wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548
 549         wpa_s->sched_scan_plans_num = 0;
 550         os_free(wpa_s->sched_scan_plans);
 551         wpa_s->sched_scan_plans = NULL;
 552 }
 553
 554
 555 /**
 556  * wpa_clear_keys - Clear keys configured for the driver
 557  * @wpa_s: Pointer to wpa_supplicant data
 558  * @addr: Previously used BSSID or %NULL if not available
 559  *
 560  * This function clears the encryption keys that has been previously configured
 561  * for the driver.
 562  */
 563 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 564 {
 565         int i, max;
 566
 567 #ifdef CONFIG_IEEE80211W
 568         max = 6;
 569 #else /* CONFIG_IEEE80211W */
 570         max = 4;
 571 #endif /* CONFIG_IEEE80211W */
 572
 573         /* MLME-DELETEKEYS.request */
 574         for (i = 0; i < max; i++) {
 575                 if (wpa_s->keys_cleared & BIT(i))
 576                         continue;
 577                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 578                                 NULL, 0);
 579         }
 580         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 581             !is_zero_ether_addr(addr)) {
 582                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 583                                 0);
 584                 /* MLME-SETPROTECTION.request(None) */
 585                 wpa_drv_mlme_setprotection(
 586                         wpa_s, addr,
 587                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 588                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 589         }
 590         wpa_s->keys_cleared = (u32) -1;
 591 }
 592
 593
 594 /**
 595  * wpa_supplicant_state_txt - Get the connection state name as a text string
 596  * @state: State (wpa_state; WPA_*)
 597  * Returns: The state name as a printable text string
 598  */
 599 const char * wpa_supplicant_state_txt(enum wpa_states state)
 600 {
 601         switch (state) {
 602         case WPA_DISCONNECTED:
 603                 return "DISCONNECTED";
 604         case WPA_INACTIVE:
 605                 return "INACTIVE";
 606         case WPA_INTERFACE_DISABLED:
 607                 return "INTERFACE_DISABLED";
 608         case WPA_SCANNING:
 609                 return "SCANNING";
 610         case WPA_AUTHENTICATING:
 611                 return "AUTHENTICATING";
 612         case WPA_ASSOCIATING:
 613                 return "ASSOCIATING";
 614         case WPA_ASSOCIATED:
 615                 return "ASSOCIATED";
 616         case WPA_4WAY_HANDSHAKE:
 617                 return "4WAY_HANDSHAKE";
 618         case WPA_GROUP_HANDSHAKE:
 619                 return "GROUP_HANDSHAKE";
 620         case WPA_COMPLETED:
 621                 return "COMPLETED";
 622         default:
 623                 return "UNKNOWN";
 624         }
 625 }
 626
 627
 628 #ifdef CONFIG_BGSCAN
 629
 630 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 631 {
 632         const char *name;
 633
 634         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 635                 name = wpa_s->current_ssid->bgscan;
 636         else
 637                 name = wpa_s->conf->bgscan;
 638         if (name == NULL || name[0] == '\0')
 639                 return;
 640         if (wpas_driver_bss_selection(wpa_s))
 641                 return;
 642         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 643                 return;
 644 #ifdef CONFIG_P2P
 645         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 646                 return;
 647 #endif /* CONFIG_P2P */
 648
 649         bgscan_deinit(wpa_s);
 650         if (wpa_s->current_ssid) {
 651                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 652                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 653                                 "bgscan");
 654                         /*
 655                          * Live without bgscan; it is only used as a roaming
 656                          * optimization, so the initial connection is not
 657                          * affected.
 658                          */
 659                 } else {
 660                         struct wpa_scan_results *scan_res;
 661                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 662                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 663                                                                    0);
 664                         if (scan_res) {
 665                                 bgscan_notify_scan(wpa_s, scan_res);
 666                                 wpa_scan_results_free(scan_res);
 667                         }
 668                 }
 669         } else
 670                 wpa_s->bgscan_ssid = NULL;
 671 }
 672
 673
 674 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 675 {
 676         if (wpa_s->bgscan_ssid != NULL) {
 677                 bgscan_deinit(wpa_s);
 678                 wpa_s->bgscan_ssid = NULL;
 679         }
 680 }
 681
 682 #endif /* CONFIG_BGSCAN */
 683
 684
 685 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 686 {
 687         if (autoscan_init(wpa_s, 0))
 688                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 689 }
 690
 691
 692 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 693 {
 694         autoscan_deinit(wpa_s);
 695 }
 696
 697
 698 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 699 {
 700         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 701             wpa_s->wpa_state == WPA_SCANNING) {
 702                 autoscan_deinit(wpa_s);
 703                 wpa_supplicant_start_autoscan(wpa_s);
 704         }
 705 }
 706
 707
 708 /**
 709  * wpa_supplicant_set_state - Set current connection state
 710  * @wpa_s: Pointer to wpa_supplicant data
 711  * @state: The new connection state
 712  *
 713  * This function is called whenever the connection state changes, e.g.,
 714  * association is completed for WPA/WPA2 4-Way Handshake is started.
 715  */
 716 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 717                               enum wpa_states state)
 718 {
 719         enum wpa_states old_state = wpa_s->wpa_state;
 720
 721         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 722                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 723                 wpa_supplicant_state_txt(state));
 724
 725         if (state == WPA_INTERFACE_DISABLED) {
 726                 /* Assure normal scan when interface is restored */
 727                 wpa_s->normal_scans = 0;
 728         }
 729
 730         if (state == WPA_COMPLETED) {
 731                 wpas_connect_work_done(wpa_s);
 732                 /* Reinitialize normal_scan counter */
 733                 wpa_s->normal_scans = 0;
 734         }
 735
 736 #ifdef CONFIG_P2P
 737         /*
 738          * P2PS client has to reply to Probe Request frames received on the
 739          * group operating channel. Enable Probe Request frame reporting for
 740          * P2P connected client in case p2p_cli_probe configuration property is
 741          * set to 1.
 742          */
 743         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 744             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 745             wpa_s->current_ssid->p2p_group) {
 746                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 747                         wpa_dbg(wpa_s, MSG_DEBUG,
 748                                 "P2P: Enable CLI Probe Request RX reporting");
 749                         wpa_s->p2p_cli_probe =
 750                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 751                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 752                         wpa_dbg(wpa_s, MSG_DEBUG,
 753                                 "P2P: Disable CLI Probe Request RX reporting");
 754                         wpa_s->p2p_cli_probe = 0;
 755                         wpa_drv_probe_req_report(wpa_s, 0);
 756                 }
 757         }
 758 #endif /* CONFIG_P2P */
 759
 760         if (state != WPA_SCANNING)
 761                 wpa_supplicant_notify_scanning(wpa_s, 0);
 762
 763         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 764                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 765 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 766                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 767                         MACSTR " completed [id=%d id_str=%s]",
 768                         MAC2STR(wpa_s->bssid),
 769                         ssid ? ssid->id : -1,
 770                         ssid && ssid->id_str ? ssid->id_str : "");
 771 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 772                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 773                 wpa_blacklist_clear(wpa_s);
 774                 wpa_s->extra_blacklist_count = 0;
 775                 wpa_s->new_connection = 0;
 776                 wpa_drv_set_operstate(wpa_s, 1);
 777 #ifndef IEEE8021X_EAPOL
 778                 wpa_drv_set_supp_port(wpa_s, 1);
 779 #endif /* IEEE8021X_EAPOL */
 780                 wpa_s->after_wps = 0;
 781                 wpa_s->known_wps_freq = 0;
 782                 wpas_p2p_completed(wpa_s);
 783
 784                 sme_sched_obss_scan(wpa_s, 1);
 785         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 786                    state == WPA_ASSOCIATED) {
 787                 wpa_s->new_connection = 1;
 788                 wpa_drv_set_operstate(wpa_s, 0);
 789 #ifndef IEEE8021X_EAPOL
 790                 wpa_drv_set_supp_port(wpa_s, 0);
 791 #endif /* IEEE8021X_EAPOL */
 792                 sme_sched_obss_scan(wpa_s, 0);
 793         }
 794         wpa_s->wpa_state = state;
 795
 796 #ifdef CONFIG_BGSCAN
 797         if (state == WPA_COMPLETED)
 798                 wpa_supplicant_start_bgscan(wpa_s);
 799         else if (state < WPA_ASSOCIATED)
 800                 wpa_supplicant_stop_bgscan(wpa_s);
 801 #endif /* CONFIG_BGSCAN */
 802
 803         if (state == WPA_AUTHENTICATING)
 804                 wpa_supplicant_stop_autoscan(wpa_s);
 805
 806         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 807                 wpa_supplicant_start_autoscan(wpa_s);
 808
 809         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 810                 wmm_ac_notify_disassoc(wpa_s);
 811
 812         if (wpa_s->wpa_state != old_state) {
 813                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 814
 815                 /*
 816                  * Notify the P2P Device interface about a state change in one
 817                  * of the interfaces.
 818                  */
 819                 wpas_p2p_indicate_state_change(wpa_s);
 820
 821                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 822                     old_state == WPA_COMPLETED)
 823                         wpas_notify_auth_changed(wpa_s);
 824         }
 825 }
 826
 827
 828 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 829 {
 830         int pending = 0;
 831 #ifdef CONFIG_WPS
 832         struct wpa_supplicant *wpa_s = global->ifaces;
 833         while (wpa_s) {
 834                 struct wpa_supplicant *next = wpa_s->next;
 835                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 836                         pending = 1;
 837 #ifdef CONFIG_P2P
 838                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 839                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 840                         wpas_p2p_disconnect(wpa_s);
 841 #endif /* CONFIG_P2P */
 842                 wpa_s = next;
 843         }
 844 #endif /* CONFIG_WPS */
 845         if (pending)
 846                 return;
 847         eloop_terminate();
 848 }
 849
 850
 851 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 852 {
 853         struct wpa_global *global = signal_ctx;
 854         wpa_supplicant_terminate_proc(global);
 855 }
 856
 857
 858 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 859 {
 860         enum wpa_states old_state = wpa_s->wpa_state;
 861
 862         wpa_s->pairwise_cipher = 0;
 863         wpa_s->group_cipher = 0;
 864         wpa_s->mgmt_group_cipher = 0;
 865         wpa_s->key_mgmt = 0;
 866         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 867                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 868
 869         if (wpa_s->wpa_state != old_state)
 870                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 871 }
 872
 873
 874 /**
 875  * wpa_supplicant_reload_configuration - Reload configuration data
 876  * @wpa_s: Pointer to wpa_supplicant data
 877  * Returns: 0 on success or -1 if configuration parsing failed
 878  *
 879  * This function can be used to request that the configuration data is reloaded
 880  * (e.g., after configuration file change). This function is reloading
 881  * configuration only for one interface, so this may need to be called multiple
 882  * times if %wpa_supplicant is controlling multiple interfaces and all
 883  * interfaces need reconfiguration.
 884  */
 885 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 886 {
 887         struct wpa_config *conf;
 888         int reconf_ctrl;
 889         int old_ap_scan;
 890
 891         if (wpa_s->confname == NULL)
 892                 return -1;
 893         conf = wpa_config_read(wpa_s->confname, NULL);
 894         if (conf == NULL) {
 895                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 896                         "file '%s' - exiting", wpa_s->confname);
 897                 return -1;
 898         }
 899         wpa_config_read(wpa_s->confanother, conf);
 900
 901         conf->changed_parameters = (unsigned int) -1;
 902
 903         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 904                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 905                     os_strcmp(conf->ctrl_interface,
 906                               wpa_s->conf->ctrl_interface) != 0);
 907
 908         if (reconf_ctrl && wpa_s->ctrl_iface) {
 909                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 910                 wpa_s->ctrl_iface = NULL;
 911         }
 912
 913         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 914         if (wpa_s->current_ssid) {
 915                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 916                         wpa_s->own_disconnect_req = 1;
 917                 wpa_supplicant_deauthenticate(wpa_s,
 918                                               WLAN_REASON_DEAUTH_LEAVING);
 919         }
 920
 921         /*
 922          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 923          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 924          */
 925         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 926                 /*
 927                  * Clear forced success to clear EAP state for next
 928                  * authentication.
 929                  */
 930                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 931         }
 932         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 933         wpa_sm_set_config(wpa_s->wpa, NULL);
 934         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 935         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 936         rsn_preauth_deinit(wpa_s->wpa);
 937
 938         old_ap_scan = wpa_s->conf->ap_scan;
 939         wpa_config_free(wpa_s->conf);
 940         wpa_s->conf = conf;
 941         if (old_ap_scan != wpa_s->conf->ap_scan)
 942                 wpas_notify_ap_scan_changed(wpa_s);
 943
 944         if (reconf_ctrl)
 945                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 946
 947         wpa_supplicant_update_config(wpa_s);
 948
 949         wpa_supplicant_clear_status(wpa_s);
 950         if (wpa_supplicant_enabled_networks(wpa_s)) {
 951                 wpa_s->reassociate = 1;
 952                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 953         }
 954         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 955         return 0;
 956 }
 957
 958
 959 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 960 {
 961         struct wpa_global *global = signal_ctx;
 962         struct wpa_supplicant *wpa_s;
 963         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 964                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 965                         sig);
 966                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 967                         wpa_supplicant_terminate_proc(global);
 968                 }
 969         }
 970
 971         if (wpa_debug_reopen_file() < 0) {
 972                 /* Ignore errors since we cannot really do much to fix this */
 973                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 974         }
 975 }
 976
 977
 978 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 979                                          struct wpa_ssid *ssid,
 980                                          struct wpa_ie_data *ie)
 981 {
 982         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 983         if (ret) {
 984                 if (ret == -2) {
 985                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 986                                 "from association info");
 987                 }
 988                 return -1;
 989         }
 990
 991         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 992                 "cipher suites");
 993         if (!(ie->group_cipher & ssid->group_cipher)) {
 994                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 995                         "cipher 0x%x (mask 0x%x) - reject",
 996                         ie->group_cipher, ssid->group_cipher);
 997                 return -1;
 998         }
 999         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1000                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1001                         "cipher 0x%x (mask 0x%x) - reject",
1002                         ie->pairwise_cipher, ssid->pairwise_cipher);
1003                 return -1;
1004         }
1005         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1007                         "management 0x%x (mask 0x%x) - reject",
1008                         ie->key_mgmt, ssid->key_mgmt);
1009                 return -1;
1010         }
1011
1012 #ifdef CONFIG_IEEE80211W
1013         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1014             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1015                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1016                         "that does not support management frame protection - "
1017                         "reject");
1018                 return -1;
1019         }
1020 #endif /* CONFIG_IEEE80211W */
1021
1022         return 0;
1023 }
1024
1025
1026 /**
1027  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1028  * @wpa_s: Pointer to wpa_supplicant data
1029  * @bss: Scan results for the selected BSS, or %NULL if not available
1030  * @ssid: Configuration data for the selected network
1031  * @wpa_ie: Buffer for the WPA/RSN IE
1032  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1033  * used buffer length in case the functions returns success.
1034  * Returns: 0 on success or -1 on failure
1035  *
1036  * This function is used to configure authentication and encryption parameters
1037  * based on the network configuration and scan result for the selected BSS (if
1038  * available).
