wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548 }
 549
 550
 551 /**
 552  * wpa_clear_keys - Clear keys configured for the driver
 553  * @wpa_s: Pointer to wpa_supplicant data
 554  * @addr: Previously used BSSID or %NULL if not available
 555  *
 556  * This function clears the encryption keys that has been previously configured
 557  * for the driver.
 558  */
 559 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 560 {
 561         int i, max;
 562
 563 #ifdef CONFIG_IEEE80211W
 564         max = 6;
 565 #else /* CONFIG_IEEE80211W */
 566         max = 4;
 567 #endif /* CONFIG_IEEE80211W */
 568
 569         /* MLME-DELETEKEYS.request */
 570         for (i = 0; i < max; i++) {
 571                 if (wpa_s->keys_cleared & BIT(i))
 572                         continue;
 573                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 574                                 NULL, 0);
 575         }
 576         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 577             !is_zero_ether_addr(addr)) {
 578                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 579                                 0);
 580                 /* MLME-SETPROTECTION.request(None) */
 581                 wpa_drv_mlme_setprotection(
 582                         wpa_s, addr,
 583                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 584                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 585         }
 586         wpa_s->keys_cleared = (u32) -1;
 587 }
 588
 589
 590 /**
 591  * wpa_supplicant_state_txt - Get the connection state name as a text string
 592  * @state: State (wpa_state; WPA_*)
 593  * Returns: The state name as a printable text string
 594  */
 595 const char * wpa_supplicant_state_txt(enum wpa_states state)
 596 {
 597         switch (state) {
 598         case WPA_DISCONNECTED:
 599                 return "DISCONNECTED";
 600         case WPA_INACTIVE:
 601                 return "INACTIVE";
 602         case WPA_INTERFACE_DISABLED:
 603                 return "INTERFACE_DISABLED";
 604         case WPA_SCANNING:
 605                 return "SCANNING";
 606         case WPA_AUTHENTICATING:
 607                 return "AUTHENTICATING";
 608         case WPA_ASSOCIATING:
 609                 return "ASSOCIATING";
 610         case WPA_ASSOCIATED:
 611                 return "ASSOCIATED";
 612         case WPA_4WAY_HANDSHAKE:
 613                 return "4WAY_HANDSHAKE";
 614         case WPA_GROUP_HANDSHAKE:
 615                 return "GROUP_HANDSHAKE";
 616         case WPA_COMPLETED:
 617                 return "COMPLETED";
 618         default:
 619                 return "UNKNOWN";
 620         }
 621 }
 622
 623
 624 #ifdef CONFIG_BGSCAN
 625
 626 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 627 {
 628         const char *name;
 629
 630         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 631                 name = wpa_s->current_ssid->bgscan;
 632         else
 633                 name = wpa_s->conf->bgscan;
 634         if (name == NULL || name[0] == '\0')
 635                 return;
 636         if (wpas_driver_bss_selection(wpa_s))
 637                 return;
 638         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 639                 return;
 640 #ifdef CONFIG_P2P
 641         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 642                 return;
 643 #endif /* CONFIG_P2P */
 644
 645         bgscan_deinit(wpa_s);
 646         if (wpa_s->current_ssid) {
 647                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 648                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 649                                 "bgscan");
 650                         /*
 651                          * Live without bgscan; it is only used as a roaming
 652                          * optimization, so the initial connection is not
 653                          * affected.
 654                          */
 655                 } else {
 656                         struct wpa_scan_results *scan_res;
 657                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 658                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 659                                                                    0);
 660                         if (scan_res) {
 661                                 bgscan_notify_scan(wpa_s, scan_res);
 662                                 wpa_scan_results_free(scan_res);
 663                         }
 664                 }
 665         } else
 666                 wpa_s->bgscan_ssid = NULL;
 667 }
 668
 669
 670 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 671 {
 672         if (wpa_s->bgscan_ssid != NULL) {
 673                 bgscan_deinit(wpa_s);
 674                 wpa_s->bgscan_ssid = NULL;
 675         }
 676 }
 677
 678 #endif /* CONFIG_BGSCAN */
 679
 680
 681 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (autoscan_init(wpa_s, 0))
 684                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 685 }
 686
 687
 688 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 689 {
 690         autoscan_deinit(wpa_s);
 691 }
 692
 693
 694 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 695 {
 696         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 697             wpa_s->wpa_state == WPA_SCANNING) {
 698                 autoscan_deinit(wpa_s);
 699                 wpa_supplicant_start_autoscan(wpa_s);
 700         }
 701 }
 702
 703
 704 /**
 705  * wpa_supplicant_set_state - Set current connection state
 706  * @wpa_s: Pointer to wpa_supplicant data
 707  * @state: The new connection state
 708  *
 709  * This function is called whenever the connection state changes, e.g.,
 710  * association is completed for WPA/WPA2 4-Way Handshake is started.
 711  */
 712 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 713                               enum wpa_states state)
 714 {
 715         enum wpa_states old_state = wpa_s->wpa_state;
 716
 717         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 718                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 719                 wpa_supplicant_state_txt(state));
 720
 721         if (state == WPA_INTERFACE_DISABLED) {
 722                 /* Assure normal scan when interface is restored */
 723                 wpa_s->normal_scans = 0;
 724         }
 725
 726         if (state == WPA_COMPLETED) {
 727                 wpas_connect_work_done(wpa_s);
 728                 /* Reinitialize normal_scan counter */
 729                 wpa_s->normal_scans = 0;
 730         }
 731
 732 #ifdef CONFIG_P2P
 733         /*
 734          * P2PS client has to reply to Probe Request frames received on the
 735          * group operating channel. Enable Probe Request frame reporting for
 736          * P2P connected client in case p2p_cli_probe configuration property is
 737          * set to 1.
 738          */
 739         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 740             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 741             wpa_s->current_ssid->p2p_group) {
 742                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 743                         wpa_dbg(wpa_s, MSG_DEBUG,
 744                                 "P2P: Enable CLI Probe Request RX reporting");
 745                         wpa_s->p2p_cli_probe =
 746                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 747                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 748                         wpa_dbg(wpa_s, MSG_DEBUG,
 749                                 "P2P: Disable CLI Probe Request RX reporting");
 750                         wpa_s->p2p_cli_probe = 0;
 751                         wpa_drv_probe_req_report(wpa_s, 0);
 752                 }
 753         }
 754 #endif /* CONFIG_P2P */
 755
 756         if (state != WPA_SCANNING)
 757                 wpa_supplicant_notify_scanning(wpa_s, 0);
 758
 759         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 760                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 761 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 762                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 763                         MACSTR " completed [id=%d id_str=%s]",
 764                         MAC2STR(wpa_s->bssid),
 765                         ssid ? ssid->id : -1,
 766                         ssid && ssid->id_str ? ssid->id_str : "");
 767 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 768                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 769                 wpa_blacklist_clear(wpa_s);
 770                 wpa_s->extra_blacklist_count = 0;
 771                 wpa_s->new_connection = 0;
 772                 wpa_drv_set_operstate(wpa_s, 1);
 773 #ifndef IEEE8021X_EAPOL
 774                 wpa_drv_set_supp_port(wpa_s, 1);
 775 #endif /* IEEE8021X_EAPOL */
 776                 wpa_s->after_wps = 0;
 777                 wpa_s->known_wps_freq = 0;
 778                 wpas_p2p_completed(wpa_s);
 779
 780                 sme_sched_obss_scan(wpa_s, 1);
 781         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 782                    state == WPA_ASSOCIATED) {
 783                 wpa_s->new_connection = 1;
 784                 wpa_drv_set_operstate(wpa_s, 0);
 785 #ifndef IEEE8021X_EAPOL
 786                 wpa_drv_set_supp_port(wpa_s, 0);
 787 #endif /* IEEE8021X_EAPOL */
 788                 sme_sched_obss_scan(wpa_s, 0);
 789         }
 790         wpa_s->wpa_state = state;
 791
 792 #ifdef CONFIG_BGSCAN
 793         if (state == WPA_COMPLETED)
 794                 wpa_supplicant_start_bgscan(wpa_s);
 795         else if (state < WPA_ASSOCIATED)
 796                 wpa_supplicant_stop_bgscan(wpa_s);
 797 #endif /* CONFIG_BGSCAN */
 798
 799         if (state == WPA_AUTHENTICATING)
 800                 wpa_supplicant_stop_autoscan(wpa_s);
 801
 802         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 803                 wpa_supplicant_start_autoscan(wpa_s);
 804
 805         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 806                 wmm_ac_notify_disassoc(wpa_s);
 807
 808         if (wpa_s->wpa_state != old_state) {
 809                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 810
 811                 /*
 812                  * Notify the P2P Device interface about a state change in one
 813                  * of the interfaces.
 814                  */
 815                 wpas_p2p_indicate_state_change(wpa_s);
 816
 817                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 818                     old_state == WPA_COMPLETED)
 819                         wpas_notify_auth_changed(wpa_s);
 820         }
 821 }
 822
 823
 824 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 825 {
 826         int pending = 0;
 827 #ifdef CONFIG_WPS
 828         struct wpa_supplicant *wpa_s = global->ifaces;
 829         while (wpa_s) {
 830                 struct wpa_supplicant *next = wpa_s->next;
 831                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 832                         pending = 1;
 833 #ifdef CONFIG_P2P
 834                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 835                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 836                         wpas_p2p_disconnect(wpa_s);
 837 #endif /* CONFIG_P2P */
 838                 wpa_s = next;
 839         }
 840 #endif /* CONFIG_WPS */
 841         if (pending)
 842                 return;
 843         eloop_terminate();
 844 }
 845
 846
 847 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 848 {
 849         struct wpa_global *global = signal_ctx;
 850         wpa_supplicant_terminate_proc(global);
 851 }
 852
 853
 854 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 855 {
 856         enum wpa_states old_state = wpa_s->wpa_state;
 857
 858         wpa_s->pairwise_cipher = 0;
 859         wpa_s->group_cipher = 0;
 860         wpa_s->mgmt_group_cipher = 0;
 861         wpa_s->key_mgmt = 0;
 862         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 863                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 864
 865         if (wpa_s->wpa_state != old_state)
 866                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 867 }
 868
 869
 870 /**
 871  * wpa_supplicant_reload_configuration - Reload configuration data
 872  * @wpa_s: Pointer to wpa_supplicant data
 873  * Returns: 0 on success or -1 if configuration parsing failed
 874  *
 875  * This function can be used to request that the configuration data is reloaded
 876  * (e.g., after configuration file change). This function is reloading
 877  * configuration only for one interface, so this may need to be called multiple
 878  * times if %wpa_supplicant is controlling multiple interfaces and all
 879  * interfaces need reconfiguration.
 880  */
 881 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 882 {
 883         struct wpa_config *conf;
 884         int reconf_ctrl;
 885         int old_ap_scan;
 886
 887         if (wpa_s->confname == NULL)
 888                 return -1;
 889         conf = wpa_config_read(wpa_s->confname, NULL);
 890         if (conf == NULL) {
 891                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 892                         "file '%s' - exiting", wpa_s->confname);
 893                 return -1;
 894         }
 895         wpa_config_read(wpa_s->confanother, conf);
 896
 897         conf->changed_parameters = (unsigned int) -1;
 898
 899         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 900                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 901                     os_strcmp(conf->ctrl_interface,
 902                               wpa_s->conf->ctrl_interface) != 0);
 903
 904         if (reconf_ctrl && wpa_s->ctrl_iface) {
 905                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 906                 wpa_s->ctrl_iface = NULL;
 907         }
 908
 909         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 910         if (wpa_s->current_ssid) {
 911                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 912                         wpa_s->own_disconnect_req = 1;
 913                 wpa_supplicant_deauthenticate(wpa_s,
 914                                               WLAN_REASON_DEAUTH_LEAVING);
 915         }
 916
 917         /*
 918          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 919          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 920          */
 921         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 922                 /*
 923                  * Clear forced success to clear EAP state for next
 924                  * authentication.
 925                  */
 926                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 927         }
 928         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 929         wpa_sm_set_config(wpa_s->wpa, NULL);
 930         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 931         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 932         rsn_preauth_deinit(wpa_s->wpa);
 933
 934         old_ap_scan = wpa_s->conf->ap_scan;
 935         wpa_config_free(wpa_s->conf);
 936         wpa_s->conf = conf;
 937         if (old_ap_scan != wpa_s->conf->ap_scan)
 938                 wpas_notify_ap_scan_changed(wpa_s);
 939
 940         if (reconf_ctrl)
 941                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 942
 943         wpa_supplicant_update_config(wpa_s);
 944
 945         wpa_supplicant_clear_status(wpa_s);
 946         if (wpa_supplicant_enabled_networks(wpa_s)) {
 947                 wpa_s->reassociate = 1;
 948                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 949         }
 950         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 951         return 0;
 952 }
 953
 954
 955 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 956 {
 957         struct wpa_global *global = signal_ctx;
 958         struct wpa_supplicant *wpa_s;
 959         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 960                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 961                         sig);
 962                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 963                         wpa_supplicant_terminate_proc(global);
 964                 }
 965         }
 966 }
 967
 968
 969 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 970                                          struct wpa_ssid *ssid,
 971                                          struct wpa_ie_data *ie)
 972 {
 973         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 974         if (ret) {
 975                 if (ret == -2) {
 976                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 977                                 "from association info");
 978                 }
 979                 return -1;
 980         }
 981
 982         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 983                 "cipher suites");
 984         if (!(ie->group_cipher & ssid->group_cipher)) {
 985                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 986                         "cipher 0x%x (mask 0x%x) - reject",
 987                         ie->group_cipher, ssid->group_cipher);
 988                 return -1;
 989         }
 990         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 991                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 992                         "cipher 0x%x (mask 0x%x) - reject",
 993                         ie->pairwise_cipher, ssid->pairwise_cipher);
 994                 return -1;
 995         }
 996         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 997                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 998                         "management 0x%x (mask 0x%x) - reject",
 999                         ie->key_mgmt, ssid->key_mgmt);
1000                 return -1;
1001         }
1002
1003 #ifdef CONFIG_IEEE80211W
1004         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1005             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1007                         "that does not support management frame protection - "
1008                         "reject");
1009                 return -1;
1010         }
1011 #endif /* CONFIG_IEEE80211W */
1012
1013         return 0;
1014 }
1015
1016
1017 /**
1018  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1019  * @wpa_s: Pointer to wpa_supplicant data
1020  * @bss: Scan results for the selected BSS, or %NULL if not available
1021  * @ssid: Configuration data for the selected network
1022  * @wpa_ie: Buffer for the WPA/RSN IE
1023  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1024  * used buffer length in case the functions returns success.
1025  * Returns: 0 on success or -1 on failure
1026  *
1027  * This function is used to configure authentication and encryption parameters
1028  * based on the network configuration and scan result for the selected BSS (if
1029  * available).
