wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "blacklist.h"
  39 #include "wpas_glue.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "sme.h"
  43 #include "gas_query.h"
  44 #include "ap.h"
  45 #include "p2p_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bgscan.h"
  49 #include "autoscan.h"
  50 #include "bss.h"
  51 #include "scan.h"
  52 #include "offchannel.h"
  53 #include "hs20_supplicant.h"
  54 #include "wnm_sta.h"
  55 #include "wpas_kay.h"
  56 #include "mesh.h"
  57
  58 const char *wpa_supplicant_version =
  59 "wpa_supplicant v" VERSION_STR "\n"
  60 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  61
  62 const char *wpa_supplicant_license =
  63 "This software may be distributed under the terms of the BSD license.\n"
  64 "See README for more details.\n"
  65 #ifdef EAP_TLS_OPENSSL
  66 "\nThis product includes software developed by the OpenSSL Project\n"
  67 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  68 #endif /* EAP_TLS_OPENSSL */
  69 ;
  70
  71 #ifndef CONFIG_NO_STDOUT_DEBUG
  72 /* Long text divided into parts in order to fit in C89 strings size limits. */
  73 const char *wpa_supplicant_full_license1 =
  74 "";
  75 const char *wpa_supplicant_full_license2 =
  76 "This software may be distributed under the terms of the BSD license.\n"
  77 "\n"
  78 "Redistribution and use in source and binary forms, with or without\n"
  79 "modification, are permitted provided that the following conditions are\n"
  80 "met:\n"
  81 "\n";
  82 const char *wpa_supplicant_full_license3 =
  83 "1. Redistributions of source code must retain the above copyright\n"
  84 "   notice, this list of conditions and the following disclaimer.\n"
  85 "\n"
  86 "2. Redistributions in binary form must reproduce the above copyright\n"
  87 "   notice, this list of conditions and the following disclaimer in the\n"
  88 "   documentation and/or other materials provided with the distribution.\n"
  89 "\n";
  90 const char *wpa_supplicant_full_license4 =
  91 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  92 "   names of its contributors may be used to endorse or promote products\n"
  93 "   derived from this software without specific prior written permission.\n"
  94 "\n"
  95 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  96 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  97 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  98 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  99 const char *wpa_supplicant_full_license5 =
 100 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 101 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 102 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 103 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 104 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 105 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 106 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 107 "\n";
 108 #endif /* CONFIG_NO_STDOUT_DEBUG */
 109
 110 /* Configure default/group WEP keys for static WEP */
 111 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 112 {
 113         int i, set = 0;
 114
 115         for (i = 0; i < NUM_WEP_KEYS; i++) {
 116                 if (ssid->wep_key_len[i] == 0)
 117                         continue;
 118
 119                 set = 1;
 120                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 121                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 122                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 123         }
 124
 125         return set;
 126 }
 127
 128
 129 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 130                                     struct wpa_ssid *ssid)
 131 {
 132         u8 key[32];
 133         size_t keylen;
 134         enum wpa_alg alg;
 135         u8 seq[6] = { 0 };
 136         int ret;
 137
 138         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 139          * sending unicast and multicast packets. */
 140
 141         if (ssid->mode != WPAS_MODE_IBSS) {
 142                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 143                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 144                 return -1;
 145         }
 146
 147         if (!ssid->psk_set) {
 148                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 149                         "WPA-None");
 150                 return -1;
 151         }
 152
 153         switch (wpa_s->group_cipher) {
 154         case WPA_CIPHER_CCMP:
 155                 os_memcpy(key, ssid->psk, 16);
 156                 keylen = 16;
 157                 alg = WPA_ALG_CCMP;
 158                 break;
 159         case WPA_CIPHER_GCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_GCMP;
 163                 break;
 164         case WPA_CIPHER_TKIP:
 165                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 166                 os_memcpy(key, ssid->psk, 16 + 8);
 167                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 168                 keylen = 32;
 169                 alg = WPA_ALG_TKIP;
 170                 break;
 171         default:
 172                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 173                         "WPA-None", wpa_s->group_cipher);
 174                 return -1;
 175         }
 176
 177         /* TODO: should actually remember the previously used seq#, both for TX
 178          * and RX from each STA.. */
 179
 180         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 181         os_memset(key, 0, sizeof(key));
 182         return ret;
 183 }
 184
 185
 186 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 187 {
 188         struct wpa_supplicant *wpa_s = eloop_ctx;
 189         const u8 *bssid = wpa_s->bssid;
 190         if (is_zero_ether_addr(bssid))
 191                 bssid = wpa_s->pending_bssid;
 192         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 193                 MAC2STR(bssid));
 194         wpa_blacklist_add(wpa_s, bssid);
 195         wpa_sm_notify_disassoc(wpa_s->wpa);
 196         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 197         wpa_s->reassociate = 1;
 198
 199         /*
 200          * If we timed out, the AP or the local radio may be busy.
 201          * So, wait a second until scanning again.
 202          */
 203         wpa_supplicant_req_scan(wpa_s, 1, 0);
 204 }
 205
 206
 207 /**
 208  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 209  * @wpa_s: Pointer to wpa_supplicant data
 210  * @sec: Number of seconds after which to time out authentication
 211  * @usec: Number of microseconds after which to time out authentication
 212  *
 213  * This function is used to schedule a timeout for the current authentication
 214  * attempt.
 215  */
 216 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 217                                      int sec, int usec)
 218 {
 219         if (wpa_s->conf->ap_scan == 0 &&
 220             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 221                 return;
 222
 223         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 224                 "%d usec", sec, usec);
 225         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 226         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 227 }
 228
 229
 230 /**
 231  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 232  * @wpa_s: Pointer to wpa_supplicant data
 233  *
 234  * This function is used to cancel authentication timeout scheduled with
 235  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 236  * been completed.
 237  */
 238 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 239 {
 240         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 241         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 242         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 243 }
 244
 245
 246 /**
 247  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 248  * @wpa_s: Pointer to wpa_supplicant data
 249  *
 250  * This function is used to configure EAPOL state machine based on the selected
 251  * authentication mode.
 252  */
 253 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 254 {
 255 #ifdef IEEE8021X_EAPOL
 256         struct eapol_config eapol_conf;
 257         struct wpa_ssid *ssid = wpa_s->current_ssid;
 258
 259 #ifdef CONFIG_IBSS_RSN
 260         if (ssid->mode == WPAS_MODE_IBSS &&
 261             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 263                 /*
 264                  * RSN IBSS authentication is per-STA and we can disable the
 265                  * per-BSSID EAPOL authentication.
 266                  */
 267                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 268                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 269                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 270                 return;
 271         }
 272 #endif /* CONFIG_IBSS_RSN */
 273
 274         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 275         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 276
 277         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 278             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 279                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 280         else
 281                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 282
 283         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 285                 eapol_conf.accept_802_1x_keys = 1;
 286                 eapol_conf.required_keys = 0;
 287                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 288                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 289                 }
 290                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 291                         eapol_conf.required_keys |=
 292                                 EAPOL_REQUIRE_KEY_BROADCAST;
 293                 }
 294
 295                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 296                         eapol_conf.required_keys = 0;
 297         }
 298         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 299         eapol_conf.workaround = ssid->eap_workaround;
 300         eapol_conf.eap_disabled =
 301                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 302                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 304         eapol_conf.external_sim = wpa_s->conf->external_sim;
 305
 306 #ifdef CONFIG_WPS
 307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 308                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 309                 if (wpa_s->current_bss) {
 310                         struct wpabuf *ie;
 311                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 312                                                          WPS_IE_VENDOR_TYPE);
 313                         if (ie) {
 314                                 if (wps_is_20(ie))
 315                                         eapol_conf.wps |=
 316                                                 EAPOL_PEER_IS_WPS20_AP;
 317                                 wpabuf_free(ie);
 318                         }
 319                 }
 320         }
 321 #endif /* CONFIG_WPS */
 322
 323         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 324
 325         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 326 #endif /* IEEE8021X_EAPOL */
 327 }
 328
 329
 330 /**
 331  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 332  * @wpa_s: Pointer to wpa_supplicant data
 333  * @ssid: Configuration data for the network
 334  *
 335  * This function is used to configure WPA state machine and related parameters
 336  * to a mode where WPA is not enabled. This is called as part of the
 337  * authentication configuration when the selected network does not use WPA.
 338  */
 339 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 340                                        struct wpa_ssid *ssid)
 341 {
 342         int i;
 343
 344         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 346         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 347                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 348         else
 349                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 350         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 351         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 353         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 354         wpa_s->group_cipher = WPA_CIPHER_NONE;
 355         wpa_s->mgmt_group_cipher = 0;
 356
 357         for (i = 0; i < NUM_WEP_KEYS; i++) {
 358                 if (ssid->wep_key_len[i] > 5) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 361                         break;
 362                 } else if (ssid->wep_key_len[i] > 0) {
 363                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 364                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 365                         break;
 366                 }
 367         }
 368
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 372                          wpa_s->pairwise_cipher);
 373         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 374 #ifdef CONFIG_IEEE80211W
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 376                          wpa_s->mgmt_group_cipher);
 377 #endif /* CONFIG_IEEE80211W */
 378
 379         pmksa_cache_clear_current(wpa_s->wpa);
 380 }
 381
 382
 383 void free_hw_features(struct wpa_supplicant *wpa_s)
 384 {
 385         int i;
 386         if (wpa_s->hw.modes == NULL)
 387                 return;
 388
 389         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 390                 os_free(wpa_s->hw.modes[i].channels);
 391                 os_free(wpa_s->hw.modes[i].rates);
 392         }
 393
 394         os_free(wpa_s->hw.modes);
 395         wpa_s->hw.modes = NULL;
 396 }
 397
 398
 399 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 400 {
 401         int i;
 402
 403         bgscan_deinit(wpa_s);
 404         autoscan_deinit(wpa_s);
 405         scard_deinit(wpa_s->scard);
 406         wpa_s->scard = NULL;
 407         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 408         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 409         l2_packet_deinit(wpa_s->l2);
 410         wpa_s->l2 = NULL;
 411         if (wpa_s->l2_br) {
 412                 l2_packet_deinit(wpa_s->l2_br);
 413                 wpa_s->l2_br = NULL;
 414         }
 415 #ifdef CONFIG_TESTING_OPTIONS
 416         l2_packet_deinit(wpa_s->l2_test);
 417         wpa_s->l2_test = NULL;
 418 #endif /* CONFIG_TESTING_OPTIONS */
 419
 420         if (wpa_s->conf != NULL) {
 421                 struct wpa_ssid *ssid;
 422                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 423                         wpas_notify_network_removed(wpa_s, ssid);
 424         }
 425
 426         os_free(wpa_s->confname);
 427         wpa_s->confname = NULL;
 428
 429         os_free(wpa_s->confanother);
 430         wpa_s->confanother = NULL;
 431
 432         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 433         eapol_sm_deinit(wpa_s->eapol);
 434         wpa_s->eapol = NULL;
 435
 436         rsn_preauth_deinit(wpa_s->wpa);
 437
 438 #ifdef CONFIG_TDLS
 439         wpa_tdls_deinit(wpa_s->wpa);
 440 #endif /* CONFIG_TDLS */
 441
 442         wmm_ac_clear_saved_tspecs(wpa_s);
 443         pmksa_candidate_free(wpa_s->wpa);
 444         wpa_sm_deinit(wpa_s->wpa);
 445         wpa_s->wpa = NULL;
 446         wpa_blacklist_clear(wpa_s);
 447
 448         wpa_bss_deinit(wpa_s);
 449
 450         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 451         wpa_supplicant_cancel_scan(wpa_s);
 452         wpa_supplicant_cancel_auth_timeout(wpa_s);
 453         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 454 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 455         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 456                              wpa_s, NULL);
 457 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 458
 459         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 460
 461         wpas_wps_deinit(wpa_s);
 462
 463         wpabuf_free(wpa_s->pending_eapol_rx);
 464         wpa_s->pending_eapol_rx = NULL;
 465
 466 #ifdef CONFIG_IBSS_RSN
 467         ibss_rsn_deinit(wpa_s->ibss_rsn);
 468         wpa_s->ibss_rsn = NULL;
 469 #endif /* CONFIG_IBSS_RSN */
 470
 471         sme_deinit(wpa_s);
 472
 473 #ifdef CONFIG_AP
 474         wpa_supplicant_ap_deinit(wpa_s);
 475 #endif /* CONFIG_AP */
 476
 477         wpas_p2p_deinit(wpa_s);
 478
 479 #ifdef CONFIG_OFFCHANNEL
 480         offchannel_deinit(wpa_s);
 481 #endif /* CONFIG_OFFCHANNEL */
 482
 483         wpa_supplicant_cancel_sched_scan(wpa_s);
 484
 485         os_free(wpa_s->next_scan_freqs);
 486         wpa_s->next_scan_freqs = NULL;
 487
 488         os_free(wpa_s->manual_scan_freqs);
 489         wpa_s->manual_scan_freqs = NULL;
 490
 491         os_free(wpa_s->manual_sched_scan_freqs);
 492         wpa_s->manual_sched_scan_freqs = NULL;
 493
 494         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 495
 496         gas_query_deinit(wpa_s->gas);
 497         wpa_s->gas = NULL;
 498
 499         free_hw_features(wpa_s);
 500
 501         ieee802_1x_dealloc_kay_sm(wpa_s);
 502
 503         os_free(wpa_s->bssid_filter);
 504         wpa_s->bssid_filter = NULL;
 505
 506         os_free(wpa_s->disallow_aps_bssid);
 507         wpa_s->disallow_aps_bssid = NULL;
 508         os_free(wpa_s->disallow_aps_ssid);
 509         wpa_s->disallow_aps_ssid = NULL;
 510
 511         wnm_bss_keep_alive_deinit(wpa_s);
 512 #ifdef CONFIG_WNM
 513         wnm_deallocate_memory(wpa_s);
 514 #endif /* CONFIG_WNM */
 515
 516         ext_password_deinit(wpa_s->ext_pw);
 517         wpa_s->ext_pw = NULL;
 518
 519         wpabuf_free(wpa_s->last_gas_resp);
 520         wpa_s->last_gas_resp = NULL;
 521         wpabuf_free(wpa_s->prev_gas_resp);
 522         wpa_s->prev_gas_resp = NULL;
 523
 524         os_free(wpa_s->last_scan_res);
 525         wpa_s->last_scan_res = NULL;
 526
 527 #ifdef CONFIG_HS20
 528         hs20_deinit(wpa_s);
 529 #endif /* CONFIG_HS20 */
 530
 531         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 532                 wpabuf_free(wpa_s->vendor_elem[i]);
 533                 wpa_s->vendor_elem[i] = NULL;
 534         }
 535
 536         wmm_ac_notify_disassoc(wpa_s);
 537 }
 538
 539
 540 /**
 541  * wpa_clear_keys - Clear keys configured for the driver
 542  * @wpa_s: Pointer to wpa_supplicant data
 543  * @addr: Previously used BSSID or %NULL if not available
 544  *
 545  * This function clears the encryption keys that has been previously configured
 546  * for the driver.
 547  */
 548 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 549 {
 550         int i, max;
 551
 552 #ifdef CONFIG_IEEE80211W
 553         max = 6;
 554 #else /* CONFIG_IEEE80211W */
 555         max = 4;
 556 #endif /* CONFIG_IEEE80211W */
 557
 558         /* MLME-DELETEKEYS.request */
 559         for (i = 0; i < max; i++) {
 560                 if (wpa_s->keys_cleared & BIT(i))
 561                         continue;
 562                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 563                                 NULL, 0);
 564         }
 565         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 566             !is_zero_ether_addr(addr)) {
 567                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 568                                 0);
 569                 /* MLME-SETPROTECTION.request(None) */
 570                 wpa_drv_mlme_setprotection(
 571                         wpa_s, addr,
 572                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 573                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 574         }
 575         wpa_s->keys_cleared = (u32) -1;
 576 }
 577
 578
 579 /**
 580  * wpa_supplicant_state_txt - Get the connection state name as a text string
 581  * @state: State (wpa_state; WPA_*)
 582  * Returns: The state name as a printable text string
 583  */
 584 const char * wpa_supplicant_state_txt(enum wpa_states state)
 585 {
 586         switch (state) {
 587         case WPA_DISCONNECTED:
 588                 return "DISCONNECTED";
 589         case WPA_INACTIVE:
 590                 return "INACTIVE";
 591         case WPA_INTERFACE_DISABLED:
 592                 return "INTERFACE_DISABLED";
 593         case WPA_SCANNING:
 594                 return "SCANNING";
 595         case WPA_AUTHENTICATING:
 596                 return "AUTHENTICATING";
 597         case WPA_ASSOCIATING:
 598                 return "ASSOCIATING";
 599         case WPA_ASSOCIATED:
 600                 return "ASSOCIATED";
 601         case WPA_4WAY_HANDSHAKE:
 602                 return "4WAY_HANDSHAKE";
 603         case WPA_GROUP_HANDSHAKE:
 604                 return "GROUP_HANDSHAKE";
 605         case WPA_COMPLETED:
 606                 return "COMPLETED";
 607         default:
 608                 return "UNKNOWN";
 609         }
 610 }
 611
 612
 613 #ifdef CONFIG_BGSCAN
 614
 615 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 616 {
 617         const char *name;
 618
 619         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 620                 name = wpa_s->current_ssid->bgscan;
 621         else
 622                 name = wpa_s->conf->bgscan;
 623         if (name == NULL || name[0] == '\0')
 624                 return;
 625         if (wpas_driver_bss_selection(wpa_s))
 626                 return;
 627         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 628                 return;
 629 #ifdef CONFIG_P2P
 630         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 631                 return;
 632 #endif /* CONFIG_P2P */
 633
 634         bgscan_deinit(wpa_s);
 635         if (wpa_s->current_ssid) {
 636                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 637                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 638                                 "bgscan");
 639                         /*
 640                          * Live without bgscan; it is only used as a roaming
 641                          * optimization, so the initial connection is not
 642                          * affected.
 643                          */
 644                 } else {
 645                         struct wpa_scan_results *scan_res;
 646                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 647                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 648                                                                    0);
 649                         if (scan_res) {
 650                                 bgscan_notify_scan(wpa_s, scan_res);
 651                                 wpa_scan_results_free(scan_res);
 652                         }
 653                 }
 654         } else
 655                 wpa_s->bgscan_ssid = NULL;
 656 }
 657
 658
 659 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 660 {
 661         if (wpa_s->bgscan_ssid != NULL) {
 662                 bgscan_deinit(wpa_s);
 663                 wpa_s->bgscan_ssid = NULL;
 664         }
 665 }
 666
 667 #endif /* CONFIG_BGSCAN */
 668
 669
 670 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 671 {
 672         if (autoscan_init(wpa_s, 0))
 673                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 674 }
 675
 676
 677 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 678 {
 679         autoscan_deinit(wpa_s);
 680 }
 681
 682
 683 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 684 {
 685         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 686             wpa_s->wpa_state == WPA_SCANNING) {
 687                 autoscan_deinit(wpa_s);
 688                 wpa_supplicant_start_autoscan(wpa_s);
 689         }
 690 }
 691
 692
 693 /**
 694  * wpa_supplicant_set_state - Set current connection state
 695  * @wpa_s: Pointer to wpa_supplicant data
 696  * @state: The new connection state
 697  *
 698  * This function is called whenever the connection state changes, e.g.,
 699  * association is completed for WPA/WPA2 4-Way Handshake is started.