1039  */
1040 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1041                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1042                               u8 *wpa_ie, size_t *wpa_ie_len)
1043 {
1044         struct wpa_ie_data ie;
1045         int sel, proto;
1046         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1047
1048         if (bss) {
1049                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1050                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1051                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1052         } else
1053                 bss_wpa = bss_rsn = bss_osen = NULL;
1054
1055         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1056             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1057             (ie.group_cipher & ssid->group_cipher) &&
1058             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1059             (ie.key_mgmt & ssid->key_mgmt)) {
1060                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1061                 proto = WPA_PROTO_RSN;
1062         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1063                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1064                    (ie.group_cipher & ssid->group_cipher) &&
1065                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1066                    (ie.key_mgmt & ssid->key_mgmt)) {
1067                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1068                 proto = WPA_PROTO_WPA;
1069 #ifdef CONFIG_HS20
1070         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1071                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1072                 /* TODO: parse OSEN element */
1073                 os_memset(&ie, 0, sizeof(ie));
1074                 ie.group_cipher = WPA_CIPHER_CCMP;
1075                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1076                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1077                 proto = WPA_PROTO_OSEN;
1078 #endif /* CONFIG_HS20 */
1079         } else if (bss) {
1080                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1081                 wpa_dbg(wpa_s, MSG_DEBUG,
1082                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1083                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1084                         ssid->key_mgmt);
1085                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1086                         MAC2STR(bss->bssid),
1087                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1088                         bss_wpa ? " WPA" : "",
1089                         bss_rsn ? " RSN" : "",
1090                         bss_osen ? " OSEN" : "");
1091                 if (bss_rsn) {
1092                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1093                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1094                                 wpa_dbg(wpa_s, MSG_DEBUG,
1095                                         "Could not parse RSN element");
1096                         } else {
1097                                 wpa_dbg(wpa_s, MSG_DEBUG,
1098                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1099                                         ie.pairwise_cipher, ie.group_cipher,
1100                                         ie.key_mgmt);
1101                         }
1102                 }
1103                 if (bss_wpa) {
1104                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1105                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1106                                 wpa_dbg(wpa_s, MSG_DEBUG,
1107                                         "Could not parse WPA element");
1108                         } else {
1109                                 wpa_dbg(wpa_s, MSG_DEBUG,
1110                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1111                                         ie.pairwise_cipher, ie.group_cipher,
1112                                         ie.key_mgmt);
1113                         }
1114                 }
1115                 return -1;
1116         } else {
1117                 if (ssid->proto & WPA_PROTO_OSEN)
1118                         proto = WPA_PROTO_OSEN;
1119                 else if (ssid->proto & WPA_PROTO_RSN)
1120                         proto = WPA_PROTO_RSN;
1121                 else
1122                         proto = WPA_PROTO_WPA;
1123                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1124                         os_memset(&ie, 0, sizeof(ie));
1125                         ie.group_cipher = ssid->group_cipher;
1126                         ie.pairwise_cipher = ssid->pairwise_cipher;
1127                         ie.key_mgmt = ssid->key_mgmt;
1128 #ifdef CONFIG_IEEE80211W
1129                         ie.mgmt_group_cipher =
1130                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1131                                 WPA_CIPHER_AES_128_CMAC : 0;
1132 #endif /* CONFIG_IEEE80211W */
1133                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1134                                 "based on configuration");
1135                 } else
1136                         proto = ie.proto;
1137         }
1138
1139         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1140                 "pairwise %d key_mgmt %d proto %d",
1141                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1142 #ifdef CONFIG_IEEE80211W
1143         if (ssid->ieee80211w) {
1144                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1145                         ie.mgmt_group_cipher);
1146         }
1147 #endif /* CONFIG_IEEE80211W */
1148
1149         wpa_s->wpa_proto = proto;
1150         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1151         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1152                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1153
1154         if (bss || !wpa_s->ap_ies_from_associnfo) {
1155                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1156                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1157                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1158                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1159                         return -1;
1160         }
1161
1162 #ifdef CONFIG_NO_WPA
1163         wpa_s->group_cipher = WPA_CIPHER_NONE;
1164         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1165 #else /* CONFIG_NO_WPA */
1166         sel = ie.group_cipher & ssid->group_cipher;
1167         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1168         if (wpa_s->group_cipher < 0) {
1169                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1170                         "cipher");
1171                 return -1;
1172         }
1173         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1174                 wpa_cipher_txt(wpa_s->group_cipher));
1175
1176         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1177         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1178         if (wpa_s->pairwise_cipher < 0) {
1179                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1180                         "cipher");
1181                 return -1;
1182         }
1183         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1184                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1185 #endif /* CONFIG_NO_WPA */
1186
1187         sel = ie.key_mgmt & ssid->key_mgmt;
1188 #ifdef CONFIG_SAE
1189         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1190                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1191 #endif /* CONFIG_SAE */
1192         if (0) {
1193 #ifdef CONFIG_SUITEB192
1194         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1195                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1196                 wpa_dbg(wpa_s, MSG_DEBUG,
1197                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1198 #endif /* CONFIG_SUITEB192 */
1199 #ifdef CONFIG_SUITEB
1200         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1202                 wpa_dbg(wpa_s, MSG_DEBUG,
1203                         "WPA: using KEY_MGMT 802.1X with Suite B");
1204 #endif /* CONFIG_SUITEB */
1205 #ifdef CONFIG_IEEE80211R
1206         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1207                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1208                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1209         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1210                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1211                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1212 #endif /* CONFIG_IEEE80211R */
1213 #ifdef CONFIG_SAE
1214         } else if (sel & WPA_KEY_MGMT_SAE) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1217         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1218                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1219                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1220 #endif /* CONFIG_SAE */
1221 #ifdef CONFIG_IEEE80211W
1222         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1223                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG,
1225                         "WPA: using KEY_MGMT 802.1X with SHA256");
1226         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1228                 wpa_dbg(wpa_s, MSG_DEBUG,
1229                         "WPA: using KEY_MGMT PSK with SHA256");
1230 #endif /* CONFIG_IEEE80211W */
1231         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1232                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1233                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1234         } else if (sel & WPA_KEY_MGMT_PSK) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1237         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1240 #ifdef CONFIG_HS20
1241         } else if (sel & WPA_KEY_MGMT_OSEN) {
1242                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1243                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1244 #endif /* CONFIG_HS20 */
1245         } else {
1246                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1247                         "authenticated key management type");
1248                 return -1;
1249         }
1250
1251         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1252         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1253                          wpa_s->pairwise_cipher);
1254         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1255
1256 #ifdef CONFIG_IEEE80211W
1257         sel = ie.mgmt_group_cipher;
1258         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1259             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1260                 sel = 0;
1261         if (sel & WPA_CIPHER_AES_128_CMAC) {
1262                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1264                         "AES-128-CMAC");
1265         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1266                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1268                         "BIP-GMAC-128");
1269         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1270                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1271                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1272                         "BIP-GMAC-256");
1273         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1274                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1275                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1276                         "BIP-CMAC-256");
1277         } else {
1278                 wpa_s->mgmt_group_cipher = 0;
1279                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1280         }
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1282                          wpa_s->mgmt_group_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1284                          wpas_get_ssid_pmf(wpa_s, ssid));
1285 #endif /* CONFIG_IEEE80211W */
1286
1287         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1288                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1289                 return -1;
1290         }
1291
1292         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1293                 int psk_set = 0;
1294
1295                 if (ssid->psk_set) {
1296                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1297                                        NULL);
1298                         psk_set = 1;
1299                 }
1300 #ifndef CONFIG_NO_PBKDF2
1301                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1302                     ssid->passphrase) {
1303                         u8 psk[PMK_LEN];
1304                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1305                                     4096, psk, PMK_LEN);
1306                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1307                                         psk, PMK_LEN);
1308                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1309                         psk_set = 1;
1310                         os_memset(psk, 0, sizeof(psk));
1311                 }
1312 #endif /* CONFIG_NO_PBKDF2 */
1313 #ifdef CONFIG_EXT_PASSWORD
1314                 if (ssid->ext_psk) {
1315                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1316                                                              ssid->ext_psk);
1317                         char pw_str[64 + 1];
1318                         u8 psk[PMK_LEN];
1319
1320                         if (pw == NULL) {
1321                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1322                                         "found from external storage");
1323                                 return -1;
1324                         }
1325
1326                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1327                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1328                                         "PSK length %d in external storage",
1329                                         (int) wpabuf_len(pw));
1330                                 ext_password_free(pw);
1331                                 return -1;
1332                         }
1333
1334                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1335                         pw_str[wpabuf_len(pw)] = '\0';
1336
1337 #ifndef CONFIG_NO_PBKDF2
1338                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1339                         {
1340                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1341                                             4096, psk, PMK_LEN);
1342                                 os_memset(pw_str, 0, sizeof(pw_str));
1343                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1344                                                 "external passphrase)",
1345                                                 psk, PMK_LEN);
1346                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1347                                                NULL);
1348                                 psk_set = 1;
1349                                 os_memset(psk, 0, sizeof(psk));
1350                         } else
1351 #endif /* CONFIG_NO_PBKDF2 */
1352                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1353                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1354                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1355                                                 "Invalid PSK hex string");
1356                                         os_memset(pw_str, 0, sizeof(pw_str));
1357                                         ext_password_free(pw);
1358                                         return -1;
1359                                 }
1360                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1361                                                NULL);
1362                                 psk_set = 1;
1363                                 os_memset(psk, 0, sizeof(psk));
1364                         } else {
1365                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1366                                         "PSK available");
1367                                 os_memset(pw_str, 0, sizeof(pw_str));
1368                                 ext_password_free(pw);
1369                                 return -1;
1370                         }
1371
1372                         os_memset(pw_str, 0, sizeof(pw_str));
1373                         ext_password_free(pw);
1374                 }
1375 #endif /* CONFIG_EXT_PASSWORD */
1376
1377                 if (!psk_set) {
1378                         wpa_msg(wpa_s, MSG_INFO,
1379                                 "No PSK available for association");
1380                         return -1;
1381                 }
1382         } else
1383                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1384
1385         return 0;
1386 }
1387
1388
1389 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1390 {
1391         *pos = 0x00;
1392
1393         switch (idx) {
1394         case 0: /* Bits 0-7 */
1395                 break;
1396         case 1: /* Bits 8-15 */
1397                 break;
1398         case 2: /* Bits 16-23 */
1399 #ifdef CONFIG_WNM
1400                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1401                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1402 #endif /* CONFIG_WNM */
1403                 break;
1404         case 3: /* Bits 24-31 */
1405 #ifdef CONFIG_WNM
1406                 *pos |= 0x02; /* Bit 25 - SSID List */
1407 #endif /* CONFIG_WNM */
1408 #ifdef CONFIG_INTERWORKING
1409                 if (wpa_s->conf->interworking)
1410                         *pos |= 0x80; /* Bit 31 - Interworking */
1411 #endif /* CONFIG_INTERWORKING */
1412                 break;
1413         case 4: /* Bits 32-39 */
1414 #ifdef CONFIG_INTERWORKING
1415                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1416                         *pos |= 0x01; /* Bit 32 - QoS Map */
1417 #endif /* CONFIG_INTERWORKING */
1418                 break;
1419         case 5: /* Bits 40-47 */
1420 #ifdef CONFIG_HS20
1421                 if (wpa_s->conf->hs20)
1422                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1423 #endif /* CONFIG_HS20 */
1424                 break;
1425         case 6: /* Bits 48-55 */
1426                 break;
1427         }
1428 }
1429
1430
1431 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1432 {
1433         u8 *pos = buf;
1434         u8 len = 6, i;
1435
1436         if (len < wpa_s->extended_capa_len)
1437                 len = wpa_s->extended_capa_len;
1438         if (buflen < (size_t) len + 2) {
1439                 wpa_printf(MSG_INFO,
1440                            "Not enough room for building extended capabilities element");
1441                 return -1;
1442         }
1443
1444         *pos++ = WLAN_EID_EXT_CAPAB;
1445         *pos++ = len;
1446         for (i = 0; i < len; i++, pos++) {
1447                 wpas_ext_capab_byte(wpa_s, pos, i);
1448
1449                 if (i < wpa_s->extended_capa_len) {
1450                         *pos &= ~wpa_s->extended_capa_mask[i];
1451                         *pos |= wpa_s->extended_capa[i];
1452                 }
1453         }
1454
1455         while (len > 0 && buf[1 + len] == 0) {
1456                 len--;
1457                 buf[1] = len;
1458         }
1459         if (len == 0)
1460                 return 0;
1461
1462         return 2 + len;
1463 }
1464
1465
1466 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1467                           struct wpa_bss *test_bss)
1468 {
1469         struct wpa_bss *bss;
1470
1471         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1472                 if (bss == test_bss)
1473                         return 1;
1474         }
1475
1476         return 0;
1477 }
1478
1479
1480 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1481                            struct wpa_ssid *test_ssid)
1482 {
1483         struct wpa_ssid *ssid;
1484
1485         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1486                 if (ssid == test_ssid)
1487                         return 1;
1488         }
1489
1490         return 0;
1491 }
1492
1493
1494 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1495                         struct wpa_ssid *test_ssid)
1496 {
1497         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1498                 return 0;
1499
1500         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1501 }
1502
1503
1504 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1505 {
1506         if (cwork == NULL)
1507                 return;
1508         os_free(cwork);
1509 }
1510
1511
1512 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1513 {
1514         struct wpa_connect_work *cwork;
1515         struct wpa_radio_work *work = wpa_s->connect_work;
1516
1517         if (!work)
1518                 return;
1519
1520         wpa_s->connect_work = NULL;
1521         cwork = work->ctx;
1522         work->ctx = NULL;
1523         wpas_connect_work_free(cwork);
1524         radio_work_done(work);
1525 }
1526
1527
1528 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1529 {
1530         struct os_reltime now;
1531         u8 addr[ETH_ALEN];
1532
1533         os_get_reltime(&now);
1534         if (wpa_s->last_mac_addr_style == style &&
1535             wpa_s->last_mac_addr_change.sec != 0 &&
1536             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1537                                 wpa_s->conf->rand_addr_lifetime)) {
1538                 wpa_msg(wpa_s, MSG_DEBUG,
1539                         "Previously selected random MAC address has not yet expired");
1540                 return 0;
1541         }
1542
1543         switch (style) {
1544         case 1:
1545                 if (random_mac_addr(addr) < 0)
1546                         return -1;
1547                 break;
1548         case 2:
1549                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1550                 if (random_mac_addr_keep_oui(addr) < 0)
1551                         return -1;
1552                 break;
1553         default:
1554                 return -1;
1555         }
1556
1557         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1558                 wpa_msg(wpa_s, MSG_INFO,
1559                         "Failed to set random MAC address");
1560                 return -1;
1561         }
1562
1563         os_get_reltime(&wpa_s->last_mac_addr_change);
1564         wpa_s->mac_addr_changed = 1;
1565         wpa_s->last_mac_addr_style = style;
1566
1567         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1568                 wpa_msg(wpa_s, MSG_INFO,
1569                         "Could not update MAC address information");
1570                 return -1;
1571         }
1572
1573         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1574                 MAC2STR(addr));
1575
1576         return 0;
1577 }
1578
1579
1580 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1581 {
1582         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1583             !wpa_s->conf->preassoc_mac_addr)
1584                 return 0;
1585
1586         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1587 }
1588
1589
1590 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1591
1592 /**
1593  * wpa_supplicant_associate - Request association
1594  * @wpa_s: Pointer to wpa_supplicant data
1595  * @bss: Scan results for the selected BSS, or %NULL if not available
1596  * @ssid: Configuration data for the selected network
1597  *
1598  * This function is used to request %wpa_supplicant to associate with a BSS.
1599  */
1600 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1601                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1602 {
1603         struct wpa_connect_work *cwork;
1604         int rand_style;
1605
1606         wpa_s->own_disconnect_req = 0;
1607
1608         /*
1609          * If we are starting a new connection, any previously pending EAPOL
1610          * RX cannot be valid anymore.
1611          */
1612         wpabuf_free(wpa_s->pending_eapol_rx);
1613         wpa_s->pending_eapol_rx = NULL;
1614
1615         if (ssid->mac_addr == -1)
1616                 rand_style = wpa_s->conf->mac_addr;
1617         else
1618                 rand_style = ssid->mac_addr;
1619
1620         wmm_ac_clear_saved_tspecs(wpa_s);
1621         wpa_s->reassoc_same_bss = 0;
1622
1623         if (wpa_s->last_ssid == ssid) {
1624                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1625                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1626                         wmm_ac_save_tspecs(wpa_s);
1627                         wpa_s->reassoc_same_bss = 1;
1628                 }
1629         } else if (rand_style > 0) {
1630                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1631                         return;
1632                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1633         } else if (wpa_s->mac_addr_changed) {
1634                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1635                         wpa_msg(wpa_s, MSG_INFO,
1636                                 "Could not restore permanent MAC address");
1637                         return;
1638                 }
1639                 wpa_s->mac_addr_changed = 0;
1640                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1641                         wpa_msg(wpa_s, MSG_INFO,
1642                                 "Could not update MAC address information");
1643                         return;
1644                 }
1645                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1646         }
1647         wpa_s->last_ssid = ssid;
1648
1649 #ifdef CONFIG_IBSS_RSN
1650         ibss_rsn_deinit(wpa_s->ibss_rsn);
1651         wpa_s->ibss_rsn = NULL;
1652 #endif /* CONFIG_IBSS_RSN */
1653
1654         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1655             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1656 #ifdef CONFIG_AP
1657                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1658                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1659                                 "mode");
1660                         return;
1661                 }
1662                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1663                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1664                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1665                                 wpas_p2p_ap_setup_failed(wpa_s);
1666                         return;
1667                 }
1668                 wpa_s->current_bss = bss;
1669 #else /* CONFIG_AP */
1670                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1671                         "the build");
1672 #endif /* CONFIG_AP */
1673                 return;
1674         }
1675
1676         if (ssid->mode == WPAS_MODE_MESH) {
1677 #ifdef CONFIG_MESH
1678                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1679                         wpa_msg(wpa_s, MSG_INFO,
1680                                 "Driver does not support mesh mode");
1681                         return;
1682                 }
1683                 if (bss)
1684                         ssid->frequency = bss->freq;
1685                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1686                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1687                         return;
1688                 }
1689                 wpa_s->current_bss = bss;
1690                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1691                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1692                         ssid->id);
1693 #else /* CONFIG_MESH */
1694                 wpa_msg(wpa_s, MSG_ERROR,
1695                         "mesh mode support not included in the build");
1696 #endif /* CONFIG_MESH */
1697                 return;
1698         }
1699
1700 #ifdef CONFIG_TDLS
1701         if (bss)
1702                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1703                                 bss->ie_len);
1704 #endif /* CONFIG_TDLS */
1705
1706         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1707             ssid->mode == IEEE80211_MODE_INFRA) {
1708                 sme_authenticate(wpa_s, bss, ssid);
1709                 return;
1710         }
1711
1712         if (wpa_s->connect_work) {
1713                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1714                 return;
1715         }
1716
1717         if (radio_work_pending(wpa_s, "connect")) {
1718                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1719                 return;
1720         }
1721
1722         wpas_abort_ongoing_scan(wpa_s);
1723
1724         cwork = os_zalloc(sizeof(*cwork));
1725         if (cwork == NULL)
1726                 return;
1727
1728         cwork->bss = bss;
1729         cwork->ssid = ssid;
1730
1731         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1732                            wpas_start_assoc_cb, cwork) < 0) {
1733                 os_free(cwork);
1734         }
1735 }
1736
1737
1738 static int bss_is_ibss(struct wpa_bss *bss)
1739 {
1740         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1741                 IEEE80211_CAP_IBSS;
1742 }
1743
1744
1745 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1746                             const struct wpa_ssid *ssid)
1747 {
1748         enum hostapd_hw_mode hw_mode;
1749         struct hostapd_hw_modes *mode = NULL;
1750         u8 channel;
1751         int i;
1752
1753 #ifdef CONFIG_HT_OVERRIDES
1754         if (ssid->disable_ht)
1755                 return 0;
1756 #endif /* CONFIG_HT_OVERRIDES */
1757
1758         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1759         if (hw_mode == NUM_HOSTAPD_MODES)
1760                 return 0;
1761         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1762                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1763                         mode = &wpa_s->hw.modes[i];
1764                         break;
1765                 }
1766         }
1767
1768         if (!mode)
1769                 return 0;
1770
1771         return mode->vht_capab != 0;
1772 }
1773
1774
1775 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1776                           const struct wpa_ssid *ssid,
1777                           struct hostapd_freq_params *freq)
1778 {
1779         enum hostapd_hw_mode hw_mode;
1780         struct hostapd_hw_modes *mode = NULL;
1781         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1782                            184, 192 };
1783         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1784         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1785         u8 channel;
1786         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1787         unsigned int j, k;
1788         struct hostapd_freq_params vht_freq;
1789         int chwidth, seg0, seg1;
1790         u32 vht_caps = 0;
1791
1792         freq->freq = ssid->frequency;
1793
1794         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1795                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1796
1797                 if (ssid->mode != WPAS_MODE_IBSS)
1798                         break;
1799
1800                 /* Don't adjust control freq in case of fixed_freq */
1801                 if (ssid->fixed_freq)
1802                         break;
1803
1804                 if (!bss_is_ibss(bss))
1805                         continue;
1806
1807                 if (ssid->ssid_len == bss->ssid_len &&
1808                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1809                         wpa_printf(MSG_DEBUG,
1810                                    "IBSS already found in scan results, adjust control freq: %d",
1811                                    bss->freq);
1812                         freq->freq = bss->freq;
1813                         obss_scan = 0;
1814                         break;
1815                 }
1816         }
1817
1818         /* For IBSS check HT_IBSS flag */
1819         if (ssid->mode == WPAS_MODE_IBSS &&
1820             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1821                 return;
1822
1823         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1824             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1825             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1826                 wpa_printf(MSG_DEBUG,
1827                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1828                 return;
1829         }
1830
1831         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1832         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1833                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1834                         mode = &wpa_s->hw.modes[i];
1835                         break;
1836                 }
1837         }
1838
1839         if (!mode)
1840                 return;
1841
1842         freq->ht_enabled = ht_supported(mode);
1843         if (!freq->ht_enabled)
1844                 return;
1845
1846         /* Setup higher BW only for 5 GHz */
1847         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1848                 return;
1849
1850         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1851                 pri_chan = &mode->channels[chan_idx];
1852                 if (pri_chan->chan == channel)
1853                         break;
1854                 pri_chan = NULL;
1855         }
1856         if (!pri_chan)
1857                 return;
1858
1859         /* Check primary channel flags */
1860         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1861                 return;
1862
1863         /* Check/setup HT40+/HT40- */
1864         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1865                 if (ht40plus[j] == channel) {
1866                         ht40 = 1;
1867                         break;
1868                 }
1869         }
1870
1871         /* Find secondary channel */
1872         for (i = 0; i < mode->num_channels; i++) {
1873                 sec_chan = &mode->channels[i];
1874                 if (sec_chan->chan == channel + ht40 * 4)
1875                         break;
1876                 sec_chan = NULL;
1877         }
1878         if (!sec_chan)
1879                 return;
1880
1881         /* Check secondary channel flags */
1882         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1883                 return;
1884
1885         freq->channel = pri_chan->chan;
1886
1887         switch (ht40) {
1888         case -1:
1889                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1890                         return;
1891                 freq->sec_channel_offset = -1;
1892                 break;
1893         case 1:
1894                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1895                         return;
1896                 freq->sec_channel_offset = 1;
1897                 break;
1898         default:
1899                 break;
1900         }
1901
1902         if (freq->sec_channel_offset && obss_scan) {
1903                 struct wpa_scan_results *scan_res;
1904
1905                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1906                 if (scan_res == NULL) {
1907                         /* Back to HT20 */
1908                         freq->sec_channel_offset = 0;
1909                         return;
1910                 }
1911
1912                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1913                                      sec_chan->chan);
1914                 switch (res) {
1915                 case 0:
1916                         /* Back to HT20 */
1917                         freq->sec_channel_offset = 0;
1918                         break;
1919                 case 1:
1920                         /* Configuration allowed */
1921                         break;
1922                 case 2:
1923                         /* Switch pri/sec channels */
1924                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1925                         freq->sec_channel_offset = -freq->sec_channel_offset;
1926                         freq->channel = sec_chan->chan;
1927                         break;
1928                 default:
1929                         freq->sec_channel_offset = 0;
1930                         break;
1931                 }
1932
1933                 wpa_scan_results_free(scan_res);
1934         }
1935
1936         wpa_printf(MSG_DEBUG,
1937                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1938                    freq->channel, freq->sec_channel_offset);
1939
1940         if (!drv_supports_vht(wpa_s, ssid))
1941                 return;
1942
1943         /* For IBSS check VHT_IBSS flag */
1944         if (ssid->mode == WPAS_MODE_IBSS &&
1945             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1946                 return;
1947
1948         vht_freq = *freq;
1949
1950         vht_freq.vht_enabled = vht_supported(mode);
1951         if (!vht_freq.vht_enabled)
1952                 return;
1953
1954         /* setup center_freq1, bandwidth */
1955         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1956                 if (freq->channel >= vht80[j] &&
1957                     freq->channel < vht80[j] + 16)
1958                         break;
1959         }
1960
1961         if (j == ARRAY_SIZE(vht80))
1962                 return;
1963
1964         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1965                 struct hostapd_channel_data *chan;
1966
1967                 chan = hw_get_channel_chan(mode, i, NULL);
1968                 if (!chan)
1969                         return;
1970
1971                 /* Back to HT configuration if channel not usable */
1972                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1973                         return;
1974         }
1975
1976         chwidth = VHT_CHANWIDTH_80MHZ;
1977         seg0 = vht80[j] + 6;
1978         seg1 = 0;
1979
1980         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
1981                 /* setup center_freq2, bandwidth */
1982                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
1983                         /* Only accept 80 MHz segments separated by a gap */
1984                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
1985                                 continue;
1986                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
1987                                 struct hostapd_channel_data *chan;
1988
1989                                 chan = hw_get_channel_chan(mode, i, NULL);
1990                                 if (!chan)
1991                                         continue;
1992
1993                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
1994                                                   HOSTAPD_CHAN_NO_IR |
1995                                                   HOSTAPD_CHAN_RADAR))
1996                                         continue;
1997
1998                                 /* Found a suitable second segment for 80+80 */
1999                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2000                                 vht_caps |=
2001                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2002                                 seg1 = vht80[k] + 6;
2003                         }
2004
2005                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2006                                 break;
2007                 }
2008         }
2009
2010         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2011                                     freq->channel, freq->ht_enabled,
2012                                     vht_freq.vht_enabled,
2013                                     freq->sec_channel_offset,
2014                                     chwidth, seg0, seg1, vht_caps) != 0)
2015                 return;
2016
2017         *freq = vht_freq;
2018
2019         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2020                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2021 }
2022
2023
2024 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2025 {
2026         struct wpa_connect_work *cwork = work->ctx;
2027         struct wpa_bss *bss = cwork->bss;
2028         struct wpa_ssid *ssid = cwork->ssid;
2029         struct wpa_supplicant *wpa_s = work->wpa_s;
2030         u8 wpa_ie[200];
2031         size_t wpa_ie_len;
2032         int use_crypt, ret, i, bssid_changed;
2033         int algs = WPA_AUTH_ALG_OPEN;
2034         unsigned int cipher_pairwise, cipher_group;
2035         struct wpa_driver_associate_params params;
2036         int wep_keys_set = 0;
2037         int assoc_failed = 0;
2038         struct wpa_ssid *old_ssid;
2039 #ifdef CONFIG_HT_OVERRIDES
2040         struct ieee80211_ht_capabilities htcaps;
2041         struct ieee80211_ht_capabilities htcaps_mask;
2042 #endif /* CONFIG_HT_OVERRIDES */
2043 #ifdef CONFIG_VHT_OVERRIDES
2044        struct ieee80211_vht_capabilities vhtcaps;
2045        struct ieee80211_vht_capabilities vhtcaps_mask;
2046 #endif /* CONFIG_VHT_OVERRIDES */
2047
2048         if (deinit) {
2049                 if (work->started) {
2050                         wpa_s->connect_work = NULL;
2051
2052                         /* cancel possible auth. timeout */
2053                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2054                                              NULL);
2055                 }
2056                 wpas_connect_work_free(cwork);
2057                 return;
2058         }
2059
2060         wpa_s->connect_work = work;
2061
2062         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2063             wpas_network_disabled(wpa_s, ssid)) {
2064                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2065                 wpas_connect_work_done(wpa_s);
2066                 return;
2067         }
2068
2069         os_memset(&params, 0, sizeof(params));
2070         wpa_s->reassociate = 0;
2071         wpa_s->eap_expected_failure = 0;
2072         if (bss &&
2073             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2074 #ifdef CONFIG_IEEE80211R
2075                 const u8 *ie, *md = NULL;
2076 #endif /* CONFIG_IEEE80211R */
2077                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2078                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2079                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2080                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2081                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2082                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2083                 if (bssid_changed)
2084                         wpas_notify_bssid_changed(wpa_s);
2085 #ifdef CONFIG_IEEE80211R
2086                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2087                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2088                         md = ie + 2;
2089                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2090                 if (md) {
2091                         /* Prepare for the next transition */
2092                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2093                 }
2094 #endif /* CONFIG_IEEE80211R */
2095 #ifdef CONFIG_WPS
2096         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2097                    wpa_s->conf->ap_scan == 2 &&
2098                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2099                 /* Use ap_scan==1 style network selection to find the network
2100                  */
2101                 wpas_connect_work_done(wpa_s);
2102                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2103                 wpa_s->reassociate = 1;
2104                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2105                 return;
2106 #endif /* CONFIG_WPS */
2107         } else {
2108                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2109                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2110                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2111         }
2112         if (!wpa_s->pno)
2113                 wpa_supplicant_cancel_sched_scan(wpa_s);
2114
2115         wpa_supplicant_cancel_scan(wpa_s);
2116
2117         /* Starting new association, so clear the possibly used WPA IE from the
2118          * previous association. */
2119         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2120
2121 #ifdef IEEE8021X_EAPOL
2122         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2123                 if (ssid->leap) {
2124                         if (ssid->non_leap == 0)
2125                                 algs = WPA_AUTH_ALG_LEAP;
2126                         else
2127                                 algs |= WPA_AUTH_ALG_LEAP;
2128                 }
2129         }
2130 #endif /* IEEE8021X_EAPOL */
2131         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2132         if (ssid->auth_alg) {
2133                 algs = ssid->auth_alg;
2134                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2135                         "0x%x", algs);
2136         }
2137
2138         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2139                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2140             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2141                 int try_opportunistic;
2142                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2143                                      wpa_s->conf->okc :
2144                                      ssid->proactive_key_caching) &&
2145                         (ssid->proto & WPA_PROTO_RSN);
2146                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2147                                             ssid, try_opportunistic) == 0)
2148                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2149                 wpa_ie_len = sizeof(wpa_ie);
2150                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2151                                               wpa_ie, &wpa_ie_len)) {
2152                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2153                                 "key management and encryption suites");
2154                         wpas_connect_work_done(wpa_s);
2155                         return;
2156                 }
2157         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2158                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2159                 /*
2160                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2161                  * use non-WPA since the scan results did not indicate that the
2162                  * AP is using WPA or WPA2.