1030  */
1031 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1032                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1033                               u8 *wpa_ie, size_t *wpa_ie_len)
1034 {
1035         struct wpa_ie_data ie;
1036         int sel, proto;
1037         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1038
1039         if (bss) {
1040                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1041                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1042                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1043         } else
1044                 bss_wpa = bss_rsn = bss_osen = NULL;
1045
1046         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1047             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1048             (ie.group_cipher & ssid->group_cipher) &&
1049             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1050             (ie.key_mgmt & ssid->key_mgmt)) {
1051                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1052                 proto = WPA_PROTO_RSN;
1053         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1054                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1055                    (ie.group_cipher & ssid->group_cipher) &&
1056                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1057                    (ie.key_mgmt & ssid->key_mgmt)) {
1058                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1059                 proto = WPA_PROTO_WPA;
1060 #ifdef CONFIG_HS20
1061         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1062                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1063                 /* TODO: parse OSEN element */
1064                 os_memset(&ie, 0, sizeof(ie));
1065                 ie.group_cipher = WPA_CIPHER_CCMP;
1066                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1067                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1068                 proto = WPA_PROTO_OSEN;
1069 #endif /* CONFIG_HS20 */
1070         } else if (bss) {
1071                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1072                 wpa_dbg(wpa_s, MSG_DEBUG,
1073                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1074                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1075                         ssid->key_mgmt);
1076                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1077                         MAC2STR(bss->bssid),
1078                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1079                         bss_wpa ? " WPA" : "",
1080                         bss_rsn ? " RSN" : "",
1081                         bss_osen ? " OSEN" : "");
1082                 if (bss_rsn) {
1083                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1084                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1085                                 wpa_dbg(wpa_s, MSG_DEBUG,
1086                                         "Could not parse RSN element");
1087                         } else {
1088                                 wpa_dbg(wpa_s, MSG_DEBUG,
1089                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1090                                         ie.pairwise_cipher, ie.group_cipher,
1091                                         ie.key_mgmt);
1092                         }
1093                 }
1094                 if (bss_wpa) {
1095                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1096                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1097                                 wpa_dbg(wpa_s, MSG_DEBUG,
1098                                         "Could not parse WPA element");
1099                         } else {
1100                                 wpa_dbg(wpa_s, MSG_DEBUG,
1101                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1102                                         ie.pairwise_cipher, ie.group_cipher,
1103                                         ie.key_mgmt);
1104                         }
1105                 }
1106                 return -1;
1107         } else {
1108                 if (ssid->proto & WPA_PROTO_OSEN)
1109                         proto = WPA_PROTO_OSEN;
1110                 else if (ssid->proto & WPA_PROTO_RSN)
1111                         proto = WPA_PROTO_RSN;
1112                 else
1113                         proto = WPA_PROTO_WPA;
1114                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1115                         os_memset(&ie, 0, sizeof(ie));
1116                         ie.group_cipher = ssid->group_cipher;
1117                         ie.pairwise_cipher = ssid->pairwise_cipher;
1118                         ie.key_mgmt = ssid->key_mgmt;
1119 #ifdef CONFIG_IEEE80211W
1120                         ie.mgmt_group_cipher =
1121                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1122                                 WPA_CIPHER_AES_128_CMAC : 0;
1123 #endif /* CONFIG_IEEE80211W */
1124                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1125                                 "based on configuration");
1126                 } else
1127                         proto = ie.proto;
1128         }
1129
1130         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1131                 "pairwise %d key_mgmt %d proto %d",
1132                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1133 #ifdef CONFIG_IEEE80211W
1134         if (ssid->ieee80211w) {
1135                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1136                         ie.mgmt_group_cipher);
1137         }
1138 #endif /* CONFIG_IEEE80211W */
1139
1140         wpa_s->wpa_proto = proto;
1141         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1142         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1143                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1144
1145         if (bss || !wpa_s->ap_ies_from_associnfo) {
1146                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1147                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1148                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1149                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1150                         return -1;
1151         }
1152
1153         sel = ie.group_cipher & ssid->group_cipher;
1154         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1155         if (wpa_s->group_cipher < 0) {
1156                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1157                         "cipher");
1158                 return -1;
1159         }
1160         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1161                 wpa_cipher_txt(wpa_s->group_cipher));
1162
1163         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1164         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1165         if (wpa_s->pairwise_cipher < 0) {
1166                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1167                         "cipher");
1168                 return -1;
1169         }
1170         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1171                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1172
1173         sel = ie.key_mgmt & ssid->key_mgmt;
1174 #ifdef CONFIG_SAE
1175         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1176                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1177 #endif /* CONFIG_SAE */
1178         if (0) {
1179 #ifdef CONFIG_SUITEB192
1180         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1181                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1182                 wpa_dbg(wpa_s, MSG_DEBUG,
1183                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1184 #endif /* CONFIG_SUITEB192 */
1185 #ifdef CONFIG_SUITEB
1186         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1187                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1188                 wpa_dbg(wpa_s, MSG_DEBUG,
1189                         "WPA: using KEY_MGMT 802.1X with Suite B");
1190 #endif /* CONFIG_SUITEB */
1191 #ifdef CONFIG_IEEE80211R
1192         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1193                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1194                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1195         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1196                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1197                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1198 #endif /* CONFIG_IEEE80211R */
1199 #ifdef CONFIG_SAE
1200         } else if (sel & WPA_KEY_MGMT_SAE) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1202                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1203         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1204                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1205                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1206 #endif /* CONFIG_SAE */
1207 #ifdef CONFIG_IEEE80211W
1208         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1209                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1210                 wpa_dbg(wpa_s, MSG_DEBUG,
1211                         "WPA: using KEY_MGMT 802.1X with SHA256");
1212         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1213                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1214                 wpa_dbg(wpa_s, MSG_DEBUG,
1215                         "WPA: using KEY_MGMT PSK with SHA256");
1216 #endif /* CONFIG_IEEE80211W */
1217         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1218                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1219                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1220         } else if (sel & WPA_KEY_MGMT_PSK) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1222                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1223         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1225                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1226 #ifdef CONFIG_HS20
1227         } else if (sel & WPA_KEY_MGMT_OSEN) {
1228                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1229                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1230 #endif /* CONFIG_HS20 */
1231         } else {
1232                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1233                         "authenticated key management type");
1234                 return -1;
1235         }
1236
1237         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1238         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1239                          wpa_s->pairwise_cipher);
1240         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1241
1242 #ifdef CONFIG_IEEE80211W
1243         sel = ie.mgmt_group_cipher;
1244         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1245             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1246                 sel = 0;
1247         if (sel & WPA_CIPHER_AES_128_CMAC) {
1248                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1249                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1250                         "AES-128-CMAC");
1251         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1252                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1253                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1254                         "BIP-GMAC-128");
1255         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1256                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1257                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1258                         "BIP-GMAC-256");
1259         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1260                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1261                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1262                         "BIP-CMAC-256");
1263         } else {
1264                 wpa_s->mgmt_group_cipher = 0;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1266         }
1267         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1268                          wpa_s->mgmt_group_cipher);
1269         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1270                          wpas_get_ssid_pmf(wpa_s, ssid));
1271 #endif /* CONFIG_IEEE80211W */
1272
1273         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1274                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1275                 return -1;
1276         }
1277
1278         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1279                 int psk_set = 0;
1280
1281                 if (ssid->psk_set) {
1282                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1283                         psk_set = 1;
1284                 }
1285 #ifndef CONFIG_NO_PBKDF2
1286                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1287                     ssid->passphrase) {
1288                         u8 psk[PMK_LEN];
1289                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1290                                     4096, psk, PMK_LEN);
1291                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1292                                         psk, PMK_LEN);
1293                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1294                         psk_set = 1;
1295                         os_memset(psk, 0, sizeof(psk));
1296                 }
1297 #endif /* CONFIG_NO_PBKDF2 */
1298 #ifdef CONFIG_EXT_PASSWORD
1299                 if (ssid->ext_psk) {
1300                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1301                                                              ssid->ext_psk);
1302                         char pw_str[64 + 1];
1303                         u8 psk[PMK_LEN];
1304
1305                         if (pw == NULL) {
1306                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1307                                         "found from external storage");
1308                                 return -1;
1309                         }
1310
1311                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1312                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1313                                         "PSK length %d in external storage",
1314                                         (int) wpabuf_len(pw));
1315                                 ext_password_free(pw);
1316                                 return -1;
1317                         }
1318
1319                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1320                         pw_str[wpabuf_len(pw)] = '\0';
1321
1322 #ifndef CONFIG_NO_PBKDF2
1323                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1324                         {
1325                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1326                                             4096, psk, PMK_LEN);
1327                                 os_memset(pw_str, 0, sizeof(pw_str));
1328                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1329                                                 "external passphrase)",
1330                                                 psk, PMK_LEN);
1331                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1332                                 psk_set = 1;
1333                                 os_memset(psk, 0, sizeof(psk));
1334                         } else
1335 #endif /* CONFIG_NO_PBKDF2 */
1336                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1337                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1338                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1339                                                 "Invalid PSK hex string");
1340                                         os_memset(pw_str, 0, sizeof(pw_str));
1341                                         ext_password_free(pw);
1342                                         return -1;
1343                                 }
1344                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1345                                 psk_set = 1;
1346                                 os_memset(psk, 0, sizeof(psk));
1347                         } else {
1348                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1349                                         "PSK available");
1350                                 os_memset(pw_str, 0, sizeof(pw_str));
1351                                 ext_password_free(pw);
1352                                 return -1;
1353                         }
1354
1355                         os_memset(pw_str, 0, sizeof(pw_str));
1356                         ext_password_free(pw);
1357                 }
1358 #endif /* CONFIG_EXT_PASSWORD */
1359
1360                 if (!psk_set) {
1361                         wpa_msg(wpa_s, MSG_INFO,
1362                                 "No PSK available for association");
1363                         return -1;
1364                 }
1365         } else
1366                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1367
1368         return 0;
1369 }
1370
1371
1372 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1373 {
1374         *pos = 0x00;
1375
1376         switch (idx) {
1377         case 0: /* Bits 0-7 */
1378                 break;
1379         case 1: /* Bits 8-15 */
1380                 break;
1381         case 2: /* Bits 16-23 */
1382 #ifdef CONFIG_WNM
1383                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1384                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1385 #endif /* CONFIG_WNM */
1386                 break;
1387         case 3: /* Bits 24-31 */
1388 #ifdef CONFIG_WNM
1389                 *pos |= 0x02; /* Bit 25 - SSID List */
1390 #endif /* CONFIG_WNM */
1391 #ifdef CONFIG_INTERWORKING
1392                 if (wpa_s->conf->interworking)
1393                         *pos |= 0x80; /* Bit 31 - Interworking */
1394 #endif /* CONFIG_INTERWORKING */
1395                 break;
1396         case 4: /* Bits 32-39 */
1397 #ifdef CONFIG_INTERWORKING
1398                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1399                         *pos |= 0x01; /* Bit 32 - QoS Map */
1400 #endif /* CONFIG_INTERWORKING */
1401                 break;
1402         case 5: /* Bits 40-47 */
1403 #ifdef CONFIG_HS20
1404                 if (wpa_s->conf->hs20)
1405                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1406 #endif /* CONFIG_HS20 */
1407                 break;
1408         case 6: /* Bits 48-55 */
1409                 break;
1410         }
1411 }
1412
1413
1414 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1415 {
1416         u8 *pos = buf;
1417         u8 len = 6, i;
1418
1419         if (len < wpa_s->extended_capa_len)
1420                 len = wpa_s->extended_capa_len;
1421         if (buflen < (size_t) len + 2) {
1422                 wpa_printf(MSG_INFO,
1423                            "Not enough room for building extended capabilities element");
1424                 return -1;
1425         }
1426
1427         *pos++ = WLAN_EID_EXT_CAPAB;
1428         *pos++ = len;
1429         for (i = 0; i < len; i++, pos++) {
1430                 wpas_ext_capab_byte(wpa_s, pos, i);
1431
1432                 if (i < wpa_s->extended_capa_len) {
1433                         *pos &= ~wpa_s->extended_capa_mask[i];
1434                         *pos |= wpa_s->extended_capa[i];
1435                 }
1436         }
1437
1438         while (len > 0 && buf[1 + len] == 0) {
1439                 len--;
1440                 buf[1] = len;
1441         }
1442         if (len == 0)
1443                 return 0;
1444
1445         return 2 + len;
1446 }
1447
1448
1449 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1450                           struct wpa_bss *test_bss)
1451 {
1452         struct wpa_bss *bss;
1453
1454         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1455                 if (bss == test_bss)
1456                         return 1;
1457         }
1458
1459         return 0;
1460 }
1461
1462
1463 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1464                            struct wpa_ssid *test_ssid)
1465 {
1466         struct wpa_ssid *ssid;
1467
1468         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1469                 if (ssid == test_ssid)
1470                         return 1;
1471         }
1472
1473         return 0;
1474 }
1475
1476
1477 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1478                         struct wpa_ssid *test_ssid)
1479 {
1480         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1481                 return 0;
1482
1483         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1484 }
1485
1486
1487 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1488 {
1489         if (cwork == NULL)
1490                 return;
1491         os_free(cwork);
1492 }
1493
1494
1495 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1496 {
1497         struct wpa_connect_work *cwork;
1498         struct wpa_radio_work *work = wpa_s->connect_work;
1499
1500         if (!work)
1501                 return;
1502
1503         wpa_s->connect_work = NULL;
1504         cwork = work->ctx;
1505         work->ctx = NULL;
1506         wpas_connect_work_free(cwork);
1507         radio_work_done(work);
1508 }
1509
1510
1511 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1512 {
1513         struct os_reltime now;
1514         u8 addr[ETH_ALEN];
1515
1516         os_get_reltime(&now);
1517         if (wpa_s->last_mac_addr_style == style &&
1518             wpa_s->last_mac_addr_change.sec != 0 &&
1519             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1520                                 wpa_s->conf->rand_addr_lifetime)) {
1521                 wpa_msg(wpa_s, MSG_DEBUG,
1522                         "Previously selected random MAC address has not yet expired");
1523                 return 0;
1524         }
1525
1526         switch (style) {
1527         case 1:
1528                 if (random_mac_addr(addr) < 0)
1529                         return -1;
1530                 break;
1531         case 2:
1532                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1533                 if (random_mac_addr_keep_oui(addr) < 0)
1534                         return -1;
1535                 break;
1536         default:
1537                 return -1;
1538         }
1539
1540         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1541                 wpa_msg(wpa_s, MSG_INFO,
1542                         "Failed to set random MAC address");
1543                 return -1;
1544         }
1545
1546         os_get_reltime(&wpa_s->last_mac_addr_change);
1547         wpa_s->mac_addr_changed = 1;
1548         wpa_s->last_mac_addr_style = style;
1549
1550         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1551                 wpa_msg(wpa_s, MSG_INFO,
1552                         "Could not update MAC address information");
1553                 return -1;
1554         }
1555
1556         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1557                 MAC2STR(addr));
1558
1559         return 0;
1560 }
1561
1562
1563 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1564 {
1565         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1566             !wpa_s->conf->preassoc_mac_addr)
1567                 return 0;
1568
1569         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1570 }
1571
1572
1573 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1574
1575 /**
1576  * wpa_supplicant_associate - Request association
1577  * @wpa_s: Pointer to wpa_supplicant data
1578  * @bss: Scan results for the selected BSS, or %NULL if not available
1579  * @ssid: Configuration data for the selected network
1580  *
1581  * This function is used to request %wpa_supplicant to associate with a BSS.
1582  */
1583 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1584                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1585 {
1586         struct wpa_connect_work *cwork;
1587         int rand_style;
1588
1589         if (ssid->mac_addr == -1)
1590                 rand_style = wpa_s->conf->mac_addr;
1591         else
1592                 rand_style = ssid->mac_addr;
1593
1594         wmm_ac_clear_saved_tspecs(wpa_s);
1595         wpa_s->reassoc_same_bss = 0;
1596
1597         if (wpa_s->last_ssid == ssid) {
1598                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1599                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1600                         wmm_ac_save_tspecs(wpa_s);
1601                         wpa_s->reassoc_same_bss = 1;
1602                 }
1603         } else if (rand_style > 0) {
1604                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1605                         return;
1606                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1607         } else if (wpa_s->mac_addr_changed) {
1608                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1609                         wpa_msg(wpa_s, MSG_INFO,
1610                                 "Could not restore permanent MAC address");
1611                         return;
1612                 }
1613                 wpa_s->mac_addr_changed = 0;
1614                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1615                         wpa_msg(wpa_s, MSG_INFO,
1616                                 "Could not update MAC address information");
1617                         return;
1618                 }
1619                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1620         }
1621         wpa_s->last_ssid = ssid;
1622
1623 #ifdef CONFIG_IBSS_RSN
1624         ibss_rsn_deinit(wpa_s->ibss_rsn);
1625         wpa_s->ibss_rsn = NULL;
1626 #endif /* CONFIG_IBSS_RSN */
1627
1628         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1629             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1630 #ifdef CONFIG_AP
1631                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1632                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1633                                 "mode");
1634                         return;
1635                 }
1636                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1637                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1638                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1639                                 wpas_p2p_ap_setup_failed(wpa_s);
1640                         return;
1641                 }
1642                 wpa_s->current_bss = bss;
1643 #else /* CONFIG_AP */
1644                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1645                         "the build");
1646 #endif /* CONFIG_AP */
1647                 return;
1648         }
1649
1650         if (ssid->mode == WPAS_MODE_MESH) {
1651 #ifdef CONFIG_MESH
1652                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1653                         wpa_msg(wpa_s, MSG_INFO,
1654                                 "Driver does not support mesh mode");
1655                         return;
1656                 }
1657                 if (bss)
1658                         ssid->frequency = bss->freq;
1659                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1660                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1661                         return;
1662                 }
1663                 wpa_s->current_bss = bss;
1664                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1665                              "ssid=\"%s\" id=%d",
1666                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1667                              ssid->id);
1668 #else /* CONFIG_MESH */
1669                 wpa_msg(wpa_s, MSG_ERROR,
1670                         "mesh mode support not included in the build");
1671 #endif /* CONFIG_MESH */
1672                 return;
1673         }
1674
1675 #ifdef CONFIG_TDLS
1676         if (bss)
1677                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1678                                 bss->ie_len);
1679 #endif /* CONFIG_TDLS */
1680
1681         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1682             ssid->mode == IEEE80211_MODE_INFRA) {
1683                 sme_authenticate(wpa_s, bss, ssid);
1684                 return;
1685         }
1686
1687         if (wpa_s->connect_work) {
1688                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1689                 return;
1690         }
1691
1692         if (radio_work_pending(wpa_s, "connect")) {
1693                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1694                 return;
1695         }
1696
1697         cwork = os_zalloc(sizeof(*cwork));
1698         if (cwork == NULL)
1699                 return;
1700
1701         cwork->bss = bss;
1702         cwork->ssid = ssid;
1703
1704         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1705                            wpas_start_assoc_cb, cwork) < 0) {
1706                 os_free(cwork);
1707         }
1708 }
1709
1710
1711 static int bss_is_ibss(struct wpa_bss *bss)
1712 {
1713         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1714                 IEEE80211_CAP_IBSS;
1715 }
1716
1717
1718 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1719                           const struct wpa_ssid *ssid,
1720                           struct hostapd_freq_params *freq)
1721 {
1722         enum hostapd_hw_mode hw_mode;
1723         struct hostapd_hw_modes *mode = NULL;
1724         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1725                            184, 192 };
1726         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1727         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1728         u8 channel;
1729         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1730         unsigned int j;
1731         struct hostapd_freq_params vht_freq;
1732
1733         freq->freq = ssid->frequency;
1734
1735         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1736                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1737
1738                 if (ssid->mode != WPAS_MODE_IBSS)
1739                         break;
1740
1741                 /* Don't adjust control freq in case of fixed_freq */
1742                 if (ssid->fixed_freq)
1743                         break;
1744
1745                 if (!bss_is_ibss(bss))
1746                         continue;
1747
1748                 if (ssid->ssid_len == bss->ssid_len &&
1749                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1750                         wpa_printf(MSG_DEBUG,
1751                                    "IBSS already found in scan results, adjust control freq: %d",
1752                                    bss->freq);
1753                         freq->freq = bss->freq;
1754                         obss_scan = 0;
1755                         break;
1756                 }
1757         }
1758
1759         /* For IBSS check HT_IBSS flag */
1760         if (ssid->mode == WPAS_MODE_IBSS &&
1761             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1762                 return;
1763
1764         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1765             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1766             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1767                 wpa_printf(MSG_DEBUG,
1768                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1769                 return;