 700  */
 701 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 702                               enum wpa_states state)
 703 {
 704         enum wpa_states old_state = wpa_s->wpa_state;
 705
 706         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 707                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 708                 wpa_supplicant_state_txt(state));
 709
 710         if (state == WPA_INTERFACE_DISABLED) {
 711                 /* Assure normal scan when interface is restored */
 712                 wpa_s->normal_scans = 0;
 713         }
 714
 715         if (state == WPA_COMPLETED) {
 716                 wpas_connect_work_done(wpa_s);
 717                 /* Reinitialize normal_scan counter */
 718                 wpa_s->normal_scans = 0;
 719         }
 720
 721         if (state != WPA_SCANNING)
 722                 wpa_supplicant_notify_scanning(wpa_s, 0);
 723
 724         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 725                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 726 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 727                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 728                         MACSTR " completed [id=%d id_str=%s]",
 729                         MAC2STR(wpa_s->bssid),
 730                         ssid ? ssid->id : -1,
 731                         ssid && ssid->id_str ? ssid->id_str : "");
 732 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 733                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 734                 wpa_blacklist_clear(wpa_s);
 735                 wpa_s->extra_blacklist_count = 0;
 736                 wpa_s->new_connection = 0;
 737                 wpa_drv_set_operstate(wpa_s, 1);
 738 #ifndef IEEE8021X_EAPOL
 739                 wpa_drv_set_supp_port(wpa_s, 1);
 740 #endif /* IEEE8021X_EAPOL */
 741                 wpa_s->after_wps = 0;
 742                 wpa_s->known_wps_freq = 0;
 743                 wpas_p2p_completed(wpa_s);
 744
 745                 sme_sched_obss_scan(wpa_s, 1);
 746         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 747                    state == WPA_ASSOCIATED) {
 748                 wpa_s->new_connection = 1;
 749                 wpa_drv_set_operstate(wpa_s, 0);
 750 #ifndef IEEE8021X_EAPOL
 751                 wpa_drv_set_supp_port(wpa_s, 0);
 752 #endif /* IEEE8021X_EAPOL */
 753                 sme_sched_obss_scan(wpa_s, 0);
 754         }
 755         wpa_s->wpa_state = state;
 756
 757 #ifdef CONFIG_BGSCAN
 758         if (state == WPA_COMPLETED)
 759                 wpa_supplicant_start_bgscan(wpa_s);
 760         else if (state < WPA_ASSOCIATED)
 761                 wpa_supplicant_stop_bgscan(wpa_s);
 762 #endif /* CONFIG_BGSCAN */
 763
 764         if (state == WPA_AUTHENTICATING)
 765                 wpa_supplicant_stop_autoscan(wpa_s);
 766
 767         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 768                 wpa_supplicant_start_autoscan(wpa_s);
 769
 770         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 771                 wmm_ac_notify_disassoc(wpa_s);
 772
 773         if (wpa_s->wpa_state != old_state) {
 774                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 775
 776                 /*
 777                  * Notify the P2P Device interface about a state change in one
 778                  * of the interfaces.
 779                  */
 780                 wpas_p2p_indicate_state_change(wpa_s);
 781
 782                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 783                     old_state == WPA_COMPLETED)
 784                         wpas_notify_auth_changed(wpa_s);
 785         }
 786 }
 787
 788
 789 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 790 {
 791         int pending = 0;
 792 #ifdef CONFIG_WPS
 793         struct wpa_supplicant *wpa_s = global->ifaces;
 794         while (wpa_s) {
 795                 struct wpa_supplicant *next = wpa_s->next;
 796                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 797                         pending = 1;
 798 #ifdef CONFIG_P2P
 799                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 800                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 801                         wpas_p2p_disconnect(wpa_s);
 802 #endif /* CONFIG_P2P */
 803                 wpa_s = next;
 804         }
 805 #endif /* CONFIG_WPS */
 806         if (pending)
 807                 return;
 808         eloop_terminate();
 809 }
 810
 811
 812 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 813 {
 814         struct wpa_global *global = signal_ctx;
 815         wpa_supplicant_terminate_proc(global);
 816 }
 817
 818
 819 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 820 {
 821         enum wpa_states old_state = wpa_s->wpa_state;
 822
 823         wpa_s->pairwise_cipher = 0;
 824         wpa_s->group_cipher = 0;
 825         wpa_s->mgmt_group_cipher = 0;
 826         wpa_s->key_mgmt = 0;
 827         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 828                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 829
 830         if (wpa_s->wpa_state != old_state)
 831                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 832 }
 833
 834
 835 /**
 836  * wpa_supplicant_reload_configuration - Reload configuration data
 837  * @wpa_s: Pointer to wpa_supplicant data
 838  * Returns: 0 on success or -1 if configuration parsing failed
 839  *
 840  * This function can be used to request that the configuration data is reloaded
 841  * (e.g., after configuration file change). This function is reloading
 842  * configuration only for one interface, so this may need to be called multiple
 843  * times if %wpa_supplicant is controlling multiple interfaces and all
 844  * interfaces need reconfiguration.
 845  */
 846 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 847 {
 848         struct wpa_config *conf;
 849         int reconf_ctrl;
 850         int old_ap_scan;
 851
 852         if (wpa_s->confname == NULL)
 853                 return -1;
 854         conf = wpa_config_read(wpa_s->confname, NULL);
 855         if (conf == NULL) {
 856                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 857                         "file '%s' - exiting", wpa_s->confname);
 858                 return -1;
 859         }
 860         wpa_config_read(wpa_s->confanother, conf);
 861
 862         conf->changed_parameters = (unsigned int) -1;
 863
 864         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 865                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 866                     os_strcmp(conf->ctrl_interface,
 867                               wpa_s->conf->ctrl_interface) != 0);
 868
 869         if (reconf_ctrl && wpa_s->ctrl_iface) {
 870                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 871                 wpa_s->ctrl_iface = NULL;
 872         }
 873
 874         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 875         if (wpa_s->current_ssid) {
 876                 wpa_s->own_disconnect_req = 1;
 877                 wpa_supplicant_deauthenticate(wpa_s,
 878                                               WLAN_REASON_DEAUTH_LEAVING);
 879         }
 880
 881         /*
 882          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 883          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 884          */
 885         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 886                 /*
 887                  * Clear forced success to clear EAP state for next
 888                  * authentication.
 889                  */
 890                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 891         }
 892         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 893         wpa_sm_set_config(wpa_s->wpa, NULL);
 894         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 895         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 896         rsn_preauth_deinit(wpa_s->wpa);
 897
 898         old_ap_scan = wpa_s->conf->ap_scan;
 899         wpa_config_free(wpa_s->conf);
 900         wpa_s->conf = conf;
 901         if (old_ap_scan != wpa_s->conf->ap_scan)
 902                 wpas_notify_ap_scan_changed(wpa_s);
 903
 904         if (reconf_ctrl)
 905                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 906
 907         wpa_supplicant_update_config(wpa_s);
 908
 909         wpa_supplicant_clear_status(wpa_s);
 910         if (wpa_supplicant_enabled_networks(wpa_s)) {
 911                 wpa_s->reassociate = 1;
 912                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 913         }
 914         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 915         return 0;
 916 }
 917
 918
 919 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 920 {
 921         struct wpa_global *global = signal_ctx;
 922         struct wpa_supplicant *wpa_s;
 923         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 924                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 925                         sig);
 926                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 927                         wpa_supplicant_terminate_proc(global);
 928                 }
 929         }
 930 }
 931
 932
 933 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 934                                          struct wpa_ssid *ssid,
 935                                          struct wpa_ie_data *ie)
 936 {
 937         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 938         if (ret) {
 939                 if (ret == -2) {
 940                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 941                                 "from association info");
 942                 }
 943                 return -1;
 944         }
 945
 946         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 947                 "cipher suites");
 948         if (!(ie->group_cipher & ssid->group_cipher)) {
 949                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 950                         "cipher 0x%x (mask 0x%x) - reject",
 951                         ie->group_cipher, ssid->group_cipher);
 952                 return -1;
 953         }
 954         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 955                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 956                         "cipher 0x%x (mask 0x%x) - reject",
 957                         ie->pairwise_cipher, ssid->pairwise_cipher);
 958                 return -1;
 959         }
 960         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 961                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 962                         "management 0x%x (mask 0x%x) - reject",
 963                         ie->key_mgmt, ssid->key_mgmt);
 964                 return -1;
 965         }
 966
 967 #ifdef CONFIG_IEEE80211W
 968         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 969             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
 970                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 971                         "that does not support management frame protection - "
 972                         "reject");
 973                 return -1;
 974         }
 975 #endif /* CONFIG_IEEE80211W */
 976
 977         return 0;
 978 }
 979
 980
 981 /**
 982  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 983  * @wpa_s: Pointer to wpa_supplicant data
 984  * @bss: Scan results for the selected BSS, or %NULL if not available
 985  * @ssid: Configuration data for the selected network
 986  * @wpa_ie: Buffer for the WPA/RSN IE
 987  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 988  * used buffer length in case the functions returns success.
 989  * Returns: 0 on success or -1 on failure
 990  *
 991  * This function is used to configure authentication and encryption parameters
 992  * based on the network configuration and scan result for the selected BSS (if
 993  * available).
 994  */
 995 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 996                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 997                               u8 *wpa_ie, size_t *wpa_ie_len)
 998 {
 999         struct wpa_ie_data ie;
1000         int sel, proto;
1001         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1002
1003         if (bss) {
1004                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1005                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1006                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1007         } else
1008                 bss_wpa = bss_rsn = bss_osen = NULL;
1009
1010         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1011             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1012             (ie.group_cipher & ssid->group_cipher) &&
1013             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1014             (ie.key_mgmt & ssid->key_mgmt)) {
1015                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1016                 proto = WPA_PROTO_RSN;
1017         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1018                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1019                    (ie.group_cipher & ssid->group_cipher) &&
1020                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1021                    (ie.key_mgmt & ssid->key_mgmt)) {
1022                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1023                 proto = WPA_PROTO_WPA;
1024 #ifdef CONFIG_HS20
1025         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1026                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1027                 /* TODO: parse OSEN element */
1028                 os_memset(&ie, 0, sizeof(ie));
1029                 ie.group_cipher = WPA_CIPHER_CCMP;
1030                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1031                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1032                 proto = WPA_PROTO_OSEN;
1033 #endif /* CONFIG_HS20 */
1034         } else if (bss) {
1035                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1036                 wpa_dbg(wpa_s, MSG_DEBUG,
1037                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1038                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1039                         ssid->key_mgmt);
1040                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1041                         MAC2STR(bss->bssid),
1042                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1043                         bss_wpa ? " WPA" : "",
1044                         bss_rsn ? " RSN" : "",
1045                         bss_osen ? " OSEN" : "");
1046                 if (bss_rsn) {
1047                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1048                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1049                                 wpa_dbg(wpa_s, MSG_DEBUG,
1050                                         "Could not parse RSN element");
1051                         } else {
1052                                 wpa_dbg(wpa_s, MSG_DEBUG,
1053                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1054                                         ie.pairwise_cipher, ie.group_cipher,
1055                                         ie.key_mgmt);
1056                         }
1057                 }
1058                 if (bss_wpa) {
1059                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1060                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1061                                 wpa_dbg(wpa_s, MSG_DEBUG,
1062                                         "Could not parse WPA element");
1063                         } else {
1064                                 wpa_dbg(wpa_s, MSG_DEBUG,
1065                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1066                                         ie.pairwise_cipher, ie.group_cipher,
1067                                         ie.key_mgmt);
1068                         }
1069                 }
1070                 return -1;
1071         } else {
1072                 if (ssid->proto & WPA_PROTO_OSEN)
1073                         proto = WPA_PROTO_OSEN;
1074                 else if (ssid->proto & WPA_PROTO_RSN)
1075                         proto = WPA_PROTO_RSN;
1076                 else
1077                         proto = WPA_PROTO_WPA;
1078                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1079                         os_memset(&ie, 0, sizeof(ie));
1080                         ie.group_cipher = ssid->group_cipher;
1081                         ie.pairwise_cipher = ssid->pairwise_cipher;
1082                         ie.key_mgmt = ssid->key_mgmt;
1083 #ifdef CONFIG_IEEE80211W
1084                         ie.mgmt_group_cipher =
1085                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1086                                 WPA_CIPHER_AES_128_CMAC : 0;
1087 #endif /* CONFIG_IEEE80211W */
1088                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1089                                 "based on configuration");
1090                 } else
1091                         proto = ie.proto;
1092         }
1093
1094         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1095                 "pairwise %d key_mgmt %d proto %d",
1096                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1097 #ifdef CONFIG_IEEE80211W
1098         if (ssid->ieee80211w) {
1099                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1100                         ie.mgmt_group_cipher);
1101         }
1102 #endif /* CONFIG_IEEE80211W */
1103
1104         wpa_s->wpa_proto = proto;
1105         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1106         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1107                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1108
1109         if (bss || !wpa_s->ap_ies_from_associnfo) {
1110                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1111                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1112                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1113                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1114                         return -1;
1115         }
1116
1117         sel = ie.group_cipher & ssid->group_cipher;
1118         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1119         if (wpa_s->group_cipher < 0) {
1120                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1121                         "cipher");
1122                 return -1;
1123         }
1124         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1125                 wpa_cipher_txt(wpa_s->group_cipher));
1126
1127         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1128         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1129         if (wpa_s->pairwise_cipher < 0) {
1130                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1131                         "cipher");
1132                 return -1;
1133         }
1134         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1135                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1136
1137         sel = ie.key_mgmt & ssid->key_mgmt;
1138 #ifdef CONFIG_SAE
1139         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1140                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1141 #endif /* CONFIG_SAE */
1142         if (0) {
1143 #ifdef CONFIG_SUITEB192
1144         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1145                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1146                 wpa_dbg(wpa_s, MSG_DEBUG,
1147                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1148 #endif /* CONFIG_SUITEB192 */
1149 #ifdef CONFIG_SUITEB
1150         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1151                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1152                 wpa_dbg(wpa_s, MSG_DEBUG,
1153                         "WPA: using KEY_MGMT 802.1X with Suite B");
1154 #endif /* CONFIG_SUITEB */
1155 #ifdef CONFIG_IEEE80211R
1156         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1157                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1158                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1159         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1160                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1161                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1162 #endif /* CONFIG_IEEE80211R */
1163 #ifdef CONFIG_SAE
1164         } else if (sel & WPA_KEY_MGMT_SAE) {
1165                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1166                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1167         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1168                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1169                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1170 #endif /* CONFIG_SAE */
1171 #ifdef CONFIG_IEEE80211W
1172         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1173                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1174                 wpa_dbg(wpa_s, MSG_DEBUG,
1175                         "WPA: using KEY_MGMT 802.1X with SHA256");
1176         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1177                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1178                 wpa_dbg(wpa_s, MSG_DEBUG,
1179                         "WPA: using KEY_MGMT PSK with SHA256");
1180 #endif /* CONFIG_IEEE80211W */
1181         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1182                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1183                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1184         } else if (sel & WPA_KEY_MGMT_PSK) {
1185                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1186                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1187         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1188                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1189                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1190 #ifdef CONFIG_HS20
1191         } else if (sel & WPA_KEY_MGMT_OSEN) {
1192                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1193                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1194 #endif /* CONFIG_HS20 */
1195         } else {
1196                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1197                         "authenticated key management type");
1198                 return -1;
1199         }
1200
1201         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1202         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1203                          wpa_s->pairwise_cipher);
1204         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1205
1206 #ifdef CONFIG_IEEE80211W
1207         sel = ie.mgmt_group_cipher;
1208         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1209             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1210                 sel = 0;
1211         if (sel & WPA_CIPHER_AES_128_CMAC) {
1212                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1213                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1214                         "AES-128-CMAC");
1215         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1216                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1217                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1218                         "BIP-GMAC-128");
1219         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1220                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1221                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1222                         "BIP-GMAC-256");
1223         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1224                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1225                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1226                         "BIP-CMAC-256");
1227         } else {
1228                 wpa_s->mgmt_group_cipher = 0;
1229                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1230         }
1231         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1232                          wpa_s->mgmt_group_cipher);
1233         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1234                          wpas_get_ssid_pmf(wpa_s, ssid));
1235 #endif /* CONFIG_IEEE80211W */
1236
1237         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1238                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1239                 return -1;
1240         }
1241
1242         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1243                 int psk_set = 0;
1244
1245                 if (ssid->psk_set) {
1246                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1247                         psk_set = 1;
1248                 }
1249 #ifndef CONFIG_NO_PBKDF2
1250                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1251                     ssid->passphrase) {
1252                         u8 psk[PMK_LEN];
1253                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1254                                     4096, psk, PMK_LEN);
1255                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1256                                         psk, PMK_LEN);
1257                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1258                         psk_set = 1;
1259                         os_memset(psk, 0, sizeof(psk));
1260                 }
1261 #endif /* CONFIG_NO_PBKDF2 */
1262 #ifdef CONFIG_EXT_PASSWORD
1263                 if (ssid->ext_psk) {
1264                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1265                                                              ssid->ext_psk);
1266                         char pw_str[64 + 1];
1267                         u8 psk[PMK_LEN];
1268
1269                         if (pw == NULL) {
1270                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1271                                         "found from external storage");
1272                                 return -1;
1273                         }
1274
1275                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1276                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1277                                         "PSK length %d in external storage",
1278                                         (int) wpabuf_len(pw));
1279                                 ext_password_free(pw);
1280                                 return -1;
1281                         }
1282
1283                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1284                         pw_str[wpabuf_len(pw)] = '\0';
1285
1286 #ifndef CONFIG_NO_PBKDF2
1287                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1288                         {
1289                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1290                                             4096, psk, PMK_LEN);
1291                                 os_memset(pw_str, 0, sizeof(pw_str));
1292                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1293                                                 "external passphrase)",
1294                                                 psk, PMK_LEN);
1295                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1296                                 psk_set = 1;
1297                                 os_memset(psk, 0, sizeof(psk));
1298                         } else
1299 #endif /* CONFIG_NO_PBKDF2 */
1300                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1301                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1302                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1303                                                 "Invalid PSK hex string");
1304                                         os_memset(pw_str, 0, sizeof(pw_str));
1305                                         ext_password_free(pw);
1306                                         return -1;
1307                                 }
1308                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1309                                 psk_set = 1;
1310                                 os_memset(psk, 0, sizeof(psk));
1311                         } else {
1312                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1313                                         "PSK available");
1314                                 os_memset(pw_str, 0, sizeof(pw_str));
1315                                 ext_password_free(pw);
1316                                 return -1;
1317                         }
1318
1319                         os_memset(pw_str, 0, sizeof(pw_str));
1320                         ext_password_free(pw);
1321                 }
1322 #endif /* CONFIG_EXT_PASSWORD */
1323
1324                 if (!psk_set) {
1325                         wpa_msg(wpa_s, MSG_INFO,
1326                                 "No PSK available for association");
1327                         return -1;
1328                 }
1329         } else
1330                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1331
1332         return 0;
1333 }
1334
1335
1336 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1337 {
1338         *pos = 0x00;
1339
1340         switch (idx) {
1341         case 0: /* Bits 0-7 */
1342                 break;
1343         case 1: /* Bits 8-15 */
1344                 break;
1345         case 2: /* Bits 16-23 */
1346 #ifdef CONFIG_WNM
1347                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1348                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1349 #endif /* CONFIG_WNM */
1350                 break;
1351         case 3: /* Bits 24-31 */
1352 #ifdef CONFIG_WNM
1353                 *pos |= 0x02; /* Bit 25 - SSID List */
1354 #endif /* CONFIG_WNM */
1355 #ifdef CONFIG_INTERWORKING
1356                 if (wpa_s->conf->interworking)
1357                         *pos |= 0x80; /* Bit 31 - Interworking */
1358 #endif /* CONFIG_INTERWORKING */
1359                 break;
1360         case 4: /* Bits 32-39 */
1361 #ifdef CONFIG_INTERWORKING
1362                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1363                         *pos |= 0x01; /* Bit 32 - QoS Map */
1364 #endif /* CONFIG_INTERWORKING */
1365                 break;
1366         case 5: /* Bits 40-47 */
1367 #ifdef CONFIG_HS20
1368                 if (wpa_s->conf->hs20)
1369                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1370 #endif /* CONFIG_HS20 */
1371                 break;
1372         case 6: /* Bits 48-55 */
1373                 break;
1374         }
1375 }
1376
1377
1378 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1379 {
1380         u8 *pos = buf;
1381         u8 len = 6, i;
1382
1383         if (len < wpa_s->extended_capa_len)
1384                 len = wpa_s->extended_capa_len;
1385         if (buflen < (size_t) len + 2) {
1386                 wpa_printf(MSG_INFO,
1387                            "Not enough room for building extended capabilities element");
1388                 return -1;
1389         }
1390
1391         *pos++ = WLAN_EID_EXT_CAPAB;
1392         *pos++ = len;
1393         for (i = 0; i < len; i++, pos++) {
1394                 wpas_ext_capab_byte(wpa_s, pos, i);
1395
1396                 if (i < wpa_s->extended_capa_len) {
1397                         *pos &= ~wpa_s->extended_capa_mask[i];
1398                         *pos |= wpa_s->extended_capa[i];
1399                 }
1400         }
1401
1402         while (len > 0 && buf[1 + len] == 0) {
1403                 len--;
1404                 buf[1] = len;
1405         }
1406         if (len == 0)
1407                 return 0;
1408
1409         return 2 + len;
1410 }
1411
1412
1413 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1414                           struct wpa_bss *test_bss)
1415 {
1416         struct wpa_bss *bss;
1417
1418         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1419                 if (bss == test_bss)
1420                         return 1;
1421         }
1422
1423         return 0;
1424 }
1425
1426
1427 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1428                            struct wpa_ssid *test_ssid)
1429 {
1430         struct wpa_ssid *ssid;
1431
1432         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1433                 if (ssid == test_ssid)
1434                         return 1;
1435         }
1436
1437         return 0;
1438 }
1439
1440
1441 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1442                         struct wpa_ssid *test_ssid)
1443 {
1444         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1445                 return 0;
1446
1447         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1448 }
1449
1450
1451 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1452 {
1453         if (cwork == NULL)
1454                 return;
1455         os_free(cwork);
1456 }
1457
1458
1459 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1460 {
1461         struct wpa_connect_work *cwork;
1462         struct wpa_radio_work *work = wpa_s->connect_work;
1463
1464         if (!work)
1465                 return;
1466
1467         wpa_s->connect_work = NULL;
1468         cwork = work->ctx;
1469         work->ctx = NULL;
1470         wpas_connect_work_free(cwork);
1471         radio_work_done(work);
1472 }
1473
1474
1475 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1476 {
1477         struct os_reltime now;
1478         u8 addr[ETH_ALEN];
1479
1480         os_get_reltime(&now);
1481         if (wpa_s->last_mac_addr_style == style &&
1482             wpa_s->last_mac_addr_change.sec != 0 &&
1483             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1484                                 wpa_s->conf->rand_addr_lifetime)) {
1485                 wpa_msg(wpa_s, MSG_DEBUG,
1486                         "Previously selected random MAC address has not yet expired");
1487                 return 0;
1488         }
1489
1490         switch (style) {
1491         case 1:
1492                 if (random_mac_addr(addr) < 0)
1493                         return -1;
1494                 break;
1495         case 2:
1496                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1497                 if (random_mac_addr_keep_oui(addr) < 0)
1498                         return -1;
1499                 break;
1500         default:
1501                 return -1;
1502         }
1503
1504         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1505                 wpa_msg(wpa_s, MSG_INFO,
1506                         "Failed to set random MAC address");
1507                 return -1;
1508         }
1509
1510         os_get_reltime(&wpa_s->last_mac_addr_change);
1511         wpa_s->mac_addr_changed = 1;
1512         wpa_s->last_mac_addr_style = style;
1513
1514         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1515                 wpa_msg(wpa_s, MSG_INFO,
1516                         "Could not update MAC address information");
1517                 return -1;
1518         }
1519
1520         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1521                 MAC2STR(addr));
1522
1523         return 0;
1524 }
1525
1526
1527 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1528 {
1529         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1530             !wpa_s->conf->preassoc_mac_addr)
1531                 return 0;
1532
1533         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1534 }
1535
1536
1537 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1538
1539 /**
1540  * wpa_supplicant_associate - Request association
1541  * @wpa_s: Pointer to wpa_supplicant data
1542  * @bss: Scan results for the selected BSS, or %NULL if not available
1543  * @ssid: Configuration data for the selected network
1544  *
1545  * This function is used to request %wpa_supplicant to associate with a BSS.