2163                  */
2164                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2165                 wpa_ie_len = 0;
2166                 wpa_s->wpa_proto = 0;
2167         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2168                 wpa_ie_len = sizeof(wpa_ie);
2169                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2170                                               wpa_ie, &wpa_ie_len)) {
2171                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2172                                 "key management and encryption suites (no "
2173                                 "scan results)");
2174                         wpas_connect_work_done(wpa_s);
2175                         return;
2176                 }
2177 #ifdef CONFIG_WPS
2178         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2179                 struct wpabuf *wps_ie;
2180                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2181                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2182                         wpa_ie_len = wpabuf_len(wps_ie);
2183                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2184                 } else
2185                         wpa_ie_len = 0;
2186                 wpabuf_free(wps_ie);
2187                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2188                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2189                         params.wps = WPS_MODE_PRIVACY;
2190                 else
2191                         params.wps = WPS_MODE_OPEN;
2192                 wpa_s->wpa_proto = 0;
2193 #endif /* CONFIG_WPS */
2194         } else {
2195                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2196                 wpa_ie_len = 0;
2197                 wpa_s->wpa_proto = 0;
2198         }
2199
2200 #ifdef CONFIG_P2P
2201         if (wpa_s->global->p2p) {
2202                 u8 *pos;
2203                 size_t len;
2204                 int res;
2205                 pos = wpa_ie + wpa_ie_len;
2206                 len = sizeof(wpa_ie) - wpa_ie_len;
2207                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2208                                             ssid->p2p_group);
2209                 if (res >= 0)
2210                         wpa_ie_len += res;
2211         }
2212
2213         wpa_s->cross_connect_disallowed = 0;
2214         if (bss) {
2215                 struct wpabuf *p2p;
2216                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2217                 if (p2p) {
2218                         wpa_s->cross_connect_disallowed =
2219                                 p2p_get_cross_connect_disallowed(p2p);
2220                         wpabuf_free(p2p);
2221                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2222                                 "connection",
2223                                 wpa_s->cross_connect_disallowed ?
2224                                 "disallows" : "allows");
2225                 }
2226         }
2227
2228         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2229 #endif /* CONFIG_P2P */
2230
2231 #ifdef CONFIG_HS20
2232         if (is_hs20_network(wpa_s, ssid, bss)) {
2233                 struct wpabuf *hs20;
2234                 hs20 = wpabuf_alloc(20);
2235                 if (hs20) {
2236                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2237                         size_t len;
2238
2239                         wpas_hs20_add_indication(hs20, pps_mo_id);
2240                         len = sizeof(wpa_ie) - wpa_ie_len;
2241                         if (wpabuf_len(hs20) <= len) {
2242                                 os_memcpy(wpa_ie + wpa_ie_len,
2243                                           wpabuf_head(hs20), wpabuf_len(hs20));
2244                                 wpa_ie_len += wpabuf_len(hs20);
2245                         }
2246                         wpabuf_free(hs20);
2247                 }
2248         }
2249 #endif /* CONFIG_HS20 */
2250
2251         /*
2252          * Workaround: Add Extended Capabilities element only if the AP
2253          * included this element in Beacon/Probe Response frames. Some older
2254          * APs seem to have interoperability issues if this element is
2255          * included, so while the standard may require us to include the
2256          * element in all cases, it is justifiable to skip it to avoid
2257          * interoperability issues.
2258          */
2259         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2260                 u8 ext_capab[18];
2261                 int ext_capab_len;
2262                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2263                                                      sizeof(ext_capab));
2264                 if (ext_capab_len > 0) {
2265                         u8 *pos = wpa_ie;
2266                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2267                                 pos += 2 + pos[1];
2268                         os_memmove(pos + ext_capab_len, pos,
2269                                    wpa_ie_len - (pos - wpa_ie));
2270                         wpa_ie_len += ext_capab_len;
2271                         os_memcpy(pos, ext_capab, ext_capab_len);
2272                 }
2273         }
2274
2275         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2276                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2277                 size_t len;
2278
2279                 len = sizeof(wpa_ie) - wpa_ie_len;
2280                 if (wpabuf_len(buf) <= len) {
2281                         os_memcpy(wpa_ie + wpa_ie_len,
2282                                   wpabuf_head(buf), wpabuf_len(buf));
2283                         wpa_ie_len += wpabuf_len(buf);
2284                 }
2285         }
2286
2287 #ifdef CONFIG_FST
2288         if (wpa_s->fst_ies) {
2289                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2290
2291                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2292                         os_memcpy(wpa_ie + wpa_ie_len,
2293                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2294                         wpa_ie_len += fst_ies_len;
2295                 }
2296         }
2297 #endif /* CONFIG_FST */
2298
2299         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2300         use_crypt = 1;
2301         cipher_pairwise = wpa_s->pairwise_cipher;
2302         cipher_group = wpa_s->group_cipher;
2303         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2304             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2305                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2306                         use_crypt = 0;
2307                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2308                         use_crypt = 1;
2309                         wep_keys_set = 1;
2310                 }
2311         }
2312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2313                 use_crypt = 0;
2314
2315 #ifdef IEEE8021X_EAPOL
2316         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2317                 if ((ssid->eapol_flags &
2318                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2319                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2320                     !wep_keys_set) {
2321                         use_crypt = 0;
2322                 } else {
2323                         /* Assume that dynamic WEP-104 keys will be used and
2324                          * set cipher suites in order for drivers to expect
2325                          * encryption. */
2326                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2327                 }
2328         }
2329 #endif /* IEEE8021X_EAPOL */
2330
2331         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2332                 /* Set the key before (and later after) association */
2333                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2334         }
2335
2336         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2337         if (bss) {
2338                 params.ssid = bss->ssid;
2339                 params.ssid_len = bss->ssid_len;
2340                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2341                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2342                                    MACSTR " freq=%u MHz based on scan results "
2343                                    "(bssid_set=%d)",
2344                                    MAC2STR(bss->bssid), bss->freq,
2345                                    ssid->bssid_set);
2346                         params.bssid = bss->bssid;
2347                         params.freq.freq = bss->freq;
2348                 }
2349                 params.bssid_hint = bss->bssid;
2350                 params.freq_hint = bss->freq;
2351                 params.pbss = bss_is_pbss(bss);
2352         } else {
2353                 params.ssid = ssid->ssid;
2354                 params.ssid_len = ssid->ssid_len;
2355                 params.pbss = ssid->pbss;
2356         }
2357
2358         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2359             wpa_s->conf->ap_scan == 2) {
2360                 params.bssid = ssid->bssid;
2361                 params.fixed_bssid = 1;
2362         }
2363
2364         /* Initial frequency for IBSS/mesh */
2365         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2366             ssid->frequency > 0 && params.freq.freq == 0)
2367                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2368
2369         if (ssid->mode == WPAS_MODE_IBSS) {
2370                 params.fixed_freq = ssid->fixed_freq;
2371                 if (ssid->beacon_int)
2372                         params.beacon_int = ssid->beacon_int;
2373                 else
2374                         params.beacon_int = wpa_s->conf->beacon_int;
2375         }
2376
2377         params.wpa_ie = wpa_ie;
2378         params.wpa_ie_len = wpa_ie_len;
2379         params.pairwise_suite = cipher_pairwise;
2380         params.group_suite = cipher_group;
2381         params.key_mgmt_suite = wpa_s->key_mgmt;
2382         params.wpa_proto = wpa_s->wpa_proto;
2383         params.auth_alg = algs;
2384         params.mode = ssid->mode;
2385         params.bg_scan_period = ssid->bg_scan_period;
2386         for (i = 0; i < NUM_WEP_KEYS; i++) {
2387                 if (ssid->wep_key_len[i])
2388                         params.wep_key[i] = ssid->wep_key[i];
2389                 params.wep_key_len[i] = ssid->wep_key_len[i];
2390         }
2391         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2392
2393         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2394             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2395              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2396                 params.passphrase = ssid->passphrase;
2397                 if (ssid->psk_set)
2398                         params.psk = ssid->psk;
2399         }
2400
2401         if (wpa_s->conf->key_mgmt_offload) {
2402                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2403                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2404                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2405                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2406                         params.req_key_mgmt_offload =
2407                                 ssid->proactive_key_caching < 0 ?
2408                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2409                 else
2410                         params.req_key_mgmt_offload = 1;
2411
2412                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2413                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2414                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2415                     ssid->psk_set)
2416                         params.psk = ssid->psk;
2417         }
2418
2419         params.drop_unencrypted = use_crypt;
2420
2421 #ifdef CONFIG_IEEE80211W
2422         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2423         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2424                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2425                 struct wpa_ie_data ie;
2426                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2427                     ie.capabilities &
2428                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2429                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2430                                 "MFP: require MFP");
2431                         params.mgmt_frame_protection =
2432                                 MGMT_FRAME_PROTECTION_REQUIRED;
2433                 }
2434         }
2435 #endif /* CONFIG_IEEE80211W */
2436
2437         params.p2p = ssid->p2p_group;
2438
2439         if (wpa_s->parent->set_sta_uapsd)
2440                 params.uapsd = wpa_s->parent->sta_uapsd;
2441         else
2442                 params.uapsd = -1;
2443
2444 #ifdef CONFIG_HT_OVERRIDES
2445         os_memset(&htcaps, 0, sizeof(htcaps));
2446         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2447         params.htcaps = (u8 *) &htcaps;
2448         params.htcaps_mask = (u8 *) &htcaps_mask;
2449         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2450 #endif /* CONFIG_HT_OVERRIDES */
2451 #ifdef CONFIG_VHT_OVERRIDES
2452         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2453         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2454         params.vhtcaps = &vhtcaps;
2455         params.vhtcaps_mask = &vhtcaps_mask;
2456         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2457 #endif /* CONFIG_VHT_OVERRIDES */
2458
2459 #ifdef CONFIG_P2P
2460         /*
2461          * If multi-channel concurrency is not supported, check for any
2462          * frequency conflict. In case of any frequency conflict, remove the
2463          * least prioritized connection.
2464          */
2465         if (wpa_s->num_multichan_concurrent < 2) {
2466                 int freq, num;
2467                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2468                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2469                         wpa_printf(MSG_DEBUG,
2470                                    "Assoc conflicting freq found (%d != %d)",
2471                                    freq, params.freq.freq);
2472                         if (wpas_p2p_handle_frequency_conflicts(
2473                                     wpa_s, params.freq.freq, ssid) < 0) {
2474                                 wpas_connect_work_done(wpa_s);
2475                                 return;
2476                         }
2477                 }
2478         }
2479 #endif /* CONFIG_P2P */
2480
2481         ret = wpa_drv_associate(wpa_s, &params);
2482         if (ret < 0) {
2483                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2484                         "failed");
2485                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2486                         /*
2487                          * The driver is known to mean what is saying, so we
2488                          * can stop right here; the association will not
2489                          * succeed.
2490                          */
2491                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2492                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2493                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2494                         return;
2495                 }
2496                 /* try to continue anyway; new association will be tried again
2497                  * after timeout */
2498                 assoc_failed = 1;
2499         }
2500
2501         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2502                 /* Set the key after the association just in case association
2503                  * cleared the previously configured key. */
2504                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2505                 /* No need to timeout authentication since there is no key
2506                  * management. */
2507                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2508                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2509 #ifdef CONFIG_IBSS_RSN
2510         } else if (ssid->mode == WPAS_MODE_IBSS &&
2511                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2512                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2513                 /*
2514                  * RSN IBSS authentication is per-STA and we can disable the
2515                  * per-BSSID authentication.
2516                  */
2517                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2518 #endif /* CONFIG_IBSS_RSN */
2519         } else {
2520                 /* Timeout for IEEE 802.11 authentication and association */
2521                 int timeout = 60;
2522
2523                 if (assoc_failed) {
2524                         /* give IBSS a bit more time */
2525                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2526                 } else if (wpa_s->conf->ap_scan == 1) {
2527                         /* give IBSS a bit more time */
2528                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2529                 }
2530                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2531         }
2532
2533         if (wep_keys_set &&
2534             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2535                 /* Set static WEP keys again */
2536                 wpa_set_wep_keys(wpa_s, ssid);
2537         }
2538
2539         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2540                 /*
2541                  * Do not allow EAP session resumption between different
2542                  * network configurations.
2543                  */
2544                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2545         }
2546         old_ssid = wpa_s->current_ssid;
2547         wpa_s->current_ssid = ssid;
2548         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2549                 wpa_s->current_bss = bss;
2550         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2551         wpa_supplicant_initiate_eapol(wpa_s);
2552         if (old_ssid != wpa_s->current_ssid)
2553                 wpas_notify_network_changed(wpa_s);
2554 }
2555
2556
2557 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2558                                             const u8 *addr)
2559 {
2560         struct wpa_ssid *old_ssid;
2561
2562         wpas_connect_work_done(wpa_s);
2563         wpa_clear_keys(wpa_s, addr);
2564         old_ssid = wpa_s->current_ssid;
2565         wpa_supplicant_mark_disassoc(wpa_s);
2566         wpa_sm_set_config(wpa_s->wpa, NULL);
2567         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2568         if (old_ssid != wpa_s->current_ssid)
2569                 wpas_notify_network_changed(wpa_s);
2570         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2571 }
2572
2573
2574 /**
2575  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2576  * @wpa_s: Pointer to wpa_supplicant data
2577  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2578  *
2579  * This function is used to request %wpa_supplicant to deauthenticate from the
2580  * current AP.
2581  */
2582 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2583                                    int reason_code)
2584 {
2585         u8 *addr = NULL;
2586         union wpa_event_data event;
2587         int zero_addr = 0;
2588
2589         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2590                 " pending_bssid=" MACSTR " reason=%d state=%s",
2591                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2592                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2593
2594         if (!is_zero_ether_addr(wpa_s->bssid))
2595                 addr = wpa_s->bssid;
2596         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2597                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2598                   wpa_s->wpa_state == WPA_ASSOCIATING))
2599                 addr = wpa_s->pending_bssid;
2600         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2601                 /*
2602                  * When using driver-based BSS selection, we may not know the
2603                  * BSSID with which we are currently trying to associate. We
2604                  * need to notify the driver of this disconnection even in such
2605                  * a case, so use the all zeros address here.
2606                  */
2607                 addr = wpa_s->bssid;
2608                 zero_addr = 1;
2609         }
2610
2611 #ifdef CONFIG_TDLS
2612         wpa_tdls_teardown_peers(wpa_s->wpa);
2613 #endif /* CONFIG_TDLS */
2614
2615 #ifdef CONFIG_MESH
2616         if (wpa_s->ifmsh) {
2617                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2618                         wpa_s->ifname);
2619                 wpa_supplicant_leave_mesh(wpa_s);
2620         }
2621 #endif /* CONFIG_MESH */
2622
2623         if (addr) {
2624                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2625                 os_memset(&event, 0, sizeof(event));
2626                 event.deauth_info.reason_code = (u16) reason_code;
2627                 event.deauth_info.locally_generated = 1;
2628                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2629                 if (zero_addr)
2630                         addr = NULL;
2631         }
2632
2633         wpa_supplicant_clear_connection(wpa_s, addr);
2634 }
2635
2636 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2637                                               struct wpa_ssid *ssid)
2638 {
2639         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2640                 return;
2641
2642         ssid->disabled = 0;
2643         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2644         wpas_notify_network_enabled_changed(wpa_s, ssid);
2645
2646         /*
2647          * Try to reassociate since there is no current configuration and a new
2648          * network was made available.
