wpa_supplicant.c revision b97e428f8acf1ecb93f38f8d0063d2f2fd0bc36e
1/*
2 * WPA Supplicant
3 * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 *
8 * This file implements functions for registering and unregistering
9 * %wpa_supplicant interfaces. In addition, this file contains number of
10 * functions for managing network connections.
11 */
12
13#include "includes.h"
14
15#include "common.h"
16#include "crypto/random.h"
17#include "crypto/sha1.h"
18#include "eapol_supp/eapol_supp_sm.h"
19#include "eap_peer/eap.h"
20#include "eap_peer/eap_proxy.h"
21#include "eap_server/eap_methods.h"
22#include "rsn_supp/wpa.h"
23#include "eloop.h"
24#include "config.h"
25#include "utils/ext_password.h"
26#include "l2_packet/l2_packet.h"
27#include "wpa_supplicant_i.h"
28#include "driver_i.h"
29#include "ctrl_iface.h"
30#include "pcsc_funcs.h"
31#include "common/version.h"
32#include "rsn_supp/preauth.h"
33#include "rsn_supp/pmksa_cache.h"
34#include "common/wpa_ctrl.h"
35#include "common/ieee802_11_defs.h"
36#include "common/hw_features_common.h"
37#include "p2p/p2p.h"
38#include "fst/fst.h"
39#include "blacklist.h"
40#include "wpas_glue.h"
41#include "wps_supplicant.h"
42#include "ibss_rsn.h"
43#include "sme.h"
44#include "gas_query.h"
45#include "ap.h"
46#include "p2p_supplicant.h"
47#include "wifi_display.h"
48#include "notify.h"
49#include "bgscan.h"
50#include "autoscan.h"
51#include "bss.h"
52#include "scan.h"
53#include "offchannel.h"
54#include "hs20_supplicant.h"
55#include "wnm_sta.h"
56#include "wpas_kay.h"
57#include "mesh.h"
58
59const char *const wpa_supplicant_version =
60"wpa_supplicant v" VERSION_STR "\n"
61"Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
62
63const char *const wpa_supplicant_license =
64"This software may be distributed under the terms of the BSD license.\n"
65"See README for more details.\n"
66#ifdef EAP_TLS_OPENSSL
67"\nThis product includes software developed by the OpenSSL Project\n"
68"for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
69#endif /* EAP_TLS_OPENSSL */
70;
71
72#ifndef CONFIG_NO_STDOUT_DEBUG
73/* Long text divided into parts in order to fit in C89 strings size limits. */
74const char *const wpa_supplicant_full_license1 =
75"";
76const char *const wpa_supplicant_full_license2 =
77"This software may be distributed under the terms of the BSD license.\n"
78"\n"
79"Redistribution and use in source and binary forms, with or without\n"
80"modification, are permitted provided that the following conditions are\n"
81"met:\n"
82"\n";
83const char *const wpa_supplicant_full_license3 =
84"1. Redistributions of source code must retain the above copyright\n"
85"   notice, this list of conditions and the following disclaimer.\n"
86"\n"
87"2. Redistributions in binary form must reproduce the above copyright\n"
88"   notice, this list of conditions and the following disclaimer in the\n"
89"   documentation and/or other materials provided with the distribution.\n"
90"\n";
91const char *const wpa_supplicant_full_license4 =
92"3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
93"   names of its contributors may be used to endorse or promote products\n"
94"   derived from this software without specific prior written permission.\n"
95"\n"
96"THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
97"\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
98"LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
99"A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
100const char *const wpa_supplicant_full_license5 =
101"OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
102"SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
103"LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
104"DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
105"THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
106"(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
107"OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
108"\n";
109#endif /* CONFIG_NO_STDOUT_DEBUG */
110
111/* Configure default/group WEP keys for static WEP */
112int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
113{
114	int i, set = 0;
115
116	for (i = 0; i < NUM_WEP_KEYS; i++) {
117		if (ssid->wep_key_len[i] == 0)
118			continue;
119
120		set = 1;
121		wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
122				i, i == ssid->wep_tx_keyidx, NULL, 0,
123				ssid->wep_key[i], ssid->wep_key_len[i]);
124	}
125
126	return set;
127}
128
129
130int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
131				    struct wpa_ssid *ssid)
132{
133	u8 key[32];
134	size_t keylen;
135	enum wpa_alg alg;
136	u8 seq[6] = { 0 };
137	int ret;
138
139	/* IBSS/WPA-None uses only one key (Group) for both receiving and
140	 * sending unicast and multicast packets. */
141
142	if (ssid->mode != WPAS_MODE_IBSS) {
143		wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
144			"IBSS/ad-hoc) for WPA-None", ssid->mode);
145		return -1;
146	}
147
148	if (!ssid->psk_set) {
149		wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
150			"WPA-None");
151		return -1;
152	}
153
154	switch (wpa_s->group_cipher) {
155	case WPA_CIPHER_CCMP:
156		os_memcpy(key, ssid->psk, 16);
157		keylen = 16;
158		alg = WPA_ALG_CCMP;
159		break;
160	case WPA_CIPHER_GCMP:
161		os_memcpy(key, ssid->psk, 16);
162		keylen = 16;
163		alg = WPA_ALG_GCMP;
164		break;
165	case WPA_CIPHER_TKIP:
166		/* WPA-None uses the same Michael MIC key for both TX and RX */
167		os_memcpy(key, ssid->psk, 16 + 8);
168		os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
169		keylen = 32;
170		alg = WPA_ALG_TKIP;
171		break;
172	default:
173		wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
174			"WPA-None", wpa_s->group_cipher);
175		return -1;
176	}
177
178	/* TODO: should actually remember the previously used seq#, both for TX
179	 * and RX from each STA.. */
180
181	ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
182	os_memset(key, 0, sizeof(key));
183	return ret;
184}
185
186
187static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
188{
189	struct wpa_supplicant *wpa_s = eloop_ctx;
190	const u8 *bssid = wpa_s->bssid;
191	if (is_zero_ether_addr(bssid))
192		bssid = wpa_s->pending_bssid;
193	wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
194		MAC2STR(bssid));
195	wpa_blacklist_add(wpa_s, bssid);
196	wpa_sm_notify_disassoc(wpa_s->wpa);
197	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
198	wpa_s->reassociate = 1;
199
200	/*
201	 * If we timed out, the AP or the local radio may be busy.
202	 * So, wait a second until scanning again.
203	 */
204	wpa_supplicant_req_scan(wpa_s, 1, 0);
205}
206
207
208/**
209 * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
210 * @wpa_s: Pointer to wpa_supplicant data
211 * @sec: Number of seconds after which to time out authentication
212 * @usec: Number of microseconds after which to time out authentication
213 *
214 * This function is used to schedule a timeout for the current authentication
215 * attempt.
216 */
217void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
218				     int sec, int usec)
219{
220	if (wpa_s->conf->ap_scan == 0 &&
221	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
222		return;
223
224	wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
225		"%d usec", sec, usec);
226	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
227	eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
228}
229
230
231/**
232 * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
233 * @wpa_s: Pointer to wpa_supplicant data
234 *
235 * This function is used to cancel authentication timeout scheduled with
236 * wpa_supplicant_req_auth_timeout() and it is called when authentication has
237 * been completed.
238 */
239void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
240{
241	wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
242	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
243	wpa_blacklist_del(wpa_s, wpa_s->bssid);
244}
245
246
247/**
248 * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
249 * @wpa_s: Pointer to wpa_supplicant data
250 *
251 * This function is used to configure EAPOL state machine based on the selected
252 * authentication mode.
253 */
254void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
255{
256#ifdef IEEE8021X_EAPOL
257	struct eapol_config eapol_conf;
258	struct wpa_ssid *ssid = wpa_s->current_ssid;
259
260#ifdef CONFIG_IBSS_RSN
261	if (ssid->mode == WPAS_MODE_IBSS &&
262	    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
263	    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
264		/*
265		 * RSN IBSS authentication is per-STA and we can disable the
266		 * per-BSSID EAPOL authentication.
267		 */
268		eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
269		eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
270		eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
271		return;
272	}
273#endif /* CONFIG_IBSS_RSN */
274
275	eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
276	eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
277
278	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
279	    wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
280		eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
281	else
282		eapol_sm_notify_portControl(wpa_s->eapol, Auto);
283
284	os_memset(&eapol_conf, 0, sizeof(eapol_conf));
285	if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
286		eapol_conf.accept_802_1x_keys = 1;
287		eapol_conf.required_keys = 0;
288		if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
289			eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
290		}
291		if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
292			eapol_conf.required_keys |=
293				EAPOL_REQUIRE_KEY_BROADCAST;
294		}
295
296		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
297			eapol_conf.required_keys = 0;
298	}
299	eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
300	eapol_conf.workaround = ssid->eap_workaround;
301	eapol_conf.eap_disabled =
302		!wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
303		wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
304		wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
305	eapol_conf.external_sim = wpa_s->conf->external_sim;
306
307#ifdef CONFIG_WPS
308	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
309		eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
310		if (wpa_s->current_bss) {
311			struct wpabuf *ie;
312			ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
313							 WPS_IE_VENDOR_TYPE);
314			if (ie) {
315				if (wps_is_20(ie))
316					eapol_conf.wps |=
317						EAPOL_PEER_IS_WPS20_AP;
318				wpabuf_free(ie);
319			}
320		}
321	}
322#endif /* CONFIG_WPS */
323
324	eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
325
326	ieee802_1x_alloc_kay_sm(wpa_s, ssid);
327#endif /* IEEE8021X_EAPOL */
328}
329
330
331/**
332 * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
333 * @wpa_s: Pointer to wpa_supplicant data
334 * @ssid: Configuration data for the network
335 *
336 * This function is used to configure WPA state machine and related parameters
337 * to a mode where WPA is not enabled. This is called as part of the
338 * authentication configuration when the selected network does not use WPA.
339 */
340void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
341				       struct wpa_ssid *ssid)
342{
343	int i;
344
345	if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
346		wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
347	else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
348		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
349	else
350		wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
351	wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
352	wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
353	wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
354	wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
355	wpa_s->group_cipher = WPA_CIPHER_NONE;
356	wpa_s->mgmt_group_cipher = 0;
357
358	for (i = 0; i < NUM_WEP_KEYS; i++) {
359		if (ssid->wep_key_len[i] > 5) {
360			wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
361			wpa_s->group_cipher = WPA_CIPHER_WEP104;
362			break;
363		} else if (ssid->wep_key_len[i] > 0) {
364			wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
365			wpa_s->group_cipher = WPA_CIPHER_WEP40;
366			break;
367		}
368	}
369
370	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
371	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
372	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
373			 wpa_s->pairwise_cipher);
374	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
375#ifdef CONFIG_IEEE80211W
376	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
377			 wpa_s->mgmt_group_cipher);
378#endif /* CONFIG_IEEE80211W */
379
380	pmksa_cache_clear_current(wpa_s->wpa);
381}
382
383
384void free_hw_features(struct wpa_supplicant *wpa_s)
385{
386	int i;
387	if (wpa_s->hw.modes == NULL)
388		return;
389
390	for (i = 0; i < wpa_s->hw.num_modes; i++) {
391		os_free(wpa_s->hw.modes[i].channels);
392		os_free(wpa_s->hw.modes[i].rates);
393	}
394
395	os_free(wpa_s->hw.modes);
396	wpa_s->hw.modes = NULL;
397}
398
399
400static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
401{
402	int i;
403
404	bgscan_deinit(wpa_s);
405	autoscan_deinit(wpa_s);
406	scard_deinit(wpa_s->scard);
407	wpa_s->scard = NULL;
408	wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
409	eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
410	l2_packet_deinit(wpa_s->l2);
411	wpa_s->l2 = NULL;
412	if (wpa_s->l2_br) {
413		l2_packet_deinit(wpa_s->l2_br);
414		wpa_s->l2_br = NULL;
415	}
416#ifdef CONFIG_TESTING_OPTIONS
417	l2_packet_deinit(wpa_s->l2_test);
418	wpa_s->l2_test = NULL;
419#endif /* CONFIG_TESTING_OPTIONS */
420
421	if (wpa_s->conf != NULL) {
422		struct wpa_ssid *ssid;
423		for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
424			wpas_notify_network_removed(wpa_s, ssid);
425	}
426
427	os_free(wpa_s->confname);
428	wpa_s->confname = NULL;
429
430	os_free(wpa_s->confanother);
431	wpa_s->confanother = NULL;
432
433	wpa_sm_set_eapol(wpa_s->wpa, NULL);
434	eapol_sm_deinit(wpa_s->eapol);
435	wpa_s->eapol = NULL;
436
437	rsn_preauth_deinit(wpa_s->wpa);
438
439#ifdef CONFIG_TDLS
440	wpa_tdls_deinit(wpa_s->wpa);
441#endif /* CONFIG_TDLS */
442
443	wmm_ac_clear_saved_tspecs(wpa_s);
444	pmksa_candidate_free(wpa_s->wpa);
445	wpa_sm_deinit(wpa_s->wpa);
446	wpa_s->wpa = NULL;
447	wpa_blacklist_clear(wpa_s);
448
449	wpa_bss_deinit(wpa_s);
450
451	wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
452	wpa_supplicant_cancel_scan(wpa_s);
453	wpa_supplicant_cancel_auth_timeout(wpa_s);
454	eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
455#ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
456	eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
457			     wpa_s, NULL);
458#endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
459
460	eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
461
462	wpas_wps_deinit(wpa_s);
463
464	wpabuf_free(wpa_s->pending_eapol_rx);
465	wpa_s->pending_eapol_rx = NULL;
466
467#ifdef CONFIG_IBSS_RSN
468	ibss_rsn_deinit(wpa_s->ibss_rsn);
469	wpa_s->ibss_rsn = NULL;
470#endif /* CONFIG_IBSS_RSN */
471
472	sme_deinit(wpa_s);
473
474#ifdef CONFIG_AP
475	wpa_supplicant_ap_deinit(wpa_s);
476#endif /* CONFIG_AP */
477
478	wpas_p2p_deinit(wpa_s);
479
480#ifdef CONFIG_OFFCHANNEL
481	offchannel_deinit(wpa_s);
482#endif /* CONFIG_OFFCHANNEL */
483
484	wpa_supplicant_cancel_sched_scan(wpa_s);
485
486	os_free(wpa_s->next_scan_freqs);
487	wpa_s->next_scan_freqs = NULL;
488
489	os_free(wpa_s->manual_scan_freqs);
490	wpa_s->manual_scan_freqs = NULL;
491
492	os_free(wpa_s->manual_sched_scan_freqs);
493	wpa_s->manual_sched_scan_freqs = NULL;
494
495	wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
496
497	/*
498	 * Need to remove any pending gas-query radio work before the
499	 * gas_query_deinit() call because gas_query::work has not yet been set
500	 * for works that have not been started. gas_query_free() will be unable
501	 * to cancel such pending radio works and once the pending gas-query
502	 * radio work eventually gets removed, the deinit notification call to
503	 * gas_query_start_cb() would result in dereferencing freed memory.
504	 */
505	if (wpa_s->radio)
506		radio_remove_works(wpa_s, "gas-query", 0);
507	gas_query_deinit(wpa_s->gas);
508	wpa_s->gas = NULL;
509
510	free_hw_features(wpa_s);
511
512	ieee802_1x_dealloc_kay_sm(wpa_s);
513
514	os_free(wpa_s->bssid_filter);
515	wpa_s->bssid_filter = NULL;
516
517	os_free(wpa_s->disallow_aps_bssid);
518	wpa_s->disallow_aps_bssid = NULL;
519	os_free(wpa_s->disallow_aps_ssid);
520	wpa_s->disallow_aps_ssid = NULL;
521
522	wnm_bss_keep_alive_deinit(wpa_s);
523#ifdef CONFIG_WNM
524	wnm_deallocate_memory(wpa_s);
525#endif /* CONFIG_WNM */
526
527	ext_password_deinit(wpa_s->ext_pw);
528	wpa_s->ext_pw = NULL;
529
530	wpabuf_free(wpa_s->last_gas_resp);
531	wpa_s->last_gas_resp = NULL;
532	wpabuf_free(wpa_s->prev_gas_resp);
533	wpa_s->prev_gas_resp = NULL;
534
535	os_free(wpa_s->last_scan_res);
536	wpa_s->last_scan_res = NULL;
537
538#ifdef CONFIG_HS20
539	hs20_deinit(wpa_s);
540#endif /* CONFIG_HS20 */
541
542	for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
543		wpabuf_free(wpa_s->vendor_elem[i]);
544		wpa_s->vendor_elem[i] = NULL;
545	}
546
547	wmm_ac_notify_disassoc(wpa_s);
548
549	wpa_s->sched_scan_plans_num = 0;
550	os_free(wpa_s->sched_scan_plans);
551	wpa_s->sched_scan_plans = NULL;
552}
553
554
555/**
556 * wpa_clear_keys - Clear keys configured for the driver
557 * @wpa_s: Pointer to wpa_supplicant data
558 * @addr: Previously used BSSID or %NULL if not available
559 *
560 * This function clears the encryption keys that has been previously configured
561 * for the driver.