1546  */
1547 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1548                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1549 {
1550         struct wpa_connect_work *cwork;
1551         int rand_style;
1552
1553         if (ssid->mac_addr == -1)
1554                 rand_style = wpa_s->conf->mac_addr;
1555         else
1556                 rand_style = ssid->mac_addr;
1557
1558         wmm_ac_clear_saved_tspecs(wpa_s);
1559         wpa_s->reassoc_same_bss = 0;
1560
1561         if (wpa_s->last_ssid == ssid) {
1562                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1563                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1564                         wmm_ac_save_tspecs(wpa_s);
1565                         wpa_s->reassoc_same_bss = 1;
1566                 }
1567         } else if (rand_style > 0) {
1568                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1569                         return;
1570                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1571         } else if (wpa_s->mac_addr_changed) {
1572                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1573                         wpa_msg(wpa_s, MSG_INFO,
1574                                 "Could not restore permanent MAC address");
1575                         return;
1576                 }
1577                 wpa_s->mac_addr_changed = 0;
1578                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1579                         wpa_msg(wpa_s, MSG_INFO,
1580                                 "Could not update MAC address information");
1581                         return;
1582                 }
1583                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1584         }
1585         wpa_s->last_ssid = ssid;
1586
1587 #ifdef CONFIG_IBSS_RSN
1588         ibss_rsn_deinit(wpa_s->ibss_rsn);
1589         wpa_s->ibss_rsn = NULL;
1590 #endif /* CONFIG_IBSS_RSN */
1591
1592         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1593             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1594 #ifdef CONFIG_AP
1595                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1596                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1597                                 "mode");
1598                         return;
1599                 }
1600                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1601                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1602                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1603                                 wpas_p2p_ap_setup_failed(wpa_s);
1604                         return;
1605                 }
1606                 wpa_s->current_bss = bss;
1607 #else /* CONFIG_AP */
1608                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1609                         "the build");
1610 #endif /* CONFIG_AP */
1611                 return;
1612         }
1613
1614         if (ssid->mode == WPAS_MODE_MESH) {
1615 #ifdef CONFIG_MESH
1616                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1617                         wpa_msg(wpa_s, MSG_INFO,
1618                                 "Driver does not support mesh mode");
1619                         return;
1620                 }
1621                 if (bss)
1622                         ssid->frequency = bss->freq;
1623                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1624                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1625                         return;
1626                 }
1627                 wpa_s->current_bss = bss;
1628                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1629                              "ssid=\"%s\" id=%d",
1630                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1631                              ssid->id);
1632 #else /* CONFIG_MESH */
1633                 wpa_msg(wpa_s, MSG_ERROR,
1634                         "mesh mode support not included in the build");
1635 #endif /* CONFIG_MESH */
1636                 return;
1637         }
1638
1639 #ifdef CONFIG_TDLS
1640         if (bss)
1641                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1642                                 bss->ie_len);
1643 #endif /* CONFIG_TDLS */
1644
1645         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1646             ssid->mode == IEEE80211_MODE_INFRA) {
1647                 sme_authenticate(wpa_s, bss, ssid);
1648                 return;
1649         }
1650
1651         if (wpa_s->connect_work) {
1652                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1653                 return;
1654         }
1655
1656         if (radio_work_pending(wpa_s, "connect")) {
1657                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1658                 return;
1659         }
1660
1661         cwork = os_zalloc(sizeof(*cwork));
1662         if (cwork == NULL)
1663                 return;
1664
1665         cwork->bss = bss;
1666         cwork->ssid = ssid;
1667
1668         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1669                            wpas_start_assoc_cb, cwork) < 0) {
1670                 os_free(cwork);
1671         }
1672 }
1673
1674
1675 static int bss_is_ibss(struct wpa_bss *bss)
1676 {
1677         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1678                 IEEE80211_CAP_IBSS;
1679 }
1680
1681
1682 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1683                           const struct wpa_ssid *ssid,
1684                           struct hostapd_freq_params *freq)
1685 {
1686         enum hostapd_hw_mode hw_mode;
1687         struct hostapd_hw_modes *mode = NULL;
1688         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1689                            184, 192 };
1690         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1691         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1692         u8 channel;
1693         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1694         unsigned int j;
1695         struct hostapd_freq_params vht_freq;
1696
1697         freq->freq = ssid->frequency;
1698
1699         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1700                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1701
1702                 if (ssid->mode != WPAS_MODE_IBSS)
1703                         break;
1704
1705                 /* Don't adjust control freq in case of fixed_freq */
1706                 if (ssid->fixed_freq)
1707                         break;
1708
1709                 if (!bss_is_ibss(bss))
1710                         continue;
1711
1712                 if (ssid->ssid_len == bss->ssid_len &&
1713                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1714                         wpa_printf(MSG_DEBUG,
1715                                    "IBSS already found in scan results, adjust control freq: %d",
1716                                    bss->freq);
1717                         freq->freq = bss->freq;
1718                         obss_scan = 0;
1719                         break;
1720                 }
1721         }
1722
1723         /* For IBSS check HT_IBSS flag */
1724         if (ssid->mode == WPAS_MODE_IBSS &&
1725             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1726                 return;
1727
1728         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1729             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1730             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1731                 wpa_printf(MSG_DEBUG,
1732                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1733                 return;
1734         }
1735
1736         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1737         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1738                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1739                         mode = &wpa_s->hw.modes[i];
1740                         break;
1741                 }
1742         }
1743
1744         if (!mode)
1745                 return;
1746
1747         freq->ht_enabled = ht_supported(mode);
1748         if (!freq->ht_enabled)
1749                 return;
1750
1751         /* Setup higher BW only for 5 GHz */
1752         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1753                 return;
1754
1755         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1756                 pri_chan = &mode->channels[chan_idx];
1757                 if (pri_chan->chan == channel)
1758                         break;
1759                 pri_chan = NULL;
1760         }
1761         if (!pri_chan)
1762                 return;
1763
1764         /* Check primary channel flags */
1765         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1766                 return;
1767
1768         /* Check/setup HT40+/HT40- */
1769         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1770                 if (ht40plus[j] == channel) {
1771                         ht40 = 1;
1772                         break;
1773                 }
1774         }
1775
1776         /* Find secondary channel */
1777         for (i = 0; i < mode->num_channels; i++) {
1778                 sec_chan = &mode->channels[i];
1779                 if (sec_chan->chan == channel + ht40 * 4)
1780                         break;
1781                 sec_chan = NULL;
1782         }
1783         if (!sec_chan)
1784                 return;
1785
1786         /* Check secondary channel flags */
1787         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1788                 return;
1789
1790         freq->channel = pri_chan->chan;
1791
1792         switch (ht40) {
1793         case -1:
1794                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1795                         return;
1796                 freq->sec_channel_offset = -1;
1797                 break;
1798         case 1:
1799                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1800                         return;
1801                 freq->sec_channel_offset = 1;
1802                 break;
1803         default:
1804                 break;
1805         }
1806
1807         if (freq->sec_channel_offset && obss_scan) {
1808                 struct wpa_scan_results *scan_res;
1809
1810                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1811                 if (scan_res == NULL) {
1812                         /* Back to HT20 */
1813                         freq->sec_channel_offset = 0;
1814                         return;
1815                 }
1816
1817                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1818                                      sec_chan->chan);
1819                 switch (res) {
1820                 case 0:
1821                         /* Back to HT20 */
1822                         freq->sec_channel_offset = 0;
1823                         break;
1824                 case 1:
1825                         /* Configuration allowed */
1826                         break;
1827                 case 2:
1828                         /* Switch pri/sec channels */
1829                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1830                         freq->sec_channel_offset = -freq->sec_channel_offset;
1831                         freq->channel = sec_chan->chan;
1832                         break;
1833                 default:
1834                         freq->sec_channel_offset = 0;
1835                         break;
1836                 }
1837
1838                 wpa_scan_results_free(scan_res);
1839         }
1840
1841         wpa_printf(MSG_DEBUG,
1842                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1843                    freq->channel, freq->sec_channel_offset);
1844
1845         /* Not sure if mesh is ready for VHT */
1846         if (ssid->mode != WPAS_MODE_IBSS)
1847                 return;
1848
1849         /* For IBSS check VHT_IBSS flag */
1850         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1851                 return;
1852
1853         vht_freq = *freq;
1854
1855         vht_freq.vht_enabled = vht_supported(mode);
1856         if (!vht_freq.vht_enabled)
1857                 return;
1858
1859         /* setup center_freq1, bandwidth */
1860         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1861                 if (freq->channel >= vht80[j] &&
1862                     freq->channel < vht80[j] + 16)
1863                         break;
1864         }
1865
1866         if (j == ARRAY_SIZE(vht80))
1867                 return;
1868
1869         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1870                 struct hostapd_channel_data *chan;
1871
1872                 chan = hw_get_channel_chan(mode, i, NULL);
1873                 if (!chan)
1874                         return;
1875
1876                 /* Back to HT configuration if channel not usable */
1877                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1878                         return;
1879         }
1880
1881         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
1882                                     freq->channel, freq->ht_enabled,
1883                                     vht_freq.vht_enabled,
1884                                     freq->sec_channel_offset,
1885                                     VHT_CHANWIDTH_80MHZ,
1886                                     vht80[j] + 6, 0, 0) != 0)
1887                 return;
1888
1889         *freq = vht_freq;
1890
1891         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
1892                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
1893 }
1894
1895
1896 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1897 {
1898         struct wpa_connect_work *cwork = work->ctx;
1899         struct wpa_bss *bss = cwork->bss;
1900         struct wpa_ssid *ssid = cwork->ssid;
1901         struct wpa_supplicant *wpa_s = work->wpa_s;
1902         u8 wpa_ie[200];
1903         size_t wpa_ie_len;
1904         int use_crypt, ret, i, bssid_changed;
1905         int algs = WPA_AUTH_ALG_OPEN;
1906         unsigned int cipher_pairwise, cipher_group;
1907         struct wpa_driver_associate_params params;
1908         int wep_keys_set = 0;
1909         int assoc_failed = 0;
1910         struct wpa_ssid *old_ssid;
1911 #ifdef CONFIG_HT_OVERRIDES
1912         struct ieee80211_ht_capabilities htcaps;
1913         struct ieee80211_ht_capabilities htcaps_mask;
1914 #endif /* CONFIG_HT_OVERRIDES */
1915 #ifdef CONFIG_VHT_OVERRIDES
1916        struct ieee80211_vht_capabilities vhtcaps;
1917        struct ieee80211_vht_capabilities vhtcaps_mask;
1918 #endif /* CONFIG_VHT_OVERRIDES */
1919
1920         if (deinit) {
1921                 if (work->started) {
1922                         wpa_s->connect_work = NULL;
1923
1924                         /* cancel possible auth. timeout */
1925                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1926                                              NULL);
1927                 }
1928                 wpas_connect_work_free(cwork);
1929                 return;
1930         }
1931
1932         wpa_s->connect_work = work;
1933
1934         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1935                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1936                 wpas_connect_work_done(wpa_s);
1937                 return;
1938         }
1939
1940         os_memset(&params, 0, sizeof(params));
1941         wpa_s->reassociate = 0;
1942         wpa_s->eap_expected_failure = 0;
1943         if (bss &&
1944             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1945 #ifdef CONFIG_IEEE80211R
1946                 const u8 *ie, *md = NULL;
1947 #endif /* CONFIG_IEEE80211R */
1948                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1949                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1950                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1951                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1952                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1953                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1954                 if (bssid_changed)
1955                         wpas_notify_bssid_changed(wpa_s);
1956 #ifdef CONFIG_IEEE80211R
1957                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1958                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1959                         md = ie + 2;
1960                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1961                 if (md) {
1962                         /* Prepare for the next transition */
1963                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1964                 }
1965 #endif /* CONFIG_IEEE80211R */
1966 #ifdef CONFIG_WPS
1967         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1968                    wpa_s->conf->ap_scan == 2 &&
1969                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1970                 /* Use ap_scan==1 style network selection to find the network
1971                  */
1972                 wpas_connect_work_done(wpa_s);
1973                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1974                 wpa_s->reassociate = 1;
1975                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1976                 return;
1977 #endif /* CONFIG_WPS */
1978         } else {
1979                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1980                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1981                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1982         }
1983         wpa_supplicant_cancel_sched_scan(wpa_s);
1984         wpa_supplicant_cancel_scan(wpa_s);
1985
1986         /* Starting new association, so clear the possibly used WPA IE from the
1987          * previous association. */
1988         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1989
1990 #ifdef IEEE8021X_EAPOL
1991         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1992                 if (ssid->leap) {
1993                         if (ssid->non_leap == 0)
1994                                 algs = WPA_AUTH_ALG_LEAP;
1995                         else
1996                                 algs |= WPA_AUTH_ALG_LEAP;
1997                 }
1998         }
1999 #endif /* IEEE8021X_EAPOL */
2000         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2001         if (ssid->auth_alg) {
2002                 algs = ssid->auth_alg;
2003                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2004                         "0x%x", algs);
2005         }
2006
2007         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2008                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2009             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2010                 int try_opportunistic;
2011                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2012                                      wpa_s->conf->okc :
2013                                      ssid->proactive_key_caching) &&
2014                         (ssid->proto & WPA_PROTO_RSN);
2015                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2016                                             ssid, try_opportunistic) == 0)
2017                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2018                 wpa_ie_len = sizeof(wpa_ie);
2019                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2020                                               wpa_ie, &wpa_ie_len)) {
2021                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2022                                 "key management and encryption suites");
2023                         wpas_connect_work_done(wpa_s);
2024                         return;
2025                 }
2026         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2027                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2028                 /*
2029                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2030                  * use non-WPA since the scan results did not indicate that the
2031                  * AP is using WPA or WPA2.
2032                  */
2033                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2034                 wpa_ie_len = 0;
2035                 wpa_s->wpa_proto = 0;
2036         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2037                 wpa_ie_len = sizeof(wpa_ie);
2038                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2039                                               wpa_ie, &wpa_ie_len)) {
2040                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2041                                 "key management and encryption suites (no "
2042                                 "scan results)");
2043                         wpas_connect_work_done(wpa_s);
2044                         return;
2045                 }
2046 #ifdef CONFIG_WPS
2047         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2048                 struct wpabuf *wps_ie;
2049                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2050                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2051                         wpa_ie_len = wpabuf_len(wps_ie);
2052                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2053                 } else
2054                         wpa_ie_len = 0;
2055                 wpabuf_free(wps_ie);
2056                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2057                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2058                         params.wps = WPS_MODE_PRIVACY;
2059                 else
2060                         params.wps = WPS_MODE_OPEN;
2061                 wpa_s->wpa_proto = 0;
2062 #endif /* CONFIG_WPS */
2063         } else {
2064                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2065                 wpa_ie_len = 0;
2066                 wpa_s->wpa_proto = 0;
2067         }
2068
2069 #ifdef CONFIG_P2P
2070         if (wpa_s->global->p2p) {
2071                 u8 *pos;
2072                 size_t len;
2073                 int res;
2074                 pos = wpa_ie + wpa_ie_len;
2075                 len = sizeof(wpa_ie) - wpa_ie_len;
2076                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2077                                             ssid->p2p_group);
2078                 if (res >= 0)
2079                         wpa_ie_len += res;
2080         }
2081
2082         wpa_s->cross_connect_disallowed = 0;
2083         if (bss) {
2084                 struct wpabuf *p2p;
2085                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2086                 if (p2p) {
2087                         wpa_s->cross_connect_disallowed =
2088                                 p2p_get_cross_connect_disallowed(p2p);
2089                         wpabuf_free(p2p);
2090                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2091                                 "connection",
2092                                 wpa_s->cross_connect_disallowed ?