2649          */
2650         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2651                 wpa_s->reassociate = 1;
2652 }
2653
2654
2655 /**
2656  * wpa_supplicant_enable_network - Mark a configured network as enabled
2657  * @wpa_s: wpa_supplicant structure for a network interface
2658  * @ssid: wpa_ssid structure for a configured network or %NULL
2659  *
2660  * Enables the specified network or all networks if no network specified.
2661  */
2662 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2663                                    struct wpa_ssid *ssid)
2664 {
2665         if (ssid == NULL) {
2666                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2667                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2668         } else
2669                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2670
2671         if (wpa_s->reassociate && !wpa_s->disconnected &&
2672             (!wpa_s->current_ssid ||
2673              wpa_s->wpa_state == WPA_DISCONNECTED ||
2674              wpa_s->wpa_state == WPA_SCANNING)) {
2675                 if (wpa_s->sched_scanning) {
2676                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2677                                    "new network to scan filters");
2678                         wpa_supplicant_cancel_sched_scan(wpa_s);
2679                 }
2680
2681                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2682                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2683                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2684                 }
2685         }
2686 }
2687
2688
2689 /**
2690  * wpa_supplicant_disable_network - Mark a configured network as disabled
2691  * @wpa_s: wpa_supplicant structure for a network interface
2692  * @ssid: wpa_ssid structure for a configured network or %NULL
2693  *
2694  * Disables the specified network or all networks if no network specified.
2695  */
2696 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2697                                     struct wpa_ssid *ssid)
2698 {
2699         struct wpa_ssid *other_ssid;
2700         int was_disabled;
2701
2702         if (ssid == NULL) {
2703                 if (wpa_s->sched_scanning)
2704                         wpa_supplicant_cancel_sched_scan(wpa_s);
2705
2706                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2707                      other_ssid = other_ssid->next) {
2708                         was_disabled = other_ssid->disabled;
2709                         if (was_disabled == 2)
2710                                 continue; /* do not change persistent P2P group
2711                                            * data */
2712
2713                         other_ssid->disabled = 1;
2714
2715                         if (was_disabled != other_ssid->disabled)
2716                                 wpas_notify_network_enabled_changed(
2717                                         wpa_s, other_ssid);
2718                 }
2719                 if (wpa_s->current_ssid)
2720                         wpa_supplicant_deauthenticate(
2721                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2722         } else if (ssid->disabled != 2) {
2723                 if (ssid == wpa_s->current_ssid)
2724                         wpa_supplicant_deauthenticate(
2725                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2726
2727                 was_disabled = ssid->disabled;
2728
2729                 ssid->disabled = 1;
2730
2731                 if (was_disabled != ssid->disabled) {
2732                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2733                         if (wpa_s->sched_scanning) {
2734                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2735                                            "to remove network from filters");
2736                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2737                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2738                         }
2739                 }
2740         }
2741 }
2742
2743
2744 /**
2745  * wpa_supplicant_select_network - Attempt association with a network
2746  * @wpa_s: wpa_supplicant structure for a network interface
2747  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2748  */
2749 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2750                                    struct wpa_ssid *ssid)
2751 {
2752
2753         struct wpa_ssid *other_ssid;
2754         int disconnected = 0;
2755
2756         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2757                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2758                         wpa_s->own_disconnect_req = 1;
2759                 wpa_supplicant_deauthenticate(
2760                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2761                 disconnected = 1;
2762         }
2763
2764         if (ssid)
2765                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2766
2767         /*
2768          * Mark all other networks disabled or mark all networks enabled if no
2769          * network specified.
2770          */
2771         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2772              other_ssid = other_ssid->next) {
2773                 int was_disabled = other_ssid->disabled;
2774                 if (was_disabled == 2)
2775                         continue; /* do not change persistent P2P group data */
2776
2777                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2778                 if (was_disabled && !other_ssid->disabled)
2779                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2780
2781                 if (was_disabled != other_ssid->disabled)
2782                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2783         }
2784
2785         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2786             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2787                 /* We are already associated with the selected network */
2788                 wpa_printf(MSG_DEBUG, "Already associated with the "
2789                            "selected network - do nothing");
2790                 return;
2791         }
2792
2793         if (ssid) {
2794                 wpa_s->current_ssid = ssid;
2795                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2796                 wpa_s->connect_without_scan =
2797                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2798
2799                 /*
2800                  * Don't optimize next scan freqs since a new ESS has been
2801                  * selected.
2802                  */
2803                 os_free(wpa_s->next_scan_freqs);
2804                 wpa_s->next_scan_freqs = NULL;
2805         } else {
2806                 wpa_s->connect_without_scan = NULL;
2807         }
2808
2809         wpa_s->disconnected = 0;
2810         wpa_s->reassociate = 1;
2811
2812         if (wpa_s->connect_without_scan ||
2813             wpa_supplicant_fast_associate(wpa_s) != 1) {
2814                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2815                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2816         }
2817
2818         if (ssid)
2819                 wpas_notify_network_selected(wpa_s, ssid);
2820 }
2821
2822
2823 /**
2824  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2825  * @wpa_s: wpa_supplicant structure for a network interface
2826  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2827  * @pkcs11_module_path: PKCS #11 module path or NULL
2828  * Returns: 0 on success; -1 on failure
2829  *
2830  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2831  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2832  * module path fails the paths will be reset to the default value (NULL).
2833  */
2834 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2835                                            const char *pkcs11_engine_path,
2836                                            const char *pkcs11_module_path)
2837 {
2838         char *pkcs11_engine_path_copy = NULL;
2839         char *pkcs11_module_path_copy = NULL;
2840
2841         if (pkcs11_engine_path != NULL) {
2842                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2843                 if (pkcs11_engine_path_copy == NULL)
2844                         return -1;
2845         }
2846         if (pkcs11_module_path != NULL) {
2847                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2848                 if (pkcs11_module_path_copy == NULL) {
2849                         os_free(pkcs11_engine_path_copy);
2850                         return -1;
2851                 }
2852         }
2853
2854         os_free(wpa_s->conf->pkcs11_engine_path);
2855         os_free(wpa_s->conf->pkcs11_module_path);
2856         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2857         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2858
2859         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2860         eapol_sm_deinit(wpa_s->eapol);
2861         wpa_s->eapol = NULL;
2862         if (wpa_supplicant_init_eapol(wpa_s)) {
2863                 /* Error -> Reset paths to the default value (NULL) once. */
2864                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2865                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2866                                                                NULL);
2867
2868                 return -1;
2869         }
2870         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2871
2872         return 0;
2873 }
2874
2875
2876 /**
2877  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2878  * @wpa_s: wpa_supplicant structure for a network interface
2879  * @ap_scan: AP scan mode
2880  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2881  *
2882  */
2883 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2884 {
2885
2886         int old_ap_scan;
2887
2888         if (ap_scan < 0 || ap_scan > 2)
2889                 return -1;
2890
2891         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2892                 wpa_printf(MSG_INFO,
2893                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2894         }
2895
2896 #ifdef ANDROID
2897         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2898             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2899             wpa_s->wpa_state < WPA_COMPLETED) {
2900                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2901                            "associating", wpa_s->conf->ap_scan, ap_scan);
2902                 return 0;
2903         }
2904 #endif /* ANDROID */
2905
2906         old_ap_scan = wpa_s->conf->ap_scan;
2907         wpa_s->conf->ap_scan = ap_scan;
2908
2909         if (old_ap_scan != wpa_s->conf->ap_scan)
2910                 wpas_notify_ap_scan_changed(wpa_s);
2911
2912         return 0;
2913 }
2914
2915
2916 /**
2917  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2918  * @wpa_s: wpa_supplicant structure for a network interface
2919  * @expire_age: Expiration age in seconds
2920  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2921  *
2922  */
2923 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2924                                           unsigned int bss_expire_age)
2925 {
2926         if (bss_expire_age < 10) {
2927                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2928                         bss_expire_age);
2929                 return -1;
2930         }
2931         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2932                 bss_expire_age);
2933         wpa_s->conf->bss_expiration_age = bss_expire_age;
2934
2935         return 0;
2936 }
2937
2938
2939 /**
2940  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2941  * @wpa_s: wpa_supplicant structure for a network interface
2942  * @expire_count: number of scans after which an unseen BSS is reclaimed
2943  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2944  *
2945  */
2946 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2947                                             unsigned int bss_expire_count)
2948 {
2949         if (bss_expire_count < 1) {
2950                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2951                         bss_expire_count);
2952                 return -1;
2953         }
2954         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2955                 bss_expire_count);
2956         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2957
2958         return 0;
2959 }
2960
2961
2962 /**
2963  * wpa_supplicant_set_scan_interval - Set scan interval
2964  * @wpa_s: wpa_supplicant structure for a network interface
2965  * @scan_interval: scan interval in seconds
2966  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2967  *
2968  */
2969 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2970                                      int scan_interval)
2971 {
2972         if (scan_interval < 0) {
2973                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2974                         scan_interval);
2975                 return -1;
2976         }
2977         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2978                 scan_interval);
2979         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2980
2981         return 0;
2982 }
2983
2984
2985 /**
2986  * wpa_supplicant_set_debug_params - Set global debug params
2987  * @global: wpa_global structure
2988  * @debug_level: debug level
2989  * @debug_timestamp: determines if show timestamp in debug data
2990  * @debug_show_keys: determines if show keys in debug data
2991  * Returns: 0 if succeed or -1 if debug_level has wrong value
2992  */
2993 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2994                                     int debug_timestamp, int debug_show_keys)
2995 {
2996
2997         int old_level, old_timestamp, old_show_keys;
2998
2999         /* check for allowed debuglevels */
3000         if (debug_level != MSG_EXCESSIVE &&
3001             debug_level != MSG_MSGDUMP &&
3002             debug_level != MSG_DEBUG &&
3003             debug_level != MSG_INFO &&
3004             debug_level != MSG_WARNING &&
3005             debug_level != MSG_ERROR)
3006                 return -1;
3007
3008         old_level = wpa_debug_level;
3009         old_timestamp = wpa_debug_timestamp;
3010         old_show_keys = wpa_debug_show_keys;
3011
3012         wpa_debug_level = debug_level;
3013         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3014         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3015
3016         if (wpa_debug_level != old_level)
3017                 wpas_notify_debug_level_changed(global);
3018         if (wpa_debug_timestamp != old_timestamp)
3019                 wpas_notify_debug_timestamp_changed(global);
3020         if (wpa_debug_show_keys != old_show_keys)
3021                 wpas_notify_debug_show_keys_changed(global);
3022
3023         return 0;
3024 }
3025
3026
3027 /**
3028  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3029  * @wpa_s: Pointer to wpa_supplicant data
3030  * Returns: A pointer to the current network structure or %NULL on failure
3031  */
3032 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3033 {
3034         struct wpa_ssid *entry;
3035         u8 ssid[SSID_MAX_LEN];
3036         int res;
3037         size_t ssid_len;
3038         u8 bssid[ETH_ALEN];
3039         int wired;
3040
3041         res = wpa_drv_get_ssid(wpa_s, ssid);
3042         if (res < 0) {
3043                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3044                         "driver");
3045                 return NULL;
3046         }
3047         ssid_len = res;
3048
3049         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3050                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3051                         "driver");
3052                 return NULL;
3053         }
3054
3055         wired = wpa_s->conf->ap_scan == 0 &&
3056                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3057
3058         entry = wpa_s->conf->ssid;
3059         while (entry) {
3060                 if (!wpas_network_disabled(wpa_s, entry) &&
3061                     ((ssid_len == entry->ssid_len &&
3062                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3063                     (!entry->bssid_set ||
3064                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3065                         return entry;
3066 #ifdef CONFIG_WPS
3067                 if (!wpas_network_disabled(wpa_s, entry) &&
3068                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3069                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3070                     (!entry->bssid_set ||
3071                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3072                         return entry;
3073 #endif /* CONFIG_WPS */
3074
3075                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3076                     entry->ssid_len == 0 &&
3077                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3078                         return entry;
3079
3080                 entry = entry->next;
3081         }
3082
3083         return NULL;
3084 }
3085
3086
3087 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3088 {
3089         struct wpa_global *global = wpa_s->global;
3090
3091         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3092                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3093                 if (global->drv_priv[i] == NULL) {
3094                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3095                                    "'%s'", wpa_drivers[i]->name);
3096                         return -1;
3097                 }
3098         }
3099
3100         wpa_s->driver = wpa_drivers[i];
3101         wpa_s->global_drv_priv = global->drv_priv[i];
3102
3103         return 0;
3104 }
3105
3106
3107 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3108                                      const char *name)
3109 {
3110         int i;
3111         size_t len;
3112         const char *pos, *driver = name;
3113
3114         if (wpa_s == NULL)
3115                 return -1;
3116
3117         if (wpa_drivers[0] == NULL) {
3118                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3119                         "wpa_supplicant");
3120                 return -1;
3121         }
3122
3123         if (name == NULL) {
3124                 /* default to first driver in the list */
3125                 return select_driver(wpa_s, 0);
3126         }
3127
3128         do {
3129                 pos = os_strchr(driver, ',');
3130                 if (pos)
3131                         len = pos - driver;
3132                 else
3133                         len = os_strlen(driver);
3134
3135                 for (i = 0; wpa_drivers[i]; i++) {
3136                         if (os_strlen(wpa_drivers[i]->name) == len &&
3137                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3138                             0) {
3139                                 /* First driver that succeeds wins */
3140                                 if (select_driver(wpa_s, i) == 0)
3141                                         return 0;
3142                         }
3143                 }
3144
3145                 driver = pos + 1;
3146         } while (pos);
3147
3148         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3149         return -1;
3150 }
3151
3152
3153 /**
3154  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3155  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3156  *      with struct wpa_driver_ops::init()
3157  * @src_addr: Source address of the EAPOL frame
3158  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3159  * @len: Length of the EAPOL data
3160  *
3161  * This function is called for each received EAPOL frame. Most driver
3162  * interfaces rely on more generic OS mechanism for receiving frames through
3163  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3164  * take care of received EAPOL frames and deliver them to the core supplicant
3165  * code by calling this function.
3166  */
3167 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3168                              const u8 *buf, size_t len)
3169 {
3170         struct wpa_supplicant *wpa_s = ctx;
3171
3172         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3173         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3174
3175 #ifdef CONFIG_PEERKEY
3176         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3177             wpa_s->current_ssid->peerkey &&
3178             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3179             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3180                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3181                 return;
3182         }
3183 #endif /* CONFIG_PEERKEY */
3184
3185         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3186             (wpa_s->last_eapol_matches_bssid &&
3187 #ifdef CONFIG_AP
3188              !wpa_s->ap_iface &&
3189 #endif /* CONFIG_AP */
3190              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3191                 /*
3192                  * There is possible race condition between receiving the
3193                  * association event and the EAPOL frame since they are coming
3194                  * through different paths from the driver. In order to avoid
3195                  * issues in trying to process the EAPOL frame before receiving
3196                  * association information, lets queue it for processing until
3197                  * the association event is received. This may also be needed in
3198                  * driver-based roaming case, so also use src_addr != BSSID as a
3199                  * trigger if we have previously confirmed that the
3200                  * Authenticator uses BSSID as the src_addr (which is not the
3201                  * case with wired IEEE 802.1X).
3202                  */
3203                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3204                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3205                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3206                         MAC2STR(wpa_s->bssid));
3207                 wpabuf_free(wpa_s->pending_eapol_rx);
3208                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3209                 if (wpa_s->pending_eapol_rx) {
3210                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3211                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3212                                   ETH_ALEN);
3213                 }
3214                 return;
3215         }
3216
3217         wpa_s->last_eapol_matches_bssid =
3218                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3219
3220 #ifdef CONFIG_AP
3221         if (wpa_s->ap_iface) {
3222                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3223                 return;
3224         }
3225 #endif /* CONFIG_AP */
3226
3227         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3228                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3229                         "no key management is configured");
3230                 return;
3231         }
3232
3233         if (wpa_s->eapol_received == 0 &&
3234             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3235              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3236              wpa_s->wpa_state != WPA_COMPLETED) &&
3237             (wpa_s->current_ssid == NULL ||
3238              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3239                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3240                 int timeout = 10;
3241
3242                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3243                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3244                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3245                         /* Use longer timeout for IEEE 802.1X/EAP */
3246                         timeout = 70;
3247                 }
3248
3249 #ifdef CONFIG_WPS
3250                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3251                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3252                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3253                         /*
3254                          * Use shorter timeout if going through WPS AP iteration
3255                          * for PIN config method with an AP that does not
3256                          * advertise Selected Registrar.
3257                          */
3258                         struct wpabuf *wps_ie;
3259
3260                         wps_ie = wpa_bss_get_vendor_ie_multi(
3261                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3262                         if (wps_ie &&
3263                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3264                                 timeout = 10;
3265                         wpabuf_free(wps_ie);
3266                 }
3267 #endif /* CONFIG_WPS */
3268
3269                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3270         }
3271         wpa_s->eapol_received++;
3272
3273         if (wpa_s->countermeasures) {
3274                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3275                         "EAPOL packet");
3276                 return;
3277         }
3278
3279 #ifdef CONFIG_IBSS_RSN
3280         if (wpa_s->current_ssid &&
3281             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3282                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3283                 return;
3284         }
3285 #endif /* CONFIG_IBSS_RSN */
3286
3287         /* Source address of the incoming EAPOL frame could be compared to the
3288          * current BSSID. However, it is possible that a centralized
3289          * Authenticator could be using another MAC address than the BSSID of
3290          * an AP, so just allow any address to be used for now. The replies are
3291          * still sent to the current BSSID (if available), though. */
3292
3293         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3294         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3295             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3296                 return;
3297         wpa_drv_poll(wpa_s);
3298         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3299                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3300         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3301                 /*
3302                  * Set portValid = TRUE here since we are going to skip 4-way
3303                  * handshake processing which would normally set portValid. We
3304                  * need this to allow the EAPOL state machines to be completed
3305                  * without going through EAPOL-Key handshake.
3306                  */
3307                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3308         }
3309 }
3310
3311
3312 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3313 {
3314         if ((!wpa_s->p2p_mgmt ||
3315              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3316             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3317                 l2_packet_deinit(wpa_s->l2);
3318                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3319                                            wpa_drv_get_mac_addr(wpa_s),
3320                                            ETH_P_EAPOL,
3321                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3322                 if (wpa_s->l2 == NULL)
3323                         return -1;
3324         } else {
3325                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3326                 if (addr)
3327                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3328         }
3329
3330         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3331                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3332                 return -1;
3333         }
3334
3335         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3336
3337         return 0;
3338 }
3339
3340
3341 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3342                                            const u8 *buf, size_t len)
3343 {
3344         struct wpa_supplicant *wpa_s = ctx;
3345         const struct l2_ethhdr *eth;
3346
3347         if (len < sizeof(*eth))
3348                 return;
3349         eth = (const struct l2_ethhdr *) buf;
3350
3351         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3352             !(eth->h_dest[0] & 0x01)) {
3353                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3354                         " (bridge - not for this interface - ignore)",
3355                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3356                 return;
3357         }
3358
3359         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3360                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3361         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3362                                 len - sizeof(*eth));
3363 }
3364
3365
3366 /**
3367  * wpa_supplicant_driver_init - Initialize driver interface parameters
3368  * @wpa_s: Pointer to wpa_supplicant data
3369  * Returns: 0 on success, -1 on failure
3370  *
3371  * This function is called to initialize driver interface parameters.
3372  * wpa_drv_init() must have been called before this function to initialize the
3373  * driver interface.
