s->global->p2p) {
2199                 u8 *pos;
2200                 size_t len;
2201                 int res;
2202                 pos = wpa_ie + wpa_ie_len;
2203                 len = sizeof(wpa_ie) - wpa_ie_len;
2204                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2205                                             ssid->p2p_group);
2206                 if (res >= 0)
2207                         wpa_ie_len += res;
2208         }
2209
2210         wpa_s->cross_connect_disallowed = 0;
2211         if (bss) {
2212                 struct wpabuf *p2p;
2213                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2214                 if (p2p) {
2215                         wpa_s->cross_connect_disallowed =
2216                                 p2p_get_cross_connect_disallowed(p2p);
2217                         wpabuf_free(p2p);
2218                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2219                                 "connection",
2220                                 wpa_s->cross_connect_disallowed ?
2221                                 "disallows" : "allows");
2222                 }
2223         }
2224
2225         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2226 #endif /* CONFIG_P2P */
2227
2228 #ifdef CONFIG_HS20
2229         if (is_hs20_network(wpa_s, ssid, bss)) {
2230                 struct wpabuf *hs20;
2231                 hs20 = wpabuf_alloc(20);
2232                 if (hs20) {
2233                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2234                         size_t len;
2235
2236                         wpas_hs20_add_indication(hs20, pps_mo_id);
2237                         len = sizeof(wpa_ie) - wpa_ie_len;
2238                         if (wpabuf_len(hs20) <= len) {
2239                                 os_memcpy(wpa_ie + wpa_ie_len,
2240                                           wpabuf_head(hs20), wpabuf_len(hs20));
2241                                 wpa_ie_len += wpabuf_len(hs20);
2242                         }
2243                         wpabuf_free(hs20);
2244                 }
2245         }
2246 #endif /* CONFIG_HS20 */
2247
2248         /*
2249          * Workaround: Add Extended Capabilities element only if the AP
2250          * included this element in Beacon/Probe Response frames. Some older
2251          * APs seem to have interoperability issues if this element is
2252          * included, so while the standard may require us to include the
2253          * element in all cases, it is justifiable to skip it to avoid
2254          * interoperability issues.
2255          */
2256         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2257                 u8 ext_capab[18];
2258                 int ext_capab_len;
2259                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2260                                                      sizeof(ext_capab));
2261                 if (ext_capab_len > 0) {
2262                         u8 *pos = wpa_ie;
2263                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2264                                 pos += 2 + pos[1];
2265                         os_memmove(pos + ext_capab_len, pos,
2266                                    wpa_ie_len - (pos - wpa_ie));
2267                         wpa_ie_len += ext_capab_len;
2268                         os_memcpy(pos, ext_capab, ext_capab_len);
2269                 }
2270         }
2271
2272         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2273                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2274                 size_t len;
2275
2276                 len = sizeof(wpa_ie) - wpa_ie_len;
2277                 if (wpabuf_len(buf) <= len) {
2278                         os_memcpy(wpa_ie + wpa_ie_len,
2279                                   wpabuf_head(buf), wpabuf_len(buf));
2280                         wpa_ie_len += wpabuf_len(buf);
2281                 }
2282         }
2283
2284 #ifdef CONFIG_FST
2285         if (wpa_s->fst_ies) {
2286                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2287
2288                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2289                         os_memcpy(wpa_ie + wpa_ie_len,
2290                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2291                         wpa_ie_len += fst_ies_len;
2292                 }
2293         }
2294 #endif /* CONFIG_FST */
2295
2296         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2297         use_crypt = 1;
2298         cipher_pairwise = wpa_s->pairwise_cipher;
2299         cipher_group = wpa_s->group_cipher;
2300         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2301             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2302                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2303                         use_crypt = 0;
2304                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2305                         use_crypt = 1;
2306                         wep_keys_set = 1;
2307                 }
2308         }
2309         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2310                 use_crypt = 0;
2311
2312 #ifdef IEEE8021X_EAPOL
2313         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2314                 if ((ssid->eapol_flags &
2315                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2316                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2317                     !wep_keys_set) {
2318                         use_crypt = 0;
2319                 } else {
2320                         /* Assume that dynamic WEP-104 keys will be used and
2321                          * set cipher suites in order for drivers to expect
2322                          * encryption. */
2323                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2324                 }
2325         }
2326 #endif /* IEEE8021X_EAPOL */
2327
2328         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2329                 /* Set the key before (and later after) association */
2330                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2331         }
2332
2333         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2334         if (bss) {
2335                 params.ssid = bss->ssid;
2336                 params.ssid_len = bss->ssid_len;
2337                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2338                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2339                                    MACSTR " freq=%u MHz based on scan results "
2340                                    "(bssid_set=%d)",
2341                                    MAC2STR(bss->bssid), bss->freq,
2342                                    ssid->bssid_set);
2343                         params.bssid = bss->bssid;
2344                         params.freq.freq = bss->freq;
2345                 }
2346                 params.bssid_hint = bss->bssid;
2347                 params.freq_hint = bss->freq;
2348                 params.pbss = bss_is_pbss(bss);
2349         } else {
2350                 params.ssid = ssid->ssid;
2351                 params.ssid_len = ssid->ssid_len;
2352                 params.pbss = ssid->pbss;
2353         }
2354
2355         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2356             wpa_s->conf->ap_scan == 2) {
2357                 params.bssid = ssid->bssid;
2358                 params.fixed_bssid = 1;
2359         }
2360
2361         /* Initial frequency for IBSS/mesh */
2362         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2363             ssid->frequency > 0 && params.freq.freq == 0)
2364                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2365
2366         if (ssid->mode == WPAS_MODE_IBSS) {
2367                 params.fixed_freq = ssid->fixed_freq;
2368                 if (ssid->beacon_int)
2369                         params.beacon_int = ssid->beacon_int;
2370                 else
2371                         params.beacon_int = wpa_s->conf->beacon_int;
2372         }
2373
2374         params.wpa_ie = wpa_ie;
2375         params.wpa_ie_len = wpa_ie_len;
2376         params.pairwise_suite = cipher_pairwise;
2377         params.group_suite = cipher_group;
2378         params.key_mgmt_suite = wpa_s->key_mgmt;
2379         params.wpa_proto = wpa_s->wpa_proto;
2380         params.auth_alg = algs;
2381         params.mode = ssid->mode;
2382         params.bg_scan_period = ssid->bg_scan_period;
2383         for (i = 0; i < NUM_WEP_KEYS; i++) {
2384                 if (ssid->wep_key_len[i])
2385                         params.wep_key[i] = ssid->wep_key[i];
2386                 params.wep_key_len[i] = ssid->wep_key_len[i];
2387         }
2388         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2389
2390         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2391             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2392              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2393                 params.passphrase = ssid->passphrase;
2394                 if (ssid->psk_set)
2395                         params.psk = ssid->psk;
2396         }
2397
2398         if (wpa_s->conf->key_mgmt_offload) {
2399                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2400                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2401                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2402                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2403                         params.req_key_mgmt_offload =
2404                                 ssid->proactive_key_caching < 0 ?
2405                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2406                 else
2407                         params.req_key_mgmt_offload = 1;
2408
2409                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2410                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2411                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2412                     ssid->psk_set)
2413                         params.psk = ssid->psk;
2414         }
2415
2416         params.drop_unencrypted = use_crypt;
2417
2418 #ifdef CONFIG_IEEE80211W
2419         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2420         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2421                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2422                 struct wpa_ie_data ie;
2423                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2424                     ie.capabilities &
2425                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2426                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2427                                 "MFP: require MFP");
2428                         params.mgmt_frame_protection =
2429                                 MGMT_FRAME_PROTECTION_REQUIRED;
2430                 }
2431         }
2432 #endif /* CONFIG_IEEE80211W */
2433
2434         params.p2p = ssid->p2p_group;
2435
2436         if (wpa_s->parent->set_sta_uapsd)
2437                 params.uapsd = wpa_s->parent->sta_uapsd;
2438         else
2439                 params.uapsd = -1;
2440
2441 #ifdef CONFIG_HT_OVERRIDES
2442         os_memset(&htcaps, 0, sizeof(htcaps));
2443         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2444         params.htcaps = (u8 *) &htcaps;
2445         params.htcaps_mask = (u8 *) &htcaps_mask;
2446         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2447 #endif /* CONFIG_HT_OVERRIDES */
2448 #ifdef CONFIG_VHT_OVERRIDES
2449         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2450         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2451         params.vhtcaps = &vhtcaps;
2452         params.vhtcaps_mask = &vhtcaps_mask;
2453         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2454 #endif /* CONFIG_VHT_OVERRIDES */
2455
2456 #ifdef CONFIG_P2P
2457         /*
2458          * If multi-channel concurrency is not supported, check for any
2459          * frequency conflict. In case of any frequency conflict, remove the
2460          * least prioritized connection.
2461          */
2462         if (wpa_s->num_multichan_concurrent < 2) {
2463                 int freq, num;
2464                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2465                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2466                         wpa_printf(MSG_DEBUG,
2467                                    "Assoc conflicting freq found (%d != %d)",
2468                                    freq, params.freq.freq);
2469                         if (wpas_p2p_handle_frequency_conflicts(
2470                                     wpa_s, params.freq.freq, ssid) < 0) {
2471                                 wpas_connect_work_done(wpa_s);
2472                                 return;
2473                         }
2474                 }
2475         }
2476 #endif /* CONFIG_P2P */
2477
2478         ret = wpa_drv_associate(wpa_s, &params);
2479         if (ret < 0) {
2480                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2481                         "failed");
2482                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2483                         /*
2484                          * The driver is known to mean what is saying, so we
2485                          * can stop right here; the association will not
2486                          * succeed.
2487                          */
2488                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2489                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2490                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2491                         return;
2492                 }
2493                 /* try to continue anyway; new association will be tried again
2494                  * after timeout */
2495                 assoc_failed = 1;
2496         }
2497
2498         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2499                 /* Set the key after the association just in case association
2500                  * cleared the previously configured key. */
2501                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2502                 /* No need to timeout authentication since there is no key
2503                  * management. */
2504                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2505                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2506 #ifdef CONFIG_IBSS_RSN
2507         } else if (ssid->mode == WPAS_MODE_IBSS &&
2508                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2509                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2510                 /*
2511                  * RSN IBSS authentication is per-STA and we can disable the
2512                  * per-BSSID authentication.
2513                  */
2514                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2515 #endif /* CONFIG_IBSS_RSN */
2516         } else {
2517                 /* Timeout for IEEE 802.11 authentication and association */
2518                 int timeout = 60;
2519
2520                 if (assoc_failed) {
2521                         /* give IBSS a bit more time */
2522                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2523                 } else if (wpa_s->conf->ap_scan == 1) {
2524                         /* give IBSS a bit more time */
2525                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2526                 }
2527                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2528         }
2529
2530         if (wep_keys_set &&
2531             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2532                 /* Set static WEP keys again */
2533                 wpa_set_wep_keys(wpa_s, ssid);
2534         }
2535
2536         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2537                 /*
2538                  * Do not allow EAP session resumption between different
2539                  * network configurations.
2540                  */
2541                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2542         }
2543         old_ssid = wpa_s->current_ssid;
2544         wpa_s->current_ssid = ssid;
2545         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2546                 wpa_s->current_bss = bss;
2547         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2548         wpa_supplicant_initiate_eapol(wpa_s);
2549         if (old_ssid != wpa_s->current_ssid)
2550                 wpas_notify_network_changed(wpa_s);
2551 }
2552
2553
2554 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2555                                             const u8 *addr)
2556 {
2557         struct wpa_ssid *old_ssid;
2558
2559         wpas_connect_work_done(wpa_s);
2560         wpa_clear_keys(wpa_s, addr);
2561         old_ssid = wpa_s->current_ssid;
2562         wpa_supplicant_mark_disassoc(wpa_s);
2563         wpa_sm_set_config(wpa_s->wpa, NULL);
2564         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2565         if (old_ssid != wpa_s->current_ssid)
2566                 wpas_notify_network_changed(wpa_s);
2567         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2568 }
2569
2570
2571 /**
2572  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2573  * @wpa_s: Pointer to wpa_supplicant data
2574  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2575  *
2576  * This function is used to request %wpa_supplicant to deauthenticate from the
2577  * current AP.
2578  */
2579 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2580                                    int reason_code)
2581 {
2582         u8 *addr = NULL;
2583         union wpa_event_data event;
2584         int zero_addr = 0;
2585
2586         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2587                 " pending_bssid=" MACSTR " reason=%d state=%s",
2588                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2589                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2590
2591         if (!is_zero_ether_addr(wpa_s->bssid))
2592                 addr = wpa_s->bssid;
2593         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2594                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2595                   wpa_s->wpa_state == WPA_ASSOCIATING))
2596                 addr = wpa_s->pending_bssid;
2597         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2598                 /*
2599                  * When using driver-based BSS selection, we may not know the
2600                  * BSSID with which we are currently trying to associate. We
2601                  * need to notify the driver of this disconnection even in such
2602                  * a case, so use the all zeros address here.
2603                  */
2604                 addr = wpa_s->bssid;
2605                 zero_addr = 1;
2606         }
2607
2608 #ifdef CONFIG_TDLS
2609         wpa_tdls_teardown_peers(wpa_s->wpa);
2610 #endif /* CONFIG_TDLS */
2611
2612 #ifdef CONFIG_MESH
2613         if (wpa_s->ifmsh) {
2614                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2615                         wpa_s->ifname);
2616                 wpa_supplicant_leave_mesh(wpa_s);
2617         }
2618 #endif /* CONFIG_MESH */
2619
2620         if (addr) {
2621                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2622                 os_memset(&event, 0, sizeof(event));
2623                 event.deauth_info.reason_code = (u16) reason_code;
2624                 event.deauth_info.locally_generated = 1;
2625                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2626                 if (zero_addr)
2627                         addr = NULL;
2628         }
2629
2630         wpa_supplicant_clear_connection(wpa_s, addr);
2631 }
2632
2633 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2634                                               struct wpa_ssid *ssid)
2635 {
2636         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2637                 return;
2638
2639         ssid->disabled = 0;
2640         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2641         wpas_notify_network_enabled_changed(wpa_s, ssid);
2642
2643         /*
2644          * Try to reassociate since there is no current configuration and a new
2645          * network was made available.
2646          */
2647         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2648                 wpa_s->reassociate = 1;
2649 }
2650
2651
2652 /**
2653  * wpa_supplicant_enable_network - Mark a configured network as enabled
2654  * @wpa_s: wpa_supplicant structure for a network interface
2655  * @ssid: wpa_ssid structure for a configured network or %NULL
2656  *
2657  * Enables the specified network or all networks if no network specified.