2093                                 "disallows" : "allows");
2094                 }
2095         }
2096
2097         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2098 #endif /* CONFIG_P2P */
2099
2100 #ifdef CONFIG_HS20
2101         if (is_hs20_network(wpa_s, ssid, bss)) {
2102                 struct wpabuf *hs20;
2103                 hs20 = wpabuf_alloc(20);
2104                 if (hs20) {
2105                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2106                         size_t len;
2107
2108                         wpas_hs20_add_indication(hs20, pps_mo_id);
2109                         len = sizeof(wpa_ie) - wpa_ie_len;
2110                         if (wpabuf_len(hs20) <= len) {
2111                                 os_memcpy(wpa_ie + wpa_ie_len,
2112                                           wpabuf_head(hs20), wpabuf_len(hs20));
2113                                 wpa_ie_len += wpabuf_len(hs20);
2114                         }
2115                         wpabuf_free(hs20);
2116                 }
2117         }
2118 #endif /* CONFIG_HS20 */
2119
2120         /*
2121          * Workaround: Add Extended Capabilities element only if the AP
2122          * included this element in Beacon/Probe Response frames. Some older
2123          * APs seem to have interoperability issues if this element is
2124          * included, so while the standard may require us to include the
2125          * element in all cases, it is justifiable to skip it to avoid
2126          * interoperability issues.
2127          */
2128         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2129                 u8 ext_capab[18];
2130                 int ext_capab_len;
2131                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2132                                                      sizeof(ext_capab));
2133                 if (ext_capab_len > 0) {
2134                         u8 *pos = wpa_ie;
2135                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2136                                 pos += 2 + pos[1];
2137                         os_memmove(pos + ext_capab_len, pos,
2138                                    wpa_ie_len - (pos - wpa_ie));
2139                         wpa_ie_len += ext_capab_len;
2140                         os_memcpy(pos, ext_capab, ext_capab_len);
2141                 }
2142         }
2143
2144         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2145                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2146                 size_t len;
2147
2148                 len = sizeof(wpa_ie) - wpa_ie_len;
2149                 if (wpabuf_len(buf) <= len) {
2150                         os_memcpy(wpa_ie + wpa_ie_len,
2151                                   wpabuf_head(buf), wpabuf_len(buf));
2152                         wpa_ie_len += wpabuf_len(buf);
2153                 }
2154         }
2155
2156         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2157         use_crypt = 1;
2158         cipher_pairwise = wpa_s->pairwise_cipher;
2159         cipher_group = wpa_s->group_cipher;
2160         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2161             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2162                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2163                         use_crypt = 0;
2164                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2165                         use_crypt = 1;
2166                         wep_keys_set = 1;
2167                 }
2168         }
2169         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2170                 use_crypt = 0;
2171
2172 #ifdef IEEE8021X_EAPOL
2173         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2174                 if ((ssid->eapol_flags &
2175                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2176                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2177                     !wep_keys_set) {
2178                         use_crypt = 0;
2179                 } else {
2180                         /* Assume that dynamic WEP-104 keys will be used and
2181                          * set cipher suites in order for drivers to expect
2182                          * encryption. */
2183                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2184                 }
2185         }
2186 #endif /* IEEE8021X_EAPOL */
2187
2188         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2189                 /* Set the key before (and later after) association */
2190                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2191         }
2192
2193         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2194         if (bss) {
2195                 params.ssid = bss->ssid;
2196                 params.ssid_len = bss->ssid_len;
2197                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2198                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2199                                    MACSTR " freq=%u MHz based on scan results "
2200                                    "(bssid_set=%d)",
2201                                    MAC2STR(bss->bssid), bss->freq,
2202                                    ssid->bssid_set);
2203                         params.bssid = bss->bssid;
2204                         params.freq.freq = bss->freq;
2205                 }
2206                 params.bssid_hint = bss->bssid;
2207                 params.freq_hint = bss->freq;
2208         } else {
2209                 params.ssid = ssid->ssid;
2210                 params.ssid_len = ssid->ssid_len;
2211         }
2212
2213         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2214             wpa_s->conf->ap_scan == 2) {
2215                 params.bssid = ssid->bssid;
2216                 params.fixed_bssid = 1;
2217         }
2218
2219         /* Initial frequency for IBSS/mesh */
2220         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2221             ssid->frequency > 0 && params.freq.freq == 0)
2222                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2223
2224         if (ssid->mode == WPAS_MODE_IBSS) {
2225                 params.fixed_freq = ssid->fixed_freq;
2226                 if (ssid->beacon_int)
2227                         params.beacon_int = ssid->beacon_int;
2228                 else
2229                         params.beacon_int = wpa_s->conf->beacon_int;
2230         }
2231
2232         params.wpa_ie = wpa_ie;
2233         params.wpa_ie_len = wpa_ie_len;
2234         params.pairwise_suite = cipher_pairwise;
2235         params.group_suite = cipher_group;
2236         params.key_mgmt_suite = wpa_s->key_mgmt;
2237         params.wpa_proto = wpa_s->wpa_proto;
2238         params.auth_alg = algs;
2239         params.mode = ssid->mode;
2240         params.bg_scan_period = ssid->bg_scan_period;
2241         for (i = 0; i < NUM_WEP_KEYS; i++) {
2242                 if (ssid->wep_key_len[i])
2243                         params.wep_key[i] = ssid->wep_key[i];
2244                 params.wep_key_len[i] = ssid->wep_key_len[i];
2245         }
2246         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2247
2248         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2249             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2250              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2251                 params.passphrase = ssid->passphrase;
2252                 if (ssid->psk_set)
2253                         params.psk = ssid->psk;
2254         }
2255
2256         if (wpa_s->conf->key_mgmt_offload) {
2257                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2258                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2259                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2260                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2261                         params.req_key_mgmt_offload =
2262                                 ssid->proactive_key_caching < 0 ?
2263                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2264                 else
2265                         params.req_key_mgmt_offload = 1;
2266
2267                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2268                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2269                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2270                     ssid->psk_set)
2271                         params.psk = ssid->psk;
2272         }
2273
2274         params.drop_unencrypted = use_crypt;
2275
2276 #ifdef CONFIG_IEEE80211W
2277         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2278         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2279                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2280                 struct wpa_ie_data ie;
2281                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2282                     ie.capabilities &
2283                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2284                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2285                                 "MFP: require MFP");
2286                         params.mgmt_frame_protection =
2287                                 MGMT_FRAME_PROTECTION_REQUIRED;
2288                 }
2289         }
2290 #endif /* CONFIG_IEEE80211W */
2291
2292         params.p2p = ssid->p2p_group;
2293
2294         if (wpa_s->parent->set_sta_uapsd)
2295                 params.uapsd = wpa_s->parent->sta_uapsd;
2296         else
2297                 params.uapsd = -1;
2298
2299 #ifdef CONFIG_HT_OVERRIDES
2300         os_memset(&htcaps, 0, sizeof(htcaps));
2301         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2302         params.htcaps = (u8 *) &htcaps;
2303         params.htcaps_mask = (u8 *) &htcaps_mask;
2304         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2305 #endif /* CONFIG_HT_OVERRIDES */
2306 #ifdef CONFIG_VHT_OVERRIDES
2307         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2308         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2309         params.vhtcaps = &vhtcaps;
2310         params.vhtcaps_mask = &vhtcaps_mask;
2311         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2312 #endif /* CONFIG_VHT_OVERRIDES */
2313
2314 #ifdef CONFIG_P2P
2315         /*
2316          * If multi-channel concurrency is not supported, check for any
2317          * frequency conflict. In case of any frequency conflict, remove the
2318          * least prioritized connection.
2319          */
2320         if (wpa_s->num_multichan_concurrent < 2) {
2321                 int freq, num;
2322                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2323                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2324                         wpa_printf(MSG_DEBUG,
2325                                    "Assoc conflicting freq found (%d != %d)",
2326                                    freq, params.freq.freq);
2327                         if (wpas_p2p_handle_frequency_conflicts(
2328                                     wpa_s, params.freq.freq, ssid) < 0) {
2329                                 wpas_connect_work_done(wpa_s);
2330                                 return;
2331                         }
2332                 }
2333         }
2334 #endif /* CONFIG_P2P */
2335
2336         ret = wpa_drv_associate(wpa_s, &params);
2337         if (ret < 0) {
2338                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2339                         "failed");
2340                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2341                         /*
2342                          * The driver is known to mean what is saying, so we
2343                          * can stop right here; the association will not
2344                          * succeed.
2345                          */
2346                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2347                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2348                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2349                         return;
2350                 }
2351                 /* try to continue anyway; new association will be tried again
2352                  * after timeout */
2353                 assoc_failed = 1;
2354         }
2355
2356         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2357                 /* Set the key after the association just in case association
2358                  * cleared the previously configured key. */
2359                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2360                 /* No need to timeout authentication since there is no key
2361                  * management. */
2362                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2363                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2364 #ifdef CONFIG_IBSS_RSN
2365         } else if (ssid->mode == WPAS_MODE_IBSS &&
2366                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2367                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2368                 /*
2369                  * RSN IBSS authentication is per-STA and we can disable the
2370                  * per-BSSID authentication.
2371                  */
2372                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2373 #endif /* CONFIG_IBSS_RSN */
2374         } else {
2375                 /* Timeout for IEEE 802.11 authentication and association */
2376                 int timeout = 60;
2377
2378                 if (assoc_failed) {
2379                         /* give IBSS a bit more time */
2380                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2381                 } else if (wpa_s->conf->ap_scan == 1) {
2382                         /* give IBSS a bit more time */
2383                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2384                 }
2385                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2386         }
2387
2388         if (wep_keys_set &&
2389             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2390                 /* Set static WEP keys again */
2391                 wpa_set_wep_keys(wpa_s, ssid);
2392         }
2393
2394         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2395                 /*
2396                  * Do not allow EAP session resumption between different
2397                  * network configurations.
2398                  */
2399                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2400         }
2401         old_ssid = wpa_s->current_ssid;
2402         wpa_s->current_ssid = ssid;
2403         wpa_s->current_bss = bss;
2404         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2405         wpa_supplicant_initiate_eapol(wpa_s);
2406         if (old_ssid != wpa_s->current_ssid)
2407                 wpas_notify_network_changed(wpa_s);
2408 }
2409
2410
2411 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2412                                             const u8 *addr)
2413 {
2414         struct wpa_ssid *old_ssid;
2415
2416         wpas_connect_work_done(wpa_s);
2417         wpa_clear_keys(wpa_s, addr);
2418         old_ssid = wpa_s->current_ssid;
2419         wpa_supplicant_mark_disassoc(wpa_s);
2420         wpa_sm_set_config(wpa_s->wpa, NULL);
2421         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2422         if (old_ssid != wpa_s->current_ssid)
2423                 wpas_notify_network_changed(wpa_s);
2424         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2425 }
2426
2427
2428 /**
2429  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2430  * @wpa_s: Pointer to wpa_supplicant data
2431  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2432  *
2433  * This function is used to request %wpa_supplicant to deauthenticate from the
2434  * current AP.
2435  */
2436 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2437                                    int reason_code)
2438 {
2439         u8 *addr = NULL;
2440         union wpa_event_data event;
2441         int zero_addr = 0;
2442
2443         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2444                 " pending_bssid=" MACSTR " reason=%d state=%s",
2445                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2446                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2447
2448         if (!is_zero_ether_addr(wpa_s->bssid))
2449                 addr = wpa_s->bssid;
2450         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2451                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2452                   wpa_s->wpa_state == WPA_ASSOCIATING))
2453                 addr = wpa_s->pending_bssid;
2454         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2455                 /*
2456                  * When using driver-based BSS selection, we may not know the
2457                  * BSSID with which we are currently trying to associate. We
2458                  * need to notify the driver of this disconnection even in such
2459                  * a case, so use the all zeros address here.
2460                  */
2461                 addr = wpa_s->bssid;
2462                 zero_addr = 1;
2463         }
2464
2465 #ifdef CONFIG_TDLS
2466         wpa_tdls_teardown_peers(wpa_s->wpa);
2467 #endif /* CONFIG_TDLS */
2468
2469 #ifdef CONFIG_MESH
2470         if (wpa_s->ifmsh) {
2471                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2472                              wpa_s->ifname);
2473                 wpa_supplicant_leave_mesh(wpa_s);
2474         }
2475 #endif /* CONFIG_MESH */
2476
2477         if (addr) {
2478                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2479                 os_memset(&event, 0, sizeof(event));
2480                 event.deauth_info.reason_code = (u16) reason_code;
2481                 event.deauth_info.locally_generated = 1;
2482                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2483                 if (zero_addr)
2484                         addr = NULL;
2485         }
2486
2487         wpa_supplicant_clear_connection(wpa_s, addr);
2488 }
2489
2490 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2491                                               struct wpa_ssid *ssid)
2492 {
2493         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2494                 return;
2495
2496         ssid->disabled = 0;
2497         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2498         wpas_notify_network_enabled_changed(wpa_s, ssid);
2499
2500         /*
2501          * Try to reassociate since there is no current configuration and a new
2502          * network was made available.
2503          */
2504         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2505                 wpa_s->reassociate = 1;
2506 }
2507
2508
2509 /**
2510  * wpa_supplicant_enable_network - Mark a configured network as enabled
2511  * @wpa_s: wpa_supplicant structure for a network interface
2512  * @ssid: wpa_ssid structure for a configured network or %NULL
2513  *
2514  * Enables the specified network or all networks if no network specified.
2515  */
2516 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2517                                    struct wpa_ssid *ssid)
2518 {
2519         if (ssid == NULL) {
2520                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2521                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2522         } else
2523                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2524
2525         if (wpa_s->reassociate && !wpa_s->disconnected) {
2526                 if (wpa_s->sched_scanning) {
2527                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2528                                    "new network to scan filters");
2529                         wpa_supplicant_cancel_sched_scan(wpa_s);
2530                 }
2531
2532                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2533                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2534         }
2535 }
2536
2537
2538 /**
2539  * wpa_supplicant_disable_network - Mark a configured network as disabled
2540  * @wpa_s: wpa_supplicant structure for a network interface
2541  * @ssid: wpa_ssid structure for a configured network or %NULL
2542  *
2543  * Disables the specified network or all networks if no network specified.
2544  */
2545 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2546                                     struct wpa_ssid *ssid)
2547 {
2548         struct wpa_ssid *other_ssid;
2549         int was_disabled;
2550
2551         if (ssid == NULL) {
2552                 if (wpa_s->sched_scanning)
2553                         wpa_supplicant_cancel_sched_scan(wpa_s);
2554
2555                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2556                      other_ssid = other_ssid->next) {
2557                         was_disabled = other_ssid->disabled;
2558                         if (was_disabled == 2)
2559                                 continue; /* do not change persistent P2P group
2560                                            * data */
2561
2562                         other_ssid->disabled = 1;
2563
2564                         if (was_disabled != other_ssid->disabled)
2565                                 wpas_notify_network_enabled_changed(
2566                                         wpa_s, other_ssid);
2567                 }
2568                 if (wpa_s->current_ssid)
2569                         wpa_supplicant_deauthenticate(
2570                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2571         } else if (ssid->disabled != 2) {
2572                 if (ssid == wpa_s->current_ssid)
2573                         wpa_supplicant_deauthenticate(
2574                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2575
2576                 was_disabled = ssid->disabled;
2577
2578                 ssid->disabled = 1;
2579
2580                 if (was_disabled != ssid->disabled) {
2581                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2582                         if (wpa_s->sched_scanning) {
2583                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2584                                            "to remove network from filters");
2585                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2586                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2587                         }
2588                 }
2589         }
2590 }
2591
2592
2593 /**
2594  * wpa_supplicant_select_network - Attempt association with a network
2595  * @wpa_s: wpa_supplicant structure for a network interface
2596  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2597  */
2598 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2599                                    struct wpa_ssid *ssid)
2600 {
2601
2602         struct wpa_ssid *other_ssid;
2603         int disconnected = 0;
2604
2605         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2606                 wpa_s->own_disconnect_req = 1;
2607                 wpa_supplicant_deauthenticate(
2608                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2609                 disconnected = 1;
2610         }
2611
2612         if (ssid)
2613                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2614
2615         /*
2616          * Mark all other networks disabled or mark all networks enabled if no
2617          * network specified.
2618          */
2619         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2620              other_ssid = other_ssid->next) {
2621                 int was_disabled = other_ssid->disabled;
2622                 if (was_disabled == 2)
2623                         continue; /* do not change persistent P2P group data */
2624
2625                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2626                 if (was_disabled && !other_ssid->disabled)
2627                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2628
2629                 if (was_disabled != other_ssid->disabled)
2630                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2631         }
2632
2633         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2634                 /* We are already associated with the selected network */
2635                 wpa_printf(MSG_DEBUG, "Already associated with the "
2636                            "selected network - do nothing");
2637                 return;
2638         }
2639
2640         if (ssid) {
2641                 wpa_s->current_ssid = ssid;
2642                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2643                 wpa_s->connect_without_scan =
2644                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2645
2646                 /*
2647                  * Don't optimize next scan freqs since a new ESS has been
2648                  * selected.
2649                  */
2650                 os_free(wpa_s->next_scan_freqs);
2651                 wpa_s->next_scan_freqs = NULL;
2652         } else {
2653                 wpa_s->connect_without_scan = NULL;
2654         }
2655
2656         wpa_s->disconnected = 0;
2657         wpa_s->reassociate = 1;
2658
2659         if (wpa_s->connect_without_scan ||
2660             wpa_supplicant_fast_associate(wpa_s) != 1)
2661                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2662
2663         if (ssid)
2664                 wpas_notify_network_selected(wpa_s, ssid);
2665 }
2666
2667
2668 /**
2669  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2670  * @wpa_s: wpa_supplicant structure for a network interface
2671  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2672  * @pkcs11_module_path: PKCS #11 module path or NULL
2673  * Returns: 0 on success; -1 on failure
2674  *
2675  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2676  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2677  * module path fails the paths will be reset to the default value (NULL).