3374  */
3375 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3376 {
3377         static int interface_count = 0;
3378
3379         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3380                 return -1;
3381
3382         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3383                 MAC2STR(wpa_s->own_addr));
3384         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3385         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3386
3387         if (wpa_s->bridge_ifname[0]) {
3388                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3389                         "interface '%s'", wpa_s->bridge_ifname);
3390                 wpa_s->l2_br = l2_packet_init_bridge(
3391                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3392                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3393                 if (wpa_s->l2_br == NULL) {
3394                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3395                                 "connection for the bridge interface '%s'",
3396                                 wpa_s->bridge_ifname);
3397                         return -1;
3398                 }
3399         }
3400
3401         if (wpa_s->conf->ap_scan == 2 &&
3402             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3403                 wpa_printf(MSG_INFO,
3404                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3405         }
3406
3407         wpa_clear_keys(wpa_s, NULL);
3408
3409         /* Make sure that TKIP countermeasures are not left enabled (could
3410          * happen if wpa_supplicant is killed during countermeasures. */
3411         wpa_drv_set_countermeasures(wpa_s, 0);
3412
3413         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3414         wpa_drv_flush_pmkid(wpa_s);
3415
3416         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3417         wpa_s->prev_scan_wildcard = 0;
3418
3419         if (wpa_supplicant_enabled_networks(wpa_s)) {
3420                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3421                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3422                         interface_count = 0;
3423                 }
3424 #ifndef ANDROID
3425                 if (!wpa_s->p2p_mgmt &&
3426                     wpa_supplicant_delayed_sched_scan(wpa_s,
3427                                                       interface_count % 3,
3428                                                       100000))
3429                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3430                                                 100000);
3431 #endif /* ANDROID */
3432                 interface_count++;
3433         } else
3434                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3435
3436         return 0;
3437 }
3438
3439
3440 static int wpa_supplicant_daemon(const char *pid_file)
3441 {
3442         wpa_printf(MSG_DEBUG, "Daemonize..");
3443         return os_daemonize(pid_file);
3444 }
3445
3446
3447 static struct wpa_supplicant *
3448 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3449 {
3450         struct wpa_supplicant *wpa_s;
3451
3452         wpa_s = os_zalloc(sizeof(*wpa_s));
3453         if (wpa_s == NULL)
3454                 return NULL;
3455         wpa_s->scan_req = INITIAL_SCAN_REQ;
3456         wpa_s->scan_interval = 5;
3457         wpa_s->new_connection = 1;
3458         wpa_s->parent = parent ? parent : wpa_s;
3459         wpa_s->sched_scanning = 0;
3460
3461         return wpa_s;
3462 }
3463
3464
3465 #ifdef CONFIG_HT_OVERRIDES
3466
3467 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3468                              struct ieee80211_ht_capabilities *htcaps,
3469                              struct ieee80211_ht_capabilities *htcaps_mask,
3470                              const char *ht_mcs)
3471 {
3472         /* parse ht_mcs into hex array */
3473         int i;
3474         const char *tmp = ht_mcs;
3475         char *end = NULL;
3476
3477         /* If ht_mcs is null, do not set anything */
3478         if (!ht_mcs)
3479                 return 0;
3480
3481         /* This is what we are setting in the kernel */
3482         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3483
3484         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3485
3486         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3487                 errno = 0;
3488                 long v = strtol(tmp, &end, 16);
3489                 if (errno == 0) {
3490                         wpa_msg(wpa_s, MSG_DEBUG,
3491                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3492                                 i, v, end, tmp);
3493                         if (end == tmp)
3494                                 break;
3495
3496                         htcaps->supported_mcs_set[i] = v;
3497                         tmp = end;
3498                 } else {
3499                         wpa_msg(wpa_s, MSG_ERROR,
3500                                 "Failed to parse ht-mcs: %s, error: %s\n",
3501                                 ht_mcs, strerror(errno));
3502                         return -1;
3503                 }
3504         }
3505
3506         /*
3507          * If we were able to parse any values, then set mask for the MCS set.
3508          */
3509         if (i) {
3510                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3511                           IEEE80211_HT_MCS_MASK_LEN - 1);
3512                 /* skip the 3 reserved bits */
3513                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3514                         0x1f;
3515         }
3516
3517         return 0;
3518 }
3519
3520
3521 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3522                                  struct ieee80211_ht_capabilities *htcaps,
3523                                  struct ieee80211_ht_capabilities *htcaps_mask,
3524                                  int disabled)
3525 {
3526         le16 msk;
3527
3528         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3529
3530         if (disabled == -1)
3531                 return 0;
3532
3533         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3534         htcaps_mask->ht_capabilities_info |= msk;
3535         if (disabled)
3536                 htcaps->ht_capabilities_info &= msk;
3537         else
3538                 htcaps->ht_capabilities_info |= msk;
3539
3540         return 0;
3541 }
3542
3543
3544 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3545                                 struct ieee80211_ht_capabilities *htcaps,
3546                                 struct ieee80211_ht_capabilities *htcaps_mask,
3547                                 int factor)
3548 {
3549         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3550
3551         if (factor == -1)
3552                 return 0;
3553
3554         if (factor < 0 || factor > 3) {
3555                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3556                         "Must be 0-3 or -1", factor);
3557                 return -EINVAL;
3558         }
3559
3560         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3561         htcaps->a_mpdu_params &= ~0x3;
3562         htcaps->a_mpdu_params |= factor & 0x3;
3563
3564         return 0;
3565 }
3566
3567
3568 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3569                                  struct ieee80211_ht_capabilities *htcaps,
3570                                  struct ieee80211_ht_capabilities *htcaps_mask,
3571                                  int density)
3572 {
3573         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3574
3575         if (density == -1)
3576                 return 0;
3577
3578         if (density < 0 || density > 7) {
3579                 wpa_msg(wpa_s, MSG_ERROR,
3580                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3581                         density);
3582                 return -EINVAL;
3583         }
3584
3585         htcaps_mask->a_mpdu_params |= 0x1C;
3586         htcaps->a_mpdu_params &= ~(0x1C);
3587         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3588
3589         return 0;
3590 }
3591
3592
3593 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3594                                 struct ieee80211_ht_capabilities *htcaps,
3595                                 struct ieee80211_ht_capabilities *htcaps_mask,
3596                                 int disabled)
3597 {
3598         /* Masking these out disables HT40 */
3599         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3600                                 HT_CAP_INFO_SHORT_GI40MHZ);
3601
3602         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3603
3604         if (disabled)
3605                 htcaps->ht_capabilities_info &= ~msk;
3606         else
3607                 htcaps->ht_capabilities_info |= msk;
3608
3609         htcaps_mask->ht_capabilities_info |= msk;
3610
3611         return 0;
3612 }
3613
3614
3615 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3616                                struct ieee80211_ht_capabilities *htcaps,
3617                                struct ieee80211_ht_capabilities *htcaps_mask,
3618                                int disabled)
3619 {
3620         /* Masking these out disables SGI */
3621         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3622                                 HT_CAP_INFO_SHORT_GI40MHZ);
3623
3624         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3625
3626         if (disabled)
3627                 htcaps->ht_capabilities_info &= ~msk;
3628         else
3629                 htcaps->ht_capabilities_info |= msk;
3630
3631         htcaps_mask->ht_capabilities_info |= msk;
3632
3633         return 0;
3634 }
3635
3636
3637 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3638                                struct ieee80211_ht_capabilities *htcaps,
3639                                struct ieee80211_ht_capabilities *htcaps_mask,
3640                                int disabled)
3641 {
3642         /* Masking these out disables LDPC */
3643         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3644
3645         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3646
3647         if (disabled)
3648                 htcaps->ht_capabilities_info &= ~msk;
3649         else
3650                 htcaps->ht_capabilities_info |= msk;
3651
3652         htcaps_mask->ht_capabilities_info |= msk;
3653
3654         return 0;
3655 }
3656
3657
3658 void wpa_supplicant_apply_ht_overrides(
3659         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3660         struct wpa_driver_associate_params *params)
3661 {
3662         struct ieee80211_ht_capabilities *htcaps;
3663         struct ieee80211_ht_capabilities *htcaps_mask;
3664
3665         if (!ssid)
3666                 return;
3667
3668         params->disable_ht = ssid->disable_ht;
3669         if (!params->htcaps || !params->htcaps_mask)
3670                 return;
3671
3672         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3673         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3674         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3675         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3676                               ssid->disable_max_amsdu);
3677         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3678         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3679         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3680         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3681         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3682
3683         if (ssid->ht40_intolerant) {
3684                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3685                 htcaps->ht_capabilities_info |= bit;
3686                 htcaps_mask->ht_capabilities_info |= bit;
3687         }
3688 }
3689
3690 #endif /* CONFIG_HT_OVERRIDES */
3691
3692
3693 #ifdef CONFIG_VHT_OVERRIDES
3694 void wpa_supplicant_apply_vht_overrides(
3695         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3696         struct wpa_driver_associate_params *params)
3697 {
3698         struct ieee80211_vht_capabilities *vhtcaps;
3699         struct ieee80211_vht_capabilities *vhtcaps_mask;
3700
3701         if (!ssid)
3702                 return;
3703
3704         params->disable_vht = ssid->disable_vht;
3705
3706         vhtcaps = (void *) params->vhtcaps;
3707         vhtcaps_mask = (void *) params->vhtcaps_mask;
3708
3709         if (!vhtcaps || !vhtcaps_mask)
3710                 return;
3711
3712         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3713         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3714
3715 #ifdef CONFIG_HT_OVERRIDES
3716         /* if max ampdu is <= 3, we have to make the HT cap the same */
3717         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3718                 int max_ampdu;
3719
3720                 max_ampdu = (ssid->vht_capa &
3721                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3722                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3723
3724                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3725                 wpa_set_ampdu_factor(wpa_s,
3726                                      (void *) params->htcaps,
3727                                      (void *) params->htcaps_mask,
3728                                      max_ampdu);
3729         }
3730 #endif /* CONFIG_HT_OVERRIDES */
3731
3732 #define OVERRIDE_MCS(i)                                                 \
3733         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3734                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3735                         3 << 2 * (i - 1);                               \
3736                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3737                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3738         }                                                               \
3739         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3740                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3741                         3 << 2 * (i - 1);                               \
3742                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3743                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3744         }
3745
3746         OVERRIDE_MCS(1);
3747         OVERRIDE_MCS(2);
3748         OVERRIDE_MCS(3);
3749         OVERRIDE_MCS(4);
3750         OVERRIDE_MCS(5);
3751         OVERRIDE_MCS(6);
3752         OVERRIDE_MCS(7);
3753         OVERRIDE_MCS(8);
3754 }
3755 #endif /* CONFIG_VHT_OVERRIDES */
3756
3757
3758 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3759 {
3760 #ifdef PCSC_FUNCS
3761         size_t len;
3762
3763         if (!wpa_s->conf->pcsc_reader)
3764                 return 0;
3765
3766         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3767         if (!wpa_s->scard)
3768                 return 1;
3769
3770         if (wpa_s->conf->pcsc_pin &&
3771             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3772                 scard_deinit(wpa_s->scard);
3773                 wpa_s->scard = NULL;
3774                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3775                 return -1;
3776         }
3777
3778         len = sizeof(wpa_s->imsi) - 1;
3779         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3780                 scard_deinit(wpa_s->scard);
3781                 wpa_s->scard = NULL;
3782                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3783                 return -1;
3784         }
3785         wpa_s->imsi[len] = '\0';
3786
3787         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3788
3789         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3790                    wpa_s->imsi, wpa_s->mnc_len);
3791
3792         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3793         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3794 #endif /* PCSC_FUNCS */
3795
3796         return 0;
3797 }
3798
3799
3800 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3801 {
3802         char *val, *pos;
3803
3804         ext_password_deinit(wpa_s->ext_pw);
3805         wpa_s->ext_pw = NULL;
3806         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3807
3808         if (!wpa_s->conf->ext_password_backend)
3809                 return 0;
3810
3811         val = os_strdup(wpa_s->conf->ext_password_backend);
3812         if (val == NULL)
3813                 return -1;
3814         pos = os_strchr(val, ':');
3815         if (pos)
3816                 *pos++ = '\0';
3817
3818         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3819
3820         wpa_s->ext_pw = ext_password_init(val, pos);
3821         os_free(val);
3822         if (wpa_s->ext_pw == NULL) {
3823                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3824                 return -1;
3825         }
3826         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3827
3828         return 0;
3829 }
3830
3831
3832 #ifdef CONFIG_FST
3833
3834 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3835 {
3836         struct wpa_supplicant *wpa_s = ctx;
3837
3838         return (is_zero_ether_addr(wpa_s->bssid) ||
3839                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3840 }
3841
3842
3843 static void wpas_fst_get_channel_info_cb(void *ctx,
3844                                          enum hostapd_hw_mode *hw_mode,
3845                                          u8 *channel)
3846 {
3847         struct wpa_supplicant *wpa_s = ctx;
3848
3849         if (wpa_s->current_bss) {
3850                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3851                                                   channel);
3852         } else if (wpa_s->hw.num_modes) {
3853                 *hw_mode = wpa_s->hw.modes[0].mode;
3854         } else {
3855                 WPA_ASSERT(0);
3856                 *hw_mode = 0;
3857         }
3858 }
3859
3860
3861 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3862 {
3863         struct wpa_supplicant *wpa_s = ctx;
3864
3865         *modes = wpa_s->hw.modes;
3866         return wpa_s->hw.num_modes;
3867 }
3868
3869
3870 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3871 {
3872         struct wpa_supplicant *wpa_s = ctx;
3873
3874         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3875         wpa_s->fst_ies = fst_ies;
3876 }
3877
3878
3879 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3880 {
3881         struct wpa_supplicant *wpa_s = ctx;
3882
3883         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3884         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3885                                           wpa_s->own_addr, wpa_s->bssid,
3886                                           wpabuf_head(data), wpabuf_len(data),
3887                                    0);
3888 }
3889
3890
3891 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3892 {
3893         struct wpa_supplicant *wpa_s = ctx;
3894
3895         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3896         return wpa_s->received_mb_ies;
3897 }
3898
3899
3900 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3901                                      const u8 *buf, size_t size)
3902 {
3903         struct wpa_supplicant *wpa_s = ctx;
3904         struct mb_ies_info info;
3905
3906         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3907
3908         if (!mb_ies_info_by_ies(&info, buf, size)) {
3909                 wpabuf_free(wpa_s->received_mb_ies);
3910                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3911         }
3912 }
3913
3914
3915 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3916                                    Boolean mb_only)
3917 {
3918         struct wpa_supplicant *wpa_s = ctx;
3919
3920         *get_ctx = NULL;
3921         if (!is_zero_ether_addr(wpa_s->bssid))
3922                 return (wpa_s->received_mb_ies || !mb_only) ?
3923                         wpa_s->bssid : NULL;
3924         return NULL;
3925 }
3926
3927
3928 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3929                                   Boolean mb_only)
3930 {
3931         return NULL;
3932 }
3933
3934 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3935                                        struct fst_wpa_obj *iface_obj)
3936 {
3937         iface_obj->ctx              = wpa_s;
3938         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3939         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3940         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3941         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3942         iface_obj->send_action      = wpas_fst_send_action_cb;
3943         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3944         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3945         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3946         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3947 }
3948 #endif /* CONFIG_FST */
3949
3950 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3951                                     const struct wpa_driver_capa *capa)
3952 {
3953         struct wowlan_triggers *triggers;
3954         int ret = 0;
3955
3956         if (!wpa_s->conf->wowlan_triggers)
3957                 return 0;
3958
3959         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3960         if (triggers) {
3961                 ret = wpa_drv_wowlan(wpa_s, triggers);
3962                 os_free(triggers);
3963         }
3964         return ret;
3965 }
3966
3967
3968 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3969 {
3970         if (freq < 3000)
3971                 return BAND_2_4_GHZ;
3972         if (freq > 50000)
3973                 return BAND_60_GHZ;
3974         return BAND_5_GHZ;
3975 }
3976
3977
3978 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3979                                    const int *freqs)
3980 {
3981         int i;
3982         unsigned int band = 0;
3983
3984         if (freqs) {
3985                 /* freqs are specified for the radio work */
3986                 for (i = 0; freqs[i]; i++)
3987                         band |= wpas_freq_to_band(freqs[i]);
3988         } else {
3989                 /*
3990                  * freqs are not specified, implies all
3991                  * the supported freqs by HW
3992                  */
3993                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3994                         if (wpa_s->hw.modes[i].num_channels != 0) {
3995                                 if (wpa_s->hw.modes[i].mode ==
3996                                     HOSTAPD_MODE_IEEE80211B ||
3997                                     wpa_s->hw.modes[i].mode ==
3998                                     HOSTAPD_MODE_IEEE80211G)
3999                                         band |= BAND_2_4_GHZ;
4000                                 else if (wpa_s->hw.modes[i].mode ==
4001                                          HOSTAPD_MODE_IEEE80211A)
4002                                         band |= BAND_5_GHZ;
4003                                 else if (wpa_s->hw.modes[i].mode ==
4004                                          HOSTAPD_MODE_IEEE80211AD)
4005                                         band |= BAND_60_GHZ;
4006                                 else if (wpa_s->hw.modes[i].mode ==
4007                                          HOSTAPD_MODE_IEEE80211ANY)
4008                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4009                                                 BAND_60_GHZ;
4010                         }
4011                 }
4012         }
4013
4014         return band;
4015 }
4016
4017
4018 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4019                                               const char *rn)
4020 {
4021         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4022         struct wpa_radio *radio;
4023
4024         while (rn && iface) {
4025                 radio = iface->radio;
4026                 if (radio && os_strcmp(rn, radio->name) == 0) {
4027                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4028                                    wpa_s->ifname, rn);
4029                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4030                         return radio;
4031                 }
4032
4033                 iface = iface->next;
4034         }
4035
4036         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4037                    wpa_s->ifname, rn ? rn : "N/A");
4038         radio = os_zalloc(sizeof(*radio));
4039         if (radio == NULL)
4040                 return NULL;
4041
4042         if (rn)
4043                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4044         dl_list_init(&radio->ifaces);
4045         dl_list_init(&radio->work);
4046         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4047
4048         return radio;
4049 }
4050
4051
4052 static void radio_work_free(struct wpa_radio_work *work)
4053 {
4054         if (work->wpa_s->scan_work == work) {
4055                 /* This should not really happen. */
4056                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4057                         work->type, work, work->started);
4058                 work->wpa_s->scan_work = NULL;
4059         }
4060
4061 #ifdef CONFIG_P2P
4062         if (work->wpa_s->p2p_scan_work == work) {
4063                 /* This should not really happen. */
4064                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4065                         work->type, work, work->started);
4066                 work->wpa_s->p2p_scan_work = NULL;
4067         }
4068 #endif /* CONFIG_P2P */
4069
4070         if (work->started) {
4071                 work->wpa_s->radio->num_active_works--;
4072                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4073                         "radio_work_free('%s'@%p: num_active_works --> %u",
4074                         work->type, work,
4075                         work->wpa_s->radio->num_active_works);
4076         }
4077
4078         dl_list_del(&work->list);
4079         os_free(work);
4080 }
4081
4082
4083 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4084 {
4085         struct wpa_radio_work *active_work = NULL;
4086         struct wpa_radio_work *tmp;
4087
4088         /* Get the active work to know the type and band. */
4089         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4090                 if (tmp->started) {
4091                         active_work = tmp;
4092                         break;
4093                 }
4094         }
4095
4096         if (!active_work) {
4097                 /* No active work, start one */
4098                 radio->num_active_works = 0;
4099                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4100                                  list) {
4101                         if (os_strcmp(tmp->type, "scan") == 0 &&
4102                             radio->external_scan_running &&
4103                             (((struct wpa_driver_scan_params *)
4104                               tmp->ctx)->only_new_results ||
4105                              tmp->wpa_s->clear_driver_scan_cache))
4106                                 continue;
4107                         return tmp;
4108                 }
4109                 return NULL;
4110         }
4111
4112         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4113             os_strcmp(active_work->type, "connect") == 0) {
4114                 /*
4115                  * If the active work is either connect or sme-connect,
4116                  * do not parallelize them with other radio works.
4117                  */
4118                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4119                         "Do not parallelize radio work with %s",
4120                         active_work->type);
4121                 return NULL;
4122         }
4123
4124         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4125                 if (tmp->started)
4126                         continue;
4127
4128                 /*
4129                  * If connect or sme-connect are enqueued, parallelize only
4130                  * those operations ahead of them in the queue.
4131                  */
4132                 if (os_strcmp(tmp->type, "connect") == 0 ||
4133                     os_strcmp(tmp->type, "sme-connect") == 0)
4134                         break;
4135
4136                 /*
4137                  * Check that the radio works are distinct and
4138                  * on different bands.
4139                  */
4140                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4141                     (active_work->bands != tmp->bands)) {
4142                         /*
4143                          * If a scan has to be scheduled through nl80211 scan
4144                          * interface and if an external scan is already running,
4145                          * do not schedule the scan since it is likely to get
4146                          * rejected by kernel.
