wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 401 {
 402         struct wpa_bss_tmp_disallowed *bss, *prev;
 403
 404         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 405                               struct wpa_bss_tmp_disallowed, list) {
 406                 dl_list_del(&bss->list);
 407                 os_free(bss);
 408         }
 409 }
 410
 411
 412 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 413 {
 414         int i;
 415
 416         bgscan_deinit(wpa_s);
 417         autoscan_deinit(wpa_s);
 418         scard_deinit(wpa_s->scard);
 419         wpa_s->scard = NULL;
 420         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 421         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 422         l2_packet_deinit(wpa_s->l2);
 423         wpa_s->l2 = NULL;
 424         if (wpa_s->l2_br) {
 425                 l2_packet_deinit(wpa_s->l2_br);
 426                 wpa_s->l2_br = NULL;
 427         }
 428 #ifdef CONFIG_TESTING_OPTIONS
 429         l2_packet_deinit(wpa_s->l2_test);
 430         wpa_s->l2_test = NULL;
 431 #endif /* CONFIG_TESTING_OPTIONS */
 432
 433         if (wpa_s->conf != NULL) {
 434                 struct wpa_ssid *ssid;
 435                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 436                         wpas_notify_network_removed(wpa_s, ssid);
 437         }
 438
 439         os_free(wpa_s->confname);
 440         wpa_s->confname = NULL;
 441
 442         os_free(wpa_s->confanother);
 443         wpa_s->confanother = NULL;
 444
 445         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 446         eapol_sm_deinit(wpa_s->eapol);
 447         wpa_s->eapol = NULL;
 448
 449         rsn_preauth_deinit(wpa_s->wpa);
 450
 451 #ifdef CONFIG_TDLS
 452         wpa_tdls_deinit(wpa_s->wpa);
 453 #endif /* CONFIG_TDLS */
 454
 455         wmm_ac_clear_saved_tspecs(wpa_s);
 456         pmksa_candidate_free(wpa_s->wpa);
 457         wpa_sm_deinit(wpa_s->wpa);
 458         wpa_s->wpa = NULL;
 459         wpa_blacklist_clear(wpa_s);
 460
 461         wpa_bss_deinit(wpa_s);
 462
 463         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 464         wpa_supplicant_cancel_scan(wpa_s);
 465         wpa_supplicant_cancel_auth_timeout(wpa_s);
 466         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 467 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 468         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 469                              wpa_s, NULL);
 470 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 471
 472         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 473
 474         wpas_wps_deinit(wpa_s);
 475
 476         wpabuf_free(wpa_s->pending_eapol_rx);
 477         wpa_s->pending_eapol_rx = NULL;
 478
 479 #ifdef CONFIG_IBSS_RSN
 480         ibss_rsn_deinit(wpa_s->ibss_rsn);
 481         wpa_s->ibss_rsn = NULL;
 482 #endif /* CONFIG_IBSS_RSN */
 483
 484         sme_deinit(wpa_s);
 485
 486 #ifdef CONFIG_AP
 487         wpa_supplicant_ap_deinit(wpa_s);
 488 #endif /* CONFIG_AP */
 489
 490         wpas_p2p_deinit(wpa_s);
 491
 492 #ifdef CONFIG_OFFCHANNEL
 493         offchannel_deinit(wpa_s);
 494 #endif /* CONFIG_OFFCHANNEL */
 495
 496         wpa_supplicant_cancel_sched_scan(wpa_s);
 497
 498         os_free(wpa_s->next_scan_freqs);
 499         wpa_s->next_scan_freqs = NULL;
 500
 501         os_free(wpa_s->manual_scan_freqs);
 502         wpa_s->manual_scan_freqs = NULL;
 503
 504         os_free(wpa_s->manual_sched_scan_freqs);
 505         wpa_s->manual_sched_scan_freqs = NULL;
 506
 507         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 508
 509         /*
 510          * Need to remove any pending gas-query radio work before the
 511          * gas_query_deinit() call because gas_query::work has not yet been set
 512          * for works that have not been started. gas_query_free() will be unable
 513          * to cancel such pending radio works and once the pending gas-query
 514          * radio work eventually gets removed, the deinit notification call to
 515          * gas_query_start_cb() would result in dereferencing freed memory.
 516          */
 517         if (wpa_s->radio)
 518                 radio_remove_works(wpa_s, "gas-query", 0);
 519         gas_query_deinit(wpa_s->gas);
 520         wpa_s->gas = NULL;
 521
 522         free_hw_features(wpa_s);
 523
 524         ieee802_1x_dealloc_kay_sm(wpa_s);
 525
 526         os_free(wpa_s->bssid_filter);
 527         wpa_s->bssid_filter = NULL;
 528
 529         os_free(wpa_s->disallow_aps_bssid);
 530         wpa_s->disallow_aps_bssid = NULL;
 531         os_free(wpa_s->disallow_aps_ssid);
 532         wpa_s->disallow_aps_ssid = NULL;
 533
 534         wnm_bss_keep_alive_deinit(wpa_s);
 535 #ifdef CONFIG_WNM
 536         wnm_deallocate_memory(wpa_s);
 537 #endif /* CONFIG_WNM */
 538
 539         ext_password_deinit(wpa_s->ext_pw);
 540         wpa_s->ext_pw = NULL;
 541
 542         wpabuf_free(wpa_s->last_gas_resp);
 543         wpa_s->last_gas_resp = NULL;
 544         wpabuf_free(wpa_s->prev_gas_resp);
 545         wpa_s->prev_gas_resp = NULL;
 546
 547         os_free(wpa_s->last_scan_res);
 548         wpa_s->last_scan_res = NULL;
 549
 550 #ifdef CONFIG_HS20
 551         hs20_deinit(wpa_s);
 552 #endif /* CONFIG_HS20 */
 553
 554         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 555                 wpabuf_free(wpa_s->vendor_elem[i]);
 556                 wpa_s->vendor_elem[i] = NULL;
 557         }
 558
 559         wmm_ac_notify_disassoc(wpa_s);
 560
 561         wpa_s->sched_scan_plans_num = 0;
 562         os_free(wpa_s->sched_scan_plans);
 563         wpa_s->sched_scan_plans = NULL;
 564
 565 #ifdef CONFIG_MBO
 566         wpa_s->non_pref_chan_num = 0;
 567         os_free(wpa_s->non_pref_chan);
 568         wpa_s->non_pref_chan = NULL;
 569 #endif /* CONFIG_MBO */
 570
 571         free_bss_tmp_disallowed(wpa_s);
 572 }
 573
 574
 575 /**
 576  * wpa_clear_keys - Clear keys configured for the driver
 577  * @wpa_s: Pointer to wpa_supplicant data
 578  * @addr: Previously used BSSID or %NULL if not available
 579  *
 580  * This function clears the encryption keys that has been previously configured
 581  * for the driver.
 582  */
 583 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 584 {
 585         int i, max;
 586
 587 #ifdef CONFIG_IEEE80211W
 588         max = 6;
 589 #else /* CONFIG_IEEE80211W */
 590         max = 4;
 591 #endif /* CONFIG_IEEE80211W */
 592
 593         /* MLME-DELETEKEYS.request */
 594         for (i = 0; i < max; i++) {
 595                 if (wpa_s->keys_cleared & BIT(i))
 596                         continue;
 597                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 598                                 NULL, 0);
 599         }
 600         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 601             !is_zero_ether_addr(addr)) {
 602                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 603                                 0);
 604                 /* MLME-SETPROTECTION.request(None) */
 605                 wpa_drv_mlme_setprotection(
 606                         wpa_s, addr,
 607                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 608                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 609         }
 610         wpa_s->keys_cleared = (u32) -1;
 611 }
 612
 613
 614 /**
 615  * wpa_supplicant_state_txt - Get the connection state name as a text string
 616  * @state: State (wpa_state; WPA_*)
 617  * Returns: The state name as a printable text string
 618  */
 619 const char * wpa_supplicant_state_txt(enum wpa_states state)
 620 {
 621         switch (state) {
 622         case WPA_DISCONNECTED:
 623                 return "DISCONNECTED";
 624         case WPA_INACTIVE:
 625                 return "INACTIVE";
 626         case WPA_INTERFACE_DISABLED:
 627                 return "INTERFACE_DISABLED";
 628         case WPA_SCANNING:
 629                 return "SCANNING";
 630         case WPA_AUTHENTICATING:
 631                 return "AUTHENTICATING";
 632         case WPA_ASSOCIATING:
 633                 return "ASSOCIATING";
 634         case WPA_ASSOCIATED:
 635                 return "ASSOCIATED";
 636         case WPA_4WAY_HANDSHAKE:
 637                 return "4WAY_HANDSHAKE";
 638         case WPA_GROUP_HANDSHAKE:
 639                 return "GROUP_HANDSHAKE";
 640         case WPA_COMPLETED:
 641                 return "COMPLETED";
 642         default:
 643                 return "UNKNOWN";
 644         }
 645 }
 646
 647
 648 #ifdef CONFIG_BGSCAN
 649
 650 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 651 {
 652         const char *name;
 653
 654         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 655                 name = wpa_s->current_ssid->bgscan;
 656         else
 657                 name = wpa_s->conf->bgscan;
 658         if (name == NULL || name[0] == '\0')
 659                 return;
 660         if (wpas_driver_bss_selection(wpa_s))
 661                 return;
 662         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 663                 return;
 664 #ifdef CONFIG_P2P
 665         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 666                 return;
 667 #endif /* CONFIG_P2P */
 668
 669         bgscan_deinit(wpa_s);
 670         if (wpa_s->current_ssid) {
 671                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 672                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 673                                 "bgscan");
 674                         /*
 675                          * Live without bgscan; it is only used as a roaming
 676                          * optimization, so the initial connection is not
 677                          * affected.
 678                          */
 679                 } else {
 680                         struct wpa_scan_results *scan_res;
 681                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 682                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 683                                                                    0);
 684                         if (scan_res) {
 685                                 bgscan_notify_scan(wpa_s, scan_res);
 686                                 wpa_scan_results_free(scan_res);
 687                         }
 688                 }
 689         } else
 690                 wpa_s->bgscan_ssid = NULL;
 691 }
 692
 693
 694 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 695 {
 696         if (wpa_s->bgscan_ssid != NULL) {
 697                 bgscan_deinit(wpa_s);
 698                 wpa_s->bgscan_ssid = NULL;
 699         }
 700 }
 701
 702 #endif /* CONFIG_BGSCAN */
 703
 704
 705 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 706 {
 707         if (autoscan_init(wpa_s, 0))
 708                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 709 }
 710
 711
 712 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 713 {
 714         autoscan_deinit(wpa_s);
 715 }
 716
 717
 718 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 719 {
 720         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 721             wpa_s->wpa_state == WPA_SCANNING) {
 722                 autoscan_deinit(wpa_s);
 723                 wpa_supplicant_start_autoscan(wpa_s);
 724         }
 725 }
 726
 727
 728 /**
 729  * wpa_supplicant_set_state - Set current connection state
 730  * @wpa_s: Pointer to wpa_supplicant data
 731  * @state: The new connection state
 732  *
 733  * This function is called whenever the connection state changes, e.g.,
 734  * association is completed for WPA/WPA2 4-Way Handshake is started.
 735  */
 736 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 737                               enum wpa_states state)
 738 {
 739         enum wpa_states old_state = wpa_s->wpa_state;
 740
 741         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 742                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 743                 wpa_supplicant_state_txt(state));
 744
 745         if (state == WPA_INTERFACE_DISABLED) {
 746                 /* Assure normal scan when interface is restored */
 747                 wpa_s->normal_scans = 0;
 748         }
 749
 750         if (state == WPA_COMPLETED) {
 751                 wpas_connect_work_done(wpa_s);
 752                 /* Reinitialize normal_scan counter */
 753                 wpa_s->normal_scans = 0;
 754         }
 755
 756 #ifdef CONFIG_P2P
 757         /*
 758          * P2PS client has to reply to Probe Request frames received on the
 759          * group operating channel. Enable Probe Request frame reporting for
 760          * P2P connected client in case p2p_cli_probe configuration property is
 761          * set to 1.
 762          */
 763         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 764             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 765             wpa_s->current_ssid->p2p_group) {
 766                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 767                         wpa_dbg(wpa_s, MSG_DEBUG,
 768                                 "P2P: Enable CLI Probe Request RX reporting");
 769                         wpa_s->p2p_cli_probe =
 770                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 771                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 772                         wpa_dbg(wpa_s, MSG_DEBUG,
 773                                 "P2P: Disable CLI Probe Request RX reporting");
 774                         wpa_s->p2p_cli_probe = 0;
 775                         wpa_drv_probe_req_report(wpa_s, 0);
 776                 }
 777         }
 778 #endif /* CONFIG_P2P */
 779
 780         if (state != WPA_SCANNING)
 781                 wpa_supplicant_notify_scanning(wpa_s, 0);
 782
 783         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 784                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 785 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 786                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 787                         MACSTR " completed [id=%d id_str=%s]",
 788                         MAC2STR(wpa_s->bssid),
 789                         ssid ? ssid->id : -1,
 790                         ssid && ssid->id_str ? ssid->id_str : "");
 791 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 792                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 793                 wpa_blacklist_clear(wpa_s);
 794                 wpa_s->extra_blacklist_count = 0;
 795                 wpa_s->new_connection = 0;
 796                 wpa_drv_set_operstate(wpa_s, 1);
 797 #ifndef IEEE8021X_EAPOL
 798                 wpa_drv_set_supp_port(wpa_s, 1);
 799 #endif /* IEEE8021X_EAPOL */
 800                 wpa_s->after_wps = 0;
 801                 wpa_s->known_wps_freq = 0;
 802                 wpas_p2p_completed(wpa_s);
 803
 804                 sme_sched_obss_scan(wpa_s, 1);
 805         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 806                    state == WPA_ASSOCIATED) {
 807                 wpa_s->new_connection = 1;
 808                 wpa_drv_set_operstate(wpa_s, 0);
 809 #ifndef IEEE8021X_EAPOL
 810                 wpa_drv_set_supp_port(wpa_s, 0);
 811 #endif /* IEEE8021X_EAPOL */
 812                 sme_sched_obss_scan(wpa_s, 0);
 813         }
 814         wpa_s->wpa_state = state;
 815
 816 #ifdef CONFIG_BGSCAN
 817         if (state == WPA_COMPLETED)
 818                 wpa_supplicant_start_bgscan(wpa_s);
 819         else if (state < WPA_ASSOCIATED)
 820                 wpa_supplicant_stop_bgscan(wpa_s);
 821 #endif /* CONFIG_BGSCAN */
 822
 823         if (state == WPA_AUTHENTICATING)
 824                 wpa_supplicant_stop_autoscan(wpa_s);
 825
 826         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 827                 wpa_supplicant_start_autoscan(wpa_s);
 828
 829         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 830                 wmm_ac_notify_disassoc(wpa_s);
 831
 832         if (wpa_s->wpa_state != old_state) {
 833                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 834
 835                 /*
 836                  * Notify the P2P Device interface about a state change in one
 837                  * of the interfaces.
 838                  */
 839                 wpas_p2p_indicate_state_change(wpa_s);
 840
 841                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 842                     old_state == WPA_COMPLETED)
 843                         wpas_notify_auth_changed(wpa_s);
 844         }
 845 }
 846
 847
 848 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 849 {
 850         int pending = 0;
 851 #ifdef CONFIG_WPS
 852         struct wpa_supplicant *wpa_s = global->ifaces;
 853         while (wpa_s) {
 854                 struct wpa_supplicant *next = wpa_s->next;
 855                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 856                         pending = 1;
 857 #ifdef CONFIG_P2P
 858                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 859                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 860                         wpas_p2p_disconnect(wpa_s);
 861 #endif /* CONFIG_P2P */
 862                 wpa_s = next;
 863         }
 864 #endif /* CONFIG_WPS */
 865         if (pending)
 866                 return;
 867         eloop_terminate();
 868 }
 869
 870
 871 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 872 {
 873         struct wpa_global *global = signal_ctx;
 874         wpa_supplicant_terminate_proc(global);
 875 }
 876
 877
 878 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 879 {
 880         enum wpa_states old_state = wpa_s->wpa_state;
 881
 882         wpa_s->pairwise_cipher = 0;
 883         wpa_s->group_cipher = 0;
 884         wpa_s->mgmt_group_cipher = 0;
 885         wpa_s->key_mgmt = 0;
 886         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 887                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 888
 889         if (wpa_s->wpa_state != old_state)
 890                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 891 }
 892
 893
 894 /**
 895  * wpa_supplicant_reload_configuration - Reload configuration data
 896  * @wpa_s: Pointer to wpa_supplicant data
 897  * Returns: 0 on success or -1 if configuration parsing failed
 898  *
 899  * This function can be used to request that the configuration data is reloaded
 900  * (e.g., after configuration file change). This function is reloading
 901  * configuration only for one interface, so this may need to be called multiple
 902  * times if %wpa_supplicant is controlling multiple interfaces and all
 903  * interfaces need reconfiguration.
 904  */
 905 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 906 {
 907         struct wpa_config *conf;
 908         int reconf_ctrl;
 909         int old_ap_scan;
 910
 911         if (wpa_s->confname == NULL)
 912                 return -1;
 913         conf = wpa_config_read(wpa_s->confname, NULL);
 914         if (conf == NULL) {
 915                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 916                         "file '%s' - exiting", wpa_s->confname);
 917                 return -1;
 918         }
 919         wpa_config_read(wpa_s->confanother, conf);
 920
 921         conf->changed_parameters = (unsigned int) -1;
 922
 923         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 924                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 925                     os_strcmp(conf->ctrl_interface,
 926                               wpa_s->conf->ctrl_interface) != 0);
 927
 928         if (reconf_ctrl && wpa_s->ctrl_iface) {
 929                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 930                 wpa_s->ctrl_iface = NULL;
 931         }
 932
 933         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 934         if (wpa_s->current_ssid) {
 935                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 936                         wpa_s->own_disconnect_req = 1;
 937                 wpa_supplicant_deauthenticate(wpa_s,
 938                                               WLAN_REASON_DEAUTH_LEAVING);
 939         }
 940
 941         /*
 942          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 943          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 944          */
 945         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 946                 /*
 947                  * Clear forced success to clear EAP state for next
 948                  * authentication.
 949                  */
 950                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 951         }
 952         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 953         wpa_sm_set_config(wpa_s->wpa, NULL);
 954         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 955         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 956         rsn_preauth_deinit(wpa_s->wpa);
 957
 958         old_ap_scan = wpa_s->conf->ap_scan;
 959         wpa_config_free(wpa_s->conf);
 960         wpa_s->conf = conf;
 961         if (old_ap_scan != wpa_s->conf->ap_scan)
 962                 wpas_notify_ap_scan_changed(wpa_s);
 963
 964         if (reconf_ctrl)
 965                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 966
 967         wpa_supplicant_update_config(wpa_s);
 968
 969         wpa_supplicant_clear_status(wpa_s);
 970         if (wpa_supplicant_enabled_networks(wpa_s)) {
 971                 wpa_s->reassociate = 1;
 972                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 973         }
 974         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 975         return 0;
 976 }
 977
 978
 979 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 980 {
 981         struct wpa_global *global = signal_ctx;
 982         struct wpa_supplicant *wpa_s;
 983         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 984                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 985                         sig);
 986                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 987                         wpa_supplicant_terminate_proc(global);
 988                 }
 989         }
 990
 991         if (wpa_debug_reopen_file() < 0) {
 992                 /* Ignore errors since we cannot really do much to fix this */
 993                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 994         }
 995 }
 996
 997
 998 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 999                                          struct wpa_ssid *ssid,
1000                                          struct wpa_ie_data *ie)
1001 {
1002         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1003         if (ret) {
1004                 if (ret == -2) {
1005                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1006                                 "from association info");
1007                 }
1008                 return -1;
1009         }
1010
1011         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1012                 "cipher suites");
1013         if (!(ie->group_cipher & ssid->group_cipher)) {
1014                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1015                         "cipher 0x%x (mask 0x%x) - reject",
1016                         ie->group_cipher, ssid->group_cipher);
1017                 return -1;
1018         }
1019         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1020                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1021                         "cipher 0x%x (mask 0x%x) - reject",
1022                         ie->pairwise_cipher, ssid->pairwise_cipher);
1023                 return -1;
1024         }
1025         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1026                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1027                         "management 0x%x (mask 0x%x) - reject",
1028                         ie->key_mgmt, ssid->key_mgmt);
1029                 return -1;
1030         }
1031
1032 #ifdef CONFIG_IEEE80211W
1033         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1034             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1035                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1036                         "that does not support management frame protection - "
1037                         "reject");
1038                 return -1;
1039         }
1040 #endif /* CONFIG_IEEE80211W */
1041
1042         return 0;
1043 }
1044
1045
1046 /**
1047  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1048  * @wpa_s: Pointer to wpa_supplicant data
1049  * @bss: Scan results for the selected BSS, or %NULL if not available
1050  * @ssid: Configuration data for the selected network
1051  * @wpa_ie: Buffer for the WPA/RSN IE
1052  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1053  * used buffer length in case the functions returns success.
1054  * Returns: 0 on success or -1 on failure
1055  *
1056  * This function is used to configure authentication and encryption parameters
1057  * based on the network configuration and scan result for the selected BSS (if
1058  * available).