2658  */
2659 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2660                                    struct wpa_ssid *ssid)
2661 {
2662         if (ssid == NULL) {
2663                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2664                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2665         } else
2666                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2667
2668         if (wpa_s->reassociate && !wpa_s->disconnected &&
2669             (!wpa_s->current_ssid ||
2670              wpa_s->wpa_state == WPA_DISCONNECTED ||
2671              wpa_s->wpa_state == WPA_SCANNING)) {
2672                 if (wpa_s->sched_scanning) {
2673                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2674                                    "new network to scan filters");
2675                         wpa_supplicant_cancel_sched_scan(wpa_s);
2676                 }
2677
2678                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2679                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2680                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2681                 }
2682         }
2683 }
2684
2685
2686 /**
2687  * wpa_supplicant_disable_network - Mark a configured network as disabled
2688  * @wpa_s: wpa_supplicant structure for a network interface
2689  * @ssid: wpa_ssid structure for a configured network or %NULL
2690  *
2691  * Disables the specified network or all networks if no network specified.
2692  */
2693 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2694                                     struct wpa_ssid *ssid)
2695 {
2696         struct wpa_ssid *other_ssid;
2697         int was_disabled;
2698
2699         if (ssid == NULL) {
2700                 if (wpa_s->sched_scanning)
2701                         wpa_supplicant_cancel_sched_scan(wpa_s);
2702
2703                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2704                      other_ssid = other_ssid->next) {
2705                         was_disabled = other_ssid->disabled;
2706                         if (was_disabled == 2)
2707                                 continue; /* do not change persistent P2P group
2708                                            * data */
2709
2710                         other_ssid->disabled = 1;
2711
2712                         if (was_disabled != other_ssid->disabled)
2713                                 wpas_notify_network_enabled_changed(
2714                                         wpa_s, other_ssid);
2715                 }
2716                 if (wpa_s->current_ssid)
2717                         wpa_supplicant_deauthenticate(
2718                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2719         } else if (ssid->disabled != 2) {
2720                 if (ssid == wpa_s->current_ssid)
2721                         wpa_supplicant_deauthenticate(
2722                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2723
2724                 was_disabled = ssid->disabled;
2725
2726                 ssid->disabled = 1;
2727
2728                 if (was_disabled != ssid->disabled) {
2729                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2730                         if (wpa_s->sched_scanning) {
2731                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2732                                            "to remove network from filters");
2733                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2734                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2735                         }
2736                 }
2737         }
2738 }
2739
2740
2741 /**
2742  * wpa_supplicant_select_network - Attempt association with a network
2743  * @wpa_s: wpa_supplicant structure for a network interface
2744  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2745  */
2746 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2747                                    struct wpa_ssid *ssid)
2748 {
2749
2750         struct wpa_ssid *other_ssid;
2751         int disconnected = 0;
2752
2753         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2754                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2755                         wpa_s->own_disconnect_req = 1;
2756                 wpa_supplicant_deauthenticate(
2757                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2758                 disconnected = 1;
2759         }
2760
2761         if (ssid)
2762                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2763
2764         /*
2765          * Mark all other networks disabled or mark all networks enabled if no
2766          * network specified.
2767          */
2768         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2769              other_ssid = other_ssid->next) {
2770                 int was_disabled = other_ssid->disabled;
2771                 if (was_disabled == 2)
2772                         continue; /* do not change persistent P2P group data */
2773
2774                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2775                 if (was_disabled && !other_ssid->disabled)
2776                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2777
2778                 if (was_disabled != other_ssid->disabled)
2779                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2780         }
2781
2782         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2783             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2784                 /* We are already associated with the selected network */
2785                 wpa_printf(MSG_DEBUG, "Already associated with the "
2786                            "selected network - do nothing");
2787                 return;
2788         }
2789
2790         if (ssid) {
2791                 wpa_s->current_ssid = ssid;
2792                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2793                 wpa_s->connect_without_scan =
2794                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2795
2796                 /*
2797                  * Don't optimize next scan freqs since a new ESS has been
2798                  * selected.
2799                  */
2800                 os_free(wpa_s->next_scan_freqs);
2801                 wpa_s->next_scan_freqs = NULL;
2802         } else {
2803                 wpa_s->connect_without_scan = NULL;
2804         }
2805
2806         wpa_s->disconnected = 0;
2807         wpa_s->reassociate = 1;
2808
2809         if (wpa_s->connect_without_scan ||
2810             wpa_supplicant_fast_associate(wpa_s) != 1) {
2811                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2812                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2813         }
2814
2815         if (ssid)
2816                 wpas_notify_network_selected(wpa_s, ssid);
2817 }
2818
2819
2820 /**
2821  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2822  * @wpa_s: wpa_supplicant structure for a network interface
2823  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2824  * @pkcs11_module_path: PKCS #11 module path or NULL
2825  * Returns: 0 on success; -1 on failure
2826  *
2827  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2828  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2829  * module path fails the paths will be reset to the default value (NULL).
2830  */
2831 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2832                                            const char *pkcs11_engine_path,
2833                                            const char *pkcs11_module_path)
2834 {
2835         char *pkcs11_engine_path_copy = NULL;
2836         char *pkcs11_module_path_copy = NULL;
2837
2838         if (pkcs11_engine_path != NULL) {
2839                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2840                 if (pkcs11_engine_path_copy == NULL)
2841                         return -1;
2842         }
2843         if (pkcs11_module_path != NULL) {
2844                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2845                 if (pkcs11_module_path_copy == NULL) {
2846                         os_free(pkcs11_engine_path_copy);
2847                         return -1;
2848                 }
2849         }
2850
2851         os_free(wpa_s->conf->pkcs11_engine_path);
2852         os_free(wpa_s->conf->pkcs11_module_path);
2853         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2854         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2855
2856         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2857         eapol_sm_deinit(wpa_s->eapol);
2858         wpa_s->eapol = NULL;
2859         if (wpa_supplicant_init_eapol(wpa_s)) {
2860                 /* Error -> Reset paths to the default value (NULL) once. */
2861                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2862                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2863                                                                NULL);
2864
2865                 return -1;
2866         }
2867         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2868
2869         return 0;
2870 }
2871
2872
2873 /**
2874  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2875  * @wpa_s: wpa_supplicant structure for a network interface
2876  * @ap_scan: AP scan mode
2877  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2878  *
2879  */
2880 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2881 {
2882
2883         int old_ap_scan;
2884
2885         if (ap_scan < 0 || ap_scan > 2)
2886                 return -1;
2887
2888         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2889                 wpa_printf(MSG_INFO,
2890                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2891         }
2892
2893 #ifdef ANDROID
2894         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2895             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2896             wpa_s->wpa_state < WPA_COMPLETED) {
2897                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2898                            "associating", wpa_s->conf->ap_scan, ap_scan);
2899                 return 0;
2900         }
2901 #endif /* ANDROID */
2902
2903         old_ap_scan = wpa_s->conf->ap_scan;
2904         wpa_s->conf->ap_scan = ap_scan;
2905
2906         if (old_ap_scan != wpa_s->conf->ap_scan)
2907                 wpas_notify_ap_scan_changed(wpa_s);
2908
2909         return 0;
2910 }
2911
2912
2913 /**
2914  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2915  * @wpa_s: wpa_supplicant structure for a network interface
2916  * @expire_age: Expiration age in seconds
2917  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2918  *
2919  */
2920 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2921                                           unsigned int bss_expire_age)
2922 {
2923         if (bss_expire_age < 10) {
2924                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2925                         bss_expire_age);
2926                 return -1;
2927         }
2928         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2929                 bss_expire_age);
2930         wpa_s->conf->bss_expiration_age = bss_expire_age;
2931
2932         return 0;
2933 }
2934
2935
2936 /**
2937  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2938  * @wpa_s: wpa_supplicant structure for a network interface
2939  * @expire_count: number of scans after which an unseen BSS is reclaimed
2940  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2941  *
2942  */
2943 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2944                                             unsigned int bss_expire_count)
2945 {
2946         if (bss_expire_count < 1) {
2947                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2948                         bss_expire_count);
2949                 return -1;
2950         }
2951         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2952                 bss_expire_count);
2953         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2954
2955         return 0;
2956 }
2957
2958
2959 /**
2960  * wpa_supplicant_set_scan_interval - Set scan interval
2961  * @wpa_s: wpa_supplicant structure for a network interface
2962  * @scan_interval: scan interval in seconds
2963  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2964  *
2965  */
2966 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2967                                      int scan_interval)
2968 {
2969         if (scan_interval < 0) {
2970                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2971                         scan_interval);
2972                 return -1;
2973         }
2974         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2975                 scan_interval);
2976         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2977
2978         return 0;
2979 }
2980
2981
2982 /**
2983  * wpa_supplicant_set_debug_params - Set global debug params
2984  * @global: wpa_global structure
2985  * @debug_level: debug level
2986  * @debug_timestamp: determines if show timestamp in debug data
2987  * @debug_show_keys: determines if show keys in debug data
2988  * Returns: 0 if succeed or -1 if debug_level has wrong value
2989  */
2990 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2991                                     int debug_timestamp, int debug_show_keys)
2992 {
2993
2994         int old_level, old_timestamp, old_show_keys;
2995
2996         /* check for allowed debuglevels */
2997         if (debug_level != MSG_EXCESSIVE &&
2998             debug_level != MSG_MSGDUMP &&
2999             debug_level != MSG_DEBUG &&
3000             debug_level != MSG_INFO &&
3001             debug_level != MSG_WARNING &&
3002             debug_level != MSG_ERROR)
3003                 return -1;
3004
3005         old_level = wpa_debug_level;
3006         old_timestamp = wpa_debug_timestamp;
3007         old_show_keys = wpa_debug_show_keys;
3008
3009         wpa_debug_level = debug_level;
3010         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3011         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3012
3013         if (wpa_debug_level != old_level)
3014                 wpas_notify_debug_level_changed(global);
3015         if (wpa_debug_timestamp != old_timestamp)
3016                 wpas_notify_debug_timestamp_changed(global);
3017         if (wpa_debug_show_keys != old_show_keys)
3018                 wpas_notify_debug_show_keys_changed(global);
3019
3020         return 0;
3021 }
3022
3023
3024 /**
3025  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3026  * @wpa_s: Pointer to wpa_supplicant data
3027  * Returns: A pointer to the current network structure or %NULL on failure
3028  */
3029 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3030 {
3031         struct wpa_ssid *entry;
3032         u8 ssid[SSID_MAX_LEN];
3033         int res;
3034         size_t ssid_len;
3035         u8 bssid[ETH_ALEN];
3036         int wired;
3037
3038         res = wpa_drv_get_ssid(wpa_s, ssid);
3039         if (res < 0) {
3040                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3041                         "driver");
3042                 return NULL;
3043         }
3044         ssid_len = res;
3045
3046         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3047                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3048                         "driver");
3049                 return NULL;
3050         }
3051
3052         wired = wpa_s->conf->ap_scan == 0 &&
3053                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3054
3055         entry = wpa_s->conf->ssid;
3056         while (entry) {
3057                 if (!wpas_network_disabled(wpa_s, entry) &&
3058                     ((ssid_len == entry->ssid_len &&
3059                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3060                     (!entry->bssid_set ||
3061                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3062                         return entry;
3063 #ifdef CONFIG_WPS
3064                 if (!wpas_network_disabled(wpa_s, entry) &&
3065                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3066                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3067                     (!entry->bssid_set ||
3068                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3069                         return entry;
3070 #endif /* CONFIG_WPS */
3071
3072                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3073                     entry->ssid_len == 0 &&
3074                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3075                         return entry;
3076
3077                 entry = entry->next;
3078         }
3079
3080         return NULL;
3081 }
3082
3083
3084 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3085 {
3086         struct wpa_global *global = wpa_s->global;
3087
3088         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3089                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3090                 if (global->drv_priv[i] == NULL) {
3091                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3092                                    "'%s'", wpa_drivers[i]->name);
3093                         return -1;
3094                 }
3095         }
3096
3097         wpa_s->driver = wpa_drivers[i];
3098         wpa_s->global_drv_priv = global->drv_priv[i];
3099
3100         return 0;
3101 }
3102
3103
3104 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3105                                      const char *name)
3106 {
3107         int i;
3108         size_t len;
3109         const char *pos, *driver = name;
3110
3111         if (wpa_s == NULL)
3112                 return -1;
3113
3114         if (wpa_drivers[0] == NULL) {
3115                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3116                         "wpa_supplicant");
3117                 return -1;
3118         }
3119
3120         if (name == NULL) {
3121                 /* default to first driver in the list */
3122                 return select_driver(wpa_s, 0);
3123         }
3124
3125         do {
3126                 pos = os_strchr(driver, ',');
3127                 if (pos)
3128                         len = pos - driver;
3129                 else
3130                         len = os_strlen(driver);
3131
3132                 for (i = 0; wpa_drivers[i]; i++) {
3133                         if (os_strlen(wpa_drivers[i]->name) == len &&
3134                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3135                             0) {
3136                                 /* First driver that succeeds wins */
3137                                 if (select_driver(wpa_s, i) == 0)
3138                                         return 0;
3139                         }
3140                 }
3141
3142                 driver = pos + 1;
3143         } while (pos);
3144
3145         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3146         return -1;
3147 }
3148
3149
3150 /**
3151  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3152  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3153  *      with struct wpa_driver_ops::init()
3154  * @src_addr: Source address of the EAPOL frame
3155  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3156  * @len: Length of the EAPOL data
3157  *
3158  * This function is called for each received EAPOL frame. Most driver
3159  * interfaces rely on more generic OS mechanism for receiving frames through
3160  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3161  * take care of received EAPOL frames and deliver them to the core supplicant
3162  * code by calling this function.
3163  */
3164 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3165                              const u8 *buf, size_t len)
3166 {
3167         struct wpa_supplicant *wpa_s = ctx;
3168
3169         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3170         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3171
3172 #ifdef CONFIG_PEERKEY
3173         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3174             wpa_s->current_ssid->peerkey &&
3175             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3176             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3177                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3178                 return;
3179         }
3180 #endif /* CONFIG_PEERKEY */
3181
3182         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3183             (wpa_s->last_eapol_matches_bssid &&
3184 #ifdef CONFIG_AP
3185              !wpa_s->ap_iface &&
3186 #endif /* CONFIG_AP */
3187              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3188                 /*
3189                  * There is possible race condition between receiving the
3190                  * association event and the EAPOL frame since they are coming
3191                  * through different paths from the driver. In order to avoid
3192                  * issues in trying to process the EAPOL frame before receiving
3193                  * association information, lets queue it for processing until
3194                  * the association event is received. This may also be needed in
3195                  * driver-based roaming case, so also use src_addr != BSSID as a
3196                  * trigger if we have previously confirmed that the
3197                  * Authenticator uses BSSID as the src_addr (which is not the
3198                  * case with wired IEEE 802.1X).