562 */
563void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
564{
565	int i, max;
566
567#ifdef CONFIG_IEEE80211W
568	max = 6;
569#else /* CONFIG_IEEE80211W */
570	max = 4;
571#endif /* CONFIG_IEEE80211W */
572
573	/* MLME-DELETEKEYS.request */
574	for (i = 0; i < max; i++) {
575		if (wpa_s->keys_cleared & BIT(i))
576			continue;
577		wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
578				NULL, 0);
579	}
580	if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
581	    !is_zero_ether_addr(addr)) {
582		wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
583				0);
584		/* MLME-SETPROTECTION.request(None) */
585		wpa_drv_mlme_setprotection(
586			wpa_s, addr,
587			MLME_SETPROTECTION_PROTECT_TYPE_NONE,
588			MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
589	}
590	wpa_s->keys_cleared = (u32) -1;
591}
592
593
594/**
595 * wpa_supplicant_state_txt - Get the connection state name as a text string
596 * @state: State (wpa_state; WPA_*)
597 * Returns: The state name as a printable text string
598 */
599const char * wpa_supplicant_state_txt(enum wpa_states state)
600{
601	switch (state) {
602	case WPA_DISCONNECTED:
603		return "DISCONNECTED";
604	case WPA_INACTIVE:
605		return "INACTIVE";
606	case WPA_INTERFACE_DISABLED:
607		return "INTERFACE_DISABLED";
608	case WPA_SCANNING:
609		return "SCANNING";
610	case WPA_AUTHENTICATING:
611		return "AUTHENTICATING";
612	case WPA_ASSOCIATING:
613		return "ASSOCIATING";
614	case WPA_ASSOCIATED:
615		return "ASSOCIATED";
616	case WPA_4WAY_HANDSHAKE:
617		return "4WAY_HANDSHAKE";
618	case WPA_GROUP_HANDSHAKE:
619		return "GROUP_HANDSHAKE";
620	case WPA_COMPLETED:
621		return "COMPLETED";
622	default:
623		return "UNKNOWN";
624	}
625}
626
627
628#ifdef CONFIG_BGSCAN
629
630static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
631{
632	const char *name;
633
634	if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
635		name = wpa_s->current_ssid->bgscan;
636	else
637		name = wpa_s->conf->bgscan;
638	if (name == NULL || name[0] == '\0')
639		return;
640	if (wpas_driver_bss_selection(wpa_s))
641		return;
642	if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
643		return;
644#ifdef CONFIG_P2P
645	if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
646		return;
647#endif /* CONFIG_P2P */
648
649	bgscan_deinit(wpa_s);
650	if (wpa_s->current_ssid) {
651		if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
652			wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
653				"bgscan");
654			/*
655			 * Live without bgscan; it is only used as a roaming
656			 * optimization, so the initial connection is not
657			 * affected.
658			 */
659		} else {
660			struct wpa_scan_results *scan_res;
661			wpa_s->bgscan_ssid = wpa_s->current_ssid;
662			scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
663								   0);
664			if (scan_res) {
665				bgscan_notify_scan(wpa_s, scan_res);
666				wpa_scan_results_free(scan_res);
667			}
668		}
669	} else
670		wpa_s->bgscan_ssid = NULL;
671}
672
673
674static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
675{
676	if (wpa_s->bgscan_ssid != NULL) {
677		bgscan_deinit(wpa_s);
678		wpa_s->bgscan_ssid = NULL;
679	}
680}
681
682#endif /* CONFIG_BGSCAN */
683
684
685static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
686{
687	if (autoscan_init(wpa_s, 0))
688		wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
689}
690
691
692static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
693{
694	autoscan_deinit(wpa_s);
695}
696
697
698void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
699{
700	if (wpa_s->wpa_state == WPA_DISCONNECTED ||
701	    wpa_s->wpa_state == WPA_SCANNING) {
702		autoscan_deinit(wpa_s);
703		wpa_supplicant_start_autoscan(wpa_s);
704	}
705}
706
707
708/**
709 * wpa_supplicant_set_state - Set current connection state
710 * @wpa_s: Pointer to wpa_supplicant data
711 * @state: The new connection state
712 *
713 * This function is called whenever the connection state changes, e.g.,
714 * association is completed for WPA/WPA2 4-Way Handshake is started.
715 */
716void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
717			      enum wpa_states state)
718{
719	enum wpa_states old_state = wpa_s->wpa_state;
720
721	wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
722		wpa_supplicant_state_txt(wpa_s->wpa_state),
723		wpa_supplicant_state_txt(state));
724
725	if (state == WPA_INTERFACE_DISABLED) {
726		/* Assure normal scan when interface is restored */
727		wpa_s->normal_scans = 0;
728	}
729
730	if (state == WPA_COMPLETED) {
731		wpas_connect_work_done(wpa_s);
732		/* Reinitialize normal_scan counter */
733		wpa_s->normal_scans = 0;
734	}
735
736#ifdef CONFIG_P2P
737	/*
738	 * P2PS client has to reply to Probe Request frames received on the
739	 * group operating channel. Enable Probe Request frame reporting for
740	 * P2P connected client in case p2p_cli_probe configuration property is
741	 * set to 1.
742	 */
743	if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
744	    wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
745	    wpa_s->current_ssid->p2p_group) {
746		if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
747			wpa_dbg(wpa_s, MSG_DEBUG,
748				"P2P: Enable CLI Probe Request RX reporting");
749			wpa_s->p2p_cli_probe =
750				wpa_drv_probe_req_report(wpa_s, 1) >= 0;
751		} else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
752			wpa_dbg(wpa_s, MSG_DEBUG,
753				"P2P: Disable CLI Probe Request RX reporting");
754			wpa_s->p2p_cli_probe = 0;
755			wpa_drv_probe_req_report(wpa_s, 0);
756		}
757	}
758#endif /* CONFIG_P2P */
759
760	if (state != WPA_SCANNING)
761		wpa_supplicant_notify_scanning(wpa_s, 0);
762
763	if (state == WPA_COMPLETED && wpa_s->new_connection) {
764		struct wpa_ssid *ssid = wpa_s->current_ssid;
765#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
766		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
767			MACSTR " completed [id=%d id_str=%s]",
768			MAC2STR(wpa_s->bssid),
769			ssid ? ssid->id : -1,
770			ssid && ssid->id_str ? ssid->id_str : "");
771#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
772		wpas_clear_temp_disabled(wpa_s, ssid, 1);
773		wpa_blacklist_clear(wpa_s);
774		wpa_s->extra_blacklist_count = 0;
775		wpa_s->new_connection = 0;
776		wpa_drv_set_operstate(wpa_s, 1);
777#ifndef IEEE8021X_EAPOL
778		wpa_drv_set_supp_port(wpa_s, 1);
779#endif /* IEEE8021X_EAPOL */
780		wpa_s->after_wps = 0;
781		wpa_s->known_wps_freq = 0;
782		wpas_p2p_completed(wpa_s);
783
784		sme_sched_obss_scan(wpa_s, 1);
785	} else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
786		   state == WPA_ASSOCIATED) {
787		wpa_s->new_connection = 1;
788		wpa_drv_set_operstate(wpa_s, 0);
789#ifndef IEEE8021X_EAPOL
790		wpa_drv_set_supp_port(wpa_s, 0);
791#endif /* IEEE8021X_EAPOL */
792		sme_sched_obss_scan(wpa_s, 0);
793	}
794	wpa_s->wpa_state = state;
795
796#ifdef CONFIG_BGSCAN
797	if (state == WPA_COMPLETED)
798		wpa_supplicant_start_bgscan(wpa_s);
799	else if (state < WPA_ASSOCIATED)
800		wpa_supplicant_stop_bgscan(wpa_s);
801#endif /* CONFIG_BGSCAN */
802
803	if (state == WPA_AUTHENTICATING)
804		wpa_supplicant_stop_autoscan(wpa_s);
805
806	if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
807		wpa_supplicant_start_autoscan(wpa_s);
808
809	if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
810		wmm_ac_notify_disassoc(wpa_s);
811
812	if (wpa_s->wpa_state != old_state) {
813		wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
814
815		/*
816		 * Notify the P2P Device interface about a state change in one
817		 * of the interfaces.
818		 */
819		wpas_p2p_indicate_state_change(wpa_s);
820
821		if (wpa_s->wpa_state == WPA_COMPLETED ||
822		    old_state == WPA_COMPLETED)
823			wpas_notify_auth_changed(wpa_s);
824	}
825}
826
827
828void wpa_supplicant_terminate_proc(struct wpa_global *global)
829{
830	int pending = 0;
831#ifdef CONFIG_WPS
832	struct wpa_supplicant *wpa_s = global->ifaces;
833	while (wpa_s) {
834		struct wpa_supplicant *next = wpa_s->next;
835		if (wpas_wps_terminate_pending(wpa_s) == 1)
836			pending = 1;
837#ifdef CONFIG_P2P
838		if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
839		    (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
840			wpas_p2p_disconnect(wpa_s);
841#endif /* CONFIG_P2P */
842		wpa_s = next;
843	}
844#endif /* CONFIG_WPS */
845	if (pending)
846		return;
847	eloop_terminate();
848}
849
850
851static void wpa_supplicant_terminate(int sig, void *signal_ctx)
852{
853	struct wpa_global *global = signal_ctx;
854	wpa_supplicant_terminate_proc(global);
855}
856
857
858void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
859{
860	enum wpa_states old_state = wpa_s->wpa_state;
861
862	wpa_s->pairwise_cipher = 0;
863	wpa_s->group_cipher = 0;
864	wpa_s->mgmt_group_cipher = 0;
865	wpa_s->key_mgmt = 0;
866	if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
867		wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
868
869	if (wpa_s->wpa_state != old_state)
870		wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
871}
872
873
874/**
875 * wpa_supplicant_reload_configuration - Reload configuration data
876 * @wpa_s: Pointer to wpa_supplicant data
877 * Returns: 0 on success or -1 if configuration parsing failed
878 *
879 * This function can be used to request that the configuration data is reloaded
880 * (e.g., after configuration file change). This function is reloading
881 * configuration only for one interface, so this may need to be called multiple
882 * times if %wpa_supplicant is controlling multiple interfaces and all
883 * interfaces need reconfiguration.
884 */
885int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
886{
887	struct wpa_config *conf;
888	int reconf_ctrl;
889	int old_ap_scan;
890
891	if (wpa_s->confname == NULL)
892		return -1;
893	conf = wpa_config_read(wpa_s->confname, NULL);
894	if (conf == NULL) {
895		wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
896			"file '%s' - exiting", wpa_s->confname);
897		return -1;
898	}
899	wpa_config_read(wpa_s->confanother, conf);
900
901	conf->changed_parameters = (unsigned int) -1;
902
903	reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
904		|| (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
905		    os_strcmp(conf->ctrl_interface,
906			      wpa_s->conf->ctrl_interface) != 0);
907
908	if (reconf_ctrl && wpa_s->ctrl_iface) {
909		wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
910		wpa_s->ctrl_iface = NULL;
911	}
912
913	eapol_sm_invalidate_cached_session(wpa_s->eapol);
914	if (wpa_s->current_ssid) {
915		if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
916			wpa_s->own_disconnect_req = 1;
917		wpa_supplicant_deauthenticate(wpa_s,
918					      WLAN_REASON_DEAUTH_LEAVING);
919	}
920
921	/*
922	 * TODO: should notify EAPOL SM about changes in opensc_engine_path,
923	 * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
924	 */
925	if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
926		/*
927		 * Clear forced success to clear EAP state for next
928		 * authentication.
929		 */
930		eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
931	}
932	eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
933	wpa_sm_set_config(wpa_s->wpa, NULL);
934	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
935	wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
936	rsn_preauth_deinit(wpa_s->wpa);
937
938	old_ap_scan = wpa_s->conf->ap_scan;
939	wpa_config_free(wpa_s->conf);
940	wpa_s->conf = conf;
941	if (old_ap_scan != wpa_s->conf->ap_scan)
942		wpas_notify_ap_scan_changed(wpa_s);
943
944	if (reconf_ctrl)
945		wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
946
947	wpa_supplicant_update_config(wpa_s);
948
949	wpa_supplicant_clear_status(wpa_s);
950	if (wpa_supplicant_enabled_networks(wpa_s)) {
951		wpa_s->reassociate = 1;
952		wpa_supplicant_req_scan(wpa_s, 0, 0);
953	}
954	wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
955	return 0;
956}
957
958
959static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
960{
961	struct wpa_global *global = signal_ctx;
962	struct wpa_supplicant *wpa_s;
963	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
964		wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
965			sig);
966		if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
967			wpa_supplicant_terminate_proc(global);
968		}
969	}
970
971	if (wpa_debug_reopen_file() < 0) {
972		/* Ignore errors since we cannot really do much to fix this */
973		wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
974	}
975}
976
977
978static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
979					 struct wpa_ssid *ssid,
980					 struct wpa_ie_data *ie)
981{
982	int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
983	if (ret) {
984		if (ret == -2) {
985			wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
986				"from association info");
987		}
988		return -1;
989	}
990
991	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
992		"cipher suites");
993	if (!(ie->group_cipher & ssid->group_cipher)) {
994		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
995			"cipher 0x%x (mask 0x%x) - reject",
996			ie->group_cipher, ssid->group_cipher);
997		return -1;
998	}
999	if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1000		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1001			"cipher 0x%x (mask 0x%x) - reject",
1002			ie->pairwise_cipher, ssid->pairwise_cipher);
1003		return -1;
1004	}
1005	if (!(ie->key_mgmt & ssid->key_mgmt)) {
1006		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1007			"management 0x%x (mask 0x%x) - reject",
1008			ie->key_mgmt, ssid->key_mgmt);
1009		return -1;
1010	}
1011
1012#ifdef CONFIG_IEEE80211W
1013	if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1014	    wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1015		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1016			"that does not support management frame protection - "
1017			"reject");
1018		return -1;
1019	}
1020#endif /* CONFIG_IEEE80211W */
1021
1022	return 0;
1023}
1024
1025
1026/**
1027 * wpa_supplicant_set_suites - Set authentication and encryption parameters
1028 * @wpa_s: Pointer to wpa_supplicant data
1029 * @bss: Scan results for the selected BSS, or %NULL if not available
1030 * @ssid: Configuration data for the selected network
1031 * @wpa_ie: Buffer for the WPA/RSN IE
1032 * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1033 * used buffer length in case the functions returns success.
1034 * Returns: 0 on success or -1 on failure
1035 *
1036 * This function is used to configure authentication and encryption parameters
1037 * based on the network configuration and scan result for the selected BSS (if
1038 * available).