2678  */
2679 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2680                                            const char *pkcs11_engine_path,
2681                                            const char *pkcs11_module_path)
2682 {
2683         char *pkcs11_engine_path_copy = NULL;
2684         char *pkcs11_module_path_copy = NULL;
2685
2686         if (pkcs11_engine_path != NULL) {
2687                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2688                 if (pkcs11_engine_path_copy == NULL)
2689                         return -1;
2690         }
2691         if (pkcs11_module_path != NULL) {
2692                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2693                 if (pkcs11_module_path_copy == NULL) {
2694                         os_free(pkcs11_engine_path_copy);
2695                         return -1;
2696                 }
2697         }
2698
2699         os_free(wpa_s->conf->pkcs11_engine_path);
2700         os_free(wpa_s->conf->pkcs11_module_path);
2701         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2702         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2703
2704         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2705         eapol_sm_deinit(wpa_s->eapol);
2706         wpa_s->eapol = NULL;
2707         if (wpa_supplicant_init_eapol(wpa_s)) {
2708                 /* Error -> Reset paths to the default value (NULL) once. */
2709                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2710                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2711                                                                NULL);
2712
2713                 return -1;
2714         }
2715         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2716
2717         return 0;
2718 }
2719
2720
2721 /**
2722  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2723  * @wpa_s: wpa_supplicant structure for a network interface
2724  * @ap_scan: AP scan mode
2725  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2726  *
2727  */
2728 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2729 {
2730
2731         int old_ap_scan;
2732
2733         if (ap_scan < 0 || ap_scan > 2)
2734                 return -1;
2735
2736 #ifdef ANDROID
2737         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2738             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2739             wpa_s->wpa_state < WPA_COMPLETED) {
2740                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2741                            "associating", wpa_s->conf->ap_scan, ap_scan);
2742                 return 0;
2743         }
2744 #endif /* ANDROID */
2745
2746         old_ap_scan = wpa_s->conf->ap_scan;
2747         wpa_s->conf->ap_scan = ap_scan;
2748
2749         if (old_ap_scan != wpa_s->conf->ap_scan)
2750                 wpas_notify_ap_scan_changed(wpa_s);
2751
2752         return 0;
2753 }
2754
2755
2756 /**
2757  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2758  * @wpa_s: wpa_supplicant structure for a network interface
2759  * @expire_age: Expiration age in seconds
2760  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2761  *
2762  */
2763 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2764                                           unsigned int bss_expire_age)
2765 {
2766         if (bss_expire_age < 10) {
2767                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2768                         bss_expire_age);
2769                 return -1;
2770         }
2771         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2772                 bss_expire_age);
2773         wpa_s->conf->bss_expiration_age = bss_expire_age;
2774
2775         return 0;
2776 }
2777
2778
2779 /**
2780  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2781  * @wpa_s: wpa_supplicant structure for a network interface
2782  * @expire_count: number of scans after which an unseen BSS is reclaimed
2783  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2784  *
2785  */
2786 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2787                                             unsigned int bss_expire_count)
2788 {
2789         if (bss_expire_count < 1) {
2790                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2791                         bss_expire_count);
2792                 return -1;
2793         }
2794         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2795                 bss_expire_count);
2796         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2797
2798         return 0;
2799 }
2800
2801
2802 /**
2803  * wpa_supplicant_set_scan_interval - Set scan interval
2804  * @wpa_s: wpa_supplicant structure for a network interface
2805  * @scan_interval: scan interval in seconds
2806  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2807  *
2808  */
2809 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2810                                      int scan_interval)
2811 {
2812         if (scan_interval < 0) {
2813                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2814                         scan_interval);
2815                 return -1;
2816         }
2817         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2818                 scan_interval);
2819         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2820
2821         return 0;
2822 }
2823
2824
2825 /**
2826  * wpa_supplicant_set_debug_params - Set global debug params
2827  * @global: wpa_global structure
2828  * @debug_level: debug level
2829  * @debug_timestamp: determines if show timestamp in debug data
2830  * @debug_show_keys: determines if show keys in debug data
2831  * Returns: 0 if succeed or -1 if debug_level has wrong value
2832  */
2833 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2834                                     int debug_timestamp, int debug_show_keys)
2835 {
2836
2837         int old_level, old_timestamp, old_show_keys;
2838
2839         /* check for allowed debuglevels */
2840         if (debug_level != MSG_EXCESSIVE &&
2841             debug_level != MSG_MSGDUMP &&
2842             debug_level != MSG_DEBUG &&
2843             debug_level != MSG_INFO &&
2844             debug_level != MSG_WARNING &&
2845             debug_level != MSG_ERROR)
2846                 return -1;
2847
2848         old_level = wpa_debug_level;
2849         old_timestamp = wpa_debug_timestamp;
2850         old_show_keys = wpa_debug_show_keys;
2851
2852         wpa_debug_level = debug_level;
2853         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2854         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2855
2856         if (wpa_debug_level != old_level)
2857                 wpas_notify_debug_level_changed(global);
2858         if (wpa_debug_timestamp != old_timestamp)
2859                 wpas_notify_debug_timestamp_changed(global);
2860         if (wpa_debug_show_keys != old_show_keys)
2861                 wpas_notify_debug_show_keys_changed(global);
2862
2863         return 0;
2864 }
2865
2866
2867 /**
2868  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2869  * @wpa_s: Pointer to wpa_supplicant data
2870  * Returns: A pointer to the current network structure or %NULL on failure
2871  */
2872 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2873 {
2874         struct wpa_ssid *entry;
2875         u8 ssid[SSID_MAX_LEN];
2876         int res;
2877         size_t ssid_len;
2878         u8 bssid[ETH_ALEN];
2879         int wired;
2880
2881         res = wpa_drv_get_ssid(wpa_s, ssid);
2882         if (res < 0) {
2883                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2884                         "driver");
2885                 return NULL;
2886         }
2887         ssid_len = res;
2888
2889         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2890                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2891                         "driver");
2892                 return NULL;
2893         }
2894
2895         wired = wpa_s->conf->ap_scan == 0 &&
2896                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2897
2898         entry = wpa_s->conf->ssid;
2899         while (entry) {
2900                 if (!wpas_network_disabled(wpa_s, entry) &&
2901                     ((ssid_len == entry->ssid_len &&
2902                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2903                     (!entry->bssid_set ||
2904                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2905                         return entry;
2906 #ifdef CONFIG_WPS
2907                 if (!wpas_network_disabled(wpa_s, entry) &&
2908                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2909                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2910                     (!entry->bssid_set ||
2911                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2912                         return entry;
2913 #endif /* CONFIG_WPS */
2914
2915                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2916                     entry->ssid_len == 0 &&
2917                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2918                         return entry;
2919
2920                 entry = entry->next;
2921         }
2922
2923         return NULL;
2924 }
2925
2926
2927 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2928 {
2929         struct wpa_global *global = wpa_s->global;
2930
2931         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2932                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2933                 if (global->drv_priv[i] == NULL) {
2934                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2935                                    "'%s'", wpa_drivers[i]->name);
2936                         return -1;
2937                 }
2938         }
2939
2940         wpa_s->driver = wpa_drivers[i];
2941         wpa_s->global_drv_priv = global->drv_priv[i];
2942
2943         return 0;
2944 }
2945
2946
2947 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2948                                      const char *name)
2949 {
2950         int i;
2951         size_t len;
2952         const char *pos, *driver = name;
2953
2954         if (wpa_s == NULL)
2955                 return -1;
2956
2957         if (wpa_drivers[0] == NULL) {
2958                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2959                         "wpa_supplicant");
2960                 return -1;
2961         }
2962
2963         if (name == NULL) {
2964                 /* default to first driver in the list */
2965                 return select_driver(wpa_s, 0);
2966         }
2967
2968         do {
2969                 pos = os_strchr(driver, ',');
2970                 if (pos)
2971                         len = pos - driver;
2972                 else
2973                         len = os_strlen(driver);
2974
2975                 for (i = 0; wpa_drivers[i]; i++) {
2976                         if (os_strlen(wpa_drivers[i]->name) == len &&
2977                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2978                             0) {
2979                                 /* First driver that succeeds wins */
2980                                 if (select_driver(wpa_s, i) == 0)
2981                                         return 0;
2982                         }
2983                 }
2984
2985                 driver = pos + 1;
2986         } while (pos);
2987
2988         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2989         return -1;
2990 }
2991
2992
2993 /**
2994  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2995  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2996  *      with struct wpa_driver_ops::init()
2997  * @src_addr: Source address of the EAPOL frame
2998  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2999  * @len: Length of the EAPOL data
3000  *
3001  * This function is called for each received EAPOL frame. Most driver
3002  * interfaces rely on more generic OS mechanism for receiving frames through
3003  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3004  * take care of received EAPOL frames and deliver them to the core supplicant
3005  * code by calling this function.
3006  */
3007 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3008                              const u8 *buf, size_t len)
3009 {
3010         struct wpa_supplicant *wpa_s = ctx;
3011
3012         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3013         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3014
3015 #ifdef CONFIG_PEERKEY
3016         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3017             wpa_s->current_ssid->peerkey &&
3018             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3019             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3020                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3021                 return;
3022         }
3023 #endif /* CONFIG_PEERKEY */
3024
3025         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3026             (wpa_s->last_eapol_matches_bssid &&
3027 #ifdef CONFIG_AP
3028              !wpa_s->ap_iface &&
3029 #endif /* CONFIG_AP */
3030              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3031                 /*
3032                  * There is possible race condition between receiving the
3033                  * association event and the EAPOL frame since they are coming
3034                  * through different paths from the driver. In order to avoid
3035                  * issues in trying to process the EAPOL frame before receiving
3036                  * association information, lets queue it for processing until
3037                  * the association event is received. This may also be needed in
3038                  * driver-based roaming case, so also use src_addr != BSSID as a
3039                  * trigger if we have previously confirmed that the
3040                  * Authenticator uses BSSID as the src_addr (which is not the
3041                  * case with wired IEEE 802.1X).
3042                  */
3043                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3044                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3045                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3046                         MAC2STR(wpa_s->bssid));
3047                 wpabuf_free(wpa_s->pending_eapol_rx);
3048                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3049                 if (wpa_s->pending_eapol_rx) {
3050                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3051                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3052                                   ETH_ALEN);
3053                 }
3054                 return;
3055         }
3056
3057         wpa_s->last_eapol_matches_bssid =
3058                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3059
3060 #ifdef CONFIG_AP
3061         if (wpa_s->ap_iface) {
3062                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3063                 return;
3064         }
3065 #endif /* CONFIG_AP */
3066
3067         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3068                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3069                         "no key management is configured");
3070                 return;
3071         }
3072
3073         if (wpa_s->eapol_received == 0 &&
3074             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3075              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3076              wpa_s->wpa_state != WPA_COMPLETED) &&
3077             (wpa_s->current_ssid == NULL ||
3078              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3079                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3080                 int timeout = 10;
3081
3082                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3083                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3084                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3085                         /* Use longer timeout for IEEE 802.1X/EAP */
3086                         timeout = 70;
3087                 }
3088
3089                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3090                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3091                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3092                         /*
3093                          * Use shorter timeout if going through WPS AP iteration
3094                          * for PIN config method with an AP that does not
3095                          * advertise Selected Registrar.
3096                          */
3097                         struct wpabuf *wps_ie;
3098
3099                         wps_ie = wpa_bss_get_vendor_ie_multi(
3100                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3101                         if (wps_ie && !wps_is_selected_pbc_registrar(wps_ie))
3102                                 timeout = 10;
3103                         wpabuf_free(wps_ie);
3104                 }
3105
3106                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3107         }
3108         wpa_s->eapol_received++;
3109
3110         if (wpa_s->countermeasures) {
3111                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3112                         "EAPOL packet");
3113                 return;
3114         }
3115
3116 #ifdef CONFIG_IBSS_RSN
3117         if (wpa_s->current_ssid &&
3118             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3119                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3120                 return;
3121         }
3122 #endif /* CONFIG_IBSS_RSN */
3123
3124         /* Source address of the incoming EAPOL frame could be compared to the
3125          * current BSSID. However, it is possible that a centralized
3126          * Authenticator could be using another MAC address than the BSSID of
3127          * an AP, so just allow any address to be used for now. The replies are
3128          * still sent to the current BSSID (if available), though. */
3129
3130         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3131         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3132             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3133                 return;
3134         wpa_drv_poll(wpa_s);
3135         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3136                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3137         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3138                 /*
3139                  * Set portValid = TRUE here since we are going to skip 4-way
3140                  * handshake processing which would normally set portValid. We
3141                  * need this to allow the EAPOL state machines to be completed
3142                  * without going through EAPOL-Key handshake.
3143                  */
3144                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3145         }
3146 }
3147
3148
3149 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3150 {
3151         if ((!wpa_s->p2p_mgmt ||
3152              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3153             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3154                 l2_packet_deinit(wpa_s->l2);
3155                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3156                                            wpa_drv_get_mac_addr(wpa_s),
3157                                            ETH_P_EAPOL,
3158                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3159                 if (wpa_s->l2 == NULL)
3160                         return -1;
3161         } else {
3162                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3163                 if (addr)
3164                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3165         }
3166
3167         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3168                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3169                 return -1;
3170         }
3171
3172         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3173
3174         return 0;
3175 }
3176
3177
3178 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3179                                            const u8 *buf, size_t len)
3180 {
3181         struct wpa_supplicant *wpa_s = ctx;
3182         const struct l2_ethhdr *eth;
3183
3184         if (len < sizeof(*eth))
3185                 return;
3186         eth = (const struct l2_ethhdr *) buf;
3187
3188         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3189             !(eth->h_dest[0] & 0x01)) {
3190                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3191                         " (bridge - not for this interface - ignore)",
3192                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3193                 return;
3194         }
3195
3196         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3197                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3198         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3199                                 len - sizeof(*eth));
3200 }
3201
3202
3203 /**
3204  * wpa_supplicant_driver_init - Initialize driver interface parameters
3205  * @wpa_s: Pointer to wpa_supplicant data
3206  * Returns: 0 on success, -1 on failure
3207  *
3208  * This function is called to initialize driver interface parameters.
3209  * wpa_drv_init() must have been called before this function to initialize the
3210  * driver interface.
3211  */
3212 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3213 {
3214         static int interface_count = 0;
3215
3216         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3217                 return -1;
3218
3219         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3220                 MAC2STR(wpa_s->own_addr));
3221         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3222         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3223
3224         if (wpa_s->bridge_ifname[0]) {
3225                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3226                         "interface '%s'", wpa_s->bridge_ifname);
3227                 wpa_s->l2_br = l2_packet_init_bridge(
3228                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3229                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3230                 if (wpa_s->l2_br == NULL) {
3231                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3232                                 "connection for the bridge interface '%s'",
3233                                 wpa_s->bridge_ifname);
3234                         return -1;
3235                 }
3236         }
3237
3238         wpa_clear_keys(wpa_s, NULL);
3239
3240         /* Make sure that TKIP countermeasures are not left enabled (could
3241          * happen if wpa_supplicant is killed during countermeasures. */
3242         wpa_drv_set_countermeasures(wpa_s, 0);
3243
3244         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3245         wpa_drv_flush_pmkid(wpa_s);
3246
3247         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3248         wpa_s->prev_scan_wildcard = 0;
3249
3250         if (wpa_supplicant_enabled_networks(wpa_s)) {
3251                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3252                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3253                         interface_count = 0;
3254                 }
3255 #ifndef ANDROID
3256                 if (!wpa_s->p2p_mgmt &&
3257                     wpa_supplicant_delayed_sched_scan(wpa_s,
3258                                                       interface_count % 3,
3259                                                       100000))
3260                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3261                                                 100000);
3262 #endif /* ANDROID */
3263                 interface_count++;
3264         } else
3265                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3266
3267         return 0;
3268 }
3269
3270
3271 static int wpa_supplicant_daemon(const char *pid_file)
3272 {
3273         wpa_printf(MSG_DEBUG, "Daemonize..");
3274         return os_daemonize(pid_file);
3275 }
3276
3277
3278 static struct wpa_supplicant *
3279 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3280 {
3281         struct wpa_supplicant *wpa_s;
3282
3283         wpa_s = os_zalloc(sizeof(*wpa_s));
3284         if (wpa_s == NULL)
3285                 return NULL;
3286         wpa_s->scan_req = INITIAL_SCAN_REQ;
3287         wpa_s->scan_interval = 5;
3288         wpa_s->new_connection = 1;
3289         wpa_s->parent = parent ? parent : wpa_s;
3290         wpa_s->sched_scanning = 0;
3291
3292         return wpa_s;
3293 }
3294
3295
3296 #ifdef CONFIG_HT_OVERRIDES
3297
3298 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3299                              struct ieee80211_ht_capabilities *htcaps,
3300                              struct ieee80211_ht_capabilities *htcaps_mask,
3301                              const char *ht_mcs)
3302 {
3303         /* parse ht_mcs into hex array */
3304         int i;
3305         const char *tmp = ht_mcs;
3306         char *end = NULL;
3307
3308         /* If ht_mcs is null, do not set anything */
3309         if (!ht_mcs)
3310                 return 0;
3311
3312         /* This is what we are setting in the kernel */
3313         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3314
3315         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3316
3317         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3318                 errno = 0;
3319                 long v = strtol(tmp, &end, 16);
3320                 if (errno == 0) {
3321                         wpa_msg(wpa_s, MSG_DEBUG,
3322                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3323                                 i, v, end, tmp);
3324                         if (end == tmp)
3325                                 break;
3326
3327                         htcaps->supported_mcs_set[i] = v;
3328                         tmp = end;
3329                 } else {
3330                         wpa_msg(wpa_s, MSG_ERROR,
3331                                 "Failed to parse ht-mcs: %s, error: %s\n",
3332                                 ht_mcs, strerror(errno));
3333                         return -1;
3334                 }
3335         }
3336
3337         /*
3338          * If we were able to parse any values, then set mask for the MCS set.