3199                  */
3200                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3201                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3202                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3203                         MAC2STR(wpa_s->bssid));
3204                 wpabuf_free(wpa_s->pending_eapol_rx);
3205                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3206                 if (wpa_s->pending_eapol_rx) {
3207                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3208                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3209                                   ETH_ALEN);
3210                 }
3211                 return;
3212         }
3213
3214         wpa_s->last_eapol_matches_bssid =
3215                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3216
3217 #ifdef CONFIG_AP
3218         if (wpa_s->ap_iface) {
3219                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3220                 return;
3221         }
3222 #endif /* CONFIG_AP */
3223
3224         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3225                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3226                         "no key management is configured");
3227                 return;
3228         }
3229
3230         if (wpa_s->eapol_received == 0 &&
3231             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3232              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3233              wpa_s->wpa_state != WPA_COMPLETED) &&
3234             (wpa_s->current_ssid == NULL ||
3235              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3236                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3237                 int timeout = 10;
3238
3239                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3240                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3241                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3242                         /* Use longer timeout for IEEE 802.1X/EAP */
3243                         timeout = 70;
3244                 }
3245
3246 #ifdef CONFIG_WPS
3247                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3248                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3249                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3250                         /*
3251                          * Use shorter timeout if going through WPS AP iteration
3252                          * for PIN config method with an AP that does not
3253                          * advertise Selected Registrar.
3254                          */
3255                         struct wpabuf *wps_ie;
3256
3257                         wps_ie = wpa_bss_get_vendor_ie_multi(
3258                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3259                         if (wps_ie &&
3260                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3261                                 timeout = 10;
3262                         wpabuf_free(wps_ie);
3263                 }
3264 #endif /* CONFIG_WPS */
3265
3266                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3267         }
3268         wpa_s->eapol_received++;
3269
3270         if (wpa_s->countermeasures) {
3271                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3272                         "EAPOL packet");
3273                 return;
3274         }
3275
3276 #ifdef CONFIG_IBSS_RSN
3277         if (wpa_s->current_ssid &&
3278             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3279                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3280                 return;
3281         }
3282 #endif /* CONFIG_IBSS_RSN */
3283
3284         /* Source address of the incoming EAPOL frame could be compared to the
3285          * current BSSID. However, it is possible that a centralized
3286          * Authenticator could be using another MAC address than the BSSID of
3287          * an AP, so just allow any address to be used for now. The replies are
3288          * still sent to the current BSSID (if available), though. */
3289
3290         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3291         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3292             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3293                 return;
3294         wpa_drv_poll(wpa_s);
3295         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3296                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3297         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3298                 /*
3299                  * Set portValid = TRUE here since we are going to skip 4-way
3300                  * handshake processing which would normally set portValid. We
3301                  * need this to allow the EAPOL state machines to be completed
3302                  * without going through EAPOL-Key handshake.
3303                  */
3304                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3305         }
3306 }
3307
3308
3309 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3310 {
3311         if ((!wpa_s->p2p_mgmt ||
3312              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3313             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3314                 l2_packet_deinit(wpa_s->l2);
3315                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3316                                            wpa_drv_get_mac_addr(wpa_s),
3317                                            ETH_P_EAPOL,
3318                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3319                 if (wpa_s->l2 == NULL)
3320                         return -1;
3321         } else {
3322                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3323                 if (addr)
3324                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3325         }
3326
3327         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3328                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3329                 return -1;
3330         }
3331
3332         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3333
3334         return 0;
3335 }
3336
3337
3338 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3339                                            const u8 *buf, size_t len)
3340 {
3341         struct wpa_supplicant *wpa_s = ctx;
3342         const struct l2_ethhdr *eth;
3343
3344         if (len < sizeof(*eth))
3345                 return;
3346         eth = (const struct l2_ethhdr *) buf;
3347
3348         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3349             !(eth->h_dest[0] & 0x01)) {
3350                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3351                         " (bridge - not for this interface - ignore)",
3352                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3353                 return;
3354         }
3355
3356         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3357                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3358         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3359                                 len - sizeof(*eth));
3360 }
3361
3362
3363 /**
3364  * wpa_supplicant_driver_init - Initialize driver interface parameters
3365  * @wpa_s: Pointer to wpa_supplicant data
3366  * Returns: 0 on success, -1 on failure
3367  *
3368  * This function is called to initialize driver interface parameters.
3369  * wpa_drv_init() must have been called before this function to initialize the
3370  * driver interface.
3371  */
3372 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3373 {
3374         static int interface_count = 0;
3375
3376         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3377                 return -1;
3378
3379         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3380                 MAC2STR(wpa_s->own_addr));
3381         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3382         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3383
3384         if (wpa_s->bridge_ifname[0]) {
3385                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3386                         "interface '%s'", wpa_s->bridge_ifname);
3387                 wpa_s->l2_br = l2_packet_init_bridge(
3388                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3389                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3390                 if (wpa_s->l2_br == NULL) {
3391                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3392                                 "connection for the bridge interface '%s'",
3393                                 wpa_s->bridge_ifname);
3394                         return -1;
3395                 }
3396         }
3397
3398         if (wpa_s->conf->ap_scan == 2 &&
3399             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3400                 wpa_printf(MSG_INFO,
3401                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3402         }
3403
3404         wpa_clear_keys(wpa_s, NULL);
3405
3406         /* Make sure that TKIP countermeasures are not left enabled (could
3407          * happen if wpa_supplicant is killed during countermeasures. */
3408         wpa_drv_set_countermeasures(wpa_s, 0);
3409
3410         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3411         wpa_drv_flush_pmkid(wpa_s);
3412
3413         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3414         wpa_s->prev_scan_wildcard = 0;
3415
3416         if (wpa_supplicant_enabled_networks(wpa_s)) {
3417                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3418                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3419                         interface_count = 0;
3420                 }
3421 #ifndef ANDROID
3422                 if (!wpa_s->p2p_mgmt &&
3423                     wpa_supplicant_delayed_sched_scan(wpa_s,
3424                                                       interface_count % 3,
3425                                                       100000))
3426                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3427                                                 100000);
3428 #endif /* ANDROID */
3429                 interface_count++;
3430         } else
3431                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3432
3433         return 0;
3434 }
3435
3436
3437 static int wpa_supplicant_daemon(const char *pid_file)
3438 {
3439         wpa_printf(MSG_DEBUG, "Daemonize..");
3440         return os_daemonize(pid_file);
3441 }
3442
3443
3444 static struct wpa_supplicant *
3445 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3446 {
3447         struct wpa_supplicant *wpa_s;
3448
3449         wpa_s = os_zalloc(sizeof(*wpa_s));
3450         if (wpa_s == NULL)
3451                 return NULL;
3452         wpa_s->scan_req = INITIAL_SCAN_REQ;
3453         wpa_s->scan_interval = 5;
3454         wpa_s->new_connection = 1;
3455         wpa_s->parent = parent ? parent : wpa_s;
3456         wpa_s->sched_scanning = 0;
3457
3458         return wpa_s;
3459 }
3460
3461
3462 #ifdef CONFIG_HT_OVERRIDES
3463
3464 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3465                              struct ieee80211_ht_capabilities *htcaps,
3466                              struct ieee80211_ht_capabilities *htcaps_mask,
3467                              const char *ht_mcs)
3468 {
3469         /* parse ht_mcs into hex array */
3470         int i;
3471         const char *tmp = ht_mcs;
3472         char *end = NULL;
3473
3474         /* If ht_mcs is null, do not set anything */
3475         if (!ht_mcs)
3476                 return 0;
3477
3478         /* This is what we are setting in the kernel */
3479         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3480
3481         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3482
3483         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3484                 errno = 0;
3485                 long v = strtol(tmp, &end, 16);
3486                 if (errno == 0) {
3487                         wpa_msg(wpa_s, MSG_DEBUG,
3488                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3489                                 i, v, end, tmp);
3490                         if (end == tmp)
3491                                 break;
3492
3493                         htcaps->supported_mcs_set[i] = v;
3494                         tmp = end;
3495                 } else {
3496                         wpa_msg(wpa_s, MSG_ERROR,
3497                                 "Failed to parse ht-mcs: %s, error: %s\n",
3498                                 ht_mcs, strerror(errno));
3499                         return -1;
3500                 }
3501         }
3502
3503         /*
3504          * If we were able to parse any values, then set mask for the MCS set.
3505          */
3506         if (i) {
3507                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3508                           IEEE80211_HT_MCS_MASK_LEN - 1);
3509                 /* skip the 3 reserved bits */
3510                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3511                         0x1f;
3512         }
3513
3514         return 0;
3515 }
3516
3517
3518 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3519                                  struct ieee80211_ht_capabilities *htcaps,
3520                                  struct ieee80211_ht_capabilities *htcaps_mask,
3521                                  int disabled)
3522 {
3523         le16 msk;
3524
3525         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3526
3527         if (disabled == -1)
3528                 return 0;
3529
3530         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3531         htcaps_mask->ht_capabilities_info |= msk;
3532         if (disabled)
3533                 htcaps->ht_capabilities_info &= msk;
3534         else
3535                 htcaps->ht_capabilities_info |= msk;
3536
3537         return 0;
3538 }
3539
3540
3541 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3542                                 struct ieee80211_ht_capabilities *htcaps,
3543                                 struct ieee80211_ht_capabilities *htcaps_mask,
3544                                 int factor)
3545 {
3546         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3547
3548         if (factor == -1)
3549                 return 0;
3550
3551         if (factor < 0 || factor > 3) {
3552                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3553                         "Must be 0-3 or -1", factor);
3554                 return -EINVAL;
3555         }
3556
3557         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3558         htcaps->a_mpdu_params &= ~0x3;
3559         htcaps->a_mpdu_params |= factor & 0x3;
3560
3561         return 0;
3562 }
3563
3564
3565 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3566                                  struct ieee80211_ht_capabilities *htcaps,
3567                                  struct ieee80211_ht_capabilities *htcaps_mask,
3568                                  int density)
3569 {
3570         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3571
3572         if (density == -1)
3573                 return 0;
3574
3575         if (density < 0 || density > 7) {
3576                 wpa_msg(wpa_s, MSG_ERROR,
3577                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3578                         density);
3579                 return -EINVAL;
3580         }
3581
3582         htcaps_mask->a_mpdu_params |= 0x1C;
3583         htcaps->a_mpdu_params &= ~(0x1C);
3584         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3585
3586         return 0;
3587 }
3588
3589
3590 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3591                                 struct ieee80211_ht_capabilities *htcaps,
3592                                 struct ieee80211_ht_capabilities *htcaps_mask,
3593                                 int disabled)
3594 {
3595         /* Masking these out disables HT40 */
3596         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3597                                 HT_CAP_INFO_SHORT_GI40MHZ);
3598
3599         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3600
3601         if (disabled)
3602                 htcaps->ht_capabilities_info &= ~msk;
3603         else
3604                 htcaps->ht_capabilities_info |= msk;
3605
3606         htcaps_mask->ht_capabilities_info |= msk;
3607
3608         return 0;
3609 }
3610
3611
3612 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3613                                struct ieee80211_ht_capabilities *htcaps,
3614                                struct ieee80211_ht_capabilities *htcaps_mask,
3615                                int disabled)
3616 {
3617         /* Masking these out disables SGI */
3618         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3619                                 HT_CAP_INFO_SHORT_GI40MHZ);
3620
3621         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3622
3623         if (disabled)
3624                 htcaps->ht_capabilities_info &= ~msk;
3625         else
3626                 htcaps->ht_capabilities_info |= msk;
3627
3628         htcaps_mask->ht_capabilities_info |= msk;
3629
3630         return 0;
3631 }
3632
3633
3634 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3635                                struct ieee80211_ht_capabilities *htcaps,
3636                                struct ieee80211_ht_capabilities *htcaps_mask,
3637                                int disabled)
3638 {
3639         /* Masking these out disables LDPC */
3640         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3641
3642         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3643
3644         if (disabled)
3645                 htcaps->ht_capabilities_info &= ~msk;
3646         else
3647                 htcaps->ht_capabilities_info |= msk;
3648
3649         htcaps_mask->ht_capabilities_info |= msk;
3650
3651         return 0;
3652 }
3653
3654
3655 void wpa_supplicant_apply_ht_overrides(
3656         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3657         struct wpa_driver_associate_params *params)
3658 {
3659         struct ieee80211_ht_capabilities *htcaps;
3660         struct ieee80211_ht_capabilities *htcaps_mask;
3661
3662         if (!ssid)
3663                 return;
3664
3665         params->disable_ht = ssid->disable_ht;
3666         if (!params->htcaps || !params->htcaps_mask)
3667                 return;
3668
3669         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3670         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3671         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3672         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3673                               ssid->disable_max_amsdu);
3674         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3675         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3676         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3677         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3678         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3679
3680         if (ssid->ht40_intolerant) {
3681                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3682                 htcaps->ht_capabilities_info |= bit;
3683                 htcaps_mask->ht_capabilities_info |= bit;
3684         }
3685 }
3686
3687 #endif /* CONFIG_HT_OVERRIDES */
3688
3689
3690 #ifdef CONFIG_VHT_OVERRIDES
3691 void wpa_supplicant_apply_vht_overrides(
3692         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3693         struct wpa_driver_associate_params *params)
3694 {
3695         struct ieee80211_vht_capabilities *vhtcaps;
3696         struct ieee80211_vht_capabilities *vhtcaps_mask;
3697
3698         if (!ssid)
3699                 return;
3700
3701         params->disable_vht = ssid->disable_vht;
3702
3703         vhtcaps = (void *) params->vhtcaps;