1039 */
1040int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1041			      struct wpa_bss *bss, struct wpa_ssid *ssid,
1042			      u8 *wpa_ie, size_t *wpa_ie_len)
1043{
1044	struct wpa_ie_data ie;
1045	int sel, proto;
1046	const u8 *bss_wpa, *bss_rsn, *bss_osen;
1047
1048	if (bss) {
1049		bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1050		bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1051		bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1052	} else
1053		bss_wpa = bss_rsn = bss_osen = NULL;
1054
1055	if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1056	    wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1057	    (ie.group_cipher & ssid->group_cipher) &&
1058	    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1059	    (ie.key_mgmt & ssid->key_mgmt)) {
1060		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1061		proto = WPA_PROTO_RSN;
1062	} else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1063		   wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1064		   (ie.group_cipher & ssid->group_cipher) &&
1065		   (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1066		   (ie.key_mgmt & ssid->key_mgmt)) {
1067		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1068		proto = WPA_PROTO_WPA;
1069#ifdef CONFIG_HS20
1070	} else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1071		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1072		/* TODO: parse OSEN element */
1073		os_memset(&ie, 0, sizeof(ie));
1074		ie.group_cipher = WPA_CIPHER_CCMP;
1075		ie.pairwise_cipher = WPA_CIPHER_CCMP;
1076		ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1077		proto = WPA_PROTO_OSEN;
1078#endif /* CONFIG_HS20 */
1079	} else if (bss) {
1080		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1081		wpa_dbg(wpa_s, MSG_DEBUG,
1082			"WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1083			ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1084			ssid->key_mgmt);
1085		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1086			MAC2STR(bss->bssid),
1087			wpa_ssid_txt(bss->ssid, bss->ssid_len),
1088			bss_wpa ? " WPA" : "",
1089			bss_rsn ? " RSN" : "",
1090			bss_osen ? " OSEN" : "");
1091		if (bss_rsn) {
1092			wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1093			if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1094				wpa_dbg(wpa_s, MSG_DEBUG,
1095					"Could not parse RSN element");
1096			} else {
1097				wpa_dbg(wpa_s, MSG_DEBUG,
1098					"RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1099					ie.pairwise_cipher, ie.group_cipher,
1100					ie.key_mgmt);
1101			}
1102		}
1103		if (bss_wpa) {
1104			wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1105			if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1106				wpa_dbg(wpa_s, MSG_DEBUG,
1107					"Could not parse WPA element");
1108			} else {
1109				wpa_dbg(wpa_s, MSG_DEBUG,
1110					"WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1111					ie.pairwise_cipher, ie.group_cipher,
1112					ie.key_mgmt);
1113			}
1114		}
1115		return -1;
1116	} else {
1117		if (ssid->proto & WPA_PROTO_OSEN)
1118			proto = WPA_PROTO_OSEN;
1119		else if (ssid->proto & WPA_PROTO_RSN)
1120			proto = WPA_PROTO_RSN;
1121		else
1122			proto = WPA_PROTO_WPA;
1123		if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1124			os_memset(&ie, 0, sizeof(ie));
1125			ie.group_cipher = ssid->group_cipher;
1126			ie.pairwise_cipher = ssid->pairwise_cipher;
1127			ie.key_mgmt = ssid->key_mgmt;
1128#ifdef CONFIG_IEEE80211W
1129			ie.mgmt_group_cipher =
1130				ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1131				WPA_CIPHER_AES_128_CMAC : 0;
1132#endif /* CONFIG_IEEE80211W */
1133			wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1134				"based on configuration");
1135		} else
1136			proto = ie.proto;
1137	}
1138
1139	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1140		"pairwise %d key_mgmt %d proto %d",
1141		ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1142#ifdef CONFIG_IEEE80211W
1143	if (ssid->ieee80211w) {
1144		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1145			ie.mgmt_group_cipher);
1146	}
1147#endif /* CONFIG_IEEE80211W */
1148
1149	wpa_s->wpa_proto = proto;
1150	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1151	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1152			 !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1153
1154	if (bss || !wpa_s->ap_ies_from_associnfo) {
1155		if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1156					 bss_wpa ? 2 + bss_wpa[1] : 0) ||
1157		    wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1158					 bss_rsn ? 2 + bss_rsn[1] : 0))
1159			return -1;
1160	}
1161
1162#ifdef CONFIG_NO_WPA
1163	wpa_s->group_cipher = WPA_CIPHER_NONE;
1164	wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1165#else /* CONFIG_NO_WPA */
1166	sel = ie.group_cipher & ssid->group_cipher;
1167	wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1168	if (wpa_s->group_cipher < 0) {
1169		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1170			"cipher");
1171		return -1;
1172	}
1173	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1174		wpa_cipher_txt(wpa_s->group_cipher));
1175
1176	sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1177	wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1178	if (wpa_s->pairwise_cipher < 0) {
1179		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1180			"cipher");
1181		return -1;
1182	}
1183	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1184		wpa_cipher_txt(wpa_s->pairwise_cipher));
1185#endif /* CONFIG_NO_WPA */
1186
1187	sel = ie.key_mgmt & ssid->key_mgmt;
1188#ifdef CONFIG_SAE
1189	if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1190		sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1191#endif /* CONFIG_SAE */
1192	if (0) {
1193#ifdef CONFIG_SUITEB192
1194	} else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1195		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1196		wpa_dbg(wpa_s, MSG_DEBUG,
1197			"WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1198#endif /* CONFIG_SUITEB192 */
1199#ifdef CONFIG_SUITEB
1200	} else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1201		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1202		wpa_dbg(wpa_s, MSG_DEBUG,
1203			"WPA: using KEY_MGMT 802.1X with Suite B");
1204#endif /* CONFIG_SUITEB */
1205#ifdef CONFIG_IEEE80211R
1206	} else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1207		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1208		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1209	} else if (sel & WPA_KEY_MGMT_FT_PSK) {
1210		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1211		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1212#endif /* CONFIG_IEEE80211R */
1213#ifdef CONFIG_SAE
1214	} else if (sel & WPA_KEY_MGMT_SAE) {
1215		wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1216		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1217	} else if (sel & WPA_KEY_MGMT_FT_SAE) {
1218		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1219		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1220#endif /* CONFIG_SAE */
1221#ifdef CONFIG_IEEE80211W
1222	} else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1223		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1224		wpa_dbg(wpa_s, MSG_DEBUG,
1225			"WPA: using KEY_MGMT 802.1X with SHA256");
1226	} else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1227		wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1228		wpa_dbg(wpa_s, MSG_DEBUG,
1229			"WPA: using KEY_MGMT PSK with SHA256");
1230#endif /* CONFIG_IEEE80211W */
1231	} else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1232		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1233		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1234	} else if (sel & WPA_KEY_MGMT_PSK) {
1235		wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1236		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1237	} else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1238		wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1239		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1240#ifdef CONFIG_HS20
1241	} else if (sel & WPA_KEY_MGMT_OSEN) {
1242		wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1243		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1244#endif /* CONFIG_HS20 */
1245	} else {
1246		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1247			"authenticated key management type");
1248		return -1;
1249	}
1250
1251	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1252	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1253			 wpa_s->pairwise_cipher);
1254	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1255
1256#ifdef CONFIG_IEEE80211W
1257	sel = ie.mgmt_group_cipher;
1258	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1259	    !(ie.capabilities & WPA_CAPABILITY_MFPC))
1260		sel = 0;
1261	if (sel & WPA_CIPHER_AES_128_CMAC) {
1262		wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1263		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1264			"AES-128-CMAC");
1265	} else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1266		wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1267		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1268			"BIP-GMAC-128");
1269	} else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1270		wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1271		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1272			"BIP-GMAC-256");
1273	} else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1274		wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1275		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1276			"BIP-CMAC-256");
1277	} else {
1278		wpa_s->mgmt_group_cipher = 0;
1279		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1280	}
1281	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1282			 wpa_s->mgmt_group_cipher);
1283	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1284			 wpas_get_ssid_pmf(wpa_s, ssid));
1285#endif /* CONFIG_IEEE80211W */
1286
1287	if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1288		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1289		return -1;
1290	}
1291
1292	if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1293		int psk_set = 0;
1294
1295		if (ssid->psk_set) {
1296			wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1297			psk_set = 1;
1298		}
1299#ifndef CONFIG_NO_PBKDF2
1300		if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1301		    ssid->passphrase) {
1302			u8 psk[PMK_LEN];
1303		        pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1304				    4096, psk, PMK_LEN);
1305		        wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1306					psk, PMK_LEN);
1307			wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1308			psk_set = 1;
1309			os_memset(psk, 0, sizeof(psk));
1310		}
1311#endif /* CONFIG_NO_PBKDF2 */
1312#ifdef CONFIG_EXT_PASSWORD
1313		if (ssid->ext_psk) {
1314			struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1315							     ssid->ext_psk);
1316			char pw_str[64 + 1];
1317			u8 psk[PMK_LEN];
1318
1319			if (pw == NULL) {
1320				wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1321					"found from external storage");
1322				return -1;
1323			}
1324
1325			if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1326				wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1327					"PSK length %d in external storage",
1328					(int) wpabuf_len(pw));
1329				ext_password_free(pw);
1330				return -1;
1331			}
1332
1333			os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1334			pw_str[wpabuf_len(pw)] = '\0';
1335
1336#ifndef CONFIG_NO_PBKDF2
1337			if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1338			{
1339				pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1340					    4096, psk, PMK_LEN);
1341				os_memset(pw_str, 0, sizeof(pw_str));
1342				wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1343						"external passphrase)",
1344						psk, PMK_LEN);
1345				wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1346				psk_set = 1;
1347				os_memset(psk, 0, sizeof(psk));
1348			} else
1349#endif /* CONFIG_NO_PBKDF2 */
1350			if (wpabuf_len(pw) == 2 * PMK_LEN) {
1351				if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1352					wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1353						"Invalid PSK hex string");
1354					os_memset(pw_str, 0, sizeof(pw_str));
1355					ext_password_free(pw);
1356					return -1;
1357				}
1358				wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1359				psk_set = 1;
1360				os_memset(psk, 0, sizeof(psk));
1361			} else {
1362				wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1363					"PSK available");
1364				os_memset(pw_str, 0, sizeof(pw_str));
1365				ext_password_free(pw);
1366				return -1;
1367			}
1368
1369			os_memset(pw_str, 0, sizeof(pw_str));
1370			ext_password_free(pw);
1371		}
1372#endif /* CONFIG_EXT_PASSWORD */
1373
1374		if (!psk_set) {
1375			wpa_msg(wpa_s, MSG_INFO,
1376				"No PSK available for association");
1377			return -1;
1378		}
1379	} else
1380		wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1381
1382	return 0;
1383}
1384
1385
1386static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1387{
1388	*pos = 0x00;
1389
1390	switch (idx) {
1391	case 0: /* Bits 0-7 */
1392		break;
1393	case 1: /* Bits 8-15 */
1394		break;
1395	case 2: /* Bits 16-23 */
1396#ifdef CONFIG_WNM
1397		*pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1398		*pos |= 0x08; /* Bit 19 - BSS Transition */
1399#endif /* CONFIG_WNM */
1400		break;
1401	case 3: /* Bits 24-31 */
1402#ifdef CONFIG_WNM
1403		*pos |= 0x02; /* Bit 25 - SSID List */
1404#endif /* CONFIG_WNM */
1405#ifdef CONFIG_INTERWORKING
1406		if (wpa_s->conf->interworking)
1407			*pos |= 0x80; /* Bit 31 - Interworking */
1408#endif /* CONFIG_INTERWORKING */
1409		break;
1410	case 4: /* Bits 32-39 */
1411#ifdef CONFIG_INTERWORKING
1412		if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1413			*pos |= 0x01; /* Bit 32 - QoS Map */
1414#endif /* CONFIG_INTERWORKING */
1415		break;
1416	case 5: /* Bits 40-47 */
1417#ifdef CONFIG_HS20
1418		if (wpa_s->conf->hs20)
1419			*pos |= 0x40; /* Bit 46 - WNM-Notification */
1420#endif /* CONFIG_HS20 */
1421		break;
1422	case 6: /* Bits 48-55 */
1423		break;
1424	}
1425}
1426
1427
1428int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1429{
1430	u8 *pos = buf;
1431	u8 len = 6, i;
1432
1433	if (len < wpa_s->extended_capa_len)
1434		len = wpa_s->extended_capa_len;
1435	if (buflen < (size_t) len + 2) {
1436		wpa_printf(MSG_INFO,
1437			   "Not enough room for building extended capabilities element");
1438		return -1;
1439	}
1440
1441	*pos++ = WLAN_EID_EXT_CAPAB;
1442	*pos++ = len;
1443	for (i = 0; i < len; i++, pos++) {
1444		wpas_ext_capab_byte(wpa_s, pos, i);
1445
1446		if (i < wpa_s->extended_capa_len) {
1447			*pos &= ~wpa_s->extended_capa_mask[i];
1448			*pos |= wpa_s->extended_capa[i];
1449		}
1450	}
1451
1452	while (len > 0 && buf[1 + len] == 0) {
1453		len--;
1454		buf[1] = len;
1455	}
1456	if (len == 0)
1457		return 0;
1458
1459	return 2 + len;
1460}
1461
1462
1463static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1464			  struct wpa_bss *test_bss)
1465{
1466	struct wpa_bss *bss;
1467
1468	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1469		if (bss == test_bss)
1470			return 1;
1471	}
1472
1473	return 0;
1474}
1475
1476
1477static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1478			   struct wpa_ssid *test_ssid)
1479{
1480	struct wpa_ssid *ssid;
1481
1482	for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1483		if (ssid == test_ssid)
1484			return 1;
1485	}
1486
1487	return 0;
1488}
1489
1490
1491int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1492			struct wpa_ssid *test_ssid)
1493{
1494	if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1495		return 0;
1496
1497	return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1498}
1499
1500
1501void wpas_connect_work_free(struct wpa_connect_work *cwork)
1502{
1503	if (cwork == NULL)
1504		return;
1505	os_free(cwork);
1506}
1507
1508
1509void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1510{
1511	struct wpa_connect_work *cwork;
1512	struct wpa_radio_work *work = wpa_s->connect_work;
1513
1514	if (!work)
1515		return;
1516
1517	wpa_s->connect_work = NULL;
1518	cwork = work->ctx;
1519	work->ctx = NULL;
1520	wpas_connect_work_free(cwork);
1521	radio_work_done(work);
1522}
1523
1524
1525int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1526{
1527	struct os_reltime now;
1528	u8 addr[ETH_ALEN];
1529
1530	os_get_reltime(&now);
1531	if (wpa_s->last_mac_addr_style == style &&
1532	    wpa_s->last_mac_addr_change.sec != 0 &&
1533	    !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1534				wpa_s->conf->rand_addr_lifetime)) {
1535		wpa_msg(wpa_s, MSG_DEBUG,
1536			"Previously selected random MAC address has not yet expired");
1537		return 0;
1538	}
1539
1540	switch (style) {
1541	case 1:
1542		if (random_mac_addr(addr) < 0)
1543			return -1;
1544		break;
1545	case 2:
1546		os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1547		if (random_mac_addr_keep_oui(addr) < 0)
1548			return -1;
1549		break;
1550	default:
1551		return -1;
1552	}
1553
1554	if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1555		wpa_msg(wpa_s, MSG_INFO,
1556			"Failed to set random MAC address");
1557		return -1;
1558	}
1559
1560	os_get_reltime(&wpa_s->last_mac_addr_change);
1561	wpa_s->mac_addr_changed = 1;
1562	wpa_s->last_mac_addr_style = style;
1563
1564	if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1565		wpa_msg(wpa_s, MSG_INFO,
1566			"Could not update MAC address information");
1567		return -1;
1568	}
1569
1570	wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1571		MAC2STR(addr));
1572
1573	return 0;
1574}
1575
1576
1577int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1578{
1579	if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1580	    !wpa_s->conf->preassoc_mac_addr)
1581		return 0;
1582
1583	return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1584}
1585
1586
1587static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1588
1589/**
1590 * wpa_supplicant_associate - Request association
1591 * @wpa_s: Pointer to wpa_supplicant data
1592 * @bss: Scan results for the selected BSS, or %NULL if not available
1593 * @ssid: Configuration data for the selected network
1594 *
1595 * This function is used to request %wpa_supplicant to associate with a BSS.
1596 */
1597void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1598			      struct wpa_bss *bss, struct wpa_ssid *ssid)
1599{
1600	struct wpa_connect_work *cwork;
1601	int rand_style;
1602
1603	wpa_s->own_disconnect_req = 0;
1604
1605	/*
1606	 * If we are starting a new connection, any previously pending EAPOL
1607	 * RX cannot be valid anymore.