1059  */
1060 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1061                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1062                               u8 *wpa_ie, size_t *wpa_ie_len)
1063 {
1064         struct wpa_ie_data ie;
1065         int sel, proto;
1066         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1067
1068         if (bss) {
1069                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1070                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1071                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1072         } else
1073                 bss_wpa = bss_rsn = bss_osen = NULL;
1074
1075         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1076             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1077             (ie.group_cipher & ssid->group_cipher) &&
1078             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1079             (ie.key_mgmt & ssid->key_mgmt)) {
1080                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1081                 proto = WPA_PROTO_RSN;
1082         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1083                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1084                    (ie.group_cipher & ssid->group_cipher) &&
1085                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1086                    (ie.key_mgmt & ssid->key_mgmt)) {
1087                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1088                 proto = WPA_PROTO_WPA;
1089 #ifdef CONFIG_HS20
1090         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1092                 /* TODO: parse OSEN element */
1093                 os_memset(&ie, 0, sizeof(ie));
1094                 ie.group_cipher = WPA_CIPHER_CCMP;
1095                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1096                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1097                 proto = WPA_PROTO_OSEN;
1098 #endif /* CONFIG_HS20 */
1099         } else if (bss) {
1100                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1101                 wpa_dbg(wpa_s, MSG_DEBUG,
1102                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1103                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1104                         ssid->key_mgmt);
1105                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1106                         MAC2STR(bss->bssid),
1107                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1108                         bss_wpa ? " WPA" : "",
1109                         bss_rsn ? " RSN" : "",
1110                         bss_osen ? " OSEN" : "");
1111                 if (bss_rsn) {
1112                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1113                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1114                                 wpa_dbg(wpa_s, MSG_DEBUG,
1115                                         "Could not parse RSN element");
1116                         } else {
1117                                 wpa_dbg(wpa_s, MSG_DEBUG,
1118                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1119                                         ie.pairwise_cipher, ie.group_cipher,
1120                                         ie.key_mgmt);
1121                         }
1122                 }
1123                 if (bss_wpa) {
1124                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1125                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1126                                 wpa_dbg(wpa_s, MSG_DEBUG,
1127                                         "Could not parse WPA element");
1128                         } else {
1129                                 wpa_dbg(wpa_s, MSG_DEBUG,
1130                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1131                                         ie.pairwise_cipher, ie.group_cipher,
1132                                         ie.key_mgmt);
1133                         }
1134                 }
1135                 return -1;
1136         } else {
1137                 if (ssid->proto & WPA_PROTO_OSEN)
1138                         proto = WPA_PROTO_OSEN;
1139                 else if (ssid->proto & WPA_PROTO_RSN)
1140                         proto = WPA_PROTO_RSN;
1141                 else
1142                         proto = WPA_PROTO_WPA;
1143                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1144                         os_memset(&ie, 0, sizeof(ie));
1145                         ie.group_cipher = ssid->group_cipher;
1146                         ie.pairwise_cipher = ssid->pairwise_cipher;
1147                         ie.key_mgmt = ssid->key_mgmt;
1148 #ifdef CONFIG_IEEE80211W
1149                         ie.mgmt_group_cipher =
1150                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1151                                 WPA_CIPHER_AES_128_CMAC : 0;
1152 #endif /* CONFIG_IEEE80211W */
1153                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1154                                 "based on configuration");
1155                 } else
1156                         proto = ie.proto;
1157         }
1158
1159         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1160                 "pairwise %d key_mgmt %d proto %d",
1161                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1162 #ifdef CONFIG_IEEE80211W
1163         if (ssid->ieee80211w) {
1164                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1165                         ie.mgmt_group_cipher);
1166         }
1167 #endif /* CONFIG_IEEE80211W */
1168
1169         wpa_s->wpa_proto = proto;
1170         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1171         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1172                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1173
1174         if (bss || !wpa_s->ap_ies_from_associnfo) {
1175                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1176                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1177                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1178                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1179                         return -1;
1180         }
1181
1182 #ifdef CONFIG_NO_WPA
1183         wpa_s->group_cipher = WPA_CIPHER_NONE;
1184         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1185 #else /* CONFIG_NO_WPA */
1186         sel = ie.group_cipher & ssid->group_cipher;
1187         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1188         if (wpa_s->group_cipher < 0) {
1189                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1190                         "cipher");
1191                 return -1;
1192         }
1193         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1194                 wpa_cipher_txt(wpa_s->group_cipher));
1195
1196         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1197         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1198         if (wpa_s->pairwise_cipher < 0) {
1199                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1200                         "cipher");
1201                 return -1;
1202         }
1203         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1204                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1205 #endif /* CONFIG_NO_WPA */
1206
1207         sel = ie.key_mgmt & ssid->key_mgmt;
1208 #ifdef CONFIG_SAE
1209         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1210                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1211 #endif /* CONFIG_SAE */
1212         if (0) {
1213 #ifdef CONFIG_SUITEB192
1214         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1216                 wpa_dbg(wpa_s, MSG_DEBUG,
1217                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1218 #endif /* CONFIG_SUITEB192 */
1219 #ifdef CONFIG_SUITEB
1220         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1222                 wpa_dbg(wpa_s, MSG_DEBUG,
1223                         "WPA: using KEY_MGMT 802.1X with Suite B");
1224 #endif /* CONFIG_SUITEB */
1225 #ifdef CONFIG_IEEE80211R
1226         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1228                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1229         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1230                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1231                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1232 #endif /* CONFIG_IEEE80211R */
1233 #ifdef CONFIG_SAE
1234         } else if (sel & WPA_KEY_MGMT_SAE) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1237         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1240 #endif /* CONFIG_SAE */
1241 #ifdef CONFIG_IEEE80211W
1242         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1243                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1244                 wpa_dbg(wpa_s, MSG_DEBUG,
1245                         "WPA: using KEY_MGMT 802.1X with SHA256");
1246         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1248                 wpa_dbg(wpa_s, MSG_DEBUG,
1249                         "WPA: using KEY_MGMT PSK with SHA256");
1250 #endif /* CONFIG_IEEE80211W */
1251         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1252                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1253                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1254         } else if (sel & WPA_KEY_MGMT_PSK) {
1255                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1256                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1257         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1258                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1259                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1260 #ifdef CONFIG_HS20
1261         } else if (sel & WPA_KEY_MGMT_OSEN) {
1262                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1264 #endif /* CONFIG_HS20 */
1265         } else {
1266                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1267                         "authenticated key management type");
1268                 return -1;
1269         }
1270
1271         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1272         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1273                          wpa_s->pairwise_cipher);
1274         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1275
1276 #ifdef CONFIG_IEEE80211W
1277         sel = ie.mgmt_group_cipher;
1278         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1279             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1280                 sel = 0;
1281         if (sel & WPA_CIPHER_AES_128_CMAC) {
1282                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1283                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1284                         "AES-128-CMAC");
1285         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1286                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1287                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1288                         "BIP-GMAC-128");
1289         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1290                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1291                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1292                         "BIP-GMAC-256");
1293         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1294                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1295                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1296                         "BIP-CMAC-256");
1297         } else {
1298                 wpa_s->mgmt_group_cipher = 0;
1299                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1300         }
1301         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1302                          wpa_s->mgmt_group_cipher);
1303         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1304                          wpas_get_ssid_pmf(wpa_s, ssid));
1305 #endif /* CONFIG_IEEE80211W */
1306
1307         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1308                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1309                 return -1;
1310         }
1311
1312         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1313                 int psk_set = 0;
1314
1315                 if (ssid->psk_set) {
1316                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1317                                        NULL);
1318                         psk_set = 1;
1319                 }
1320 #ifndef CONFIG_NO_PBKDF2
1321                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1322                     ssid->passphrase) {
1323                         u8 psk[PMK_LEN];
1324                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1325                                     4096, psk, PMK_LEN);
1326                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1327                                         psk, PMK_LEN);
1328                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1329                         psk_set = 1;
1330                         os_memset(psk, 0, sizeof(psk));
1331                 }
1332 #endif /* CONFIG_NO_PBKDF2 */
1333 #ifdef CONFIG_EXT_PASSWORD
1334                 if (ssid->ext_psk) {
1335                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1336                                                              ssid->ext_psk);
1337                         char pw_str[64 + 1];
1338                         u8 psk[PMK_LEN];
1339
1340                         if (pw == NULL) {
1341                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1342                                         "found from external storage");
1343                                 return -1;
1344                         }
1345
1346                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1347                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1348                                         "PSK length %d in external storage",
1349                                         (int) wpabuf_len(pw));
1350                                 ext_password_free(pw);
1351                                 return -1;
1352                         }
1353
1354                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1355                         pw_str[wpabuf_len(pw)] = '\0';
1356
1357 #ifndef CONFIG_NO_PBKDF2
1358                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1359                         {
1360                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1361                                             4096, psk, PMK_LEN);
1362                                 os_memset(pw_str, 0, sizeof(pw_str));
1363                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1364                                                 "external passphrase)",
1365                                                 psk, PMK_LEN);
1366                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1367                                                NULL);
1368                                 psk_set = 1;
1369                                 os_memset(psk, 0, sizeof(psk));
1370                         } else
1371 #endif /* CONFIG_NO_PBKDF2 */
1372                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1373                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1374                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1375                                                 "Invalid PSK hex string");
1376                                         os_memset(pw_str, 0, sizeof(pw_str));
1377                                         ext_password_free(pw);
1378                                         return -1;
1379                                 }
1380                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1381                                                NULL);
1382                                 psk_set = 1;
1383                                 os_memset(psk, 0, sizeof(psk));
1384                         } else {
1385                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1386                                         "PSK available");
1387                                 os_memset(pw_str, 0, sizeof(pw_str));
1388                                 ext_password_free(pw);
1389                                 return -1;
1390                         }
1391
1392                         os_memset(pw_str, 0, sizeof(pw_str));
1393                         ext_password_free(pw);
1394                 }
1395 #endif /* CONFIG_EXT_PASSWORD */
1396
1397                 if (!psk_set) {
1398                         wpa_msg(wpa_s, MSG_INFO,
1399                                 "No PSK available for association");
1400                         return -1;
1401                 }
1402         } else
1403                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1404
1405         return 0;
1406 }
1407
1408
1409 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1410 {
1411         *pos = 0x00;
1412
1413         switch (idx) {
1414         case 0: /* Bits 0-7 */
1415                 break;
1416         case 1: /* Bits 8-15 */
1417                 break;
1418         case 2: /* Bits 16-23 */
1419 #ifdef CONFIG_WNM
1420                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1421                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1422 #endif /* CONFIG_WNM */
1423                 break;
1424         case 3: /* Bits 24-31 */
1425 #ifdef CONFIG_WNM
1426                 *pos |= 0x02; /* Bit 25 - SSID List */
1427 #endif /* CONFIG_WNM */
1428 #ifdef CONFIG_INTERWORKING
1429                 if (wpa_s->conf->interworking)
1430                         *pos |= 0x80; /* Bit 31 - Interworking */
1431 #endif /* CONFIG_INTERWORKING */
1432                 break;
1433         case 4: /* Bits 32-39 */
1434 #ifdef CONFIG_INTERWORKING
1435                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1436                         *pos |= 0x01; /* Bit 32 - QoS Map */
1437 #endif /* CONFIG_INTERWORKING */
1438                 break;
1439         case 5: /* Bits 40-47 */
1440 #ifdef CONFIG_HS20
1441                 if (wpa_s->conf->hs20)
1442                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1443 #endif /* CONFIG_HS20 */
1444 #ifdef CONFIG_MBO
1445                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1446 #endif /* CONFIG_MBO */
1447                 break;
1448         case 6: /* Bits 48-55 */
1449                 break;
1450         }
1451 }
1452
1453
1454 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1455 {
1456         u8 *pos = buf;
1457         u8 len = 6, i;
1458
1459         if (len < wpa_s->extended_capa_len)
1460                 len = wpa_s->extended_capa_len;
1461         if (buflen < (size_t) len + 2) {
1462                 wpa_printf(MSG_INFO,
1463                            "Not enough room for building extended capabilities element");
1464                 return -1;
1465         }
1466
1467         *pos++ = WLAN_EID_EXT_CAPAB;
1468         *pos++ = len;
1469         for (i = 0; i < len; i++, pos++) {
1470                 wpas_ext_capab_byte(wpa_s, pos, i);
1471
1472                 if (i < wpa_s->extended_capa_len) {
1473                         *pos &= ~wpa_s->extended_capa_mask[i];
1474                         *pos |= wpa_s->extended_capa[i];
1475                 }
1476         }
1477
1478         while (len > 0 && buf[1 + len] == 0) {
1479                 len--;
1480                 buf[1] = len;
1481         }
1482         if (len == 0)
1483                 return 0;
1484
1485         return 2 + len;
1486 }
1487
1488
1489 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1490                           struct wpa_bss *test_bss)
1491 {
1492         struct wpa_bss *bss;
1493
1494         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1495                 if (bss == test_bss)
1496                         return 1;
1497         }
1498
1499         return 0;
1500 }
1501
1502
1503 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1504                            struct wpa_ssid *test_ssid)
1505 {
1506         struct wpa_ssid *ssid;
1507
1508         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1509                 if (ssid == test_ssid)
1510                         return 1;
1511         }
1512
1513         return 0;
1514 }
1515
1516
1517 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1518                         struct wpa_ssid *test_ssid)
1519 {
1520         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1521                 return 0;
1522
1523         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1524 }
1525
1526
1527 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1528 {
1529         if (cwork == NULL)
1530                 return;
1531         os_free(cwork);
1532 }
1533
1534
1535 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1536 {
1537         struct wpa_connect_work *cwork;
1538         struct wpa_radio_work *work = wpa_s->connect_work;
1539
1540         if (!work)
1541                 return;
1542
1543         wpa_s->connect_work = NULL;
1544         cwork = work->ctx;
1545         work->ctx = NULL;
1546         wpas_connect_work_free(cwork);
1547         radio_work_done(work);
1548 }
1549
1550
1551 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1552 {
1553         struct os_reltime now;
1554         u8 addr[ETH_ALEN];
1555
1556         os_get_reltime(&now);
1557         if (wpa_s->last_mac_addr_style == style &&
1558             wpa_s->last_mac_addr_change.sec != 0 &&
1559             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1560                                 wpa_s->conf->rand_addr_lifetime)) {
1561                 wpa_msg(wpa_s, MSG_DEBUG,
1562                         "Previously selected random MAC address has not yet expired");
1563                 return 0;
1564         }
1565
1566         switch (style) {
1567         case 1:
1568                 if (random_mac_addr(addr) < 0)
1569                         return -1;
1570                 break;
1571         case 2:
1572                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1573                 if (random_mac_addr_keep_oui(addr) < 0)
1574                         return -1;
1575                 break;
1576         default:
1577                 return -1;
1578         }
1579
1580         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1581                 wpa_msg(wpa_s, MSG_INFO,
1582                         "Failed to set random MAC address");
1583                 return -1;
1584         }
1585
1586         os_get_reltime(&wpa_s->last_mac_addr_change);
1587         wpa_s->mac_addr_changed = 1;
1588         wpa_s->last_mac_addr_style = style;
1589
1590         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1591                 wpa_msg(wpa_s, MSG_INFO,
1592                         "Could not update MAC address information");
1593                 return -1;
1594         }
1595
1596         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1597                 MAC2STR(addr));
1598
1599         return 0;
1600 }
1601
1602
1603 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1604 {
1605         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1606             !wpa_s->conf->preassoc_mac_addr)
1607                 return 0;
1608
1609         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1610 }
1611
1612
1613 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1614
1615 /**
1616  * wpa_supplicant_associate - Request association
1617  * @wpa_s: Pointer to wpa_supplicant data
1618  * @bss: Scan results for the selected BSS, or %NULL if not available
1619  * @ssid: Configuration data for the selected network
1620  *
1621  * This function is used to request %wpa_supplicant to associate with a BSS.
1622  */
1623 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1624                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1625 {
1626         struct wpa_connect_work *cwork;
1627         int rand_style;
1628
1629         wpa_s->own_disconnect_req = 0;
1630
1631         /*
1632          * If we are starting a new connection, any previously pending EAPOL
1633          * RX cannot be valid anymore.