3704         vhtcaps_mask = (void *) params->vhtcaps_mask;
3705
3706         if (!vhtcaps || !vhtcaps_mask)
3707                 return;
3708
3709         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3710         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3711
3712 #ifdef CONFIG_HT_OVERRIDES
3713         /* if max ampdu is <= 3, we have to make the HT cap the same */
3714         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3715                 int max_ampdu;
3716
3717                 max_ampdu = (ssid->vht_capa &
3718                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3719                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3720
3721                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3722                 wpa_set_ampdu_factor(wpa_s,
3723                                      (void *) params->htcaps,
3724                                      (void *) params->htcaps_mask,
3725                                      max_ampdu);
3726         }
3727 #endif /* CONFIG_HT_OVERRIDES */
3728
3729 #define OVERRIDE_MCS(i)                                                 \
3730         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3731                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3732                         3 << 2 * (i - 1);                               \
3733                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3734                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3735         }                                                               \
3736         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3737                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3738                         3 << 2 * (i - 1);                               \
3739                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3740                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3741         }
3742
3743         OVERRIDE_MCS(1);
3744         OVERRIDE_MCS(2);
3745         OVERRIDE_MCS(3);
3746         OVERRIDE_MCS(4);
3747         OVERRIDE_MCS(5);
3748         OVERRIDE_MCS(6);
3749         OVERRIDE_MCS(7);
3750         OVERRIDE_MCS(8);
3751 }
3752 #endif /* CONFIG_VHT_OVERRIDES */
3753
3754
3755 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3756 {
3757 #ifdef PCSC_FUNCS
3758         size_t len;
3759
3760         if (!wpa_s->conf->pcsc_reader)
3761                 return 0;
3762
3763         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3764         if (!wpa_s->scard)
3765                 return 1;
3766
3767         if (wpa_s->conf->pcsc_pin &&
3768             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3769                 scard_deinit(wpa_s->scard);
3770                 wpa_s->scard = NULL;
3771                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3772                 return -1;
3773         }
3774
3775         len = sizeof(wpa_s->imsi) - 1;
3776         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3777                 scard_deinit(wpa_s->scard);
3778                 wpa_s->scard = NULL;
3779                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3780                 return -1;
3781         }
3782         wpa_s->imsi[len] = '\0';
3783
3784         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3785
3786         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3787                    wpa_s->imsi, wpa_s->mnc_len);
3788
3789         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3790         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3791 #endif /* PCSC_FUNCS */
3792
3793         return 0;
3794 }
3795
3796
3797 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3798 {
3799         char *val, *pos;
3800
3801         ext_password_deinit(wpa_s->ext_pw);
3802         wpa_s->ext_pw = NULL;
3803         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3804
3805         if (!wpa_s->conf->ext_password_backend)
3806                 return 0;
3807
3808         val = os_strdup(wpa_s->conf->ext_password_backend);
3809         if (val == NULL)
3810                 return -1;
3811         pos = os_strchr(val, ':');
3812         if (pos)
3813                 *pos++ = '\0';
3814
3815         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3816
3817         wpa_s->ext_pw = ext_password_init(val, pos);
3818         os_free(val);
3819         if (wpa_s->ext_pw == NULL) {
3820                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3821                 return -1;
3822         }
3823         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3824
3825         return 0;
3826 }
3827
3828
3829 #ifdef CONFIG_FST
3830
3831 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3832 {
3833         struct wpa_supplicant *wpa_s = ctx;
3834
3835         return (is_zero_ether_addr(wpa_s->bssid) ||
3836                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3837 }
3838
3839
3840 static void wpas_fst_get_channel_info_cb(void *ctx,
3841                                          enum hostapd_hw_mode *hw_mode,
3842                                          u8 *channel)
3843 {
3844         struct wpa_supplicant *wpa_s = ctx;
3845
3846         if (wpa_s->current_bss) {
3847                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3848                                                   channel);
3849         } else if (wpa_s->hw.num_modes) {
3850                 *hw_mode = wpa_s->hw.modes[0].mode;
3851         } else {
3852                 WPA_ASSERT(0);
3853                 *hw_mode = 0;
3854         }
3855 }
3856
3857
3858 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3859 {
3860         struct wpa_supplicant *wpa_s = ctx;
3861
3862         *modes = wpa_s->hw.modes;
3863         return wpa_s->hw.num_modes;
3864 }
3865
3866
3867 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3868 {
3869         struct wpa_supplicant *wpa_s = ctx;
3870
3871         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3872         wpa_s->fst_ies = fst_ies;
3873 }
3874
3875
3876 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3877 {
3878         struct wpa_supplicant *wpa_s = ctx;
3879
3880         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3881         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3882                                           wpa_s->own_addr, wpa_s->bssid,
3883                                           wpabuf_head(data), wpabuf_len(data),
3884                                    0);
3885 }
3886
3887
3888 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3889 {
3890         struct wpa_supplicant *wpa_s = ctx;
3891
3892         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3893         return wpa_s->received_mb_ies;
3894 }
3895
3896
3897 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3898                                      const u8 *buf, size_t size)
3899 {
3900         struct wpa_supplicant *wpa_s = ctx;
3901         struct mb_ies_info info;
3902
3903         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3904
3905         if (!mb_ies_info_by_ies(&info, buf, size)) {
3906                 wpabuf_free(wpa_s->received_mb_ies);
3907                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3908         }
3909 }
3910
3911
3912 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3913                                    Boolean mb_only)
3914 {
3915         struct wpa_supplicant *wpa_s = ctx;
3916
3917         *get_ctx = NULL;
3918         if (!is_zero_ether_addr(wpa_s->bssid))
3919                 return (wpa_s->received_mb_ies || !mb_only) ?
3920                         wpa_s->bssid : NULL;
3921         return NULL;
3922 }
3923
3924
3925 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3926                                   Boolean mb_only)
3927 {
3928         return NULL;
3929 }
3930
3931 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3932                                        struct fst_wpa_obj *iface_obj)
3933 {
3934         iface_obj->ctx              = wpa_s;
3935         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3936         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3937         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3938         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3939         iface_obj->send_action      = wpas_fst_send_action_cb;
3940         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3941         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3942         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3943         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3944 }
3945 #endif /* CONFIG_FST */
3946
3947 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3948                                     const struct wpa_driver_capa *capa)
3949 {
3950         struct wowlan_triggers *triggers;
3951         int ret = 0;
3952
3953         if (!wpa_s->conf->wowlan_triggers)
3954                 return 0;
3955
3956         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3957         if (triggers) {
3958                 ret = wpa_drv_wowlan(wpa_s, triggers);
3959                 os_free(triggers);
3960         }
3961         return ret;
3962 }
3963
3964
3965 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3966 {
3967         if (freq < 3000)
3968                 return BAND_2_4_GHZ;
3969         if (freq > 50000)
3970                 return BAND_60_GHZ;
3971         return BAND_5_GHZ;
3972 }
3973
3974
3975 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3976                                    const int *freqs)
3977 {
3978         int i;
3979         unsigned int band = 0;
3980
3981         if (freqs) {
3982                 /* freqs are specified for the radio work */
3983                 for (i = 0; freqs[i]; i++)
3984                         band |= wpas_freq_to_band(freqs[i]);
3985         } else {
3986                 /*
3987                  * freqs are not specified, implies all
3988                  * the supported freqs by HW
3989                  */
3990                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3991                         if (wpa_s->hw.modes[i].num_channels != 0) {
3992                                 if (wpa_s->hw.modes[i].mode ==
3993                                     HOSTAPD_MODE_IEEE80211B ||
3994                                     wpa_s->hw.modes[i].mode ==
3995                                     HOSTAPD_MODE_IEEE80211G)
3996                                         band |= BAND_2_4_GHZ;
3997                                 else if (wpa_s->hw.modes[i].mode ==
3998                                          HOSTAPD_MODE_IEEE80211A)
3999                                         band |= BAND_5_GHZ;
4000                                 else if (wpa_s->hw.modes[i].mode ==
4001                                          HOSTAPD_MODE_IEEE80211AD)
4002                                         band |= BAND_60_GHZ;
4003                                 else if (wpa_s->hw.modes[i].mode ==
4004                                          HOSTAPD_MODE_IEEE80211ANY)
4005                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4006                                                 BAND_60_GHZ;
4007                         }
4008                 }
4009         }
4010
4011         return band;
4012 }
4013
4014
4015 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4016                                               const char *rn)
4017 {
4018         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4019         struct wpa_radio *radio;
4020
4021         while (rn && iface) {
4022                 radio = iface->radio;
4023                 if (radio && os_strcmp(rn, radio->name) == 0) {
4024                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4025                                    wpa_s->ifname, rn);
4026                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4027                         return radio;
4028                 }
4029
4030                 iface = iface->next;
4031         }
4032
4033         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4034                    wpa_s->ifname, rn ? rn : "N/A");
4035         radio = os_zalloc(sizeof(*radio));
4036         if (radio == NULL)
4037                 return NULL;
4038
4039         if (rn)
4040                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4041         dl_list_init(&radio->ifaces);
4042         dl_list_init(&radio->work);
4043         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4044
4045         return radio;
4046 }
4047
4048
4049 static void radio_work_free(struct wpa_radio_work *work)
4050 {
4051         if (work->wpa_s->scan_work == work) {
4052                 /* This should not really happen. */
4053                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4054                         work->type, work, work->started);
4055                 work->wpa_s->scan_work = NULL;
4056         }
4057
4058 #ifdef CONFIG_P2P
4059         if (work->wpa_s->p2p_scan_work == work) {
4060                 /* This should not really happen. */
4061                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4062                         work->type, work, work->started);
4063                 work->wpa_s->p2p_scan_work = NULL;
4064         }
4065 #endif /* CONFIG_P2P */
4066
4067         if (work->started) {
4068                 work->wpa_s->radio->num_active_works--;
4069                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4070                         "radio_work_free('%s'@%p: num_active_works --> %u",
4071                         work->type, work,
4072                         work->wpa_s->radio->num_active_works);
4073         }
4074
4075         dl_list_del(&work->list);
4076         os_free(work);
4077 }
4078
4079
4080 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4081 {
4082         struct wpa_radio_work *active_work = NULL;
4083         struct wpa_radio_work *tmp;
4084
4085         /* Get the active work to know the type and band. */
4086         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4087                 if (tmp->started) {
4088                         active_work = tmp;
4089                         break;
4090                 }
4091         }
4092
4093         if (!active_work) {
4094                 /* No active work, start one */
4095                 radio->num_active_works = 0;
4096                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4097                                  list) {
4098                         if (os_strcmp(tmp->type, "scan") == 0 &&
4099                             radio->external_scan_running &&
4100                             (((struct wpa_driver_scan_params *)
4101                               tmp->ctx)->only_new_results ||
4102                              tmp->wpa_s->clear_driver_scan_cache))
4103                                 continue;
4104                         return tmp;
4105                 }
4106                 return NULL;
4107         }
4108
4109         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4110             os_strcmp(active_work->type, "connect") == 0) {
4111                 /*
4112                  * If the active work is either connect or sme-connect,
4113                  * do not parallelize them with other radio works.
4114                  */
4115                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4116                         "Do not parallelize radio work with %s",
4117                         active_work->type);
4118                 return NULL;
4119         }
4120
4121         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4122                 if (tmp->started)
4123                         continue;
4124
4125                 /*
4126                  * If connect or sme-connect are enqueued, parallelize only
4127                  * those operations ahead of them in the queue.
4128                  */
4129                 if (os_strcmp(tmp->type, "connect") == 0 ||
4130                     os_strcmp(tmp->type, "sme-connect") == 0)
4131                         break;
4132
4133                 /*
4134                  * Check that the radio works are distinct and
4135                  * on different bands.
4136                  */
4137                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4138                     (active_work->bands != tmp->bands)) {
4139                         /*
4140                          * If a scan has to be scheduled through nl80211 scan
4141                          * interface and if an external scan is already running,
4142                          * do not schedule the scan since it is likely to get
4143                          * rejected by kernel.
4144                          */
4145                         if (os_strcmp(tmp->type, "scan") == 0 &&
4146                             radio->external_scan_running &&
4147                             (((struct wpa_driver_scan_params *)
4148                               tmp->ctx)->only_new_results ||
4149                              tmp->wpa_s->clear_driver_scan_cache))
4150                                 continue;
4151
4152                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4153                                 "active_work:%s new_work:%s",
4154                                 active_work->type, tmp->type);
4155                         return tmp;
4156                 }
4157         }
4158
4159         /* Did not find a radio work to schedule in parallel. */
4160         return NULL;
4161 }
4162
4163
4164 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4165 {
4166         struct wpa_radio *radio = eloop_ctx;
4167         struct wpa_radio_work *work;
4168         struct os_reltime now, diff;
4169         struct wpa_supplicant *wpa_s;
4170
4171         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4172         if (work == NULL) {
4173                 radio->num_active_works = 0;
4174                 return;
4175         }
4176
4177         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4178                               radio_list);
4179
4180         if (!(wpa_s &&
4181               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4182                 if (work->started)
4183                         return; /* already started and still in progress */
4184
4185                 if (wpa_s && wpa_s->radio->external_scan_running) {
4186                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4187                         return;
4188                 }
4189         } else {
4190                 work = NULL;
4191                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4192                         /* get the work to schedule next */
4193                         work = radio_work_get_next_work(radio);
4194                 }
4195                 if (!work)
4196                         return;
4197         }
4198
4199         wpa_s = work->wpa_s;
4200         os_get_reltime(&now);
4201         os_reltime_sub(&now, &work->time, &diff);
4202         wpa_dbg(wpa_s, MSG_DEBUG,
4203                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4204                 work->type, work, diff.sec, diff.usec);
4205         work->started = 1;
4206         work->time = now;
4207         radio->num_active_works++;
4208
4209         work->cb(work, 0);
4210
4211         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4212             radio->num_active_works < MAX_ACTIVE_WORKS)
4213                 radio_work_check_next(wpa_s);
4214 }
4215
4216
4217 /*
4218  * This function removes both started and pending radio works running on
4219  * the provided interface's radio.
4220  * Prior to the removal of the radio work, its callback (cb) is called with
4221  * deinit set to be 1. Each work's callback is responsible for clearing its
4222  * internal data and restoring to a correct state.
4223  * @wpa_s: wpa_supplicant data
4224  * @type: type of works to be removed
4225  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4226  * this interface's works.