1608	 */
1609	wpabuf_free(wpa_s->pending_eapol_rx);
1610	wpa_s->pending_eapol_rx = NULL;
1611
1612	if (ssid->mac_addr == -1)
1613		rand_style = wpa_s->conf->mac_addr;
1614	else
1615		rand_style = ssid->mac_addr;
1616
1617	wmm_ac_clear_saved_tspecs(wpa_s);
1618	wpa_s->reassoc_same_bss = 0;
1619
1620	if (wpa_s->last_ssid == ssid) {
1621		wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1622		if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1623			wmm_ac_save_tspecs(wpa_s);
1624			wpa_s->reassoc_same_bss = 1;
1625		}
1626	} else if (rand_style > 0) {
1627		if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1628			return;
1629		wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1630	} else if (wpa_s->mac_addr_changed) {
1631		if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1632			wpa_msg(wpa_s, MSG_INFO,
1633				"Could not restore permanent MAC address");
1634			return;
1635		}
1636		wpa_s->mac_addr_changed = 0;
1637		if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1638			wpa_msg(wpa_s, MSG_INFO,
1639				"Could not update MAC address information");
1640			return;
1641		}
1642		wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1643	}
1644	wpa_s->last_ssid = ssid;
1645
1646#ifdef CONFIG_IBSS_RSN
1647	ibss_rsn_deinit(wpa_s->ibss_rsn);
1648	wpa_s->ibss_rsn = NULL;
1649#endif /* CONFIG_IBSS_RSN */
1650
1651	if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1652	    ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1653#ifdef CONFIG_AP
1654		if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1655			wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1656				"mode");
1657			return;
1658		}
1659		if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1660			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1661			if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1662				wpas_p2p_ap_setup_failed(wpa_s);
1663			return;
1664		}
1665		wpa_s->current_bss = bss;
1666#else /* CONFIG_AP */
1667		wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1668			"the build");
1669#endif /* CONFIG_AP */
1670		return;
1671	}
1672
1673	if (ssid->mode == WPAS_MODE_MESH) {
1674#ifdef CONFIG_MESH
1675		if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1676			wpa_msg(wpa_s, MSG_INFO,
1677				"Driver does not support mesh mode");
1678			return;
1679		}
1680		if (bss)
1681			ssid->frequency = bss->freq;
1682		if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1683			wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1684			return;
1685		}
1686		wpa_s->current_bss = bss;
1687		wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1688			wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1689			ssid->id);
1690#else /* CONFIG_MESH */
1691		wpa_msg(wpa_s, MSG_ERROR,
1692			"mesh mode support not included in the build");
1693#endif /* CONFIG_MESH */
1694		return;
1695	}
1696
1697#ifdef CONFIG_TDLS
1698	if (bss)
1699		wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1700				bss->ie_len);
1701#endif /* CONFIG_TDLS */
1702
1703	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1704	    ssid->mode == IEEE80211_MODE_INFRA) {
1705		sme_authenticate(wpa_s, bss, ssid);
1706		return;
1707	}
1708
1709	if (wpa_s->connect_work) {
1710		wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1711		return;
1712	}
1713
1714	if (radio_work_pending(wpa_s, "connect")) {
1715		wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1716		return;
1717	}
1718
1719	wpas_abort_ongoing_scan(wpa_s);
1720
1721	cwork = os_zalloc(sizeof(*cwork));
1722	if (cwork == NULL)
1723		return;
1724
1725	cwork->bss = bss;
1726	cwork->ssid = ssid;
1727
1728	if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1729			   wpas_start_assoc_cb, cwork) < 0) {
1730		os_free(cwork);
1731	}
1732}
1733
1734
1735static int bss_is_ibss(struct wpa_bss *bss)
1736{
1737	return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1738		IEEE80211_CAP_IBSS;
1739}
1740
1741
1742static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1743			    const struct wpa_ssid *ssid)
1744{
1745	enum hostapd_hw_mode hw_mode;
1746	struct hostapd_hw_modes *mode = NULL;
1747	u8 channel;
1748	int i;
1749
1750#ifdef CONFIG_HT_OVERRIDES
1751	if (ssid->disable_ht)
1752		return 0;
1753#endif /* CONFIG_HT_OVERRIDES */
1754
1755	hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1756	if (hw_mode == NUM_HOSTAPD_MODES)
1757		return 0;
1758	for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1759		if (wpa_s->hw.modes[i].mode == hw_mode) {
1760			mode = &wpa_s->hw.modes[i];
1761			break;
1762		}
1763	}
1764
1765	if (!mode)
1766		return 0;
1767
1768	return mode->vht_capab != 0;
1769}
1770
1771
1772void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1773			  const struct wpa_ssid *ssid,
1774			  struct hostapd_freq_params *freq)
1775{
1776	enum hostapd_hw_mode hw_mode;
1777	struct hostapd_hw_modes *mode = NULL;
1778	int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1779			   184, 192 };
1780	int vht80[] = { 36, 52, 100, 116, 132, 149 };
1781	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1782	u8 channel;
1783	int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1784	unsigned int j, k;
1785	struct hostapd_freq_params vht_freq;
1786	int chwidth, seg0, seg1;
1787	u32 vht_caps = 0;
1788
1789	freq->freq = ssid->frequency;
1790
1791	for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1792		struct wpa_bss *bss = wpa_s->last_scan_res[j];
1793
1794		if (ssid->mode != WPAS_MODE_IBSS)
1795			break;
1796
1797		/* Don't adjust control freq in case of fixed_freq */
1798		if (ssid->fixed_freq)
1799			break;
1800
1801		if (!bss_is_ibss(bss))
1802			continue;
1803
1804		if (ssid->ssid_len == bss->ssid_len &&
1805		    os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1806			wpa_printf(MSG_DEBUG,
1807				   "IBSS already found in scan results, adjust control freq: %d",
1808				   bss->freq);
1809			freq->freq = bss->freq;
1810			obss_scan = 0;
1811			break;
1812		}
1813	}
1814
1815	/* For IBSS check HT_IBSS flag */
1816	if (ssid->mode == WPAS_MODE_IBSS &&
1817	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1818		return;
1819
1820	if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1821	    wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1822	    wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1823		wpa_printf(MSG_DEBUG,
1824			   "IBSS: WEP/TKIP detected, do not try to enable HT");
1825		return;
1826	}
1827
1828	hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1829	for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1830		if (wpa_s->hw.modes[i].mode == hw_mode) {
1831			mode = &wpa_s->hw.modes[i];
1832			break;
1833		}
1834	}
1835
1836	if (!mode)
1837		return;
1838
1839	freq->ht_enabled = ht_supported(mode);
1840	if (!freq->ht_enabled)
1841		return;
1842
1843	/* Setup higher BW only for 5 GHz */
1844	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1845		return;
1846
1847	for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1848		pri_chan = &mode->channels[chan_idx];
1849		if (pri_chan->chan == channel)
1850			break;
1851		pri_chan = NULL;
1852	}
1853	if (!pri_chan)
1854		return;
1855
1856	/* Check primary channel flags */
1857	if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1858		return;
1859
1860	/* Check/setup HT40+/HT40- */
1861	for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1862		if (ht40plus[j] == channel) {
1863			ht40 = 1;
1864			break;
1865		}
1866	}
1867
1868	/* Find secondary channel */
1869	for (i = 0; i < mode->num_channels; i++) {
1870		sec_chan = &mode->channels[i];
1871		if (sec_chan->chan == channel + ht40 * 4)
1872			break;
1873		sec_chan = NULL;
1874	}
1875	if (!sec_chan)
1876		return;
1877
1878	/* Check secondary channel flags */
1879	if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1880		return;
1881
1882	freq->channel = pri_chan->chan;
1883
1884	switch (ht40) {
1885	case -1:
1886		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1887			return;
1888		freq->sec_channel_offset = -1;
1889		break;
1890	case 1:
1891		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1892			return;
1893		freq->sec_channel_offset = 1;
1894		break;
1895	default:
1896		break;
1897	}
1898
1899	if (freq->sec_channel_offset && obss_scan) {
1900		struct wpa_scan_results *scan_res;
1901
1902		scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1903		if (scan_res == NULL) {
1904			/* Back to HT20 */
1905			freq->sec_channel_offset = 0;
1906			return;
1907		}
1908
1909		res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1910				     sec_chan->chan);
1911		switch (res) {
1912		case 0:
1913			/* Back to HT20 */
1914			freq->sec_channel_offset = 0;
1915			break;
1916		case 1:
1917			/* Configuration allowed */
1918			break;
1919		case 2:
1920			/* Switch pri/sec channels */
1921			freq->freq = hw_get_freq(mode, sec_chan->chan);
1922			freq->sec_channel_offset = -freq->sec_channel_offset;
1923			freq->channel = sec_chan->chan;
1924			break;
1925		default:
1926			freq->sec_channel_offset = 0;
1927			break;
1928		}
1929
1930		wpa_scan_results_free(scan_res);
1931	}
1932
1933	wpa_printf(MSG_DEBUG,
1934		   "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1935		   freq->channel, freq->sec_channel_offset);
1936
1937	if (!drv_supports_vht(wpa_s, ssid))
1938		return;
1939
1940	/* For IBSS check VHT_IBSS flag */
1941	if (ssid->mode == WPAS_MODE_IBSS &&
1942	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1943		return;
1944
1945	vht_freq = *freq;
1946
1947	vht_freq.vht_enabled = vht_supported(mode);
1948	if (!vht_freq.vht_enabled)
1949		return;
1950
1951	/* setup center_freq1, bandwidth */
1952	for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1953		if (freq->channel >= vht80[j] &&
1954		    freq->channel < vht80[j] + 16)
1955			break;
1956	}
1957
1958	if (j == ARRAY_SIZE(vht80))
1959		return;
1960
1961	for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1962		struct hostapd_channel_data *chan;
1963
1964		chan = hw_get_channel_chan(mode, i, NULL);
1965		if (!chan)
1966			return;
1967
1968		/* Back to HT configuration if channel not usable */
1969		if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1970			return;
1971	}
1972
1973	chwidth = VHT_CHANWIDTH_80MHZ;
1974	seg0 = vht80[j] + 6;
1975	seg1 = 0;
1976
1977	if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
1978		/* setup center_freq2, bandwidth */
1979		for (k = 0; k < ARRAY_SIZE(vht80); k++) {
1980			/* Only accept 80 MHz segments separated by a gap */
1981			if (j == k || abs(vht80[j] - vht80[k]) == 16)
1982				continue;
1983			for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
1984				struct hostapd_channel_data *chan;
1985
1986				chan = hw_get_channel_chan(mode, i, NULL);
1987				if (!chan)
1988					continue;
1989
1990				if (chan->flag & (HOSTAPD_CHAN_DISABLED |
1991						  HOSTAPD_CHAN_NO_IR |
1992						  HOSTAPD_CHAN_RADAR))
1993					continue;
1994
1995				/* Found a suitable second segment for 80+80 */
1996				chwidth = VHT_CHANWIDTH_80P80MHZ;
1997				vht_caps |=
1998					VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1999				seg1 = vht80[k] + 6;
2000			}
2001
2002			if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2003				break;
2004		}
2005	}
2006
2007	if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2008				    freq->channel, freq->ht_enabled,
2009				    vht_freq.vht_enabled,
2010				    freq->sec_channel_offset,
2011				    chwidth, seg0, seg1, vht_caps) != 0)
2012		return;
2013
2014	*freq = vht_freq;
2015
2016	wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2017		   freq->center_freq1, freq->center_freq2, freq->bandwidth);
2018}
2019
2020
2021static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2022{
2023	struct wpa_connect_work *cwork = work->ctx;
2024	struct wpa_bss *bss = cwork->bss;
2025	struct wpa_ssid *ssid = cwork->ssid;
2026	struct wpa_supplicant *wpa_s = work->wpa_s;
2027	u8 wpa_ie[200];
2028	size_t wpa_ie_len;
2029	int use_crypt, ret, i, bssid_changed;
2030	int algs = WPA_AUTH_ALG_OPEN;
2031	unsigned int cipher_pairwise, cipher_group;
2032	struct wpa_driver_associate_params params;
2033	int wep_keys_set = 0;
2034	int assoc_failed = 0;
2035	struct wpa_ssid *old_ssid;
2036#ifdef CONFIG_HT_OVERRIDES
2037	struct ieee80211_ht_capabilities htcaps;
2038	struct ieee80211_ht_capabilities htcaps_mask;
2039#endif /* CONFIG_HT_OVERRIDES */
2040#ifdef CONFIG_VHT_OVERRIDES
2041       struct ieee80211_vht_capabilities vhtcaps;
2042       struct ieee80211_vht_capabilities vhtcaps_mask;
2043#endif /* CONFIG_VHT_OVERRIDES */
2044
2045	if (deinit) {
2046		if (work->started) {
2047			wpa_s->connect_work = NULL;
2048
2049			/* cancel possible auth. timeout */
2050			eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2051					     NULL);
2052		}
2053		wpas_connect_work_free(cwork);
2054		return;
2055	}
2056
2057	wpa_s->connect_work = work;
2058
2059	if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2060	    wpas_network_disabled(wpa_s, ssid)) {
2061		wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2062		wpas_connect_work_done(wpa_s);
2063		return;
2064	}
2065
2066	os_memset(&params, 0, sizeof(params));
2067	wpa_s->reassociate = 0;
2068	wpa_s->eap_expected_failure = 0;
2069	if (bss &&
2070	    (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2071#ifdef CONFIG_IEEE80211R
2072		const u8 *ie, *md = NULL;
2073#endif /* CONFIG_IEEE80211R */
2074		wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2075			" (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2076			wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2077		bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2078		os_memset(wpa_s->bssid, 0, ETH_ALEN);
2079		os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2080		if (bssid_changed)
2081			wpas_notify_bssid_changed(wpa_s);
2082#ifdef CONFIG_IEEE80211R
2083		ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2084		if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2085			md = ie + 2;
2086		wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2087		if (md) {
2088			/* Prepare for the next transition */
2089			wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2090		}
2091#endif /* CONFIG_IEEE80211R */
2092#ifdef CONFIG_WPS
2093	} else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2094		   wpa_s->conf->ap_scan == 2 &&
2095		   (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2096		/* Use ap_scan==1 style network selection to find the network
2097		 */
2098		wpas_connect_work_done(wpa_s);
2099		wpa_s->scan_req = MANUAL_SCAN_REQ;
2100		wpa_s->reassociate = 1;
2101		wpa_supplicant_req_scan(wpa_s, 0, 0);
2102		return;
2103#endif /* CONFIG_WPS */
2104	} else {
2105		wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2106			wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2107		os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2108	}
2109	if (!wpa_s->pno)
2110		wpa_supplicant_cancel_sched_scan(wpa_s);
2111
2112	wpa_supplicant_cancel_scan(wpa_s);
2113
2114	/* Starting new association, so clear the possibly used WPA IE from the
2115	 * previous association. */
2116	wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2117
2118#ifdef IEEE8021X_EAPOL
2119	if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2120		if (ssid->leap) {
2121			if (ssid->non_leap == 0)
2122				algs = WPA_AUTH_ALG_LEAP;
2123			else
2124				algs |= WPA_AUTH_ALG_LEAP;
2125		}
2126	}
2127#endif /* IEEE8021X_EAPOL */
2128	wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2129	if (ssid->auth_alg) {
2130		algs = ssid->auth_alg;
2131		wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2132			"0x%x", algs);
2133	}
2134
2135	if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2136		    wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2137	    wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2138		int try_opportunistic;
2139		try_opportunistic = (ssid->proactive_key_caching < 0 ?
2140				     wpa_s->conf->okc :
2141				     ssid->proactive_key_caching) &&
2142			(ssid->proto & WPA_PROTO_RSN);
2143		if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2144					    ssid, try_opportunistic) == 0)
2145			eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2146		wpa_ie_len = sizeof(wpa_ie);
2147		if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2148					      wpa_ie, &wpa_ie_len)) {
2149			wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2150				"key management and encryption suites");
2151			wpas_connect_work_done(wpa_s);
2152			return;
2153		}
2154	} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2155		   wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2156		/*
2157		 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2158		 * use non-WPA since the scan results did not indicate that the
2159		 * AP is using WPA or WPA2.
2160		 */
2161		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2162		wpa_ie_len = 0;
2163		wpa_s->wpa_proto = 0;
2164	} else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2165		wpa_ie_len = sizeof(wpa_ie);
2166		if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2167					      wpa_ie, &wpa_ie_len)) {
2168			wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2169				"key management and encryption suites (no "
2170				"scan results)");
2171			wpas_connect_work_done(wpa_s);
2172			return;
2173		}
2174#ifdef CONFIG_WPS
2175	} else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2176		struct wpabuf *wps_ie;
2177		wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2178		if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2179			wpa_ie_len = wpabuf_len(wps_ie);
2180			os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2181		} else
2182			wpa_ie_len = 0;
2183		wpabuf_free(wps_ie);
2184		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2185		if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2186			params.wps = WPS_MODE_PRIVACY;
2187		else
2188			params.wps = WPS_MODE_OPEN;
2189		wpa_s->wpa_proto = 0;
2190#endif /* CONFIG_WPS */
2191	} else {
2192		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2193		wpa_ie_len = 0;
2194		wpa_s->wpa_proto = 0;
2195	}
2196
2197#ifdef CONFIG_P2P
2198	if (wpa_s->global->p2p) {
2199		u8 *pos;
2200		size_t len;
2201		int res;
2202		pos = wpa_ie + wpa_ie_len;
2203		len = sizeof(wpa_ie) - wpa_ie_len;
2204		res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2205					    ssid->p2p_group);
2206		if (res >= 0)
2207			wpa_ie_len += res;
2208	}
2209
2210	wpa_s->cross_connect_disallowed = 0;
2211	if (bss) {
2212		struct wpabuf *p2p;
2213		p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2214		if (p2p) {
2215			wpa_s->cross_connect_disallowed =
2216				p2p_get_cross_connect_disallowed(p2p);
2217			wpabuf_free(p2p);
2218			wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2219				"connection",
2220				wpa_s->cross_connect_disallowed ?
2221				"disallows" : "allows");
2222		}
2223	}
2224
2225	os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2226#endif /* CONFIG_P2P */
2227
2228#ifdef CONFIG_HS20
2229	if (is_hs20_network(wpa_s, ssid, bss)) {
2230		struct wpabuf *hs20;
2231		hs20 = wpabuf_alloc(20);
2232		if (hs20) {
2233			int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2234			size_t len;
2235
2236			wpas_hs20_add_indication(hs20, pps_mo_id);
2237			len = sizeof(wpa_ie) - wpa_ie_len;
2238			if (wpabuf_len(hs20) <= len) {
2239				os_memcpy(wpa_ie + wpa_ie_len,
2240					  wpabuf_head(hs20), wpabuf_len(hs20));
2241				wpa_ie_len += wpabuf_len(hs20);
2242			}
2243			wpabuf_free(hs20);
2244		}
2245	}
2246#endif /* CONFIG_HS20 */
2247
2248	/*
2249	 * Workaround: Add Extended Capabilities element only if the AP
2250	 * included this element in Beacon/Probe Response frames. Some older
2251	 * APs seem to have interoperability issues if this element is
2252	 * included, so while the standard may require us to include the
2253	 * element in all cases, it is justifiable to skip it to avoid
2254	 * interoperability issues.