3339          */
3340         if (i) {
3341                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3342                           IEEE80211_HT_MCS_MASK_LEN - 1);
3343                 /* skip the 3 reserved bits */
3344                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3345                         0x1f;
3346         }
3347
3348         return 0;
3349 }
3350
3351
3352 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3353                                  struct ieee80211_ht_capabilities *htcaps,
3354                                  struct ieee80211_ht_capabilities *htcaps_mask,
3355                                  int disabled)
3356 {
3357         le16 msk;
3358
3359         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3360
3361         if (disabled == -1)
3362                 return 0;
3363
3364         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3365         htcaps_mask->ht_capabilities_info |= msk;
3366         if (disabled)
3367                 htcaps->ht_capabilities_info &= msk;
3368         else
3369                 htcaps->ht_capabilities_info |= msk;
3370
3371         return 0;
3372 }
3373
3374
3375 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3376                                 struct ieee80211_ht_capabilities *htcaps,
3377                                 struct ieee80211_ht_capabilities *htcaps_mask,
3378                                 int factor)
3379 {
3380         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3381
3382         if (factor == -1)
3383                 return 0;
3384
3385         if (factor < 0 || factor > 3) {
3386                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3387                         "Must be 0-3 or -1", factor);
3388                 return -EINVAL;
3389         }
3390
3391         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3392         htcaps->a_mpdu_params &= ~0x3;
3393         htcaps->a_mpdu_params |= factor & 0x3;
3394
3395         return 0;
3396 }
3397
3398
3399 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3400                                  struct ieee80211_ht_capabilities *htcaps,
3401                                  struct ieee80211_ht_capabilities *htcaps_mask,
3402                                  int density)
3403 {
3404         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3405
3406         if (density == -1)
3407                 return 0;
3408
3409         if (density < 0 || density > 7) {
3410                 wpa_msg(wpa_s, MSG_ERROR,
3411                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3412                         density);
3413                 return -EINVAL;
3414         }
3415
3416         htcaps_mask->a_mpdu_params |= 0x1C;
3417         htcaps->a_mpdu_params &= ~(0x1C);
3418         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3419
3420         return 0;
3421 }
3422
3423
3424 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3425                                 struct ieee80211_ht_capabilities *htcaps,
3426                                 struct ieee80211_ht_capabilities *htcaps_mask,
3427                                 int disabled)
3428 {
3429         /* Masking these out disables HT40 */
3430         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3431                                 HT_CAP_INFO_SHORT_GI40MHZ);
3432
3433         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3434
3435         if (disabled)
3436                 htcaps->ht_capabilities_info &= ~msk;
3437         else
3438                 htcaps->ht_capabilities_info |= msk;
3439
3440         htcaps_mask->ht_capabilities_info |= msk;
3441
3442         return 0;
3443 }
3444
3445
3446 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3447                                struct ieee80211_ht_capabilities *htcaps,
3448                                struct ieee80211_ht_capabilities *htcaps_mask,
3449                                int disabled)
3450 {
3451         /* Masking these out disables SGI */
3452         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3453                                 HT_CAP_INFO_SHORT_GI40MHZ);
3454
3455         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3456
3457         if (disabled)
3458                 htcaps->ht_capabilities_info &= ~msk;
3459         else
3460                 htcaps->ht_capabilities_info |= msk;
3461
3462         htcaps_mask->ht_capabilities_info |= msk;
3463
3464         return 0;
3465 }
3466
3467
3468 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3469                                struct ieee80211_ht_capabilities *htcaps,
3470                                struct ieee80211_ht_capabilities *htcaps_mask,
3471                                int disabled)
3472 {
3473         /* Masking these out disables LDPC */
3474         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3475
3476         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3477
3478         if (disabled)
3479                 htcaps->ht_capabilities_info &= ~msk;
3480         else
3481                 htcaps->ht_capabilities_info |= msk;
3482
3483         htcaps_mask->ht_capabilities_info |= msk;
3484
3485         return 0;
3486 }
3487
3488
3489 void wpa_supplicant_apply_ht_overrides(
3490         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3491         struct wpa_driver_associate_params *params)
3492 {
3493         struct ieee80211_ht_capabilities *htcaps;
3494         struct ieee80211_ht_capabilities *htcaps_mask;
3495
3496         if (!ssid)
3497                 return;
3498
3499         params->disable_ht = ssid->disable_ht;
3500         if (!params->htcaps || !params->htcaps_mask)
3501                 return;
3502
3503         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3504         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3505         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3506         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3507                               ssid->disable_max_amsdu);
3508         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3509         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3510         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3511         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3512         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3513
3514         if (ssid->ht40_intolerant) {
3515                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3516                 htcaps->ht_capabilities_info |= bit;
3517                 htcaps_mask->ht_capabilities_info |= bit;
3518         }
3519 }
3520
3521 #endif /* CONFIG_HT_OVERRIDES */
3522
3523
3524 #ifdef CONFIG_VHT_OVERRIDES
3525 void wpa_supplicant_apply_vht_overrides(
3526         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3527         struct wpa_driver_associate_params *params)
3528 {
3529         struct ieee80211_vht_capabilities *vhtcaps;
3530         struct ieee80211_vht_capabilities *vhtcaps_mask;
3531
3532         if (!ssid)
3533                 return;
3534
3535         params->disable_vht = ssid->disable_vht;
3536
3537         vhtcaps = (void *) params->vhtcaps;
3538         vhtcaps_mask = (void *) params->vhtcaps_mask;
3539
3540         if (!vhtcaps || !vhtcaps_mask)
3541                 return;
3542
3543         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3544         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3545
3546 #ifdef CONFIG_HT_OVERRIDES
3547         /* if max ampdu is <= 3, we have to make the HT cap the same */
3548         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3549                 int max_ampdu;
3550
3551                 max_ampdu = (ssid->vht_capa &
3552                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3553                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3554
3555                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3556                 wpa_set_ampdu_factor(wpa_s,
3557                                      (void *) params->htcaps,
3558                                      (void *) params->htcaps_mask,
3559                                      max_ampdu);
3560         }
3561 #endif /* CONFIG_HT_OVERRIDES */
3562
3563 #define OVERRIDE_MCS(i)                                                 \
3564         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3565                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3566                         3 << 2 * (i - 1);                               \
3567                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3568                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3569         }                                                               \
3570         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3571                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3572                         3 << 2 * (i - 1);                               \
3573                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3574                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3575         }
3576
3577         OVERRIDE_MCS(1);
3578         OVERRIDE_MCS(2);
3579         OVERRIDE_MCS(3);
3580         OVERRIDE_MCS(4);
3581         OVERRIDE_MCS(5);
3582         OVERRIDE_MCS(6);
3583         OVERRIDE_MCS(7);
3584         OVERRIDE_MCS(8);
3585 }
3586 #endif /* CONFIG_VHT_OVERRIDES */
3587
3588
3589 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3590 {
3591 #ifdef PCSC_FUNCS
3592         size_t len;
3593
3594         if (!wpa_s->conf->pcsc_reader)
3595                 return 0;
3596
3597         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3598         if (!wpa_s->scard)
3599                 return 1;
3600
3601         if (wpa_s->conf->pcsc_pin &&
3602             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3603                 scard_deinit(wpa_s->scard);
3604                 wpa_s->scard = NULL;
3605                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3606                 return -1;
3607         }
3608
3609         len = sizeof(wpa_s->imsi) - 1;
3610         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3611                 scard_deinit(wpa_s->scard);
3612                 wpa_s->scard = NULL;
3613                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3614                 return -1;
3615         }
3616         wpa_s->imsi[len] = '\0';
3617
3618         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3619
3620         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3621                    wpa_s->imsi, wpa_s->mnc_len);
3622
3623         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3624         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3625 #endif /* PCSC_FUNCS */
3626
3627         return 0;
3628 }
3629
3630
3631 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3632 {
3633         char *val, *pos;
3634
3635         ext_password_deinit(wpa_s->ext_pw);
3636         wpa_s->ext_pw = NULL;
3637         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3638
3639         if (!wpa_s->conf->ext_password_backend)
3640                 return 0;
3641
3642         val = os_strdup(wpa_s->conf->ext_password_backend);
3643         if (val == NULL)
3644                 return -1;
3645         pos = os_strchr(val, ':');
3646         if (pos)
3647                 *pos++ = '\0';
3648
3649         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3650
3651         wpa_s->ext_pw = ext_password_init(val, pos);
3652         os_free(val);
3653         if (wpa_s->ext_pw == NULL) {
3654                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3655                 return -1;
3656         }
3657         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3658
3659         return 0;
3660 }
3661
3662
3663 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3664                                     const struct wpa_driver_capa *capa)
3665 {
3666         struct wowlan_triggers *triggers;
3667         int ret = 0;
3668
3669         if (!wpa_s->conf->wowlan_triggers)
3670                 return 0;
3671
3672         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3673         if (triggers) {
3674                 ret = wpa_drv_wowlan(wpa_s, triggers);
3675                 os_free(triggers);
3676         }
3677         return ret;
3678 }
3679
3680
3681 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3682                                               const char *rn)
3683 {
3684         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3685         struct wpa_radio *radio;
3686
3687         while (rn && iface) {
3688                 radio = iface->radio;
3689                 if (radio && os_strcmp(rn, radio->name) == 0) {
3690                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3691                                    wpa_s->ifname, rn);
3692                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3693                         return radio;
3694                 }
3695
3696                 iface = iface->next;
3697         }
3698
3699         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3700                    wpa_s->ifname, rn ? rn : "N/A");
3701         radio = os_zalloc(sizeof(*radio));
3702         if (radio == NULL)
3703                 return NULL;
3704
3705         if (rn)
3706                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3707         dl_list_init(&radio->ifaces);
3708         dl_list_init(&radio->work);
3709         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3710
3711         return radio;
3712 }
3713
3714
3715 static void radio_work_free(struct wpa_radio_work *work)
3716 {
3717         if (work->wpa_s->scan_work == work) {
3718                 /* This should not really happen. */
3719                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3720                         work->type, work, work->started);
3721                 work->wpa_s->scan_work = NULL;
3722         }
3723
3724 #ifdef CONFIG_P2P
3725         if (work->wpa_s->p2p_scan_work == work) {
3726                 /* This should not really happen. */
3727                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3728                         work->type, work, work->started);
3729                 work->wpa_s->p2p_scan_work = NULL;
3730         }
3731 #endif /* CONFIG_P2P */
3732
3733         dl_list_del(&work->list);
3734         os_free(work);
3735 }
3736
3737
3738 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3739 {
3740         struct wpa_radio *radio = eloop_ctx;
3741         struct wpa_radio_work *work;
3742         struct os_reltime now, diff;
3743         struct wpa_supplicant *wpa_s;
3744
3745         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3746         if (work == NULL)
3747                 return;
3748
3749         if (work->started)
3750                 return; /* already started and still in progress */
3751
3752         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3753                               radio_list);
3754         if (wpa_s && wpa_s->radio->external_scan_running) {
3755                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3756                 return;
3757         }
3758
3759         os_get_reltime(&now);
3760         os_reltime_sub(&now, &work->time, &diff);
3761         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3762                 work->type, work, diff.sec, diff.usec);
3763         work->started = 1;
3764         work->time = now;
3765         work->cb(work, 0);
3766 }
3767
3768
3769 /*
3770  * This function removes both started and pending radio works running on
3771  * the provided interface's radio.
3772  * Prior to the removal of the radio work, its callback (cb) is called with
3773  * deinit set to be 1. Each work's callback is responsible for clearing its
3774  * internal data and restoring to a correct state.
3775  * @wpa_s: wpa_supplicant data
3776  * @type: type of works to be removed
3777  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3778  * this interface's works.
3779  */
3780 void radio_remove_works(struct wpa_supplicant *wpa_s,
3781                         const char *type, int remove_all)
3782 {
3783         struct wpa_radio_work *work, *tmp;
3784         struct wpa_radio *radio = wpa_s->radio;
3785
3786         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3787                               list) {
3788                 if (type && os_strcmp(type, work->type) != 0)
3789                         continue;
3790
3791                 /* skip other ifaces' works */
3792                 if (!remove_all && work->wpa_s != wpa_s)
3793                         continue;
3794
3795                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3796                         work->type, work, work->started ? " (started)" : "");
3797                 work->cb(work, 1);
3798                 radio_work_free(work);
3799         }
3800
3801         /* in case we removed the started work */
3802         radio_work_check_next(wpa_s);
3803 }
3804
3805
3806 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3807 {
3808         struct wpa_radio *radio = wpa_s->radio;
3809
3810         if (!radio)
3811                 return;
3812
3813         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3814                    wpa_s->ifname, radio->name);
3815         dl_list_del(&wpa_s->radio_list);
3816         radio_remove_works(wpa_s, NULL, 0);
3817         wpa_s->radio = NULL;
3818         if (!dl_list_empty(&radio->ifaces))
3819                 return; /* Interfaces remain for this radio */
3820
3821         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3822         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3823         os_free(radio);
3824 }
3825
3826
3827 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3828 {
3829         struct wpa_radio *radio = wpa_s->radio;
3830
3831         if (dl_list_empty(&radio->work))
3832                 return;
3833         if (wpa_s->ext_work_in_progress) {
3834                 wpa_printf(MSG_DEBUG,
3835                            "External radio work in progress - delay start of pending item");
3836                 return;
3837         }
3838         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3839         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3840 }
3841
3842
3843 /**
3844  * radio_add_work - Add a radio work item
3845  * @wpa_s: Pointer to wpa_supplicant data
3846  * @freq: Frequency of the offchannel operation in MHz or 0
3847  * @type: Unique identifier for each type of work
3848  * @next: Force as the next work to be executed
3849  * @cb: Callback function for indicating when radio is available
3850  * @ctx: Context pointer for the work (work->ctx in cb())
3851  * Returns: 0 on success, -1 on failure
3852  *
3853  * This function is used to request time for an operation that requires
3854  * exclusive radio control. Once the radio is available, the registered callback
3855  * function will be called. radio_work_done() must be called once the exclusive
3856  * radio operation has been completed, so that the radio is freed for other
3857  * operations. The special case of deinit=1 is used to free the context data
3858  * during interface removal. That does not allow the callback function to start
3859  * the radio operation, i.e., it must free any resources allocated for the radio
3860  * work and return.
3861  *
3862  * The @freq parameter can be used to indicate a single channel on which the
3863  * offchannel operation will occur. This may allow multiple radio work
3864  * operations to be performed in parallel if they apply for the same channel.
3865  * Setting this to 0 indicates that the work item may use multiple channels or
3866  * requires exclusive control of the radio.
3867  */
3868 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3869                    const char *type, int next,
3870                    void (*cb)(struct wpa_radio_work *work, int deinit),
3871                    void *ctx)
3872 {
3873         struct wpa_radio_work *work;
3874         int was_empty;
3875
3876         work = os_zalloc(sizeof(*work));
3877         if (work == NULL)
3878                 return -1;
3879         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3880         os_get_reltime(&work->time);
3881         work->freq = freq;
3882         work->type = type;
3883         work->wpa_s = wpa_s;
3884         work->cb = cb;
3885         work->ctx = ctx;
3886
3887         was_empty = dl_list_empty(&wpa_s->radio->work);
3888         if (next)
3889                 dl_list_add(&wpa_s->radio->work, &work->list);
3890         else
3891                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3892         if (was_empty) {
3893                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3894                 radio_work_check_next(wpa_s);
3895         }
3896
3897         return 0;
3898 }
3899
3900
3901 /**
3902  * radio_work_done - Indicate that a radio work item has been completed
3903  * @work: Completed work
3904  *
3905  * This function is called once the callback function registered with
3906  * radio_add_work() has completed its work.
3907  */
3908 void radio_work_done(struct wpa_radio_work *work)
3909 {
3910         struct wpa_supplicant *wpa_s = work->wpa_s;
3911         struct os_reltime now, diff;
3912         unsigned int started = work->started;
3913
3914         os_get_reltime(&now);
3915         os_reltime_sub(&now, &work->time, &diff);
3916         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3917                 work->type, work, started ? "done" : "canceled",
3918                 diff.sec, diff.usec);
3919         radio_work_free(work);
3920         if (started)
3921                 radio_work_check_next(wpa_s);
3922 }
3923
3924
3925 struct wpa_radio_work *
3926 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3927 {
3928         struct wpa_radio_work *work;
3929         struct wpa_radio *radio = wpa_s->radio;
3930
3931         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3932                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3933                         return work;
3934         }
3935
3936         return NULL;
3937 }
3938
3939
3940 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3941                             struct wpa_interface *iface)
3942 {
3943         const char *ifname, *driver, *rn;
3944
3945         driver = iface->driver;
3946 next_driver:
3947         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3948                 return -1;
3949
3950         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3951         if (wpa_s->drv_priv == NULL) {
3952                 const char *pos;
3953                 pos = driver ? os_strchr(driver, ',') : NULL;
3954                 if (pos) {
3955                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3956                                 "driver interface - try next driver wrapper");
3957                         driver = pos + 1;
3958                         goto next_driver;
3959                 }
3960                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3961                         "interface");
3962                 return -1;
3963         }
3964         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3965                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3966                         "driver_param '%s'", wpa_s->conf->driver_param);
3967                 return -1;
3968         }
3969
3970         ifname = wpa_drv_get_ifname(wpa_s);
3971         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3972                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3973                         "interface name with '%s'", ifname);
3974                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3975         }
3976
3977         rn = wpa_driver_get_radio_name(wpa_s);
3978         if (rn && rn[0] == '\0')
3979                 rn = NULL;
3980
3981         wpa_s->radio = radio_add_interface(wpa_s, rn);
3982         if (wpa_s->radio == NULL)
3983                 return -1;
3984
3985         return 0;
3986 }
3987
3988
3989 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3990                                      struct wpa_interface *iface)
3991 {
3992         struct wpa_driver_capa capa;
3993         int capa_res;
3994
3995         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3996                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3997                    iface->confname ? iface->confname : "N/A",
3998                    iface->driver ? iface->driver : "default",
3999                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4000                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4001
4002         if (iface->confname) {
4003 #ifdef CONFIG_BACKEND_FILE
4004                 wpa_s->confname = os_rel2abs_path(iface->confname);
4005                 if (wpa_s->confname == NULL) {
4006                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4007                                    "for configuration file '%s'.",
4008                                    iface->confname);
4009                         return -1;
4010                 }
4011                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4012                            iface->confname, wpa_s->confname);
4013 #else /* CONFIG_BACKEND_FILE */
4014                 wpa_s->confname = os_strdup(iface->confname);
4015 #endif /* CONFIG_BACKEND_FILE */
4016                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4017                 if (wpa_s->conf == NULL) {
4018                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4019                                    "configuration '%s'.", wpa_s->confname);
4020                         return -1;
4021                 }
4022                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4023                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4024
4025                 /*
4026                  * Override ctrl_interface and driver_param if set on command
4027                  * line.
4028                  */
4029                 if (iface->ctrl_interface) {
4030                         os_free(wpa_s->conf->ctrl_interface);
4031                         wpa_s->conf->ctrl_interface =
4032                                 os_strdup(iface->ctrl_interface);
4033                 }
4034
4035                 if (iface->driver_param) {
4036                         os_free(wpa_s->conf->driver_param);
4037                         wpa_s->conf->driver_param =
4038                                 os_strdup(iface->driver_param);
4039                 }
4040
4041                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4042                         os_free(wpa_s->conf->ctrl_interface);
4043                         wpa_s->conf->ctrl_interface = NULL;
4044                 }
4045         } else
4046                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4047                                                      iface->driver_param);
4048
4049         if (wpa_s->conf == NULL) {
4050                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4051                 return -1;
4052         }
4053
4054         if (iface->ifname == NULL) {
4055                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4056                 return -1;
4057         }
4058         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4059                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4060                            iface->ifname);
4061                 return -1;
4062         }
4063         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4064
4065         if (iface->bridge_ifname) {
4066                 if (os_strlen(iface->bridge_ifname) >=
4067                     sizeof(wpa_s->bridge_ifname)) {
4068                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4069                                    "name '%s'.", iface->bridge_ifname);
4070                         return -1;
4071                 }
4072                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4073                            sizeof(wpa_s->bridge_ifname));
4074         }
4075
4076         /* RSNA Supplicant Key Management - INITIALIZE */
4077         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4078         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4079
4080         /* Initialize driver interface and register driver event handler before
4081          * L2 receive handler so that association events are processed before
4082          * EAPOL-Key packets if both become available for the same select()
4083          * call. */
4084         if (wpas_init_driver(wpa_s, iface) < 0)
4085                 return -1;
4086
4087         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4088                 return -1;
4089
4090         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4091                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4092                           NULL);
4093         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4094
4095         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4096             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4097                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4098                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4099                         "dot11RSNAConfigPMKLifetime");
4100                 return -1;
4101         }
4102
4103         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4104             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4105                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4106                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4107                         "dot11RSNAConfigPMKReauthThreshold");
4108                 return -1;
4109         }
4110
4111         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4112             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4113                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4114                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4115                         "dot11RSNAConfigSATimeout");
4116                 return -1;
4117         }
4118
4119         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4120                                                       &wpa_s->hw.num_modes,
4121                                                       &wpa_s->hw.flags);
4122         if (wpa_s->hw.modes) {
4123                 u16 i;
4124
4125                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4126                         if (wpa_s->hw.modes[i].vht_capab) {
4127                                 wpa_s->hw_capab = CAPAB_VHT;
4128                                 break;
4129                         }
4130
4131                         if (wpa_s->hw.modes[i].ht_capab &
4132                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4133                                 wpa_s->hw_capab = CAPAB_HT40;
4134                         else if (wpa_s->hw.modes[i].ht_capab &&
4135                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4136                                 wpa_s->hw_capab = CAPAB_HT;
4137                 }
4138         }
4139
4140         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4141         if (capa_res == 0) {
4142                 wpa_s->drv_capa_known = 1;
4143                 wpa_s->drv_flags = capa.flags;
4144                 wpa_s->drv_enc = capa.enc;
4145                 wpa_s->drv_smps_modes = capa.smps_modes;
4146                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4147                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4148                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4149                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4150                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4151                 wpa_s->max_match_sets = capa.max_match_sets;
4152                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4153                 wpa_s->max_stations = capa.max_stations;
4154                 wpa_s->extended_capa = capa.extended_capa;
4155                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4156                 wpa_s->extended_capa_len = capa.extended_capa_len;
4157                 wpa_s->num_multichan_concurrent =
4158                         capa.num_multichan_concurrent;
4159                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4160
4161                 if (capa.mac_addr_rand_scan_supported)
4162                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4163                 if (wpa_s->sched_scan_supported &&
4164                     capa.mac_addr_rand_sched_scan_supported)
4165                         wpa_s->mac_addr_rand_supported |=
4166                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4167         }
4168         if (wpa_s->max_remain_on_chan == 0)
4169                 wpa_s->max_remain_on_chan = 1000;
4170
4171         /*
4172          * Only take p2p_mgmt parameters when P2P Device is supported.
4173          * Doing it here as it determines whether l2_packet_init() will be done
4174          * during wpa_supplicant_driver_init().
4175          */
4176         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4177                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4178         else
4179                 iface->p2p_mgmt = 1;
4180
4181         if (wpa_s->num_multichan_concurrent == 0)
4182                 wpa_s->num_multichan_concurrent = 1;
4183
4184         if (wpa_supplicant_driver_init(wpa_s) < 0)
4185                 return -1;
4186
4187 #ifdef CONFIG_TDLS
4188         if ((!iface->p2p_mgmt ||
4189              !(wpa_s->drv_flags &
4190                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4191             wpa_tdls_init(wpa_s->wpa))
4192                 return -1;
4193 #endif /* CONFIG_TDLS */
4194
4195         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4196             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4197                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4198                 return -1;
4199         }
4200
4201         if (wpas_wps_init(wpa_s))
4202                 return -1;
4203
4204         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4205                 return -1;
4206         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4207
4208         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4209         if (wpa_s->ctrl_iface == NULL) {
4210                 wpa_printf(MSG_ERROR,
4211                            "Failed to initialize control interface '%s'.\n"
4212                            "You may have another wpa_supplicant process "
4213                            "already running or the file was\n"
4214                            "left by an unclean termination of wpa_supplicant "
4215                            "in which case you will need\n"
4216                            "to manually remove this file before starting "
4217                            "wpa_supplicant again.\n",
4218                            wpa_s->conf->ctrl_interface);
4219                 return -1;
4220         }
4221
4222         wpa_s->gas = gas_query_init(wpa_s);
4223         if (wpa_s->gas == NULL) {
4224                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4225                 return -1;
4226         }
4227
4228         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4229                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4230                 return -1;
4231         }
4232
4233         if (wpa_bss_init(wpa_s) < 0)
4234                 return -1;
4235
4236         /*
4237          * Set Wake-on-WLAN triggers, if configured.