1634          */
1635         wpabuf_free(wpa_s->pending_eapol_rx);
1636         wpa_s->pending_eapol_rx = NULL;
1637
1638         if (ssid->mac_addr == -1)
1639                 rand_style = wpa_s->conf->mac_addr;
1640         else
1641                 rand_style = ssid->mac_addr;
1642
1643         wmm_ac_clear_saved_tspecs(wpa_s);
1644         wpa_s->reassoc_same_bss = 0;
1645
1646         if (wpa_s->last_ssid == ssid) {
1647                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1648                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1649                         wmm_ac_save_tspecs(wpa_s);
1650                         wpa_s->reassoc_same_bss = 1;
1651                 }
1652         } else if (rand_style > 0) {
1653                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1654                         return;
1655                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1656         } else if (wpa_s->mac_addr_changed) {
1657                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1658                         wpa_msg(wpa_s, MSG_INFO,
1659                                 "Could not restore permanent MAC address");
1660                         return;
1661                 }
1662                 wpa_s->mac_addr_changed = 0;
1663                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1664                         wpa_msg(wpa_s, MSG_INFO,
1665                                 "Could not update MAC address information");
1666                         return;
1667                 }
1668                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1669         }
1670         wpa_s->last_ssid = ssid;
1671
1672 #ifdef CONFIG_IBSS_RSN
1673         ibss_rsn_deinit(wpa_s->ibss_rsn);
1674         wpa_s->ibss_rsn = NULL;
1675 #endif /* CONFIG_IBSS_RSN */
1676
1677         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1678             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1679 #ifdef CONFIG_AP
1680                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1681                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1682                                 "mode");
1683                         return;
1684                 }
1685                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1686                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1687                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1688                                 wpas_p2p_ap_setup_failed(wpa_s);
1689                         return;
1690                 }
1691                 wpa_s->current_bss = bss;
1692 #else /* CONFIG_AP */
1693                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1694                         "the build");
1695 #endif /* CONFIG_AP */
1696                 return;
1697         }
1698
1699         if (ssid->mode == WPAS_MODE_MESH) {
1700 #ifdef CONFIG_MESH
1701                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1702                         wpa_msg(wpa_s, MSG_INFO,
1703                                 "Driver does not support mesh mode");
1704                         return;
1705                 }
1706                 if (bss)
1707                         ssid->frequency = bss->freq;
1708                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1709                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1710                         return;
1711                 }
1712                 wpa_s->current_bss = bss;
1713                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1714                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1715                         ssid->id);
1716 #else /* CONFIG_MESH */
1717                 wpa_msg(wpa_s, MSG_ERROR,
1718                         "mesh mode support not included in the build");
1719 #endif /* CONFIG_MESH */
1720                 return;
1721         }
1722
1723 #ifdef CONFIG_TDLS
1724         if (bss)
1725                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1726                                 bss->ie_len);
1727 #endif /* CONFIG_TDLS */
1728
1729         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1730             ssid->mode == IEEE80211_MODE_INFRA) {
1731                 sme_authenticate(wpa_s, bss, ssid);
1732                 return;
1733         }
1734
1735         if (wpa_s->connect_work) {
1736                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1737                 return;
1738         }
1739
1740         if (radio_work_pending(wpa_s, "connect")) {
1741                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1742                 return;
1743         }
1744
1745         wpas_abort_ongoing_scan(wpa_s);
1746
1747         cwork = os_zalloc(sizeof(*cwork));
1748         if (cwork == NULL)
1749                 return;
1750
1751         cwork->bss = bss;
1752         cwork->ssid = ssid;
1753
1754         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1755                            wpas_start_assoc_cb, cwork) < 0) {
1756                 os_free(cwork);
1757         }
1758 }
1759
1760
1761 static int bss_is_ibss(struct wpa_bss *bss)
1762 {
1763         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1764                 IEEE80211_CAP_IBSS;
1765 }
1766
1767
1768 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1769                             const struct wpa_ssid *ssid)
1770 {
1771         enum hostapd_hw_mode hw_mode;
1772         struct hostapd_hw_modes *mode = NULL;
1773         u8 channel;
1774         int i;
1775
1776 #ifdef CONFIG_HT_OVERRIDES
1777         if (ssid->disable_ht)
1778                 return 0;
1779 #endif /* CONFIG_HT_OVERRIDES */
1780
1781         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1782         if (hw_mode == NUM_HOSTAPD_MODES)
1783                 return 0;
1784         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1785                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1786                         mode = &wpa_s->hw.modes[i];
1787                         break;
1788                 }
1789         }
1790
1791         if (!mode)
1792                 return 0;
1793
1794         return mode->vht_capab != 0;
1795 }
1796
1797
1798 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1799                           const struct wpa_ssid *ssid,
1800                           struct hostapd_freq_params *freq)
1801 {
1802         enum hostapd_hw_mode hw_mode;
1803         struct hostapd_hw_modes *mode = NULL;
1804         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1805                            184, 192 };
1806         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1807         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1808         u8 channel;
1809         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1810         unsigned int j, k;
1811         struct hostapd_freq_params vht_freq;
1812         int chwidth, seg0, seg1;
1813         u32 vht_caps = 0;
1814
1815         freq->freq = ssid->frequency;
1816
1817         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1818                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1819
1820                 if (ssid->mode != WPAS_MODE_IBSS)
1821                         break;
1822
1823                 /* Don't adjust control freq in case of fixed_freq */
1824                 if (ssid->fixed_freq)
1825                         break;
1826
1827                 if (!bss_is_ibss(bss))
1828                         continue;
1829
1830                 if (ssid->ssid_len == bss->ssid_len &&
1831                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1832                         wpa_printf(MSG_DEBUG,
1833                                    "IBSS already found in scan results, adjust control freq: %d",
1834                                    bss->freq);
1835                         freq->freq = bss->freq;
1836                         obss_scan = 0;
1837                         break;
1838                 }
1839         }
1840
1841         /* For IBSS check HT_IBSS flag */
1842         if (ssid->mode == WPAS_MODE_IBSS &&
1843             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1844                 return;
1845
1846         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1847             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1848             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1849                 wpa_printf(MSG_DEBUG,
1850                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1851                 return;
1852         }
1853
1854         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1855         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1856                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1857                         mode = &wpa_s->hw.modes[i];
1858                         break;
1859                 }
1860         }
1861
1862         if (!mode)
1863                 return;
1864
1865         freq->ht_enabled = ht_supported(mode);
1866         if (!freq->ht_enabled)
1867                 return;
1868
1869         /* Setup higher BW only for 5 GHz */
1870         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1871                 return;
1872
1873         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1874                 pri_chan = &mode->channels[chan_idx];
1875                 if (pri_chan->chan == channel)
1876                         break;
1877                 pri_chan = NULL;
1878         }
1879         if (!pri_chan)
1880                 return;
1881
1882         /* Check primary channel flags */
1883         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1884                 return;
1885
1886         /* Check/setup HT40+/HT40- */
1887         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1888                 if (ht40plus[j] == channel) {
1889                         ht40 = 1;
1890                         break;
1891                 }
1892         }
1893
1894         /* Find secondary channel */
1895         for (i = 0; i < mode->num_channels; i++) {
1896                 sec_chan = &mode->channels[i];
1897                 if (sec_chan->chan == channel + ht40 * 4)
1898                         break;
1899                 sec_chan = NULL;
1900         }
1901         if (!sec_chan)
1902                 return;
1903
1904         /* Check secondary channel flags */
1905         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1906                 return;
1907
1908         freq->channel = pri_chan->chan;
1909
1910         switch (ht40) {
1911         case -1:
1912                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1913                         return;
1914                 freq->sec_channel_offset = -1;
1915                 break;
1916         case 1:
1917                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1918                         return;
1919                 freq->sec_channel_offset = 1;
1920                 break;
1921         default:
1922                 break;
1923         }
1924
1925         if (freq->sec_channel_offset && obss_scan) {
1926                 struct wpa_scan_results *scan_res;
1927
1928                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1929                 if (scan_res == NULL) {
1930                         /* Back to HT20 */
1931                         freq->sec_channel_offset = 0;
1932                         return;
1933                 }
1934
1935                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1936                                      sec_chan->chan);
1937                 switch (res) {
1938                 case 0:
1939                         /* Back to HT20 */
1940                         freq->sec_channel_offset = 0;
1941                         break;
1942                 case 1:
1943                         /* Configuration allowed */
1944                         break;
1945                 case 2:
1946                         /* Switch pri/sec channels */
1947                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1948                         freq->sec_channel_offset = -freq->sec_channel_offset;
1949                         freq->channel = sec_chan->chan;
1950                         break;
1951                 default:
1952                         freq->sec_channel_offset = 0;
1953                         break;
1954                 }
1955
1956                 wpa_scan_results_free(scan_res);
1957         }
1958
1959         wpa_printf(MSG_DEBUG,
1960                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1961                    freq->channel, freq->sec_channel_offset);
1962
1963         if (!drv_supports_vht(wpa_s, ssid))
1964                 return;
1965
1966         /* For IBSS check VHT_IBSS flag */
1967         if (ssid->mode == WPAS_MODE_IBSS &&
1968             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1969                 return;
1970
1971         vht_freq = *freq;
1972
1973         vht_freq.vht_enabled = vht_supported(mode);
1974         if (!vht_freq.vht_enabled)
1975                 return;
1976
1977         /* setup center_freq1, bandwidth */
1978         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1979                 if (freq->channel >= vht80[j] &&
1980                     freq->channel < vht80[j] + 16)
1981                         break;
1982         }
1983
1984         if (j == ARRAY_SIZE(vht80))
1985                 return;
1986
1987         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1988                 struct hostapd_channel_data *chan;
1989
1990                 chan = hw_get_channel_chan(mode, i, NULL);
1991                 if (!chan)
1992                         return;
1993
1994                 /* Back to HT configuration if channel not usable */
1995                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1996                         return;
1997         }
1998
1999         chwidth = VHT_CHANWIDTH_80MHZ;
2000         seg0 = vht80[j] + 6;
2001         seg1 = 0;
2002
2003         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2004                 /* setup center_freq2, bandwidth */
2005                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2006                         /* Only accept 80 MHz segments separated by a gap */
2007                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2008                                 continue;
2009                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2010                                 struct hostapd_channel_data *chan;
2011
2012                                 chan = hw_get_channel_chan(mode, i, NULL);
2013                                 if (!chan)
2014                                         continue;
2015
2016                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2017                                                   HOSTAPD_CHAN_NO_IR |
2018                                                   HOSTAPD_CHAN_RADAR))
2019                                         continue;
2020
2021                                 /* Found a suitable second segment for 80+80 */
2022                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2023                                 vht_caps |=
2024                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2025                                 seg1 = vht80[k] + 6;
2026                         }
2027
2028                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2029                                 break;
2030                 }
2031         }
2032
2033         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2034                                     freq->channel, freq->ht_enabled,
2035                                     vht_freq.vht_enabled,
2036                                     freq->sec_channel_offset,
2037                                     chwidth, seg0, seg1, vht_caps) != 0)
2038                 return;
2039
2040         *freq = vht_freq;
2041
2042         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2043                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2044 }
2045
2046
2047 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2048 {
2049         struct wpa_connect_work *cwork = work->ctx;
2050         struct wpa_bss *bss = cwork->bss;
2051         struct wpa_ssid *ssid = cwork->ssid;
2052         struct wpa_supplicant *wpa_s = work->wpa_s;
2053         u8 wpa_ie[200];
2054         size_t wpa_ie_len;
2055         int use_crypt, ret, i, bssid_changed;
2056         int algs = WPA_AUTH_ALG_OPEN;
2057         unsigned int cipher_pairwise, cipher_group;
2058         struct wpa_driver_associate_params params;
2059         int wep_keys_set = 0;
2060         int assoc_failed = 0;
2061         struct wpa_ssid *old_ssid;
2062 #ifdef CONFIG_HT_OVERRIDES
2063         struct ieee80211_ht_capabilities htcaps;
2064         struct ieee80211_ht_capabilities htcaps_mask;
2065 #endif /* CONFIG_HT_OVERRIDES */
2066 #ifdef CONFIG_VHT_OVERRIDES
2067        struct ieee80211_vht_capabilities vhtcaps;
2068        struct ieee80211_vht_capabilities vhtcaps_mask;
2069 #endif /* CONFIG_VHT_OVERRIDES */
2070 #ifdef CONFIG_MBO
2071         const u8 *mbo = NULL;
2072 #endif /* CONFIG_MBO */
2073
2074         if (deinit) {
2075                 if (work->started) {
2076                         wpa_s->connect_work = NULL;
2077
2078                         /* cancel possible auth. timeout */
2079                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2080                                              NULL);
2081                 }
2082                 wpas_connect_work_free(cwork);
2083                 return;
2084         }
2085
2086         wpa_s->connect_work = work;
2087
2088         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2089             wpas_network_disabled(wpa_s, ssid)) {
2090                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2091                 wpas_connect_work_done(wpa_s);
2092                 return;
2093         }
2094
2095         os_memset(&params, 0, sizeof(params));
2096         wpa_s->reassociate = 0;
2097         wpa_s->eap_expected_failure = 0;
2098         if (bss &&
2099             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2100 #ifdef CONFIG_IEEE80211R
2101                 const u8 *ie, *md = NULL;
2102 #endif /* CONFIG_IEEE80211R */
2103                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2104                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2105                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2106                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2107                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2108                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2109                 if (bssid_changed)
2110                         wpas_notify_bssid_changed(wpa_s);
2111 #ifdef CONFIG_IEEE80211R
2112                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2113                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2114                         md = ie + 2;
2115                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2116                 if (md) {
2117                         /* Prepare for the next transition */
2118                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2119                 }
2120 #endif /* CONFIG_IEEE80211R */
2121 #ifdef CONFIG_WPS
2122         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2123                    wpa_s->conf->ap_scan == 2 &&
2124                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2125                 /* Use ap_scan==1 style network selection to find the network
2126                  */
2127                 wpas_connect_work_done(wpa_s);
2128                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2129                 wpa_s->reassociate = 1;
2130                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2131                 return;
2132 #endif /* CONFIG_WPS */
2133         } else {
2134                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2135                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2136                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2137         }
2138         if (!wpa_s->pno)
2139                 wpa_supplicant_cancel_sched_scan(wpa_s);
2140
2141         wpa_supplicant_cancel_scan(wpa_s);
2142
2143         /* Starting new association, so clear the possibly used WPA IE from the
2144          * previous association. */
2145         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2146
2147 #ifdef IEEE8021X_EAPOL
2148         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2149                 if (ssid->leap) {
2150                         if (ssid->non_leap == 0)
2151                                 algs = WPA_AUTH_ALG_LEAP;
2152                         else
2153                                 algs |= WPA_AUTH_ALG_LEAP;
2154                 }
2155         }
2156 #endif /* IEEE8021X_EAPOL */
2157         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2158         if (ssid->auth_alg) {
2159                 algs = ssid->auth_alg;
2160                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2161                         "0x%x", algs);
2162         }
2163
2164         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2165                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2166             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2167                 int try_opportunistic;
2168                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2169                                      wpa_s->conf->okc :
2170                                      ssid->proactive_key_caching) &&
2171                         (ssid->proto & WPA_PROTO_RSN);
2172                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2173                                             ssid, try_opportunistic) == 0)
2174                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2175                 wpa_ie_len = sizeof(wpa_ie);
2176                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2177                                               wpa_ie, &wpa_ie_len)) {
2178                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2179                                 "key management and encryption suites");
2180                         wpas_connect_work_done(wpa_s);
2181                         return;
2182                 }
2183         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2184                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2185                 /*
2186                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2187                  * use non-WPA since the scan results did not indicate that the
2188                  * AP is using WPA or WPA2.
2189                  */
2190                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2191                 wpa_ie_len = 0;
2192                 wpa_s->wpa_proto = 0;
2193         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2194                 wpa_ie_len = sizeof(wpa_ie);
2195                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2196                                               wpa_ie, &wpa_ie_len)) {
2197                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2198                                 "key management and encryption suites (no "
2199                                 "scan results)");
2200                         wpas_connect_work_done(wpa_s);
2201                         return;
2202                 }
2203 #ifdef CONFIG_WPS
2204         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2205                 struct wpabuf *wps_ie;
2206                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2207                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2208                         wpa_ie_len = wpabuf_len(wps_ie);
2209                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2210                 } else
2211                         wpa_ie_len = 0;
2212                 wpabuf_free(wps_ie);
2213                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2214                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2215                         params.wps = WPS_MODE_PRIVACY;
2216                 else
2217                         params.wps = WPS_MODE_OPEN;
2218                 wpa_s->wpa_proto = 0;
2219 #endif /* CONFIG_WPS */
2220         } else {
2221                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2222                 wpa_ie_len = 0;
2223                 wpa_s->wpa_proto = 0;
2224         }
2225
2226 #ifdef CONFIG_P2P
2227         if (wpa_s->global->p2p) {
2228                 u8 *pos;
2229                 size_t len;
2230                 int res;
2231                 pos = wpa_ie + wpa_ie_len;
2232                 len = sizeof(wpa_ie) - wpa_ie_len;
2233                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2234                                             ssid->p2p_group);
2235                 if (res >= 0)
2236                         wpa_ie_len += res;
2237         }
2238
2239         wpa_s->cross_connect_disallowed = 0;
2240         if (bss) {
2241                 struct wpabuf *p2p;
2242                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2243                 if (p2p) {
2244                         wpa_s->cross_connect_disallowed =
2245                                 p2p_get_cross_connect_disallowed(p2p);
2246                         wpabuf_free(p2p);
2247                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2248                                 "connection",
2249                                 wpa_s->cross_connect_disallowed ?
2250                                 "disallows" : "allows");
2251                 }
2252         }
2253
2254         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2255 #endif /* CONFIG_P2P */
2256
2257 #ifdef CONFIG_MBO
2258         if (bss) {
2259                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2260                 if (mbo) {
2261                         int len;
2262
2263                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2264                                                         wpa_ie + wpa_ie_len,
2265                                                         sizeof(wpa_ie) -
2266                                                         wpa_ie_len);
2267                         if (len > 0)
2268                                 wpa_ie_len += len;
2269                 }
2270         }
2271 #endif /* CONFIG_MBO */
2272
2273         /*
2274          * Workaround: Add Extended Capabilities element only if the AP
2275          * included this element in Beacon/Probe Response frames. Some older
2276          * APs seem to have interoperability issues if this element is
2277          * included, so while the standard may require us to include the
2278          * element in all cases, it is justifiable to skip it to avoid
2279          * interoperability issues.
2280          */
2281         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2282                 u8 ext_capab[18];
2283                 int ext_capab_len;
2284                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2285                                                      sizeof(ext_capab));
2286                 if (ext_capab_len > 0) {
2287                         u8 *pos = wpa_ie;
2288                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2289                                 pos += 2 + pos[1];
2290                         os_memmove(pos + ext_capab_len, pos,
2291                                    wpa_ie_len - (pos - wpa_ie));
2292                         wpa_ie_len += ext_capab_len;
2293                         os_memcpy(pos, ext_capab, ext_capab_len);
2294                 }
2295         }
2296
2297 #ifdef CONFIG_HS20
2298         if (is_hs20_network(wpa_s, ssid, bss)) {
2299                 struct wpabuf *hs20;
2300
2301                 hs20 = wpabuf_alloc(20);
2302                 if (hs20) {
2303                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2304                         size_t len;
2305
2306                         wpas_hs20_add_indication(hs20, pps_mo_id);
2307                         len = sizeof(wpa_ie) - wpa_ie_len;
2308                         if (wpabuf_len(hs20) <= len) {
2309                                 os_memcpy(wpa_ie + wpa_ie_len,
2310                                           wpabuf_head(hs20), wpabuf_len(hs20));
2311                                 wpa_ie_len += wpabuf_len(hs20);
2312                         }
2313                         wpabuf_free(hs20);
2314                 }
2315         }
2316 #endif /* CONFIG_HS20 */
2317
2318         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2319                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2320                 size_t len;
2321
2322                 len = sizeof(wpa_ie) - wpa_ie_len;
2323                 if (wpabuf_len(buf) <= len) {
2324                         os_memcpy(wpa_ie + wpa_ie_len,
2325                                   wpabuf_head(buf), wpabuf_len(buf));
2326                         wpa_ie_len += wpabuf_len(buf);
2327                 }
2328         }
2329
2330 #ifdef CONFIG_FST
2331         if (wpa_s->fst_ies) {
2332                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2333
2334                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2335                         os_memcpy(wpa_ie + wpa_ie_len,
2336                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2337                         wpa_ie_len += fst_ies_len;
2338                 }
2339         }
2340 #endif /* CONFIG_FST */
2341
2342 #ifdef CONFIG_MBO
2343         if (mbo) {
2344                 int len;
2345
2346                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2347                                   sizeof(wpa_ie) - wpa_ie_len);
2348                 if (len >= 0)
2349                         wpa_ie_len += len;
2350         }
2351 #endif /* CONFIG_MBO */
2352
2353         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2354         use_crypt = 1;
2355         cipher_pairwise = wpa_s->pairwise_cipher;
2356         cipher_group = wpa_s->group_cipher;
2357         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2358             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2359                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2360                         use_crypt = 0;
2361                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2362                         use_crypt = 1;
2363                         wep_keys_set = 1;
2364                 }
2365         }
2366         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2367                 use_crypt = 0;
2368
2369 #ifdef IEEE8021X_EAPOL
2370         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2371                 if ((ssid->eapol_flags &
2372                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2373                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2374                     !wep_keys_set) {
2375                         use_crypt = 0;
2376                 } else {
2377                         /* Assume that dynamic WEP-104 keys will be used and
2378                          * set cipher suites in order for drivers to expect
2379                          * encryption. */
2380                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2381                 }
2382         }
2383 #endif /* IEEE8021X_EAPOL */
2384
2385         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2386                 /* Set the key before (and later after) association */
2387                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2388         }
2389
2390         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2391         if (bss) {
2392                 params.ssid = bss->ssid;
2393                 params.ssid_len = bss->ssid_len;
2394                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2395                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2396                                    MACSTR " freq=%u MHz based on scan results "
2397                                    "(bssid_set=%d)",
2398                                    MAC2STR(bss->bssid), bss->freq,
2399                                    ssid->bssid_set);
2400                         params.bssid = bss->bssid;
2401                         params.freq.freq = bss->freq;
2402                 }
2403                 params.bssid_hint = bss->bssid;
2404                 params.freq_hint = bss->freq;
2405                 params.pbss = bss_is_pbss(bss);
2406         } else {
2407                 params.ssid = ssid->ssid;
2408                 params.ssid_len = ssid->ssid_len;
2409                 params.pbss = ssid->pbss;
2410         }
2411
2412         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2413             wpa_s->conf->ap_scan == 2) {
2414                 params.bssid = ssid->bssid;
2415                 params.fixed_bssid = 1;
2416         }
2417
2418         /* Initial frequency for IBSS/mesh */
2419         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2420             ssid->frequency > 0 && params.freq.freq == 0)
2421                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2422
2423         if (ssid->mode == WPAS_MODE_IBSS) {
2424                 params.fixed_freq = ssid->fixed_freq;
2425                 if (ssid->beacon_int)
2426                         params.beacon_int = ssid->beacon_int;
2427                 else
2428                         params.beacon_int = wpa_s->conf->beacon_int;
2429         }
2430
2431         params.wpa_ie = wpa_ie;
2432         params.wpa_ie_len = wpa_ie_len;
2433         params.pairwise_suite = cipher_pairwise;
2434         params.group_suite = cipher_group;
2435         params.key_mgmt_suite = wpa_s->key_mgmt;
2436         params.wpa_proto = wpa_s->wpa_proto;
2437         params.auth_alg = algs;
2438         params.mode = ssid->mode;
2439         params.bg_scan_period = ssid->bg_scan_period;
2440         for (i = 0; i < NUM_WEP_KEYS; i++) {
2441                 if (ssid->wep_key_len[i])
2442                         params.wep_key[i] = ssid->wep_key[i];
2443                 params.wep_key_len[i] = ssid->wep_key_len[i];
2444         }
2445         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2446
2447         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2448             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2449              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2450                 params.passphrase = ssid->passphrase;
2451                 if (ssid->psk_set)
2452                         params.psk = ssid->psk;
2453         }
2454
2455         if (wpa_s->conf->key_mgmt_offload) {
2456                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2457                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2458                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2459                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2460                         params.req_key_mgmt_offload =
2461                                 ssid->proactive_key_caching < 0 ?
2462                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2463                 else
2464                         params.req_key_mgmt_offload = 1;
2465
2466                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2467                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2468                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2469                     ssid->psk_set)
2470                         params.psk = ssid->psk;
2471         }
2472
2473         params.drop_unencrypted = use_crypt;
2474
2475 #ifdef CONFIG_IEEE80211W
2476         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2477         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2478                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2479                 struct wpa_ie_data ie;
2480                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2481                     ie.capabilities &
2482                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2483                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2484                                 "MFP: require MFP");
2485                         params.mgmt_frame_protection =
2486                                 MGMT_FRAME_PROTECTION_REQUIRED;
2487                 }
2488         }
2489 #endif /* CONFIG_IEEE80211W */
2490
2491         params.p2p = ssid->p2p_group;
2492
2493         if (wpa_s->p2pdev->set_sta_uapsd)
2494                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2495         else
2496                 params.uapsd = -1;
2497
2498 #ifdef CONFIG_HT_OVERRIDES
2499         os_memset(&htcaps, 0, sizeof(htcaps));
2500         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2501         params.htcaps = (u8 *) &htcaps;
2502         params.htcaps_mask = (u8 *) &htcaps_mask;
2503         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2504 #endif /* CONFIG_HT_OVERRIDES */
2505 #ifdef CONFIG_VHT_OVERRIDES
2506         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2507         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2508         params.vhtcaps = &vhtcaps;
2509         params.vhtcaps_mask = &vhtcaps_mask;
2510         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2511 #endif /* CONFIG_VHT_OVERRIDES */
2512
2513 #ifdef CONFIG_P2P
2514         /*
2515          * If multi-channel concurrency is not supported, check for any
2516          * frequency conflict. In case of any frequency conflict, remove the
2517          * least prioritized connection.
2518          */
2519         if (wpa_s->num_multichan_concurrent < 2) {
2520                 int freq, num;
2521                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2522                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2523                         wpa_printf(MSG_DEBUG,
2524                                    "Assoc conflicting freq found (%d != %d)",
2525                                    freq, params.freq.freq);
2526                         if (wpas_p2p_handle_frequency_conflicts(
2527                                     wpa_s, params.freq.freq, ssid) < 0) {
2528                                 wpas_connect_work_done(wpa_s);
2529                                 return;
2530                         }
2531                 }
2532         }
2533 #endif /* CONFIG_P2P */
2534
2535         ret = wpa_drv_associate(wpa_s, &params);
2536         if (ret < 0) {
2537                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2538                         "failed");
2539                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2540                         /*
2541                          * The driver is known to mean what is saying, so we
2542                          * can stop right here; the association will not
2543                          * succeed.
2544                          */
2545                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2546                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2547                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2548                         return;
2549                 }
2550                 /* try to continue anyway; new association will be tried again
2551                  * after timeout */
2552                 assoc_failed = 1;
2553         }
2554
2555         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2556                 /* Set the key after the association just in case association
2557                  * cleared the previously configured key. */
2558                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2559                 /* No need to timeout authentication since there is no key
2560                  * management. */
2561                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2562                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2563 #ifdef CONFIG_IBSS_RSN
2564         } else if (ssid->mode == WPAS_MODE_IBSS &&
2565                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2566                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2567                 /*
2568                  * RSN IBSS authentication is per-STA and we can disable the
2569                  * per-BSSID authentication.