2255	 */
2256	if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2257		u8 ext_capab[18];
2258		int ext_capab_len;
2259		ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2260						     sizeof(ext_capab));
2261		if (ext_capab_len > 0) {
2262			u8 *pos = wpa_ie;
2263			if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2264				pos += 2 + pos[1];
2265			os_memmove(pos + ext_capab_len, pos,
2266				   wpa_ie_len - (pos - wpa_ie));
2267			wpa_ie_len += ext_capab_len;
2268			os_memcpy(pos, ext_capab, ext_capab_len);
2269		}
2270	}
2271
2272	if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2273		struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2274		size_t len;
2275
2276		len = sizeof(wpa_ie) - wpa_ie_len;
2277		if (wpabuf_len(buf) <= len) {
2278			os_memcpy(wpa_ie + wpa_ie_len,
2279				  wpabuf_head(buf), wpabuf_len(buf));
2280			wpa_ie_len += wpabuf_len(buf);
2281		}
2282	}
2283
2284#ifdef CONFIG_FST
2285	if (wpa_s->fst_ies) {
2286		int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2287
2288		if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2289			os_memcpy(wpa_ie + wpa_ie_len,
2290				  wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2291			wpa_ie_len += fst_ies_len;
2292		}
2293	}
2294#endif /* CONFIG_FST */
2295
2296	wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2297	use_crypt = 1;
2298	cipher_pairwise = wpa_s->pairwise_cipher;
2299	cipher_group = wpa_s->group_cipher;
2300	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2301	    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2302		if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2303			use_crypt = 0;
2304		if (wpa_set_wep_keys(wpa_s, ssid)) {
2305			use_crypt = 1;
2306			wep_keys_set = 1;
2307		}
2308	}
2309	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2310		use_crypt = 0;
2311
2312#ifdef IEEE8021X_EAPOL
2313	if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2314		if ((ssid->eapol_flags &
2315		     (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2316		      EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2317		    !wep_keys_set) {
2318			use_crypt = 0;
2319		} else {
2320			/* Assume that dynamic WEP-104 keys will be used and
2321			 * set cipher suites in order for drivers to expect
2322			 * encryption. */
2323			cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2324		}
2325	}
2326#endif /* IEEE8021X_EAPOL */
2327
2328	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2329		/* Set the key before (and later after) association */
2330		wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2331	}
2332
2333	wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2334	if (bss) {
2335		params.ssid = bss->ssid;
2336		params.ssid_len = bss->ssid_len;
2337		if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2338			wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2339				   MACSTR " freq=%u MHz based on scan results "
2340				   "(bssid_set=%d)",
2341				   MAC2STR(bss->bssid), bss->freq,
2342				   ssid->bssid_set);
2343			params.bssid = bss->bssid;
2344			params.freq.freq = bss->freq;
2345		}
2346		params.bssid_hint = bss->bssid;
2347		params.freq_hint = bss->freq;
2348	} else {
2349		params.ssid = ssid->ssid;
2350		params.ssid_len = ssid->ssid_len;
2351	}
2352
2353	if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2354	    wpa_s->conf->ap_scan == 2) {
2355		params.bssid = ssid->bssid;
2356		params.fixed_bssid = 1;
2357	}
2358
2359	/* Initial frequency for IBSS/mesh */
2360	if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2361	    ssid->frequency > 0 && params.freq.freq == 0)
2362		ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2363
2364	if (ssid->mode == WPAS_MODE_IBSS) {
2365		params.fixed_freq = ssid->fixed_freq;
2366		if (ssid->beacon_int)
2367			params.beacon_int = ssid->beacon_int;
2368		else
2369			params.beacon_int = wpa_s->conf->beacon_int;
2370	}
2371
2372	params.wpa_ie = wpa_ie;
2373	params.wpa_ie_len = wpa_ie_len;
2374	params.pairwise_suite = cipher_pairwise;
2375	params.group_suite = cipher_group;
2376	params.key_mgmt_suite = wpa_s->key_mgmt;
2377	params.wpa_proto = wpa_s->wpa_proto;
2378	params.auth_alg = algs;
2379	params.mode = ssid->mode;
2380	params.bg_scan_period = ssid->bg_scan_period;
2381	for (i = 0; i < NUM_WEP_KEYS; i++) {
2382		if (ssid->wep_key_len[i])
2383			params.wep_key[i] = ssid->wep_key[i];
2384		params.wep_key_len[i] = ssid->wep_key_len[i];
2385	}
2386	params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2387
2388	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2389	    (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2390	     params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2391		params.passphrase = ssid->passphrase;
2392		if (ssid->psk_set)
2393			params.psk = ssid->psk;
2394	}
2395
2396	if (wpa_s->conf->key_mgmt_offload) {
2397		if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2398		    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2399		    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2400		    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2401			params.req_key_mgmt_offload =
2402				ssid->proactive_key_caching < 0 ?
2403				wpa_s->conf->okc : ssid->proactive_key_caching;
2404		else
2405			params.req_key_mgmt_offload = 1;
2406
2407		if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2408		     params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2409		     params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2410		    ssid->psk_set)
2411			params.psk = ssid->psk;
2412	}
2413
2414	params.drop_unencrypted = use_crypt;
2415
2416#ifdef CONFIG_IEEE80211W
2417	params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2418	if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2419		const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2420		struct wpa_ie_data ie;
2421		if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2422		    ie.capabilities &
2423		    (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2424			wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2425				"MFP: require MFP");
2426			params.mgmt_frame_protection =
2427				MGMT_FRAME_PROTECTION_REQUIRED;
2428		}
2429	}
2430#endif /* CONFIG_IEEE80211W */
2431
2432	params.p2p = ssid->p2p_group;
2433
2434	if (wpa_s->parent->set_sta_uapsd)
2435		params.uapsd = wpa_s->parent->sta_uapsd;
2436	else
2437		params.uapsd = -1;
2438
2439#ifdef CONFIG_HT_OVERRIDES
2440	os_memset(&htcaps, 0, sizeof(htcaps));
2441	os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2442	params.htcaps = (u8 *) &htcaps;
2443	params.htcaps_mask = (u8 *) &htcaps_mask;
2444	wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2445#endif /* CONFIG_HT_OVERRIDES */
2446#ifdef CONFIG_VHT_OVERRIDES
2447	os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2448	os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2449	params.vhtcaps = &vhtcaps;
2450	params.vhtcaps_mask = &vhtcaps_mask;
2451	wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2452#endif /* CONFIG_VHT_OVERRIDES */
2453
2454#ifdef CONFIG_P2P
2455	/*
2456	 * If multi-channel concurrency is not supported, check for any
2457	 * frequency conflict. In case of any frequency conflict, remove the
2458	 * least prioritized connection.
2459	 */
2460	if (wpa_s->num_multichan_concurrent < 2) {
2461		int freq, num;
2462		num = get_shared_radio_freqs(wpa_s, &freq, 1);
2463		if (num > 0 && freq > 0 && freq != params.freq.freq) {
2464			wpa_printf(MSG_DEBUG,
2465				   "Assoc conflicting freq found (%d != %d)",
2466				   freq, params.freq.freq);
2467			if (wpas_p2p_handle_frequency_conflicts(
2468				    wpa_s, params.freq.freq, ssid) < 0) {
2469				wpas_connect_work_done(wpa_s);
2470				return;
2471			}
2472		}
2473	}
2474#endif /* CONFIG_P2P */
2475
2476	ret = wpa_drv_associate(wpa_s, &params);
2477	if (ret < 0) {
2478		wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2479			"failed");
2480		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2481			/*
2482			 * The driver is known to mean what is saying, so we
2483			 * can stop right here; the association will not
2484			 * succeed.
2485			 */
2486			wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2487			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2488			os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2489			return;
2490		}
2491		/* try to continue anyway; new association will be tried again
2492		 * after timeout */
2493		assoc_failed = 1;
2494	}
2495
2496	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2497		/* Set the key after the association just in case association
2498		 * cleared the previously configured key. */
2499		wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2500		/* No need to timeout authentication since there is no key
2501		 * management. */
2502		wpa_supplicant_cancel_auth_timeout(wpa_s);
2503		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2504#ifdef CONFIG_IBSS_RSN
2505	} else if (ssid->mode == WPAS_MODE_IBSS &&
2506		   wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2507		   wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2508		/*
2509		 * RSN IBSS authentication is per-STA and we can disable the
2510		 * per-BSSID authentication.
2511		 */
2512		wpa_supplicant_cancel_auth_timeout(wpa_s);
2513#endif /* CONFIG_IBSS_RSN */
2514	} else {
2515		/* Timeout for IEEE 802.11 authentication and association */
2516		int timeout = 60;
2517
2518		if (assoc_failed) {
2519			/* give IBSS a bit more time */
2520			timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2521		} else if (wpa_s->conf->ap_scan == 1) {
2522			/* give IBSS a bit more time */
2523			timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2524		}
2525		wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2526	}
2527
2528	if (wep_keys_set &&
2529	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2530		/* Set static WEP keys again */
2531		wpa_set_wep_keys(wpa_s, ssid);
2532	}
2533
2534	if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2535		/*
2536		 * Do not allow EAP session resumption between different
2537		 * network configurations.
2538		 */
2539		eapol_sm_invalidate_cached_session(wpa_s->eapol);
2540	}
2541	old_ssid = wpa_s->current_ssid;
2542	wpa_s->current_ssid = ssid;
2543	if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2544		wpa_s->current_bss = bss;
2545	wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2546	wpa_supplicant_initiate_eapol(wpa_s);
2547	if (old_ssid != wpa_s->current_ssid)
2548		wpas_notify_network_changed(wpa_s);
2549}
2550
2551
2552static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2553					    const u8 *addr)
2554{
2555	struct wpa_ssid *old_ssid;
2556
2557	wpas_connect_work_done(wpa_s);
2558	wpa_clear_keys(wpa_s, addr);
2559	old_ssid = wpa_s->current_ssid;
2560	wpa_supplicant_mark_disassoc(wpa_s);
2561	wpa_sm_set_config(wpa_s->wpa, NULL);
2562	eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2563	if (old_ssid != wpa_s->current_ssid)
2564		wpas_notify_network_changed(wpa_s);
2565	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2566}
2567
2568
2569/**
2570 * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2571 * @wpa_s: Pointer to wpa_supplicant data
2572 * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2573 *
2574 * This function is used to request %wpa_supplicant to deauthenticate from the
2575 * current AP.
2576 */
2577void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2578				   int reason_code)
2579{
2580	u8 *addr = NULL;
2581	union wpa_event_data event;
2582	int zero_addr = 0;
2583
2584	wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2585		" pending_bssid=" MACSTR " reason=%d state=%s",
2586		MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2587		reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2588
2589	if (!is_zero_ether_addr(wpa_s->bssid))
2590		addr = wpa_s->bssid;
2591	else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2592		 (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2593		  wpa_s->wpa_state == WPA_ASSOCIATING))
2594		addr = wpa_s->pending_bssid;
2595	else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2596		/*
2597		 * When using driver-based BSS selection, we may not know the
2598		 * BSSID with which we are currently trying to associate. We
2599		 * need to notify the driver of this disconnection even in such
2600		 * a case, so use the all zeros address here.
2601		 */
2602		addr = wpa_s->bssid;
2603		zero_addr = 1;
2604	}
2605
2606#ifdef CONFIG_TDLS
2607	wpa_tdls_teardown_peers(wpa_s->wpa);
2608#endif /* CONFIG_TDLS */
2609
2610#ifdef CONFIG_MESH
2611	if (wpa_s->ifmsh) {
2612		wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2613			wpa_s->ifname);
2614		wpa_supplicant_leave_mesh(wpa_s);
2615	}
2616#endif /* CONFIG_MESH */
2617
2618	if (addr) {
2619		wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2620		os_memset(&event, 0, sizeof(event));
2621		event.deauth_info.reason_code = (u16) reason_code;
2622		event.deauth_info.locally_generated = 1;
2623		wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2624		if (zero_addr)
2625			addr = NULL;
2626	}
2627
2628	wpa_supplicant_clear_connection(wpa_s, addr);
2629}
2630
2631static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2632					      struct wpa_ssid *ssid)
2633{
2634	if (!ssid || !ssid->disabled || ssid->disabled == 2)
2635		return;
2636
2637	ssid->disabled = 0;
2638	wpas_clear_temp_disabled(wpa_s, ssid, 1);
2639	wpas_notify_network_enabled_changed(wpa_s, ssid);
2640
2641	/*
2642	 * Try to reassociate since there is no current configuration and a new
2643	 * network was made available.
2644	 */
2645	if (!wpa_s->current_ssid && !wpa_s->disconnected)
2646		wpa_s->reassociate = 1;
2647}
2648
2649
2650/**
2651 * wpa_supplicant_enable_network - Mark a configured network as enabled
2652 * @wpa_s: wpa_supplicant structure for a network interface
2653 * @ssid: wpa_ssid structure for a configured network or %NULL
2654 *
2655 * Enables the specified network or all networks if no network specified.
2656 */
2657void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2658				   struct wpa_ssid *ssid)
2659{
2660	if (ssid == NULL) {
2661		for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2662			wpa_supplicant_enable_one_network(wpa_s, ssid);
2663	} else
2664		wpa_supplicant_enable_one_network(wpa_s, ssid);
2665
2666	if (wpa_s->reassociate && !wpa_s->disconnected &&
2667	    (!wpa_s->current_ssid ||
2668	     wpa_s->wpa_state == WPA_DISCONNECTED ||
2669	     wpa_s->wpa_state == WPA_SCANNING)) {
2670		if (wpa_s->sched_scanning) {
2671			wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2672				   "new network to scan filters");
2673			wpa_supplicant_cancel_sched_scan(wpa_s);
2674		}
2675
2676		if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2677			wpa_s->scan_req = NORMAL_SCAN_REQ;
2678			wpa_supplicant_req_scan(wpa_s, 0, 0);
2679		}
2680	}
2681}
2682
2683
2684/**
2685 * wpa_supplicant_disable_network - Mark a configured network as disabled
2686 * @wpa_s: wpa_supplicant structure for a network interface
2687 * @ssid: wpa_ssid structure for a configured network or %NULL
2688 *
2689 * Disables the specified network or all networks if no network specified.
2690 */
2691void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2692				    struct wpa_ssid *ssid)
2693{
2694	struct wpa_ssid *other_ssid;
2695	int was_disabled;
2696
2697	if (ssid == NULL) {
2698		if (wpa_s->sched_scanning)
2699			wpa_supplicant_cancel_sched_scan(wpa_s);
2700
2701		for (other_ssid = wpa_s->conf->ssid; other_ssid;
2702		     other_ssid = other_ssid->next) {
2703			was_disabled = other_ssid->disabled;
2704			if (was_disabled == 2)
2705				continue; /* do not change persistent P2P group
2706					   * data */
2707
2708			other_ssid->disabled = 1;
2709
2710			if (was_disabled != other_ssid->disabled)
2711				wpas_notify_network_enabled_changed(
2712					wpa_s, other_ssid);
2713		}
2714		if (wpa_s->current_ssid)
2715			wpa_supplicant_deauthenticate(
2716				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2717	} else if (ssid->disabled != 2) {
2718		if (ssid == wpa_s->current_ssid)
2719			wpa_supplicant_deauthenticate(
2720				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2721
2722		was_disabled = ssid->disabled;
2723
2724		ssid->disabled = 1;
2725
2726		if (was_disabled != ssid->disabled) {
2727			wpas_notify_network_enabled_changed(wpa_s, ssid);
2728			if (wpa_s->sched_scanning) {
2729				wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2730					   "to remove network from filters");
2731				wpa_supplicant_cancel_sched_scan(wpa_s);
2732				wpa_supplicant_req_scan(wpa_s, 0, 0);
2733			}
2734		}
2735	}
2736}
2737
2738
2739/**
2740 * wpa_supplicant_select_network - Attempt association with a network
2741 * @wpa_s: wpa_supplicant structure for a network interface
2742 * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2743 */
2744void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2745				   struct wpa_ssid *ssid)
2746{
2747
2748	struct wpa_ssid *other_ssid;
2749	int disconnected = 0;
2750
2751	if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2752		if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2753			wpa_s->own_disconnect_req = 1;
2754		wpa_supplicant_deauthenticate(
2755			wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2756		disconnected = 1;
2757	}
2758
2759	if (ssid)
2760		wpas_clear_temp_disabled(wpa_s, ssid, 1);
2761
2762	/*
2763	 * Mark all other networks disabled or mark all networks enabled if no
2764	 * network specified.
2765	 */
2766	for (other_ssid = wpa_s->conf->ssid; other_ssid;
2767	     other_ssid = other_ssid->next) {
2768		int was_disabled = other_ssid->disabled;
2769		if (was_disabled == 2)
2770			continue; /* do not change persistent P2P group data */
2771
2772		other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2773		if (was_disabled && !other_ssid->disabled)
2774			wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2775
2776		if (was_disabled != other_ssid->disabled)
2777			wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2778	}
2779
2780	if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2781	    wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2782		/* We are already associated with the selected network */
2783		wpa_printf(MSG_DEBUG, "Already associated with the "
2784			   "selected network - do nothing");
2785		return;
2786	}
2787
2788	if (ssid) {
2789		wpa_s->current_ssid = ssid;
2790		eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2791		wpa_s->connect_without_scan =
2792			(ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2793
2794		/*
2795		 * Don't optimize next scan freqs since a new ESS has been
2796		 * selected.
2797		 */
2798		os_free(wpa_s->next_scan_freqs);
2799		wpa_s->next_scan_freqs = NULL;
2800	} else {
2801		wpa_s->connect_without_scan = NULL;
2802	}
2803
2804	wpa_s->disconnected = 0;
2805	wpa_s->reassociate = 1;
2806
2807	if (wpa_s->connect_without_scan ||
2808	    wpa_supplicant_fast_associate(wpa_s) != 1) {
2809		wpa_s->scan_req = NORMAL_SCAN_REQ;
2810		wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2811	}
2812
2813	if (ssid)
2814		wpas_notify_network_selected(wpa_s, ssid);
2815}
2816
2817
2818/**
2819 * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2820 * @wpa_s: wpa_supplicant structure for a network interface
2821 * @pkcs11_engine_path: PKCS #11 engine path or NULL
2822 * @pkcs11_module_path: PKCS #11 module path or NULL
2823 * Returns: 0 on success; -1 on failure
2824 *
2825 * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2826 * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2827 * module path fails the paths will be reset to the default value (NULL).