1770         }
1771
1772         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1773         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1774                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1775                         mode = &wpa_s->hw.modes[i];
1776                         break;
1777                 }
1778         }
1779
1780         if (!mode)
1781                 return;
1782
1783         freq->ht_enabled = ht_supported(mode);
1784         if (!freq->ht_enabled)
1785                 return;
1786
1787         /* Setup higher BW only for 5 GHz */
1788         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1789                 return;
1790
1791         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1792                 pri_chan = &mode->channels[chan_idx];
1793                 if (pri_chan->chan == channel)
1794                         break;
1795                 pri_chan = NULL;
1796         }
1797         if (!pri_chan)
1798                 return;
1799
1800         /* Check primary channel flags */
1801         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1802                 return;
1803
1804         /* Check/setup HT40+/HT40- */
1805         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1806                 if (ht40plus[j] == channel) {
1807                         ht40 = 1;
1808                         break;
1809                 }
1810         }
1811
1812         /* Find secondary channel */
1813         for (i = 0; i < mode->num_channels; i++) {
1814                 sec_chan = &mode->channels[i];
1815                 if (sec_chan->chan == channel + ht40 * 4)
1816                         break;
1817                 sec_chan = NULL;
1818         }
1819         if (!sec_chan)
1820                 return;
1821
1822         /* Check secondary channel flags */
1823         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1824                 return;
1825
1826         freq->channel = pri_chan->chan;
1827
1828         switch (ht40) {
1829         case -1:
1830                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1831                         return;
1832                 freq->sec_channel_offset = -1;
1833                 break;
1834         case 1:
1835                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1836                         return;
1837                 freq->sec_channel_offset = 1;
1838                 break;
1839         default:
1840                 break;
1841         }
1842
1843         if (freq->sec_channel_offset && obss_scan) {
1844                 struct wpa_scan_results *scan_res;
1845
1846                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1847                 if (scan_res == NULL) {
1848                         /* Back to HT20 */
1849                         freq->sec_channel_offset = 0;
1850                         return;
1851                 }
1852
1853                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1854                                      sec_chan->chan);
1855                 switch (res) {
1856                 case 0:
1857                         /* Back to HT20 */
1858                         freq->sec_channel_offset = 0;
1859                         break;
1860                 case 1:
1861                         /* Configuration allowed */
1862                         break;
1863                 case 2:
1864                         /* Switch pri/sec channels */
1865                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1866                         freq->sec_channel_offset = -freq->sec_channel_offset;
1867                         freq->channel = sec_chan->chan;
1868                         break;
1869                 default:
1870                         freq->sec_channel_offset = 0;
1871                         break;
1872                 }
1873
1874                 wpa_scan_results_free(scan_res);
1875         }
1876
1877         wpa_printf(MSG_DEBUG,
1878                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1879                    freq->channel, freq->sec_channel_offset);
1880
1881         /* Not sure if mesh is ready for VHT */
1882         if (ssid->mode != WPAS_MODE_IBSS)
1883                 return;
1884
1885         /* For IBSS check VHT_IBSS flag */
1886         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1887                 return;
1888
1889         vht_freq = *freq;
1890
1891         vht_freq.vht_enabled = vht_supported(mode);
1892         if (!vht_freq.vht_enabled)
1893                 return;
1894
1895         /* setup center_freq1, bandwidth */
1896         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1897                 if (freq->channel >= vht80[j] &&
1898                     freq->channel < vht80[j] + 16)
1899                         break;
1900         }
1901
1902         if (j == ARRAY_SIZE(vht80))
1903                 return;
1904
1905         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1906                 struct hostapd_channel_data *chan;
1907
1908                 chan = hw_get_channel_chan(mode, i, NULL);
1909                 if (!chan)
1910                         return;
1911
1912                 /* Back to HT configuration if channel not usable */
1913                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1914                         return;
1915         }
1916
1917         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
1918                                     freq->channel, freq->ht_enabled,
1919                                     vht_freq.vht_enabled,
1920                                     freq->sec_channel_offset,
1921                                     VHT_CHANWIDTH_80MHZ,
1922                                     vht80[j] + 6, 0, 0) != 0)
1923                 return;
1924
1925         *freq = vht_freq;
1926
1927         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
1928                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
1929 }
1930
1931
1932 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1933 {
1934         struct wpa_connect_work *cwork = work->ctx;
1935         struct wpa_bss *bss = cwork->bss;
1936         struct wpa_ssid *ssid = cwork->ssid;
1937         struct wpa_supplicant *wpa_s = work->wpa_s;
1938         u8 wpa_ie[200];
1939         size_t wpa_ie_len;
1940         int use_crypt, ret, i, bssid_changed;
1941         int algs = WPA_AUTH_ALG_OPEN;
1942         unsigned int cipher_pairwise, cipher_group;
1943         struct wpa_driver_associate_params params;
1944         int wep_keys_set = 0;
1945         int assoc_failed = 0;
1946         struct wpa_ssid *old_ssid;
1947 #ifdef CONFIG_HT_OVERRIDES
1948         struct ieee80211_ht_capabilities htcaps;
1949         struct ieee80211_ht_capabilities htcaps_mask;
1950 #endif /* CONFIG_HT_OVERRIDES */
1951 #ifdef CONFIG_VHT_OVERRIDES
1952        struct ieee80211_vht_capabilities vhtcaps;
1953        struct ieee80211_vht_capabilities vhtcaps_mask;
1954 #endif /* CONFIG_VHT_OVERRIDES */
1955
1956         if (deinit) {
1957                 if (work->started) {
1958                         wpa_s->connect_work = NULL;
1959
1960                         /* cancel possible auth. timeout */
1961                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1962                                              NULL);
1963                 }
1964                 wpas_connect_work_free(cwork);
1965                 return;
1966         }
1967
1968         wpa_s->connect_work = work;
1969
1970         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1971                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1972                 wpas_connect_work_done(wpa_s);
1973                 return;
1974         }
1975
1976         os_memset(&params, 0, sizeof(params));
1977         wpa_s->reassociate = 0;
1978         wpa_s->eap_expected_failure = 0;
1979         if (bss &&
1980             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1981 #ifdef CONFIG_IEEE80211R
1982                 const u8 *ie, *md = NULL;
1983 #endif /* CONFIG_IEEE80211R */
1984                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1985                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1986                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1987                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1988                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1989                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1990                 if (bssid_changed)
1991                         wpas_notify_bssid_changed(wpa_s);
1992 #ifdef CONFIG_IEEE80211R
1993                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1994                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1995                         md = ie + 2;
1996                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1997                 if (md) {
1998                         /* Prepare for the next transition */
1999                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2000                 }
2001 #endif /* CONFIG_IEEE80211R */
2002 #ifdef CONFIG_WPS
2003         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2004                    wpa_s->conf->ap_scan == 2 &&
2005                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2006                 /* Use ap_scan==1 style network selection to find the network
2007                  */
2008                 wpas_connect_work_done(wpa_s);
2009                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2010                 wpa_s->reassociate = 1;
2011                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2012                 return;
2013 #endif /* CONFIG_WPS */
2014         } else {
2015                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2016                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2017                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2018         }
2019         wpa_supplicant_cancel_sched_scan(wpa_s);
2020         wpa_supplicant_cancel_scan(wpa_s);
2021
2022         /* Starting new association, so clear the possibly used WPA IE from the
2023          * previous association. */
2024         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2025
2026 #ifdef IEEE8021X_EAPOL
2027         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2028                 if (ssid->leap) {
2029                         if (ssid->non_leap == 0)
2030                                 algs = WPA_AUTH_ALG_LEAP;
2031                         else
2032                                 algs |= WPA_AUTH_ALG_LEAP;
2033                 }
2034         }
2035 #endif /* IEEE8021X_EAPOL */
2036         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2037         if (ssid->auth_alg) {
2038                 algs = ssid->auth_alg;
2039                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2040                         "0x%x", algs);
2041         }
2042
2043         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2044                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2045             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2046                 int try_opportunistic;
2047                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2048                                      wpa_s->conf->okc :
2049                                      ssid->proactive_key_caching) &&
2050                         (ssid->proto & WPA_PROTO_RSN);
2051                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2052                                             ssid, try_opportunistic) == 0)
2053                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2054                 wpa_ie_len = sizeof(wpa_ie);
2055                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2056                                               wpa_ie, &wpa_ie_len)) {
2057                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2058                                 "key management and encryption suites");
2059                         wpas_connect_work_done(wpa_s);
2060                         return;
2061                 }
2062         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2063                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2064                 /*
2065                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2066                  * use non-WPA since the scan results did not indicate that the
2067                  * AP is using WPA or WPA2.
2068                  */
2069                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2070                 wpa_ie_len = 0;
2071                 wpa_s->wpa_proto = 0;
2072         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2073                 wpa_ie_len = sizeof(wpa_ie);
2074                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2075                                               wpa_ie, &wpa_ie_len)) {
2076                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2077                                 "key management and encryption suites (no "
2078                                 "scan results)");
2079                         wpas_connect_work_done(wpa_s);
2080                         return;
2081                 }
2082 #ifdef CONFIG_WPS
2083         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2084                 struct wpabuf *wps_ie;
2085                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2086                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2087                         wpa_ie_len = wpabuf_len(wps_ie);
2088                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2089                 } else
2090                         wpa_ie_len = 0;
2091                 wpabuf_free(wps_ie);
2092                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2093                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2094                         params.wps = WPS_MODE_PRIVACY;
2095                 else
2096                         params.wps = WPS_MODE_OPEN;
2097                 wpa_s->wpa_proto = 0;
2098 #endif /* CONFIG_WPS */
2099         } else {
2100                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2101                 wpa_ie_len = 0;
2102                 wpa_s->wpa_proto = 0;
2103         }
2104
2105 #ifdef CONFIG_P2P
2106         if (wpa_s->global->p2p) {
2107                 u8 *pos;
2108                 size_t len;
2109                 int res;
2110                 pos = wpa_ie + wpa_ie_len;
2111                 len = sizeof(wpa_ie) - wpa_ie_len;
2112                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2113                                             ssid->p2p_group);
2114                 if (res >= 0)
2115                         wpa_ie_len += res;
2116         }
2117
2118         wpa_s->cross_connect_disallowed = 0;
2119         if (bss) {
2120                 struct wpabuf *p2p;
2121                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2122                 if (p2p) {
2123                         wpa_s->cross_connect_disallowed =
2124                                 p2p_get_cross_connect_disallowed(p2p);
2125                         wpabuf_free(p2p);
2126                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2127                                 "connection",
2128                                 wpa_s->cross_connect_disallowed ?
2129                                 "disallows" : "allows");
2130                 }
2131         }
2132
2133         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2134 #endif /* CONFIG_P2P */
2135
2136 #ifdef CONFIG_HS20
2137         if (is_hs20_network(wpa_s, ssid, bss)) {
2138                 struct wpabuf *hs20;
2139                 hs20 = wpabuf_alloc(20);
2140                 if (hs20) {
2141                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2142                         size_t len;
2143
2144                         wpas_hs20_add_indication(hs20, pps_mo_id);
2145                         len = sizeof(wpa_ie) - wpa_ie_len;
2146                         if (wpabuf_len(hs20) <= len) {
2147                                 os_memcpy(wpa_ie + wpa_ie_len,
2148                                           wpabuf_head(hs20), wpabuf_len(hs20));
2149                                 wpa_ie_len += wpabuf_len(hs20);
2150                         }
2151                         wpabuf_free(hs20);
2152                 }
2153         }
2154 #endif /* CONFIG_HS20 */
2155
2156         /*
2157          * Workaround: Add Extended Capabilities element only if the AP
2158          * included this element in Beacon/Probe Response frames. Some older
2159          * APs seem to have interoperability issues if this element is
2160          * included, so while the standard may require us to include the
2161          * element in all cases, it is justifiable to skip it to avoid
2162          * interoperability issues.
2163          */
2164         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2165                 u8 ext_capab[18];
2166                 int ext_capab_len;
2167                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2168                                                      sizeof(ext_capab));
2169                 if (ext_capab_len > 0) {
2170                         u8 *pos = wpa_ie;
2171                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2172                                 pos += 2 + pos[1];
2173                         os_memmove(pos + ext_capab_len, pos,
2174                                    wpa_ie_len - (pos - wpa_ie));
2175                         wpa_ie_len += ext_capab_len;
2176                         os_memcpy(pos, ext_capab, ext_capab_len);
2177                 }
2178         }
2179
2180         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2181                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2182                 size_t len;
2183
2184                 len = sizeof(wpa_ie) - wpa_ie_len;
2185                 if (wpabuf_len(buf) <= len) {
2186                         os_memcpy(wpa_ie + wpa_ie_len,
2187                                   wpabuf_head(buf), wpabuf_len(buf));
2188                         wpa_ie_len += wpabuf_len(buf);
2189                 }
2190         }
2191
2192 #ifdef CONFIG_FST
2193         if (wpa_s->fst_ies) {
2194                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2195
2196                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2197                         os_memcpy(wpa_ie + wpa_ie_len,
2198                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2199                         wpa_ie_len += fst_ies_len;
2200                 }
2201         }
2202 #endif /* CONFIG_FST */
2203
2204         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2205         use_crypt = 1;
2206         cipher_pairwise = wpa_s->pairwise_cipher;
2207         cipher_group = wpa_s->group_cipher;
2208         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2209             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2210                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2211                         use_crypt = 0;
2212                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2213                         use_crypt = 1;
2214                         wep_keys_set = 1;
2215                 }
2216         }
2217         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2218                 use_crypt = 0;
2219
2220 #ifdef IEEE8021X_EAPOL
2221         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2222                 if ((ssid->eapol_flags &
2223                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2224                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2225                     !wep_keys_set) {
2226                         use_crypt = 0;
2227                 } else {
2228                         /* Assume that dynamic WEP-104 keys will be used and
2229                          * set cipher suites in order for drivers to expect
2230                          * encryption. */
2231                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2232                 }
2233         }
2234 #endif /* IEEE8021X_EAPOL */
2235
2236         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2237                 /* Set the key before (and later after) association */
2238                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2239         }
2240
2241         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2242         if (bss) {
2243                 params.ssid = bss->ssid;
2244                 params.ssid_len = bss->ssid_len;
2245                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2246                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2247                                    MACSTR " freq=%u MHz based on scan results "
2248                                    "(bssid_set=%d)",
2249                                    MAC2STR(bss->bssid), bss->freq,
2250                                    ssid->bssid_set);
2251                         params.bssid = bss->bssid;
2252                         params.freq.freq = bss->freq;
2253                 }
2254                 params.bssid_hint = bss->bssid;
2255                 params.freq_hint = bss->freq;
2256         } else {
2257                 params.ssid = ssid->ssid;
2258                 params.ssid_len = ssid->ssid_len;
2259         }
2260
2261         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2262             wpa_s->conf->ap_scan == 2) {
2263                 params.bssid = ssid->bssid;
2264                 params.fixed_bssid = 1;
2265         }
2266
2267         /* Initial frequency for IBSS/mesh */
2268         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2269             ssid->frequency > 0 && params.freq.freq == 0)
2270                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2271
2272         if (ssid->mode == WPAS_MODE_IBSS) {
2273                 params.fixed_freq = ssid->fixed_freq;
2274                 if (ssid->beacon_int)
2275                         params.beacon_int = ssid->beacon_int;
2276                 else
2277                         params.beacon_int = wpa_s->conf->beacon_int;
2278         }
2279
2280         params.wpa_ie = wpa_ie;
2281         params.wpa_ie_len = wpa_ie_len;
2282         params.pairwise_suite = cipher_pairwise;
2283         params.group_suite = cipher_group;
2284         params.key_mgmt_suite = wpa_s->key_mgmt;
2285         params.wpa_proto = wpa_s->wpa_proto;
2286         params.auth_alg = algs;
2287         params.mode = ssid->mode;
2288         params.bg_scan_period = ssid->bg_scan_period;
2289         for (i = 0; i < NUM_WEP_KEYS; i++) {
2290                 if (ssid->wep_key_len[i])
2291                         params.wep_key[i] = ssid->wep_key[i];
2292                 params.wep_key_len[i] = ssid->wep_key_len[i];
2293         }
2294         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2295
2296         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2297             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2298              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2299                 params.passphrase = ssid->passphrase;
2300                 if (ssid->psk_set)
2301                         params.psk = ssid->psk;
2302         }
2303
2304         if (wpa_s->conf->key_mgmt_offload) {
2305                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2306                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2307                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2308                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2309                         params.req_key_mgmt_offload =
2310                                 ssid->proactive_key_caching < 0 ?
2311                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2312                 else
2313                         params.req_key_mgmt_offload = 1;
2314
2315                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2316                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2317                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2318                     ssid->psk_set)
2319                         params.psk = ssid->psk;
2320         }
2321
2322         params.drop_unencrypted = use_crypt;
2323
2324 #ifdef CONFIG_IEEE80211W
2325         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2326         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2327                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2328                 struct wpa_ie_data ie;
2329                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2330                     ie.capabilities &
2331                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2332                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2333                                 "MFP: require MFP");
2334                         params.mgmt_frame_protection =
2335                                 MGMT_FRAME_PROTECTION_REQUIRED;
2336                 }
2337         }
2338 #endif /* CONFIG_IEEE80211W */
2339
2340         params.p2p = ssid->p2p_group;
2341
2342         if (wpa_s->parent->set_sta_uapsd)
2343                 params.uapsd = wpa_s->parent->sta_uapsd;
2344         else
2345                 params.uapsd = -1;
2346
2347 #ifdef CONFIG_HT_OVERRIDES
2348         os_memset(&htcaps, 0, sizeof(htcaps));
2349         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2350         params.htcaps = (u8 *) &htcaps;
2351         params.htcaps_mask = (u8 *) &htcaps_mask;
2352         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2353 #endif /* CONFIG_HT_OVERRIDES */
2354 #ifdef CONFIG_VHT_OVERRIDES
2355         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2356         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2357         params.vhtcaps = &vhtcaps;
2358         params.vhtcaps_mask = &vhtcaps_mask;
2359         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2360 #endif /* CONFIG_VHT_OVERRIDES */
2361
2362 #ifdef CONFIG_P2P
2363         /*
2364          * If multi-channel concurrency is not supported, check for any
2365          * frequency conflict. In case of any frequency conflict, remove the
2366          * least prioritized connection.
2367          */
2368         if (wpa_s->num_multichan_concurrent < 2) {
2369                 int freq, num;
2370                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2371                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2372                         wpa_printf(MSG_DEBUG,
2373                                    "Assoc conflicting freq found (%d != %d)",
2374                                    freq, params.freq.freq);
2375                         if (wpas_p2p_handle_frequency_conflicts(
2376                                     wpa_s, params.freq.freq, ssid) < 0) {
2377                                 wpas_connect_work_done(wpa_s);
2378                                 return;
2379                         }
2380                 }
2381         }
2382 #endif /* CONFIG_P2P */
2383
2384         ret = wpa_drv_associate(wpa_s, &params);
2385         if (ret < 0) {
2386                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2387                         "failed");
2388                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2389                         /*
2390                          * The driver is known to mean what is saying, so we
2391                          * can stop right here; the association will not
2392                          * succeed.
2393                          */
2394                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2395                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2396                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2397                         return;
2398                 }
2399                 /* try to continue anyway; new association will be tried again
2400                  * after timeout */
2401                 assoc_failed = 1;
2402         }
2403
2404         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2405                 /* Set the key after the association just in case association
2406                  * cleared the previously configured key. */
2407                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2408                 /* No need to timeout authentication since there is no key
2409                  * management. */
2410                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2411                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2412 #ifdef CONFIG_IBSS_RSN
2413         } else if (ssid->mode == WPAS_MODE_IBSS &&
2414                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2415                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2416                 /*
2417                  * RSN IBSS authentication is per-STA and we can disable the
2418                  * per-BSSID authentication.
2419                  */
2420                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2421 #endif /* CONFIG_IBSS_RSN */
2422         } else {
2423                 /* Timeout for IEEE 802.11 authentication and association */
2424                 int timeout = 60;
2425
2426                 if (assoc_failed) {
2427                         /* give IBSS a bit more time */
2428                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2429                 } else if (wpa_s->conf->ap_scan == 1) {
2430                         /* give IBSS a bit more time */
2431                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2432                 }
2433                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2434         }
2435
2436         if (wep_keys_set &&
2437             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2438                 /* Set static WEP keys again */
2439                 wpa_set_wep_keys(wpa_s, ssid);
2440         }
2441
2442         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2443                 /*
2444                  * Do not allow EAP session resumption between different
2445                  * network configurations.
2446                  */
2447                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2448         }
2449         old_ssid = wpa_s->current_ssid;
2450         wpa_s->current_ssid = ssid;
2451         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2452                 wpa_s->current_bss = bss;
2453         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2454         wpa_supplicant_initiate_eapol(wpa_s);
2455         if (old_ssid != wpa_s->current_ssid)
2456                 wpas_notify_network_changed(wpa_s);
2457 }
2458
2459
2460 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2461                                             const u8 *addr)
2462 {
2463         struct wpa_ssid *old_ssid;
2464
2465         wpas_connect_work_done(wpa_s);
2466         wpa_clear_keys(wpa_s, addr);
2467         old_ssid = wpa_s->current_ssid;
2468         wpa_supplicant_mark_disassoc(wpa_s);
2469         wpa_sm_set_config(wpa_s->wpa, NULL);
2470         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2471         if (old_ssid != wpa_s->current_ssid)
2472                 wpas_notify_network_changed(wpa_s);
2473         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2474 }
2475
2476
2477 /**
2478  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2479  * @wpa_s: Pointer to wpa_supplicant data
2480  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2481  *
2482  * This function is used to request %wpa_supplicant to deauthenticate from the
2483  * current AP.