4227  */
4228 void radio_remove_works(struct wpa_supplicant *wpa_s,
4229                         const char *type, int remove_all)
4230 {
4231         struct wpa_radio_work *work, *tmp;
4232         struct wpa_radio *radio = wpa_s->radio;
4233
4234         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4235                               list) {
4236                 if (type && os_strcmp(type, work->type) != 0)
4237                         continue;
4238
4239                 /* skip other ifaces' works */
4240                 if (!remove_all && work->wpa_s != wpa_s)
4241                         continue;
4242
4243                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4244                         work->type, work, work->started ? " (started)" : "");
4245                 work->cb(work, 1);
4246                 radio_work_free(work);
4247         }
4248
4249         /* in case we removed the started work */
4250         radio_work_check_next(wpa_s);
4251 }
4252
4253
4254 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4255 {
4256         struct wpa_radio *radio = wpa_s->radio;
4257
4258         if (!radio)
4259                 return;
4260
4261         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4262                    wpa_s->ifname, radio->name);
4263         dl_list_del(&wpa_s->radio_list);
4264         radio_remove_works(wpa_s, NULL, 0);
4265         wpa_s->radio = NULL;
4266         if (!dl_list_empty(&radio->ifaces))
4267                 return; /* Interfaces remain for this radio */
4268
4269         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4270         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4271         os_free(radio);
4272 }
4273
4274
4275 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4276 {
4277         struct wpa_radio *radio = wpa_s->radio;
4278
4279         if (dl_list_empty(&radio->work))
4280                 return;
4281         if (wpa_s->ext_work_in_progress) {
4282                 wpa_printf(MSG_DEBUG,
4283                            "External radio work in progress - delay start of pending item");
4284                 return;
4285         }
4286         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4287         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4288 }
4289
4290
4291 /**
4292  * radio_add_work - Add a radio work item
4293  * @wpa_s: Pointer to wpa_supplicant data
4294  * @freq: Frequency of the offchannel operation in MHz or 0
4295  * @type: Unique identifier for each type of work
4296  * @next: Force as the next work to be executed
4297  * @cb: Callback function for indicating when radio is available
4298  * @ctx: Context pointer for the work (work->ctx in cb())
4299  * Returns: 0 on success, -1 on failure
4300  *
4301  * This function is used to request time for an operation that requires
4302  * exclusive radio control. Once the radio is available, the registered callback
4303  * function will be called. radio_work_done() must be called once the exclusive
4304  * radio operation has been completed, so that the radio is freed for other
4305  * operations. The special case of deinit=1 is used to free the context data
4306  * during interface removal. That does not allow the callback function to start
4307  * the radio operation, i.e., it must free any resources allocated for the radio
4308  * work and return.
4309  *
4310  * The @freq parameter can be used to indicate a single channel on which the
4311  * offchannel operation will occur. This may allow multiple radio work
4312  * operations to be performed in parallel if they apply for the same channel.
4313  * Setting this to 0 indicates that the work item may use multiple channels or
4314  * requires exclusive control of the radio.
4315  */
4316 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4317                    const char *type, int next,
4318                    void (*cb)(struct wpa_radio_work *work, int deinit),
4319                    void *ctx)
4320 {
4321         struct wpa_radio *radio = wpa_s->radio;
4322         struct wpa_radio_work *work;
4323         int was_empty;
4324
4325         work = os_zalloc(sizeof(*work));
4326         if (work == NULL)
4327                 return -1;
4328         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4329         os_get_reltime(&work->time);
4330         work->freq = freq;
4331         work->type = type;
4332         work->wpa_s = wpa_s;
4333         work->cb = cb;
4334         work->ctx = ctx;
4335
4336         if (freq)
4337                 work->bands = wpas_freq_to_band(freq);
4338         else if (os_strcmp(type, "scan") == 0 ||
4339                  os_strcmp(type, "p2p-scan") == 0)
4340                 work->bands = wpas_get_bands(wpa_s,
4341                                              ((struct wpa_driver_scan_params *)
4342                                               ctx)->freqs);
4343         else
4344                 work->bands = wpas_get_bands(wpa_s, NULL);
4345
4346         was_empty = dl_list_empty(&wpa_s->radio->work);
4347         if (next)
4348                 dl_list_add(&wpa_s->radio->work, &work->list);
4349         else
4350                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4351         if (was_empty) {
4352                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4353                 radio_work_check_next(wpa_s);
4354         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4355                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4356                 wpa_dbg(wpa_s, MSG_DEBUG,
4357                         "Try to schedule a radio work (num_active_works=%u)",
4358                         radio->num_active_works);
4359                 radio_work_check_next(wpa_s);
4360         }
4361
4362         return 0;
4363 }
4364
4365
4366 /**
4367  * radio_work_done - Indicate that a radio work item has been completed
4368  * @work: Completed work
4369  *
4370  * This function is called once the callback function registered with
4371  * radio_add_work() has completed its work.
4372  */
4373 void radio_work_done(struct wpa_radio_work *work)
4374 {
4375         struct wpa_supplicant *wpa_s = work->wpa_s;
4376         struct os_reltime now, diff;
4377         unsigned int started = work->started;
4378
4379         os_get_reltime(&now);
4380         os_reltime_sub(&now, &work->time, &diff);
4381         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4382                 work->type, work, started ? "done" : "canceled",
4383                 diff.sec, diff.usec);
4384         radio_work_free(work);
4385         if (started)
4386                 radio_work_check_next(wpa_s);
4387 }
4388
4389
4390 struct wpa_radio_work *
4391 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4392 {
4393         struct wpa_radio_work *work;
4394         struct wpa_radio *radio = wpa_s->radio;
4395
4396         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4397                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4398                         return work;
4399         }
4400
4401         return NULL;
4402 }
4403
4404
4405 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4406                             struct wpa_interface *iface)
4407 {
4408         const char *ifname, *driver, *rn;
4409
4410         driver = iface->driver;
4411 next_driver:
4412         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4413                 return -1;
4414
4415         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4416         if (wpa_s->drv_priv == NULL) {
4417                 const char *pos;
4418                 pos = driver ? os_strchr(driver, ',') : NULL;
4419                 if (pos) {
4420                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4421                                 "driver interface - try next driver wrapper");
4422                         driver = pos + 1;
4423                         goto next_driver;
4424                 }
4425                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4426                         "interface");
4427                 return -1;
4428         }
4429         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4430                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4431                         "driver_param '%s'", wpa_s->conf->driver_param);
4432                 return -1;
4433         }
4434
4435         ifname = wpa_drv_get_ifname(wpa_s);
4436         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4437                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4438                         "interface name with '%s'", ifname);
4439                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4440         }
4441
4442         rn = wpa_driver_get_radio_name(wpa_s);
4443         if (rn && rn[0] == '\0')
4444                 rn = NULL;
4445
4446         wpa_s->radio = radio_add_interface(wpa_s, rn);
4447         if (wpa_s->radio == NULL)
4448                 return -1;
4449
4450         return 0;
4451 }
4452
4453
4454 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4455                                      struct wpa_interface *iface)
4456 {
4457         struct wpa_driver_capa capa;
4458         int capa_res;
4459
4460         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4461                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4462                    iface->confname ? iface->confname : "N/A",
4463                    iface->driver ? iface->driver : "default",
4464                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4465                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4466
4467         if (iface->confname) {
4468 #ifdef CONFIG_BACKEND_FILE
4469                 wpa_s->confname = os_rel2abs_path(iface->confname);
4470                 if (wpa_s->confname == NULL) {
4471                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4472                                    "for configuration file '%s'.",
4473                                    iface->confname);
4474                         return -1;
4475                 }
4476                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4477                            iface->confname, wpa_s->confname);
4478 #else /* CONFIG_BACKEND_FILE */
4479                 wpa_s->confname = os_strdup(iface->confname);
4480 #endif /* CONFIG_BACKEND_FILE */
4481                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4482                 if (wpa_s->conf == NULL) {
4483                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4484                                    "configuration '%s'.", wpa_s->confname);
4485                         return -1;
4486                 }
4487                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4488                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4489
4490                 /*
4491                  * Override ctrl_interface and driver_param if set on command
4492                  * line.
4493                  */
4494                 if (iface->ctrl_interface) {
4495                         os_free(wpa_s->conf->ctrl_interface);
4496                         wpa_s->conf->ctrl_interface =
4497                                 os_strdup(iface->ctrl_interface);
4498                 }
4499
4500                 if (iface->driver_param) {
4501                         os_free(wpa_s->conf->driver_param);
4502                         wpa_s->conf->driver_param =
4503                                 os_strdup(iface->driver_param);
4504                 }
4505
4506                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4507                         os_free(wpa_s->conf->ctrl_interface);
4508                         wpa_s->conf->ctrl_interface = NULL;
4509                 }
4510         } else
4511                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4512                                                      iface->driver_param);
4513
4514         if (wpa_s->conf == NULL) {
4515                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4516                 return -1;
4517         }
4518
4519         if (iface->ifname == NULL) {
4520                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4521                 return -1;
4522         }
4523         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4524                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4525                            iface->ifname);
4526                 return -1;
4527         }
4528         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4529
4530         if (iface->bridge_ifname) {
4531                 if (os_strlen(iface->bridge_ifname) >=
4532                     sizeof(wpa_s->bridge_ifname)) {
4533                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4534                                    "name '%s'.", iface->bridge_ifname);
4535                         return -1;
4536                 }
4537                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4538                            sizeof(wpa_s->bridge_ifname));
4539         }
4540
4541         /* RSNA Supplicant Key Management - INITIALIZE */
4542         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4543         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4544
4545         /* Initialize driver interface and register driver event handler before
4546          * L2 receive handler so that association events are processed before
4547          * EAPOL-Key packets if both become available for the same select()
4548          * call. */
4549         if (wpas_init_driver(wpa_s, iface) < 0)
4550                 return -1;
4551
4552         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4553                 return -1;
4554
4555         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4556                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4557                           NULL);
4558         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4559
4560         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4561             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4562                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4563                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4564                         "dot11RSNAConfigPMKLifetime");
4565                 return -1;
4566         }
4567
4568         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4569             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4570                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4571                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4572                         "dot11RSNAConfigPMKReauthThreshold");
4573                 return -1;
4574         }
4575
4576         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4577             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4578                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4579                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4580                         "dot11RSNAConfigSATimeout");
4581                 return -1;
4582         }
4583
4584         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4585                                                       &wpa_s->hw.num_modes,
4586                                                       &wpa_s->hw.flags);
4587         if (wpa_s->hw.modes) {
4588                 u16 i;
4589
4590                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4591                         if (wpa_s->hw.modes[i].vht_capab) {
4592                                 wpa_s->hw_capab = CAPAB_VHT;
4593                                 break;
4594                         }
4595
4596                         if (wpa_s->hw.modes[i].ht_capab &
4597                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4598                                 wpa_s->hw_capab = CAPAB_HT40;
4599                         else if (wpa_s->hw.modes[i].ht_capab &&
4600                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4601                                 wpa_s->hw_capab = CAPAB_HT;
4602                 }
4603         }
4604
4605         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4606         if (capa_res == 0) {
4607                 wpa_s->drv_capa_known = 1;
4608                 wpa_s->drv_flags = capa.flags;
4609                 wpa_s->drv_enc = capa.enc;
4610                 wpa_s->drv_smps_modes = capa.smps_modes;
4611                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4612                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4613                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4614                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4615                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4616                 wpa_s->max_sched_scan_plan_interval =
4617                         capa.max_sched_scan_plan_interval;
4618                 wpa_s->max_sched_scan_plan_iterations =
4619                         capa.max_sched_scan_plan_iterations;
4620                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4621                 wpa_s->max_match_sets = capa.max_match_sets;
4622                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4623                 wpa_s->max_stations = capa.max_stations;
4624                 wpa_s->extended_capa = capa.extended_capa;
4625                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4626                 wpa_s->extended_capa_len = capa.extended_capa_len;
4627                 wpa_s->num_multichan_concurrent =
4628                         capa.num_multichan_concurrent;
4629                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4630
4631                 if (capa.mac_addr_rand_scan_supported)
4632                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4633                 if (wpa_s->sched_scan_supported &&
4634                     capa.mac_addr_rand_sched_scan_supported)
4635                         wpa_s->mac_addr_rand_supported |=
4636                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4637         }
4638         if (wpa_s->max_remain_on_chan == 0)
4639                 wpa_s->max_remain_on_chan = 1000;
4640
4641         /*
4642          * Only take p2p_mgmt parameters when P2P Device is supported.
4643          * Doing it here as it determines whether l2_packet_init() will be done
4644          * during wpa_supplicant_driver_init().
4645          */
4646         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4647                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4648         else
4649                 iface->p2p_mgmt = 1;
4650
4651         if (wpa_s->num_multichan_concurrent == 0)
4652                 wpa_s->num_multichan_concurrent = 1;
4653
4654         if (wpa_supplicant_driver_init(wpa_s) < 0)
4655                 return -1;
4656
4657 #ifdef CONFIG_TDLS
4658         if ((!iface->p2p_mgmt ||
4659              !(wpa_s->drv_flags &
4660                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4661             wpa_tdls_init(wpa_s->wpa))
4662                 return -1;
4663 #endif /* CONFIG_TDLS */
4664
4665         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4666             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4667                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4668                 return -1;
4669         }
4670
4671 #ifdef CONFIG_FST
4672         if (wpa_s->conf->fst_group_id) {
4673                 struct fst_iface_cfg cfg;
4674                 struct fst_wpa_obj iface_obj;
4675
4676                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4677                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4678                            sizeof(cfg.group_id));
4679                 cfg.priority = wpa_s->conf->fst_priority;
4680                 cfg.llt = wpa_s->conf->fst_llt;
4681
4682                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4683                                         &iface_obj, &cfg);
4684                 if (!wpa_s->fst) {
4685                         wpa_msg(wpa_s, MSG_ERROR,
4686                                 "FST: Cannot attach iface %s to group %s",
4687                                 wpa_s->ifname, cfg.group_id);
4688                         return -1;
4689                 }
4690         }
4691 #endif /* CONFIG_FST */
4692
4693         if (wpas_wps_init(wpa_s))
4694                 return -1;
4695
4696         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4697                 return -1;
4698         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4699
4700         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4701         if (wpa_s->ctrl_iface == NULL) {
4702                 wpa_printf(MSG_ERROR,
4703                            "Failed to initialize control interface '%s'.\n"
4704                            "You may have another wpa_supplicant process "
4705                            "already running or the file was\n"
4706                            "left by an unclean termination of wpa_supplicant "
4707                            "in which case you will need\n"
4708                            "to manually remove this file before starting "
4709                            "wpa_supplicant again.\n",
4710                            wpa_s->conf->ctrl_interface);
4711                 return -1;
4712         }
4713
4714         wpa_s->gas = gas_query_init(wpa_s);
4715         if (wpa_s->gas == NULL) {
4716                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4717                 return -1;
4718         }
4719
4720         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4721                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4722                 return -1;
4723         }
4724
4725         if (wpa_bss_init(wpa_s) < 0)
4726                 return -1;
4727
4728         /*
4729          * Set Wake-on-WLAN triggers, if configured.
4730          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4731          * have effect anyway when the interface is down).