4238          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4239          * have effect anyway when the interface is down).
4240          */
4241         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4242                 return -1;
4243
4244 #ifdef CONFIG_EAP_PROXY
4245 {
4246         size_t len;
4247         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4248                                                      &len);
4249         if (wpa_s->mnc_len > 0) {
4250                 wpa_s->imsi[len] = '\0';
4251                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4252                            wpa_s->imsi, wpa_s->mnc_len);
4253         } else {
4254                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4255         }
4256 }
4257 #endif /* CONFIG_EAP_PROXY */
4258
4259         if (pcsc_reader_init(wpa_s) < 0)
4260                 return -1;
4261
4262         if (wpas_init_ext_pw(wpa_s) < 0)
4263                 return -1;
4264
4265         wpas_rrm_reset(wpa_s);
4266
4267         return 0;
4268 }
4269
4270
4271 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4272                                         int notify, int terminate)
4273 {
4274         struct wpa_global *global = wpa_s->global;
4275         struct wpa_supplicant *iface, *prev;
4276
4277         if (wpa_s == wpa_s->parent)
4278                 wpas_p2p_group_remove(wpa_s, "*");
4279
4280         iface = global->ifaces;
4281         while (iface) {
4282                 if (iface == wpa_s || iface->parent != wpa_s) {
4283                         iface = iface->next;
4284                         continue;
4285                 }
4286                 wpa_printf(MSG_DEBUG,
4287                            "Remove remaining child interface %s from parent %s",
4288                            iface->ifname, wpa_s->ifname);
4289                 prev = iface;
4290                 iface = iface->next;
4291                 wpa_supplicant_remove_iface(global, prev, terminate);
4292         }
4293
4294         wpa_s->disconnected = 1;
4295         if (wpa_s->drv_priv) {
4296                 wpa_supplicant_deauthenticate(wpa_s,
4297                                               WLAN_REASON_DEAUTH_LEAVING);
4298
4299                 wpa_drv_set_countermeasures(wpa_s, 0);
4300                 wpa_clear_keys(wpa_s, NULL);
4301         }
4302
4303         wpa_supplicant_cleanup(wpa_s);
4304         wpas_p2p_deinit_iface(wpa_s);
4305
4306         wpas_ctrl_radio_work_flush(wpa_s);
4307         radio_remove_interface(wpa_s);
4308
4309         if (wpa_s->drv_priv)
4310                 wpa_drv_deinit(wpa_s);
4311
4312         if (notify)
4313                 wpas_notify_iface_removed(wpa_s);
4314
4315         if (terminate)
4316                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4317
4318         if (wpa_s->ctrl_iface) {
4319                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4320                 wpa_s->ctrl_iface = NULL;
4321         }
4322
4323 #ifdef CONFIG_MESH
4324         if (wpa_s->ifmsh) {
4325                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4326                 wpa_s->ifmsh = NULL;
4327         }
4328 #endif /* CONFIG_MESH */
4329
4330         if (wpa_s->conf != NULL) {
4331                 wpa_config_free(wpa_s->conf);
4332                 wpa_s->conf = NULL;
4333         }
4334
4335         os_free(wpa_s);
4336 }
4337
4338
4339 /**
4340  * wpa_supplicant_add_iface - Add a new network interface
4341  * @global: Pointer to global data from wpa_supplicant_init()
4342  * @iface: Interface configuration options
4343  * @parent: Parent interface or %NULL to assign new interface as parent
4344  * Returns: Pointer to the created interface or %NULL on failure
4345  *
4346  * This function is used to add new network interfaces for %wpa_supplicant.
4347  * This can be called before wpa_supplicant_run() to add interfaces before the
4348  * main event loop has been started. In addition, new interfaces can be added
4349  * dynamically while %wpa_supplicant is already running. This could happen,
4350  * e.g., when a hotplug network adapter is inserted.
4351  */
4352 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4353                                                  struct wpa_interface *iface,
4354                                                  struct wpa_supplicant *parent)
4355 {
4356         struct wpa_supplicant *wpa_s;
4357         struct wpa_interface t_iface;
4358         struct wpa_ssid *ssid;
4359
4360         if (global == NULL || iface == NULL)
4361                 return NULL;
4362
4363         wpa_s = wpa_supplicant_alloc(parent);
4364         if (wpa_s == NULL)
4365                 return NULL;
4366
4367         wpa_s->global = global;
4368
4369         t_iface = *iface;
4370         if (global->params.override_driver) {
4371                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4372                            "('%s' -> '%s')",
4373                            iface->driver, global->params.override_driver);
4374                 t_iface.driver = global->params.override_driver;
4375         }
4376         if (global->params.override_ctrl_interface) {
4377                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4378                            "ctrl_interface ('%s' -> '%s')",
4379                            iface->ctrl_interface,
4380                            global->params.override_ctrl_interface);
4381                 t_iface.ctrl_interface =
4382                         global->params.override_ctrl_interface;
4383         }
4384         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4385                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4386                            iface->ifname);
4387                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4388                 return NULL;
4389         }
4390
4391         if (iface->p2p_mgmt == 0) {
4392                 /* Notify the control interfaces about new iface */
4393                 if (wpas_notify_iface_added(wpa_s)) {
4394                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4395                         return NULL;
4396                 }
4397
4398                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4399                         wpas_notify_network_added(wpa_s, ssid);
4400         }
4401
4402         wpa_s->next = global->ifaces;
4403         global->ifaces = wpa_s;
4404
4405         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4406         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4407
4408 #ifdef CONFIG_P2P
4409         if (wpa_s->global->p2p == NULL &&
4410             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4411             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4412             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4413                 wpa_printf(MSG_INFO,
4414                            "P2P: Failed to enable P2P Device interface");
4415                 /* Try to continue without. P2P will be disabled. */
4416         }
4417 #endif /* CONFIG_P2P */
4418
4419         return wpa_s;
4420 }
4421
4422
4423 /**
4424  * wpa_supplicant_remove_iface - Remove a network interface
4425  * @global: Pointer to global data from wpa_supplicant_init()
4426  * @wpa_s: Pointer to the network interface to be removed
4427  * Returns: 0 if interface was removed, -1 if interface was not found
4428  *
4429  * This function can be used to dynamically remove network interfaces from
4430  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4431  * addition, this function is used to remove all remaining interfaces when
4432  * %wpa_supplicant is terminated.
4433  */
4434 int wpa_supplicant_remove_iface(struct wpa_global *global,
4435                                 struct wpa_supplicant *wpa_s,
4436                                 int terminate)
4437 {
4438         struct wpa_supplicant *prev;
4439 #ifdef CONFIG_MESH
4440         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4441         char *ifname = NULL;
4442 #endif /* CONFIG_MESH */
4443
4444         /* Remove interface from the global list of interfaces */
4445         prev = global->ifaces;
4446         if (prev == wpa_s) {
4447                 global->ifaces = wpa_s->next;
4448         } else {
4449                 while (prev && prev->next != wpa_s)
4450                         prev = prev->next;
4451                 if (prev == NULL)
4452                         return -1;
4453                 prev->next = wpa_s->next;
4454         }
4455
4456         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4457
4458 #ifdef CONFIG_MESH
4459         if (mesh_if_created) {
4460                 ifname = os_strdup(wpa_s->ifname);
4461                 if (ifname == NULL) {
4462                         wpa_dbg(wpa_s, MSG_ERROR,
4463                                 "mesh: Failed to malloc ifname");
4464                         return -1;
4465                 }
4466         }
4467 #endif /* CONFIG_MESH */
4468
4469         if (global->p2p_group_formation == wpa_s)
4470                 global->p2p_group_formation = NULL;
4471         if (global->p2p_invite_group == wpa_s)
4472                 global->p2p_invite_group = NULL;
4473         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4474
4475 #ifdef CONFIG_MESH
4476         if (mesh_if_created) {
4477                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4478                 os_free(ifname);
4479         }
4480 #endif /* CONFIG_MESH */
4481
4482         return 0;
4483 }
4484
4485
4486 /**
4487  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4488  * @wpa_s: Pointer to the network interface
4489  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4490  */
4491 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4492 {
4493         const char *eapol_method;
4494
4495         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4496             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4497                 return "NO-EAP";
4498         }
4499
4500         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4501         if (eapol_method == NULL)
4502                 return "UNKNOWN-EAP";
4503
4504         return eapol_method;
4505 }
4506
4507
4508 /**
4509  * wpa_supplicant_get_iface - Get a new network interface
4510  * @global: Pointer to global data from wpa_supplicant_init()
4511  * @ifname: Interface name
4512  * Returns: Pointer to the interface or %NULL if not found
4513  */
4514 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4515                                                  const char *ifname)
4516 {
4517         struct wpa_supplicant *wpa_s;
4518
4519         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4520                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4521                         return wpa_s;
4522         }
4523         return NULL;
4524 }
4525
4526
4527 #ifndef CONFIG_NO_WPA_MSG
4528 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4529 {
4530         struct wpa_supplicant *wpa_s = ctx;
4531         if (wpa_s == NULL)
4532                 return NULL;
4533         return wpa_s->ifname;
4534 }
4535 #endif /* CONFIG_NO_WPA_MSG */
4536
4537
4538 /**
4539  * wpa_supplicant_init - Initialize %wpa_supplicant
4540  * @params: Parameters for %wpa_supplicant
4541  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4542  *
4543  * This function is used to initialize %wpa_supplicant. After successful
4544  * initialization, the returned data pointer can be used to add and remove
4545  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4546  */
4547 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4548 {
4549         struct wpa_global *global;
4550         int ret, i;
4551
4552         if (params == NULL)
4553                 return NULL;
4554
4555 #ifdef CONFIG_DRIVER_NDIS
4556         {
4557                 void driver_ndis_init_ops(void);
4558                 driver_ndis_init_ops();
4559         }
4560 #endif /* CONFIG_DRIVER_NDIS */
4561
4562 #ifndef CONFIG_NO_WPA_MSG
4563         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4564 #endif /* CONFIG_NO_WPA_MSG */
4565
4566         if (params->wpa_debug_file_path)
4567                 wpa_debug_open_file(params->wpa_debug_file_path);
4568         else
4569                 wpa_debug_setup_stdout();
4570         if (params->wpa_debug_syslog)
4571                 wpa_debug_open_syslog();
4572         if (params->wpa_debug_tracing) {
4573                 ret = wpa_debug_open_linux_tracing();
4574                 if (ret) {
4575                         wpa_printf(MSG_ERROR,
4576                                    "Failed to enable trace logging");
4577                         return NULL;
4578                 }
4579         }
4580
4581         ret = eap_register_methods();
4582         if (ret) {
4583                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4584                 if (ret == -2)
4585                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4586                                    "the same EAP type.");
4587                 return NULL;
4588         }
4589
4590         global = os_zalloc(sizeof(*global));
4591         if (global == NULL)
4592                 return NULL;
4593         dl_list_init(&global->p2p_srv_bonjour);
4594         dl_list_init(&global->p2p_srv_upnp);
4595         global->params.daemonize = params->daemonize;
4596         global->params.wait_for_monitor = params->wait_for_monitor;
4597         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4598         if (params->pid_file)
4599                 global->params.pid_file = os_strdup(params->pid_file);
4600         if (params->ctrl_interface)
4601                 global->params.ctrl_interface =
4602                         os_strdup(params->ctrl_interface);
4603         if (params->ctrl_interface_group)
4604                 global->params.ctrl_interface_group =
4605                         os_strdup(params->ctrl_interface_group);
4606         if (params->override_driver)
4607                 global->params.override_driver =
4608                         os_strdup(params->override_driver);
4609         if (params->override_ctrl_interface)
4610                 global->params.override_ctrl_interface =
4611                         os_strdup(params->override_ctrl_interface);
4612         wpa_debug_level = global->params.wpa_debug_level =
4613                 params->wpa_debug_level;
4614         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4615                 params->wpa_debug_show_keys;
4616         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4617                 params->wpa_debug_timestamp;
4618
4619         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4620
4621         if (eloop_init()) {
4622                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4623                 wpa_supplicant_deinit(global);
4624                 return NULL;
4625         }
4626
4627         random_init(params->entropy_file);
4628
4629         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4630         if (global->ctrl_iface == NULL) {
4631                 wpa_supplicant_deinit(global);
4632                 return NULL;
4633         }
4634
4635         if (wpas_notify_supplicant_initialized(global)) {
4636                 wpa_supplicant_deinit(global);
4637                 return NULL;
4638         }
4639
4640         for (i = 0; wpa_drivers[i]; i++)
4641                 global->drv_count++;
4642         if (global->drv_count == 0) {
4643                 wpa_printf(MSG_ERROR, "No drivers enabled");
4644                 wpa_supplicant_deinit(global);
4645                 return NULL;
4646         }
4647         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4648         if (global->drv_priv == NULL) {
4649                 wpa_supplicant_deinit(global);
4650                 return NULL;
4651         }
4652
4653 #ifdef CONFIG_WIFI_DISPLAY
4654         if (wifi_display_init(global) < 0) {
4655                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4656                 wpa_supplicant_deinit(global);
4657                 return NULL;
4658         }
4659 #endif /* CONFIG_WIFI_DISPLAY */
4660
4661         return global;
4662 }
4663
4664
4665 /**
4666  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4667  * @global: Pointer to global data from wpa_supplicant_init()
4668  * Returns: 0 after successful event loop run, -1 on failure
4669  *
4670  * This function starts the main event loop and continues running as long as
4671  * there are any remaining events. In most cases, this function is running as
4672  * long as the %wpa_supplicant process in still in use.
4673  */
4674 int wpa_supplicant_run(struct wpa_global *global)
4675 {
4676         struct wpa_supplicant *wpa_s;
4677
4678         if (global->params.daemonize &&
4679             wpa_supplicant_daemon(global->params.pid_file))
4680                 return -1;
4681
4682         if (global->params.wait_for_monitor) {
4683                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4684                         if (wpa_s->ctrl_iface)
4685                                 wpa_supplicant_ctrl_iface_wait(
4686                                         wpa_s->ctrl_iface);
4687         }
4688
4689         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4690         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4691
4692         eloop_run();
4693
4694         return 0;
4695 }
4696
4697
4698 /**
4699  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4700  * @global: Pointer to global data from wpa_supplicant_init()
4701  *
4702  * This function is called to deinitialize %wpa_supplicant and to free all
4703  * allocated resources. Remaining network interfaces will also be removed.
4704  */
4705 void wpa_supplicant_deinit(struct wpa_global *global)
4706 {
4707         int i;
4708
4709         if (global == NULL)
4710                 return;
4711
4712 #ifdef CONFIG_WIFI_DISPLAY
4713         wifi_display_deinit(global);
4714 #endif /* CONFIG_WIFI_DISPLAY */
4715
4716         while (global->ifaces)
4717                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4718
4719         if (global->ctrl_iface)
4720                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4721
4722         wpas_notify_supplicant_deinitialized(global);
4723
4724         eap_peer_unregister_methods();
4725 #ifdef CONFIG_AP
4726         eap_server_unregister_methods();
4727 #endif /* CONFIG_AP */
4728
4729         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4730                 if (!global->drv_priv[i])
4731                         continue;
4732                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4733         }
4734         os_free(global->drv_priv);
4735
4736         random_deinit();
4737
4738         eloop_destroy();
4739
4740         if (global->params.pid_file) {
4741                 os_daemonize_terminate(global->params.pid_file);
4742                 os_free(global->params.pid_file);
4743         }
4744         os_free(global->params.ctrl_interface);
4745         os_free(global->params.ctrl_interface_group);
4746         os_free(global->params.override_driver);
4747         os_free(global->params.override_ctrl_interface);
4748
4749         os_free(global->p2p_disallow_freq.range);
4750         os_free(global->p2p_go_avoid_freq.range);
4751         os_free(global->add_psk);
4752
4753         os_free(global);
4754         wpa_debug_close_syslog();
4755         wpa_debug_close_file();
4756         wpa_debug_close_linux_tracing();
4757 }
4758
4759
4760 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4761 {
4762         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4763             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4764                 char country[3];
4765                 country[0] = wpa_s->conf->country[0];
4766                 country[1] = wpa_s->conf->country[1];
4767                 country[2] = '\0';
4768                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4769                         wpa_printf(MSG_ERROR, "Failed to set country code "
4770                                    "'%s'", country);
4771                 }
4772         }
4773
4774         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4775                 wpas_init_ext_pw(wpa_s);
4776
4777 #ifdef CONFIG_WPS
4778         wpas_wps_update_config(wpa_s);
4779 #endif /* CONFIG_WPS */
4780         wpas_p2p_update_config(wpa_s);
4781         wpa_s->conf->changed_parameters = 0;
4782 }
4783
4784
4785 void add_freq(int *freqs, int *num_freqs, int freq)
4786 {
4787         int i;
4788
4789         for (i = 0; i < *num_freqs; i++) {
4790                 if (freqs[i] == freq)
4791                         return;
4792         }
4793
4794         freqs[*num_freqs] = freq;
4795         (*num_freqs)++;
4796 }
4797
4798
4799 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4800 {
4801         struct wpa_bss *bss, *cbss;
4802         const int max_freqs = 10;
4803         int *freqs;
4804         int num_freqs = 0;
4805
4806         freqs = os_calloc(max_freqs + 1, sizeof(int));
4807         if (freqs == NULL)
4808                 return NULL;
4809
4810         cbss = wpa_s->current_bss;
4811
4812         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4813                 if (bss == cbss)
4814                         continue;
4815                 if (bss->ssid_len == cbss->ssid_len &&
4816                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4817                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4818                         add_freq(freqs, &num_freqs, bss->freq);
4819                         if (num_freqs == max_freqs)
4820                                 break;
4821                 }
4822         }
4823
4824         if (num_freqs == 0) {
4825                 os_free(freqs);
4826                 freqs = NULL;
4827         }
4828
4829         return freqs;
4830 }
4831
4832
4833 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4834 {
4835         int timeout;
4836         int count;
4837         int *freqs = NULL;
4838
4839         wpas_connect_work_done(wpa_s);
4840
4841         /*
4842          * Remove possible authentication timeout since the connection failed.
4843          */
4844         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4845
4846         /*
4847          * There is no point in blacklisting the AP if this event is
4848          * generated based on local request to disconnect.
4849          */
4850         if (wpa_s->own_disconnect_req) {
4851                 wpa_s->own_disconnect_req = 0;
4852                 wpa_dbg(wpa_s, MSG_DEBUG,
4853                         "Ignore connection failure due to local request to disconnect");
4854                 return;
4855         }
4856         if (wpa_s->disconnected) {
4857                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4858                         "indication since interface has been put into "
4859                         "disconnected state");
4860                 return;
4861         }
4862
4863         /*
4864          * Add the failed BSSID into the blacklist and speed up next scan
4865          * attempt if there could be other APs that could accept association.
4866          * The current blacklist count indicates how many times we have tried
4867          * connecting to this AP and multiple attempts mean that other APs are
4868          * either not available or has already been tried, so that we can start
4869          * increasing the delay here to avoid constant scanning.
4870          */
4871         count = wpa_blacklist_add(wpa_s, bssid);
4872         if (count == 1 && wpa_s->current_bss) {
4873                 /*
4874                  * This BSS was not in the blacklist before. If there is
4875                  * another BSS available for the same ESS, we should try that
4876                  * next. Otherwise, we may as well try this one once more
4877                  * before allowing other, likely worse, ESSes to be considered.