2484  */
2485 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2486                                    int reason_code)
2487 {
2488         u8 *addr = NULL;
2489         union wpa_event_data event;
2490         int zero_addr = 0;
2491
2492         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2493                 " pending_bssid=" MACSTR " reason=%d state=%s",
2494                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2495                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2496
2497         if (!is_zero_ether_addr(wpa_s->bssid))
2498                 addr = wpa_s->bssid;
2499         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2500                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2501                   wpa_s->wpa_state == WPA_ASSOCIATING))
2502                 addr = wpa_s->pending_bssid;
2503         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2504                 /*
2505                  * When using driver-based BSS selection, we may not know the
2506                  * BSSID with which we are currently trying to associate. We
2507                  * need to notify the driver of this disconnection even in such
2508                  * a case, so use the all zeros address here.
2509                  */
2510                 addr = wpa_s->bssid;
2511                 zero_addr = 1;
2512         }
2513
2514 #ifdef CONFIG_TDLS
2515         wpa_tdls_teardown_peers(wpa_s->wpa);
2516 #endif /* CONFIG_TDLS */
2517
2518 #ifdef CONFIG_MESH
2519         if (wpa_s->ifmsh) {
2520                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2521                              wpa_s->ifname);
2522                 wpa_supplicant_leave_mesh(wpa_s);
2523         }
2524 #endif /* CONFIG_MESH */
2525
2526         if (addr) {
2527                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2528                 os_memset(&event, 0, sizeof(event));
2529                 event.deauth_info.reason_code = (u16) reason_code;
2530                 event.deauth_info.locally_generated = 1;
2531                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2532                 if (zero_addr)
2533                         addr = NULL;
2534         }
2535
2536         wpa_supplicant_clear_connection(wpa_s, addr);
2537 }
2538
2539 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2540                                               struct wpa_ssid *ssid)
2541 {
2542         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2543                 return;
2544
2545         ssid->disabled = 0;
2546         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2547         wpas_notify_network_enabled_changed(wpa_s, ssid);
2548
2549         /*
2550          * Try to reassociate since there is no current configuration and a new
2551          * network was made available.
2552          */
2553         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2554                 wpa_s->reassociate = 1;
2555 }
2556
2557
2558 /**
2559  * wpa_supplicant_enable_network - Mark a configured network as enabled
2560  * @wpa_s: wpa_supplicant structure for a network interface
2561  * @ssid: wpa_ssid structure for a configured network or %NULL
2562  *
2563  * Enables the specified network or all networks if no network specified.
2564  */
2565 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2566                                    struct wpa_ssid *ssid)
2567 {
2568         if (ssid == NULL) {
2569                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2570                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2571         } else
2572                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2573
2574         if (wpa_s->reassociate && !wpa_s->disconnected) {
2575                 if (wpa_s->sched_scanning) {
2576                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2577                                    "new network to scan filters");
2578                         wpa_supplicant_cancel_sched_scan(wpa_s);
2579                 }
2580
2581                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2582                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2583         }
2584 }
2585
2586
2587 /**
2588  * wpa_supplicant_disable_network - Mark a configured network as disabled
2589  * @wpa_s: wpa_supplicant structure for a network interface
2590  * @ssid: wpa_ssid structure for a configured network or %NULL
2591  *
2592  * Disables the specified network or all networks if no network specified.
2593  */
2594 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2595                                     struct wpa_ssid *ssid)
2596 {
2597         struct wpa_ssid *other_ssid;
2598         int was_disabled;
2599
2600         if (ssid == NULL) {
2601                 if (wpa_s->sched_scanning)
2602                         wpa_supplicant_cancel_sched_scan(wpa_s);
2603
2604                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2605                      other_ssid = other_ssid->next) {
2606                         was_disabled = other_ssid->disabled;
2607                         if (was_disabled == 2)
2608                                 continue; /* do not change persistent P2P group
2609                                            * data */
2610
2611                         other_ssid->disabled = 1;
2612
2613                         if (was_disabled != other_ssid->disabled)
2614                                 wpas_notify_network_enabled_changed(
2615                                         wpa_s, other_ssid);
2616                 }
2617                 if (wpa_s->current_ssid)
2618                         wpa_supplicant_deauthenticate(
2619                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2620         } else if (ssid->disabled != 2) {
2621                 if (ssid == wpa_s->current_ssid)
2622                         wpa_supplicant_deauthenticate(
2623                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2624
2625                 was_disabled = ssid->disabled;
2626
2627                 ssid->disabled = 1;
2628
2629                 if (was_disabled != ssid->disabled) {
2630                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2631                         if (wpa_s->sched_scanning) {
2632                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2633                                            "to remove network from filters");
2634                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2635                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2636                         }
2637                 }
2638         }
2639 }
2640
2641
2642 /**
2643  * wpa_supplicant_select_network - Attempt association with a network
2644  * @wpa_s: wpa_supplicant structure for a network interface
2645  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2646  */
2647 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2648                                    struct wpa_ssid *ssid)
2649 {
2650
2651         struct wpa_ssid *other_ssid;
2652         int disconnected = 0;
2653
2654         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2655                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2656                         wpa_s->own_disconnect_req = 1;
2657                 wpa_supplicant_deauthenticate(
2658                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2659                 disconnected = 1;
2660         }
2661
2662         if (ssid)
2663                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2664
2665         /*
2666          * Mark all other networks disabled or mark all networks enabled if no
2667          * network specified.
2668          */
2669         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2670              other_ssid = other_ssid->next) {
2671                 int was_disabled = other_ssid->disabled;
2672                 if (was_disabled == 2)
2673                         continue; /* do not change persistent P2P group data */
2674
2675                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2676                 if (was_disabled && !other_ssid->disabled)
2677                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2678
2679                 if (was_disabled != other_ssid->disabled)
2680                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2681         }
2682
2683         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2684                 /* We are already associated with the selected network */
2685                 wpa_printf(MSG_DEBUG, "Already associated with the "
2686                            "selected network - do nothing");
2687                 return;
2688         }
2689
2690         if (ssid) {
2691                 wpa_s->current_ssid = ssid;
2692                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2693                 wpa_s->connect_without_scan =
2694                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2695
2696                 /*
2697                  * Don't optimize next scan freqs since a new ESS has been
2698                  * selected.
2699                  */
2700                 os_free(wpa_s->next_scan_freqs);
2701                 wpa_s->next_scan_freqs = NULL;
2702         } else {
2703                 wpa_s->connect_without_scan = NULL;
2704         }
2705
2706         wpa_s->disconnected = 0;
2707         wpa_s->reassociate = 1;
2708
2709         if (wpa_s->connect_without_scan ||
2710             wpa_supplicant_fast_associate(wpa_s) != 1)
2711                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2712
2713         if (ssid)
2714                 wpas_notify_network_selected(wpa_s, ssid);
2715 }
2716
2717
2718 /**
2719  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2720  * @wpa_s: wpa_supplicant structure for a network interface
2721  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2722  * @pkcs11_module_path: PKCS #11 module path or NULL
2723  * Returns: 0 on success; -1 on failure
2724  *
2725  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2726  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2727  * module path fails the paths will be reset to the default value (NULL).
2728  */
2729 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2730                                            const char *pkcs11_engine_path,
2731                                            const char *pkcs11_module_path)
2732 {
2733         char *pkcs11_engine_path_copy = NULL;
2734         char *pkcs11_module_path_copy = NULL;
2735
2736         if (pkcs11_engine_path != NULL) {
2737                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2738                 if (pkcs11_engine_path_copy == NULL)
2739                         return -1;
2740         }
2741         if (pkcs11_module_path != NULL) {
2742                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2743                 if (pkcs11_module_path_copy == NULL) {
2744                         os_free(pkcs11_engine_path_copy);
2745                         return -1;
2746                 }
2747         }
2748
2749         os_free(wpa_s->conf->pkcs11_engine_path);
2750         os_free(wpa_s->conf->pkcs11_module_path);
2751         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2752         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2753
2754         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2755         eapol_sm_deinit(wpa_s->eapol);
2756         wpa_s->eapol = NULL;
2757         if (wpa_supplicant_init_eapol(wpa_s)) {
2758                 /* Error -> Reset paths to the default value (NULL) once. */
2759                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2760                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2761                                                                NULL);
2762
2763                 return -1;
2764         }
2765         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2766
2767         return 0;
2768 }
2769
2770
2771 /**
2772  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2773  * @wpa_s: wpa_supplicant structure for a network interface
2774  * @ap_scan: AP scan mode
2775  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2776  *
2777  */
2778 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2779 {
2780
2781         int old_ap_scan;
2782
2783         if (ap_scan < 0 || ap_scan > 2)
2784                 return -1;
2785
2786 #ifdef ANDROID
2787         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2788             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2789             wpa_s->wpa_state < WPA_COMPLETED) {
2790                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2791                            "associating", wpa_s->conf->ap_scan, ap_scan);
2792                 return 0;
2793         }
2794 #endif /* ANDROID */
2795
2796         old_ap_scan = wpa_s->conf->ap_scan;
2797         wpa_s->conf->ap_scan = ap_scan;
2798
2799         if (old_ap_scan != wpa_s->conf->ap_scan)
2800                 wpas_notify_ap_scan_changed(wpa_s);
2801
2802         return 0;
2803 }
2804
2805
2806 /**
2807  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2808  * @wpa_s: wpa_supplicant structure for a network interface
2809  * @expire_age: Expiration age in seconds
2810  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2811  *
2812  */
2813 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2814                                           unsigned int bss_expire_age)
2815 {
2816         if (bss_expire_age < 10) {
2817                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2818                         bss_expire_age);
2819                 return -1;
2820         }
2821         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2822                 bss_expire_age);
2823         wpa_s->conf->bss_expiration_age = bss_expire_age;
2824
2825         return 0;
2826 }
2827
2828
2829 /**
2830  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2831  * @wpa_s: wpa_supplicant structure for a network interface
2832  * @expire_count: number of scans after which an unseen BSS is reclaimed
2833  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2834  *
2835  */
2836 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2837                                             unsigned int bss_expire_count)
2838 {
2839         if (bss_expire_count < 1) {
2840                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2841                         bss_expire_count);
2842                 return -1;
2843         }
2844         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2845                 bss_expire_count);
2846         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2847
2848         return 0;
2849 }
2850
2851
2852 /**
2853  * wpa_supplicant_set_scan_interval - Set scan interval
2854  * @wpa_s: wpa_supplicant structure for a network interface
2855  * @scan_interval: scan interval in seconds
2856  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2857  *
2858  */
2859 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2860                                      int scan_interval)
2861 {
2862         if (scan_interval < 0) {
2863                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2864                         scan_interval);
2865                 return -1;
2866         }
2867         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2868                 scan_interval);
2869         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2870
2871         return 0;
2872 }
2873
2874
2875 /**
2876  * wpa_supplicant_set_debug_params - Set global debug params
2877  * @global: wpa_global structure
2878  * @debug_level: debug level
2879  * @debug_timestamp: determines if show timestamp in debug data
2880  * @debug_show_keys: determines if show keys in debug data
2881  * Returns: 0 if succeed or -1 if debug_level has wrong value
2882  */
2883 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2884                                     int debug_timestamp, int debug_show_keys)
2885 {
2886
2887         int old_level, old_timestamp, old_show_keys;
2888
2889         /* check for allowed debuglevels */
2890         if (debug_level != MSG_EXCESSIVE &&
2891             debug_level != MSG_MSGDUMP &&
2892             debug_level != MSG_DEBUG &&
2893             debug_level != MSG_INFO &&
2894             debug_level != MSG_WARNING &&
2895             debug_level != MSG_ERROR)
2896                 return -1;
2897
2898         old_level = wpa_debug_level;
2899         old_timestamp = wpa_debug_timestamp;
2900         old_show_keys = wpa_debug_show_keys;
2901
2902         wpa_debug_level = debug_level;
2903         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2904         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2905
2906         if (wpa_debug_level != old_level)
2907                 wpas_notify_debug_level_changed(global);
2908         if (wpa_debug_timestamp != old_timestamp)
2909                 wpas_notify_debug_timestamp_changed(global);
2910         if (wpa_debug_show_keys != old_show_keys)
2911                 wpas_notify_debug_show_keys_changed(global);
2912
2913         return 0;
2914 }
2915
2916
2917 /**
2918  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2919  * @wpa_s: Pointer to wpa_supplicant data
2920  * Returns: A pointer to the current network structure or %NULL on failure
2921  */
2922 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2923 {
2924         struct wpa_ssid *entry;
2925         u8 ssid[SSID_MAX_LEN];
2926         int res;
2927         size_t ssid_len;
2928         u8 bssid[ETH_ALEN];
2929         int wired;
2930
2931         res = wpa_drv_get_ssid(wpa_s, ssid);
2932         if (res < 0) {
2933                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2934                         "driver");
2935                 return NULL;
2936         }
2937         ssid_len = res;
2938
2939         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2940                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2941                         "driver");
2942                 return NULL;
2943         }
2944
2945         wired = wpa_s->conf->ap_scan == 0 &&
2946                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2947
2948         entry = wpa_s->conf->ssid;
2949         while (entry) {
2950                 if (!wpas_network_disabled(wpa_s, entry) &&
2951                     ((ssid_len == entry->ssid_len &&
2952                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2953                     (!entry->bssid_set ||
2954                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2955                         return entry;
2956 #ifdef CONFIG_WPS
2957                 if (!wpas_network_disabled(wpa_s, entry) &&
2958                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2959                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2960                     (!entry->bssid_set ||
2961                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2962                         return entry;
2963 #endif /* CONFIG_WPS */
2964
2965                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2966                     entry->ssid_len == 0 &&
2967                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2968                         return entry;
2969
2970                 entry = entry->next;
2971         }
2972
2973         return NULL;
2974 }
2975
2976
2977 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2978 {
2979         struct wpa_global *global = wpa_s->global;
2980
2981         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2982                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2983                 if (global->drv_priv[i] == NULL) {
2984                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2985                                    "'%s'", wpa_drivers[i]->name);
2986                         return -1;
2987                 }
2988         }
2989
2990         wpa_s->driver = wpa_drivers[i];
2991         wpa_s->global_drv_priv = global->drv_priv[i];
2992
2993         return 0;
2994 }
2995
2996
2997 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2998                                      const char *name)
2999 {
3000         int i;
3001         size_t len;
3002         const char *pos, *driver = name;
3003
3004         if (wpa_s == NULL)
3005                 return -1;
3006
3007         if (wpa_drivers[0] == NULL) {
3008                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3009                         "wpa_supplicant");
3010                 return -1;
3011         }
3012
3013         if (name == NULL) {
3014                 /* default to first driver in the list */
3015                 return select_driver(wpa_s, 0);
3016         }
3017
3018         do {
3019                 pos = os_strchr(driver, ',');
3020                 if (pos)
3021                         len = pos - driver;
3022                 else
3023                         len = os_strlen(driver);
3024
3025                 for (i = 0; wpa_drivers[i]; i++) {
3026                         if (os_strlen(wpa_drivers[i]->name) == len &&
3027                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3028                             0) {
3029                                 /* First driver that succeeds wins */
3030                                 if (select_driver(wpa_s, i) == 0)
3031                                         return 0;
3032                         }
3033                 }
3034
3035                 driver = pos + 1;
3036         } while (pos);
3037
3038         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3039         return -1;
3040 }
3041
3042
3043 /**
3044  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3045  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3046  *      with struct wpa_driver_ops::init()
3047  * @src_addr: Source address of the EAPOL frame
3048  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3049  * @len: Length of the EAPOL data
3050  *
3051  * This function is called for each received EAPOL frame. Most driver
3052  * interfaces rely on more generic OS mechanism for receiving frames through
3053  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3054  * take care of received EAPOL frames and deliver them to the core supplicant
3055  * code by calling this function.
3056  */
3057 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3058                              const u8 *buf, size_t len)
3059 {
3060         struct wpa_supplicant *wpa_s = ctx;
3061
3062         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3063         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3064
3065 #ifdef CONFIG_PEERKEY
3066         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3067             wpa_s->current_ssid->peerkey &&
3068             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3069             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3070                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3071                 return;
3072         }
3073 #endif /* CONFIG_PEERKEY */
3074
3075         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3076             (wpa_s->last_eapol_matches_bssid &&
3077 #ifdef CONFIG_AP
3078              !wpa_s->ap_iface &&
3079 #endif /* CONFIG_AP */
3080              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3081                 /*
3082                  * There is possible race condition between receiving the
3083                  * association event and the EAPOL frame since they are coming
3084                  * through different paths from the driver. In order to avoid
3085                  * issues in trying to process the EAPOL frame before receiving
3086                  * association information, lets queue it for processing until
3087                  * the association event is received. This may also be needed in
3088                  * driver-based roaming case, so also use src_addr != BSSID as a
3089                  * trigger if we have previously confirmed that the
3090                  * Authenticator uses BSSID as the src_addr (which is not the
3091                  * case with wired IEEE 802.1X).
3092                  */
3093                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3094                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3095                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3096                         MAC2STR(wpa_s->bssid));
3097                 wpabuf_free(wpa_s->pending_eapol_rx);
3098                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3099                 if (wpa_s->pending_eapol_rx) {
3100                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3101                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3102                                   ETH_ALEN);
3103                 }
3104                 return;
3105         }
3106
3107         wpa_s->last_eapol_matches_bssid =
3108                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3109
3110 #ifdef CONFIG_AP
3111         if (wpa_s->ap_iface) {
3112                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3113                 return;
3114         }
3115 #endif /* CONFIG_AP */
3116
3117         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3118                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3119                         "no key management is configured");
3120                 return;
3121         }
3122
3123         if (wpa_s->eapol_received == 0 &&
3124             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3125              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3126              wpa_s->wpa_state != WPA_COMPLETED) &&
3127             (wpa_s->current_ssid == NULL ||
3128              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3129                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3130                 int timeout = 10;
3131
3132                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3133                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3134                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3135                         /* Use longer timeout for IEEE 802.1X/EAP */
3136                         timeout = 70;
3137                 }
3138
3139 #ifdef CONFIG_WPS
3140                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3141                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3142                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3143                         /*
3144                          * Use shorter timeout if going through WPS AP iteration
3145                          * for PIN config method with an AP that does not
3146                          * advertise Selected Registrar.