2570                  */
2571                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2572 #endif /* CONFIG_IBSS_RSN */
2573         } else {
2574                 /* Timeout for IEEE 802.11 authentication and association */
2575                 int timeout = 60;
2576
2577                 if (assoc_failed) {
2578                         /* give IBSS a bit more time */
2579                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2580                 } else if (wpa_s->conf->ap_scan == 1) {
2581                         /* give IBSS a bit more time */
2582                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2583                 }
2584                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2585         }
2586
2587         if (wep_keys_set &&
2588             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2589                 /* Set static WEP keys again */
2590                 wpa_set_wep_keys(wpa_s, ssid);
2591         }
2592
2593         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2594                 /*
2595                  * Do not allow EAP session resumption between different
2596                  * network configurations.
2597                  */
2598                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2599         }
2600         old_ssid = wpa_s->current_ssid;
2601         wpa_s->current_ssid = ssid;
2602         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2603                 wpa_s->current_bss = bss;
2604         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2605         wpa_supplicant_initiate_eapol(wpa_s);
2606         if (old_ssid != wpa_s->current_ssid)
2607                 wpas_notify_network_changed(wpa_s);
2608 }
2609
2610
2611 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2612                                             const u8 *addr)
2613 {
2614         struct wpa_ssid *old_ssid;
2615
2616         wpas_connect_work_done(wpa_s);
2617         wpa_clear_keys(wpa_s, addr);
2618         old_ssid = wpa_s->current_ssid;
2619         wpa_supplicant_mark_disassoc(wpa_s);
2620         wpa_sm_set_config(wpa_s->wpa, NULL);
2621         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2622         if (old_ssid != wpa_s->current_ssid)
2623                 wpas_notify_network_changed(wpa_s);
2624         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2625 }
2626
2627
2628 /**
2629  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2630  * @wpa_s: Pointer to wpa_supplicant data
2631  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2632  *
2633  * This function is used to request %wpa_supplicant to deauthenticate from the
2634  * current AP.
2635  */
2636 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2637                                    int reason_code)
2638 {
2639         u8 *addr = NULL;
2640         union wpa_event_data event;
2641         int zero_addr = 0;
2642
2643         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2644                 " pending_bssid=" MACSTR " reason=%d state=%s",
2645                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2646                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2647
2648         if (!is_zero_ether_addr(wpa_s->bssid))
2649                 addr = wpa_s->bssid;
2650         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2651                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2652                   wpa_s->wpa_state == WPA_ASSOCIATING))
2653                 addr = wpa_s->pending_bssid;
2654         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2655                 /*
2656                  * When using driver-based BSS selection, we may not know the
2657                  * BSSID with which we are currently trying to associate. We
2658                  * need to notify the driver of this disconnection even in such
2659                  * a case, so use the all zeros address here.
2660                  */
2661                 addr = wpa_s->bssid;
2662                 zero_addr = 1;
2663         }
2664
2665 #ifdef CONFIG_TDLS
2666         wpa_tdls_teardown_peers(wpa_s->wpa);
2667 #endif /* CONFIG_TDLS */
2668
2669 #ifdef CONFIG_MESH
2670         if (wpa_s->ifmsh) {
2671                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2672                         wpa_s->ifname);
2673                 wpa_supplicant_leave_mesh(wpa_s);
2674         }
2675 #endif /* CONFIG_MESH */
2676
2677         if (addr) {
2678                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2679                 os_memset(&event, 0, sizeof(event));
2680                 event.deauth_info.reason_code = (u16) reason_code;
2681                 event.deauth_info.locally_generated = 1;
2682                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2683                 if (zero_addr)
2684                         addr = NULL;
2685         }
2686
2687         wpa_supplicant_clear_connection(wpa_s, addr);
2688 }
2689
2690 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2691                                               struct wpa_ssid *ssid)
2692 {
2693         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2694                 return;
2695
2696         ssid->disabled = 0;
2697         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2698         wpas_notify_network_enabled_changed(wpa_s, ssid);
2699
2700         /*
2701          * Try to reassociate since there is no current configuration and a new
2702          * network was made available.
2703          */
2704         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2705                 wpa_s->reassociate = 1;
2706 }
2707
2708
2709 /**
2710  * wpa_supplicant_enable_network - Mark a configured network as enabled
2711  * @wpa_s: wpa_supplicant structure for a network interface
2712  * @ssid: wpa_ssid structure for a configured network or %NULL
2713  *
2714  * Enables the specified network or all networks if no network specified.
2715  */
2716 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2717                                    struct wpa_ssid *ssid)
2718 {
2719         if (ssid == NULL) {
2720                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2721                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2722         } else
2723                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2724
2725         if (wpa_s->reassociate && !wpa_s->disconnected &&
2726             (!wpa_s->current_ssid ||
2727              wpa_s->wpa_state == WPA_DISCONNECTED ||
2728              wpa_s->wpa_state == WPA_SCANNING)) {
2729                 if (wpa_s->sched_scanning) {
2730                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2731                                    "new network to scan filters");
2732                         wpa_supplicant_cancel_sched_scan(wpa_s);
2733                 }
2734
2735                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2736                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2737                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2738                 }
2739         }
2740 }
2741
2742
2743 /**
2744  * wpa_supplicant_disable_network - Mark a configured network as disabled
2745  * @wpa_s: wpa_supplicant structure for a network interface
2746  * @ssid: wpa_ssid structure for a configured network or %NULL
2747  *
2748  * Disables the specified network or all networks if no network specified.
2749  */
2750 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2751                                     struct wpa_ssid *ssid)
2752 {
2753         struct wpa_ssid *other_ssid;
2754         int was_disabled;
2755
2756         if (ssid == NULL) {
2757                 if (wpa_s->sched_scanning)
2758                         wpa_supplicant_cancel_sched_scan(wpa_s);
2759
2760                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2761                      other_ssid = other_ssid->next) {
2762                         was_disabled = other_ssid->disabled;
2763                         if (was_disabled == 2)
2764                                 continue; /* do not change persistent P2P group
2765                                            * data */
2766
2767                         other_ssid->disabled = 1;
2768
2769                         if (was_disabled != other_ssid->disabled)
2770                                 wpas_notify_network_enabled_changed(
2771                                         wpa_s, other_ssid);
2772                 }
2773                 if (wpa_s->current_ssid)
2774                         wpa_supplicant_deauthenticate(
2775                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2776         } else if (ssid->disabled != 2) {
2777                 if (ssid == wpa_s->current_ssid)
2778                         wpa_supplicant_deauthenticate(
2779                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2780
2781                 was_disabled = ssid->disabled;
2782
2783                 ssid->disabled = 1;
2784
2785                 if (was_disabled != ssid->disabled) {
2786                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2787                         if (wpa_s->sched_scanning) {
2788                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2789                                            "to remove network from filters");
2790                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2791                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2792                         }
2793                 }
2794         }
2795 }
2796
2797
2798 /**
2799  * wpa_supplicant_select_network - Attempt association with a network
2800  * @wpa_s: wpa_supplicant structure for a network interface
2801  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2802  */
2803 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2804                                    struct wpa_ssid *ssid)
2805 {
2806
2807         struct wpa_ssid *other_ssid;
2808         int disconnected = 0;
2809
2810         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2811                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2812                         wpa_s->own_disconnect_req = 1;
2813                 wpa_supplicant_deauthenticate(
2814                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2815                 disconnected = 1;
2816         }
2817
2818         if (ssid)
2819                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2820
2821         /*
2822          * Mark all other networks disabled or mark all networks enabled if no
2823          * network specified.
2824          */
2825         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2826              other_ssid = other_ssid->next) {
2827                 int was_disabled = other_ssid->disabled;
2828                 if (was_disabled == 2)
2829                         continue; /* do not change persistent P2P group data */
2830
2831                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2832                 if (was_disabled && !other_ssid->disabled)
2833                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2834
2835                 if (was_disabled != other_ssid->disabled)
2836                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2837         }
2838
2839         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2840             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2841                 /* We are already associated with the selected network */
2842                 wpa_printf(MSG_DEBUG, "Already associated with the "
2843                            "selected network - do nothing");
2844                 return;
2845         }
2846
2847         if (ssid) {
2848                 wpa_s->current_ssid = ssid;
2849                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2850                 wpa_s->connect_without_scan =
2851                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2852
2853                 /*
2854                  * Don't optimize next scan freqs since a new ESS has been
2855                  * selected.
2856                  */
2857                 os_free(wpa_s->next_scan_freqs);
2858                 wpa_s->next_scan_freqs = NULL;
2859         } else {
2860                 wpa_s->connect_without_scan = NULL;
2861         }
2862
2863         wpa_s->disconnected = 0;
2864         wpa_s->reassociate = 1;
2865
2866         if (wpa_s->connect_without_scan ||
2867             wpa_supplicant_fast_associate(wpa_s) != 1) {
2868                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2869                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2870         }
2871
2872         if (ssid)
2873                 wpas_notify_network_selected(wpa_s, ssid);
2874 }
2875
2876
2877 /**
2878  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2879  * @wpa_s: wpa_supplicant structure for a network interface
2880  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2881  * @pkcs11_module_path: PKCS #11 module path or NULL
2882  * Returns: 0 on success; -1 on failure
2883  *
2884  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2885  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2886  * module path fails the paths will be reset to the default value (NULL).
2887  */
2888 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2889                                            const char *pkcs11_engine_path,
2890                                            const char *pkcs11_module_path)
2891 {
2892         char *pkcs11_engine_path_copy = NULL;
2893         char *pkcs11_module_path_copy = NULL;
2894
2895         if (pkcs11_engine_path != NULL) {
2896                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2897                 if (pkcs11_engine_path_copy == NULL)
2898                         return -1;
2899         }
2900         if (pkcs11_module_path != NULL) {
2901                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2902                 if (pkcs11_module_path_copy == NULL) {
2903                         os_free(pkcs11_engine_path_copy);
2904                         return -1;
2905                 }
2906         }
2907
2908         os_free(wpa_s->conf->pkcs11_engine_path);
2909         os_free(wpa_s->conf->pkcs11_module_path);
2910         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2911         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2912
2913         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2914         eapol_sm_deinit(wpa_s->eapol);
2915         wpa_s->eapol = NULL;
2916         if (wpa_supplicant_init_eapol(wpa_s)) {
2917                 /* Error -> Reset paths to the default value (NULL) once. */
2918                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2919                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2920                                                                NULL);
2921
2922                 return -1;
2923         }
2924         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2925
2926         return 0;
2927 }
2928
2929
2930 /**
2931  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2932  * @wpa_s: wpa_supplicant structure for a network interface
2933  * @ap_scan: AP scan mode
2934  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2935  *
2936  */
2937 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2938 {
2939
2940         int old_ap_scan;
2941
2942         if (ap_scan < 0 || ap_scan > 2)
2943                 return -1;
2944
2945         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2946                 wpa_printf(MSG_INFO,
2947                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2948         }
2949
2950 #ifdef ANDROID
2951         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2952             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2953             wpa_s->wpa_state < WPA_COMPLETED) {
2954                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2955                            "associating", wpa_s->conf->ap_scan, ap_scan);
2956                 return 0;
2957         }
2958 #endif /* ANDROID */
2959
2960         old_ap_scan = wpa_s->conf->ap_scan;
2961         wpa_s->conf->ap_scan = ap_scan;
2962
2963         if (old_ap_scan != wpa_s->conf->ap_scan)
2964                 wpas_notify_ap_scan_changed(wpa_s);
2965
2966         return 0;
2967 }
2968
2969
2970 /**
2971  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2972  * @wpa_s: wpa_supplicant structure for a network interface
2973  * @expire_age: Expiration age in seconds
2974  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2975  *
2976  */
2977 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2978                                           unsigned int bss_expire_age)
2979 {
2980         if (bss_expire_age < 10) {
2981                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2982                         bss_expire_age);
2983                 return -1;
2984         }
2985         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2986                 bss_expire_age);
2987         wpa_s->conf->bss_expiration_age = bss_expire_age;
2988
2989         return 0;
2990 }
2991
2992
2993 /**
2994  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2995  * @wpa_s: wpa_supplicant structure for a network interface
2996  * @expire_count: number of scans after which an unseen BSS is reclaimed
2997  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2998  *
2999  */
3000 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3001                                             unsigned int bss_expire_count)
3002 {
3003         if (bss_expire_count < 1) {
3004                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3005                         bss_expire_count);
3006                 return -1;
3007         }
3008         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3009                 bss_expire_count);
3010         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3011
3012         return 0;
3013 }
3014
3015
3016 /**
3017  * wpa_supplicant_set_scan_interval - Set scan interval
3018  * @wpa_s: wpa_supplicant structure for a network interface
3019  * @scan_interval: scan interval in seconds
3020  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3021  *
3022  */
3023 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3024                                      int scan_interval)
3025 {
3026         if (scan_interval < 0) {
3027                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3028                         scan_interval);
3029                 return -1;
3030         }
3031         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3032                 scan_interval);
3033         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3034
3035         return 0;
3036 }
3037
3038
3039 /**
3040  * wpa_supplicant_set_debug_params - Set global debug params
3041  * @global: wpa_global structure
3042  * @debug_level: debug level
3043  * @debug_timestamp: determines if show timestamp in debug data
3044  * @debug_show_keys: determines if show keys in debug data
3045  * Returns: 0 if succeed or -1 if debug_level has wrong value
3046  */
3047 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3048                                     int debug_timestamp, int debug_show_keys)
3049 {
3050
3051         int old_level, old_timestamp, old_show_keys;
3052
3053         /* check for allowed debuglevels */
3054         if (debug_level != MSG_EXCESSIVE &&
3055             debug_level != MSG_MSGDUMP &&
3056             debug_level != MSG_DEBUG &&
3057             debug_level != MSG_INFO &&
3058             debug_level != MSG_WARNING &&
3059             debug_level != MSG_ERROR)
3060                 return -1;
3061
3062         old_level = wpa_debug_level;
3063         old_timestamp = wpa_debug_timestamp;
3064         old_show_keys = wpa_debug_show_keys;
3065
3066         wpa_debug_level = debug_level;
3067         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3068         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3069
3070         if (wpa_debug_level != old_level)
3071                 wpas_notify_debug_level_changed(global);
3072         if (wpa_debug_timestamp != old_timestamp)
3073                 wpas_notify_debug_timestamp_changed(global);
3074         if (wpa_debug_show_keys != old_show_keys)
3075                 wpas_notify_debug_show_keys_changed(global);
3076
3077         return 0;
3078 }
3079
3080
3081 /**
3082  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3083  * @wpa_s: Pointer to wpa_supplicant data
3084  * Returns: A pointer to the current network structure or %NULL on failure
3085  */
3086 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3087 {
3088         struct wpa_ssid *entry;
3089         u8 ssid[SSID_MAX_LEN];
3090         int res;
3091         size_t ssid_len;
3092         u8 bssid[ETH_ALEN];
3093         int wired;
3094
3095         res = wpa_drv_get_ssid(wpa_s, ssid);
3096         if (res < 0) {
3097                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3098                         "driver");
3099                 return NULL;
3100         }
3101         ssid_len = res;
3102
3103         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3104                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3105                         "driver");
3106                 return NULL;
3107         }
3108
3109         wired = wpa_s->conf->ap_scan == 0 &&
3110                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3111
3112         entry = wpa_s->conf->ssid;
3113         while (entry) {
3114                 if (!wpas_network_disabled(wpa_s, entry) &&
3115                     ((ssid_len == entry->ssid_len &&
3116                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3117                     (!entry->bssid_set ||
3118                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3119                         return entry;
3120 #ifdef CONFIG_WPS
3121                 if (!wpas_network_disabled(wpa_s, entry) &&
3122                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3123                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3124                     (!entry->bssid_set ||
3125                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3126                         return entry;
3127 #endif /* CONFIG_WPS */
3128
3129                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3130                     entry->ssid_len == 0 &&
3131                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3132                         return entry;
3133
3134                 entry = entry->next;
3135         }
3136
3137         return NULL;
3138 }
3139
3140
3141 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3142 {
3143         struct wpa_global *global = wpa_s->global;
3144
3145         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3146                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3147                 if (global->drv_priv[i] == NULL) {
3148                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3149                                    "'%s'", wpa_drivers[i]->name);
3150                         return -1;
3151                 }
3152         }
3153
3154         wpa_s->driver = wpa_drivers[i];
3155         wpa_s->global_drv_priv = global->drv_priv[i];
3156
3157         return 0;
3158 }
3159
3160
3161 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3162                                      const char *name)
3163 {
3164         int i;
3165         size_t len;
3166         const char *pos, *driver = name;
3167
3168         if (wpa_s == NULL)
3169                 return -1;
3170
3171         if (wpa_drivers[0] == NULL) {
3172                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3173                         "wpa_supplicant");
3174                 return -1;
3175         }
3176
3177         if (name == NULL) {
3178                 /* default to first driver in the list */
3179                 return select_driver(wpa_s, 0);
3180         }
3181
3182         do {
3183                 pos = os_strchr(driver, ',');
3184                 if (pos)
3185                         len = pos - driver;
3186                 else
3187                         len = os_strlen(driver);
3188
3189                 for (i = 0; wpa_drivers[i]; i++) {
3190                         if (os_strlen(wpa_drivers[i]->name) == len &&
3191                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3192                             0) {
3193                                 /* First driver that succeeds wins */
3194                                 if (select_driver(wpa_s, i) == 0)
3195                                         return 0;
3196                         }
3197                 }
3198
3199                 driver = pos + 1;
3200         } while (pos);
3201
3202         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3203         return -1;
3204 }
3205
3206
3207 /**
3208  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3209  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3210  *      with struct wpa_driver_ops::init()
3211  * @src_addr: Source address of the EAPOL frame
3212  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3213  * @len: Length of the EAPOL data
3214  *
3215  * This function is called for each received EAPOL frame. Most driver
3216  * interfaces rely on more generic OS mechanism for receiving frames through
3217  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3218  * take care of received EAPOL frames and deliver them to the core supplicant
3219  * code by calling this function.
3220  */
3221 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3222                              const u8 *buf, size_t len)
3223 {
3224         struct wpa_supplicant *wpa_s = ctx;
3225
3226         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3227         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3228
3229 #ifdef CONFIG_PEERKEY
3230         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3231             wpa_s->current_ssid->peerkey &&
3232             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3233             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3234                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3235                 return;
3236         }
3237 #endif /* CONFIG_PEERKEY */
3238
3239         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3240             (wpa_s->last_eapol_matches_bssid &&
3241 #ifdef CONFIG_AP
3242              !wpa_s->ap_iface &&
3243 #endif /* CONFIG_AP */
3244              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3245                 /*
3246                  * There is possible race condition between receiving the
3247                  * association event and the EAPOL frame since they are coming
3248                  * through different paths from the driver. In order to avoid
3249                  * issues in trying to process the EAPOL frame before receiving
3250                  * association information, lets queue it for processing until
3251                  * the association event is received. This may also be needed in
3252                  * driver-based roaming case, so also use src_addr != BSSID as a
3253                  * trigger if we have previously confirmed that the
3254                  * Authenticator uses BSSID as the src_addr (which is not the
3255                  * case with wired IEEE 802.1X).
3256                  */
3257                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3258                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3259                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3260                         MAC2STR(wpa_s->bssid));
3261                 wpabuf_free(wpa_s->pending_eapol_rx);
3262                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3263                 if (wpa_s->pending_eapol_rx) {
3264                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3265                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3266                                   ETH_ALEN);
3267                 }
3268                 return;
3269         }
3270
3271         wpa_s->last_eapol_matches_bssid =
3272                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3273
3274 #ifdef CONFIG_AP
3275         if (wpa_s->ap_iface) {
3276                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3277                 return;
3278         }
3279 #endif /* CONFIG_AP */
3280
3281         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3282                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3283                         "no key management is configured");
3284                 return;
3285         }
3286
3287         if (wpa_s->eapol_received == 0 &&
3288             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3289              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3290              wpa_s->wpa_state != WPA_COMPLETED) &&
3291             (wpa_s->current_ssid == NULL ||
3292              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3293                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3294                 int timeout = 10;
3295
3296                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3297                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3298                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3299                         /* Use longer timeout for IEEE 802.1X/EAP */
3300                         timeout = 70;
3301                 }
3302
3303 #ifdef CONFIG_WPS
3304                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3305                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3306                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3307                         /*
3308                          * Use shorter timeout if going through WPS AP iteration
3309                          * for PIN config method with an AP that does not
3310                          * advertise Selected Registrar.
3311                          */
3312                         struct wpabuf *wps_ie;
3313
3314                         wps_ie = wpa_bss_get_vendor_ie_multi(
3315                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3316                         if (wps_ie &&
3317                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3318                                 timeout = 10;
3319                         wpabuf_free(wps_ie);
3320                 }
3321 #endif /* CONFIG_WPS */
3322
3323                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3324         }
3325         wpa_s->eapol_received++;
3326
3327         if (wpa_s->countermeasures) {
3328                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3329                         "EAPOL packet");
3330                 return;
3331         }
3332
3333 #ifdef CONFIG_IBSS_RSN
3334         if (wpa_s->current_ssid &&
3335             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3336                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3337                 return;
3338         }
3339 #endif /* CONFIG_IBSS_RSN */
3340
3341         /* Source address of the incoming EAPOL frame could be compared to the
3342          * current BSSID. However, it is possible that a centralized
3343          * Authenticator could be using another MAC address than the BSSID of
3344          * an AP, so just allow any address to be used for now. The replies are
3345          * still sent to the current BSSID (if available), though. */
3346
3347         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3348         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3349             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3350                 return;
3351         wpa_drv_poll(wpa_s);
3352         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3353                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3354         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3355                 /*
3356                  * Set portValid = TRUE here since we are going to skip 4-way
3357                  * handshake processing which would normally set portValid. We
3358                  * need this to allow the EAPOL state machines to be completed
3359                  * without going through EAPOL-Key handshake.