4147                          */
4148                         if (os_strcmp(tmp->type, "scan") == 0 &&
4149                             radio->external_scan_running &&
4150                             (((struct wpa_driver_scan_params *)
4151                               tmp->ctx)->only_new_results ||
4152                              tmp->wpa_s->clear_driver_scan_cache))
4153                                 continue;
4154
4155                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4156                                 "active_work:%s new_work:%s",
4157                                 active_work->type, tmp->type);
4158                         return tmp;
4159                 }
4160         }
4161
4162         /* Did not find a radio work to schedule in parallel. */
4163         return NULL;
4164 }
4165
4166
4167 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4168 {
4169         struct wpa_radio *radio = eloop_ctx;
4170         struct wpa_radio_work *work;
4171         struct os_reltime now, diff;
4172         struct wpa_supplicant *wpa_s;
4173
4174         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4175         if (work == NULL) {
4176                 radio->num_active_works = 0;
4177                 return;
4178         }
4179
4180         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4181                               radio_list);
4182
4183         if (!(wpa_s &&
4184               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4185                 if (work->started)
4186                         return; /* already started and still in progress */
4187
4188                 if (wpa_s && wpa_s->radio->external_scan_running) {
4189                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4190                         return;
4191                 }
4192         } else {
4193                 work = NULL;
4194                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4195                         /* get the work to schedule next */
4196                         work = radio_work_get_next_work(radio);
4197                 }
4198                 if (!work)
4199                         return;
4200         }
4201
4202         wpa_s = work->wpa_s;
4203         os_get_reltime(&now);
4204         os_reltime_sub(&now, &work->time, &diff);
4205         wpa_dbg(wpa_s, MSG_DEBUG,
4206                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4207                 work->type, work, diff.sec, diff.usec);
4208         work->started = 1;
4209         work->time = now;
4210         radio->num_active_works++;
4211
4212         work->cb(work, 0);
4213
4214         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4215             radio->num_active_works < MAX_ACTIVE_WORKS)
4216                 radio_work_check_next(wpa_s);
4217 }
4218
4219
4220 /*
4221  * This function removes both started and pending radio works running on
4222  * the provided interface's radio.
4223  * Prior to the removal of the radio work, its callback (cb) is called with
4224  * deinit set to be 1. Each work's callback is responsible for clearing its
4225  * internal data and restoring to a correct state.
4226  * @wpa_s: wpa_supplicant data
4227  * @type: type of works to be removed
4228  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4229  * this interface's works.
4230  */
4231 void radio_remove_works(struct wpa_supplicant *wpa_s,
4232                         const char *type, int remove_all)
4233 {
4234         struct wpa_radio_work *work, *tmp;
4235         struct wpa_radio *radio = wpa_s->radio;
4236
4237         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4238                               list) {
4239                 if (type && os_strcmp(type, work->type) != 0)
4240                         continue;
4241
4242                 /* skip other ifaces' works */
4243                 if (!remove_all && work->wpa_s != wpa_s)
4244                         continue;
4245
4246                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4247                         work->type, work, work->started ? " (started)" : "");
4248                 work->cb(work, 1);
4249                 radio_work_free(work);
4250         }
4251
4252         /* in case we removed the started work */
4253         radio_work_check_next(wpa_s);
4254 }
4255
4256
4257 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4258 {
4259         struct wpa_radio *radio = wpa_s->radio;
4260
4261         if (!radio)
4262                 return;
4263
4264         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4265                    wpa_s->ifname, radio->name);
4266         dl_list_del(&wpa_s->radio_list);
4267         radio_remove_works(wpa_s, NULL, 0);
4268         wpa_s->radio = NULL;
4269         if (!dl_list_empty(&radio->ifaces))
4270                 return; /* Interfaces remain for this radio */
4271
4272         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4273         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4274         os_free(radio);
4275 }
4276
4277
4278 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4279 {
4280         struct wpa_radio *radio = wpa_s->radio;
4281
4282         if (dl_list_empty(&radio->work))
4283                 return;
4284         if (wpa_s->ext_work_in_progress) {
4285                 wpa_printf(MSG_DEBUG,
4286                            "External radio work in progress - delay start of pending item");
4287                 return;
4288         }
4289         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4290         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4291 }
4292
4293
4294 /**
4295  * radio_add_work - Add a radio work item
4296  * @wpa_s: Pointer to wpa_supplicant data
4297  * @freq: Frequency of the offchannel operation in MHz or 0
4298  * @type: Unique identifier for each type of work
4299  * @next: Force as the next work to be executed
4300  * @cb: Callback function for indicating when radio is available
4301  * @ctx: Context pointer for the work (work->ctx in cb())
4302  * Returns: 0 on success, -1 on failure
4303  *
4304  * This function is used to request time for an operation that requires
4305  * exclusive radio control. Once the radio is available, the registered callback
4306  * function will be called. radio_work_done() must be called once the exclusive
4307  * radio operation has been completed, so that the radio is freed for other
4308  * operations. The special case of deinit=1 is used to free the context data
4309  * during interface removal. That does not allow the callback function to start
4310  * the radio operation, i.e., it must free any resources allocated for the radio
4311  * work and return.
4312  *
4313  * The @freq parameter can be used to indicate a single channel on which the
4314  * offchannel operation will occur. This may allow multiple radio work
4315  * operations to be performed in parallel if they apply for the same channel.
4316  * Setting this to 0 indicates that the work item may use multiple channels or
4317  * requires exclusive control of the radio.
4318  */
4319 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4320                    const char *type, int next,
4321                    void (*cb)(struct wpa_radio_work *work, int deinit),
4322                    void *ctx)
4323 {
4324         struct wpa_radio *radio = wpa_s->radio;
4325         struct wpa_radio_work *work;
4326         int was_empty;
4327
4328         work = os_zalloc(sizeof(*work));
4329         if (work == NULL)
4330                 return -1;
4331         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4332         os_get_reltime(&work->time);
4333         work->freq = freq;
4334         work->type = type;
4335         work->wpa_s = wpa_s;
4336         work->cb = cb;
4337         work->ctx = ctx;
4338
4339         if (freq)
4340                 work->bands = wpas_freq_to_band(freq);
4341         else if (os_strcmp(type, "scan") == 0 ||
4342                  os_strcmp(type, "p2p-scan") == 0)
4343                 work->bands = wpas_get_bands(wpa_s,
4344                                              ((struct wpa_driver_scan_params *)
4345                                               ctx)->freqs);
4346         else
4347                 work->bands = wpas_get_bands(wpa_s, NULL);
4348
4349         was_empty = dl_list_empty(&wpa_s->radio->work);
4350         if (next)
4351                 dl_list_add(&wpa_s->radio->work, &work->list);
4352         else
4353                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4354         if (was_empty) {
4355                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4356                 radio_work_check_next(wpa_s);
4357         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4358                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4359                 wpa_dbg(wpa_s, MSG_DEBUG,
4360                         "Try to schedule a radio work (num_active_works=%u)",
4361                         radio->num_active_works);
4362                 radio_work_check_next(wpa_s);
4363         }
4364
4365         return 0;
4366 }
4367
4368
4369 /**
4370  * radio_work_done - Indicate that a radio work item has been completed
4371  * @work: Completed work
4372  *
4373  * This function is called once the callback function registered with
4374  * radio_add_work() has completed its work.
4375  */
4376 void radio_work_done(struct wpa_radio_work *work)
4377 {
4378         struct wpa_supplicant *wpa_s = work->wpa_s;
4379         struct os_reltime now, diff;
4380         unsigned int started = work->started;
4381
4382         os_get_reltime(&now);
4383         os_reltime_sub(&now, &work->time, &diff);
4384         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4385                 work->type, work, started ? "done" : "canceled",
4386                 diff.sec, diff.usec);
4387         radio_work_free(work);
4388         if (started)
4389                 radio_work_check_next(wpa_s);
4390 }
4391
4392
4393 struct wpa_radio_work *
4394 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4395 {
4396         struct wpa_radio_work *work;
4397         struct wpa_radio *radio = wpa_s->radio;
4398
4399         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4400                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4401                         return work;
4402         }
4403
4404         return NULL;
4405 }
4406
4407
4408 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4409                             struct wpa_interface *iface)
4410 {
4411         const char *ifname, *driver, *rn;
4412
4413         driver = iface->driver;
4414 next_driver:
4415         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4416                 return -1;
4417
4418         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4419         if (wpa_s->drv_priv == NULL) {
4420                 const char *pos;
4421                 pos = driver ? os_strchr(driver, ',') : NULL;
4422                 if (pos) {
4423                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4424                                 "driver interface - try next driver wrapper");
4425                         driver = pos + 1;
4426                         goto next_driver;
4427                 }
4428                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4429                         "interface");
4430                 return -1;
4431         }
4432         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4433                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4434                         "driver_param '%s'", wpa_s->conf->driver_param);
4435                 return -1;
4436         }
4437
4438         ifname = wpa_drv_get_ifname(wpa_s);
4439         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4440                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4441                         "interface name with '%s'", ifname);
4442                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4443         }
4444
4445         rn = wpa_driver_get_radio_name(wpa_s);
4446         if (rn && rn[0] == '\0')
4447                 rn = NULL;
4448
4449         wpa_s->radio = radio_add_interface(wpa_s, rn);
4450         if (wpa_s->radio == NULL)
4451                 return -1;
4452
4453         return 0;
4454 }
4455
4456
4457 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4458                                      struct wpa_interface *iface)
4459 {
4460         struct wpa_driver_capa capa;
4461         int capa_res;
4462
4463         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4464                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4465                    iface->confname ? iface->confname : "N/A",
4466                    iface->driver ? iface->driver : "default",
4467                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4468                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4469
4470         if (iface->confname) {
4471 #ifdef CONFIG_BACKEND_FILE
4472                 wpa_s->confname = os_rel2abs_path(iface->confname);
4473                 if (wpa_s->confname == NULL) {
4474                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4475                                    "for configuration file '%s'.",
4476                                    iface->confname);
4477                         return -1;
4478                 }
4479                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4480                            iface->confname, wpa_s->confname);
4481 #else /* CONFIG_BACKEND_FILE */
4482                 wpa_s->confname = os_strdup(iface->confname);
4483 #endif /* CONFIG_BACKEND_FILE */
4484                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4485                 if (wpa_s->conf == NULL) {
4486                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4487                                    "configuration '%s'.", wpa_s->confname);
4488                         return -1;
4489                 }
4490                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4491                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4492
4493                 /*
4494                  * Override ctrl_interface and driver_param if set on command
4495                  * line.
4496                  */
4497                 if (iface->ctrl_interface) {
4498                         os_free(wpa_s->conf->ctrl_interface);
4499                         wpa_s->conf->ctrl_interface =
4500                                 os_strdup(iface->ctrl_interface);
4501                 }
4502
4503                 if (iface->driver_param) {
4504                         os_free(wpa_s->conf->driver_param);
4505                         wpa_s->conf->driver_param =
4506                                 os_strdup(iface->driver_param);
4507                 }
4508
4509                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4510                         os_free(wpa_s->conf->ctrl_interface);
4511                         wpa_s->conf->ctrl_interface = NULL;
4512                 }
4513         } else
4514                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4515                                                      iface->driver_param);
4516
4517         if (wpa_s->conf == NULL) {
4518                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4519                 return -1;
4520         }
4521
4522         if (iface->ifname == NULL) {
4523                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4524                 return -1;
4525         }
4526         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4527                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4528                            iface->ifname);
4529                 return -1;
4530         }
4531         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4532
4533         if (iface->bridge_ifname) {
4534                 if (os_strlen(iface->bridge_ifname) >=
4535                     sizeof(wpa_s->bridge_ifname)) {
4536                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4537                                    "name '%s'.", iface->bridge_ifname);
4538                         return -1;
4539                 }
4540                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4541                            sizeof(wpa_s->bridge_ifname));
4542         }
4543
4544         /* RSNA Supplicant Key Management - INITIALIZE */
4545         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4546         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4547
4548         /* Initialize driver interface and register driver event handler before
4549          * L2 receive handler so that association events are processed before
4550          * EAPOL-Key packets if both become available for the same select()
4551          * call. */
4552         if (wpas_init_driver(wpa_s, iface) < 0)
4553                 return -1;
4554
4555         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4556                 return -1;
4557
4558         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4559                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4560                           NULL);
4561         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4562
4563         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4564             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4565                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4566                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4567                         "dot11RSNAConfigPMKLifetime");
4568                 return -1;
4569         }
4570
4571         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4572             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4573                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4574                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4575                         "dot11RSNAConfigPMKReauthThreshold");
4576                 return -1;
4577         }
4578
4579         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4580             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4581                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4582                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4583                         "dot11RSNAConfigSATimeout");
4584                 return -1;
4585         }
4586
4587         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4588                                                       &wpa_s->hw.num_modes,
4589                                                       &wpa_s->hw.flags);
4590         if (wpa_s->hw.modes) {
4591                 u16 i;
4592
4593                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4594                         if (wpa_s->hw.modes[i].vht_capab) {
4595                                 wpa_s->hw_capab = CAPAB_VHT;
4596                                 break;
4597                         }
4598
4599                         if (wpa_s->hw.modes[i].ht_capab &
4600                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4601                                 wpa_s->hw_capab = CAPAB_HT40;
4602                         else if (wpa_s->hw.modes[i].ht_capab &&
4603                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4604                                 wpa_s->hw_capab = CAPAB_HT;
4605                 }
4606         }
4607
4608         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4609         if (capa_res == 0) {
4610                 wpa_s->drv_capa_known = 1;
4611                 wpa_s->drv_flags = capa.flags;
4612                 wpa_s->drv_enc = capa.enc;
4613                 wpa_s->drv_smps_modes = capa.smps_modes;
4614                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4615                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4616                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4617                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4618                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4619                 wpa_s->max_sched_scan_plan_interval =
4620                         capa.max_sched_scan_plan_interval;
4621                 wpa_s->max_sched_scan_plan_iterations =
4622                         capa.max_sched_scan_plan_iterations;
4623                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4624                 wpa_s->max_match_sets = capa.max_match_sets;
4625                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4626                 wpa_s->max_stations = capa.max_stations;
4627                 wpa_s->extended_capa = capa.extended_capa;
4628                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4629                 wpa_s->extended_capa_len = capa.extended_capa_len;
4630                 wpa_s->num_multichan_concurrent =
4631                         capa.num_multichan_concurrent;
4632                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4633
4634                 if (capa.mac_addr_rand_scan_supported)
4635                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4636                 if (wpa_s->sched_scan_supported &&
4637                     capa.mac_addr_rand_sched_scan_supported)
4638                         wpa_s->mac_addr_rand_supported |=
4639                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4640         }
4641         if (wpa_s->max_remain_on_chan == 0)
4642                 wpa_s->max_remain_on_chan = 1000;
4643
4644         /*
4645          * Only take p2p_mgmt parameters when P2P Device is supported.
4646          * Doing it here as it determines whether l2_packet_init() will be done
4647          * during wpa_supplicant_driver_init().
4648          */
4649         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4650                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4651         else
4652                 iface->p2p_mgmt = 1;
4653
4654         if (wpa_s->num_multichan_concurrent == 0)
4655                 wpa_s->num_multichan_concurrent = 1;
4656
4657         if (wpa_supplicant_driver_init(wpa_s) < 0)
4658                 return -1;
4659
4660 #ifdef CONFIG_TDLS
4661         if ((!iface->p2p_mgmt ||
4662              !(wpa_s->drv_flags &
4663                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4664             wpa_tdls_init(wpa_s->wpa))
4665                 return -1;
4666 #endif /* CONFIG_TDLS */
4667
4668         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4669             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4670                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4671                 return -1;
4672         }
4673
4674 #ifdef CONFIG_FST
4675         if (wpa_s->conf->fst_group_id) {
4676                 struct fst_iface_cfg cfg;
4677                 struct fst_wpa_obj iface_obj;
4678
4679                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4680                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4681                            sizeof(cfg.group_id));
4682                 cfg.priority = wpa_s->conf->fst_priority;
4683                 cfg.llt = wpa_s->conf->fst_llt;
4684
4685                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4686                                         &iface_obj, &cfg);
4687                 if (!wpa_s->fst) {
4688                         wpa_msg(wpa_s, MSG_ERROR,
4689                                 "FST: Cannot attach iface %s to group %s",
4690                                 wpa_s->ifname, cfg.group_id);
4691                         return -1;
4692                 }
4693         }
4694 #endif /* CONFIG_FST */
4695
4696         if (wpas_wps_init(wpa_s))
4697                 return -1;
4698
4699         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4700                 return -1;
4701         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4702
4703         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4704         if (wpa_s->ctrl_iface == NULL) {
4705                 wpa_printf(MSG_ERROR,
4706                            "Failed to initialize control interface '%s'.\n"
4707                            "You may have another wpa_supplicant process "
4708                            "already running or the file was\n"
4709                            "left by an unclean termination of wpa_supplicant "
4710                            "in which case you will need\n"
4711                            "to manually remove this file before starting "
4712                            "wpa_supplicant again.\n",
4713                            wpa_s->conf->ctrl_interface);
4714                 return -1;
4715         }
4716
4717         wpa_s->gas = gas_query_init(wpa_s);
4718         if (wpa_s->gas == NULL) {
4719                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4720                 return -1;
4721         }
4722
4723         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4724                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4725                 return -1;
4726         }
4727
4728         if (wpa_bss_init(wpa_s) < 0)
4729                 return -1;
4730
4731         /*
4732          * Set Wake-on-WLAN triggers, if configured.
4733          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4734          * have effect anyway when the interface is down).
4735          */
4736         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4737                 return -1;
4738
4739 #ifdef CONFIG_EAP_PROXY
4740 {
4741         size_t len;
4742         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4743                                                      &len);
4744         if (wpa_s->mnc_len > 0) {
4745                 wpa_s->imsi[len] = '\0';
4746                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4747                            wpa_s->imsi, wpa_s->mnc_len);
4748         } else {
4749                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4750         }
4751 }
4752 #endif /* CONFIG_EAP_PROXY */
4753
4754         if (pcsc_reader_init(wpa_s) < 0)
4755                 return -1;
4756
4757         if (wpas_init_ext_pw(wpa_s) < 0)
4758                 return -1;
4759
4760         wpas_rrm_reset(wpa_s);
4761
4762         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4763
4764 #ifdef CONFIG_HS20
4765         hs20_init(wpa_s);
4766 #endif /* CONFIG_HS20 */
4767
4768         return 0;
4769 }
4770
4771
4772 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4773                                         int notify, int terminate)
4774 {
4775         struct wpa_global *global = wpa_s->global;
4776         struct wpa_supplicant *iface, *prev;
4777
4778         if (wpa_s == wpa_s->parent)
4779                 wpas_p2p_group_remove(wpa_s, "*");
4780
4781         iface = global->ifaces;
4782         while (iface) {
4783                 if (iface == wpa_s || iface->parent != wpa_s) {
4784                         iface = iface->next;
4785                         continue;
4786                 }
4787                 wpa_printf(MSG_DEBUG,
4788                            "Remove remaining child interface %s from parent %s",
4789                            iface->ifname, wpa_s->ifname);
4790                 prev = iface;
4791                 iface = iface->next;
4792                 wpa_supplicant_remove_iface(global, prev, terminate);
4793         }
4794
4795         wpa_s->disconnected = 1;
4796         if (wpa_s->drv_priv) {
4797                 wpa_supplicant_deauthenticate(wpa_s,
4798                                               WLAN_REASON_DEAUTH_LEAVING);
4799
4800                 wpa_drv_set_countermeasures(wpa_s, 0);
4801                 wpa_clear_keys(wpa_s, NULL);
4802         }
4803
4804         wpa_supplicant_cleanup(wpa_s);
4805         wpas_p2p_deinit_iface(wpa_s);
4806
4807         wpas_ctrl_radio_work_flush(wpa_s);
4808         radio_remove_interface(wpa_s);
4809
4810 #ifdef CONFIG_FST
4811         if (wpa_s->fst) {
4812                 fst_detach(wpa_s->fst);
4813                 wpa_s->fst = NULL;
4814         }
4815         if (wpa_s->received_mb_ies) {
4816                 wpabuf_free(wpa_s->received_mb_ies);
4817                 wpa_s->received_mb_ies = NULL;
4818         }
4819 #endif /* CONFIG_FST */
4820
4821         if (wpa_s->drv_priv)
4822                 wpa_drv_deinit(wpa_s);
4823
4824         if (notify)
4825                 wpas_notify_iface_removed(wpa_s);
4826
4827         if (terminate)
4828                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4829
4830         if (wpa_s->ctrl_iface) {
4831                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4832                 wpa_s->ctrl_iface = NULL;
4833         }
4834
4835 #ifdef CONFIG_MESH
4836         if (wpa_s->ifmsh) {
4837                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4838                 wpa_s->ifmsh = NULL;
4839         }
4840 #endif /* CONFIG_MESH */
4841
4842         if (wpa_s->conf != NULL) {
4843                 wpa_config_free(wpa_s->conf);
4844                 wpa_s->conf = NULL;
4845         }
4846
4847         os_free(wpa_s->ssids_from_scan_req);
4848
4849         os_free(wpa_s);
4850 }
4851
4852
4853 /**
4854  * wpa_supplicant_add_iface - Add a new network interface
4855  * @global: Pointer to global data from wpa_supplicant_init()
4856  * @iface: Interface configuration options
4857  * @parent: Parent interface or %NULL to assign new interface as parent
4858  * Returns: Pointer to the created interface or %NULL on failure
4859  *
4860  * This function is used to add new network interfaces for %wpa_supplicant.