3147                          */
3148                         struct wpabuf *wps_ie;
3149
3150                         wps_ie = wpa_bss_get_vendor_ie_multi(
3151                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3152                         if (wps_ie &&
3153                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3154                                 timeout = 10;
3155                         wpabuf_free(wps_ie);
3156                 }
3157 #endif /* CONFIG_WPS */
3158
3159                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3160         }
3161         wpa_s->eapol_received++;
3162
3163         if (wpa_s->countermeasures) {
3164                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3165                         "EAPOL packet");
3166                 return;
3167         }
3168
3169 #ifdef CONFIG_IBSS_RSN
3170         if (wpa_s->current_ssid &&
3171             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3172                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3173                 return;
3174         }
3175 #endif /* CONFIG_IBSS_RSN */
3176
3177         /* Source address of the incoming EAPOL frame could be compared to the
3178          * current BSSID. However, it is possible that a centralized
3179          * Authenticator could be using another MAC address than the BSSID of
3180          * an AP, so just allow any address to be used for now. The replies are
3181          * still sent to the current BSSID (if available), though. */
3182
3183         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3184         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3185             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3186                 return;
3187         wpa_drv_poll(wpa_s);
3188         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3189                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3190         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3191                 /*
3192                  * Set portValid = TRUE here since we are going to skip 4-way
3193                  * handshake processing which would normally set portValid. We
3194                  * need this to allow the EAPOL state machines to be completed
3195                  * without going through EAPOL-Key handshake.
3196                  */
3197                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3198         }
3199 }
3200
3201
3202 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3203 {
3204         if ((!wpa_s->p2p_mgmt ||
3205              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3206             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3207                 l2_packet_deinit(wpa_s->l2);
3208                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3209                                            wpa_drv_get_mac_addr(wpa_s),
3210                                            ETH_P_EAPOL,
3211                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3212                 if (wpa_s->l2 == NULL)
3213                         return -1;
3214         } else {
3215                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3216                 if (addr)
3217                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3218         }
3219
3220         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3221                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3222                 return -1;
3223         }
3224
3225         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3226
3227         return 0;
3228 }
3229
3230
3231 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3232                                            const u8 *buf, size_t len)
3233 {
3234         struct wpa_supplicant *wpa_s = ctx;
3235         const struct l2_ethhdr *eth;
3236
3237         if (len < sizeof(*eth))
3238                 return;
3239         eth = (const struct l2_ethhdr *) buf;
3240
3241         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3242             !(eth->h_dest[0] & 0x01)) {
3243                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3244                         " (bridge - not for this interface - ignore)",
3245                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3246                 return;
3247         }
3248
3249         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3250                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3251         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3252                                 len - sizeof(*eth));
3253 }
3254
3255
3256 /**
3257  * wpa_supplicant_driver_init - Initialize driver interface parameters
3258  * @wpa_s: Pointer to wpa_supplicant data
3259  * Returns: 0 on success, -1 on failure
3260  *
3261  * This function is called to initialize driver interface parameters.
3262  * wpa_drv_init() must have been called before this function to initialize the
3263  * driver interface.
3264  */
3265 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3266 {
3267         static int interface_count = 0;
3268
3269         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3270                 return -1;
3271
3272         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3273                 MAC2STR(wpa_s->own_addr));
3274         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3275         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3276
3277         if (wpa_s->bridge_ifname[0]) {
3278                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3279                         "interface '%s'", wpa_s->bridge_ifname);
3280                 wpa_s->l2_br = l2_packet_init_bridge(
3281                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3282                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3283                 if (wpa_s->l2_br == NULL) {
3284                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3285                                 "connection for the bridge interface '%s'",
3286                                 wpa_s->bridge_ifname);
3287                         return -1;
3288                 }
3289         }
3290
3291         wpa_clear_keys(wpa_s, NULL);
3292
3293         /* Make sure that TKIP countermeasures are not left enabled (could
3294          * happen if wpa_supplicant is killed during countermeasures. */
3295         wpa_drv_set_countermeasures(wpa_s, 0);
3296
3297         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3298         wpa_drv_flush_pmkid(wpa_s);
3299
3300         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3301         wpa_s->prev_scan_wildcard = 0;
3302
3303         if (wpa_supplicant_enabled_networks(wpa_s)) {
3304                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3305                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3306                         interface_count = 0;
3307                 }
3308 #ifndef ANDROID
3309                 if (!wpa_s->p2p_mgmt &&
3310                     wpa_supplicant_delayed_sched_scan(wpa_s,
3311                                                       interface_count % 3,
3312                                                       100000))
3313                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3314                                                 100000);
3315 #endif /* ANDROID */
3316                 interface_count++;
3317         } else
3318                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3319
3320         return 0;
3321 }
3322
3323
3324 static int wpa_supplicant_daemon(const char *pid_file)
3325 {
3326         wpa_printf(MSG_DEBUG, "Daemonize..");
3327         return os_daemonize(pid_file);
3328 }
3329
3330
3331 static struct wpa_supplicant *
3332 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3333 {
3334         struct wpa_supplicant *wpa_s;
3335
3336         wpa_s = os_zalloc(sizeof(*wpa_s));
3337         if (wpa_s == NULL)
3338                 return NULL;
3339         wpa_s->scan_req = INITIAL_SCAN_REQ;
3340         wpa_s->scan_interval = 5;
3341         wpa_s->new_connection = 1;
3342         wpa_s->parent = parent ? parent : wpa_s;
3343         wpa_s->sched_scanning = 0;
3344
3345         return wpa_s;
3346 }
3347
3348
3349 #ifdef CONFIG_HT_OVERRIDES
3350
3351 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3352                              struct ieee80211_ht_capabilities *htcaps,
3353                              struct ieee80211_ht_capabilities *htcaps_mask,
3354                              const char *ht_mcs)
3355 {
3356         /* parse ht_mcs into hex array */
3357         int i;
3358         const char *tmp = ht_mcs;
3359         char *end = NULL;
3360
3361         /* If ht_mcs is null, do not set anything */
3362         if (!ht_mcs)
3363                 return 0;
3364
3365         /* This is what we are setting in the kernel */
3366         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3367
3368         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3369
3370         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3371                 errno = 0;
3372                 long v = strtol(tmp, &end, 16);
3373                 if (errno == 0) {
3374                         wpa_msg(wpa_s, MSG_DEBUG,
3375                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3376                                 i, v, end, tmp);
3377                         if (end == tmp)
3378                                 break;
3379
3380                         htcaps->supported_mcs_set[i] = v;
3381                         tmp = end;
3382                 } else {
3383                         wpa_msg(wpa_s, MSG_ERROR,
3384                                 "Failed to parse ht-mcs: %s, error: %s\n",
3385                                 ht_mcs, strerror(errno));
3386                         return -1;
3387                 }
3388         }
3389
3390         /*
3391          * If we were able to parse any values, then set mask for the MCS set.
3392          */
3393         if (i) {
3394                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3395                           IEEE80211_HT_MCS_MASK_LEN - 1);
3396                 /* skip the 3 reserved bits */
3397                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3398                         0x1f;
3399         }
3400
3401         return 0;
3402 }
3403
3404
3405 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3406                                  struct ieee80211_ht_capabilities *htcaps,
3407                                  struct ieee80211_ht_capabilities *htcaps_mask,
3408                                  int disabled)
3409 {
3410         le16 msk;
3411
3412         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3413
3414         if (disabled == -1)
3415                 return 0;
3416
3417         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3418         htcaps_mask->ht_capabilities_info |= msk;
3419         if (disabled)
3420                 htcaps->ht_capabilities_info &= msk;
3421         else
3422                 htcaps->ht_capabilities_info |= msk;
3423
3424         return 0;
3425 }
3426
3427
3428 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3429                                 struct ieee80211_ht_capabilities *htcaps,
3430                                 struct ieee80211_ht_capabilities *htcaps_mask,
3431                                 int factor)
3432 {
3433         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3434
3435         if (factor == -1)
3436                 return 0;
3437
3438         if (factor < 0 || factor > 3) {
3439                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3440                         "Must be 0-3 or -1", factor);
3441                 return -EINVAL;
3442         }
3443
3444         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3445         htcaps->a_mpdu_params &= ~0x3;
3446         htcaps->a_mpdu_params |= factor & 0x3;
3447
3448         return 0;
3449 }
3450
3451
3452 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3453                                  struct ieee80211_ht_capabilities *htcaps,
3454                                  struct ieee80211_ht_capabilities *htcaps_mask,
3455                                  int density)
3456 {
3457         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3458
3459         if (density == -1)
3460                 return 0;
3461
3462         if (density < 0 || density > 7) {
3463                 wpa_msg(wpa_s, MSG_ERROR,
3464                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3465                         density);
3466                 return -EINVAL;
3467         }
3468
3469         htcaps_mask->a_mpdu_params |= 0x1C;
3470         htcaps->a_mpdu_params &= ~(0x1C);
3471         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3472
3473         return 0;
3474 }
3475
3476
3477 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3478                                 struct ieee80211_ht_capabilities *htcaps,
3479                                 struct ieee80211_ht_capabilities *htcaps_mask,
3480                                 int disabled)
3481 {
3482         /* Masking these out disables HT40 */
3483         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3484                                 HT_CAP_INFO_SHORT_GI40MHZ);
3485
3486         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3487
3488         if (disabled)
3489                 htcaps->ht_capabilities_info &= ~msk;
3490         else
3491                 htcaps->ht_capabilities_info |= msk;
3492
3493         htcaps_mask->ht_capabilities_info |= msk;
3494
3495         return 0;
3496 }
3497
3498
3499 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3500                                struct ieee80211_ht_capabilities *htcaps,
3501                                struct ieee80211_ht_capabilities *htcaps_mask,
3502                                int disabled)
3503 {
3504         /* Masking these out disables SGI */
3505         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3506                                 HT_CAP_INFO_SHORT_GI40MHZ);
3507
3508         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3509
3510         if (disabled)
3511                 htcaps->ht_capabilities_info &= ~msk;
3512         else
3513                 htcaps->ht_capabilities_info |= msk;
3514
3515         htcaps_mask->ht_capabilities_info |= msk;
3516
3517         return 0;
3518 }
3519
3520
3521 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3522                                struct ieee80211_ht_capabilities *htcaps,
3523                                struct ieee80211_ht_capabilities *htcaps_mask,
3524                                int disabled)
3525 {
3526         /* Masking these out disables LDPC */
3527         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3528
3529         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3530
3531         if (disabled)
3532                 htcaps->ht_capabilities_info &= ~msk;
3533         else
3534                 htcaps->ht_capabilities_info |= msk;
3535
3536         htcaps_mask->ht_capabilities_info |= msk;
3537
3538         return 0;
3539 }
3540
3541
3542 void wpa_supplicant_apply_ht_overrides(
3543         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3544         struct wpa_driver_associate_params *params)
3545 {
3546         struct ieee80211_ht_capabilities *htcaps;
3547         struct ieee80211_ht_capabilities *htcaps_mask;
3548
3549         if (!ssid)
3550                 return;
3551
3552         params->disable_ht = ssid->disable_ht;
3553         if (!params->htcaps || !params->htcaps_mask)
3554                 return;
3555
3556         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3557         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3558         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3559         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3560                               ssid->disable_max_amsdu);
3561         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3562         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3563         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3564         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3565         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3566
3567         if (ssid->ht40_intolerant) {
3568                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3569                 htcaps->ht_capabilities_info |= bit;
3570                 htcaps_mask->ht_capabilities_info |= bit;
3571         }
3572 }
3573
3574 #endif /* CONFIG_HT_OVERRIDES */
3575
3576
3577 #ifdef CONFIG_VHT_OVERRIDES
3578 void wpa_supplicant_apply_vht_overrides(
3579         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3580         struct wpa_driver_associate_params *params)
3581 {
3582         struct ieee80211_vht_capabilities *vhtcaps;
3583         struct ieee80211_vht_capabilities *vhtcaps_mask;
3584
3585         if (!ssid)
3586                 return;
3587
3588         params->disable_vht = ssid->disable_vht;
3589
3590         vhtcaps = (void *) params->vhtcaps;
3591         vhtcaps_mask = (void *) params->vhtcaps_mask;
3592
3593         if (!vhtcaps || !vhtcaps_mask)
3594                 return;
3595
3596         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3597         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3598
3599 #ifdef CONFIG_HT_OVERRIDES
3600         /* if max ampdu is <= 3, we have to make the HT cap the same */
3601         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3602                 int max_ampdu;
3603
3604                 max_ampdu = (ssid->vht_capa &
3605                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3606                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3607
3608                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3609                 wpa_set_ampdu_factor(wpa_s,
3610                                      (void *) params->htcaps,
3611                                      (void *) params->htcaps_mask,
3612                                      max_ampdu);
3613         }
3614 #endif /* CONFIG_HT_OVERRIDES */
3615
3616 #define OVERRIDE_MCS(i)                                                 \
3617         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3618                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3619                         3 << 2 * (i - 1);                               \
3620                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3621                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3622         }                                                               \
3623         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3624                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3625                         3 << 2 * (i - 1);                               \
3626                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3627                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3628         }
3629
3630         OVERRIDE_MCS(1);
3631         OVERRIDE_MCS(2);
3632         OVERRIDE_MCS(3);
3633         OVERRIDE_MCS(4);
3634         OVERRIDE_MCS(5);
3635         OVERRIDE_MCS(6);
3636         OVERRIDE_MCS(7);
3637         OVERRIDE_MCS(8);
3638 }
3639 #endif /* CONFIG_VHT_OVERRIDES */
3640
3641
3642 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3643 {
3644 #ifdef PCSC_FUNCS
3645         size_t len;
3646
3647         if (!wpa_s->conf->pcsc_reader)
3648                 return 0;
3649
3650         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3651         if (!wpa_s->scard)
3652                 return 1;
3653
3654         if (wpa_s->conf->pcsc_pin &&
3655             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3656                 scard_deinit(wpa_s->scard);
3657                 wpa_s->scard = NULL;
3658                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3659                 return -1;
3660         }
3661
3662         len = sizeof(wpa_s->imsi) - 1;
3663         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3664                 scard_deinit(wpa_s->scard);
3665                 wpa_s->scard = NULL;
3666                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3667                 return -1;
3668         }
3669         wpa_s->imsi[len] = '\0';
3670
3671         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3672
3673         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3674                    wpa_s->imsi, wpa_s->mnc_len);
3675
3676         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3677         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3678 #endif /* PCSC_FUNCS */
3679
3680         return 0;
3681 }
3682
3683
3684 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3685 {
3686         char *val, *pos;
3687
3688         ext_password_deinit(wpa_s->ext_pw);
3689         wpa_s->ext_pw = NULL;
3690         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3691
3692         if (!wpa_s->conf->ext_password_backend)
3693                 return 0;
3694
3695         val = os_strdup(wpa_s->conf->ext_password_backend);
3696         if (val == NULL)
3697                 return -1;
3698         pos = os_strchr(val, ':');
3699         if (pos)
3700                 *pos++ = '\0';
3701
3702         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3703
3704         wpa_s->ext_pw = ext_password_init(val, pos);
3705         os_free(val);
3706         if (wpa_s->ext_pw == NULL) {
3707                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3708                 return -1;
3709         }
3710         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3711
3712         return 0;
3713 }
3714
3715
3716 #ifdef CONFIG_FST
3717
3718 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3719 {
3720         struct wpa_supplicant *wpa_s = ctx;
3721
3722         return (is_zero_ether_addr(wpa_s->bssid) ||
3723                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3724 }
3725
3726
3727 static void wpas_fst_get_channel_info_cb(void *ctx,
3728                                          enum hostapd_hw_mode *hw_mode,
3729                                          u8 *channel)
3730 {
3731         struct wpa_supplicant *wpa_s = ctx;
3732
3733         if (wpa_s->current_bss) {
3734                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3735                                                   channel);
3736         } else if (wpa_s->hw.num_modes) {
3737                 *hw_mode = wpa_s->hw.modes[0].mode;
3738         } else {
3739                 WPA_ASSERT(0);
3740                 *hw_mode = 0;
3741         }
3742 }
3743
3744
3745 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3746 {
3747         struct wpa_supplicant *wpa_s = ctx;
3748
3749         *modes = wpa_s->hw.modes;
3750         return wpa_s->hw.num_modes;
3751 }
3752
3753
3754 static void wpas_fst_set_ies_cb(void *ctx, struct wpabuf *fst_ies)
3755 {
3756         struct wpa_supplicant *wpa_s = ctx;
3757
3758         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3759         wpa_s->fst_ies = fst_ies;
3760 }
3761
3762
3763 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3764 {
3765         struct wpa_supplicant *wpa_s = ctx;
3766
3767         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3768         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3769                                           wpa_s->own_addr, wpa_s->bssid,
3770                                           wpabuf_head(data), wpabuf_len(data),
3771                                    0);
3772 }
3773
3774
3775 static struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3776 {
3777         struct wpa_supplicant *wpa_s = ctx;
3778
3779         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3780         return wpa_s->received_mb_ies;
3781 }
3782
3783
3784 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3785                                      const u8 *buf, size_t size)
3786 {
3787         struct wpa_supplicant *wpa_s = ctx;
3788         struct mb_ies_info info;
3789
3790         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3791
3792         if (!mb_ies_info_by_ies(&info, buf, size)) {
3793                 wpabuf_free(wpa_s->received_mb_ies);
3794                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3795         }
3796 }
3797
3798
3799 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3800                                    Boolean mb_only)
3801 {
3802         struct wpa_supplicant *wpa_s = ctx;
3803
3804         *get_ctx = NULL;
3805         if (!is_zero_ether_addr(wpa_s->bssid))
3806                 return (wpa_s->received_mb_ies || !mb_only) ?