3360                  */
3361                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3362         }
3363 }
3364
3365
3366 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3367 {
3368         if ((!wpa_s->p2p_mgmt ||
3369              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3370             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3371                 l2_packet_deinit(wpa_s->l2);
3372                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3373                                            wpa_drv_get_mac_addr(wpa_s),
3374                                            ETH_P_EAPOL,
3375                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3376                 if (wpa_s->l2 == NULL)
3377                         return -1;
3378         } else {
3379                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3380                 if (addr)
3381                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3382         }
3383
3384         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3385                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3386                 return -1;
3387         }
3388
3389         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3390
3391         return 0;
3392 }
3393
3394
3395 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3396                                            const u8 *buf, size_t len)
3397 {
3398         struct wpa_supplicant *wpa_s = ctx;
3399         const struct l2_ethhdr *eth;
3400
3401         if (len < sizeof(*eth))
3402                 return;
3403         eth = (const struct l2_ethhdr *) buf;
3404
3405         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3406             !(eth->h_dest[0] & 0x01)) {
3407                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3408                         " (bridge - not for this interface - ignore)",
3409                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3410                 return;
3411         }
3412
3413         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3414                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3415         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3416                                 len - sizeof(*eth));
3417 }
3418
3419
3420 /**
3421  * wpa_supplicant_driver_init - Initialize driver interface parameters
3422  * @wpa_s: Pointer to wpa_supplicant data
3423  * Returns: 0 on success, -1 on failure
3424  *
3425  * This function is called to initialize driver interface parameters.
3426  * wpa_drv_init() must have been called before this function to initialize the
3427  * driver interface.
3428  */
3429 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3430 {
3431         static int interface_count = 0;
3432
3433         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3434                 return -1;
3435
3436         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3437                 MAC2STR(wpa_s->own_addr));
3438         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3439         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3440
3441         if (wpa_s->bridge_ifname[0]) {
3442                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3443                         "interface '%s'", wpa_s->bridge_ifname);
3444                 wpa_s->l2_br = l2_packet_init_bridge(
3445                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3446                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3447                 if (wpa_s->l2_br == NULL) {
3448                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3449                                 "connection for the bridge interface '%s'",
3450                                 wpa_s->bridge_ifname);
3451                         return -1;
3452                 }
3453         }
3454
3455         if (wpa_s->conf->ap_scan == 2 &&
3456             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3457                 wpa_printf(MSG_INFO,
3458                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3459         }
3460
3461         wpa_clear_keys(wpa_s, NULL);
3462
3463         /* Make sure that TKIP countermeasures are not left enabled (could
3464          * happen if wpa_supplicant is killed during countermeasures. */
3465         wpa_drv_set_countermeasures(wpa_s, 0);
3466
3467         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3468         wpa_drv_flush_pmkid(wpa_s);
3469
3470         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3471         wpa_s->prev_scan_wildcard = 0;
3472
3473         if (wpa_supplicant_enabled_networks(wpa_s)) {
3474                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3475                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3476                         interface_count = 0;
3477                 }
3478 #ifndef ANDROID
3479                 if (!wpa_s->p2p_mgmt &&
3480                     wpa_supplicant_delayed_sched_scan(wpa_s,
3481                                                       interface_count % 3,
3482                                                       100000))
3483                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3484                                                 100000);
3485 #endif /* ANDROID */
3486                 interface_count++;
3487         } else
3488                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3489
3490         return 0;
3491 }
3492
3493
3494 static int wpa_supplicant_daemon(const char *pid_file)
3495 {
3496         wpa_printf(MSG_DEBUG, "Daemonize..");
3497         return os_daemonize(pid_file);
3498 }
3499
3500
3501 static struct wpa_supplicant *
3502 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3503 {
3504         struct wpa_supplicant *wpa_s;
3505
3506         wpa_s = os_zalloc(sizeof(*wpa_s));
3507         if (wpa_s == NULL)
3508                 return NULL;
3509         wpa_s->scan_req = INITIAL_SCAN_REQ;
3510         wpa_s->scan_interval = 5;
3511         wpa_s->new_connection = 1;
3512         wpa_s->parent = parent ? parent : wpa_s;
3513         wpa_s->p2pdev = wpa_s->parent;
3514         wpa_s->sched_scanning = 0;
3515
3516         dl_list_init(&wpa_s->bss_tmp_disallowed);
3517
3518         return wpa_s;
3519 }
3520
3521
3522 #ifdef CONFIG_HT_OVERRIDES
3523
3524 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3525                              struct ieee80211_ht_capabilities *htcaps,
3526                              struct ieee80211_ht_capabilities *htcaps_mask,
3527                              const char *ht_mcs)
3528 {
3529         /* parse ht_mcs into hex array */
3530         int i;
3531         const char *tmp = ht_mcs;
3532         char *end = NULL;
3533
3534         /* If ht_mcs is null, do not set anything */
3535         if (!ht_mcs)
3536                 return 0;
3537
3538         /* This is what we are setting in the kernel */
3539         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3540
3541         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3542
3543         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3544                 errno = 0;
3545                 long v = strtol(tmp, &end, 16);
3546                 if (errno == 0) {
3547                         wpa_msg(wpa_s, MSG_DEBUG,
3548                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3549                                 i, v, end, tmp);
3550                         if (end == tmp)
3551                                 break;
3552
3553                         htcaps->supported_mcs_set[i] = v;
3554                         tmp = end;
3555                 } else {
3556                         wpa_msg(wpa_s, MSG_ERROR,
3557                                 "Failed to parse ht-mcs: %s, error: %s\n",
3558                                 ht_mcs, strerror(errno));
3559                         return -1;
3560                 }
3561         }
3562
3563         /*
3564          * If we were able to parse any values, then set mask for the MCS set.
3565          */
3566         if (i) {
3567                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3568                           IEEE80211_HT_MCS_MASK_LEN - 1);
3569                 /* skip the 3 reserved bits */
3570                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3571                         0x1f;
3572         }
3573
3574         return 0;
3575 }
3576
3577
3578 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3579                                  struct ieee80211_ht_capabilities *htcaps,
3580                                  struct ieee80211_ht_capabilities *htcaps_mask,
3581                                  int disabled)
3582 {
3583         le16 msk;
3584
3585         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3586
3587         if (disabled == -1)
3588                 return 0;
3589
3590         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3591         htcaps_mask->ht_capabilities_info |= msk;
3592         if (disabled)
3593                 htcaps->ht_capabilities_info &= msk;
3594         else
3595                 htcaps->ht_capabilities_info |= msk;
3596
3597         return 0;
3598 }
3599
3600
3601 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3602                                 struct ieee80211_ht_capabilities *htcaps,
3603                                 struct ieee80211_ht_capabilities *htcaps_mask,
3604                                 int factor)
3605 {
3606         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3607
3608         if (factor == -1)
3609                 return 0;
3610
3611         if (factor < 0 || factor > 3) {
3612                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3613                         "Must be 0-3 or -1", factor);
3614                 return -EINVAL;
3615         }
3616
3617         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3618         htcaps->a_mpdu_params &= ~0x3;
3619         htcaps->a_mpdu_params |= factor & 0x3;
3620
3621         return 0;
3622 }
3623
3624
3625 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3626                                  struct ieee80211_ht_capabilities *htcaps,
3627                                  struct ieee80211_ht_capabilities *htcaps_mask,
3628                                  int density)
3629 {
3630         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3631
3632         if (density == -1)
3633                 return 0;
3634
3635         if (density < 0 || density > 7) {
3636                 wpa_msg(wpa_s, MSG_ERROR,
3637                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3638                         density);
3639                 return -EINVAL;
3640         }
3641
3642         htcaps_mask->a_mpdu_params |= 0x1C;
3643         htcaps->a_mpdu_params &= ~(0x1C);
3644         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3645
3646         return 0;
3647 }
3648
3649
3650 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3651                                 struct ieee80211_ht_capabilities *htcaps,
3652                                 struct ieee80211_ht_capabilities *htcaps_mask,
3653                                 int disabled)
3654 {
3655         /* Masking these out disables HT40 */
3656         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3657                                 HT_CAP_INFO_SHORT_GI40MHZ);
3658
3659         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3660
3661         if (disabled)
3662                 htcaps->ht_capabilities_info &= ~msk;
3663         else
3664                 htcaps->ht_capabilities_info |= msk;
3665
3666         htcaps_mask->ht_capabilities_info |= msk;
3667
3668         return 0;
3669 }
3670
3671
3672 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3673                                struct ieee80211_ht_capabilities *htcaps,
3674                                struct ieee80211_ht_capabilities *htcaps_mask,
3675                                int disabled)
3676 {
3677         /* Masking these out disables SGI */
3678         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3679                                 HT_CAP_INFO_SHORT_GI40MHZ);
3680
3681         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3682
3683         if (disabled)
3684                 htcaps->ht_capabilities_info &= ~msk;
3685         else
3686                 htcaps->ht_capabilities_info |= msk;
3687
3688         htcaps_mask->ht_capabilities_info |= msk;
3689
3690         return 0;
3691 }
3692
3693
3694 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3695                                struct ieee80211_ht_capabilities *htcaps,
3696                                struct ieee80211_ht_capabilities *htcaps_mask,
3697                                int disabled)
3698 {
3699         /* Masking these out disables LDPC */
3700         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3701
3702         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3703
3704         if (disabled)
3705                 htcaps->ht_capabilities_info &= ~msk;
3706         else
3707                 htcaps->ht_capabilities_info |= msk;
3708
3709         htcaps_mask->ht_capabilities_info |= msk;
3710
3711         return 0;
3712 }
3713
3714
3715 void wpa_supplicant_apply_ht_overrides(
3716         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3717         struct wpa_driver_associate_params *params)
3718 {
3719         struct ieee80211_ht_capabilities *htcaps;
3720         struct ieee80211_ht_capabilities *htcaps_mask;
3721
3722         if (!ssid)
3723                 return;
3724
3725         params->disable_ht = ssid->disable_ht;
3726         if (!params->htcaps || !params->htcaps_mask)
3727                 return;
3728
3729         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3730         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3731         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3732         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3733                               ssid->disable_max_amsdu);
3734         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3735         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3736         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3737         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3738         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3739
3740         if (ssid->ht40_intolerant) {
3741                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3742                 htcaps->ht_capabilities_info |= bit;
3743                 htcaps_mask->ht_capabilities_info |= bit;
3744         }
3745 }
3746
3747 #endif /* CONFIG_HT_OVERRIDES */
3748
3749
3750 #ifdef CONFIG_VHT_OVERRIDES
3751 void wpa_supplicant_apply_vht_overrides(
3752         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3753         struct wpa_driver_associate_params *params)
3754 {
3755         struct ieee80211_vht_capabilities *vhtcaps;
3756         struct ieee80211_vht_capabilities *vhtcaps_mask;
3757
3758         if (!ssid)
3759                 return;
3760
3761         params->disable_vht = ssid->disable_vht;
3762
3763         vhtcaps = (void *) params->vhtcaps;
3764         vhtcaps_mask = (void *) params->vhtcaps_mask;
3765
3766         if (!vhtcaps || !vhtcaps_mask)
3767                 return;
3768
3769         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3770         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3771
3772 #ifdef CONFIG_HT_OVERRIDES
3773         /* if max ampdu is <= 3, we have to make the HT cap the same */
3774         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3775                 int max_ampdu;
3776
3777                 max_ampdu = (ssid->vht_capa &
3778                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3779                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3780
3781                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3782                 wpa_set_ampdu_factor(wpa_s,
3783                                      (void *) params->htcaps,
3784                                      (void *) params->htcaps_mask,
3785                                      max_ampdu);
3786         }
3787 #endif /* CONFIG_HT_OVERRIDES */
3788
3789 #define OVERRIDE_MCS(i)                                                 \
3790         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3791                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3792                         3 << 2 * (i - 1);                               \
3793                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3794                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3795         }                                                               \
3796         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3797                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3798                         3 << 2 * (i - 1);                               \
3799                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3800                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3801         }
3802
3803         OVERRIDE_MCS(1);
3804         OVERRIDE_MCS(2);
3805         OVERRIDE_MCS(3);
3806         OVERRIDE_MCS(4);
3807         OVERRIDE_MCS(5);
3808         OVERRIDE_MCS(6);
3809         OVERRIDE_MCS(7);
3810         OVERRIDE_MCS(8);
3811 }
3812 #endif /* CONFIG_VHT_OVERRIDES */
3813
3814
3815 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3816 {
3817 #ifdef PCSC_FUNCS
3818         size_t len;
3819
3820         if (!wpa_s->conf->pcsc_reader)
3821                 return 0;
3822
3823         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3824         if (!wpa_s->scard)
3825                 return 1;
3826
3827         if (wpa_s->conf->pcsc_pin &&
3828             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3829                 scard_deinit(wpa_s->scard);
3830                 wpa_s->scard = NULL;
3831                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3832                 return -1;
3833         }
3834
3835         len = sizeof(wpa_s->imsi) - 1;
3836         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3837                 scard_deinit(wpa_s->scard);
3838                 wpa_s->scard = NULL;
3839                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3840                 return -1;
3841         }
3842         wpa_s->imsi[len] = '\0';
3843
3844         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3845
3846         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3847                    wpa_s->imsi, wpa_s->mnc_len);
3848
3849         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3850         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3851 #endif /* PCSC_FUNCS */
3852
3853         return 0;
3854 }
3855
3856
3857 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3858 {
3859         char *val, *pos;
3860
3861         ext_password_deinit(wpa_s->ext_pw);
3862         wpa_s->ext_pw = NULL;
3863         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3864
3865         if (!wpa_s->conf->ext_password_backend)
3866                 return 0;
3867
3868         val = os_strdup(wpa_s->conf->ext_password_backend);
3869         if (val == NULL)
3870                 return -1;
3871         pos = os_strchr(val, ':');
3872         if (pos)
3873                 *pos++ = '\0';
3874
3875         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3876
3877         wpa_s->ext_pw = ext_password_init(val, pos);
3878         os_free(val);
3879         if (wpa_s->ext_pw == NULL) {
3880                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3881                 return -1;
3882         }
3883         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3884
3885         return 0;
3886 }
3887
3888
3889 #ifdef CONFIG_FST
3890
3891 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3892 {
3893         struct wpa_supplicant *wpa_s = ctx;
3894
3895         return (is_zero_ether_addr(wpa_s->bssid) ||
3896                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3897 }
3898
3899
3900 static void wpas_fst_get_channel_info_cb(void *ctx,
3901                                          enum hostapd_hw_mode *hw_mode,
3902                                          u8 *channel)
3903 {
3904         struct wpa_supplicant *wpa_s = ctx;
3905
3906         if (wpa_s->current_bss) {
3907                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3908                                                   channel);
3909         } else if (wpa_s->hw.num_modes) {
3910                 *hw_mode = wpa_s->hw.modes[0].mode;
3911         } else {
3912                 WPA_ASSERT(0);
3913                 *hw_mode = 0;
3914         }
3915 }
3916
3917
3918 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3919 {
3920         struct wpa_supplicant *wpa_s = ctx;
3921
3922         *modes = wpa_s->hw.modes;
3923         return wpa_s->hw.num_modes;
3924 }
3925
3926
3927 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3928 {
3929         struct wpa_supplicant *wpa_s = ctx;
3930
3931         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3932         wpa_s->fst_ies = fst_ies;
3933 }
3934
3935
3936 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3937 {
3938         struct wpa_supplicant *wpa_s = ctx;
3939
3940         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3941         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3942                                           wpa_s->own_addr, wpa_s->bssid,
3943                                           wpabuf_head(data), wpabuf_len(data),
3944                                    0);
3945 }
3946
3947
3948 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3949 {
3950         struct wpa_supplicant *wpa_s = ctx;
3951
3952         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3953         return wpa_s->received_mb_ies;
3954 }
3955
3956
3957 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3958                                      const u8 *buf, size_t size)
3959 {
3960         struct wpa_supplicant *wpa_s = ctx;
3961         struct mb_ies_info info;
3962
3963         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3964
3965         if (!mb_ies_info_by_ies(&info, buf, size)) {
3966                 wpabuf_free(wpa_s->received_mb_ies);
3967                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3968         }
3969 }
3970
3971
3972 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3973                                    Boolean mb_only)
3974 {
3975         struct wpa_supplicant *wpa_s = ctx;
3976
3977         *get_ctx = NULL;
3978         if (!is_zero_ether_addr(wpa_s->bssid))
3979                 return (wpa_s->received_mb_ies || !mb_only) ?
3980                         wpa_s->bssid : NULL;
3981         return NULL;
3982 }
3983
3984
3985 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3986                                   Boolean mb_only)
3987 {
3988         return NULL;
3989 }
3990
3991 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3992                                        struct fst_wpa_obj *iface_obj)
3993 {
3994         iface_obj->ctx              = wpa_s;
3995         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3996         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3997         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3998         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3999         iface_obj->send_action      = wpas_fst_send_action_cb;
4000         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4001         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4002         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4003         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4004 }
4005 #endif /* CONFIG_FST */
4006
4007 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4008                                     const struct wpa_driver_capa *capa)
4009 {
4010         struct wowlan_triggers *triggers;
4011         int ret = 0;
4012
4013         if (!wpa_s->conf->wowlan_triggers)
4014                 return 0;
4015
4016         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4017         if (triggers) {
4018                 ret = wpa_drv_wowlan(wpa_s, triggers);
4019                 os_free(triggers);
4020         }
4021         return ret;
4022 }
4023
4024
4025 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4026 {
4027         if (freq < 3000)
4028                 return BAND_2_4_GHZ;
4029         if (freq > 50000)
4030                 return BAND_60_GHZ;
4031         return BAND_5_GHZ;
4032 }
4033
4034
4035 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4036 {
4037         int i;
4038         unsigned int band = 0;
4039
4040         if (freqs) {
4041                 /* freqs are specified for the radio work */
4042                 for (i = 0; freqs[i]; i++)
4043                         band |= wpas_freq_to_band(freqs[i]);
4044         } else {
4045                 /*
4046                  * freqs are not specified, implies all
4047                  * the supported freqs by HW
4048                  */
4049                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4050                         if (wpa_s->hw.modes[i].num_channels != 0) {
4051                                 if (wpa_s->hw.modes[i].mode ==
4052                                     HOSTAPD_MODE_IEEE80211B ||
4053                                     wpa_s->hw.modes[i].mode ==
4054                                     HOSTAPD_MODE_IEEE80211G)
4055                                         band |= BAND_2_4_GHZ;
4056                                 else if (wpa_s->hw.modes[i].mode ==
4057                                          HOSTAPD_MODE_IEEE80211A)
4058                                         band |= BAND_5_GHZ;
4059                                 else if (wpa_s->hw.modes[i].mode ==
4060                                          HOSTAPD_MODE_IEEE80211AD)
4061                                         band |= BAND_60_GHZ;
4062                                 else if (wpa_s->hw.modes[i].mode ==
4063                                          HOSTAPD_MODE_IEEE80211ANY)
4064                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4065                                                 BAND_60_GHZ;
4066                         }
4067                 }
4068         }
4069
4070         return band;
4071 }
4072
4073
4074 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4075                                               const char *rn)
4076 {
4077         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4078         struct wpa_radio *radio;
4079
4080         while (rn && iface) {
4081                 radio = iface->radio;
4082                 if (radio && os_strcmp(rn, radio->name) == 0) {
4083                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4084                                    wpa_s->ifname, rn);
4085                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4086                         return radio;
4087                 }
4088
4089                 iface = iface->next;
4090         }
4091
4092         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4093                    wpa_s->ifname, rn ? rn : "N/A");
4094         radio = os_zalloc(sizeof(*radio));
4095         if (radio == NULL)
4096                 return NULL;
4097
4098         if (rn)
4099                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4100         dl_list_init(&radio->ifaces);
4101         dl_list_init(&radio->work);
4102         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4103
4104         return radio;
4105 }
4106
4107
4108 static void radio_work_free(struct wpa_radio_work *work)
4109 {
4110         if (work->wpa_s->scan_work == work) {
4111                 /* This should not really happen. */
4112                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4113                         work->type, work, work->started);
4114                 work->wpa_s->scan_work = NULL;
4115         }
4116
4117 #ifdef CONFIG_P2P
4118         if (work->wpa_s->p2p_scan_work == work) {
4119                 /* This should not really happen. */
4120                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4121                         work->type, work, work->started);
4122                 work->wpa_s->p2p_scan_work = NULL;
4123         }
4124 #endif /* CONFIG_P2P */
4125
4126         if (work->started) {
4127                 work->wpa_s->radio->num_active_works--;
4128                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4129                         "radio_work_free('%s'@%p: num_active_works --> %u",
4130                         work->type, work,
4131                         work->wpa_s->radio->num_active_works);
4132         }
4133
4134         dl_list_del(&work->list);
4135         os_free(work);
4136 }
4137
4138
4139 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4140 {
4141         struct wpa_radio_work *active_work = NULL;
4142         struct wpa_radio_work *tmp;
4143
4144         /* Get the active work to know the type and band. */
4145         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4146                 if (tmp->started) {
4147                         active_work = tmp;
4148                         break;
4149                 }
4150         }
4151
4152         if (!active_work) {
4153                 /* No active work, start one */
4154                 radio->num_active_works = 0;
4155                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4156                                  list) {
4157                         if (os_strcmp(tmp->type, "scan") == 0 &&
4158                             radio->external_scan_running &&
4159                             (((struct wpa_driver_scan_params *)
4160                               tmp->ctx)->only_new_results ||
4161                              tmp->wpa_s->clear_driver_scan_cache))
4162                                 continue;
4163                         return tmp;
4164                 }
4165                 return NULL;
4166         }
4167
4168         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4169             os_strcmp(active_work->type, "connect") == 0) {
4170                 /*
4171                  * If the active work is either connect or sme-connect,
4172                  * do not parallelize them with other radio works.