2828 */
2829int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2830					   const char *pkcs11_engine_path,
2831					   const char *pkcs11_module_path)
2832{
2833	char *pkcs11_engine_path_copy = NULL;
2834	char *pkcs11_module_path_copy = NULL;
2835
2836	if (pkcs11_engine_path != NULL) {
2837		pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2838		if (pkcs11_engine_path_copy == NULL)
2839			return -1;
2840	}
2841	if (pkcs11_module_path != NULL) {
2842		pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2843		if (pkcs11_module_path_copy == NULL) {
2844			os_free(pkcs11_engine_path_copy);
2845			return -1;
2846		}
2847	}
2848
2849	os_free(wpa_s->conf->pkcs11_engine_path);
2850	os_free(wpa_s->conf->pkcs11_module_path);
2851	wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2852	wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2853
2854	wpa_sm_set_eapol(wpa_s->wpa, NULL);
2855	eapol_sm_deinit(wpa_s->eapol);
2856	wpa_s->eapol = NULL;
2857	if (wpa_supplicant_init_eapol(wpa_s)) {
2858		/* Error -> Reset paths to the default value (NULL) once. */
2859		if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2860			wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2861							       NULL);
2862
2863		return -1;
2864	}
2865	wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2866
2867	return 0;
2868}
2869
2870
2871/**
2872 * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2873 * @wpa_s: wpa_supplicant structure for a network interface
2874 * @ap_scan: AP scan mode
2875 * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2876 *
2877 */
2878int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2879{
2880
2881	int old_ap_scan;
2882
2883	if (ap_scan < 0 || ap_scan > 2)
2884		return -1;
2885
2886	if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2887		wpa_printf(MSG_INFO,
2888			   "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2889	}
2890
2891#ifdef ANDROID
2892	if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2893	    wpa_s->wpa_state >= WPA_ASSOCIATING &&
2894	    wpa_s->wpa_state < WPA_COMPLETED) {
2895		wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2896			   "associating", wpa_s->conf->ap_scan, ap_scan);
2897		return 0;
2898	}
2899#endif /* ANDROID */
2900
2901	old_ap_scan = wpa_s->conf->ap_scan;
2902	wpa_s->conf->ap_scan = ap_scan;
2903
2904	if (old_ap_scan != wpa_s->conf->ap_scan)
2905		wpas_notify_ap_scan_changed(wpa_s);
2906
2907	return 0;
2908}
2909
2910
2911/**
2912 * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2913 * @wpa_s: wpa_supplicant structure for a network interface
2914 * @expire_age: Expiration age in seconds
2915 * Returns: 0 if succeed or -1 if expire_age has an invalid value
2916 *
2917 */
2918int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2919					  unsigned int bss_expire_age)
2920{
2921	if (bss_expire_age < 10) {
2922		wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2923			bss_expire_age);
2924		return -1;
2925	}
2926	wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2927		bss_expire_age);
2928	wpa_s->conf->bss_expiration_age = bss_expire_age;
2929
2930	return 0;
2931}
2932
2933
2934/**
2935 * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2936 * @wpa_s: wpa_supplicant structure for a network interface
2937 * @expire_count: number of scans after which an unseen BSS is reclaimed
2938 * Returns: 0 if succeed or -1 if expire_count has an invalid value
2939 *
2940 */
2941int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2942					    unsigned int bss_expire_count)
2943{
2944	if (bss_expire_count < 1) {
2945		wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2946			bss_expire_count);
2947		return -1;
2948	}
2949	wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2950		bss_expire_count);
2951	wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2952
2953	return 0;
2954}
2955
2956
2957/**
2958 * wpa_supplicant_set_scan_interval - Set scan interval
2959 * @wpa_s: wpa_supplicant structure for a network interface
2960 * @scan_interval: scan interval in seconds
2961 * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2962 *
2963 */
2964int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2965				     int scan_interval)
2966{
2967	if (scan_interval < 0) {
2968		wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2969			scan_interval);
2970		return -1;
2971	}
2972	wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2973		scan_interval);
2974	wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2975
2976	return 0;
2977}
2978
2979
2980/**
2981 * wpa_supplicant_set_debug_params - Set global debug params
2982 * @global: wpa_global structure
2983 * @debug_level: debug level
2984 * @debug_timestamp: determines if show timestamp in debug data
2985 * @debug_show_keys: determines if show keys in debug data
2986 * Returns: 0 if succeed or -1 if debug_level has wrong value
2987 */
2988int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2989				    int debug_timestamp, int debug_show_keys)
2990{
2991
2992	int old_level, old_timestamp, old_show_keys;
2993
2994	/* check for allowed debuglevels */
2995	if (debug_level != MSG_EXCESSIVE &&
2996	    debug_level != MSG_MSGDUMP &&
2997	    debug_level != MSG_DEBUG &&
2998	    debug_level != MSG_INFO &&
2999	    debug_level != MSG_WARNING &&
3000	    debug_level != MSG_ERROR)
3001		return -1;
3002
3003	old_level = wpa_debug_level;
3004	old_timestamp = wpa_debug_timestamp;
3005	old_show_keys = wpa_debug_show_keys;
3006
3007	wpa_debug_level = debug_level;
3008	wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3009	wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3010
3011	if (wpa_debug_level != old_level)
3012		wpas_notify_debug_level_changed(global);
3013	if (wpa_debug_timestamp != old_timestamp)
3014		wpas_notify_debug_timestamp_changed(global);
3015	if (wpa_debug_show_keys != old_show_keys)
3016		wpas_notify_debug_show_keys_changed(global);
3017
3018	return 0;
3019}
3020
3021
3022/**
3023 * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3024 * @wpa_s: Pointer to wpa_supplicant data
3025 * Returns: A pointer to the current network structure or %NULL on failure
3026 */
3027struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3028{
3029	struct wpa_ssid *entry;
3030	u8 ssid[SSID_MAX_LEN];
3031	int res;
3032	size_t ssid_len;
3033	u8 bssid[ETH_ALEN];
3034	int wired;
3035
3036	res = wpa_drv_get_ssid(wpa_s, ssid);
3037	if (res < 0) {
3038		wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3039			"driver");
3040		return NULL;
3041	}
3042	ssid_len = res;
3043
3044	if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3045		wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3046			"driver");
3047		return NULL;
3048	}
3049
3050	wired = wpa_s->conf->ap_scan == 0 &&
3051		(wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3052
3053	entry = wpa_s->conf->ssid;
3054	while (entry) {
3055		if (!wpas_network_disabled(wpa_s, entry) &&
3056		    ((ssid_len == entry->ssid_len &&
3057		      os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3058		    (!entry->bssid_set ||
3059		     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3060			return entry;
3061#ifdef CONFIG_WPS
3062		if (!wpas_network_disabled(wpa_s, entry) &&
3063		    (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3064		    (entry->ssid == NULL || entry->ssid_len == 0) &&
3065		    (!entry->bssid_set ||
3066		     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3067			return entry;
3068#endif /* CONFIG_WPS */
3069
3070		if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3071		    entry->ssid_len == 0 &&
3072		    os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3073			return entry;
3074
3075		entry = entry->next;
3076	}
3077
3078	return NULL;
3079}
3080
3081
3082static int select_driver(struct wpa_supplicant *wpa_s, int i)
3083{
3084	struct wpa_global *global = wpa_s->global;
3085
3086	if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3087		global->drv_priv[i] = wpa_drivers[i]->global_init();
3088		if (global->drv_priv[i] == NULL) {
3089			wpa_printf(MSG_ERROR, "Failed to initialize driver "
3090				   "'%s'", wpa_drivers[i]->name);
3091			return -1;
3092		}
3093	}
3094
3095	wpa_s->driver = wpa_drivers[i];
3096	wpa_s->global_drv_priv = global->drv_priv[i];
3097
3098	return 0;
3099}
3100
3101
3102static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3103				     const char *name)
3104{
3105	int i;
3106	size_t len;
3107	const char *pos, *driver = name;
3108
3109	if (wpa_s == NULL)
3110		return -1;
3111
3112	if (wpa_drivers[0] == NULL) {
3113		wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3114			"wpa_supplicant");
3115		return -1;
3116	}
3117
3118	if (name == NULL) {
3119		/* default to first driver in the list */
3120		return select_driver(wpa_s, 0);
3121	}
3122
3123	do {
3124		pos = os_strchr(driver, ',');
3125		if (pos)
3126			len = pos - driver;
3127		else
3128			len = os_strlen(driver);
3129
3130		for (i = 0; wpa_drivers[i]; i++) {
3131			if (os_strlen(wpa_drivers[i]->name) == len &&
3132			    os_strncmp(driver, wpa_drivers[i]->name, len) ==
3133			    0) {
3134				/* First driver that succeeds wins */
3135				if (select_driver(wpa_s, i) == 0)
3136					return 0;
3137			}
3138		}
3139
3140		driver = pos + 1;
3141	} while (pos);
3142
3143	wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3144	return -1;
3145}
3146
3147
3148/**
3149 * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3150 * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3151 *	with struct wpa_driver_ops::init()
3152 * @src_addr: Source address of the EAPOL frame
3153 * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3154 * @len: Length of the EAPOL data
3155 *
3156 * This function is called for each received EAPOL frame. Most driver
3157 * interfaces rely on more generic OS mechanism for receiving frames through
3158 * l2_packet, but if such a mechanism is not available, the driver wrapper may
3159 * take care of received EAPOL frames and deliver them to the core supplicant
3160 * code by calling this function.
3161 */
3162void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3163			     const u8 *buf, size_t len)
3164{
3165	struct wpa_supplicant *wpa_s = ctx;
3166
3167	wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3168	wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3169
3170#ifdef CONFIG_PEERKEY
3171	if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3172	    wpa_s->current_ssid->peerkey &&
3173	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3174	    wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3175		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3176		return;
3177	}
3178#endif /* CONFIG_PEERKEY */
3179
3180	if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3181	    (wpa_s->last_eapol_matches_bssid &&
3182#ifdef CONFIG_AP
3183	     !wpa_s->ap_iface &&
3184#endif /* CONFIG_AP */
3185	     os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3186		/*
3187		 * There is possible race condition between receiving the
3188		 * association event and the EAPOL frame since they are coming
3189		 * through different paths from the driver. In order to avoid
3190		 * issues in trying to process the EAPOL frame before receiving
3191		 * association information, lets queue it for processing until
3192		 * the association event is received. This may also be needed in
3193		 * driver-based roaming case, so also use src_addr != BSSID as a
3194		 * trigger if we have previously confirmed that the
3195		 * Authenticator uses BSSID as the src_addr (which is not the
3196		 * case with wired IEEE 802.1X).
3197		 */
3198		wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3199			"of received EAPOL frame (state=%s bssid=" MACSTR ")",
3200			wpa_supplicant_state_txt(wpa_s->wpa_state),
3201			MAC2STR(wpa_s->bssid));
3202		wpabuf_free(wpa_s->pending_eapol_rx);
3203		wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3204		if (wpa_s->pending_eapol_rx) {
3205			os_get_reltime(&wpa_s->pending_eapol_rx_time);
3206			os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3207				  ETH_ALEN);
3208		}
3209		return;
3210	}
3211
3212	wpa_s->last_eapol_matches_bssid =
3213		os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3214
3215#ifdef CONFIG_AP
3216	if (wpa_s->ap_iface) {
3217		wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3218		return;
3219	}
3220#endif /* CONFIG_AP */
3221
3222	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3223		wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3224			"no key management is configured");
3225		return;
3226	}
3227
3228	if (wpa_s->eapol_received == 0 &&
3229	    (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3230	     !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3231	     wpa_s->wpa_state != WPA_COMPLETED) &&
3232	    (wpa_s->current_ssid == NULL ||
3233	     wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3234		/* Timeout for completing IEEE 802.1X and WPA authentication */
3235		int timeout = 10;
3236
3237		if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3238		    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3239		    wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3240			/* Use longer timeout for IEEE 802.1X/EAP */
3241			timeout = 70;
3242		}
3243
3244#ifdef CONFIG_WPS
3245		if (wpa_s->current_ssid && wpa_s->current_bss &&
3246		    (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3247		    eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3248			/*
3249			 * Use shorter timeout if going through WPS AP iteration
3250			 * for PIN config method with an AP that does not
3251			 * advertise Selected Registrar.
3252			 */
3253			struct wpabuf *wps_ie;
3254
3255			wps_ie = wpa_bss_get_vendor_ie_multi(
3256				wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3257			if (wps_ie &&
3258			    !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3259				timeout = 10;
3260			wpabuf_free(wps_ie);
3261		}
3262#endif /* CONFIG_WPS */
3263
3264		wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3265	}
3266	wpa_s->eapol_received++;
3267
3268	if (wpa_s->countermeasures) {
3269		wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3270			"EAPOL packet");
3271		return;
3272	}
3273
3274#ifdef CONFIG_IBSS_RSN
3275	if (wpa_s->current_ssid &&
3276	    wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3277		ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3278		return;
3279	}
3280#endif /* CONFIG_IBSS_RSN */
3281
3282	/* Source address of the incoming EAPOL frame could be compared to the
3283	 * current BSSID. However, it is possible that a centralized
3284	 * Authenticator could be using another MAC address than the BSSID of
3285	 * an AP, so just allow any address to be used for now. The replies are
3286	 * still sent to the current BSSID (if available), though. */
3287
3288	os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3289	if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3290	    eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3291		return;
3292	wpa_drv_poll(wpa_s);
3293	if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3294		wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3295	else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3296		/*
3297		 * Set portValid = TRUE here since we are going to skip 4-way
3298		 * handshake processing which would normally set portValid. We
3299		 * need this to allow the EAPOL state machines to be completed
3300		 * without going through EAPOL-Key handshake.
3301		 */
3302		eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3303	}
3304}
3305
3306
3307int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3308{
3309	if ((!wpa_s->p2p_mgmt ||
3310	     !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3311	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3312		l2_packet_deinit(wpa_s->l2);
3313		wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3314					   wpa_drv_get_mac_addr(wpa_s),
3315					   ETH_P_EAPOL,
3316					   wpa_supplicant_rx_eapol, wpa_s, 0);
3317		if (wpa_s->l2 == NULL)
3318			return -1;
3319	} else {
3320		const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3321		if (addr)
3322			os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3323	}
3324
3325	if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3326		wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3327		return -1;
3328	}
3329
3330	wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3331
3332	return 0;
3333}
3334
3335
3336static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3337					   const u8 *buf, size_t len)
3338{
3339	struct wpa_supplicant *wpa_s = ctx;
3340	const struct l2_ethhdr *eth;
3341
3342	if (len < sizeof(*eth))
3343		return;
3344	eth = (const struct l2_ethhdr *) buf;
3345
3346	if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3347	    !(eth->h_dest[0] & 0x01)) {
3348		wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3349			" (bridge - not for this interface - ignore)",
3350			MAC2STR(src_addr), MAC2STR(eth->h_dest));
3351		return;
3352	}
3353
3354	wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3355		" (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3356	wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3357				len - sizeof(*eth));
3358}
3359
3360
3361/**
3362 * wpa_supplicant_driver_init - Initialize driver interface parameters
3363 * @wpa_s: Pointer to wpa_supplicant data
3364 * Returns: 0 on success, -1 on failure
3365 *
3366 * This function is called to initialize driver interface parameters.
3367 * wpa_drv_init() must have been called before this function to initialize the
3368 * driver interface.
3369 */
3370int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3371{
3372	static int interface_count = 0;
3373
3374	if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3375		return -1;
3376
3377	wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3378		MAC2STR(wpa_s->own_addr));
3379	os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3380	wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3381
3382	if (wpa_s->bridge_ifname[0]) {
3383		wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3384			"interface '%s'", wpa_s->bridge_ifname);
3385		wpa_s->l2_br = l2_packet_init_bridge(
3386			wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3387			ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3388		if (wpa_s->l2_br == NULL) {
3389			wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3390				"connection for the bridge interface '%s'",
3391				wpa_s->bridge_ifname);
3392			return -1;
3393		}
3394	}
3395
3396	if (wpa_s->conf->ap_scan == 2 &&
3397	    os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3398		wpa_printf(MSG_INFO,
3399			   "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3400	}
3401
3402	wpa_clear_keys(wpa_s, NULL);
3403
3404	/* Make sure that TKIP countermeasures are not left enabled (could
3405	 * happen if wpa_supplicant is killed during countermeasures. */
3406	wpa_drv_set_countermeasures(wpa_s, 0);
3407
3408	wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3409	wpa_drv_flush_pmkid(wpa_s);
3410
3411	wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3412	wpa_s->prev_scan_wildcard = 0;
3413
3414	if (wpa_supplicant_enabled_networks(wpa_s)) {
3415		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3416			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3417			interface_count = 0;
3418		}
3419#ifndef ANDROID
3420		if (!wpa_s->p2p_mgmt &&
3421		    wpa_supplicant_delayed_sched_scan(wpa_s,
3422						      interface_count % 3,
3423						      100000))
3424			wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3425						100000);
3426#endif /* ANDROID */
3427		interface_count++;
3428	} else
3429		wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3430
3431	return 0;
3432}
3433
3434
3435static int wpa_supplicant_daemon(const char *pid_file)
3436{
3437	wpa_printf(MSG_DEBUG, "Daemonize..");
3438	return os_daemonize(pid_file);
3439}
3440
3441
3442static struct wpa_supplicant *
3443wpa_supplicant_alloc(struct wpa_supplicant *parent)
3444{
3445	struct wpa_supplicant *wpa_s;
3446
3447	wpa_s = os_zalloc(sizeof(*wpa_s));
3448	if (wpa_s == NULL)
3449		return NULL;
3450	wpa_s->scan_req = INITIAL_SCAN_REQ;
3451	wpa_s->scan_interval = 5;
3452	wpa_s->new_connection = 1;
3453	wpa_s->parent = parent ? parent : wpa_s;
3454	wpa_s->sched_scanning = 0;
3455
3456	return wpa_s;
3457}
3458
3459
3460#ifdef CONFIG_HT_OVERRIDES
3461
3462static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3463			     struct ieee80211_ht_capabilities *htcaps,
3464			     struct ieee80211_ht_capabilities *htcaps_mask,
3465			     const char *ht_mcs)
3466{
3467	/* parse ht_mcs into hex array */
3468	int i;
3469	const char *tmp = ht_mcs;
3470	char *end = NULL;
3471
3472	/* If ht_mcs is null, do not set anything */
3473	if (!ht_mcs)
3474		return 0;
3475
3476	/* This is what we are setting in the kernel */
3477	os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3478
3479	wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3480
3481	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3482		errno = 0;
3483		long v = strtol(tmp, &end, 16);
3484		if (errno == 0) {
3485			wpa_msg(wpa_s, MSG_DEBUG,
3486				"htcap value[%i]: %ld end: %p  tmp: %p",
3487				i, v, end, tmp);
3488			if (end == tmp)
3489				break;
3490
3491			htcaps->supported_mcs_set[i] = v;
3492			tmp = end;
3493		} else {
3494			wpa_msg(wpa_s, MSG_ERROR,
3495				"Failed to parse ht-mcs: %s, error: %s\n",
3496				ht_mcs, strerror(errno));
3497			return -1;
3498		}
3499	}
3500
3501	/*
3502	 * If we were able to parse any values, then set mask for the MCS set.