4732          */
4733         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4734                 return -1;
4735
4736 #ifdef CONFIG_EAP_PROXY
4737 {
4738         size_t len;
4739         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4740                                                      &len);
4741         if (wpa_s->mnc_len > 0) {
4742                 wpa_s->imsi[len] = '\0';
4743                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4744                            wpa_s->imsi, wpa_s->mnc_len);
4745         } else {
4746                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4747         }
4748 }
4749 #endif /* CONFIG_EAP_PROXY */
4750
4751         if (pcsc_reader_init(wpa_s) < 0)
4752                 return -1;
4753
4754         if (wpas_init_ext_pw(wpa_s) < 0)
4755                 return -1;
4756
4757         wpas_rrm_reset(wpa_s);
4758
4759         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4760
4761 #ifdef CONFIG_HS20
4762         hs20_init(wpa_s);
4763 #endif /* CONFIG_HS20 */
4764
4765         return 0;
4766 }
4767
4768
4769 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4770                                         int notify, int terminate)
4771 {
4772         struct wpa_global *global = wpa_s->global;
4773         struct wpa_supplicant *iface, *prev;
4774
4775         if (wpa_s == wpa_s->parent)
4776                 wpas_p2p_group_remove(wpa_s, "*");
4777
4778         iface = global->ifaces;
4779         while (iface) {
4780                 if (iface == wpa_s || iface->parent != wpa_s) {
4781                         iface = iface->next;
4782                         continue;
4783                 }
4784                 wpa_printf(MSG_DEBUG,
4785                            "Remove remaining child interface %s from parent %s",
4786                            iface->ifname, wpa_s->ifname);
4787                 prev = iface;
4788                 iface = iface->next;
4789                 wpa_supplicant_remove_iface(global, prev, terminate);
4790         }
4791
4792         wpa_s->disconnected = 1;
4793         if (wpa_s->drv_priv) {
4794                 wpa_supplicant_deauthenticate(wpa_s,
4795                                               WLAN_REASON_DEAUTH_LEAVING);
4796
4797                 wpa_drv_set_countermeasures(wpa_s, 0);
4798                 wpa_clear_keys(wpa_s, NULL);
4799         }
4800
4801         wpa_supplicant_cleanup(wpa_s);
4802         wpas_p2p_deinit_iface(wpa_s);
4803
4804         wpas_ctrl_radio_work_flush(wpa_s);
4805         radio_remove_interface(wpa_s);
4806
4807 #ifdef CONFIG_FST
4808         if (wpa_s->fst) {
4809                 fst_detach(wpa_s->fst);
4810                 wpa_s->fst = NULL;
4811         }
4812         if (wpa_s->received_mb_ies) {
4813                 wpabuf_free(wpa_s->received_mb_ies);
4814                 wpa_s->received_mb_ies = NULL;
4815         }
4816 #endif /* CONFIG_FST */
4817
4818         if (wpa_s->drv_priv)
4819                 wpa_drv_deinit(wpa_s);
4820
4821         if (notify)
4822                 wpas_notify_iface_removed(wpa_s);
4823
4824         if (terminate)
4825                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4826
4827         if (wpa_s->ctrl_iface) {
4828                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4829                 wpa_s->ctrl_iface = NULL;
4830         }
4831
4832 #ifdef CONFIG_MESH
4833         if (wpa_s->ifmsh) {
4834                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4835                 wpa_s->ifmsh = NULL;
4836         }
4837 #endif /* CONFIG_MESH */
4838
4839         if (wpa_s->conf != NULL) {
4840                 wpa_config_free(wpa_s->conf);
4841                 wpa_s->conf = NULL;
4842         }
4843
4844         os_free(wpa_s->ssids_from_scan_req);
4845
4846         os_free(wpa_s);
4847 }
4848
4849
4850 /**
4851  * wpa_supplicant_add_iface - Add a new network interface
4852  * @global: Pointer to global data from wpa_supplicant_init()
4853  * @iface: Interface configuration options
4854  * @parent: Parent interface or %NULL to assign new interface as parent
4855  * Returns: Pointer to the created interface or %NULL on failure
4856  *
4857  * This function is used to add new network interfaces for %wpa_supplicant.
4858  * This can be called before wpa_supplicant_run() to add interfaces before the
4859  * main event loop has been started. In addition, new interfaces can be added
4860  * dynamically while %wpa_supplicant is already running. This could happen,
4861  * e.g., when a hotplug network adapter is inserted.
4862  */
4863 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4864                                                  struct wpa_interface *iface,
4865                                                  struct wpa_supplicant *parent)
4866 {
4867         struct wpa_supplicant *wpa_s;
4868         struct wpa_interface t_iface;
4869         struct wpa_ssid *ssid;
4870
4871         if (global == NULL || iface == NULL)
4872                 return NULL;
4873
4874         wpa_s = wpa_supplicant_alloc(parent);
4875         if (wpa_s == NULL)
4876                 return NULL;
4877
4878         wpa_s->global = global;
4879
4880         t_iface = *iface;
4881         if (global->params.override_driver) {
4882                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4883                            "('%s' -> '%s')",
4884                            iface->driver, global->params.override_driver);
4885                 t_iface.driver = global->params.override_driver;
4886         }
4887         if (global->params.override_ctrl_interface) {
4888                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4889                            "ctrl_interface ('%s' -> '%s')",
4890                            iface->ctrl_interface,
4891                            global->params.override_ctrl_interface);
4892                 t_iface.ctrl_interface =
4893                         global->params.override_ctrl_interface;
4894         }
4895         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4896                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4897                            iface->ifname);
4898                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4899                 return NULL;
4900         }
4901
4902         if (iface->p2p_mgmt == 0) {
4903                 /* Notify the control interfaces about new iface */
4904                 if (wpas_notify_iface_added(wpa_s)) {
4905                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4906                         return NULL;
4907                 }
4908
4909                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4910                         wpas_notify_network_added(wpa_s, ssid);
4911         }
4912
4913         wpa_s->next = global->ifaces;
4914         global->ifaces = wpa_s;
4915
4916         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4917         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4918
4919 #ifdef CONFIG_P2P
4920         if (wpa_s->global->p2p == NULL &&
4921             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4922             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4923             wpas_p2p_add_p2pdev_interface(
4924                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4925                 wpa_printf(MSG_INFO,
4926                            "P2P: Failed to enable P2P Device interface");
4927                 /* Try to continue without. P2P will be disabled. */
4928         }
4929 #endif /* CONFIG_P2P */
4930
4931         return wpa_s;
4932 }
4933
4934
4935 /**
4936  * wpa_supplicant_remove_iface - Remove a network interface
4937  * @global: Pointer to global data from wpa_supplicant_init()
4938  * @wpa_s: Pointer to the network interface to be removed
4939  * Returns: 0 if interface was removed, -1 if interface was not found
4940  *
4941  * This function can be used to dynamically remove network interfaces from
4942  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4943  * addition, this function is used to remove all remaining interfaces when
4944  * %wpa_supplicant is terminated.
4945  */
4946 int wpa_supplicant_remove_iface(struct wpa_global *global,
4947                                 struct wpa_supplicant *wpa_s,
4948                                 int terminate)
4949 {
4950         struct wpa_supplicant *prev;
4951 #ifdef CONFIG_MESH
4952         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4953         char *ifname = NULL;
4954 #endif /* CONFIG_MESH */
4955
4956         /* Remove interface from the global list of interfaces */
4957         prev = global->ifaces;
4958         if (prev == wpa_s) {
4959                 global->ifaces = wpa_s->next;
4960         } else {
4961                 while (prev && prev->next != wpa_s)
4962                         prev = prev->next;
4963                 if (prev == NULL)
4964                         return -1;
4965                 prev->next = wpa_s->next;
4966         }
4967
4968         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4969
4970 #ifdef CONFIG_MESH
4971         if (mesh_if_created) {
4972                 ifname = os_strdup(wpa_s->ifname);
4973                 if (ifname == NULL) {
4974                         wpa_dbg(wpa_s, MSG_ERROR,
4975                                 "mesh: Failed to malloc ifname");
4976                         return -1;
4977                 }
4978         }
4979 #endif /* CONFIG_MESH */
4980
4981         if (global->p2p_group_formation == wpa_s)
4982                 global->p2p_group_formation = NULL;
4983         if (global->p2p_invite_group == wpa_s)
4984                 global->p2p_invite_group = NULL;
4985         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4986
4987 #ifdef CONFIG_MESH
4988         if (mesh_if_created) {
4989                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4990                 os_free(ifname);
4991         }
4992 #endif /* CONFIG_MESH */
4993
4994         return 0;
4995 }
4996
4997
4998 /**
4999  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5000  * @wpa_s: Pointer to the network interface
5001  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5002  */
5003 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5004 {
5005         const char *eapol_method;
5006
5007         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5008             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5009                 return "NO-EAP";
5010         }
5011
5012         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5013         if (eapol_method == NULL)
5014                 return "UNKNOWN-EAP";
5015
5016         return eapol_method;
5017 }
5018
5019
5020 /**
5021  * wpa_supplicant_get_iface - Get a new network interface
5022  * @global: Pointer to global data from wpa_supplicant_init()
5023  * @ifname: Interface name
5024  * Returns: Pointer to the interface or %NULL if not found
5025  */
5026 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5027                                                  const char *ifname)
5028 {
5029         struct wpa_supplicant *wpa_s;
5030
5031         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5032                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5033                         return wpa_s;
5034         }
5035         return NULL;
5036 }
5037
5038
5039 #ifndef CONFIG_NO_WPA_MSG
5040 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5041 {
5042         struct wpa_supplicant *wpa_s = ctx;
5043         if (wpa_s == NULL)
5044                 return NULL;
5045         return wpa_s->ifname;
5046 }
5047 #endif /* CONFIG_NO_WPA_MSG */
5048
5049
5050 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5051 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5052 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5053
5054 /* Periodic cleanup tasks */
5055 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5056 {
5057         struct wpa_global *global = eloop_ctx;
5058         struct wpa_supplicant *wpa_s;
5059
5060         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5061                                wpas_periodic, global, NULL);
5062
5063 #ifdef CONFIG_P2P
5064         if (global->p2p)
5065                 p2p_expire_peers(global->p2p);
5066 #endif /* CONFIG_P2P */
5067
5068         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5069                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5070 #ifdef CONFIG_AP
5071                 ap_periodic(wpa_s);
5072 #endif /* CONFIG_AP */
5073         }
5074 }
5075
5076
5077 /**
5078  * wpa_supplicant_init - Initialize %wpa_supplicant
5079  * @params: Parameters for %wpa_supplicant
5080  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5081  *
5082  * This function is used to initialize %wpa_supplicant. After successful
5083  * initialization, the returned data pointer can be used to add and remove
5084  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5085  */
5086 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5087 {
5088         struct wpa_global *global;
5089         int ret, i;
5090
5091         if (params == NULL)
5092                 return NULL;
5093
5094 #ifdef CONFIG_DRIVER_NDIS
5095         {
5096                 void driver_ndis_init_ops(void);
5097                 driver_ndis_init_ops();
5098         }
5099 #endif /* CONFIG_DRIVER_NDIS */
5100
5101 #ifndef CONFIG_NO_WPA_MSG
5102         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5103 #endif /* CONFIG_NO_WPA_MSG */
5104
5105         if (params->wpa_debug_file_path)
5106                 wpa_debug_open_file(params->wpa_debug_file_path);
5107         else
5108                 wpa_debug_setup_stdout();
5109         if (params->wpa_debug_syslog)
5110                 wpa_debug_open_syslog();
5111         if (params->wpa_debug_tracing) {
5112                 ret = wpa_debug_open_linux_tracing();
5113                 if (ret) {
5114                         wpa_printf(MSG_ERROR,
5115                                    "Failed to enable trace logging");
5116                         return NULL;
5117                 }
5118         }
5119
5120         ret = eap_register_methods();
5121         if (ret) {
5122                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5123                 if (ret == -2)
5124                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5125                                    "the same EAP type.");
5126                 return NULL;
5127         }
5128
5129         global = os_zalloc(sizeof(*global));
5130         if (global == NULL)
5131                 return NULL;
5132         dl_list_init(&global->p2p_srv_bonjour);
5133         dl_list_init(&global->p2p_srv_upnp);
5134         global->params.daemonize = params->daemonize;
5135         global->params.wait_for_monitor = params->wait_for_monitor;
5136         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5137         if (params->pid_file)
5138                 global->params.pid_file = os_strdup(params->pid_file);
5139         if (params->ctrl_interface)
5140                 global->params.ctrl_interface =
5141                         os_strdup(params->ctrl_interface);
5142         if (params->ctrl_interface_group)
5143                 global->params.ctrl_interface_group =
5144                         os_strdup(params->ctrl_interface_group);
5145         if (params->override_driver)
5146                 global->params.override_driver =
5147                         os_strdup(params->override_driver);
5148         if (params->override_ctrl_interface)
5149                 global->params.override_ctrl_interface =
5150                         os_strdup(params->override_ctrl_interface);
5151 #ifdef CONFIG_P2P
5152         if (params->conf_p2p_dev)
5153                 global->params.conf_p2p_dev =
5154                         os_strdup(params->conf_p2p_dev);
5155 #endif /* CONFIG_P2P */
5156         wpa_debug_level = global->params.wpa_debug_level =
5157                 params->wpa_debug_level;
5158         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5159                 params->wpa_debug_show_keys;
5160         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5161                 params->wpa_debug_timestamp;
5162
5163         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5164
5165         if (eloop_init()) {
5166                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5167                 wpa_supplicant_deinit(global);
5168                 return NULL;
5169         }
5170
5171         random_init(params->entropy_file);
5172
5173         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5174         if (global->ctrl_iface == NULL) {
5175                 wpa_supplicant_deinit(global);
5176                 return NULL;
5177         }
5178
5179         if (wpas_notify_supplicant_initialized(global)) {
5180                 wpa_supplicant_deinit(global);
5181                 return NULL;
5182         }
5183
5184         for (i = 0; wpa_drivers[i]; i++)
5185                 global->drv_count++;
5186         if (global->drv_count == 0) {
5187                 wpa_printf(MSG_ERROR, "No drivers enabled");
5188                 wpa_supplicant_deinit(global);
5189                 return NULL;
5190         }
5191         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5192         if (global->drv_priv == NULL) {
5193                 wpa_supplicant_deinit(global);
5194                 return NULL;
5195         }
5196
5197 #ifdef CONFIG_WIFI_DISPLAY
5198         if (wifi_display_init(global) < 0) {
5199                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5200                 wpa_supplicant_deinit(global);
5201                 return NULL;
5202         }
5203 #endif /* CONFIG_WIFI_DISPLAY */
5204
5205         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5206                                wpas_periodic, global, NULL);
5207
5208         return global;
5209 }
5210
5211
5212 /**
5213  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5214  * @global: Pointer to global data from wpa_supplicant_init()
5215  * Returns: 0 after successful event loop run, -1 on failure
5216  *
5217  * This function starts the main event loop and continues running as long as
5218  * there are any remaining events. In most cases, this function is running as
5219  * long as the %wpa_supplicant process in still in use.