3807                         wpa_s->bssid : NULL;
3808         return NULL;
3809 }
3810
3811
3812 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3813                                   Boolean mb_only)
3814 {
3815         return NULL;
3816 }
3817
3818 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3819                                        struct fst_wpa_obj *iface_obj)
3820 {
3821         iface_obj->ctx              = wpa_s;
3822         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3823         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3824         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3825         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3826         iface_obj->send_action      = wpas_fst_send_action_cb;
3827         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3828         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3829         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3830         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3831 }
3832 #endif /* CONFIG_FST */
3833
3834 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3835                                     const struct wpa_driver_capa *capa)
3836 {
3837         struct wowlan_triggers *triggers;
3838         int ret = 0;
3839
3840         if (!wpa_s->conf->wowlan_triggers)
3841                 return 0;
3842
3843         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3844         if (triggers) {
3845                 ret = wpa_drv_wowlan(wpa_s, triggers);
3846                 os_free(triggers);
3847         }
3848         return ret;
3849 }
3850
3851
3852 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3853                                               const char *rn)
3854 {
3855         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3856         struct wpa_radio *radio;
3857
3858         while (rn && iface) {
3859                 radio = iface->radio;
3860                 if (radio && os_strcmp(rn, radio->name) == 0) {
3861                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3862                                    wpa_s->ifname, rn);
3863                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3864                         return radio;
3865                 }
3866
3867                 iface = iface->next;
3868         }
3869
3870         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3871                    wpa_s->ifname, rn ? rn : "N/A");
3872         radio = os_zalloc(sizeof(*radio));
3873         if (radio == NULL)
3874                 return NULL;
3875
3876         if (rn)
3877                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3878         dl_list_init(&radio->ifaces);
3879         dl_list_init(&radio->work);
3880         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3881
3882         return radio;
3883 }
3884
3885
3886 static void radio_work_free(struct wpa_radio_work *work)
3887 {
3888         if (work->wpa_s->scan_work == work) {
3889                 /* This should not really happen. */
3890                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3891                         work->type, work, work->started);
3892                 work->wpa_s->scan_work = NULL;
3893         }
3894
3895 #ifdef CONFIG_P2P
3896         if (work->wpa_s->p2p_scan_work == work) {
3897                 /* This should not really happen. */
3898                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3899                         work->type, work, work->started);
3900                 work->wpa_s->p2p_scan_work = NULL;
3901         }
3902 #endif /* CONFIG_P2P */
3903
3904         dl_list_del(&work->list);
3905         os_free(work);
3906 }
3907
3908
3909 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3910 {
3911         struct wpa_radio *radio = eloop_ctx;
3912         struct wpa_radio_work *work;
3913         struct os_reltime now, diff;
3914         struct wpa_supplicant *wpa_s;
3915
3916         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3917         if (work == NULL)
3918                 return;
3919
3920         if (work->started)
3921                 return; /* already started and still in progress */
3922
3923         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3924                               radio_list);
3925         if (wpa_s && wpa_s->radio->external_scan_running) {
3926                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3927                 return;
3928         }
3929
3930         os_get_reltime(&now);
3931         os_reltime_sub(&now, &work->time, &diff);
3932         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3933                 work->type, work, diff.sec, diff.usec);
3934         work->started = 1;
3935         work->time = now;
3936         work->cb(work, 0);
3937 }
3938
3939
3940 /*
3941  * This function removes both started and pending radio works running on
3942  * the provided interface's radio.
3943  * Prior to the removal of the radio work, its callback (cb) is called with
3944  * deinit set to be 1. Each work's callback is responsible for clearing its
3945  * internal data and restoring to a correct state.
3946  * @wpa_s: wpa_supplicant data
3947  * @type: type of works to be removed
3948  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3949  * this interface's works.
3950  */
3951 void radio_remove_works(struct wpa_supplicant *wpa_s,
3952                         const char *type, int remove_all)
3953 {
3954         struct wpa_radio_work *work, *tmp;
3955         struct wpa_radio *radio = wpa_s->radio;
3956
3957         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3958                               list) {
3959                 if (type && os_strcmp(type, work->type) != 0)
3960                         continue;
3961
3962                 /* skip other ifaces' works */
3963                 if (!remove_all && work->wpa_s != wpa_s)
3964                         continue;
3965
3966                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3967                         work->type, work, work->started ? " (started)" : "");
3968                 work->cb(work, 1);
3969                 radio_work_free(work);
3970         }
3971
3972         /* in case we removed the started work */
3973         radio_work_check_next(wpa_s);
3974 }
3975
3976
3977 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3978 {
3979         struct wpa_radio *radio = wpa_s->radio;
3980
3981         if (!radio)
3982                 return;
3983
3984         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3985                    wpa_s->ifname, radio->name);
3986         dl_list_del(&wpa_s->radio_list);
3987         radio_remove_works(wpa_s, NULL, 0);
3988         wpa_s->radio = NULL;
3989         if (!dl_list_empty(&radio->ifaces))
3990                 return; /* Interfaces remain for this radio */
3991
3992         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3993         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3994         os_free(radio);
3995 }
3996
3997
3998 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3999 {
4000         struct wpa_radio *radio = wpa_s->radio;
4001
4002         if (dl_list_empty(&radio->work))
4003                 return;
4004         if (wpa_s->ext_work_in_progress) {
4005                 wpa_printf(MSG_DEBUG,
4006                            "External radio work in progress - delay start of pending item");
4007                 return;
4008         }
4009         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4010         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4011 }
4012
4013
4014 /**
4015  * radio_add_work - Add a radio work item
4016  * @wpa_s: Pointer to wpa_supplicant data
4017  * @freq: Frequency of the offchannel operation in MHz or 0
4018  * @type: Unique identifier for each type of work
4019  * @next: Force as the next work to be executed
4020  * @cb: Callback function for indicating when radio is available
4021  * @ctx: Context pointer for the work (work->ctx in cb())
4022  * Returns: 0 on success, -1 on failure
4023  *
4024  * This function is used to request time for an operation that requires
4025  * exclusive radio control. Once the radio is available, the registered callback
4026  * function will be called. radio_work_done() must be called once the exclusive
4027  * radio operation has been completed, so that the radio is freed for other
4028  * operations. The special case of deinit=1 is used to free the context data
4029  * during interface removal. That does not allow the callback function to start
4030  * the radio operation, i.e., it must free any resources allocated for the radio
4031  * work and return.
4032  *
4033  * The @freq parameter can be used to indicate a single channel on which the
4034  * offchannel operation will occur. This may allow multiple radio work
4035  * operations to be performed in parallel if they apply for the same channel.
4036  * Setting this to 0 indicates that the work item may use multiple channels or
4037  * requires exclusive control of the radio.
4038  */
4039 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4040                    const char *type, int next,
4041                    void (*cb)(struct wpa_radio_work *work, int deinit),
4042                    void *ctx)
4043 {
4044         struct wpa_radio_work *work;
4045         int was_empty;
4046
4047         work = os_zalloc(sizeof(*work));
4048         if (work == NULL)
4049                 return -1;
4050         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4051         os_get_reltime(&work->time);
4052         work->freq = freq;
4053         work->type = type;
4054         work->wpa_s = wpa_s;
4055         work->cb = cb;
4056         work->ctx = ctx;
4057
4058         was_empty = dl_list_empty(&wpa_s->radio->work);
4059         if (next)
4060                 dl_list_add(&wpa_s->radio->work, &work->list);
4061         else
4062                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4063         if (was_empty) {
4064                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4065                 radio_work_check_next(wpa_s);
4066         }
4067
4068         return 0;
4069 }
4070
4071
4072 /**
4073  * radio_work_done - Indicate that a radio work item has been completed
4074  * @work: Completed work
4075  *
4076  * This function is called once the callback function registered with
4077  * radio_add_work() has completed its work.
4078  */
4079 void radio_work_done(struct wpa_radio_work *work)
4080 {
4081         struct wpa_supplicant *wpa_s = work->wpa_s;
4082         struct os_reltime now, diff;
4083         unsigned int started = work->started;
4084
4085         os_get_reltime(&now);
4086         os_reltime_sub(&now, &work->time, &diff);
4087         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4088                 work->type, work, started ? "done" : "canceled",
4089                 diff.sec, diff.usec);
4090         radio_work_free(work);
4091         if (started)
4092                 radio_work_check_next(wpa_s);
4093 }
4094
4095
4096 struct wpa_radio_work *
4097 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4098 {
4099         struct wpa_radio_work *work;
4100         struct wpa_radio *radio = wpa_s->radio;
4101
4102         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4103                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4104                         return work;
4105         }
4106
4107         return NULL;
4108 }
4109
4110
4111 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4112                             struct wpa_interface *iface)
4113 {
4114         const char *ifname, *driver, *rn;
4115
4116         driver = iface->driver;
4117 next_driver:
4118         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4119                 return -1;
4120
4121         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4122         if (wpa_s->drv_priv == NULL) {
4123                 const char *pos;
4124                 pos = driver ? os_strchr(driver, ',') : NULL;
4125                 if (pos) {
4126                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4127                                 "driver interface - try next driver wrapper");
4128                         driver = pos + 1;
4129                         goto next_driver;
4130                 }
4131                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4132                         "interface");
4133                 return -1;
4134         }
4135         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4136                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4137                         "driver_param '%s'", wpa_s->conf->driver_param);
4138                 return -1;
4139         }
4140
4141         ifname = wpa_drv_get_ifname(wpa_s);
4142         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4143                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4144                         "interface name with '%s'", ifname);
4145                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4146         }
4147
4148         rn = wpa_driver_get_radio_name(wpa_s);
4149         if (rn && rn[0] == '\0')
4150                 rn = NULL;
4151
4152         wpa_s->radio = radio_add_interface(wpa_s, rn);
4153         if (wpa_s->radio == NULL)
4154                 return -1;
4155
4156         return 0;
4157 }
4158
4159
4160 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4161                                      struct wpa_interface *iface)
4162 {
4163         struct wpa_driver_capa capa;
4164         int capa_res;
4165
4166         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4167                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4168                    iface->confname ? iface->confname : "N/A",
4169                    iface->driver ? iface->driver : "default",
4170                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4171                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4172
4173         if (iface->confname) {
4174 #ifdef CONFIG_BACKEND_FILE
4175                 wpa_s->confname = os_rel2abs_path(iface->confname);
4176                 if (wpa_s->confname == NULL) {
4177                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4178                                    "for configuration file '%s'.",
4179                                    iface->confname);
4180                         return -1;
4181                 }
4182                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4183                            iface->confname, wpa_s->confname);
4184 #else /* CONFIG_BACKEND_FILE */
4185                 wpa_s->confname = os_strdup(iface->confname);
4186 #endif /* CONFIG_BACKEND_FILE */
4187                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4188                 if (wpa_s->conf == NULL) {
4189                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4190                                    "configuration '%s'.", wpa_s->confname);
4191                         return -1;
4192                 }
4193                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4194                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4195
4196                 /*
4197                  * Override ctrl_interface and driver_param if set on command
4198                  * line.
4199                  */
4200                 if (iface->ctrl_interface) {
4201                         os_free(wpa_s->conf->ctrl_interface);
4202                         wpa_s->conf->ctrl_interface =
4203                                 os_strdup(iface->ctrl_interface);
4204                 }
4205
4206                 if (iface->driver_param) {
4207                         os_free(wpa_s->conf->driver_param);
4208                         wpa_s->conf->driver_param =
4209                                 os_strdup(iface->driver_param);
4210                 }
4211
4212                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4213                         os_free(wpa_s->conf->ctrl_interface);
4214                         wpa_s->conf->ctrl_interface = NULL;
4215                 }
4216         } else
4217                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4218                                                      iface->driver_param);
4219
4220         if (wpa_s->conf == NULL) {
4221                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4222                 return -1;
4223         }
4224
4225         if (iface->ifname == NULL) {
4226                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4227                 return -1;
4228         }
4229         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4230                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4231                            iface->ifname);
4232                 return -1;
4233         }
4234         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4235
4236         if (iface->bridge_ifname) {
4237                 if (os_strlen(iface->bridge_ifname) >=
4238                     sizeof(wpa_s->bridge_ifname)) {
4239                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4240                                    "name '%s'.", iface->bridge_ifname);
4241                         return -1;
4242                 }
4243                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4244                            sizeof(wpa_s->bridge_ifname));
4245         }
4246
4247         /* RSNA Supplicant Key Management - INITIALIZE */
4248         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4249         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4250
4251         /* Initialize driver interface and register driver event handler before
4252          * L2 receive handler so that association events are processed before
4253          * EAPOL-Key packets if both become available for the same select()
4254          * call. */
4255         if (wpas_init_driver(wpa_s, iface) < 0)
4256                 return -1;
4257
4258         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4259                 return -1;
4260
4261         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4262                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4263                           NULL);
4264         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4265
4266         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4267             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4268                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4269                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4270                         "dot11RSNAConfigPMKLifetime");
4271                 return -1;
4272         }
4273
4274         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4275             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4276                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4277                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4278                         "dot11RSNAConfigPMKReauthThreshold");
4279                 return -1;
4280         }
4281
4282         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4283             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4284                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4285                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4286                         "dot11RSNAConfigSATimeout");
4287                 return -1;
4288         }
4289
4290         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4291                                                       &wpa_s->hw.num_modes,
4292                                                       &wpa_s->hw.flags);
4293         if (wpa_s->hw.modes) {
4294                 u16 i;
4295
4296                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4297                         if (wpa_s->hw.modes[i].vht_capab) {
4298                                 wpa_s->hw_capab = CAPAB_VHT;
4299                                 break;
4300                         }
4301
4302                         if (wpa_s->hw.modes[i].ht_capab &
4303                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4304                                 wpa_s->hw_capab = CAPAB_HT40;
4305                         else if (wpa_s->hw.modes[i].ht_capab &&
4306                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4307                                 wpa_s->hw_capab = CAPAB_HT;
4308                 }
4309         }
4310
4311         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4312         if (capa_res == 0) {
4313                 wpa_s->drv_capa_known = 1;
4314                 wpa_s->drv_flags = capa.flags;
4315                 wpa_s->drv_enc = capa.enc;
4316                 wpa_s->drv_smps_modes = capa.smps_modes;
4317                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4318                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4319                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4320                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4321                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4322                 wpa_s->max_match_sets = capa.max_match_sets;
4323                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4324                 wpa_s->max_stations = capa.max_stations;
4325                 wpa_s->extended_capa = capa.extended_capa;
4326                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4327                 wpa_s->extended_capa_len = capa.extended_capa_len;
4328                 wpa_s->num_multichan_concurrent =
4329                         capa.num_multichan_concurrent;
4330                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4331
4332                 if (capa.mac_addr_rand_scan_supported)
4333                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4334                 if (wpa_s->sched_scan_supported &&
4335                     capa.mac_addr_rand_sched_scan_supported)
4336                         wpa_s->mac_addr_rand_supported |=
4337                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4338         }
4339         if (wpa_s->max_remain_on_chan == 0)
4340                 wpa_s->max_remain_on_chan = 1000;
4341
4342         /*
4343          * Only take p2p_mgmt parameters when P2P Device is supported.
4344          * Doing it here as it determines whether l2_packet_init() will be done
4345          * during wpa_supplicant_driver_init().
4346          */
4347         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4348                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4349         else
4350                 iface->p2p_mgmt = 1;
4351
4352         if (wpa_s->num_multichan_concurrent == 0)
4353                 wpa_s->num_multichan_concurrent = 1;
4354
4355         if (wpa_supplicant_driver_init(wpa_s) < 0)
4356                 return -1;
4357
4358 #ifdef CONFIG_TDLS
4359         if ((!iface->p2p_mgmt ||
4360              !(wpa_s->drv_flags &
4361                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4362             wpa_tdls_init(wpa_s->wpa))
4363                 return -1;
4364 #endif /* CONFIG_TDLS */
4365
4366         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4367             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4368                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4369                 return -1;
4370         }
4371
4372 #ifdef CONFIG_FST
4373         if (wpa_s->conf->fst_group_id) {
4374                 struct fst_iface_cfg cfg;
4375                 struct fst_wpa_obj iface_obj;
4376
4377                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4378                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4379                            sizeof(cfg.group_id));
4380                 cfg.priority = wpa_s->conf->fst_priority;
4381                 cfg.llt = wpa_s->conf->fst_llt;
4382
4383                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4384                                         &iface_obj, &cfg);
4385                 if (!wpa_s->fst) {
4386                         wpa_msg(wpa_s, MSG_ERROR,
4387                                 "FST: Cannot attach iface %s to group %s",
4388                                 wpa_s->ifname, cfg.group_id);
4389                         return -1;
4390                 }
4391         }
4392 #endif /* CONFIG_FST */
4393
4394         if (wpas_wps_init(wpa_s))
4395                 return -1;
4396
4397         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4398                 return -1;
4399         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4400
4401         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4402         if (wpa_s->ctrl_iface == NULL) {
4403                 wpa_printf(MSG_ERROR,
4404                            "Failed to initialize control interface '%s'.\n"
4405                            "You may have another wpa_supplicant process "
4406                            "already running or the file was\n"
4407                            "left by an unclean termination of wpa_supplicant "
4408                            "in which case you will need\n"
4409                            "to manually remove this file before starting "
4410                            "wpa_supplicant again.\n",
4411                            wpa_s->conf->ctrl_interface);
4412                 return -1;
4413         }
4414
4415         wpa_s->gas = gas_query_init(wpa_s);
4416         if (wpa_s->gas == NULL) {
4417                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4418                 return -1;
4419         }
4420
4421         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4422                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4423                 return -1;
4424         }
4425
4426         if (wpa_bss_init(wpa_s) < 0)
4427                 return -1;
4428
4429         /*
4430          * Set Wake-on-WLAN triggers, if configured.
4431          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4432          * have effect anyway when the interface is down).
4433          */
4434         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4435                 return -1;
4436
4437 #ifdef CONFIG_EAP_PROXY
4438 {
4439         size_t len;
4440         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4441                                                      &len);
4442         if (wpa_s->mnc_len > 0) {
4443                 wpa_s->imsi[len] = '\0';
4444                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4445                            wpa_s->imsi, wpa_s->mnc_len);
4446         } else {
4447                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4448         }
4449 }
4450 #endif /* CONFIG_EAP_PROXY */
4451
4452         if (pcsc_reader_init(wpa_s) < 0)
4453                 return -1;
4454
4455         if (wpas_init_ext_pw(wpa_s) < 0)
4456                 return -1;
4457
4458         wpas_rrm_reset(wpa_s);
4459
4460         return 0;
4461 }
4462
4463
4464 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4465                                         int notify, int terminate)
4466 {
4467         struct wpa_global *global = wpa_s->global;
4468         struct wpa_supplicant *iface, *prev;
4469
4470         if (wpa_s == wpa_s->parent)
4471                 wpas_p2p_group_remove(wpa_s, "*");
4472
4473         iface = global->ifaces;
4474         while (iface) {
4475                 if (iface == wpa_s || iface->parent != wpa_s) {
4476                         iface = iface->next;
4477                         continue;
4478                 }
4479                 wpa_printf(MSG_DEBUG,
4480                            "Remove remaining child interface %s from parent %s",
4481                            iface->ifname, wpa_s->ifname);
4482                 prev = iface;
4483                 iface = iface->next;
4484                 wpa_supplicant_remove_iface(global, prev, terminate);
4485         }
4486
4487         wpa_s->disconnected = 1;
4488         if (wpa_s->drv_priv) {
4489                 wpa_supplicant_deauthenticate(wpa_s,
4490                                               WLAN_REASON_DEAUTH_LEAVING);
4491
4492                 wpa_drv_set_countermeasures(wpa_s, 0);
4493                 wpa_clear_keys(wpa_s, NULL);
4494         }
4495
4496         wpa_supplicant_cleanup(wpa_s);
4497         wpas_p2p_deinit_iface(wpa_s);
4498
4499         wpas_ctrl_radio_work_flush(wpa_s);
4500         radio_remove_interface(wpa_s);
4501
4502 #ifdef CONFIG_FST
4503         if (wpa_s->fst) {
4504                 fst_detach(wpa_s->fst);
4505                 wpa_s->fst = NULL;
4506         }
4507         if (wpa_s->received_mb_ies) {
4508                 wpabuf_free(wpa_s->received_mb_ies);
4509                 wpa_s->received_mb_ies = NULL;
4510         }
4511 #endif /* CONFIG_FST */
4512
4513         if (wpa_s->drv_priv)
4514                 wpa_drv_deinit(wpa_s);
4515
4516         if (notify)
4517                 wpas_notify_iface_removed(wpa_s);
4518
4519         if (terminate)
4520                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4521
4522         if (wpa_s->ctrl_iface) {
4523                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4524                 wpa_s->ctrl_iface = NULL;
4525         }
4526
4527 #ifdef CONFIG_MESH
4528         if (wpa_s->ifmsh) {
4529                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4530                 wpa_s->ifmsh = NULL;
4531         }
4532 #endif /* CONFIG_MESH */
4533
4534         if (wpa_s->conf != NULL) {
4535                 wpa_config_free(wpa_s->conf);
4536                 wpa_s->conf = NULL;
4537         }
4538
4539         os_free(wpa_s->ssids_from_scan_req);
4540
4541         os_free(wpa_s);
4542 }
4543
4544
4545 /**
4546  * wpa_supplicant_add_iface - Add a new network interface
4547  * @global: Pointer to global data from wpa_supplicant_init()
4548  * @iface: Interface configuration options
4549  * @parent: Parent interface or %NULL to assign new interface as parent
4550  * Returns: Pointer to the created interface or %NULL on failure
4551  *
4552  * This function is used to add new network interfaces for %wpa_supplicant.