4173                  */
4174                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4175                         "Do not parallelize radio work with %s",
4176                         active_work->type);
4177                 return NULL;
4178         }
4179
4180         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4181                 if (tmp->started)
4182                         continue;
4183
4184                 /*
4185                  * If connect or sme-connect are enqueued, parallelize only
4186                  * those operations ahead of them in the queue.
4187                  */
4188                 if (os_strcmp(tmp->type, "connect") == 0 ||
4189                     os_strcmp(tmp->type, "sme-connect") == 0)
4190                         break;
4191
4192                 /*
4193                  * Check that the radio works are distinct and
4194                  * on different bands.
4195                  */
4196                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4197                     (active_work->bands != tmp->bands)) {
4198                         /*
4199                          * If a scan has to be scheduled through nl80211 scan
4200                          * interface and if an external scan is already running,
4201                          * do not schedule the scan since it is likely to get
4202                          * rejected by kernel.
4203                          */
4204                         if (os_strcmp(tmp->type, "scan") == 0 &&
4205                             radio->external_scan_running &&
4206                             (((struct wpa_driver_scan_params *)
4207                               tmp->ctx)->only_new_results ||
4208                              tmp->wpa_s->clear_driver_scan_cache))
4209                                 continue;
4210
4211                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4212                                 "active_work:%s new_work:%s",
4213                                 active_work->type, tmp->type);
4214                         return tmp;
4215                 }
4216         }
4217
4218         /* Did not find a radio work to schedule in parallel. */
4219         return NULL;
4220 }
4221
4222
4223 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4224 {
4225         struct wpa_radio *radio = eloop_ctx;
4226         struct wpa_radio_work *work;
4227         struct os_reltime now, diff;
4228         struct wpa_supplicant *wpa_s;
4229
4230         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4231         if (work == NULL) {
4232                 radio->num_active_works = 0;
4233                 return;
4234         }
4235
4236         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4237                               radio_list);
4238
4239         if (!(wpa_s &&
4240               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4241                 if (work->started)
4242                         return; /* already started and still in progress */
4243
4244                 if (wpa_s && wpa_s->radio->external_scan_running) {
4245                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4246                         return;
4247                 }
4248         } else {
4249                 work = NULL;
4250                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4251                         /* get the work to schedule next */
4252                         work = radio_work_get_next_work(radio);
4253                 }
4254                 if (!work)
4255                         return;
4256         }
4257
4258         wpa_s = work->wpa_s;
4259         os_get_reltime(&now);
4260         os_reltime_sub(&now, &work->time, &diff);
4261         wpa_dbg(wpa_s, MSG_DEBUG,
4262                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4263                 work->type, work, diff.sec, diff.usec);
4264         work->started = 1;
4265         work->time = now;
4266         radio->num_active_works++;
4267
4268         work->cb(work, 0);
4269
4270         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4271             radio->num_active_works < MAX_ACTIVE_WORKS)
4272                 radio_work_check_next(wpa_s);
4273 }
4274
4275
4276 /*
4277  * This function removes both started and pending radio works running on
4278  * the provided interface's radio.
4279  * Prior to the removal of the radio work, its callback (cb) is called with
4280  * deinit set to be 1. Each work's callback is responsible for clearing its
4281  * internal data and restoring to a correct state.
4282  * @wpa_s: wpa_supplicant data
4283  * @type: type of works to be removed
4284  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4285  * this interface's works.
4286  */
4287 void radio_remove_works(struct wpa_supplicant *wpa_s,
4288                         const char *type, int remove_all)
4289 {
4290         struct wpa_radio_work *work, *tmp;
4291         struct wpa_radio *radio = wpa_s->radio;
4292
4293         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4294                               list) {
4295                 if (type && os_strcmp(type, work->type) != 0)
4296                         continue;
4297
4298                 /* skip other ifaces' works */
4299                 if (!remove_all && work->wpa_s != wpa_s)
4300                         continue;
4301
4302                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4303                         work->type, work, work->started ? " (started)" : "");
4304                 work->cb(work, 1);
4305                 radio_work_free(work);
4306         }
4307
4308         /* in case we removed the started work */
4309         radio_work_check_next(wpa_s);
4310 }
4311
4312
4313 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4314 {
4315         struct wpa_radio *radio = wpa_s->radio;
4316
4317         if (!radio)
4318                 return;
4319
4320         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4321                    wpa_s->ifname, radio->name);
4322         dl_list_del(&wpa_s->radio_list);
4323         radio_remove_works(wpa_s, NULL, 0);
4324         wpa_s->radio = NULL;
4325         if (!dl_list_empty(&radio->ifaces))
4326                 return; /* Interfaces remain for this radio */
4327
4328         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4329         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4330         os_free(radio);
4331 }
4332
4333
4334 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4335 {
4336         struct wpa_radio *radio = wpa_s->radio;
4337
4338         if (dl_list_empty(&radio->work))
4339                 return;
4340         if (wpa_s->ext_work_in_progress) {
4341                 wpa_printf(MSG_DEBUG,
4342                            "External radio work in progress - delay start of pending item");
4343                 return;
4344         }
4345         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4346         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4347 }
4348
4349
4350 /**
4351  * radio_add_work - Add a radio work item
4352  * @wpa_s: Pointer to wpa_supplicant data
4353  * @freq: Frequency of the offchannel operation in MHz or 0
4354  * @type: Unique identifier for each type of work
4355  * @next: Force as the next work to be executed
4356  * @cb: Callback function for indicating when radio is available
4357  * @ctx: Context pointer for the work (work->ctx in cb())
4358  * Returns: 0 on success, -1 on failure
4359  *
4360  * This function is used to request time for an operation that requires
4361  * exclusive radio control. Once the radio is available, the registered callback
4362  * function will be called. radio_work_done() must be called once the exclusive
4363  * radio operation has been completed, so that the radio is freed for other
4364  * operations. The special case of deinit=1 is used to free the context data
4365  * during interface removal. That does not allow the callback function to start
4366  * the radio operation, i.e., it must free any resources allocated for the radio
4367  * work and return.
4368  *
4369  * The @freq parameter can be used to indicate a single channel on which the
4370  * offchannel operation will occur. This may allow multiple radio work
4371  * operations to be performed in parallel if they apply for the same channel.
4372  * Setting this to 0 indicates that the work item may use multiple channels or
4373  * requires exclusive control of the radio.
4374  */
4375 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4376                    const char *type, int next,
4377                    void (*cb)(struct wpa_radio_work *work, int deinit),
4378                    void *ctx)
4379 {
4380         struct wpa_radio *radio = wpa_s->radio;
4381         struct wpa_radio_work *work;
4382         int was_empty;
4383
4384         work = os_zalloc(sizeof(*work));
4385         if (work == NULL)
4386                 return -1;
4387         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4388         os_get_reltime(&work->time);
4389         work->freq = freq;
4390         work->type = type;
4391         work->wpa_s = wpa_s;
4392         work->cb = cb;
4393         work->ctx = ctx;
4394
4395         if (freq)
4396                 work->bands = wpas_freq_to_band(freq);
4397         else if (os_strcmp(type, "scan") == 0 ||
4398                  os_strcmp(type, "p2p-scan") == 0)
4399                 work->bands = wpas_get_bands(wpa_s,
4400                                              ((struct wpa_driver_scan_params *)
4401                                               ctx)->freqs);
4402         else
4403                 work->bands = wpas_get_bands(wpa_s, NULL);
4404
4405         was_empty = dl_list_empty(&wpa_s->radio->work);
4406         if (next)
4407                 dl_list_add(&wpa_s->radio->work, &work->list);
4408         else
4409                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4410         if (was_empty) {
4411                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4412                 radio_work_check_next(wpa_s);
4413         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4414                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4415                 wpa_dbg(wpa_s, MSG_DEBUG,
4416                         "Try to schedule a radio work (num_active_works=%u)",
4417                         radio->num_active_works);
4418                 radio_work_check_next(wpa_s);
4419         }
4420
4421         return 0;
4422 }
4423
4424
4425 /**
4426  * radio_work_done - Indicate that a radio work item has been completed
4427  * @work: Completed work
4428  *
4429  * This function is called once the callback function registered with
4430  * radio_add_work() has completed its work.
4431  */
4432 void radio_work_done(struct wpa_radio_work *work)
4433 {
4434         struct wpa_supplicant *wpa_s = work->wpa_s;
4435         struct os_reltime now, diff;
4436         unsigned int started = work->started;
4437
4438         os_get_reltime(&now);
4439         os_reltime_sub(&now, &work->time, &diff);
4440         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4441                 work->type, work, started ? "done" : "canceled",
4442                 diff.sec, diff.usec);
4443         radio_work_free(work);
4444         if (started)
4445                 radio_work_check_next(wpa_s);
4446 }
4447
4448
4449 struct wpa_radio_work *
4450 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4451 {
4452         struct wpa_radio_work *work;
4453         struct wpa_radio *radio = wpa_s->radio;
4454
4455         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4456                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4457                         return work;
4458         }
4459
4460         return NULL;
4461 }
4462
4463
4464 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4465                             struct wpa_interface *iface)
4466 {
4467         const char *ifname, *driver, *rn;
4468
4469         driver = iface->driver;
4470 next_driver:
4471         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4472                 return -1;
4473
4474         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4475         if (wpa_s->drv_priv == NULL) {
4476                 const char *pos;
4477                 pos = driver ? os_strchr(driver, ',') : NULL;
4478                 if (pos) {
4479                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4480                                 "driver interface - try next driver wrapper");
4481                         driver = pos + 1;
4482                         goto next_driver;
4483                 }
4484                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4485                         "interface");
4486                 return -1;
4487         }
4488         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4489                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4490                         "driver_param '%s'", wpa_s->conf->driver_param);
4491                 return -1;
4492         }
4493
4494         ifname = wpa_drv_get_ifname(wpa_s);
4495         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4496                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4497                         "interface name with '%s'", ifname);
4498                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4499         }
4500
4501         rn = wpa_driver_get_radio_name(wpa_s);
4502         if (rn && rn[0] == '\0')
4503                 rn = NULL;
4504
4505         wpa_s->radio = radio_add_interface(wpa_s, rn);
4506         if (wpa_s->radio == NULL)
4507                 return -1;
4508
4509         return 0;
4510 }
4511
4512
4513 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4514                                      struct wpa_interface *iface)
4515 {
4516         struct wpa_driver_capa capa;
4517         int capa_res;
4518
4519         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4520                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4521                    iface->confname ? iface->confname : "N/A",
4522                    iface->driver ? iface->driver : "default",
4523                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4524                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4525
4526         if (iface->confname) {
4527 #ifdef CONFIG_BACKEND_FILE
4528                 wpa_s->confname = os_rel2abs_path(iface->confname);
4529                 if (wpa_s->confname == NULL) {
4530                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4531                                    "for configuration file '%s'.",
4532                                    iface->confname);
4533                         return -1;
4534                 }
4535                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4536                            iface->confname, wpa_s->confname);
4537 #else /* CONFIG_BACKEND_FILE */
4538                 wpa_s->confname = os_strdup(iface->confname);
4539 #endif /* CONFIG_BACKEND_FILE */
4540                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4541                 if (wpa_s->conf == NULL) {
4542                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4543                                    "configuration '%s'.", wpa_s->confname);
4544                         return -1;
4545                 }
4546                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4547                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4548
4549                 /*
4550                  * Override ctrl_interface and driver_param if set on command
4551                  * line.
4552                  */
4553                 if (iface->ctrl_interface) {
4554                         os_free(wpa_s->conf->ctrl_interface);
4555                         wpa_s->conf->ctrl_interface =
4556                                 os_strdup(iface->ctrl_interface);
4557                 }
4558
4559                 if (iface->driver_param) {
4560                         os_free(wpa_s->conf->driver_param);
4561                         wpa_s->conf->driver_param =
4562                                 os_strdup(iface->driver_param);
4563                 }
4564
4565                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4566                         os_free(wpa_s->conf->ctrl_interface);
4567                         wpa_s->conf->ctrl_interface = NULL;
4568                 }
4569         } else
4570                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4571                                                      iface->driver_param);
4572
4573         if (wpa_s->conf == NULL) {
4574                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4575                 return -1;
4576         }
4577
4578         if (iface->ifname == NULL) {
4579                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4580                 return -1;
4581         }
4582         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4583                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4584                            iface->ifname);
4585                 return -1;
4586         }
4587         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4588
4589         if (iface->bridge_ifname) {
4590                 if (os_strlen(iface->bridge_ifname) >=
4591                     sizeof(wpa_s->bridge_ifname)) {
4592                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4593                                    "name '%s'.", iface->bridge_ifname);
4594                         return -1;
4595                 }
4596                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4597                            sizeof(wpa_s->bridge_ifname));
4598         }
4599
4600         /* RSNA Supplicant Key Management - INITIALIZE */
4601         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4602         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4603
4604         /* Initialize driver interface and register driver event handler before
4605          * L2 receive handler so that association events are processed before
4606          * EAPOL-Key packets if both become available for the same select()
4607          * call. */
4608         if (wpas_init_driver(wpa_s, iface) < 0)
4609                 return -1;
4610
4611         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4612                 return -1;
4613
4614         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4615                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4616                           NULL);
4617         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4618
4619         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4620             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4621                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4622                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4623                         "dot11RSNAConfigPMKLifetime");
4624                 return -1;
4625         }
4626
4627         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4628             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4629                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4630                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4631                         "dot11RSNAConfigPMKReauthThreshold");
4632                 return -1;
4633         }
4634
4635         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4636             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4637                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4638                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4639                         "dot11RSNAConfigSATimeout");
4640                 return -1;
4641         }
4642
4643         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4644                                                       &wpa_s->hw.num_modes,
4645                                                       &wpa_s->hw.flags);
4646         if (wpa_s->hw.modes) {
4647                 u16 i;
4648
4649                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4650                         if (wpa_s->hw.modes[i].vht_capab) {
4651                                 wpa_s->hw_capab = CAPAB_VHT;
4652                                 break;
4653                         }
4654
4655                         if (wpa_s->hw.modes[i].ht_capab &
4656                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4657                                 wpa_s->hw_capab = CAPAB_HT40;
4658                         else if (wpa_s->hw.modes[i].ht_capab &&
4659                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4660                                 wpa_s->hw_capab = CAPAB_HT;
4661                 }
4662         }
4663
4664         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4665         if (capa_res == 0) {
4666                 wpa_s->drv_capa_known = 1;
4667                 wpa_s->drv_flags = capa.flags;
4668                 wpa_s->drv_enc = capa.enc;
4669                 wpa_s->drv_smps_modes = capa.smps_modes;
4670                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4671                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4672                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4673                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4674                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4675                 wpa_s->max_sched_scan_plan_interval =
4676                         capa.max_sched_scan_plan_interval;
4677                 wpa_s->max_sched_scan_plan_iterations =
4678                         capa.max_sched_scan_plan_iterations;
4679                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4680                 wpa_s->max_match_sets = capa.max_match_sets;
4681                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4682                 wpa_s->max_stations = capa.max_stations;
4683                 wpa_s->extended_capa = capa.extended_capa;
4684                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4685                 wpa_s->extended_capa_len = capa.extended_capa_len;
4686                 wpa_s->num_multichan_concurrent =
4687                         capa.num_multichan_concurrent;
4688                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4689
4690                 if (capa.mac_addr_rand_scan_supported)
4691                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4692                 if (wpa_s->sched_scan_supported &&
4693                     capa.mac_addr_rand_sched_scan_supported)
4694                         wpa_s->mac_addr_rand_supported |=
4695                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4696         }
4697         if (wpa_s->max_remain_on_chan == 0)
4698                 wpa_s->max_remain_on_chan = 1000;
4699
4700         /*
4701          * Only take p2p_mgmt parameters when P2P Device is supported.
4702          * Doing it here as it determines whether l2_packet_init() will be done
4703          * during wpa_supplicant_driver_init().
4704          */
4705         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4706                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4707         else
4708                 iface->p2p_mgmt = 1;
4709
4710         if (wpa_s->num_multichan_concurrent == 0)
4711                 wpa_s->num_multichan_concurrent = 1;
4712
4713         if (wpa_supplicant_driver_init(wpa_s) < 0)
4714                 return -1;
4715
4716 #ifdef CONFIG_TDLS
4717         if ((!iface->p2p_mgmt ||
4718              !(wpa_s->drv_flags &
4719                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4720             wpa_tdls_init(wpa_s->wpa))
4721                 return -1;
4722 #endif /* CONFIG_TDLS */
4723
4724         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4725             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4726                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4727                 return -1;
4728         }
4729
4730 #ifdef CONFIG_FST
4731         if (wpa_s->conf->fst_group_id) {
4732                 struct fst_iface_cfg cfg;
4733                 struct fst_wpa_obj iface_obj;
4734
4735                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4736                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4737                            sizeof(cfg.group_id));
4738                 cfg.priority = wpa_s->conf->fst_priority;
4739                 cfg.llt = wpa_s->conf->fst_llt;
4740
4741                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4742                                         &iface_obj, &cfg);
4743                 if (!wpa_s->fst) {
4744                         wpa_msg(wpa_s, MSG_ERROR,
4745                                 "FST: Cannot attach iface %s to group %s",
4746                                 wpa_s->ifname, cfg.group_id);
4747                         return -1;
4748                 }
4749         }
4750 #endif /* CONFIG_FST */
4751
4752         if (wpas_wps_init(wpa_s))
4753                 return -1;
4754
4755         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4756                 return -1;
4757         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4758
4759         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4760         if (wpa_s->ctrl_iface == NULL) {
4761                 wpa_printf(MSG_ERROR,
4762                            "Failed to initialize control interface '%s'.\n"
4763                            "You may have another wpa_supplicant process "
4764                            "already running or the file was\n"
4765                            "left by an unclean termination of wpa_supplicant "
4766                            "in which case you will need\n"
4767                            "to manually remove this file before starting "
4768                            "wpa_supplicant again.\n",
4769                            wpa_s->conf->ctrl_interface);
4770                 return -1;
4771         }
4772
4773         wpa_s->gas = gas_query_init(wpa_s);
4774         if (wpa_s->gas == NULL) {
4775                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4776                 return -1;
4777         }
4778
4779         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4780                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4781                 return -1;
4782         }
4783
4784         if (wpa_bss_init(wpa_s) < 0)
4785                 return -1;
4786
4787         /*
4788          * Set Wake-on-WLAN triggers, if configured.
4789          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4790          * have effect anyway when the interface is down).
4791          */
4792         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4793                 return -1;
4794
4795 #ifdef CONFIG_EAP_PROXY
4796 {
4797         size_t len;
4798         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4799                                                      &len);
4800         if (wpa_s->mnc_len > 0) {
4801                 wpa_s->imsi[len] = '\0';
4802                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4803                            wpa_s->imsi, wpa_s->mnc_len);
4804         } else {
4805                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4806         }
4807 }
4808 #endif /* CONFIG_EAP_PROXY */
4809
4810         if (pcsc_reader_init(wpa_s) < 0)
4811                 return -1;
4812
4813         if (wpas_init_ext_pw(wpa_s) < 0)
4814                 return -1;
4815
4816         wpas_rrm_reset(wpa_s);
4817
4818         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4819
4820 #ifdef CONFIG_HS20
4821         hs20_init(wpa_s);
4822 #endif /* CONFIG_HS20 */
4823 #ifdef CONFIG_MBO
4824         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4825 #endif /* CONFIG_MBO */
4826
4827         return 0;
4828 }
4829
4830
4831 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4832                                         int notify, int terminate)
4833 {
4834         struct wpa_global *global = wpa_s->global;
4835         struct wpa_supplicant *iface, *prev;
4836
4837         if (wpa_s == wpa_s->parent)
4838                 wpas_p2p_group_remove(wpa_s, "*");
4839
4840         iface = global->ifaces;
4841         while (iface) {
4842                 if (iface->p2pdev == wpa_s)
4843                         iface->p2pdev = iface->parent;
4844                 if (iface == wpa_s || iface->parent != wpa_s) {
4845                         iface = iface->next;
4846                         continue;
4847                 }
4848                 wpa_printf(MSG_DEBUG,
4849                            "Remove remaining child interface %s from parent %s",
4850                            iface->ifname, wpa_s->ifname);
4851                 prev = iface;
4852                 iface = iface->next;
4853                 wpa_supplicant_remove_iface(global, prev, terminate);
4854         }
4855
4856         wpa_s->disconnected = 1;
4857         if (wpa_s->drv_priv) {
4858                 wpa_supplicant_deauthenticate(wpa_s,
4859                                               WLAN_REASON_DEAUTH_LEAVING);
4860
4861                 wpa_drv_set_countermeasures(wpa_s, 0);
4862                 wpa_clear_keys(wpa_s, NULL);
4863         }
4864
4865         wpa_supplicant_cleanup(wpa_s);
4866         wpas_p2p_deinit_iface(wpa_s);
4867
4868         wpas_ctrl_radio_work_flush(wpa_s);
4869         radio_remove_interface(wpa_s);
4870
4871 #ifdef CONFIG_FST
4872         if (wpa_s->fst) {
4873                 fst_detach(wpa_s->fst);
4874                 wpa_s->fst = NULL;
4875         }
4876         if (wpa_s->received_mb_ies) {
4877                 wpabuf_free(wpa_s->received_mb_ies);
4878                 wpa_s->received_mb_ies = NULL;
4879         }
4880 #endif /* CONFIG_FST */
4881
4882         if (wpa_s->drv_priv)
4883                 wpa_drv_deinit(wpa_s);
4884
4885         if (notify)
4886                 wpas_notify_iface_removed(wpa_s);
4887
4888         if (terminate)
4889                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4890
4891         if (wpa_s->ctrl_iface) {
4892                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4893                 wpa_s->ctrl_iface = NULL;
4894         }
4895
4896 #ifdef CONFIG_MESH
4897         if (wpa_s->ifmsh) {
4898                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4899                 wpa_s->ifmsh = NULL;
4900         }
4901 #endif /* CONFIG_MESH */
4902
4903         if (wpa_s->conf != NULL) {
4904                 wpa_config_free(wpa_s->conf);
4905                 wpa_s->conf = NULL;
4906         }
4907
4908         os_free(wpa_s->ssids_from_scan_req);
4909
4910         os_free(wpa_s);
4911 }
4912
4913
4914 /**
4915  * wpa_supplicant_add_iface - Add a new network interface
4916  * @global: Pointer to global data from wpa_supplicant_init()
4917  * @iface: Interface configuration options
4918  * @parent: Parent interface or %NULL to assign new interface as parent
4919  * Returns: Pointer to the created interface or %NULL on failure
4920  *
4921  * This function is used to add new network interfaces for %wpa_supplicant.