4861  * This can be called before wpa_supplicant_run() to add interfaces before the
4862  * main event loop has been started. In addition, new interfaces can be added
4863  * dynamically while %wpa_supplicant is already running. This could happen,
4864  * e.g., when a hotplug network adapter is inserted.
4865  */
4866 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4867                                                  struct wpa_interface *iface,
4868                                                  struct wpa_supplicant *parent)
4869 {
4870         struct wpa_supplicant *wpa_s;
4871         struct wpa_interface t_iface;
4872         struct wpa_ssid *ssid;
4873
4874         if (global == NULL || iface == NULL)
4875                 return NULL;
4876
4877         wpa_s = wpa_supplicant_alloc(parent);
4878         if (wpa_s == NULL)
4879                 return NULL;
4880
4881         wpa_s->global = global;
4882
4883         t_iface = *iface;
4884         if (global->params.override_driver) {
4885                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4886                            "('%s' -> '%s')",
4887                            iface->driver, global->params.override_driver);
4888                 t_iface.driver = global->params.override_driver;
4889         }
4890         if (global->params.override_ctrl_interface) {
4891                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4892                            "ctrl_interface ('%s' -> '%s')",
4893                            iface->ctrl_interface,
4894                            global->params.override_ctrl_interface);
4895                 t_iface.ctrl_interface =
4896                         global->params.override_ctrl_interface;
4897         }
4898         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4899                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4900                            iface->ifname);
4901                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4902                 return NULL;
4903         }
4904
4905         if (iface->p2p_mgmt == 0) {
4906                 /* Notify the control interfaces about new iface */
4907                 if (wpas_notify_iface_added(wpa_s)) {
4908                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4909                         return NULL;
4910                 }
4911
4912                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4913                         wpas_notify_network_added(wpa_s, ssid);
4914         }
4915
4916         wpa_s->next = global->ifaces;
4917         global->ifaces = wpa_s;
4918
4919         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4920         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4921
4922 #ifdef CONFIG_P2P
4923         if (wpa_s->global->p2p == NULL &&
4924             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4925             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4926             wpas_p2p_add_p2pdev_interface(
4927                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4928                 wpa_printf(MSG_INFO,
4929                            "P2P: Failed to enable P2P Device interface");
4930                 /* Try to continue without. P2P will be disabled. */
4931         }
4932 #endif /* CONFIG_P2P */
4933
4934         return wpa_s;
4935 }
4936
4937
4938 /**
4939  * wpa_supplicant_remove_iface - Remove a network interface
4940  * @global: Pointer to global data from wpa_supplicant_init()
4941  * @wpa_s: Pointer to the network interface to be removed
4942  * Returns: 0 if interface was removed, -1 if interface was not found
4943  *
4944  * This function can be used to dynamically remove network interfaces from
4945  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4946  * addition, this function is used to remove all remaining interfaces when
4947  * %wpa_supplicant is terminated.
4948  */
4949 int wpa_supplicant_remove_iface(struct wpa_global *global,
4950                                 struct wpa_supplicant *wpa_s,
4951                                 int terminate)
4952 {
4953         struct wpa_supplicant *prev;
4954 #ifdef CONFIG_MESH
4955         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4956         char *ifname = NULL;
4957 #endif /* CONFIG_MESH */
4958
4959         /* Remove interface from the global list of interfaces */
4960         prev = global->ifaces;
4961         if (prev == wpa_s) {
4962                 global->ifaces = wpa_s->next;
4963         } else {
4964                 while (prev && prev->next != wpa_s)
4965                         prev = prev->next;
4966                 if (prev == NULL)
4967                         return -1;
4968                 prev->next = wpa_s->next;
4969         }
4970
4971         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4972
4973 #ifdef CONFIG_MESH
4974         if (mesh_if_created) {
4975                 ifname = os_strdup(wpa_s->ifname);
4976                 if (ifname == NULL) {
4977                         wpa_dbg(wpa_s, MSG_ERROR,
4978                                 "mesh: Failed to malloc ifname");
4979                         return -1;
4980                 }
4981         }
4982 #endif /* CONFIG_MESH */
4983
4984         if (global->p2p_group_formation == wpa_s)
4985                 global->p2p_group_formation = NULL;
4986         if (global->p2p_invite_group == wpa_s)
4987                 global->p2p_invite_group = NULL;
4988         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4989
4990 #ifdef CONFIG_MESH
4991         if (mesh_if_created) {
4992                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4993                 os_free(ifname);
4994         }
4995 #endif /* CONFIG_MESH */
4996
4997         return 0;
4998 }
4999
5000
5001 /**
5002  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5003  * @wpa_s: Pointer to the network interface
5004  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5005  */
5006 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5007 {
5008         const char *eapol_method;
5009
5010         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5011             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5012                 return "NO-EAP";
5013         }
5014
5015         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5016         if (eapol_method == NULL)
5017                 return "UNKNOWN-EAP";
5018
5019         return eapol_method;
5020 }
5021
5022
5023 /**
5024  * wpa_supplicant_get_iface - Get a new network interface
5025  * @global: Pointer to global data from wpa_supplicant_init()
5026  * @ifname: Interface name
5027  * Returns: Pointer to the interface or %NULL if not found
5028  */
5029 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5030                                                  const char *ifname)
5031 {
5032         struct wpa_supplicant *wpa_s;
5033
5034         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5035                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5036                         return wpa_s;
5037         }
5038         return NULL;
5039 }
5040
5041
5042 #ifndef CONFIG_NO_WPA_MSG
5043 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5044 {
5045         struct wpa_supplicant *wpa_s = ctx;
5046         if (wpa_s == NULL)
5047                 return NULL;
5048         return wpa_s->ifname;
5049 }
5050 #endif /* CONFIG_NO_WPA_MSG */
5051
5052
5053 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5054 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5055 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5056
5057 /* Periodic cleanup tasks */
5058 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5059 {
5060         struct wpa_global *global = eloop_ctx;
5061         struct wpa_supplicant *wpa_s;
5062
5063         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5064                                wpas_periodic, global, NULL);
5065
5066 #ifdef CONFIG_P2P
5067         if (global->p2p)
5068                 p2p_expire_peers(global->p2p);
5069 #endif /* CONFIG_P2P */
5070
5071         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5072                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5073 #ifdef CONFIG_AP
5074                 ap_periodic(wpa_s);
5075 #endif /* CONFIG_AP */
5076         }
5077 }
5078
5079
5080 /**
5081  * wpa_supplicant_init - Initialize %wpa_supplicant
5082  * @params: Parameters for %wpa_supplicant
5083  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5084  *
5085  * This function is used to initialize %wpa_supplicant. After successful
5086  * initialization, the returned data pointer can be used to add and remove
5087  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5088  */
5089 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5090 {
5091         struct wpa_global *global;
5092         int ret, i;
5093
5094         if (params == NULL)
5095                 return NULL;
5096
5097 #ifdef CONFIG_DRIVER_NDIS
5098         {
5099                 void driver_ndis_init_ops(void);
5100                 driver_ndis_init_ops();
5101         }
5102 #endif /* CONFIG_DRIVER_NDIS */
5103
5104 #ifndef CONFIG_NO_WPA_MSG
5105         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5106 #endif /* CONFIG_NO_WPA_MSG */
5107
5108         if (params->wpa_debug_file_path)
5109                 wpa_debug_open_file(params->wpa_debug_file_path);
5110         else
5111                 wpa_debug_setup_stdout();
5112         if (params->wpa_debug_syslog)
5113                 wpa_debug_open_syslog();
5114         if (params->wpa_debug_tracing) {
5115                 ret = wpa_debug_open_linux_tracing();
5116                 if (ret) {
5117                         wpa_printf(MSG_ERROR,
5118                                    "Failed to enable trace logging");
5119                         return NULL;
5120                 }
5121         }
5122
5123         ret = eap_register_methods();
5124         if (ret) {
5125                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5126                 if (ret == -2)
5127                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5128                                    "the same EAP type.");
5129                 return NULL;
5130         }
5131
5132         global = os_zalloc(sizeof(*global));
5133         if (global == NULL)
5134                 return NULL;
5135         dl_list_init(&global->p2p_srv_bonjour);
5136         dl_list_init(&global->p2p_srv_upnp);
5137         global->params.daemonize = params->daemonize;
5138         global->params.wait_for_monitor = params->wait_for_monitor;
5139         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5140         if (params->pid_file)
5141                 global->params.pid_file = os_strdup(params->pid_file);
5142         if (params->ctrl_interface)
5143                 global->params.ctrl_interface =
5144                         os_strdup(params->ctrl_interface);
5145         if (params->ctrl_interface_group)
5146                 global->params.ctrl_interface_group =
5147                         os_strdup(params->ctrl_interface_group);
5148         if (params->override_driver)
5149                 global->params.override_driver =
5150                         os_strdup(params->override_driver);
5151         if (params->override_ctrl_interface)
5152                 global->params.override_ctrl_interface =
5153                         os_strdup(params->override_ctrl_interface);
5154 #ifdef CONFIG_P2P
5155         if (params->conf_p2p_dev)
5156                 global->params.conf_p2p_dev =
5157                         os_strdup(params->conf_p2p_dev);
5158 #endif /* CONFIG_P2P */
5159         wpa_debug_level = global->params.wpa_debug_level =
5160                 params->wpa_debug_level;
5161         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5162                 params->wpa_debug_show_keys;
5163         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5164                 params->wpa_debug_timestamp;
5165
5166         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5167
5168         if (eloop_init()) {
5169                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5170                 wpa_supplicant_deinit(global);
5171                 return NULL;
5172         }
5173
5174         random_init(params->entropy_file);
5175
5176         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5177         if (global->ctrl_iface == NULL) {
5178                 wpa_supplicant_deinit(global);
5179                 return NULL;
5180         }
5181
5182         if (wpas_notify_supplicant_initialized(global)) {
5183                 wpa_supplicant_deinit(global);
5184                 return NULL;
5185         }
5186
5187         for (i = 0; wpa_drivers[i]; i++)
5188                 global->drv_count++;
5189         if (global->drv_count == 0) {
5190                 wpa_printf(MSG_ERROR, "No drivers enabled");
5191                 wpa_supplicant_deinit(global);
5192                 return NULL;
5193         }
5194         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5195         if (global->drv_priv == NULL) {
5196                 wpa_supplicant_deinit(global);
5197                 return NULL;
5198         }
5199
5200 #ifdef CONFIG_WIFI_DISPLAY
5201         if (wifi_display_init(global) < 0) {
5202                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5203                 wpa_supplicant_deinit(global);
5204                 return NULL;
5205         }
5206 #endif /* CONFIG_WIFI_DISPLAY */
5207
5208         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5209                                wpas_periodic, global, NULL);
5210
5211         return global;
5212 }
5213
5214
5215 /**
5216  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5217  * @global: Pointer to global data from wpa_supplicant_init()
5218  * Returns: 0 after successful event loop run, -1 on failure
5219  *
5220  * This function starts the main event loop and continues running as long as
5221  * there are any remaining events. In most cases, this function is running as
5222  * long as the %wpa_supplicant process in still in use.
5223  */
5224 int wpa_supplicant_run(struct wpa_global *global)
5225 {
5226         struct wpa_supplicant *wpa_s;
5227
5228         if (global->params.daemonize &&
5229             (wpa_supplicant_daemon(global->params.pid_file) ||
5230              eloop_sock_requeue()))
5231                 return -1;
5232
5233         if (global->params.wait_for_monitor) {
5234                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5235                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5236                                 wpa_supplicant_ctrl_iface_wait(
5237                                         wpa_s->ctrl_iface);
5238         }
5239
5240         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5241         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5242
5243         eloop_run();
5244
5245         return 0;
5246 }
5247
5248
5249 /**
5250  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5251  * @global: Pointer to global data from wpa_supplicant_init()
5252  *
5253  * This function is called to deinitialize %wpa_supplicant and to free all
5254  * allocated resources. Remaining network interfaces will also be removed.
5255  */
5256 void wpa_supplicant_deinit(struct wpa_global *global)
5257 {
5258         int i;
5259
5260         if (global == NULL)
5261                 return;
5262
5263         eloop_cancel_timeout(wpas_periodic, global, NULL);
5264
5265 #ifdef CONFIG_WIFI_DISPLAY
5266         wifi_display_deinit(global);
5267 #endif /* CONFIG_WIFI_DISPLAY */
5268
5269         while (global->ifaces)
5270                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5271
5272         if (global->ctrl_iface)
5273                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5274
5275         wpas_notify_supplicant_deinitialized(global);
5276
5277         eap_peer_unregister_methods();
5278 #ifdef CONFIG_AP
5279         eap_server_unregister_methods();
5280 #endif /* CONFIG_AP */
5281
5282         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5283                 if (!global->drv_priv[i])
5284                         continue;
5285                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5286         }
5287         os_free(global->drv_priv);
5288
5289         random_deinit();
5290
5291         eloop_destroy();
5292
5293         if (global->params.pid_file) {
5294                 os_daemonize_terminate(global->params.pid_file);
5295                 os_free(global->params.pid_file);
5296         }
5297         os_free(global->params.ctrl_interface);
5298         os_free(global->params.ctrl_interface_group);
5299         os_free(global->params.override_driver);
5300         os_free(global->params.override_ctrl_interface);
5301 #ifdef CONFIG_P2P
5302         os_free(global->params.conf_p2p_dev);
5303 #endif /* CONFIG_P2P */
5304
5305         os_free(global->p2p_disallow_freq.range);
5306         os_free(global->p2p_go_avoid_freq.range);
5307         os_free(global->add_psk);
5308
5309         os_free(global);
5310         wpa_debug_close_syslog();
5311         wpa_debug_close_file();
5312         wpa_debug_close_linux_tracing();
5313 }
5314
5315
5316 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5317 {
5318         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5319             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5320                 char country[3];
5321                 country[0] = wpa_s->conf->country[0];
5322                 country[1] = wpa_s->conf->country[1];
5323                 country[2] = '\0';
5324                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5325                         wpa_printf(MSG_ERROR, "Failed to set country code "
5326                                    "'%s'", country);
5327                 }
5328         }
5329
5330         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5331                 wpas_init_ext_pw(wpa_s);
5332
5333         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5334                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5335
5336 #ifdef CONFIG_WPS
5337         wpas_wps_update_config(wpa_s);
5338 #endif /* CONFIG_WPS */
5339         wpas_p2p_update_config(wpa_s);
5340         wpa_s->conf->changed_parameters = 0;
5341 }
5342
5343
5344 void add_freq(int *freqs, int *num_freqs, int freq)
5345 {
5346         int i;
5347
5348         for (i = 0; i < *num_freqs; i++) {
5349                 if (freqs[i] == freq)
5350                         return;
5351         }
5352
5353         freqs[*num_freqs] = freq;
5354         (*num_freqs)++;
5355 }
5356
5357
5358 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5359 {
5360         struct wpa_bss *bss, *cbss;
5361         const int max_freqs = 10;
5362         int *freqs;
5363         int num_freqs = 0;
5364
5365         freqs = os_calloc(max_freqs + 1, sizeof(int));
5366         if (freqs == NULL)
5367                 return NULL;
5368
5369         cbss = wpa_s->current_bss;
5370
5371         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5372                 if (bss == cbss)
5373                         continue;
5374                 if (bss->ssid_len == cbss->ssid_len &&
5375                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5376                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5377                         add_freq(freqs, &num_freqs, bss->freq);
5378                         if (num_freqs == max_freqs)
5379                                 break;
5380                 }
5381         }
5382
5383         if (num_freqs == 0) {
5384                 os_free(freqs);
5385                 freqs = NULL;
5386         }
5387
5388         return freqs;
5389 }
5390
5391
5392 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5393 {
5394         int timeout;
5395         int count;
5396         int *freqs = NULL;
5397
5398         wpas_connect_work_done(wpa_s);
5399
5400         /*
5401          * Remove possible authentication timeout since the connection failed.
5402          */
5403         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5404
5405         /*
5406          * There is no point in blacklisting the AP if this event is
5407          * generated based on local request to disconnect.
5408          */
5409         if (wpa_s->own_disconnect_req) {
5410                 wpa_s->own_disconnect_req = 0;
5411                 wpa_dbg(wpa_s, MSG_DEBUG,
5412                         "Ignore connection failure due to local request to disconnect");
5413                 return;
5414         }
5415         if (wpa_s->disconnected) {
5416                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5417                         "indication since interface has been put into "
5418                         "disconnected state");
5419                 return;
5420         }
5421
5422         /*
5423          * Add the failed BSSID into the blacklist and speed up next scan
5424          * attempt if there could be other APs that could accept association.
5425          * The current blacklist count indicates how many times we have tried
5426          * connecting to this AP and multiple attempts mean that other APs are
5427          * either not available or has already been tried, so that we can start
5428          * increasing the delay here to avoid constant scanning.
5429          */
5430         count = wpa_blacklist_add(wpa_s, bssid);
5431         if (count == 1 && wpa_s->current_bss) {
5432                 /*
5433                  * This BSS was not in the blacklist before. If there is
5434                  * another BSS available for the same ESS, we should try that
5435                  * next. Otherwise, we may as well try this one once more
5436                  * before allowing other, likely worse, ESSes to be considered.
5437                  */
5438                 freqs = get_bss_freqs_in_ess(wpa_s);
5439                 if (freqs) {
5440                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5441                                 "has been seen; try it next");
5442                         wpa_blacklist_add(wpa_s, bssid);
5443                         /*
5444                          * On the next scan, go through only the known channels
5445                          * used in this ESS based on previous scans to speed up
5446                          * common load balancing use case.
5447                          */
5448                         os_free(wpa_s->next_scan_freqs);
5449                         wpa_s->next_scan_freqs = freqs;
5450                 }
5451         }
5452
5453         /*
5454          * Add previous failure count in case the temporary blacklist was
5455          * cleared due to no other BSSes being available.
5456          */
5457         count += wpa_s->extra_blacklist_count;
5458
5459         if (count > 3 && wpa_s->current_ssid) {
5460                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5461                            "consider temporary network disabling");
5462                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5463         }
5464
5465         switch (count) {
5466         case 1:
5467                 timeout = 100;
5468                 break;
5469         case 2:
5470                 timeout = 500;
5471                 break;
5472         case 3:
5473                 timeout = 1000;
5474                 break;
5475         case 4:
5476                 timeout = 5000;
5477                 break;
5478         default:
5479                 timeout = 10000;
5480                 break;
5481         }
5482
5483         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5484                 "ms", count, timeout);
5485
5486         /*
5487          * TODO: if more than one possible AP is available in scan results,
5488          * could try the other ones before requesting a new scan.