4553  * This can be called before wpa_supplicant_run() to add interfaces before the
4554  * main event loop has been started. In addition, new interfaces can be added
4555  * dynamically while %wpa_supplicant is already running. This could happen,
4556  * e.g., when a hotplug network adapter is inserted.
4557  */
4558 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4559                                                  struct wpa_interface *iface,
4560                                                  struct wpa_supplicant *parent)
4561 {
4562         struct wpa_supplicant *wpa_s;
4563         struct wpa_interface t_iface;
4564         struct wpa_ssid *ssid;
4565
4566         if (global == NULL || iface == NULL)
4567                 return NULL;
4568
4569         wpa_s = wpa_supplicant_alloc(parent);
4570         if (wpa_s == NULL)
4571                 return NULL;
4572
4573         wpa_s->global = global;
4574
4575         t_iface = *iface;
4576         if (global->params.override_driver) {
4577                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4578                            "('%s' -> '%s')",
4579                            iface->driver, global->params.override_driver);
4580                 t_iface.driver = global->params.override_driver;
4581         }
4582         if (global->params.override_ctrl_interface) {
4583                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4584                            "ctrl_interface ('%s' -> '%s')",
4585                            iface->ctrl_interface,
4586                            global->params.override_ctrl_interface);
4587                 t_iface.ctrl_interface =
4588                         global->params.override_ctrl_interface;
4589         }
4590         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4591                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4592                            iface->ifname);
4593                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4594                 return NULL;
4595         }
4596
4597         if (iface->p2p_mgmt == 0) {
4598                 /* Notify the control interfaces about new iface */
4599                 if (wpas_notify_iface_added(wpa_s)) {
4600                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4601                         return NULL;
4602                 }
4603
4604                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4605                         wpas_notify_network_added(wpa_s, ssid);
4606         }
4607
4608         wpa_s->next = global->ifaces;
4609         global->ifaces = wpa_s;
4610
4611         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4612         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4613
4614 #ifdef CONFIG_P2P
4615         if (wpa_s->global->p2p == NULL &&
4616             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4617             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4618             wpas_p2p_add_p2pdev_interface(
4619                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4620                 wpa_printf(MSG_INFO,
4621                            "P2P: Failed to enable P2P Device interface");
4622                 /* Try to continue without. P2P will be disabled. */
4623         }
4624 #endif /* CONFIG_P2P */
4625
4626         return wpa_s;
4627 }
4628
4629
4630 /**
4631  * wpa_supplicant_remove_iface - Remove a network interface
4632  * @global: Pointer to global data from wpa_supplicant_init()
4633  * @wpa_s: Pointer to the network interface to be removed
4634  * Returns: 0 if interface was removed, -1 if interface was not found
4635  *
4636  * This function can be used to dynamically remove network interfaces from
4637  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4638  * addition, this function is used to remove all remaining interfaces when
4639  * %wpa_supplicant is terminated.
4640  */
4641 int wpa_supplicant_remove_iface(struct wpa_global *global,
4642                                 struct wpa_supplicant *wpa_s,
4643                                 int terminate)
4644 {
4645         struct wpa_supplicant *prev;
4646 #ifdef CONFIG_MESH
4647         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4648         char *ifname = NULL;
4649 #endif /* CONFIG_MESH */
4650
4651         /* Remove interface from the global list of interfaces */
4652         prev = global->ifaces;
4653         if (prev == wpa_s) {
4654                 global->ifaces = wpa_s->next;
4655         } else {
4656                 while (prev && prev->next != wpa_s)
4657                         prev = prev->next;
4658                 if (prev == NULL)
4659                         return -1;
4660                 prev->next = wpa_s->next;
4661         }
4662
4663         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4664
4665 #ifdef CONFIG_MESH
4666         if (mesh_if_created) {
4667                 ifname = os_strdup(wpa_s->ifname);
4668                 if (ifname == NULL) {
4669                         wpa_dbg(wpa_s, MSG_ERROR,
4670                                 "mesh: Failed to malloc ifname");
4671                         return -1;
4672                 }
4673         }
4674 #endif /* CONFIG_MESH */
4675
4676         if (global->p2p_group_formation == wpa_s)
4677                 global->p2p_group_formation = NULL;
4678         if (global->p2p_invite_group == wpa_s)
4679                 global->p2p_invite_group = NULL;
4680         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4681
4682 #ifdef CONFIG_MESH
4683         if (mesh_if_created) {
4684                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4685                 os_free(ifname);
4686         }
4687 #endif /* CONFIG_MESH */
4688
4689         return 0;
4690 }
4691
4692
4693 /**
4694  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4695  * @wpa_s: Pointer to the network interface
4696  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4697  */
4698 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4699 {
4700         const char *eapol_method;
4701
4702         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4703             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4704                 return "NO-EAP";
4705         }
4706
4707         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4708         if (eapol_method == NULL)
4709                 return "UNKNOWN-EAP";
4710
4711         return eapol_method;
4712 }
4713
4714
4715 /**
4716  * wpa_supplicant_get_iface - Get a new network interface
4717  * @global: Pointer to global data from wpa_supplicant_init()
4718  * @ifname: Interface name
4719  * Returns: Pointer to the interface or %NULL if not found
4720  */
4721 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4722                                                  const char *ifname)
4723 {
4724         struct wpa_supplicant *wpa_s;
4725
4726         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4727                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4728                         return wpa_s;
4729         }
4730         return NULL;
4731 }
4732
4733
4734 #ifndef CONFIG_NO_WPA_MSG
4735 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4736 {
4737         struct wpa_supplicant *wpa_s = ctx;
4738         if (wpa_s == NULL)
4739                 return NULL;
4740         return wpa_s->ifname;
4741 }
4742 #endif /* CONFIG_NO_WPA_MSG */
4743
4744
4745 /**
4746  * wpa_supplicant_init - Initialize %wpa_supplicant
4747  * @params: Parameters for %wpa_supplicant
4748  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4749  *
4750  * This function is used to initialize %wpa_supplicant. After successful
4751  * initialization, the returned data pointer can be used to add and remove
4752  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4753  */
4754 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4755 {
4756         struct wpa_global *global;
4757         int ret, i;
4758
4759         if (params == NULL)
4760                 return NULL;
4761
4762 #ifdef CONFIG_DRIVER_NDIS
4763         {
4764                 void driver_ndis_init_ops(void);
4765                 driver_ndis_init_ops();
4766         }
4767 #endif /* CONFIG_DRIVER_NDIS */
4768
4769 #ifndef CONFIG_NO_WPA_MSG
4770         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4771 #endif /* CONFIG_NO_WPA_MSG */
4772
4773         if (params->wpa_debug_file_path)
4774                 wpa_debug_open_file(params->wpa_debug_file_path);
4775         else
4776                 wpa_debug_setup_stdout();
4777         if (params->wpa_debug_syslog)
4778                 wpa_debug_open_syslog();
4779         if (params->wpa_debug_tracing) {
4780                 ret = wpa_debug_open_linux_tracing();
4781                 if (ret) {
4782                         wpa_printf(MSG_ERROR,
4783                                    "Failed to enable trace logging");
4784                         return NULL;
4785                 }
4786         }
4787
4788         ret = eap_register_methods();
4789         if (ret) {
4790                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4791                 if (ret == -2)
4792                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4793                                    "the same EAP type.");
4794                 return NULL;
4795         }
4796
4797         global = os_zalloc(sizeof(*global));
4798         if (global == NULL)
4799                 return NULL;
4800         dl_list_init(&global->p2p_srv_bonjour);
4801         dl_list_init(&global->p2p_srv_upnp);
4802         global->params.daemonize = params->daemonize;
4803         global->params.wait_for_monitor = params->wait_for_monitor;
4804         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4805         if (params->pid_file)
4806                 global->params.pid_file = os_strdup(params->pid_file);
4807         if (params->ctrl_interface)
4808                 global->params.ctrl_interface =
4809                         os_strdup(params->ctrl_interface);
4810         if (params->ctrl_interface_group)
4811                 global->params.ctrl_interface_group =
4812                         os_strdup(params->ctrl_interface_group);
4813         if (params->override_driver)
4814                 global->params.override_driver =
4815                         os_strdup(params->override_driver);
4816         if (params->override_ctrl_interface)
4817                 global->params.override_ctrl_interface =
4818                         os_strdup(params->override_ctrl_interface);
4819         wpa_debug_level = global->params.wpa_debug_level =
4820                 params->wpa_debug_level;
4821         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4822                 params->wpa_debug_show_keys;
4823         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4824                 params->wpa_debug_timestamp;
4825
4826         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4827
4828         if (eloop_init()) {
4829                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4830                 wpa_supplicant_deinit(global);
4831                 return NULL;
4832         }
4833
4834         random_init(params->entropy_file);
4835
4836         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4837         if (global->ctrl_iface == NULL) {
4838                 wpa_supplicant_deinit(global);
4839                 return NULL;
4840         }
4841
4842         if (wpas_notify_supplicant_initialized(global)) {
4843                 wpa_supplicant_deinit(global);
4844                 return NULL;
4845         }
4846
4847         for (i = 0; wpa_drivers[i]; i++)
4848                 global->drv_count++;
4849         if (global->drv_count == 0) {
4850                 wpa_printf(MSG_ERROR, "No drivers enabled");
4851                 wpa_supplicant_deinit(global);
4852                 return NULL;
4853         }
4854         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4855         if (global->drv_priv == NULL) {
4856                 wpa_supplicant_deinit(global);
4857                 return NULL;
4858         }
4859
4860 #ifdef CONFIG_WIFI_DISPLAY
4861         if (wifi_display_init(global) < 0) {
4862                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4863                 wpa_supplicant_deinit(global);
4864                 return NULL;
4865         }
4866 #endif /* CONFIG_WIFI_DISPLAY */
4867
4868         return global;
4869 }
4870
4871
4872 /**
4873  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4874  * @global: Pointer to global data from wpa_supplicant_init()
4875  * Returns: 0 after successful event loop run, -1 on failure
4876  *
4877  * This function starts the main event loop and continues running as long as
4878  * there are any remaining events. In most cases, this function is running as
4879  * long as the %wpa_supplicant process in still in use.
4880  */
4881 int wpa_supplicant_run(struct wpa_global *global)
4882 {
4883         struct wpa_supplicant *wpa_s;
4884
4885         if (global->params.daemonize &&
4886             wpa_supplicant_daemon(global->params.pid_file))
4887                 return -1;
4888
4889         if (global->params.wait_for_monitor) {
4890                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4891                         if (wpa_s->ctrl_iface)
4892                                 wpa_supplicant_ctrl_iface_wait(
4893                                         wpa_s->ctrl_iface);
4894         }
4895
4896         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4897         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4898
4899         eloop_run();
4900
4901         return 0;
4902 }
4903
4904
4905 /**
4906  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4907  * @global: Pointer to global data from wpa_supplicant_init()
4908  *
4909  * This function is called to deinitialize %wpa_supplicant and to free all
4910  * allocated resources. Remaining network interfaces will also be removed.
4911  */
4912 void wpa_supplicant_deinit(struct wpa_global *global)
4913 {
4914         int i;
4915
4916         if (global == NULL)
4917                 return;
4918
4919 #ifdef CONFIG_WIFI_DISPLAY
4920         wifi_display_deinit(global);
4921 #endif /* CONFIG_WIFI_DISPLAY */
4922
4923         while (global->ifaces)
4924                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4925
4926         if (global->ctrl_iface)
4927                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4928
4929         wpas_notify_supplicant_deinitialized(global);
4930
4931         eap_peer_unregister_methods();
4932 #ifdef CONFIG_AP
4933         eap_server_unregister_methods();
4934 #endif /* CONFIG_AP */
4935
4936         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4937                 if (!global->drv_priv[i])
4938                         continue;
4939                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4940         }
4941         os_free(global->drv_priv);
4942
4943         random_deinit();
4944
4945         eloop_destroy();
4946
4947         if (global->params.pid_file) {
4948                 os_daemonize_terminate(global->params.pid_file);
4949                 os_free(global->params.pid_file);
4950         }
4951         os_free(global->params.ctrl_interface);
4952         os_free(global->params.ctrl_interface_group);
4953         os_free(global->params.override_driver);
4954         os_free(global->params.override_ctrl_interface);
4955
4956         os_free(global->p2p_disallow_freq.range);
4957         os_free(global->p2p_go_avoid_freq.range);
4958         os_free(global->add_psk);
4959
4960         os_free(global);
4961         wpa_debug_close_syslog();
4962         wpa_debug_close_file();
4963         wpa_debug_close_linux_tracing();
4964 }
4965
4966
4967 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4968 {
4969         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4970             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4971                 char country[3];
4972                 country[0] = wpa_s->conf->country[0];
4973                 country[1] = wpa_s->conf->country[1];
4974                 country[2] = '\0';
4975                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4976                         wpa_printf(MSG_ERROR, "Failed to set country code "
4977                                    "'%s'", country);
4978                 }
4979         }
4980
4981         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4982                 wpas_init_ext_pw(wpa_s);
4983
4984 #ifdef CONFIG_WPS
4985         wpas_wps_update_config(wpa_s);
4986 #endif /* CONFIG_WPS */
4987         wpas_p2p_update_config(wpa_s);
4988         wpa_s->conf->changed_parameters = 0;
4989 }
4990
4991
4992 void add_freq(int *freqs, int *num_freqs, int freq)
4993 {
4994         int i;
4995
4996         for (i = 0; i < *num_freqs; i++) {
4997                 if (freqs[i] == freq)
4998                         return;
4999         }
5000
5001         freqs[*num_freqs] = freq;
5002         (*num_freqs)++;
5003 }
5004
5005
5006 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5007 {
5008         struct wpa_bss *bss, *cbss;
5009         const int max_freqs = 10;
5010         int *freqs;
5011         int num_freqs = 0;
5012
5013         freqs = os_calloc(max_freqs + 1, sizeof(int));
5014         if (freqs == NULL)
5015                 return NULL;
5016
5017         cbss = wpa_s->current_bss;
5018
5019         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5020                 if (bss == cbss)
5021                         continue;
5022                 if (bss->ssid_len == cbss->ssid_len &&
5023                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5024                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5025                         add_freq(freqs, &num_freqs, bss->freq);
5026                         if (num_freqs == max_freqs)
5027                                 break;
5028                 }
5029         }
5030
5031         if (num_freqs == 0) {
5032                 os_free(freqs);
5033                 freqs = NULL;
5034         }
5035
5036         return freqs;
5037 }
5038
5039
5040 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5041 {
5042         int timeout;
5043         int count;
5044         int *freqs = NULL;
5045
5046         wpas_connect_work_done(wpa_s);
5047
5048         /*
5049          * Remove possible authentication timeout since the connection failed.
5050          */
5051         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5052
5053         /*
5054          * There is no point in blacklisting the AP if this event is
5055          * generated based on local request to disconnect.
5056          */
5057         if (wpa_s->own_disconnect_req) {
5058                 wpa_s->own_disconnect_req = 0;
5059                 wpa_dbg(wpa_s, MSG_DEBUG,
5060                         "Ignore connection failure due to local request to disconnect");
5061                 return;
5062         }
5063         if (wpa_s->disconnected) {
5064                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5065                         "indication since interface has been put into "
5066                         "disconnected state");
5067                 return;
5068         }
5069
5070         /*
5071          * Add the failed BSSID into the blacklist and speed up next scan
5072          * attempt if there could be other APs that could accept association.
5073          * The current blacklist count indicates how many times we have tried
5074          * connecting to this AP and multiple attempts mean that other APs are
5075          * either not available or has already been tried, so that we can start
5076          * increasing the delay here to avoid constant scanning.
5077          */
5078         count = wpa_blacklist_add(wpa_s, bssid);
5079         if (count == 1 && wpa_s->current_bss) {
5080                 /*
5081                  * This BSS was not in the blacklist before. If there is
5082                  * another BSS available for the same ESS, we should try that
5083                  * next. Otherwise, we may as well try this one once more
5084                  * before allowing other, likely worse, ESSes to be considered.
5085                  */
5086                 freqs = get_bss_freqs_in_ess(wpa_s);
5087                 if (freqs) {
5088                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5089                                 "has been seen; try it next");
5090                         wpa_blacklist_add(wpa_s, bssid);
5091                         /*
5092                          * On the next scan, go through only the known channels
5093                          * used in this ESS based on previous scans to speed up
5094                          * common load balancing use case.
5095                          */
5096                         os_free(wpa_s->next_scan_freqs);
5097                         wpa_s->next_scan_freqs = freqs;
5098                 }
5099         }
5100
5101         /*
5102          * Add previous failure count in case the temporary blacklist was
5103          * cleared due to no other BSSes being available.
5104          */
5105         count += wpa_s->extra_blacklist_count;
5106
5107         if (count > 3 && wpa_s->current_ssid) {
5108                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5109                            "consider temporary network disabling");
5110                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5111         }
5112
5113         switch (count) {
5114         case 1:
5115                 timeout = 100;
5116                 break;
5117         case 2:
5118                 timeout = 500;
5119                 break;
5120         case 3:
5121                 timeout = 1000;
5122                 break;
5123         case 4:
5124                 timeout = 5000;
5125                 break;
5126         default:
5127                 timeout = 10000;
5128                 break;
5129         }
5130
5131         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5132                 "ms", count, timeout);
5133
5134         /*
5135          * TODO: if more than one possible AP is available in scan results,
5136          * could try the other ones before requesting a new scan.