3503	 */
3504	if (i) {
3505		os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3506			  IEEE80211_HT_MCS_MASK_LEN - 1);
3507		/* skip the 3 reserved bits */
3508		htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3509			0x1f;
3510	}
3511
3512	return 0;
3513}
3514
3515
3516static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3517				 struct ieee80211_ht_capabilities *htcaps,
3518				 struct ieee80211_ht_capabilities *htcaps_mask,
3519				 int disabled)
3520{
3521	le16 msk;
3522
3523	wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3524
3525	if (disabled == -1)
3526		return 0;
3527
3528	msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3529	htcaps_mask->ht_capabilities_info |= msk;
3530	if (disabled)
3531		htcaps->ht_capabilities_info &= msk;
3532	else
3533		htcaps->ht_capabilities_info |= msk;
3534
3535	return 0;
3536}
3537
3538
3539static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3540				struct ieee80211_ht_capabilities *htcaps,
3541				struct ieee80211_ht_capabilities *htcaps_mask,
3542				int factor)
3543{
3544	wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3545
3546	if (factor == -1)
3547		return 0;
3548
3549	if (factor < 0 || factor > 3) {
3550		wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3551			"Must be 0-3 or -1", factor);
3552		return -EINVAL;
3553	}
3554
3555	htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3556	htcaps->a_mpdu_params &= ~0x3;
3557	htcaps->a_mpdu_params |= factor & 0x3;
3558
3559	return 0;
3560}
3561
3562
3563static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3564				 struct ieee80211_ht_capabilities *htcaps,
3565				 struct ieee80211_ht_capabilities *htcaps_mask,
3566				 int density)
3567{
3568	wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3569
3570	if (density == -1)
3571		return 0;
3572
3573	if (density < 0 || density > 7) {
3574		wpa_msg(wpa_s, MSG_ERROR,
3575			"ampdu_density: %d out of range. Must be 0-7 or -1.",
3576			density);
3577		return -EINVAL;
3578	}
3579
3580	htcaps_mask->a_mpdu_params |= 0x1C;
3581	htcaps->a_mpdu_params &= ~(0x1C);
3582	htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3583
3584	return 0;
3585}
3586
3587
3588static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3589				struct ieee80211_ht_capabilities *htcaps,
3590				struct ieee80211_ht_capabilities *htcaps_mask,
3591				int disabled)
3592{
3593	/* Masking these out disables HT40 */
3594	le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3595				HT_CAP_INFO_SHORT_GI40MHZ);
3596
3597	wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3598
3599	if (disabled)
3600		htcaps->ht_capabilities_info &= ~msk;
3601	else
3602		htcaps->ht_capabilities_info |= msk;
3603
3604	htcaps_mask->ht_capabilities_info |= msk;
3605
3606	return 0;
3607}
3608
3609
3610static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3611			       struct ieee80211_ht_capabilities *htcaps,
3612			       struct ieee80211_ht_capabilities *htcaps_mask,
3613			       int disabled)
3614{
3615	/* Masking these out disables SGI */
3616	le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3617				HT_CAP_INFO_SHORT_GI40MHZ);
3618
3619	wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3620
3621	if (disabled)
3622		htcaps->ht_capabilities_info &= ~msk;
3623	else
3624		htcaps->ht_capabilities_info |= msk;
3625
3626	htcaps_mask->ht_capabilities_info |= msk;
3627
3628	return 0;
3629}
3630
3631
3632static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3633			       struct ieee80211_ht_capabilities *htcaps,
3634			       struct ieee80211_ht_capabilities *htcaps_mask,
3635			       int disabled)
3636{
3637	/* Masking these out disables LDPC */
3638	le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3639
3640	wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3641
3642	if (disabled)
3643		htcaps->ht_capabilities_info &= ~msk;
3644	else
3645		htcaps->ht_capabilities_info |= msk;
3646
3647	htcaps_mask->ht_capabilities_info |= msk;
3648
3649	return 0;
3650}
3651
3652
3653void wpa_supplicant_apply_ht_overrides(
3654	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3655	struct wpa_driver_associate_params *params)
3656{
3657	struct ieee80211_ht_capabilities *htcaps;
3658	struct ieee80211_ht_capabilities *htcaps_mask;
3659
3660	if (!ssid)
3661		return;
3662
3663	params->disable_ht = ssid->disable_ht;
3664	if (!params->htcaps || !params->htcaps_mask)
3665		return;
3666
3667	htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3668	htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3669	wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3670	wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3671			      ssid->disable_max_amsdu);
3672	wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3673	wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3674	wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3675	wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3676	wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3677
3678	if (ssid->ht40_intolerant) {
3679		le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3680		htcaps->ht_capabilities_info |= bit;
3681		htcaps_mask->ht_capabilities_info |= bit;
3682	}
3683}
3684
3685#endif /* CONFIG_HT_OVERRIDES */
3686
3687
3688#ifdef CONFIG_VHT_OVERRIDES
3689void wpa_supplicant_apply_vht_overrides(
3690	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3691	struct wpa_driver_associate_params *params)
3692{
3693	struct ieee80211_vht_capabilities *vhtcaps;
3694	struct ieee80211_vht_capabilities *vhtcaps_mask;
3695
3696	if (!ssid)
3697		return;
3698
3699	params->disable_vht = ssid->disable_vht;
3700
3701	vhtcaps = (void *) params->vhtcaps;
3702	vhtcaps_mask = (void *) params->vhtcaps_mask;
3703
3704	if (!vhtcaps || !vhtcaps_mask)
3705		return;
3706
3707	vhtcaps->vht_capabilities_info = ssid->vht_capa;
3708	vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3709
3710#ifdef CONFIG_HT_OVERRIDES
3711	/* if max ampdu is <= 3, we have to make the HT cap the same */
3712	if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3713		int max_ampdu;
3714
3715		max_ampdu = (ssid->vht_capa &
3716			     VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3717			VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3718
3719		max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3720		wpa_set_ampdu_factor(wpa_s,
3721				     (void *) params->htcaps,
3722				     (void *) params->htcaps_mask,
3723				     max_ampdu);
3724	}
3725#endif /* CONFIG_HT_OVERRIDES */
3726
3727#define OVERRIDE_MCS(i)							\
3728	if (ssid->vht_tx_mcs_nss_ ##i >= 0) {				\
3729		vhtcaps_mask->vht_supported_mcs_set.tx_map |=		\
3730			3 << 2 * (i - 1);				\
3731		vhtcaps->vht_supported_mcs_set.tx_map |=		\
3732			ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);	\
3733	}								\
3734	if (ssid->vht_rx_mcs_nss_ ##i >= 0) {				\
3735		vhtcaps_mask->vht_supported_mcs_set.rx_map |=		\
3736			3 << 2 * (i - 1);				\
3737		vhtcaps->vht_supported_mcs_set.rx_map |=		\
3738			ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);	\
3739	}
3740
3741	OVERRIDE_MCS(1);
3742	OVERRIDE_MCS(2);
3743	OVERRIDE_MCS(3);
3744	OVERRIDE_MCS(4);
3745	OVERRIDE_MCS(5);
3746	OVERRIDE_MCS(6);
3747	OVERRIDE_MCS(7);
3748	OVERRIDE_MCS(8);
3749}
3750#endif /* CONFIG_VHT_OVERRIDES */
3751
3752
3753static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3754{
3755#ifdef PCSC_FUNCS
3756	size_t len;
3757
3758	if (!wpa_s->conf->pcsc_reader)
3759		return 0;
3760
3761	wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3762	if (!wpa_s->scard)
3763		return 1;
3764
3765	if (wpa_s->conf->pcsc_pin &&
3766	    scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3767		scard_deinit(wpa_s->scard);
3768		wpa_s->scard = NULL;
3769		wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3770		return -1;
3771	}
3772
3773	len = sizeof(wpa_s->imsi) - 1;
3774	if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3775		scard_deinit(wpa_s->scard);
3776		wpa_s->scard = NULL;
3777		wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3778		return -1;
3779	}
3780	wpa_s->imsi[len] = '\0';
3781
3782	wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3783
3784	wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3785		   wpa_s->imsi, wpa_s->mnc_len);
3786
3787	wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3788	eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3789#endif /* PCSC_FUNCS */
3790
3791	return 0;
3792}
3793
3794
3795int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3796{
3797	char *val, *pos;
3798
3799	ext_password_deinit(wpa_s->ext_pw);
3800	wpa_s->ext_pw = NULL;
3801	eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3802
3803	if (!wpa_s->conf->ext_password_backend)
3804		return 0;
3805
3806	val = os_strdup(wpa_s->conf->ext_password_backend);
3807	if (val == NULL)
3808		return -1;
3809	pos = os_strchr(val, ':');
3810	if (pos)
3811		*pos++ = '\0';
3812
3813	wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3814
3815	wpa_s->ext_pw = ext_password_init(val, pos);
3816	os_free(val);
3817	if (wpa_s->ext_pw == NULL) {
3818		wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3819		return -1;
3820	}
3821	eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3822
3823	return 0;
3824}
3825
3826
3827#ifdef CONFIG_FST
3828
3829static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3830{
3831	struct wpa_supplicant *wpa_s = ctx;
3832
3833	return (is_zero_ether_addr(wpa_s->bssid) ||
3834		wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3835}
3836
3837
3838static void wpas_fst_get_channel_info_cb(void *ctx,
3839					 enum hostapd_hw_mode *hw_mode,
3840					 u8 *channel)
3841{
3842	struct wpa_supplicant *wpa_s = ctx;
3843
3844	if (wpa_s->current_bss) {
3845		*hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3846						  channel);
3847	} else if (wpa_s->hw.num_modes) {
3848		*hw_mode = wpa_s->hw.modes[0].mode;
3849	} else {
3850		WPA_ASSERT(0);
3851		*hw_mode = 0;
3852	}
3853}
3854
3855
3856static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3857{
3858	struct wpa_supplicant *wpa_s = ctx;
3859
3860	*modes = wpa_s->hw.modes;
3861	return wpa_s->hw.num_modes;
3862}
3863
3864
3865static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3866{
3867	struct wpa_supplicant *wpa_s = ctx;
3868
3869	wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3870	wpa_s->fst_ies = fst_ies;
3871}
3872
3873
3874static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3875{
3876	struct wpa_supplicant *wpa_s = ctx;
3877
3878	WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3879	return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3880					  wpa_s->own_addr, wpa_s->bssid,
3881					  wpabuf_head(data), wpabuf_len(data),
3882				   0);
3883}
3884
3885
3886static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3887{
3888	struct wpa_supplicant *wpa_s = ctx;
3889
3890	WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3891	return wpa_s->received_mb_ies;
3892}
3893
3894
3895static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3896				     const u8 *buf, size_t size)
3897{
3898	struct wpa_supplicant *wpa_s = ctx;
3899	struct mb_ies_info info;
3900
3901	WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3902
3903	if (!mb_ies_info_by_ies(&info, buf, size)) {
3904		wpabuf_free(wpa_s->received_mb_ies);
3905		wpa_s->received_mb_ies = mb_ies_by_info(&info);
3906	}
3907}
3908
3909
3910const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3911				   Boolean mb_only)
3912{
3913	struct wpa_supplicant *wpa_s = ctx;
3914
3915	*get_ctx = NULL;
3916	if (!is_zero_ether_addr(wpa_s->bssid))
3917		return (wpa_s->received_mb_ies || !mb_only) ?
3918			wpa_s->bssid : NULL;
3919	return NULL;
3920}
3921
3922
3923const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3924				  Boolean mb_only)
3925{
3926	return NULL;
3927}
3928
3929void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3930				       struct fst_wpa_obj *iface_obj)
3931{
3932	iface_obj->ctx              = wpa_s;
3933	iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3934	iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3935	iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3936	iface_obj->set_ies          = wpas_fst_set_ies_cb;
3937	iface_obj->send_action      = wpas_fst_send_action_cb;
3938	iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3939	iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3940	iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3941	iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3942}
3943#endif /* CONFIG_FST */
3944
3945static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3946				    const struct wpa_driver_capa *capa)
3947{
3948	struct wowlan_triggers *triggers;
3949	int ret = 0;
3950
3951	if (!wpa_s->conf->wowlan_triggers)
3952		return 0;
3953
3954	triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3955	if (triggers) {
3956		ret = wpa_drv_wowlan(wpa_s, triggers);
3957		os_free(triggers);
3958	}
3959	return ret;
3960}
3961
3962
3963static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3964{
3965	if (freq < 3000)
3966		return BAND_2_4_GHZ;
3967	if (freq > 50000)
3968		return BAND_60_GHZ;
3969	return BAND_5_GHZ;
3970}
3971
3972
3973static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3974				   const int *freqs)
3975{
3976	int i;
3977	unsigned int band = 0;
3978
3979	if (freqs) {
3980		/* freqs are specified for the radio work */
3981		for (i = 0; freqs[i]; i++)
3982			band |= wpas_freq_to_band(freqs[i]);
3983	} else {
3984		/*
3985		 * freqs are not specified, implies all
3986		 * the supported freqs by HW
3987		 */
3988		for (i = 0; i < wpa_s->hw.num_modes; i++) {
3989			if (wpa_s->hw.modes[i].num_channels != 0) {
3990				if (wpa_s->hw.modes[i].mode ==
3991				    HOSTAPD_MODE_IEEE80211B ||
3992				    wpa_s->hw.modes[i].mode ==
3993				    HOSTAPD_MODE_IEEE80211G)
3994					band |= BAND_2_4_GHZ;
3995				else if (wpa_s->hw.modes[i].mode ==
3996					 HOSTAPD_MODE_IEEE80211A)
3997					band |= BAND_5_GHZ;
3998				else if (wpa_s->hw.modes[i].mode ==
3999					 HOSTAPD_MODE_IEEE80211AD)
4000					band |= BAND_60_GHZ;
4001				else if (wpa_s->hw.modes[i].mode ==
4002					 HOSTAPD_MODE_IEEE80211ANY)
4003					band = BAND_2_4_GHZ | BAND_5_GHZ |
4004						BAND_60_GHZ;
4005			}
4006		}
4007	}
4008
4009	return band;
4010}
4011
4012
4013static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4014					      const char *rn)
4015{
4016	struct wpa_supplicant *iface = wpa_s->global->ifaces;
4017	struct wpa_radio *radio;
4018
4019	while (rn && iface) {
4020		radio = iface->radio;
4021		if (radio && os_strcmp(rn, radio->name) == 0) {
4022			wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4023				   wpa_s->ifname, rn);
4024			dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4025			return radio;
4026		}
4027
4028		iface = iface->next;
4029	}
4030
4031	wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4032		   wpa_s->ifname, rn ? rn : "N/A");
4033	radio = os_zalloc(sizeof(*radio));
4034	if (radio == NULL)
4035		return NULL;
4036
4037	if (rn)
4038		os_strlcpy(radio->name, rn, sizeof(radio->name));
4039	dl_list_init(&radio->ifaces);
4040	dl_list_init(&radio->work);
4041	dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4042
4043	return radio;
4044}
4045
4046
4047static void radio_work_free(struct wpa_radio_work *work)
4048{
4049	if (work->wpa_s->scan_work == work) {
4050		/* This should not really happen. */
4051		wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4052			work->type, work, work->started);
4053		work->wpa_s->scan_work = NULL;
4054	}
4055
4056#ifdef CONFIG_P2P
4057	if (work->wpa_s->p2p_scan_work == work) {
4058		/* This should not really happen. */
4059		wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4060			work->type, work, work->started);
4061		work->wpa_s->p2p_scan_work = NULL;
4062	}
4063#endif /* CONFIG_P2P */
4064
4065	if (work->started) {
4066		work->wpa_s->radio->num_active_works--;
4067		wpa_dbg(work->wpa_s, MSG_DEBUG,
4068			"radio_work_free('%s'@%p: num_active_works --> %u",
4069			work->type, work,
4070			work->wpa_s->radio->num_active_works);
4071	}
4072
4073	dl_list_del(&work->list);
4074	os_free(work);
4075}
4076
4077
4078static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4079{
4080	struct wpa_radio_work *active_work = NULL;
4081	struct wpa_radio_work *tmp;
4082
4083	/* Get the active work to know the type and band. */
4084	dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4085		if (tmp->started) {
4086			active_work = tmp;
4087			break;
4088		}
4089	}
4090
4091	if (!active_work) {
4092		/* No active work, start one */
4093		radio->num_active_works = 0;
4094		dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4095				 list) {
4096			if (os_strcmp(tmp->type, "scan") == 0 &&
4097			    radio->external_scan_running &&
4098			    (((struct wpa_driver_scan_params *)
4099			      tmp->ctx)->only_new_results ||
4100			     tmp->wpa_s->clear_driver_scan_cache))
4101				continue;
4102			return tmp;
4103		}
4104		return NULL;
4105	}
4106
4107	if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4108	    os_strcmp(active_work->type, "connect") == 0) {
4109		/*
4110		 * If the active work is either connect or sme-connect,
4111		 * do not parallelize them with other radio works.