5220  */
5221 int wpa_supplicant_run(struct wpa_global *global)
5222 {
5223         struct wpa_supplicant *wpa_s;
5224
5225         if (global->params.daemonize &&
5226             (wpa_supplicant_daemon(global->params.pid_file) ||
5227              eloop_sock_requeue()))
5228                 return -1;
5229
5230         if (global->params.wait_for_monitor) {
5231                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5232                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5233                                 wpa_supplicant_ctrl_iface_wait(
5234                                         wpa_s->ctrl_iface);
5235         }
5236
5237         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5238         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5239
5240         eloop_run();
5241
5242         return 0;
5243 }
5244
5245
5246 /**
5247  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5248  * @global: Pointer to global data from wpa_supplicant_init()
5249  *
5250  * This function is called to deinitialize %wpa_supplicant and to free all
5251  * allocated resources. Remaining network interfaces will also be removed.
5252  */
5253 void wpa_supplicant_deinit(struct wpa_global *global)
5254 {
5255         int i;
5256
5257         if (global == NULL)
5258                 return;
5259
5260         eloop_cancel_timeout(wpas_periodic, global, NULL);
5261
5262 #ifdef CONFIG_WIFI_DISPLAY
5263         wifi_display_deinit(global);
5264 #endif /* CONFIG_WIFI_DISPLAY */
5265
5266         while (global->ifaces)
5267                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5268
5269         if (global->ctrl_iface)
5270                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5271
5272         wpas_notify_supplicant_deinitialized(global);
5273
5274         eap_peer_unregister_methods();
5275 #ifdef CONFIG_AP
5276         eap_server_unregister_methods();
5277 #endif /* CONFIG_AP */
5278
5279         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5280                 if (!global->drv_priv[i])
5281                         continue;
5282                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5283         }
5284         os_free(global->drv_priv);
5285
5286         random_deinit();
5287
5288         eloop_destroy();
5289
5290         if (global->params.pid_file) {
5291                 os_daemonize_terminate(global->params.pid_file);
5292                 os_free(global->params.pid_file);
5293         }
5294         os_free(global->params.ctrl_interface);
5295         os_free(global->params.ctrl_interface_group);
5296         os_free(global->params.override_driver);
5297         os_free(global->params.override_ctrl_interface);
5298 #ifdef CONFIG_P2P
5299         os_free(global->params.conf_p2p_dev);
5300 #endif /* CONFIG_P2P */
5301
5302         os_free(global->p2p_disallow_freq.range);
5303         os_free(global->p2p_go_avoid_freq.range);
5304         os_free(global->add_psk);
5305
5306         os_free(global);
5307         wpa_debug_close_syslog();
5308         wpa_debug_close_file();
5309         wpa_debug_close_linux_tracing();
5310 }
5311
5312
5313 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5314 {
5315         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5316             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5317                 char country[3];
5318                 country[0] = wpa_s->conf->country[0];
5319                 country[1] = wpa_s->conf->country[1];
5320                 country[2] = '\0';
5321                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5322                         wpa_printf(MSG_ERROR, "Failed to set country code "
5323                                    "'%s'", country);
5324                 }
5325         }
5326
5327         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5328                 wpas_init_ext_pw(wpa_s);
5329
5330         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5331                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5332
5333 #ifdef CONFIG_WPS
5334         wpas_wps_update_config(wpa_s);
5335 #endif /* CONFIG_WPS */
5336         wpas_p2p_update_config(wpa_s);
5337         wpa_s->conf->changed_parameters = 0;
5338 }
5339
5340
5341 void add_freq(int *freqs, int *num_freqs, int freq)
5342 {
5343         int i;
5344
5345         for (i = 0; i < *num_freqs; i++) {
5346                 if (freqs[i] == freq)
5347                         return;
5348         }
5349
5350         freqs[*num_freqs] = freq;
5351         (*num_freqs)++;
5352 }
5353
5354
5355 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5356 {
5357         struct wpa_bss *bss, *cbss;
5358         const int max_freqs = 10;
5359         int *freqs;
5360         int num_freqs = 0;
5361
5362         freqs = os_calloc(max_freqs + 1, sizeof(int));
5363         if (freqs == NULL)
5364                 return NULL;
5365
5366         cbss = wpa_s->current_bss;
5367
5368         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5369                 if (bss == cbss)
5370                         continue;
5371                 if (bss->ssid_len == cbss->ssid_len &&
5372                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5373                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5374                         add_freq(freqs, &num_freqs, bss->freq);
5375                         if (num_freqs == max_freqs)
5376                                 break;
5377                 }
5378         }
5379
5380         if (num_freqs == 0) {
5381                 os_free(freqs);
5382                 freqs = NULL;
5383         }
5384
5385         return freqs;
5386 }
5387
5388
5389 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5390 {
5391         int timeout;
5392         int count;
5393         int *freqs = NULL;
5394
5395         wpas_connect_work_done(wpa_s);
5396
5397         /*
5398          * Remove possible authentication timeout since the connection failed.
5399          */
5400         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5401
5402         /*
5403          * There is no point in blacklisting the AP if this event is
5404          * generated based on local request to disconnect.
5405          */
5406         if (wpa_s->own_disconnect_req) {
5407                 wpa_s->own_disconnect_req = 0;
5408                 wpa_dbg(wpa_s, MSG_DEBUG,
5409                         "Ignore connection failure due to local request to disconnect");
5410                 return;
5411         }
5412         if (wpa_s->disconnected) {
5413                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5414                         "indication since interface has been put into "
5415                         "disconnected state");
5416                 return;
5417         }
5418
5419         /*
5420          * Add the failed BSSID into the blacklist and speed up next scan
5421          * attempt if there could be other APs that could accept association.
5422          * The current blacklist count indicates how many times we have tried
5423          * connecting to this AP and multiple attempts mean that other APs are
5424          * either not available or has already been tried, so that we can start
5425          * increasing the delay here to avoid constant scanning.
5426          */
5427         count = wpa_blacklist_add(wpa_s, bssid);
5428         if (count == 1 && wpa_s->current_bss) {
5429                 /*
5430                  * This BSS was not in the blacklist before. If there is
5431                  * another BSS available for the same ESS, we should try that
5432                  * next. Otherwise, we may as well try this one once more
5433                  * before allowing other, likely worse, ESSes to be considered.
5434                  */
5435                 freqs = get_bss_freqs_in_ess(wpa_s);
5436                 if (freqs) {
5437                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5438                                 "has been seen; try it next");
5439                         wpa_blacklist_add(wpa_s, bssid);
5440                         /*
5441                          * On the next scan, go through only the known channels
5442                          * used in this ESS based on previous scans to speed up
5443                          * common load balancing use case.
5444                          */
5445                         os_free(wpa_s->next_scan_freqs);
5446                         wpa_s->next_scan_freqs = freqs;
5447                 }
5448         }
5449
5450         /*
5451          * Add previous failure count in case the temporary blacklist was
5452          * cleared due to no other BSSes being available.
5453          */
5454         count += wpa_s->extra_blacklist_count;
5455
5456         if (count > 3 && wpa_s->current_ssid) {
5457                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5458                            "consider temporary network disabling");
5459                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5460         }
5461
5462         switch (count) {
5463         case 1:
5464                 timeout = 100;
5465                 break;
5466         case 2:
5467                 timeout = 500;
5468                 break;
5469         case 3:
5470                 timeout = 1000;
5471                 break;
5472         case 4:
5473                 timeout = 5000;
5474                 break;
5475         default:
5476                 timeout = 10000;
5477                 break;
5478         }
5479
5480         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5481                 "ms", count, timeout);
5482
5483         /*
5484          * TODO: if more than one possible AP is available in scan results,
5485          * could try the other ones before requesting a new scan.
5486          */
5487         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5488                                 1000 * (timeout % 1000));
5489 }
5490
5491
5492 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5493 {
5494         return wpa_s->conf->ap_scan == 2 ||
5495                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5496 }
5497
5498
5499 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5500 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5501                                               struct wpa_ssid *ssid,
5502                                               const char *field,
5503                                               const char *value)
5504 {
5505 #ifdef IEEE8021X_EAPOL
5506         struct eap_peer_config *eap = &ssid->eap;
5507
5508         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5509         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5510                               (const u8 *) value, os_strlen(value));
5511
5512         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5513         case WPA_CTRL_REQ_EAP_IDENTITY:
5514                 os_free(eap->identity);
5515                 eap->identity = (u8 *) os_strdup(value);
5516                 eap->identity_len = os_strlen(value);
5517                 eap->pending_req_identity = 0;
5518                 if (ssid == wpa_s->current_ssid)
5519                         wpa_s->reassociate = 1;
5520                 break;
5521         case WPA_CTRL_REQ_EAP_PASSWORD:
5522                 bin_clear_free(eap->password, eap->password_len);
5523                 eap->password = (u8 *) os_strdup(value);
5524                 eap->password_len = os_strlen(value);
5525                 eap->pending_req_password = 0;
5526                 if (ssid == wpa_s->current_ssid)
5527                         wpa_s->reassociate = 1;
5528                 break;
5529         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5530                 bin_clear_free(eap->new_password, eap->new_password_len);
5531                 eap->new_password = (u8 *) os_strdup(value);
5532                 eap->new_password_len = os_strlen(value);
5533                 eap->pending_req_new_password = 0;
5534                 if (ssid == wpa_s->current_ssid)
5535                         wpa_s->reassociate = 1;
5536                 break;
5537         case WPA_CTRL_REQ_EAP_PIN:
5538                 str_clear_free(eap->pin);
5539                 eap->pin = os_strdup(value);
5540                 eap->pending_req_pin = 0;
5541                 if (ssid == wpa_s->current_ssid)
5542                         wpa_s->reassociate = 1;
5543                 break;
5544         case WPA_CTRL_REQ_EAP_OTP:
5545                 bin_clear_free(eap->otp, eap->otp_len);
5546                 eap->otp = (u8 *) os_strdup(value);
5547                 eap->otp_len = os_strlen(value);
5548                 os_free(eap->pending_req_otp);
5549                 eap->pending_req_otp = NULL;
5550                 eap->pending_req_otp_len = 0;
5551                 break;
5552         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5553                 str_clear_free(eap->private_key_passwd);
5554                 eap->private_key_passwd = os_strdup(value);
5555                 eap->pending_req_passphrase = 0;
5556                 if (ssid == wpa_s->current_ssid)
5557                         wpa_s->reassociate = 1;
5558                 break;
5559         case WPA_CTRL_REQ_SIM:
5560                 str_clear_free(eap->external_sim_resp);
5561                 eap->external_sim_resp = os_strdup(value);
5562                 break;
5563         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5564                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5565                         return -1;
5566                 ssid->mem_only_psk = 1;
5567                 if (ssid->passphrase)
5568                         wpa_config_update_psk(ssid);
5569                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5570                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5571                 break;
5572         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5573                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5574                         return -1;
5575                 if (os_strcmp(value, "good") == 0)
5576                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5577                 else if (os_strcmp(value, "bad") == 0)
5578                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5579                 else
5580                         return -1;
5581                 break;
5582         default:
5583                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5584                 return -1;
5585         }
5586
5587         return 0;
5588 #else /* IEEE8021X_EAPOL */
5589         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5590         return -1;
5591 #endif /* IEEE8021X_EAPOL */
5592 }
5593 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5594
5595
5596 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5597 {
5598         int i;
5599         unsigned int drv_enc;
5600
5601         if (wpa_s->p2p_mgmt)
5602                 return 1; /* no normal network profiles on p2p_mgmt interface */
5603
5604         if (ssid == NULL)
5605                 return 1;
5606
5607         if (ssid->disabled)
5608                 return 1;
5609
5610         if (wpa_s->drv_capa_known)
5611                 drv_enc = wpa_s->drv_enc;
5612         else
5613                 drv_enc = (unsigned int) -1;
5614
5615         for (i = 0; i < NUM_WEP_KEYS; i++) {
5616                 size_t len = ssid->wep_key_len[i];
5617                 if (len == 0)
5618                         continue;
5619                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5620                         continue;
5621                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5622                         continue;
5623                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5624                         continue;
5625                 return 1; /* invalid WEP key */
5626         }
5627
5628         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5629             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5630             !ssid->mem_only_psk)
5631                 return 1;
5632
5633         return 0;
5634 }
5635
5636
5637 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5638 {
5639 #ifdef CONFIG_IEEE80211W
5640         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5641                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5642                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5643                         /*
5644                          * Driver does not support BIP -- ignore pmf=1 default
5645                          * since the connection with PMF would fail and the
5646                          * configuration does not require PMF to be enabled.
5647                          */
5648                         return NO_MGMT_FRAME_PROTECTION;
5649                 }
5650
5651                 return wpa_s->conf->pmf;
5652         }
5653
5654         return ssid->ieee80211w;
5655 #else /* CONFIG_IEEE80211W */
5656         return NO_MGMT_FRAME_PROTECTION;
5657 #endif /* CONFIG_IEEE80211W */
5658 }
5659
5660
5661 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5662 {
5663         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5664                 return 1;
5665         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5666                 return 0;
5667         return -1;
5668 }
5669
5670
5671 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5672 {
5673         struct wpa_ssid *ssid = wpa_s->current_ssid;
5674         int dur;
5675         struct os_reltime now;
5676
5677         if (ssid == NULL) {
5678                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5679                            "SSID block");
5680                 return;
5681         }
5682
5683         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5684                 return;
5685
5686         ssid->auth_failures++;
5687
5688 #ifdef CONFIG_P2P
5689         if (ssid->p2p_group &&
5690             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5691                 /*
5692                  * Skip the wait time since there is a short timeout on the
5693                  * connection to a P2P group.