5137          */
5138         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5139                                 1000 * (timeout % 1000));
5140 }
5141
5142
5143 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5144 {
5145         return wpa_s->conf->ap_scan == 2 ||
5146                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5147 }
5148
5149
5150 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5151 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5152                                               struct wpa_ssid *ssid,
5153                                               const char *field,
5154                                               const char *value)
5155 {
5156 #ifdef IEEE8021X_EAPOL
5157         struct eap_peer_config *eap = &ssid->eap;
5158
5159         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5160         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5161                               (const u8 *) value, os_strlen(value));
5162
5163         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5164         case WPA_CTRL_REQ_EAP_IDENTITY:
5165                 os_free(eap->identity);
5166                 eap->identity = (u8 *) os_strdup(value);
5167                 eap->identity_len = os_strlen(value);
5168                 eap->pending_req_identity = 0;
5169                 if (ssid == wpa_s->current_ssid)
5170                         wpa_s->reassociate = 1;
5171                 break;
5172         case WPA_CTRL_REQ_EAP_PASSWORD:
5173                 bin_clear_free(eap->password, eap->password_len);
5174                 eap->password = (u8 *) os_strdup(value);
5175                 eap->password_len = os_strlen(value);
5176                 eap->pending_req_password = 0;
5177                 if (ssid == wpa_s->current_ssid)
5178                         wpa_s->reassociate = 1;
5179                 break;
5180         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5181                 bin_clear_free(eap->new_password, eap->new_password_len);
5182                 eap->new_password = (u8 *) os_strdup(value);
5183                 eap->new_password_len = os_strlen(value);
5184                 eap->pending_req_new_password = 0;
5185                 if (ssid == wpa_s->current_ssid)
5186                         wpa_s->reassociate = 1;
5187                 break;
5188         case WPA_CTRL_REQ_EAP_PIN:
5189                 str_clear_free(eap->pin);
5190                 eap->pin = os_strdup(value);
5191                 eap->pending_req_pin = 0;
5192                 if (ssid == wpa_s->current_ssid)
5193                         wpa_s->reassociate = 1;
5194                 break;
5195         case WPA_CTRL_REQ_EAP_OTP:
5196                 bin_clear_free(eap->otp, eap->otp_len);
5197                 eap->otp = (u8 *) os_strdup(value);
5198                 eap->otp_len = os_strlen(value);
5199                 os_free(eap->pending_req_otp);
5200                 eap->pending_req_otp = NULL;
5201                 eap->pending_req_otp_len = 0;
5202                 break;
5203         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5204                 str_clear_free(eap->private_key_passwd);
5205                 eap->private_key_passwd = os_strdup(value);
5206                 eap->pending_req_passphrase = 0;
5207                 if (ssid == wpa_s->current_ssid)
5208                         wpa_s->reassociate = 1;
5209                 break;
5210         case WPA_CTRL_REQ_SIM:
5211                 str_clear_free(eap->external_sim_resp);
5212                 eap->external_sim_resp = os_strdup(value);
5213                 break;
5214         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5215                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5216                         return -1;
5217                 ssid->mem_only_psk = 1;
5218                 if (ssid->passphrase)
5219                         wpa_config_update_psk(ssid);
5220                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5221                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5222                 break;
5223         default:
5224                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5225                 return -1;
5226         }
5227
5228         return 0;
5229 #else /* IEEE8021X_EAPOL */
5230         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5231         return -1;
5232 #endif /* IEEE8021X_EAPOL */
5233 }
5234 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5235
5236
5237 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5238 {
5239         int i;
5240         unsigned int drv_enc;
5241
5242         if (wpa_s->p2p_mgmt)
5243                 return 1; /* no normal network profiles on p2p_mgmt interface */
5244
5245         if (ssid == NULL)
5246                 return 1;
5247
5248         if (ssid->disabled)
5249                 return 1;
5250
5251         if (wpa_s->drv_capa_known)
5252                 drv_enc = wpa_s->drv_enc;
5253         else
5254                 drv_enc = (unsigned int) -1;
5255
5256         for (i = 0; i < NUM_WEP_KEYS; i++) {
5257                 size_t len = ssid->wep_key_len[i];
5258                 if (len == 0)
5259                         continue;
5260                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5261                         continue;
5262                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5263                         continue;
5264                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5265                         continue;
5266                 return 1; /* invalid WEP key */
5267         }
5268
5269         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5270             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5271             !ssid->mem_only_psk)
5272                 return 1;
5273
5274         return 0;
5275 }
5276
5277
5278 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5279 {
5280 #ifdef CONFIG_IEEE80211W
5281         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5282                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5283                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5284                         /*
5285                          * Driver does not support BIP -- ignore pmf=1 default
5286                          * since the connection with PMF would fail and the
5287                          * configuration does not require PMF to be enabled.
5288                          */
5289                         return NO_MGMT_FRAME_PROTECTION;
5290                 }
5291
5292                 return wpa_s->conf->pmf;
5293         }
5294
5295         return ssid->ieee80211w;
5296 #else /* CONFIG_IEEE80211W */
5297         return NO_MGMT_FRAME_PROTECTION;
5298 #endif /* CONFIG_IEEE80211W */
5299 }
5300
5301
5302 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5303 {
5304         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5305                 return 1;
5306         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5307                 return 0;
5308         return -1;
5309 }
5310
5311
5312 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5313 {
5314         struct wpa_ssid *ssid = wpa_s->current_ssid;
5315         int dur;
5316         struct os_reltime now;
5317
5318         if (ssid == NULL) {
5319                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5320                            "SSID block");
5321                 return;
5322         }
5323
5324         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5325                 return;
5326
5327         ssid->auth_failures++;
5328
5329 #ifdef CONFIG_P2P
5330         if (ssid->p2p_group &&
5331             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5332                 /*
5333                  * Skip the wait time since there is a short timeout on the
5334                  * connection to a P2P group.
5335                  */
5336                 return;
5337         }
5338 #endif /* CONFIG_P2P */
5339
5340         if (ssid->auth_failures > 50)
5341                 dur = 300;
5342         else if (ssid->auth_failures > 10)
5343                 dur = 120;
5344         else if (ssid->auth_failures > 5)
5345                 dur = 90;
5346         else if (ssid->auth_failures > 3)
5347                 dur = 60;
5348         else if (ssid->auth_failures > 2)
5349                 dur = 30;
5350         else if (ssid->auth_failures > 1)
5351                 dur = 20;
5352         else
5353                 dur = 10;
5354
5355         if (ssid->auth_failures > 1 &&
5356             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5357                 dur += os_random() % (ssid->auth_failures * 10);
5358
5359         os_get_reltime(&now);
5360         if (now.sec + dur <= ssid->disabled_until.sec)
5361                 return;
5362
5363         ssid->disabled_until.sec = now.sec + dur;
5364
5365         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5366                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5367                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5368                 ssid->auth_failures, dur, reason);
5369 }
5370
5371
5372 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5373                               struct wpa_ssid *ssid, int clear_failures)
5374 {
5375         if (ssid == NULL)
5376                 return;
5377
5378         if (ssid->disabled_until.sec) {
5379                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5380                         "id=%d ssid=\"%s\"",
5381                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5382         }
5383         ssid->disabled_until.sec = 0;
5384         ssid->disabled_until.usec = 0;
5385         if (clear_failures)
5386                 ssid->auth_failures = 0;
5387 }
5388
5389
5390 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5391 {
5392         size_t i;
5393
5394         if (wpa_s->disallow_aps_bssid == NULL)
5395                 return 0;
5396
5397         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5398                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5399                               bssid, ETH_ALEN) == 0)
5400                         return 1;
5401         }
5402
5403         return 0;
5404 }
5405
5406
5407 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5408                     size_t ssid_len)
5409 {
5410         size_t i;
5411
5412         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5413                 return 0;
5414
5415         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5416                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5417                 if (ssid_len == s->ssid_len &&
5418                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5419                         return 1;
5420         }
5421
5422         return 0;
5423 }
5424
5425
5426 /**
5427  * wpas_request_connection - Request a new connection
5428  * @wpa_s: Pointer to the network interface
5429  *
5430  * This function is used to request a new connection to be found. It will mark
5431  * the interface to allow reassociation and request a new scan to find a
5432  * suitable network to connect to.
5433  */
5434 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5435 {
5436         wpa_s->normal_scans = 0;
5437         wpa_s->scan_req = NORMAL_SCAN_REQ;
5438         wpa_supplicant_reinit_autoscan(wpa_s);
5439         wpa_s->extra_blacklist_count = 0;
5440         wpa_s->disconnected = 0;
5441         wpa_s->reassociate = 1;
5442
5443         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5444                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5445         else
5446                 wpa_s->reattach = 0;
5447 }
5448
5449
5450 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5451                     struct wpa_used_freq_data *freqs_data,
5452                     unsigned int len)
5453 {
5454         unsigned int i;
5455
5456         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5457                 len, title);
5458         for (i = 0; i < len; i++) {
5459                 struct wpa_used_freq_data *cur = &freqs_data[i];
5460                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5461                         i, cur->freq, cur->flags);
5462         }
5463 }
5464
5465
5466 /*
5467  * Find the operating frequencies of any of the virtual interfaces that
5468  * are using the same radio as the current interface, and in addition, get
5469  * information about the interface types that are using the frequency.
5470  */
5471 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5472                                 struct wpa_used_freq_data *freqs_data,
5473                                 unsigned int len)
5474 {
5475         struct wpa_supplicant *ifs;
5476         u8 bssid[ETH_ALEN];
5477         int freq;
5478         unsigned int idx = 0, i;
5479
5480         wpa_dbg(wpa_s, MSG_DEBUG,
5481                 "Determining shared radio frequencies (max len %u)", len);
5482         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5483
5484         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5485                          radio_list) {
5486                 if (idx == len)
5487                         break;
5488
5489                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5490                         continue;
5491
5492                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5493                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5494                         freq = ifs->current_ssid->frequency;
5495                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5496                         freq = ifs->assoc_freq;
5497                 else
5498                         continue;
5499
5500                 /* Hold only distinct freqs */
5501                 for (i = 0; i < idx; i++)
5502                         if (freqs_data[i].freq == freq)
5503                                 break;
5504
5505                 if (i == idx)
5506                         freqs_data[idx++].freq = freq;
5507
5508                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5509                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5510                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5511                                 WPA_FREQ_USED_BY_INFRA_STATION;
5512                 }
5513         }
5514
5515         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5516         return idx;
5517 }
5518
5519
5520 /*
5521  * Find the operating frequencies of any of the virtual interfaces that
5522  * are using the same radio as the current interface.
5523  */
5524 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5525                            int *freq_array, unsigned int len)
5526 {
5527         struct wpa_used_freq_data *freqs_data;
5528         int num, i;
5529
5530         os_memset(freq_array, 0, sizeof(int) * len);
5531
5532         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5533         if (!freqs_data)
5534                 return -1;
5535
5536         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5537         for (i = 0; i < num; i++)
5538                 freq_array[i] = freqs_data[i].freq;
5539
5540         os_free(freqs_data);
5541
5542         return num;
5543 }
5544
5545
5546 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5547 {
5548         struct rrm_data *rrm = data;
5549
5550         if (!rrm->notify_neighbor_rep) {
5551                 wpa_printf(MSG_ERROR,
5552                            "RRM: Unexpected neighbor report timeout");
5553                 return;
5554         }
5555
5556         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5557         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5558
5559         rrm->notify_neighbor_rep = NULL;
5560         rrm->neighbor_rep_cb_ctx = NULL;
5561 }
5562
5563
5564 /*
5565  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5566  * @wpa_s: Pointer to wpa_supplicant
5567  */
5568 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5569 {
5570         wpa_s->rrm.rrm_used = 0;
5571
5572         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5573                              NULL);
5574         if (wpa_s->rrm.notify_neighbor_rep)
5575                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5576         wpa_s->rrm.next_neighbor_rep_token = 1;
5577 }
5578
5579
5580 /*
5581  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5582  * @wpa_s: Pointer to wpa_supplicant
5583  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5584  * @report_len: Length of neighbor report buffer
5585  */
5586 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5587                                    const u8 *report, size_t report_len)
5588 {
5589         struct wpabuf *neighbor_rep;
5590
5591         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5592         if (report_len < 1)
5593                 return;
5594
5595         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5596                 wpa_printf(MSG_DEBUG,
5597                            "RRM: Discarding neighbor report with token %d (expected %d)",
5598                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5599                 return;
5600         }
5601
5602         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5603                              NULL);
5604
5605         if (!wpa_s->rrm.notify_neighbor_rep) {
5606                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5607                 return;
5608         }
5609
5610         /* skipping the first byte, which is only an id (dialog token) */
5611         neighbor_rep = wpabuf_alloc(report_len - 1);
5612         if (neighbor_rep == NULL)
5613                 return;
5614         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5615         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5616                    report[0]);
5617         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5618                                        neighbor_rep);
5619         wpa_s->rrm.notify_neighbor_rep = NULL;
5620         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5621 }
5622
5623
5624 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5625 /* Workaround different, undefined for Windows, error codes used here */
5626 #define ENOTCONN -1
5627 #define EOPNOTSUPP -1
5628 #define ECANCELED -1
5629 #endif
5630
5631 /**
5632  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5633  * @wpa_s: Pointer to wpa_supplicant
5634  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5635  *        is sent in the request.
5636  * @cb: Callback function to be called once the requested report arrives, or
5637  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5638  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5639  *      the requester's responsibility to free it.
5640  *      In the latter case NULL will be sent in 'neighbor_rep'.
5641  * @cb_ctx: Context value to send the callback function
5642  * Returns: 0 in case of success, negative error code otherwise
5643  *
5644  * In case there is a previous request which has not been answered yet, the
5645  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5646  * Request must contain a callback function.
5647  */
5648 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5649                                        const struct wpa_ssid *ssid,
5650                                        void (*cb)(void *ctx,
5651                                                   struct wpabuf *neighbor_rep),
5652                                        void *cb_ctx)
5653 {
5654         struct wpabuf *buf;
5655         const u8 *rrm_ie;
5656
5657         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5658                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5659                 return -ENOTCONN;
5660         }
5661
5662         if (!wpa_s->rrm.rrm_used) {
5663                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5664                 return -EOPNOTSUPP;
5665         }
5666
5667         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5668                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5669         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5670             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5671                 wpa_printf(MSG_DEBUG,
5672                            "RRM: No network support for Neighbor Report.");
5673                 return -EOPNOTSUPP;
5674         }
5675
5676         if (!cb) {
5677                 wpa_printf(MSG_DEBUG,
5678                            "RRM: Neighbor Report request must provide a callback.");
5679                 return -EINVAL;
5680         }
5681
5682         /* Refuse if there's a live request */
5683         if (wpa_s->rrm.notify_neighbor_rep) {
5684                 wpa_printf(MSG_DEBUG,
5685                            "RRM: Currently handling previous Neighbor Report.");
5686                 return -EBUSY;
5687         }
5688
5689         /* 3 = action category + action code + dialog token */
5690         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5691         if (buf == NULL) {
5692                 wpa_printf(MSG_DEBUG,
5693                            "RRM: Failed to allocate Neighbor Report Request");
5694                 return -ENOMEM;
5695         }
5696
5697         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5698                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5699                    wpa_s->rrm.next_neighbor_rep_token);
5700
5701         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5702         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5703         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5704         if (ssid) {
5705                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5706                 wpabuf_put_u8(buf, ssid->ssid_len);
5707                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5708         }
5709
5710         wpa_s->rrm.next_neighbor_rep_token++;
5711
5712         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5713                                 wpa_s->own_addr, wpa_s->bssid,
5714                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5715                 wpa_printf(MSG_DEBUG,
5716                            "RRM: Failed to send Neighbor Report Request");
5717                 wpabuf_free(buf);
5718                 return -ECANCELED;
5719         }
5720
5721         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5722         wpa_s->rrm.notify_neighbor_rep = cb;
5723         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5724                                wpas_rrm_neighbor_rep_timeout_handler,
5725                                &wpa_s->rrm, NULL);
5726
5727         wpabuf_free(buf);
5728         return 0;
5729 }
5730
5731
5732 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5733                                               const u8 *src,
5734                                               const u8 *frame, size_t len,
5735                                               int rssi)
5736 {
5737         struct wpabuf *buf;
5738         const struct rrm_link_measurement_request *req;
5739         struct rrm_link_measurement_report report;
5740
5741         if (wpa_s->wpa_state != WPA_COMPLETED) {
5742                 wpa_printf(MSG_INFO,
5743                            "RRM: Ignoring link measurement request. Not associated");
5744                 return;
5745         }
5746
5747         if (!wpa_s->rrm.rrm_used) {
5748                 wpa_printf(MSG_INFO,
5749                            "RRM: Ignoring link measurement request. Not RRM network");
5750                 return;
5751         }
5752
5753         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5754                 wpa_printf(MSG_INFO,
5755                            "RRM: Measurement report failed. TX power insertion not supported");
5756                 return;
5757         }
5758
5759         req = (const struct rrm_link_measurement_request *) frame;
5760         if (len < sizeof(*req)) {
5761                 wpa_printf(MSG_INFO,
5762                            "RRM: Link measurement report failed. Request too short");
5763                 return;
5764         }
5765
5766         os_memset(&report, 0, sizeof(report));
5767         report.tpc.eid = WLAN_EID_TPC_REPORT;
5768         report.tpc.len = 2;
5769         report.rsni = 255; /* 255 indicates that RSNI is not available */
5770         report.dialog_token = req->dialog_token;
5771
5772         /*
5773          * It's possible to estimate RCPI based on RSSI in dBm. This
5774          * calculation will not reflect the correct value for high rates,
5775          * but it's good enough for Action frames which are transmitted
5776          * with up to 24 Mbps rates.
5777          */
5778         if (!rssi)
5779                 report.rcpi = 255; /* not available */
5780         else if (rssi < -110)
5781                 report.rcpi = 0;
5782         else if (rssi > 0)
5783                 report.rcpi = 220;
5784         else
5785                 report.rcpi = (rssi + 110) * 2;
5786
5787         /* action_category + action_code */
5788         buf = wpabuf_alloc(2 + sizeof(report));
5789         if (buf == NULL) {
5790                 wpa_printf(MSG_ERROR,
5791                            "RRM: Link measurement report failed. Buffer allocation failed");
5792                 return;
5793         }
5794
5795         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5796         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5797         wpabuf_put_data(buf, &report, sizeof(report));
5798         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5799                     wpabuf_head(buf), wpabuf_len(buf));
5800
5801         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5802                                 wpa_s->own_addr, wpa_s->bssid,
5803                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5804                 wpa_printf(MSG_ERROR,
5805                            "RRM: Link measurement report failed. Send action failed");
5806         }
5807         wpabuf_free(buf);
5808 }