4922  * This can be called before wpa_supplicant_run() to add interfaces before the
4923  * main event loop has been started. In addition, new interfaces can be added
4924  * dynamically while %wpa_supplicant is already running. This could happen,
4925  * e.g., when a hotplug network adapter is inserted.
4926  */
4927 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4928                                                  struct wpa_interface *iface,
4929                                                  struct wpa_supplicant *parent)
4930 {
4931         struct wpa_supplicant *wpa_s;
4932         struct wpa_interface t_iface;
4933         struct wpa_ssid *ssid;
4934
4935         if (global == NULL || iface == NULL)
4936                 return NULL;
4937
4938         wpa_s = wpa_supplicant_alloc(parent);
4939         if (wpa_s == NULL)
4940                 return NULL;
4941
4942         wpa_s->global = global;
4943
4944         t_iface = *iface;
4945         if (global->params.override_driver) {
4946                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4947                            "('%s' -> '%s')",
4948                            iface->driver, global->params.override_driver);
4949                 t_iface.driver = global->params.override_driver;
4950         }
4951         if (global->params.override_ctrl_interface) {
4952                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4953                            "ctrl_interface ('%s' -> '%s')",
4954                            iface->ctrl_interface,
4955                            global->params.override_ctrl_interface);
4956                 t_iface.ctrl_interface =
4957                         global->params.override_ctrl_interface;
4958         }
4959         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4960                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4961                            iface->ifname);
4962                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4963                 return NULL;
4964         }
4965
4966         if (iface->p2p_mgmt == 0) {
4967                 /* Notify the control interfaces about new iface */
4968                 if (wpas_notify_iface_added(wpa_s)) {
4969                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4970                         return NULL;
4971                 }
4972
4973                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4974                         wpas_notify_network_added(wpa_s, ssid);
4975         }
4976
4977         wpa_s->next = global->ifaces;
4978         global->ifaces = wpa_s;
4979
4980         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4981         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4982
4983 #ifdef CONFIG_P2P
4984         if (wpa_s->global->p2p == NULL &&
4985             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4986             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4987             wpas_p2p_add_p2pdev_interface(
4988                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4989                 wpa_printf(MSG_INFO,
4990                            "P2P: Failed to enable P2P Device interface");
4991                 /* Try to continue without. P2P will be disabled. */
4992         }
4993 #endif /* CONFIG_P2P */
4994
4995         return wpa_s;
4996 }
4997
4998
4999 /**
5000  * wpa_supplicant_remove_iface - Remove a network interface
5001  * @global: Pointer to global data from wpa_supplicant_init()
5002  * @wpa_s: Pointer to the network interface to be removed
5003  * Returns: 0 if interface was removed, -1 if interface was not found
5004  *
5005  * This function can be used to dynamically remove network interfaces from
5006  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5007  * addition, this function is used to remove all remaining interfaces when
5008  * %wpa_supplicant is terminated.
5009  */
5010 int wpa_supplicant_remove_iface(struct wpa_global *global,
5011                                 struct wpa_supplicant *wpa_s,
5012                                 int terminate)
5013 {
5014         struct wpa_supplicant *prev;
5015 #ifdef CONFIG_MESH
5016         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5017         char *ifname = NULL;
5018 #endif /* CONFIG_MESH */
5019
5020         /* Remove interface from the global list of interfaces */
5021         prev = global->ifaces;
5022         if (prev == wpa_s) {
5023                 global->ifaces = wpa_s->next;
5024         } else {
5025                 while (prev && prev->next != wpa_s)
5026                         prev = prev->next;
5027                 if (prev == NULL)
5028                         return -1;
5029                 prev->next = wpa_s->next;
5030         }
5031
5032         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5033
5034 #ifdef CONFIG_MESH
5035         if (mesh_if_created) {
5036                 ifname = os_strdup(wpa_s->ifname);
5037                 if (ifname == NULL) {
5038                         wpa_dbg(wpa_s, MSG_ERROR,
5039                                 "mesh: Failed to malloc ifname");
5040                         return -1;
5041                 }
5042         }
5043 #endif /* CONFIG_MESH */
5044
5045         if (global->p2p_group_formation == wpa_s)
5046                 global->p2p_group_formation = NULL;
5047         if (global->p2p_invite_group == wpa_s)
5048                 global->p2p_invite_group = NULL;
5049         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5050
5051 #ifdef CONFIG_MESH
5052         if (mesh_if_created) {
5053                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5054                 os_free(ifname);
5055         }
5056 #endif /* CONFIG_MESH */
5057
5058         return 0;
5059 }
5060
5061
5062 /**
5063  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5064  * @wpa_s: Pointer to the network interface
5065  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5066  */
5067 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5068 {
5069         const char *eapol_method;
5070
5071         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5072             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5073                 return "NO-EAP";
5074         }
5075
5076         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5077         if (eapol_method == NULL)
5078                 return "UNKNOWN-EAP";
5079
5080         return eapol_method;
5081 }
5082
5083
5084 /**
5085  * wpa_supplicant_get_iface - Get a new network interface
5086  * @global: Pointer to global data from wpa_supplicant_init()
5087  * @ifname: Interface name
5088  * Returns: Pointer to the interface or %NULL if not found
5089  */
5090 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5091                                                  const char *ifname)
5092 {
5093         struct wpa_supplicant *wpa_s;
5094
5095         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5096                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5097                         return wpa_s;
5098         }
5099         return NULL;
5100 }
5101
5102
5103 #ifndef CONFIG_NO_WPA_MSG
5104 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5105 {
5106         struct wpa_supplicant *wpa_s = ctx;
5107         if (wpa_s == NULL)
5108                 return NULL;
5109         return wpa_s->ifname;
5110 }
5111 #endif /* CONFIG_NO_WPA_MSG */
5112
5113
5114 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5115 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5116 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5117
5118 /* Periodic cleanup tasks */
5119 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5120 {
5121         struct wpa_global *global = eloop_ctx;
5122         struct wpa_supplicant *wpa_s;
5123
5124         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5125                                wpas_periodic, global, NULL);
5126
5127 #ifdef CONFIG_P2P
5128         if (global->p2p)
5129                 p2p_expire_peers(global->p2p);
5130 #endif /* CONFIG_P2P */
5131
5132         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5133                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5134 #ifdef CONFIG_AP
5135                 ap_periodic(wpa_s);
5136 #endif /* CONFIG_AP */
5137         }
5138 }
5139
5140
5141 /**
5142  * wpa_supplicant_init - Initialize %wpa_supplicant
5143  * @params: Parameters for %wpa_supplicant
5144  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5145  *
5146  * This function is used to initialize %wpa_supplicant. After successful
5147  * initialization, the returned data pointer can be used to add and remove
5148  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5149  */
5150 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5151 {
5152         struct wpa_global *global;
5153         int ret, i;
5154
5155         if (params == NULL)
5156                 return NULL;
5157
5158 #ifdef CONFIG_DRIVER_NDIS
5159         {
5160                 void driver_ndis_init_ops(void);
5161                 driver_ndis_init_ops();
5162         }
5163 #endif /* CONFIG_DRIVER_NDIS */
5164
5165 #ifndef CONFIG_NO_WPA_MSG
5166         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5167 #endif /* CONFIG_NO_WPA_MSG */
5168
5169         if (params->wpa_debug_file_path)
5170                 wpa_debug_open_file(params->wpa_debug_file_path);
5171         else
5172                 wpa_debug_setup_stdout();
5173         if (params->wpa_debug_syslog)
5174                 wpa_debug_open_syslog();
5175         if (params->wpa_debug_tracing) {
5176                 ret = wpa_debug_open_linux_tracing();
5177                 if (ret) {
5178                         wpa_printf(MSG_ERROR,
5179                                    "Failed to enable trace logging");
5180                         return NULL;
5181                 }
5182         }
5183
5184         ret = eap_register_methods();
5185         if (ret) {
5186                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5187                 if (ret == -2)
5188                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5189                                    "the same EAP type.");
5190                 return NULL;
5191         }
5192
5193         global = os_zalloc(sizeof(*global));
5194         if (global == NULL)
5195                 return NULL;
5196         dl_list_init(&global->p2p_srv_bonjour);
5197         dl_list_init(&global->p2p_srv_upnp);
5198         global->params.daemonize = params->daemonize;
5199         global->params.wait_for_monitor = params->wait_for_monitor;
5200         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5201         if (params->pid_file)
5202                 global->params.pid_file = os_strdup(params->pid_file);
5203         if (params->ctrl_interface)
5204                 global->params.ctrl_interface =
5205                         os_strdup(params->ctrl_interface);
5206         if (params->ctrl_interface_group)
5207                 global->params.ctrl_interface_group =
5208                         os_strdup(params->ctrl_interface_group);
5209         if (params->override_driver)
5210                 global->params.override_driver =
5211                         os_strdup(params->override_driver);
5212         if (params->override_ctrl_interface)
5213                 global->params.override_ctrl_interface =
5214                         os_strdup(params->override_ctrl_interface);
5215 #ifdef CONFIG_P2P
5216         if (params->conf_p2p_dev)
5217                 global->params.conf_p2p_dev =
5218                         os_strdup(params->conf_p2p_dev);
5219 #endif /* CONFIG_P2P */
5220         wpa_debug_level = global->params.wpa_debug_level =
5221                 params->wpa_debug_level;
5222         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5223                 params->wpa_debug_show_keys;
5224         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5225                 params->wpa_debug_timestamp;
5226
5227         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5228
5229         if (eloop_init()) {
5230                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5231                 wpa_supplicant_deinit(global);
5232                 return NULL;
5233         }
5234
5235         random_init(params->entropy_file);
5236
5237         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5238         if (global->ctrl_iface == NULL) {
5239                 wpa_supplicant_deinit(global);
5240                 return NULL;
5241         }
5242
5243         if (wpas_notify_supplicant_initialized(global)) {
5244                 wpa_supplicant_deinit(global);
5245                 return NULL;
5246         }
5247
5248         for (i = 0; wpa_drivers[i]; i++)
5249                 global->drv_count++;
5250         if (global->drv_count == 0) {
5251                 wpa_printf(MSG_ERROR, "No drivers enabled");
5252                 wpa_supplicant_deinit(global);
5253                 return NULL;
5254         }
5255         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5256         if (global->drv_priv == NULL) {
5257                 wpa_supplicant_deinit(global);
5258                 return NULL;
5259         }
5260
5261 #ifdef CONFIG_WIFI_DISPLAY
5262         if (wifi_display_init(global) < 0) {
5263                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5264                 wpa_supplicant_deinit(global);
5265                 return NULL;
5266         }
5267 #endif /* CONFIG_WIFI_DISPLAY */
5268
5269         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5270                                wpas_periodic, global, NULL);
5271
5272         return global;
5273 }
5274
5275
5276 /**
5277  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5278  * @global: Pointer to global data from wpa_supplicant_init()
5279  * Returns: 0 after successful event loop run, -1 on failure
5280  *
5281  * This function starts the main event loop and continues running as long as
5282  * there are any remaining events. In most cases, this function is running as
5283  * long as the %wpa_supplicant process in still in use.
5284  */
5285 int wpa_supplicant_run(struct wpa_global *global)
5286 {
5287         struct wpa_supplicant *wpa_s;
5288
5289         if (global->params.daemonize &&
5290             (wpa_supplicant_daemon(global->params.pid_file) ||
5291              eloop_sock_requeue()))
5292                 return -1;
5293
5294         if (global->params.wait_for_monitor) {
5295                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5296                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5297                                 wpa_supplicant_ctrl_iface_wait(
5298                                         wpa_s->ctrl_iface);
5299         }
5300
5301         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5302         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5303
5304         eloop_run();
5305
5306         return 0;
5307 }
5308
5309
5310 /**
5311  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5312  * @global: Pointer to global data from wpa_supplicant_init()
5313  *
5314  * This function is called to deinitialize %wpa_supplicant and to free all
5315  * allocated resources. Remaining network interfaces will also be removed.
5316  */
5317 void wpa_supplicant_deinit(struct wpa_global *global)
5318 {
5319         int i;
5320
5321         if (global == NULL)
5322                 return;
5323
5324         eloop_cancel_timeout(wpas_periodic, global, NULL);
5325
5326 #ifdef CONFIG_WIFI_DISPLAY
5327         wifi_display_deinit(global);
5328 #endif /* CONFIG_WIFI_DISPLAY */
5329
5330         while (global->ifaces)
5331                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5332
5333         if (global->ctrl_iface)
5334                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5335
5336         wpas_notify_supplicant_deinitialized(global);
5337
5338         eap_peer_unregister_methods();
5339 #ifdef CONFIG_AP
5340         eap_server_unregister_methods();
5341 #endif /* CONFIG_AP */
5342
5343         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5344                 if (!global->drv_priv[i])
5345                         continue;
5346                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5347         }
5348         os_free(global->drv_priv);
5349
5350         random_deinit();
5351
5352         eloop_destroy();
5353
5354         if (global->params.pid_file) {
5355                 os_daemonize_terminate(global->params.pid_file);
5356                 os_free(global->params.pid_file);
5357         }
5358         os_free(global->params.ctrl_interface);
5359         os_free(global->params.ctrl_interface_group);
5360         os_free(global->params.override_driver);
5361         os_free(global->params.override_ctrl_interface);
5362 #ifdef CONFIG_P2P
5363         os_free(global->params.conf_p2p_dev);
5364 #endif /* CONFIG_P2P */
5365
5366         os_free(global->p2p_disallow_freq.range);
5367         os_free(global->p2p_go_avoid_freq.range);
5368         os_free(global->add_psk);
5369
5370         os_free(global);
5371         wpa_debug_close_syslog();
5372         wpa_debug_close_file();
5373         wpa_debug_close_linux_tracing();
5374 }
5375
5376
5377 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5378 {
5379         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5380             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5381                 char country[3];
5382                 country[0] = wpa_s->conf->country[0];
5383                 country[1] = wpa_s->conf->country[1];
5384                 country[2] = '\0';
5385                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5386                         wpa_printf(MSG_ERROR, "Failed to set country code "
5387                                    "'%s'", country);
5388                 }
5389         }
5390
5391         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5392                 wpas_init_ext_pw(wpa_s);
5393
5394         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5395                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5396
5397 #ifdef CONFIG_WPS
5398         wpas_wps_update_config(wpa_s);
5399 #endif /* CONFIG_WPS */
5400         wpas_p2p_update_config(wpa_s);
5401         wpa_s->conf->changed_parameters = 0;
5402 }
5403
5404
5405 void add_freq(int *freqs, int *num_freqs, int freq)
5406 {
5407         int i;
5408
5409         for (i = 0; i < *num_freqs; i++) {
5410                 if (freqs[i] == freq)
5411                         return;
5412         }
5413
5414         freqs[*num_freqs] = freq;
5415         (*num_freqs)++;
5416 }
5417
5418
5419 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5420 {
5421         struct wpa_bss *bss, *cbss;
5422         const int max_freqs = 10;
5423         int *freqs;
5424         int num_freqs = 0;
5425
5426         freqs = os_calloc(max_freqs + 1, sizeof(int));
5427         if (freqs == NULL)
5428                 return NULL;
5429
5430         cbss = wpa_s->current_bss;
5431
5432         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5433                 if (bss == cbss)
5434                         continue;
5435                 if (bss->ssid_len == cbss->ssid_len &&
5436                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5437                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5438                         add_freq(freqs, &num_freqs, bss->freq);
5439                         if (num_freqs == max_freqs)
5440                                 break;
5441                 }
5442         }
5443
5444         if (num_freqs == 0) {
5445                 os_free(freqs);
5446                 freqs = NULL;
5447         }
5448
5449         return freqs;
5450 }
5451
5452
5453 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5454 {
5455         int timeout;
5456         int count;
5457         int *freqs = NULL;
5458
5459         wpas_connect_work_done(wpa_s);
5460
5461         /*
5462          * Remove possible authentication timeout since the connection failed.
5463          */
5464         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5465
5466         /*
5467          * There is no point in blacklisting the AP if this event is
5468          * generated based on local request to disconnect.
5469          */
5470         if (wpa_s->own_disconnect_req) {
5471                 wpa_s->own_disconnect_req = 0;
5472                 wpa_dbg(wpa_s, MSG_DEBUG,
5473                         "Ignore connection failure due to local request to disconnect");
5474                 return;
5475         }
5476         if (wpa_s->disconnected) {
5477                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5478                         "indication since interface has been put into "
5479                         "disconnected state");
5480                 return;
5481         }
5482
5483         /*
5484          * Add the failed BSSID into the blacklist and speed up next scan
5485          * attempt if there could be other APs that could accept association.
5486          * The current blacklist count indicates how many times we have tried
5487          * connecting to this AP and multiple attempts mean that other APs are
5488          * either not available or has already been tried, so that we can start
5489          * increasing the delay here to avoid constant scanning.
5490          */
5491         count = wpa_blacklist_add(wpa_s, bssid);
5492         if (count == 1 && wpa_s->current_bss) {
5493                 /*
5494                  * This BSS was not in the blacklist before. If there is
5495                  * another BSS available for the same ESS, we should try that
5496                  * next. Otherwise, we may as well try this one once more
5497                  * before allowing other, likely worse, ESSes to be considered.
5498                  */
5499                 freqs = get_bss_freqs_in_ess(wpa_s);
5500                 if (freqs) {
5501                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5502                                 "has been seen; try it next");
5503                         wpa_blacklist_add(wpa_s, bssid);
5504                         /*
5505                          * On the next scan, go through only the known channels
5506                          * used in this ESS based on previous scans to speed up
5507                          * common load balancing use case.
5508                          */
5509                         os_free(wpa_s->next_scan_freqs);
5510                         wpa_s->next_scan_freqs = freqs;
5511                 }
5512         }
5513
5514         /*
5515          * Add previous failure count in case the temporary blacklist was
5516          * cleared due to no other BSSes being available.
5517          */
5518         count += wpa_s->extra_blacklist_count;
5519
5520         if (count > 3 && wpa_s->current_ssid) {
5521                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5522                            "consider temporary network disabling");
5523                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5524         }
5525
5526         switch (count) {
5527         case 1:
5528                 timeout = 100;
5529                 break;
5530         case 2:
5531                 timeout = 500;
5532                 break;
5533         case 3:
5534                 timeout = 1000;
5535                 break;
5536         case 4:
5537                 timeout = 5000;
5538                 break;
5539         default:
5540                 timeout = 10000;
5541                 break;
5542         }
5543
5544         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5545                 "ms", count, timeout);
5546
5547         /*
5548          * TODO: if more than one possible AP is available in scan results,
5549          * could try the other ones before requesting a new scan.