5694                  */
5695                 return;
5696         }
5697 #endif /* CONFIG_P2P */
5698
5699         if (ssid->auth_failures > 50)
5700                 dur = 300;
5701         else if (ssid->auth_failures > 10)
5702                 dur = 120;
5703         else if (ssid->auth_failures > 5)
5704                 dur = 90;
5705         else if (ssid->auth_failures > 3)
5706                 dur = 60;
5707         else if (ssid->auth_failures > 2)
5708                 dur = 30;
5709         else if (ssid->auth_failures > 1)
5710                 dur = 20;
5711         else
5712                 dur = 10;
5713
5714         if (ssid->auth_failures > 1 &&
5715             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5716                 dur += os_random() % (ssid->auth_failures * 10);
5717
5718         os_get_reltime(&now);
5719         if (now.sec + dur <= ssid->disabled_until.sec)
5720                 return;
5721
5722         ssid->disabled_until.sec = now.sec + dur;
5723
5724         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5725                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5726                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5727                 ssid->auth_failures, dur, reason);
5728 }
5729
5730
5731 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5732                               struct wpa_ssid *ssid, int clear_failures)
5733 {
5734         if (ssid == NULL)
5735                 return;
5736
5737         if (ssid->disabled_until.sec) {
5738                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5739                         "id=%d ssid=\"%s\"",
5740                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5741         }
5742         ssid->disabled_until.sec = 0;
5743         ssid->disabled_until.usec = 0;
5744         if (clear_failures)
5745                 ssid->auth_failures = 0;
5746 }
5747
5748
5749 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5750 {
5751         size_t i;
5752
5753         if (wpa_s->disallow_aps_bssid == NULL)
5754                 return 0;
5755
5756         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5757                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5758                               bssid, ETH_ALEN) == 0)
5759                         return 1;
5760         }
5761
5762         return 0;
5763 }
5764
5765
5766 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5767                     size_t ssid_len)
5768 {
5769         size_t i;
5770
5771         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5772                 return 0;
5773
5774         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5775                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5776                 if (ssid_len == s->ssid_len &&
5777                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5778                         return 1;
5779         }
5780
5781         return 0;
5782 }
5783
5784
5785 /**
5786  * wpas_request_connection - Request a new connection
5787  * @wpa_s: Pointer to the network interface
5788  *
5789  * This function is used to request a new connection to be found. It will mark
5790  * the interface to allow reassociation and request a new scan to find a
5791  * suitable network to connect to.
5792  */
5793 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5794 {
5795         wpa_s->normal_scans = 0;
5796         wpa_s->scan_req = NORMAL_SCAN_REQ;
5797         wpa_supplicant_reinit_autoscan(wpa_s);
5798         wpa_s->extra_blacklist_count = 0;
5799         wpa_s->disconnected = 0;
5800         wpa_s->reassociate = 1;
5801
5802         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5803                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5804         else
5805                 wpa_s->reattach = 0;
5806 }
5807
5808
5809 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5810                     struct wpa_used_freq_data *freqs_data,
5811                     unsigned int len)
5812 {
5813         unsigned int i;
5814
5815         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5816                 len, title);
5817         for (i = 0; i < len; i++) {
5818                 struct wpa_used_freq_data *cur = &freqs_data[i];
5819                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5820                         i, cur->freq, cur->flags);
5821         }
5822 }
5823
5824
5825 /*
5826  * Find the operating frequencies of any of the virtual interfaces that
5827  * are using the same radio as the current interface, and in addition, get
5828  * information about the interface types that are using the frequency.
5829  */
5830 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5831                                 struct wpa_used_freq_data *freqs_data,
5832                                 unsigned int len)
5833 {
5834         struct wpa_supplicant *ifs;
5835         u8 bssid[ETH_ALEN];
5836         int freq;
5837         unsigned int idx = 0, i;
5838
5839         wpa_dbg(wpa_s, MSG_DEBUG,
5840                 "Determining shared radio frequencies (max len %u)", len);
5841         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5842
5843         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5844                          radio_list) {
5845                 if (idx == len)
5846                         break;
5847
5848                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5849                         continue;
5850
5851                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5852                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5853                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5854                         freq = ifs->current_ssid->frequency;
5855                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5856                         freq = ifs->assoc_freq;
5857                 else
5858                         continue;
5859
5860                 /* Hold only distinct freqs */
5861                 for (i = 0; i < idx; i++)
5862                         if (freqs_data[i].freq == freq)
5863                                 break;
5864
5865                 if (i == idx)
5866                         freqs_data[idx++].freq = freq;
5867
5868                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5869                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5870                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5871                                 WPA_FREQ_USED_BY_INFRA_STATION;
5872                 }
5873         }
5874
5875         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5876         return idx;
5877 }
5878
5879
5880 /*
5881  * Find the operating frequencies of any of the virtual interfaces that
5882  * are using the same radio as the current interface.
5883  */
5884 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5885                            int *freq_array, unsigned int len)
5886 {
5887         struct wpa_used_freq_data *freqs_data;
5888         int num, i;
5889
5890         os_memset(freq_array, 0, sizeof(int) * len);
5891
5892         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5893         if (!freqs_data)
5894                 return -1;
5895
5896         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5897         for (i = 0; i < num; i++)
5898                 freq_array[i] = freqs_data[i].freq;
5899
5900         os_free(freqs_data);
5901
5902         return num;
5903 }
5904
5905
5906 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5907 {
5908         struct rrm_data *rrm = data;
5909
5910         if (!rrm->notify_neighbor_rep) {
5911                 wpa_printf(MSG_ERROR,
5912                            "RRM: Unexpected neighbor report timeout");
5913                 return;
5914         }
5915
5916         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5917         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5918
5919         rrm->notify_neighbor_rep = NULL;
5920         rrm->neighbor_rep_cb_ctx = NULL;
5921 }
5922
5923
5924 /*
5925  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5926  * @wpa_s: Pointer to wpa_supplicant
5927  */
5928 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5929 {
5930         wpa_s->rrm.rrm_used = 0;
5931
5932         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5933                              NULL);
5934         if (wpa_s->rrm.notify_neighbor_rep)
5935                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5936         wpa_s->rrm.next_neighbor_rep_token = 1;
5937 }
5938
5939
5940 /*
5941  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5942  * @wpa_s: Pointer to wpa_supplicant
5943  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5944  * @report_len: Length of neighbor report buffer
5945  */
5946 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5947                                    const u8 *report, size_t report_len)
5948 {
5949         struct wpabuf *neighbor_rep;
5950
5951         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5952         if (report_len < 1)
5953                 return;
5954
5955         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5956                 wpa_printf(MSG_DEBUG,
5957                            "RRM: Discarding neighbor report with token %d (expected %d)",
5958                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5959                 return;
5960         }
5961
5962         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5963                              NULL);
5964
5965         if (!wpa_s->rrm.notify_neighbor_rep) {
5966                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5967                 return;
5968         }
5969
5970         /* skipping the first byte, which is only an id (dialog token) */
5971         neighbor_rep = wpabuf_alloc(report_len - 1);
5972         if (neighbor_rep == NULL)
5973                 return;
5974         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5975         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5976                    report[0]);
5977         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5978                                        neighbor_rep);
5979         wpa_s->rrm.notify_neighbor_rep = NULL;
5980         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5981 }
5982
5983
5984 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5985 /* Workaround different, undefined for Windows, error codes used here */
5986 #define ENOTCONN -1
5987 #define EOPNOTSUPP -1
5988 #define ECANCELED -1
5989 #endif
5990
5991 /**
5992  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5993  * @wpa_s: Pointer to wpa_supplicant
5994  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5995  *        is sent in the request.
5996  * @cb: Callback function to be called once the requested report arrives, or
5997  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5998  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5999  *      the requester's responsibility to free it.
6000  *      In the latter case NULL will be sent in 'neighbor_rep'.
6001  * @cb_ctx: Context value to send the callback function
6002  * Returns: 0 in case of success, negative error code otherwise
6003  *
6004  * In case there is a previous request which has not been answered yet, the
6005  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6006  * Request must contain a callback function.
6007  */
6008 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6009                                        const struct wpa_ssid *ssid,
6010                                        void (*cb)(void *ctx,
6011                                                   struct wpabuf *neighbor_rep),
6012                                        void *cb_ctx)
6013 {
6014         struct wpabuf *buf;
6015         const u8 *rrm_ie;
6016
6017         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6018                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6019                 return -ENOTCONN;
6020         }
6021
6022         if (!wpa_s->rrm.rrm_used) {
6023                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6024                 return -EOPNOTSUPP;
6025         }
6026
6027         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6028                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6029         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6030             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6031                 wpa_printf(MSG_DEBUG,
6032                            "RRM: No network support for Neighbor Report.");
6033                 return -EOPNOTSUPP;
6034         }
6035
6036         if (!cb) {
6037                 wpa_printf(MSG_DEBUG,
6038                            "RRM: Neighbor Report request must provide a callback.");
6039                 return -EINVAL;
6040         }
6041
6042         /* Refuse if there's a live request */
6043         if (wpa_s->rrm.notify_neighbor_rep) {
6044                 wpa_printf(MSG_DEBUG,
6045                            "RRM: Currently handling previous Neighbor Report.");
6046                 return -EBUSY;
6047         }
6048
6049         /* 3 = action category + action code + dialog token */
6050         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6051         if (buf == NULL) {
6052                 wpa_printf(MSG_DEBUG,
6053                            "RRM: Failed to allocate Neighbor Report Request");
6054                 return -ENOMEM;
6055         }
6056
6057         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6058                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6059                    wpa_s->rrm.next_neighbor_rep_token);
6060
6061         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6062         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6063         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6064         if (ssid) {
6065                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6066                 wpabuf_put_u8(buf, ssid->ssid_len);
6067                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6068         }
6069
6070         wpa_s->rrm.next_neighbor_rep_token++;
6071
6072         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6073                                 wpa_s->own_addr, wpa_s->bssid,
6074                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6075                 wpa_printf(MSG_DEBUG,
6076                            "RRM: Failed to send Neighbor Report Request");
6077                 wpabuf_free(buf);
6078                 return -ECANCELED;
6079         }
6080
6081         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6082         wpa_s->rrm.notify_neighbor_rep = cb;
6083         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6084                                wpas_rrm_neighbor_rep_timeout_handler,
6085                                &wpa_s->rrm, NULL);
6086
6087         wpabuf_free(buf);
6088         return 0;
6089 }
6090
6091
6092 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6093                                               const u8 *src,
6094                                               const u8 *frame, size_t len,
6095                                               int rssi)
6096 {
6097         struct wpabuf *buf;
6098         const struct rrm_link_measurement_request *req;
6099         struct rrm_link_measurement_report report;
6100
6101         if (wpa_s->wpa_state != WPA_COMPLETED) {
6102                 wpa_printf(MSG_INFO,
6103                            "RRM: Ignoring link measurement request. Not associated");
6104                 return;
6105         }
6106
6107         if (!wpa_s->rrm.rrm_used) {
6108                 wpa_printf(MSG_INFO,
6109                            "RRM: Ignoring link measurement request. Not RRM network");
6110                 return;
6111         }
6112
6113         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6114                 wpa_printf(MSG_INFO,
6115                            "RRM: Measurement report failed. TX power insertion not supported");
6116                 return;
6117         }
6118
6119         req = (const struct rrm_link_measurement_request *) frame;
6120         if (len < sizeof(*req)) {
6121                 wpa_printf(MSG_INFO,
6122                            "RRM: Link measurement report failed. Request too short");
6123                 return;
6124         }
6125
6126         os_memset(&report, 0, sizeof(report));
6127         report.tpc.eid = WLAN_EID_TPC_REPORT;
6128         report.tpc.len = 2;
6129         report.rsni = 255; /* 255 indicates that RSNI is not available */
6130         report.dialog_token = req->dialog_token;
6131
6132         /*
6133          * It's possible to estimate RCPI based on RSSI in dBm. This
6134          * calculation will not reflect the correct value for high rates,
6135          * but it's good enough for Action frames which are transmitted
6136          * with up to 24 Mbps rates.
6137          */
6138         if (!rssi)
6139                 report.rcpi = 255; /* not available */
6140         else if (rssi < -110)
6141                 report.rcpi = 0;
6142         else if (rssi > 0)
6143                 report.rcpi = 220;
6144         else
6145                 report.rcpi = (rssi + 110) * 2;
6146
6147         /* action_category + action_code */
6148         buf = wpabuf_alloc(2 + sizeof(report));
6149         if (buf == NULL) {
6150                 wpa_printf(MSG_ERROR,
6151                            "RRM: Link measurement report failed. Buffer allocation failed");
6152                 return;
6153         }
6154
6155         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6156         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6157         wpabuf_put_data(buf, &report, sizeof(report));
6158         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6159                     wpabuf_head(buf), wpabuf_len(buf));
6160
6161         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6162                                 wpa_s->own_addr, wpa_s->bssid,
6163                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6164                 wpa_printf(MSG_ERROR,
6165                            "RRM: Link measurement report failed. Send action failed");
6166         }
6167         wpabuf_free(buf);
6168 }
6169
6170
6171 struct wpa_supplicant *
6172 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6173 {
6174         switch (frame) {
6175 #ifdef CONFIG_P2P
6176         case VENDOR_ELEM_PROBE_REQ_P2P:
6177         case VENDOR_ELEM_PROBE_RESP_P2P:
6178         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6179         case VENDOR_ELEM_BEACON_P2P_GO:
6180         case VENDOR_ELEM_P2P_PD_REQ:
6181         case VENDOR_ELEM_P2P_PD_RESP:
6182         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6183         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6184         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6185         case VENDOR_ELEM_P2P_INV_REQ:
6186         case VENDOR_ELEM_P2P_INV_RESP:
6187         case VENDOR_ELEM_P2P_ASSOC_REQ:
6188         case VENDOR_ELEM_P2P_ASSOC_RESP:
6189                 return wpa_s->parent;
6190 #endif /* CONFIG_P2P */
6191         default:
6192                 return wpa_s;
6193         }
6194 }
6195
6196
6197 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6198 {
6199         unsigned int i;
6200         char buf[30];
6201
6202         wpa_printf(MSG_DEBUG, "Update vendor elements");
6203
6204         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6205                 if (wpa_s->vendor_elem[i]) {
6206                         int res;
6207
6208                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6209                         if (!os_snprintf_error(sizeof(buf), res)) {
6210                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6211                                                 wpa_s->vendor_elem[i]);
6212                         }
6213                 }
6214         }
6215
6216 #ifdef CONFIG_P2P
6217         if (wpa_s->parent == wpa_s &&
6218             wpa_s->global->p2p &&
6219             !wpa_s->global->p2p_disabled)
6220                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6221 #endif /* CONFIG_P2P */
6222 }
6223
6224
6225 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6226                             const u8 *elem, size_t len)
6227 {
6228         u8 *ie, *end;
6229
6230         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6231         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6232
6233         for (; ie + 1 < end; ie += 2 + ie[1]) {
6234                 if (ie + len > end)
6235                         break;
6236                 if (os_memcmp(ie, elem, len) != 0)
6237                         continue;
6238
6239                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6240                         wpabuf_free(wpa_s->vendor_elem[frame]);
6241                         wpa_s->vendor_elem[frame] = NULL;
6242                 } else {
6243                         os_memmove(ie, ie + len, end - (ie + len));
6244                         wpa_s->vendor_elem[frame]->used -= len;
6245                 }
6246                 wpas_vendor_elem_update(wpa_s);
6247                 return 0;
6248         }
6249
6250         return -1;
6251 }