5489          */
5490         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5491                                 1000 * (timeout % 1000));
5492 }
5493
5494
5495 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5496 {
5497         return wpa_s->conf->ap_scan == 2 ||
5498                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5499 }
5500
5501
5502 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5503 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5504                                               struct wpa_ssid *ssid,
5505                                               const char *field,
5506                                               const char *value)
5507 {
5508 #ifdef IEEE8021X_EAPOL
5509         struct eap_peer_config *eap = &ssid->eap;
5510
5511         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5512         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5513                               (const u8 *) value, os_strlen(value));
5514
5515         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5516         case WPA_CTRL_REQ_EAP_IDENTITY:
5517                 os_free(eap->identity);
5518                 eap->identity = (u8 *) os_strdup(value);
5519                 eap->identity_len = os_strlen(value);
5520                 eap->pending_req_identity = 0;
5521                 if (ssid == wpa_s->current_ssid)
5522                         wpa_s->reassociate = 1;
5523                 break;
5524         case WPA_CTRL_REQ_EAP_PASSWORD:
5525                 bin_clear_free(eap->password, eap->password_len);
5526                 eap->password = (u8 *) os_strdup(value);
5527                 eap->password_len = os_strlen(value);
5528                 eap->pending_req_password = 0;
5529                 if (ssid == wpa_s->current_ssid)
5530                         wpa_s->reassociate = 1;
5531                 break;
5532         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5533                 bin_clear_free(eap->new_password, eap->new_password_len);
5534                 eap->new_password = (u8 *) os_strdup(value);
5535                 eap->new_password_len = os_strlen(value);
5536                 eap->pending_req_new_password = 0;
5537                 if (ssid == wpa_s->current_ssid)
5538                         wpa_s->reassociate = 1;
5539                 break;
5540         case WPA_CTRL_REQ_EAP_PIN:
5541                 str_clear_free(eap->pin);
5542                 eap->pin = os_strdup(value);
5543                 eap->pending_req_pin = 0;
5544                 if (ssid == wpa_s->current_ssid)
5545                         wpa_s->reassociate = 1;
5546                 break;
5547         case WPA_CTRL_REQ_EAP_OTP:
5548                 bin_clear_free(eap->otp, eap->otp_len);
5549                 eap->otp = (u8 *) os_strdup(value);
5550                 eap->otp_len = os_strlen(value);
5551                 os_free(eap->pending_req_otp);
5552                 eap->pending_req_otp = NULL;
5553                 eap->pending_req_otp_len = 0;
5554                 break;
5555         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5556                 str_clear_free(eap->private_key_passwd);
5557                 eap->private_key_passwd = os_strdup(value);
5558                 eap->pending_req_passphrase = 0;
5559                 if (ssid == wpa_s->current_ssid)
5560                         wpa_s->reassociate = 1;
5561                 break;
5562         case WPA_CTRL_REQ_SIM:
5563                 str_clear_free(eap->external_sim_resp);
5564                 eap->external_sim_resp = os_strdup(value);
5565                 break;
5566         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5567                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5568                         return -1;
5569                 ssid->mem_only_psk = 1;
5570                 if (ssid->passphrase)
5571                         wpa_config_update_psk(ssid);
5572                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5573                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5574                 break;
5575         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5576                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5577                         return -1;
5578                 if (os_strcmp(value, "good") == 0)
5579                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5580                 else if (os_strcmp(value, "bad") == 0)
5581                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5582                 else
5583                         return -1;
5584                 break;
5585         default:
5586                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5587                 return -1;
5588         }
5589
5590         return 0;
5591 #else /* IEEE8021X_EAPOL */
5592         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5593         return -1;
5594 #endif /* IEEE8021X_EAPOL */
5595 }
5596 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5597
5598
5599 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5600 {
5601         int i;
5602         unsigned int drv_enc;
5603
5604         if (wpa_s->p2p_mgmt)
5605                 return 1; /* no normal network profiles on p2p_mgmt interface */
5606
5607         if (ssid == NULL)
5608                 return 1;
5609
5610         if (ssid->disabled)
5611                 return 1;
5612
5613         if (wpa_s->drv_capa_known)
5614                 drv_enc = wpa_s->drv_enc;
5615         else
5616                 drv_enc = (unsigned int) -1;
5617
5618         for (i = 0; i < NUM_WEP_KEYS; i++) {
5619                 size_t len = ssid->wep_key_len[i];
5620                 if (len == 0)
5621                         continue;
5622                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5623                         continue;
5624                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5625                         continue;
5626                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5627                         continue;
5628                 return 1; /* invalid WEP key */
5629         }
5630
5631         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5632             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5633             !ssid->mem_only_psk)
5634                 return 1;
5635
5636         return 0;
5637 }
5638
5639
5640 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5641 {
5642 #ifdef CONFIG_IEEE80211W
5643         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5644                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5645                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5646                         /*
5647                          * Driver does not support BIP -- ignore pmf=1 default
5648                          * since the connection with PMF would fail and the
5649                          * configuration does not require PMF to be enabled.
5650                          */
5651                         return NO_MGMT_FRAME_PROTECTION;
5652                 }
5653
5654                 return wpa_s->conf->pmf;
5655         }
5656
5657         return ssid->ieee80211w;
5658 #else /* CONFIG_IEEE80211W */
5659         return NO_MGMT_FRAME_PROTECTION;
5660 #endif /* CONFIG_IEEE80211W */
5661 }
5662
5663
5664 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5665 {
5666         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5667                 return 1;
5668         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5669                 return 0;
5670         return -1;
5671 }
5672
5673
5674 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5675 {
5676         struct wpa_ssid *ssid = wpa_s->current_ssid;
5677         int dur;
5678         struct os_reltime now;
5679
5680         if (ssid == NULL) {
5681                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5682                            "SSID block");
5683                 return;
5684         }
5685
5686         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5687                 return;
5688
5689         ssid->auth_failures++;
5690
5691 #ifdef CONFIG_P2P
5692         if (ssid->p2p_group &&
5693             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5694                 /*
5695                  * Skip the wait time since there is a short timeout on the
5696                  * connection to a P2P group.
5697                  */
5698                 return;
5699         }
5700 #endif /* CONFIG_P2P */
5701
5702         if (ssid->auth_failures > 50)
5703                 dur = 300;
5704         else if (ssid->auth_failures > 10)
5705                 dur = 120;
5706         else if (ssid->auth_failures > 5)
5707                 dur = 90;
5708         else if (ssid->auth_failures > 3)
5709                 dur = 60;
5710         else if (ssid->auth_failures > 2)
5711                 dur = 30;
5712         else if (ssid->auth_failures > 1)
5713                 dur = 20;
5714         else
5715                 dur = 10;
5716
5717         if (ssid->auth_failures > 1 &&
5718             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5719                 dur += os_random() % (ssid->auth_failures * 10);
5720
5721         os_get_reltime(&now);
5722         if (now.sec + dur <= ssid->disabled_until.sec)
5723                 return;
5724
5725         ssid->disabled_until.sec = now.sec + dur;
5726
5727         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5728                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5729                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5730                 ssid->auth_failures, dur, reason);
5731 }
5732
5733
5734 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5735                               struct wpa_ssid *ssid, int clear_failures)
5736 {
5737         if (ssid == NULL)
5738                 return;
5739
5740         if (ssid->disabled_until.sec) {
5741                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5742                         "id=%d ssid=\"%s\"",
5743                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5744         }
5745         ssid->disabled_until.sec = 0;
5746         ssid->disabled_until.usec = 0;
5747         if (clear_failures)
5748                 ssid->auth_failures = 0;
5749 }
5750
5751
5752 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5753 {
5754         size_t i;
5755
5756         if (wpa_s->disallow_aps_bssid == NULL)
5757                 return 0;
5758
5759         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5760                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5761                               bssid, ETH_ALEN) == 0)
5762                         return 1;
5763         }
5764
5765         return 0;
5766 }
5767
5768
5769 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5770                     size_t ssid_len)
5771 {
5772         size_t i;
5773
5774         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5775                 return 0;
5776
5777         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5778                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5779                 if (ssid_len == s->ssid_len &&
5780                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5781                         return 1;
5782         }
5783
5784         return 0;
5785 }
5786
5787
5788 /**
5789  * wpas_request_connection - Request a new connection
5790  * @wpa_s: Pointer to the network interface
5791  *
5792  * This function is used to request a new connection to be found. It will mark
5793  * the interface to allow reassociation and request a new scan to find a
5794  * suitable network to connect to.
5795  */
5796 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5797 {
5798         wpa_s->normal_scans = 0;
5799         wpa_s->scan_req = NORMAL_SCAN_REQ;
5800         wpa_supplicant_reinit_autoscan(wpa_s);
5801         wpa_s->extra_blacklist_count = 0;
5802         wpa_s->disconnected = 0;
5803         wpa_s->reassociate = 1;
5804
5805         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5806                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5807         else
5808                 wpa_s->reattach = 0;
5809 }
5810
5811
5812 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5813                     struct wpa_used_freq_data *freqs_data,
5814                     unsigned int len)
5815 {
5816         unsigned int i;
5817
5818         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5819                 len, title);
5820         for (i = 0; i < len; i++) {
5821                 struct wpa_used_freq_data *cur = &freqs_data[i];
5822                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5823                         i, cur->freq, cur->flags);
5824         }
5825 }
5826
5827
5828 /*
5829  * Find the operating frequencies of any of the virtual interfaces that
5830  * are using the same radio as the current interface, and in addition, get
5831  * information about the interface types that are using the frequency.
5832  */
5833 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5834                                 struct wpa_used_freq_data *freqs_data,
5835                                 unsigned int len)
5836 {
5837         struct wpa_supplicant *ifs;
5838         u8 bssid[ETH_ALEN];
5839         int freq;
5840         unsigned int idx = 0, i;
5841
5842         wpa_dbg(wpa_s, MSG_DEBUG,
5843                 "Determining shared radio frequencies (max len %u)", len);
5844         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5845
5846         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5847                          radio_list) {
5848                 if (idx == len)
5849                         break;
5850
5851                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5852                         continue;
5853
5854                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5855                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5856                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5857                         freq = ifs->current_ssid->frequency;
5858                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5859                         freq = ifs->assoc_freq;
5860                 else
5861                         continue;
5862
5863                 /* Hold only distinct freqs */
5864                 for (i = 0; i < idx; i++)
5865                         if (freqs_data[i].freq == freq)
5866                                 break;
5867
5868                 if (i == idx)
5869                         freqs_data[idx++].freq = freq;
5870
5871                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5872                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5873                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5874                                 WPA_FREQ_USED_BY_INFRA_STATION;
5875                 }
5876         }
5877
5878         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5879         return idx;
5880 }
5881
5882
5883 /*
5884  * Find the operating frequencies of any of the virtual interfaces that
5885  * are using the same radio as the current interface.
5886  */
5887 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5888                            int *freq_array, unsigned int len)
5889 {
5890         struct wpa_used_freq_data *freqs_data;
5891         int num, i;
5892
5893         os_memset(freq_array, 0, sizeof(int) * len);
5894
5895         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5896         if (!freqs_data)
5897                 return -1;
5898
5899         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5900         for (i = 0; i < num; i++)
5901                 freq_array[i] = freqs_data[i].freq;
5902
5903         os_free(freqs_data);
5904
5905         return num;
5906 }
5907
5908
5909 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5910 {
5911         struct rrm_data *rrm = data;
5912
5913         if (!rrm->notify_neighbor_rep) {
5914                 wpa_printf(MSG_ERROR,
5915                            "RRM: Unexpected neighbor report timeout");
5916                 return;
5917         }
5918
5919         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5920         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5921
5922         rrm->notify_neighbor_rep = NULL;
5923         rrm->neighbor_rep_cb_ctx = NULL;
5924 }
5925
5926
5927 /*
5928  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5929  * @wpa_s: Pointer to wpa_supplicant
5930  */
5931 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5932 {
5933         wpa_s->rrm.rrm_used = 0;
5934
5935         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5936                              NULL);
5937         if (wpa_s->rrm.notify_neighbor_rep)
5938                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5939         wpa_s->rrm.next_neighbor_rep_token = 1;
5940 }
5941
5942
5943 /*
5944  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5945  * @wpa_s: Pointer to wpa_supplicant
5946  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5947  * @report_len: Length of neighbor report buffer
5948  */
5949 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5950                                    const u8 *report, size_t report_len)
5951 {
5952         struct wpabuf *neighbor_rep;
5953
5954         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5955         if (report_len < 1)
5956                 return;
5957
5958         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5959                 wpa_printf(MSG_DEBUG,
5960                            "RRM: Discarding neighbor report with token %d (expected %d)",
5961                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5962                 return;
5963         }
5964
5965         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5966                              NULL);
5967
5968         if (!wpa_s->rrm.notify_neighbor_rep) {
5969                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5970                 return;
5971         }
5972
5973         /* skipping the first byte, which is only an id (dialog token) */
5974         neighbor_rep = wpabuf_alloc(report_len - 1);
5975         if (neighbor_rep == NULL)
5976                 return;
5977         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5978         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5979                    report[0]);
5980         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5981                                        neighbor_rep);
5982         wpa_s->rrm.notify_neighbor_rep = NULL;
5983         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5984 }
5985
5986
5987 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5988 /* Workaround different, undefined for Windows, error codes used here */
5989 #define ENOTCONN -1
5990 #define EOPNOTSUPP -1
5991 #define ECANCELED -1
5992 #endif
5993
5994 /**
5995  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5996  * @wpa_s: Pointer to wpa_supplicant
5997  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5998  *        is sent in the request.
5999  * @cb: Callback function to be called once the requested report arrives, or
6000  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6001  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6002  *      the requester's responsibility to free it.
6003  *      In the latter case NULL will be sent in 'neighbor_rep'.
6004  * @cb_ctx: Context value to send the callback function
6005  * Returns: 0 in case of success, negative error code otherwise
6006  *
6007  * In case there is a previous request which has not been answered yet, the
6008  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6009  * Request must contain a callback function.
6010  */
6011 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6012                                        const struct wpa_ssid *ssid,
6013                                        void (*cb)(void *ctx,
6014                                                   struct wpabuf *neighbor_rep),
6015                                        void *cb_ctx)
6016 {
6017         struct wpabuf *buf;
6018         const u8 *rrm_ie;
6019
6020         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6021                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6022                 return -ENOTCONN;
6023         }
6024
6025         if (!wpa_s->rrm.rrm_used) {
6026                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6027                 return -EOPNOTSUPP;
6028         }
6029
6030         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6031                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6032         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6033             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6034                 wpa_printf(MSG_DEBUG,
6035                            "RRM: No network support for Neighbor Report.");
6036                 return -EOPNOTSUPP;
6037         }
6038
6039         if (!cb) {
6040                 wpa_printf(MSG_DEBUG,
6041                            "RRM: Neighbor Report request must provide a callback.");
6042                 return -EINVAL;
6043         }
6044
6045         /* Refuse if there's a live request */
6046         if (wpa_s->rrm.notify_neighbor_rep) {
6047                 wpa_printf(MSG_DEBUG,
6048                            "RRM: Currently handling previous Neighbor Report.");
6049                 return -EBUSY;
6050         }
6051
6052         /* 3 = action category + action code + dialog token */
6053         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6054         if (buf == NULL) {
6055                 wpa_printf(MSG_DEBUG,
6056                            "RRM: Failed to allocate Neighbor Report Request");
6057                 return -ENOMEM;
6058         }
6059
6060         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6061                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6062                    wpa_s->rrm.next_neighbor_rep_token);
6063
6064         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6065         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6066         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6067         if (ssid) {
6068                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6069                 wpabuf_put_u8(buf, ssid->ssid_len);
6070                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6071         }
6072
6073         wpa_s->rrm.next_neighbor_rep_token++;
6074
6075         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6076                                 wpa_s->own_addr, wpa_s->bssid,
6077                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6078                 wpa_printf(MSG_DEBUG,
6079                            "RRM: Failed to send Neighbor Report Request");
6080                 wpabuf_free(buf);
6081                 return -ECANCELED;
6082         }
6083
6084         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6085         wpa_s->rrm.notify_neighbor_rep = cb;
6086         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6087                                wpas_rrm_neighbor_rep_timeout_handler,
6088                                &wpa_s->rrm, NULL);
6089
6090         wpabuf_free(buf);
6091         return 0;
6092 }
6093
6094
6095 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6096                                               const u8 *src,
6097                                               const u8 *frame, size_t len,
6098                                               int rssi)
6099 {
6100         struct wpabuf *buf;
6101         const struct rrm_link_measurement_request *req;
6102         struct rrm_link_measurement_report report;
6103
6104         if (wpa_s->wpa_state != WPA_COMPLETED) {
6105                 wpa_printf(MSG_INFO,
6106                            "RRM: Ignoring link measurement request. Not associated");
6107                 return;
6108         }
6109
6110         if (!wpa_s->rrm.rrm_used) {
6111                 wpa_printf(MSG_INFO,
6112                            "RRM: Ignoring link measurement request. Not RRM network");
6113                 return;
6114         }
6115
6116         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6117                 wpa_printf(MSG_INFO,
6118                            "RRM: Measurement report failed. TX power insertion not supported");
6119                 return;
6120         }
6121
6122         req = (const struct rrm_link_measurement_request *) frame;
6123         if (len < sizeof(*req)) {
6124                 wpa_printf(MSG_INFO,
6125                            "RRM: Link measurement report failed. Request too short");
6126                 return;
6127         }
6128
6129         os_memset(&report, 0, sizeof(report));
6130         report.tpc.eid = WLAN_EID_TPC_REPORT;
6131         report.tpc.len = 2;
6132         report.rsni = 255; /* 255 indicates that RSNI is not available */
6133         report.dialog_token = req->dialog_token;
6134
6135         /*
6136          * It's possible to estimate RCPI based on RSSI in dBm. This
6137          * calculation will not reflect the correct value for high rates,
6138          * but it's good enough for Action frames which are transmitted
6139          * with up to 24 Mbps rates.
6140          */
6141         if (!rssi)
6142                 report.rcpi = 255; /* not available */
6143         else if (rssi < -110)
6144                 report.rcpi = 0;
6145         else if (rssi > 0)
6146                 report.rcpi = 220;
6147         else
6148                 report.rcpi = (rssi + 110) * 2;
6149
6150         /* action_category + action_code */
6151         buf = wpabuf_alloc(2 + sizeof(report));
6152         if (buf == NULL) {
6153                 wpa_printf(MSG_ERROR,
6154                            "RRM: Link measurement report failed. Buffer allocation failed");
6155                 return;
6156         }
6157
6158         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6159         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6160         wpabuf_put_data(buf, &report, sizeof(report));
6161         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6162                     wpabuf_head(buf), wpabuf_len(buf));
6163
6164         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6165                                 wpa_s->own_addr, wpa_s->bssid,
6166                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6167                 wpa_printf(MSG_ERROR,
6168                            "RRM: Link measurement report failed. Send action failed");
6169         }
6170         wpabuf_free(buf);
6171 }
6172
6173
6174 struct wpa_supplicant *
6175 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6176 {
6177         switch (frame) {
6178 #ifdef CONFIG_P2P
6179         case VENDOR_ELEM_PROBE_REQ_P2P:
6180         case VENDOR_ELEM_PROBE_RESP_P2P:
6181         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6182         case VENDOR_ELEM_BEACON_P2P_GO:
6183         case VENDOR_ELEM_P2P_PD_REQ:
6184         case VENDOR_ELEM_P2P_PD_RESP:
6185         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6186         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6187         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6188         case VENDOR_ELEM_P2P_INV_REQ:
6189         case VENDOR_ELEM_P2P_INV_RESP:
6190         case VENDOR_ELEM_P2P_ASSOC_REQ:
6191         case VENDOR_ELEM_P2P_ASSOC_RESP:
6192                 return wpa_s->parent;
6193 #endif /* CONFIG_P2P */
6194         default:
6195                 return wpa_s;
6196         }
6197 }
6198
6199
6200 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6201 {
6202         unsigned int i;
6203         char buf[30];
6204
6205         wpa_printf(MSG_DEBUG, "Update vendor elements");
6206
6207         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6208                 if (wpa_s->vendor_elem[i]) {
6209                         int res;
6210
6211                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6212                         if (!os_snprintf_error(sizeof(buf), res)) {
6213                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6214                                                 wpa_s->vendor_elem[i]);
6215                         }
6216                 }
6217         }
6218
6219 #ifdef CONFIG_P2P
6220         if (wpa_s->parent == wpa_s &&
6221             wpa_s->global->p2p &&
6222             !wpa_s->global->p2p_disabled)
6223                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6224 #endif /* CONFIG_P2P */
6225 }
6226
6227
6228 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6229                             const u8 *elem, size_t len)
6230 {
6231         u8 *ie, *end;
6232
6233         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6234         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6235
6236         for (; ie + 1 < end; ie += 2 + ie[1]) {
6237                 if (ie + len > end)
6238                         break;
6239                 if (os_memcmp(ie, elem, len) != 0)
6240                         continue;
6241
6242                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6243                         wpabuf_free(wpa_s->vendor_elem[frame]);
6244                         wpa_s->vendor_elem[frame] = NULL;
6245                 } else {
6246                         os_memmove(ie, ie + len, end - (ie + len));
6247                         wpa_s->vendor_elem[frame]->used -= len;
6248                 }
6249                 wpas_vendor_elem_update(wpa_s);
6250                 return 0;
6251         }
6252
6253         return -1;
6254 }