4878                  */
4879                 freqs = get_bss_freqs_in_ess(wpa_s);
4880                 if (freqs) {
4881                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4882                                 "has been seen; try it next");
4883                         wpa_blacklist_add(wpa_s, bssid);
4884                         /*
4885                          * On the next scan, go through only the known channels
4886                          * used in this ESS based on previous scans to speed up
4887                          * common load balancing use case.
4888                          */
4889                         os_free(wpa_s->next_scan_freqs);
4890                         wpa_s->next_scan_freqs = freqs;
4891                 }
4892         }
4893
4894         /*
4895          * Add previous failure count in case the temporary blacklist was
4896          * cleared due to no other BSSes being available.
4897          */
4898         count += wpa_s->extra_blacklist_count;
4899
4900         if (count > 3 && wpa_s->current_ssid) {
4901                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4902                            "consider temporary network disabling");
4903                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4904         }
4905
4906         switch (count) {
4907         case 1:
4908                 timeout = 100;
4909                 break;
4910         case 2:
4911                 timeout = 500;
4912                 break;
4913         case 3:
4914                 timeout = 1000;
4915                 break;
4916         case 4:
4917                 timeout = 5000;
4918                 break;
4919         default:
4920                 timeout = 10000;
4921                 break;
4922         }
4923
4924         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4925                 "ms", count, timeout);
4926
4927         /*
4928          * TODO: if more than one possible AP is available in scan results,
4929          * could try the other ones before requesting a new scan.
4930          */
4931         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4932                                 1000 * (timeout % 1000));
4933 }
4934
4935
4936 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4937 {
4938         return wpa_s->conf->ap_scan == 2 ||
4939                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4940 }
4941
4942
4943 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4944 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4945                                               struct wpa_ssid *ssid,
4946                                               const char *field,
4947                                               const char *value)
4948 {
4949 #ifdef IEEE8021X_EAPOL
4950         struct eap_peer_config *eap = &ssid->eap;
4951
4952         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4953         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4954                               (const u8 *) value, os_strlen(value));
4955
4956         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4957         case WPA_CTRL_REQ_EAP_IDENTITY:
4958                 os_free(eap->identity);
4959                 eap->identity = (u8 *) os_strdup(value);
4960                 eap->identity_len = os_strlen(value);
4961                 eap->pending_req_identity = 0;
4962                 if (ssid == wpa_s->current_ssid)
4963                         wpa_s->reassociate = 1;
4964                 break;
4965         case WPA_CTRL_REQ_EAP_PASSWORD:
4966                 bin_clear_free(eap->password, eap->password_len);
4967                 eap->password = (u8 *) os_strdup(value);
4968                 eap->password_len = os_strlen(value);
4969                 eap->pending_req_password = 0;
4970                 if (ssid == wpa_s->current_ssid)
4971                         wpa_s->reassociate = 1;
4972                 break;
4973         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4974                 bin_clear_free(eap->new_password, eap->new_password_len);
4975                 eap->new_password = (u8 *) os_strdup(value);
4976                 eap->new_password_len = os_strlen(value);
4977                 eap->pending_req_new_password = 0;
4978                 if (ssid == wpa_s->current_ssid)
4979                         wpa_s->reassociate = 1;
4980                 break;
4981         case WPA_CTRL_REQ_EAP_PIN:
4982                 str_clear_free(eap->pin);
4983                 eap->pin = os_strdup(value);
4984                 eap->pending_req_pin = 0;
4985                 if (ssid == wpa_s->current_ssid)
4986                         wpa_s->reassociate = 1;
4987                 break;
4988         case WPA_CTRL_REQ_EAP_OTP:
4989                 bin_clear_free(eap->otp, eap->otp_len);
4990                 eap->otp = (u8 *) os_strdup(value);
4991                 eap->otp_len = os_strlen(value);
4992                 os_free(eap->pending_req_otp);
4993                 eap->pending_req_otp = NULL;
4994                 eap->pending_req_otp_len = 0;
4995                 break;
4996         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4997                 str_clear_free(eap->private_key_passwd);
4998                 eap->private_key_passwd = os_strdup(value);
4999                 eap->pending_req_passphrase = 0;
5000                 if (ssid == wpa_s->current_ssid)
5001                         wpa_s->reassociate = 1;
5002                 break;
5003         case WPA_CTRL_REQ_SIM:
5004                 str_clear_free(eap->external_sim_resp);
5005                 eap->external_sim_resp = os_strdup(value);
5006                 break;
5007         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5008                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5009                         return -1;
5010                 ssid->mem_only_psk = 1;
5011                 if (ssid->passphrase)
5012                         wpa_config_update_psk(ssid);
5013                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5014                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5015                 break;
5016         default:
5017                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5018                 return -1;
5019         }
5020
5021         return 0;
5022 #else /* IEEE8021X_EAPOL */
5023         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5024         return -1;
5025 #endif /* IEEE8021X_EAPOL */
5026 }
5027 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5028
5029
5030 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5031 {
5032         int i;
5033         unsigned int drv_enc;
5034
5035         if (wpa_s->p2p_mgmt)
5036                 return 1; /* no normal network profiles on p2p_mgmt interface */
5037
5038         if (ssid == NULL)
5039                 return 1;
5040
5041         if (ssid->disabled)
5042                 return 1;
5043
5044         if (wpa_s->drv_capa_known)
5045                 drv_enc = wpa_s->drv_enc;
5046         else
5047                 drv_enc = (unsigned int) -1;
5048
5049         for (i = 0; i < NUM_WEP_KEYS; i++) {
5050                 size_t len = ssid->wep_key_len[i];
5051                 if (len == 0)
5052                         continue;
5053                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5054                         continue;
5055                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5056                         continue;
5057                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5058                         continue;
5059                 return 1; /* invalid WEP key */
5060         }
5061
5062         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5063             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5064             !ssid->mem_only_psk)
5065                 return 1;
5066
5067         return 0;
5068 }
5069
5070
5071 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5072 {
5073 #ifdef CONFIG_IEEE80211W
5074         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5075                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5076                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5077                         /*
5078                          * Driver does not support BIP -- ignore pmf=1 default
5079                          * since the connection with PMF would fail and the
5080                          * configuration does not require PMF to be enabled.
5081                          */
5082                         return NO_MGMT_FRAME_PROTECTION;
5083                 }
5084
5085                 return wpa_s->conf->pmf;
5086         }
5087
5088         return ssid->ieee80211w;
5089 #else /* CONFIG_IEEE80211W */
5090         return NO_MGMT_FRAME_PROTECTION;
5091 #endif /* CONFIG_IEEE80211W */
5092 }
5093
5094
5095 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5096 {
5097         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5098                 return 1;
5099         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5100                 return 0;
5101         return -1;
5102 }
5103
5104
5105 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5106 {
5107         struct wpa_ssid *ssid = wpa_s->current_ssid;
5108         int dur;
5109         struct os_reltime now;
5110
5111         if (ssid == NULL) {
5112                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5113                            "SSID block");
5114                 return;
5115         }
5116
5117         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5118                 return;
5119
5120         ssid->auth_failures++;
5121
5122 #ifdef CONFIG_P2P
5123         if (ssid->p2p_group &&
5124             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5125                 /*
5126                  * Skip the wait time since there is a short timeout on the
5127                  * connection to a P2P group.
5128                  */
5129                 return;
5130         }
5131 #endif /* CONFIG_P2P */
5132
5133         if (ssid->auth_failures > 50)
5134                 dur = 300;
5135         else if (ssid->auth_failures > 10)
5136                 dur = 120;
5137         else if (ssid->auth_failures > 5)
5138                 dur = 90;
5139         else if (ssid->auth_failures > 3)
5140                 dur = 60;
5141         else if (ssid->auth_failures > 2)
5142                 dur = 30;
5143         else if (ssid->auth_failures > 1)
5144                 dur = 20;
5145         else
5146                 dur = 10;
5147
5148         if (ssid->auth_failures > 1 &&
5149             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5150                 dur += os_random() % (ssid->auth_failures * 10);
5151
5152         os_get_reltime(&now);
5153         if (now.sec + dur <= ssid->disabled_until.sec)
5154                 return;
5155
5156         ssid->disabled_until.sec = now.sec + dur;
5157
5158         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5159                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5160                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5161                 ssid->auth_failures, dur, reason);
5162 }
5163
5164
5165 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5166                               struct wpa_ssid *ssid, int clear_failures)
5167 {
5168         if (ssid == NULL)
5169                 return;
5170
5171         if (ssid->disabled_until.sec) {
5172                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5173                         "id=%d ssid=\"%s\"",
5174                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5175         }
5176         ssid->disabled_until.sec = 0;
5177         ssid->disabled_until.usec = 0;
5178         if (clear_failures)
5179                 ssid->auth_failures = 0;
5180 }
5181
5182
5183 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5184 {
5185         size_t i;
5186
5187         if (wpa_s->disallow_aps_bssid == NULL)
5188                 return 0;
5189
5190         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5191                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5192                               bssid, ETH_ALEN) == 0)
5193                         return 1;
5194         }
5195
5196         return 0;
5197 }
5198
5199
5200 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5201                     size_t ssid_len)
5202 {
5203         size_t i;
5204
5205         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5206                 return 0;
5207
5208         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5209                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5210                 if (ssid_len == s->ssid_len &&
5211                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5212                         return 1;
5213         }
5214
5215         return 0;
5216 }
5217
5218
5219 /**
5220  * wpas_request_connection - Request a new connection
5221  * @wpa_s: Pointer to the network interface
5222  *
5223  * This function is used to request a new connection to be found. It will mark
5224  * the interface to allow reassociation and request a new scan to find a
5225  * suitable network to connect to.
5226  */
5227 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5228 {
5229         wpa_s->normal_scans = 0;
5230         wpa_s->scan_req = NORMAL_SCAN_REQ;
5231         wpa_supplicant_reinit_autoscan(wpa_s);
5232         wpa_s->extra_blacklist_count = 0;
5233         wpa_s->disconnected = 0;
5234         wpa_s->reassociate = 1;
5235
5236         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5237                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5238         else
5239                 wpa_s->reattach = 0;
5240 }
5241
5242
5243 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5244                     struct wpa_used_freq_data *freqs_data,
5245                     unsigned int len)
5246 {
5247         unsigned int i;
5248
5249         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5250                 len, title);
5251         for (i = 0; i < len; i++) {
5252                 struct wpa_used_freq_data *cur = &freqs_data[i];
5253                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5254                         i, cur->freq, cur->flags);
5255         }
5256 }
5257
5258
5259 /*
5260  * Find the operating frequencies of any of the virtual interfaces that
5261  * are using the same radio as the current interface, and in addition, get
5262  * information about the interface types that are using the frequency.
5263  */
5264 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5265                                 struct wpa_used_freq_data *freqs_data,
5266                                 unsigned int len)
5267 {
5268         struct wpa_supplicant *ifs;
5269         u8 bssid[ETH_ALEN];
5270         int freq;
5271         unsigned int idx = 0, i;
5272
5273         wpa_dbg(wpa_s, MSG_DEBUG,
5274                 "Determining shared radio frequencies (max len %u)", len);
5275         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5276
5277         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5278                          radio_list) {
5279                 if (idx == len)
5280                         break;
5281
5282                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5283                         continue;
5284
5285                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5286                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5287                         freq = ifs->current_ssid->frequency;
5288                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5289                         freq = ifs->assoc_freq;
5290                 else
5291                         continue;
5292
5293                 /* Hold only distinct freqs */
5294                 for (i = 0; i < idx; i++)
5295                         if (freqs_data[i].freq == freq)
5296                                 break;
5297
5298                 if (i == idx)
5299                         freqs_data[idx++].freq = freq;
5300
5301                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5302                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5303                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5304                                 WPA_FREQ_USED_BY_INFRA_STATION;
5305                 }
5306         }
5307
5308         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5309         return idx;
5310 }
5311
5312
5313 /*
5314  * Find the operating frequencies of any of the virtual interfaces that
5315  * are using the same radio as the current interface.
5316  */
5317 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5318                            int *freq_array, unsigned int len)
5319 {
5320         struct wpa_used_freq_data *freqs_data;
5321         int num, i;
5322
5323         os_memset(freq_array, 0, sizeof(int) * len);
5324
5325         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5326         if (!freqs_data)
5327                 return -1;
5328
5329         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5330         for (i = 0; i < num; i++)
5331                 freq_array[i] = freqs_data[i].freq;
5332
5333         os_free(freqs_data);
5334
5335         return num;
5336 }
5337
5338
5339 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5340 {
5341         struct rrm_data *rrm = data;
5342
5343         if (!rrm->notify_neighbor_rep) {
5344                 wpa_printf(MSG_ERROR,
5345                            "RRM: Unexpected neighbor report timeout");
5346                 return;
5347         }
5348
5349         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5350         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5351
5352         rrm->notify_neighbor_rep = NULL;
5353         rrm->neighbor_rep_cb_ctx = NULL;
5354 }
5355
5356
5357 /*
5358  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5359  * @wpa_s: Pointer to wpa_supplicant
5360  */
5361 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5362 {
5363         wpa_s->rrm.rrm_used = 0;
5364
5365         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5366                              NULL);
5367         if (wpa_s->rrm.notify_neighbor_rep)
5368                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5369         wpa_s->rrm.next_neighbor_rep_token = 1;
5370 }
5371
5372
5373 /*
5374  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5375  * @wpa_s: Pointer to wpa_supplicant
5376  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5377  * @report_len: Length of neighbor report buffer
5378  */
5379 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5380                                    const u8 *report, size_t report_len)
5381 {
5382         struct wpabuf *neighbor_rep;
5383
5384         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5385         if (report_len < 1)
5386                 return;
5387
5388         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5389                 wpa_printf(MSG_DEBUG,
5390                            "RRM: Discarding neighbor report with token %d (expected %d)",
5391                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5392                 return;
5393         }
5394
5395         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5396                              NULL);
5397
5398         if (!wpa_s->rrm.notify_neighbor_rep) {
5399                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5400                 return;
5401         }
5402
5403         /* skipping the first byte, which is only an id (dialog token) */
5404         neighbor_rep = wpabuf_alloc(report_len - 1);
5405         if (neighbor_rep == NULL)
5406                 return;
5407         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5408         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5409                    report[0]);
5410         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5411                                        neighbor_rep);
5412         wpa_s->rrm.notify_neighbor_rep = NULL;
5413         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5414 }
5415
5416
5417 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5418 /* Workaround different, undefined for Windows, error codes used here */
5419 #define ENOTCONN -1
5420 #define EOPNOTSUPP -1
5421 #define ECANCELED -1
5422 #endif
5423
5424 /**
5425  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5426  * @wpa_s: Pointer to wpa_supplicant
5427  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5428  *        is sent in the request.
5429  * @cb: Callback function to be called once the requested report arrives, or
5430  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5431  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5432  *      the requester's responsibility to free it.
5433  *      In the latter case NULL will be sent in 'neighbor_rep'.
5434  * @cb_ctx: Context value to send the callback function
5435  * Returns: 0 in case of success, negative error code otherwise
5436  *
5437  * In case there is a previous request which has not been answered yet, the
5438  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5439  * Request must contain a callback function.
5440  */
5441 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5442                                        const struct wpa_ssid *ssid,
5443                                        void (*cb)(void *ctx,
5444                                                   struct wpabuf *neighbor_rep),
5445                                        void *cb_ctx)
5446 {
5447         struct wpabuf *buf;
5448         const u8 *rrm_ie;
5449
5450         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5451                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5452                 return -ENOTCONN;
5453         }
5454
5455         if (!wpa_s->rrm.rrm_used) {
5456                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5457                 return -EOPNOTSUPP;
5458         }
5459
5460         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5461                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5462         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5463             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5464                 wpa_printf(MSG_DEBUG,
5465                            "RRM: No network support for Neighbor Report.");
5466                 return -EOPNOTSUPP;
5467         }
5468
5469         if (!cb) {
5470                 wpa_printf(MSG_DEBUG,
5471                            "RRM: Neighbor Report request must provide a callback.");
5472                 return -EINVAL;
5473         }
5474
5475         /* Refuse if there's a live request */
5476         if (wpa_s->rrm.notify_neighbor_rep) {
5477                 wpa_printf(MSG_DEBUG,
5478                            "RRM: Currently handling previous Neighbor Report.");
5479                 return -EBUSY;
5480         }
5481
5482         /* 3 = action category + action code + dialog token */
5483         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5484         if (buf == NULL) {
5485                 wpa_printf(MSG_DEBUG,
5486                            "RRM: Failed to allocate Neighbor Report Request");
5487                 return -ENOMEM;
5488         }
5489
5490         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5491                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5492                    wpa_s->rrm.next_neighbor_rep_token);
5493
5494         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5495         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5496         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5497         if (ssid) {
5498                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5499                 wpabuf_put_u8(buf, ssid->ssid_len);
5500                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5501         }
5502
5503         wpa_s->rrm.next_neighbor_rep_token++;
5504
5505         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5506                                 wpa_s->own_addr, wpa_s->bssid,
5507                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5508                 wpa_printf(MSG_DEBUG,
5509                            "RRM: Failed to send Neighbor Report Request");
5510                 wpabuf_free(buf);
5511                 return -ECANCELED;
5512         }
5513
5514         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5515         wpa_s->rrm.notify_neighbor_rep = cb;
5516         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5517                                wpas_rrm_neighbor_rep_timeout_handler,
5518                                &wpa_s->rrm, NULL);
5519
5520         wpabuf_free(buf);
5521         return 0;
5522 }
5523
5524
5525 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5526                                               const u8 *src,
5527                                               const u8 *frame, size_t len,
5528                                               int rssi)
5529 {
5530         struct wpabuf *buf;
5531         const struct rrm_link_measurement_request *req;
5532         struct rrm_link_measurement_report report;
5533
5534         if (wpa_s->wpa_state != WPA_COMPLETED) {
5535                 wpa_printf(MSG_INFO,
5536                            "RRM: Ignoring link measurement request. Not associated");
5537                 return;
5538         }
5539
5540         if (!wpa_s->rrm.rrm_used) {
5541                 wpa_printf(MSG_INFO,
5542                            "RRM: Ignoring link measurement request. Not RRM network");
5543                 return;
5544         }
5545
5546         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5547                 wpa_printf(MSG_INFO,
5548                            "RRM: Measurement report failed. TX power insertion not supported");
5549                 return;
5550         }
5551
5552         req = (const struct rrm_link_measurement_request *) frame;
5553         if (len < sizeof(*req)) {
5554                 wpa_printf(MSG_INFO,
5555                            "RRM: Link measurement report failed. Request too short");
5556                 return;
5557         }
5558
5559         os_memset(&report, 0, sizeof(report));
5560         report.tpc.eid = WLAN_EID_TPC_REPORT;
5561         report.tpc.len = 2;
5562         report.rsni = 255; /* 255 indicates that RSNI is not available */
5563         report.dialog_token = req->dialog_token;
5564
5565         /*
5566          * It's possible to estimate RCPI based on RSSI in dBm. This
5567          * calculation will not reflect the correct value for high rates,
5568          * but it's good enough for Action frames which are transmitted
5569          * with up to 24 Mbps rates.
5570          */
5571         if (!rssi)
5572                 report.rcpi = 255; /* not available */
5573         else if (rssi < -110)
5574                 report.rcpi = 0;
5575         else if (rssi > 0)
5576                 report.rcpi = 220;
5577         else
5578                 report.rcpi = (rssi + 110) * 2;
5579
5580         /* action_category + action_code */
5581         buf = wpabuf_alloc(2 + sizeof(report));
5582         if (buf == NULL) {
5583                 wpa_printf(MSG_ERROR,
5584                            "RRM: Link measurement report failed. Buffer allocation failed");
5585                 return;
5586         }
5587
5588         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5589         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5590         wpabuf_put_data(buf, &report, sizeof(report));
5591         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5592                     wpabuf_head(buf), wpabuf_len(buf));
5593
5594         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5595                                 wpa_s->own_addr, wpa_s->bssid,
5596                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5597                 wpa_printf(MSG_ERROR,
5598                            "RRM: Link measurement report failed. Send action failed");
5599         }
5600         wpabuf_free(buf);
5601 }