5550          */
5551         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5552                                 1000 * (timeout % 1000));
5553 }
5554
5555
5556 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5557 {
5558         return wpa_s->conf->ap_scan == 2 ||
5559                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5560 }
5561
5562
5563 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5564 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5565                                               struct wpa_ssid *ssid,
5566                                               const char *field,
5567                                               const char *value)
5568 {
5569 #ifdef IEEE8021X_EAPOL
5570         struct eap_peer_config *eap = &ssid->eap;
5571
5572         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5573         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5574                               (const u8 *) value, os_strlen(value));
5575
5576         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5577         case WPA_CTRL_REQ_EAP_IDENTITY:
5578                 os_free(eap->identity);
5579                 eap->identity = (u8 *) os_strdup(value);
5580                 eap->identity_len = os_strlen(value);
5581                 eap->pending_req_identity = 0;
5582                 if (ssid == wpa_s->current_ssid)
5583                         wpa_s->reassociate = 1;
5584                 break;
5585         case WPA_CTRL_REQ_EAP_PASSWORD:
5586                 bin_clear_free(eap->password, eap->password_len);
5587                 eap->password = (u8 *) os_strdup(value);
5588                 eap->password_len = os_strlen(value);
5589                 eap->pending_req_password = 0;
5590                 if (ssid == wpa_s->current_ssid)
5591                         wpa_s->reassociate = 1;
5592                 break;
5593         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5594                 bin_clear_free(eap->new_password, eap->new_password_len);
5595                 eap->new_password = (u8 *) os_strdup(value);
5596                 eap->new_password_len = os_strlen(value);
5597                 eap->pending_req_new_password = 0;
5598                 if (ssid == wpa_s->current_ssid)
5599                         wpa_s->reassociate = 1;
5600                 break;
5601         case WPA_CTRL_REQ_EAP_PIN:
5602                 str_clear_free(eap->pin);
5603                 eap->pin = os_strdup(value);
5604                 eap->pending_req_pin = 0;
5605                 if (ssid == wpa_s->current_ssid)
5606                         wpa_s->reassociate = 1;
5607                 break;
5608         case WPA_CTRL_REQ_EAP_OTP:
5609                 bin_clear_free(eap->otp, eap->otp_len);
5610                 eap->otp = (u8 *) os_strdup(value);
5611                 eap->otp_len = os_strlen(value);
5612                 os_free(eap->pending_req_otp);
5613                 eap->pending_req_otp = NULL;
5614                 eap->pending_req_otp_len = 0;
5615                 break;
5616         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5617                 str_clear_free(eap->private_key_passwd);
5618                 eap->private_key_passwd = os_strdup(value);
5619                 eap->pending_req_passphrase = 0;
5620                 if (ssid == wpa_s->current_ssid)
5621                         wpa_s->reassociate = 1;
5622                 break;
5623         case WPA_CTRL_REQ_SIM:
5624                 str_clear_free(eap->external_sim_resp);
5625                 eap->external_sim_resp = os_strdup(value);
5626                 break;
5627         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5628                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5629                         return -1;
5630                 ssid->mem_only_psk = 1;
5631                 if (ssid->passphrase)
5632                         wpa_config_update_psk(ssid);
5633                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5634                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5635                 break;
5636         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5637                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5638                         return -1;
5639                 if (os_strcmp(value, "good") == 0)
5640                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5641                 else if (os_strcmp(value, "bad") == 0)
5642                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5643                 else
5644                         return -1;
5645                 break;
5646         default:
5647                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5648                 return -1;
5649         }
5650
5651         return 0;
5652 #else /* IEEE8021X_EAPOL */
5653         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5654         return -1;
5655 #endif /* IEEE8021X_EAPOL */
5656 }
5657 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5658
5659
5660 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5661 {
5662         int i;
5663         unsigned int drv_enc;
5664
5665         if (wpa_s->p2p_mgmt)
5666                 return 1; /* no normal network profiles on p2p_mgmt interface */
5667
5668         if (ssid == NULL)
5669                 return 1;
5670
5671         if (ssid->disabled)
5672                 return 1;
5673
5674         if (wpa_s->drv_capa_known)
5675                 drv_enc = wpa_s->drv_enc;
5676         else
5677                 drv_enc = (unsigned int) -1;
5678
5679         for (i = 0; i < NUM_WEP_KEYS; i++) {
5680                 size_t len = ssid->wep_key_len[i];
5681                 if (len == 0)
5682                         continue;
5683                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5684                         continue;
5685                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5686                         continue;
5687                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5688                         continue;
5689                 return 1; /* invalid WEP key */
5690         }
5691
5692         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5693             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5694             !ssid->mem_only_psk)
5695                 return 1;
5696
5697         return 0;
5698 }
5699
5700
5701 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5702 {
5703 #ifdef CONFIG_IEEE80211W
5704         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5705                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5706                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5707                         /*
5708                          * Driver does not support BIP -- ignore pmf=1 default
5709                          * since the connection with PMF would fail and the
5710                          * configuration does not require PMF to be enabled.
5711                          */
5712                         return NO_MGMT_FRAME_PROTECTION;
5713                 }
5714
5715                 return wpa_s->conf->pmf;
5716         }
5717
5718         return ssid->ieee80211w;
5719 #else /* CONFIG_IEEE80211W */
5720         return NO_MGMT_FRAME_PROTECTION;
5721 #endif /* CONFIG_IEEE80211W */
5722 }
5723
5724
5725 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5726 {
5727         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5728                 return 1;
5729         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5730                 return 0;
5731         return -1;
5732 }
5733
5734
5735 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5736 {
5737         struct wpa_ssid *ssid = wpa_s->current_ssid;
5738         int dur;
5739         struct os_reltime now;
5740
5741         if (ssid == NULL) {
5742                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5743                            "SSID block");
5744                 return;
5745         }
5746
5747         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5748                 return;
5749
5750         ssid->auth_failures++;
5751
5752 #ifdef CONFIG_P2P
5753         if (ssid->p2p_group &&
5754             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5755                 /*
5756                  * Skip the wait time since there is a short timeout on the
5757                  * connection to a P2P group.
5758                  */
5759                 return;
5760         }
5761 #endif /* CONFIG_P2P */
5762
5763         if (ssid->auth_failures > 50)
5764                 dur = 300;
5765         else if (ssid->auth_failures > 10)
5766                 dur = 120;
5767         else if (ssid->auth_failures > 5)
5768                 dur = 90;
5769         else if (ssid->auth_failures > 3)
5770                 dur = 60;
5771         else if (ssid->auth_failures > 2)
5772                 dur = 30;
5773         else if (ssid->auth_failures > 1)
5774                 dur = 20;
5775         else
5776                 dur = 10;
5777
5778         if (ssid->auth_failures > 1 &&
5779             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5780                 dur += os_random() % (ssid->auth_failures * 10);
5781
5782         os_get_reltime(&now);
5783         if (now.sec + dur <= ssid->disabled_until.sec)
5784                 return;
5785
5786         ssid->disabled_until.sec = now.sec + dur;
5787
5788         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5789                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5790                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5791                 ssid->auth_failures, dur, reason);
5792 }
5793
5794
5795 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5796                               struct wpa_ssid *ssid, int clear_failures)
5797 {
5798         if (ssid == NULL)
5799                 return;
5800
5801         if (ssid->disabled_until.sec) {
5802                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5803                         "id=%d ssid=\"%s\"",
5804                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5805         }
5806         ssid->disabled_until.sec = 0;
5807         ssid->disabled_until.usec = 0;
5808         if (clear_failures)
5809                 ssid->auth_failures = 0;
5810 }
5811
5812
5813 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5814 {
5815         size_t i;
5816
5817         if (wpa_s->disallow_aps_bssid == NULL)
5818                 return 0;
5819
5820         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5821                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5822                               bssid, ETH_ALEN) == 0)
5823                         return 1;
5824         }
5825
5826         return 0;
5827 }
5828
5829
5830 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5831                     size_t ssid_len)
5832 {
5833         size_t i;
5834
5835         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5836                 return 0;
5837
5838         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5839                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5840                 if (ssid_len == s->ssid_len &&
5841                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5842                         return 1;
5843         }
5844
5845         return 0;
5846 }
5847
5848
5849 /**
5850  * wpas_request_connection - Request a new connection
5851  * @wpa_s: Pointer to the network interface
5852  *
5853  * This function is used to request a new connection to be found. It will mark
5854  * the interface to allow reassociation and request a new scan to find a
5855  * suitable network to connect to.
5856  */
5857 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5858 {
5859         wpa_s->normal_scans = 0;
5860         wpa_s->scan_req = NORMAL_SCAN_REQ;
5861         wpa_supplicant_reinit_autoscan(wpa_s);
5862         wpa_s->extra_blacklist_count = 0;
5863         wpa_s->disconnected = 0;
5864         wpa_s->reassociate = 1;
5865
5866         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5867                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5868         else
5869                 wpa_s->reattach = 0;
5870 }
5871
5872
5873 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5874                     struct wpa_used_freq_data *freqs_data,
5875                     unsigned int len)
5876 {
5877         unsigned int i;
5878
5879         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5880                 len, title);
5881         for (i = 0; i < len; i++) {
5882                 struct wpa_used_freq_data *cur = &freqs_data[i];
5883                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5884                         i, cur->freq, cur->flags);
5885         }
5886 }
5887
5888
5889 /*
5890  * Find the operating frequencies of any of the virtual interfaces that
5891  * are using the same radio as the current interface, and in addition, get
5892  * information about the interface types that are using the frequency.
5893  */
5894 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5895                                 struct wpa_used_freq_data *freqs_data,
5896                                 unsigned int len)
5897 {
5898         struct wpa_supplicant *ifs;
5899         u8 bssid[ETH_ALEN];
5900         int freq;
5901         unsigned int idx = 0, i;
5902
5903         wpa_dbg(wpa_s, MSG_DEBUG,
5904                 "Determining shared radio frequencies (max len %u)", len);
5905         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5906
5907         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5908                          radio_list) {
5909                 if (idx == len)
5910                         break;
5911
5912                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5913                         continue;
5914
5915                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5916                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5917                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5918                         freq = ifs->current_ssid->frequency;
5919                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5920                         freq = ifs->assoc_freq;
5921                 else
5922                         continue;
5923
5924                 /* Hold only distinct freqs */
5925                 for (i = 0; i < idx; i++)
5926                         if (freqs_data[i].freq == freq)
5927                                 break;
5928
5929                 if (i == idx)
5930                         freqs_data[idx++].freq = freq;
5931
5932                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5933                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5934                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5935                                 WPA_FREQ_USED_BY_INFRA_STATION;
5936                 }
5937         }
5938
5939         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5940         return idx;
5941 }
5942
5943
5944 /*
5945  * Find the operating frequencies of any of the virtual interfaces that
5946  * are using the same radio as the current interface.
5947  */
5948 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5949                            int *freq_array, unsigned int len)
5950 {
5951         struct wpa_used_freq_data *freqs_data;
5952         int num, i;
5953
5954         os_memset(freq_array, 0, sizeof(int) * len);
5955
5956         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5957         if (!freqs_data)
5958                 return -1;
5959
5960         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5961         for (i = 0; i < num; i++)
5962                 freq_array[i] = freqs_data[i].freq;
5963
5964         os_free(freqs_data);
5965
5966         return num;
5967 }
5968
5969
5970 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5971 {
5972         struct rrm_data *rrm = data;
5973
5974         if (!rrm->notify_neighbor_rep) {
5975                 wpa_printf(MSG_ERROR,
5976                            "RRM: Unexpected neighbor report timeout");
5977                 return;
5978         }
5979
5980         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5981         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5982
5983         rrm->notify_neighbor_rep = NULL;
5984         rrm->neighbor_rep_cb_ctx = NULL;
5985 }
5986
5987
5988 /*
5989  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5990  * @wpa_s: Pointer to wpa_supplicant
5991  */
5992 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5993 {
5994         wpa_s->rrm.rrm_used = 0;
5995
5996         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5997                              NULL);
5998         if (wpa_s->rrm.notify_neighbor_rep)
5999                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6000         wpa_s->rrm.next_neighbor_rep_token = 1;
6001 }
6002
6003
6004 /*
6005  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6006  * @wpa_s: Pointer to wpa_supplicant
6007  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6008  * @report_len: Length of neighbor report buffer
6009  */
6010 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6011                                    const u8 *report, size_t report_len)
6012 {
6013         struct wpabuf *neighbor_rep;
6014
6015         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6016         if (report_len < 1)
6017                 return;
6018
6019         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6020                 wpa_printf(MSG_DEBUG,
6021                            "RRM: Discarding neighbor report with token %d (expected %d)",
6022                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6023                 return;
6024         }
6025
6026         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6027                              NULL);
6028
6029         if (!wpa_s->rrm.notify_neighbor_rep) {
6030                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6031                 return;
6032         }
6033
6034         /* skipping the first byte, which is only an id (dialog token) */
6035         neighbor_rep = wpabuf_alloc(report_len - 1);
6036         if (neighbor_rep == NULL)
6037                 return;
6038         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6039         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6040                    report[0]);
6041         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6042                                        neighbor_rep);
6043         wpa_s->rrm.notify_neighbor_rep = NULL;
6044         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6045 }
6046
6047
6048 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6049 /* Workaround different, undefined for Windows, error codes used here */
6050 #define ENOTCONN -1
6051 #define EOPNOTSUPP -1
6052 #define ECANCELED -1
6053 #endif
6054
6055 /**
6056  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6057  * @wpa_s: Pointer to wpa_supplicant
6058  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6059  *        is sent in the request.
6060  * @cb: Callback function to be called once the requested report arrives, or
6061  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6062  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6063  *      the requester's responsibility to free it.
6064  *      In the latter case NULL will be sent in 'neighbor_rep'.
6065  * @cb_ctx: Context value to send the callback function
6066  * Returns: 0 in case of success, negative error code otherwise
6067  *
6068  * In case there is a previous request which has not been answered yet, the
6069  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6070  * Request must contain a callback function.
6071  */
6072 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6073                                        const struct wpa_ssid *ssid,
6074                                        void (*cb)(void *ctx,
6075                                                   struct wpabuf *neighbor_rep),
6076                                        void *cb_ctx)
6077 {
6078         struct wpabuf *buf;
6079         const u8 *rrm_ie;
6080
6081         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6082                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6083                 return -ENOTCONN;
6084         }
6085
6086         if (!wpa_s->rrm.rrm_used) {
6087                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6088                 return -EOPNOTSUPP;
6089         }
6090
6091         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6092                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6093         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6094             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6095                 wpa_printf(MSG_DEBUG,
6096                            "RRM: No network support for Neighbor Report.");
6097                 return -EOPNOTSUPP;
6098         }
6099
6100         if (!cb) {
6101                 wpa_printf(MSG_DEBUG,
6102                            "RRM: Neighbor Report request must provide a callback.");
6103                 return -EINVAL;
6104         }
6105
6106         /* Refuse if there's a live request */
6107         if (wpa_s->rrm.notify_neighbor_rep) {
6108                 wpa_printf(MSG_DEBUG,
6109                            "RRM: Currently handling previous Neighbor Report.");
6110                 return -EBUSY;
6111         }
6112
6113         /* 3 = action category + action code + dialog token */
6114         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6115         if (buf == NULL) {
6116                 wpa_printf(MSG_DEBUG,
6117                            "RRM: Failed to allocate Neighbor Report Request");
6118                 return -ENOMEM;
6119         }
6120
6121         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6122                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6123                    wpa_s->rrm.next_neighbor_rep_token);
6124
6125         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6126         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6127         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6128         if (ssid) {
6129                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6130                 wpabuf_put_u8(buf, ssid->ssid_len);
6131                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6132         }
6133
6134         wpa_s->rrm.next_neighbor_rep_token++;
6135
6136         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6137                                 wpa_s->own_addr, wpa_s->bssid,
6138                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6139                 wpa_printf(MSG_DEBUG,
6140                            "RRM: Failed to send Neighbor Report Request");
6141                 wpabuf_free(buf);
6142                 return -ECANCELED;
6143         }
6144
6145         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6146         wpa_s->rrm.notify_neighbor_rep = cb;
6147         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6148                                wpas_rrm_neighbor_rep_timeout_handler,
6149                                &wpa_s->rrm, NULL);
6150
6151         wpabuf_free(buf);
6152         return 0;
6153 }
6154
6155
6156 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6157                                               const u8 *src,
6158                                               const u8 *frame, size_t len,
6159                                               int rssi)
6160 {
6161         struct wpabuf *buf;
6162         const struct rrm_link_measurement_request *req;
6163         struct rrm_link_measurement_report report;
6164
6165         if (wpa_s->wpa_state != WPA_COMPLETED) {
6166                 wpa_printf(MSG_INFO,
6167                            "RRM: Ignoring link measurement request. Not associated");
6168                 return;
6169         }
6170
6171         if (!wpa_s->rrm.rrm_used) {
6172                 wpa_printf(MSG_INFO,
6173                            "RRM: Ignoring link measurement request. Not RRM network");
6174                 return;
6175         }
6176
6177         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6178                 wpa_printf(MSG_INFO,
6179                            "RRM: Measurement report failed. TX power insertion not supported");
6180                 return;
6181         }
6182
6183         req = (const struct rrm_link_measurement_request *) frame;
6184         if (len < sizeof(*req)) {
6185                 wpa_printf(MSG_INFO,
6186                            "RRM: Link measurement report failed. Request too short");
6187                 return;
6188         }
6189
6190         os_memset(&report, 0, sizeof(report));
6191         report.tpc.eid = WLAN_EID_TPC_REPORT;
6192         report.tpc.len = 2;
6193         report.rsni = 255; /* 255 indicates that RSNI is not available */
6194         report.dialog_token = req->dialog_token;
6195
6196         /*
6197          * It's possible to estimate RCPI based on RSSI in dBm. This
6198          * calculation will not reflect the correct value for high rates,
6199          * but it's good enough for Action frames which are transmitted
6200          * with up to 24 Mbps rates.
6201          */
6202         if (!rssi)
6203                 report.rcpi = 255; /* not available */
6204         else if (rssi < -110)
6205                 report.rcpi = 0;
6206         else if (rssi > 0)
6207                 report.rcpi = 220;
6208         else
6209                 report.rcpi = (rssi + 110) * 2;
6210
6211         /* action_category + action_code */
6212         buf = wpabuf_alloc(2 + sizeof(report));
6213         if (buf == NULL) {
6214                 wpa_printf(MSG_ERROR,
6215                            "RRM: Link measurement report failed. Buffer allocation failed");
6216                 return;
6217         }
6218
6219         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6220         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6221         wpabuf_put_data(buf, &report, sizeof(report));
6222         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6223                     wpabuf_head(buf), wpabuf_len(buf));
6224
6225         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6226                                 wpa_s->own_addr, wpa_s->bssid,
6227                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6228                 wpa_printf(MSG_ERROR,
6229                            "RRM: Link measurement report failed. Send action failed");
6230         }
6231         wpabuf_free(buf);
6232 }
6233
6234
6235 struct wpa_supplicant *
6236 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6237 {
6238         switch (frame) {
6239 #ifdef CONFIG_P2P
6240         case VENDOR_ELEM_PROBE_REQ_P2P:
6241         case VENDOR_ELEM_PROBE_RESP_P2P:
6242         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6243         case VENDOR_ELEM_BEACON_P2P_GO:
6244         case VENDOR_ELEM_P2P_PD_REQ:
6245         case VENDOR_ELEM_P2P_PD_RESP:
6246         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6247         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6248         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6249         case VENDOR_ELEM_P2P_INV_REQ:
6250         case VENDOR_ELEM_P2P_INV_RESP:
6251         case VENDOR_ELEM_P2P_ASSOC_REQ:
6252         case VENDOR_ELEM_P2P_ASSOC_RESP:
6253                 return wpa_s->p2pdev;
6254 #endif /* CONFIG_P2P */
6255         default:
6256                 return wpa_s;
6257         }
6258 }
6259
6260
6261 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6262 {
6263         unsigned int i;
6264         char buf[30];
6265
6266         wpa_printf(MSG_DEBUG, "Update vendor elements");
6267
6268         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6269                 if (wpa_s->vendor_elem[i]) {
6270                         int res;
6271
6272                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6273                         if (!os_snprintf_error(sizeof(buf), res)) {
6274                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6275                                                 wpa_s->vendor_elem[i]);
6276                         }
6277                 }
6278         }
6279
6280 #ifdef CONFIG_P2P
6281         if (wpa_s->parent == wpa_s &&
6282             wpa_s->global->p2p &&
6283             !wpa_s->global->p2p_disabled)
6284                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6285 #endif /* CONFIG_P2P */
6286 }
6287
6288
6289 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6290                             const u8 *elem, size_t len)
6291 {
6292         u8 *ie, *end;
6293
6294         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6295         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6296
6297         for (; ie + 1 < end; ie += 2 + ie[1]) {
6298                 if (ie + len > end)
6299                         break;
6300                 if (os_memcmp(ie, elem, len) != 0)
6301                         continue;
6302
6303                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6304                         wpabuf_free(wpa_s->vendor_elem[frame]);
6305                         wpa_s->vendor_elem[frame] = NULL;
6306                 } else {
6307                         os_memmove(ie, ie + len, end - (ie + len));
6308                         wpa_s->vendor_elem[frame]->used -= len;
6309                 }
6310                 wpas_vendor_elem_update(wpa_s);
6311                 return 0;
6312         }
6313
6314         return -1;
6315 }
6316
6317
6318 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6319                                    u16 num_modes, enum hostapd_hw_mode mode)
6320 {
6321         u16 i;
6322
6323         for (i = 0; i < num_modes; i++) {
6324                 if (modes[i].mode == mode)
6325                         return &modes[i];
6326         }
6327
6328         return NULL;
6329 }
6330
6331
6332 static struct
6333 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6334                                                  const u8 *bssid)
6335 {
6336         struct wpa_bss_tmp_disallowed *bss;
6337
6338         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6339                          struct wpa_bss_tmp_disallowed, list) {
6340                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6341                         return bss;
6342         }
6343
6344         return NULL;
6345 }
6346
6347
6348 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6349                           unsigned int sec)
6350 {
6351         struct wpa_bss_tmp_disallowed *bss;
6352         struct os_reltime until;
6353
6354         os_get_reltime(&until);
6355         until.sec += sec;
6356
6357         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6358         if (bss) {
6359                 bss->disallowed_until = until;
6360                 return;
6361         }
6362
6363         bss = os_malloc(sizeof(*bss));
6364         if (!bss) {
6365                 wpa_printf(MSG_DEBUG,
6366                            "Failed to allocate memory for temp disallow BSS");
6367                 return;
6368         }
6369
6370         bss->disallowed_until = until;
6371         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6372         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6373 }
6374
6375
6376 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6377 {
6378         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6379         struct os_reltime now, age;
6380
6381         os_get_reltime(&now);
6382
6383         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6384                          struct wpa_bss_tmp_disallowed, list) {
6385                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6386                         /* This BSS is not disallowed anymore */
6387                         dl_list_del(&tmp->list);
6388                         os_free(tmp);
6389                         continue;
6390                 }
6391                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6392                         bss = tmp;
6393                         break;
6394                 }
6395         }
6396         if (!bss)
6397                 return 0;
6398
6399         os_reltime_sub(&bss->disallowed_until, &now, &age);
6400         wpa_printf(MSG_DEBUG,
6401                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6402                    MAC2STR(bss->bssid), age.sec, age.usec);
6403         return 1;
6404 }