4112		 */
4113		wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4114			"Do not parallelize radio work with %s",
4115			active_work->type);
4116		return NULL;
4117	}
4118
4119	dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4120		if (tmp->started)
4121			continue;
4122
4123		/*
4124		 * If connect or sme-connect are enqueued, parallelize only
4125		 * those operations ahead of them in the queue.
4126		 */
4127		if (os_strcmp(tmp->type, "connect") == 0 ||
4128		    os_strcmp(tmp->type, "sme-connect") == 0)
4129			break;
4130
4131		/*
4132		 * Check that the radio works are distinct and
4133		 * on different bands.
4134		 */
4135		if (os_strcmp(active_work->type, tmp->type) != 0 &&
4136		    (active_work->bands != tmp->bands)) {
4137			/*
4138			 * If a scan has to be scheduled through nl80211 scan
4139			 * interface and if an external scan is already running,
4140			 * do not schedule the scan since it is likely to get
4141			 * rejected by kernel.
4142			 */
4143			if (os_strcmp(tmp->type, "scan") == 0 &&
4144			    radio->external_scan_running &&
4145			    (((struct wpa_driver_scan_params *)
4146			      tmp->ctx)->only_new_results ||
4147			     tmp->wpa_s->clear_driver_scan_cache))
4148				continue;
4149
4150			wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4151				"active_work:%s new_work:%s",
4152				active_work->type, tmp->type);
4153			return tmp;
4154		}
4155	}
4156
4157	/* Did not find a radio work to schedule in parallel. */
4158	return NULL;
4159}
4160
4161
4162static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4163{
4164	struct wpa_radio *radio = eloop_ctx;
4165	struct wpa_radio_work *work;
4166	struct os_reltime now, diff;
4167	struct wpa_supplicant *wpa_s;
4168
4169	work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4170	if (work == NULL) {
4171		radio->num_active_works = 0;
4172		return;
4173	}
4174
4175	wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4176			      radio_list);
4177
4178	if (!(wpa_s &&
4179	      wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4180		if (work->started)
4181			return; /* already started and still in progress */
4182
4183		if (wpa_s && wpa_s->radio->external_scan_running) {
4184			wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4185			return;
4186		}
4187	} else {
4188		work = NULL;
4189		if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4190			/* get the work to schedule next */
4191			work = radio_work_get_next_work(radio);
4192		}
4193		if (!work)
4194			return;
4195	}
4196
4197	wpa_s = work->wpa_s;
4198	os_get_reltime(&now);
4199	os_reltime_sub(&now, &work->time, &diff);
4200	wpa_dbg(wpa_s, MSG_DEBUG,
4201		"Starting radio work '%s'@%p after %ld.%06ld second wait",
4202		work->type, work, diff.sec, diff.usec);
4203	work->started = 1;
4204	work->time = now;
4205	radio->num_active_works++;
4206
4207	work->cb(work, 0);
4208
4209	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4210	    radio->num_active_works < MAX_ACTIVE_WORKS)
4211		radio_work_check_next(wpa_s);
4212}
4213
4214
4215/*
4216 * This function removes both started and pending radio works running on
4217 * the provided interface's radio.
4218 * Prior to the removal of the radio work, its callback (cb) is called with
4219 * deinit set to be 1. Each work's callback is responsible for clearing its
4220 * internal data and restoring to a correct state.
4221 * @wpa_s: wpa_supplicant data
4222 * @type: type of works to be removed
4223 * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4224 * this interface's works.
4225 */
4226void radio_remove_works(struct wpa_supplicant *wpa_s,
4227			const char *type, int remove_all)
4228{
4229	struct wpa_radio_work *work, *tmp;
4230	struct wpa_radio *radio = wpa_s->radio;
4231
4232	dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4233			      list) {
4234		if (type && os_strcmp(type, work->type) != 0)
4235			continue;
4236
4237		/* skip other ifaces' works */
4238		if (!remove_all && work->wpa_s != wpa_s)
4239			continue;
4240
4241		wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4242			work->type, work, work->started ? " (started)" : "");
4243		work->cb(work, 1);
4244		radio_work_free(work);
4245	}
4246
4247	/* in case we removed the started work */
4248	radio_work_check_next(wpa_s);
4249}
4250
4251
4252static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4253{
4254	struct wpa_radio *radio = wpa_s->radio;
4255
4256	if (!radio)
4257		return;
4258
4259	wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4260		   wpa_s->ifname, radio->name);
4261	dl_list_del(&wpa_s->radio_list);
4262	radio_remove_works(wpa_s, NULL, 0);
4263	wpa_s->radio = NULL;
4264	if (!dl_list_empty(&radio->ifaces))
4265		return; /* Interfaces remain for this radio */
4266
4267	wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4268	eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4269	os_free(radio);
4270}
4271
4272
4273void radio_work_check_next(struct wpa_supplicant *wpa_s)
4274{
4275	struct wpa_radio *radio = wpa_s->radio;
4276
4277	if (dl_list_empty(&radio->work))
4278		return;
4279	if (wpa_s->ext_work_in_progress) {
4280		wpa_printf(MSG_DEBUG,
4281			   "External radio work in progress - delay start of pending item");
4282		return;
4283	}
4284	eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4285	eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4286}
4287
4288
4289/**
4290 * radio_add_work - Add a radio work item
4291 * @wpa_s: Pointer to wpa_supplicant data
4292 * @freq: Frequency of the offchannel operation in MHz or 0
4293 * @type: Unique identifier for each type of work
4294 * @next: Force as the next work to be executed
4295 * @cb: Callback function for indicating when radio is available
4296 * @ctx: Context pointer for the work (work->ctx in cb())
4297 * Returns: 0 on success, -1 on failure
4298 *
4299 * This function is used to request time for an operation that requires
4300 * exclusive radio control. Once the radio is available, the registered callback
4301 * function will be called. radio_work_done() must be called once the exclusive
4302 * radio operation has been completed, so that the radio is freed for other
4303 * operations. The special case of deinit=1 is used to free the context data
4304 * during interface removal. That does not allow the callback function to start
4305 * the radio operation, i.e., it must free any resources allocated for the radio
4306 * work and return.
4307 *
4308 * The @freq parameter can be used to indicate a single channel on which the
4309 * offchannel operation will occur. This may allow multiple radio work
4310 * operations to be performed in parallel if they apply for the same channel.
4311 * Setting this to 0 indicates that the work item may use multiple channels or
4312 * requires exclusive control of the radio.
4313 */
4314int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4315		   const char *type, int next,
4316		   void (*cb)(struct wpa_radio_work *work, int deinit),
4317		   void *ctx)
4318{
4319	struct wpa_radio *radio = wpa_s->radio;
4320	struct wpa_radio_work *work;
4321	int was_empty;
4322
4323	work = os_zalloc(sizeof(*work));
4324	if (work == NULL)
4325		return -1;
4326	wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4327	os_get_reltime(&work->time);
4328	work->freq = freq;
4329	work->type = type;
4330	work->wpa_s = wpa_s;
4331	work->cb = cb;
4332	work->ctx = ctx;
4333
4334	if (freq)
4335		work->bands = wpas_freq_to_band(freq);
4336	else if (os_strcmp(type, "scan") == 0 ||
4337		 os_strcmp(type, "p2p-scan") == 0)
4338		work->bands = wpas_get_bands(wpa_s,
4339					     ((struct wpa_driver_scan_params *)
4340					      ctx)->freqs);
4341	else
4342		work->bands = wpas_get_bands(wpa_s, NULL);
4343
4344	was_empty = dl_list_empty(&wpa_s->radio->work);
4345	if (next)
4346		dl_list_add(&wpa_s->radio->work, &work->list);
4347	else
4348		dl_list_add_tail(&wpa_s->radio->work, &work->list);
4349	if (was_empty) {
4350		wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4351		radio_work_check_next(wpa_s);
4352	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4353		   && radio->num_active_works < MAX_ACTIVE_WORKS) {
4354		wpa_dbg(wpa_s, MSG_DEBUG,
4355			"Try to schedule a radio work (num_active_works=%u)",
4356			radio->num_active_works);
4357		radio_work_check_next(wpa_s);
4358	}
4359
4360	return 0;
4361}
4362
4363
4364/**
4365 * radio_work_done - Indicate that a radio work item has been completed
4366 * @work: Completed work
4367 *
4368 * This function is called once the callback function registered with
4369 * radio_add_work() has completed its work.
4370 */
4371void radio_work_done(struct wpa_radio_work *work)
4372{
4373	struct wpa_supplicant *wpa_s = work->wpa_s;
4374	struct os_reltime now, diff;
4375	unsigned int started = work->started;
4376
4377	os_get_reltime(&now);
4378	os_reltime_sub(&now, &work->time, &diff);
4379	wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4380		work->type, work, started ? "done" : "canceled",
4381		diff.sec, diff.usec);
4382	radio_work_free(work);
4383	if (started)
4384		radio_work_check_next(wpa_s);
4385}
4386
4387
4388struct wpa_radio_work *
4389radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4390{
4391	struct wpa_radio_work *work;
4392	struct wpa_radio *radio = wpa_s->radio;
4393
4394	dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4395		if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4396			return work;
4397	}
4398
4399	return NULL;
4400}
4401
4402
4403static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4404			    struct wpa_interface *iface)
4405{
4406	const char *ifname, *driver, *rn;
4407
4408	driver = iface->driver;
4409next_driver:
4410	if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4411		return -1;
4412
4413	wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4414	if (wpa_s->drv_priv == NULL) {
4415		const char *pos;
4416		pos = driver ? os_strchr(driver, ',') : NULL;
4417		if (pos) {
4418			wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4419				"driver interface - try next driver wrapper");
4420			driver = pos + 1;
4421			goto next_driver;
4422		}
4423		wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4424			"interface");
4425		return -1;
4426	}
4427	if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4428		wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4429			"driver_param '%s'", wpa_s->conf->driver_param);
4430		return -1;
4431	}
4432
4433	ifname = wpa_drv_get_ifname(wpa_s);
4434	if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4435		wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4436			"interface name with '%s'", ifname);
4437		os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4438	}
4439
4440	rn = wpa_driver_get_radio_name(wpa_s);
4441	if (rn && rn[0] == '\0')
4442		rn = NULL;
4443
4444	wpa_s->radio = radio_add_interface(wpa_s, rn);
4445	if (wpa_s->radio == NULL)
4446		return -1;
4447
4448	return 0;
4449}
4450
4451
4452static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4453				     struct wpa_interface *iface)
4454{
4455	struct wpa_driver_capa capa;
4456	int capa_res;
4457
4458	wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4459		   "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4460		   iface->confname ? iface->confname : "N/A",
4461		   iface->driver ? iface->driver : "default",
4462		   iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4463		   iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4464
4465	if (iface->confname) {
4466#ifdef CONFIG_BACKEND_FILE
4467		wpa_s->confname = os_rel2abs_path(iface->confname);
4468		if (wpa_s->confname == NULL) {
4469			wpa_printf(MSG_ERROR, "Failed to get absolute path "
4470				   "for configuration file '%s'.",
4471				   iface->confname);
4472			return -1;
4473		}
4474		wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4475			   iface->confname, wpa_s->confname);
4476#else /* CONFIG_BACKEND_FILE */
4477		wpa_s->confname = os_strdup(iface->confname);
4478#endif /* CONFIG_BACKEND_FILE */
4479		wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4480		if (wpa_s->conf == NULL) {
4481			wpa_printf(MSG_ERROR, "Failed to read or parse "
4482				   "configuration '%s'.", wpa_s->confname);
4483			return -1;
4484		}
4485		wpa_s->confanother = os_rel2abs_path(iface->confanother);
4486		wpa_config_read(wpa_s->confanother, wpa_s->conf);
4487
4488		/*
4489		 * Override ctrl_interface and driver_param if set on command
4490		 * line.
4491		 */
4492		if (iface->ctrl_interface) {
4493			os_free(wpa_s->conf->ctrl_interface);
4494			wpa_s->conf->ctrl_interface =
4495				os_strdup(iface->ctrl_interface);
4496		}
4497
4498		if (iface->driver_param) {
4499			os_free(wpa_s->conf->driver_param);
4500			wpa_s->conf->driver_param =
4501				os_strdup(iface->driver_param);
4502		}
4503
4504		if (iface->p2p_mgmt && !iface->ctrl_interface) {
4505			os_free(wpa_s->conf->ctrl_interface);
4506			wpa_s->conf->ctrl_interface = NULL;
4507		}
4508	} else
4509		wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4510						     iface->driver_param);
4511
4512	if (wpa_s->conf == NULL) {
4513		wpa_printf(MSG_ERROR, "\nNo configuration found.");
4514		return -1;
4515	}
4516
4517	if (iface->ifname == NULL) {
4518		wpa_printf(MSG_ERROR, "\nInterface name is required.");
4519		return -1;
4520	}
4521	if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4522		wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4523			   iface->ifname);
4524		return -1;
4525	}
4526	os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4527
4528	if (iface->bridge_ifname) {
4529		if (os_strlen(iface->bridge_ifname) >=
4530		    sizeof(wpa_s->bridge_ifname)) {
4531			wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4532				   "name '%s'.", iface->bridge_ifname);
4533			return -1;
4534		}
4535		os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4536			   sizeof(wpa_s->bridge_ifname));
4537	}
4538
4539	/* RSNA Supplicant Key Management - INITIALIZE */
4540	eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4541	eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4542
4543	/* Initialize driver interface and register driver event handler before
4544	 * L2 receive handler so that association events are processed before
4545	 * EAPOL-Key packets if both become available for the same select()
4546	 * call. */
4547	if (wpas_init_driver(wpa_s, iface) < 0)
4548		return -1;
4549
4550	if (wpa_supplicant_init_wpa(wpa_s) < 0)
4551		return -1;
4552
4553	wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4554			  wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4555			  NULL);
4556	wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4557
4558	if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4559	    wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4560			     wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4561		wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4562			"dot11RSNAConfigPMKLifetime");
4563		return -1;
4564	}
4565
4566	if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4567	    wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4568			     wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4569		wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4570			"dot11RSNAConfigPMKReauthThreshold");
4571		return -1;
4572	}
4573
4574	if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4575	    wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4576			     wpa_s->conf->dot11RSNAConfigSATimeout)) {
4577		wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4578			"dot11RSNAConfigSATimeout");
4579		return -1;
4580	}
4581
4582	wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4583						      &wpa_s->hw.num_modes,
4584						      &wpa_s->hw.flags);
4585	if (wpa_s->hw.modes) {
4586		u16 i;
4587
4588		for (i = 0; i < wpa_s->hw.num_modes; i++) {
4589			if (wpa_s->hw.modes[i].vht_capab) {
4590				wpa_s->hw_capab = CAPAB_VHT;
4591				break;
4592			}
4593
4594			if (wpa_s->hw.modes[i].ht_capab &
4595			    HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4596				wpa_s->hw_capab = CAPAB_HT40;
4597			else if (wpa_s->hw.modes[i].ht_capab &&
4598				 wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4599				wpa_s->hw_capab = CAPAB_HT;
4600		}
4601	}
4602
4603	capa_res = wpa_drv_get_capa(wpa_s, &capa);
4604	if (capa_res == 0) {
4605		wpa_s->drv_capa_known = 1;
4606		wpa_s->drv_flags = capa.flags;
4607		wpa_s->drv_enc = capa.enc;
4608		wpa_s->drv_smps_modes = capa.smps_modes;
4609		wpa_s->drv_rrm_flags = capa.rrm_flags;
4610		wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4611		wpa_s->max_scan_ssids = capa.max_scan_ssids;
4612		wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4613		wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4614		wpa_s->max_sched_scan_plan_interval =
4615			capa.max_sched_scan_plan_interval;
4616		wpa_s->max_sched_scan_plan_iterations =
4617			capa.max_sched_scan_plan_iterations;
4618		wpa_s->sched_scan_supported = capa.sched_scan_supported;
4619		wpa_s->max_match_sets = capa.max_match_sets;
4620		wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4621		wpa_s->max_stations = capa.max_stations;
4622		wpa_s->extended_capa = capa.extended_capa;
4623		wpa_s->extended_capa_mask = capa.extended_capa_mask;
4624		wpa_s->extended_capa_len = capa.extended_capa_len;
4625		wpa_s->num_multichan_concurrent =
4626			capa.num_multichan_concurrent;
4627		wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4628
4629		if (capa.mac_addr_rand_scan_supported)
4630			wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4631		if (wpa_s->sched_scan_supported &&
4632		    capa.mac_addr_rand_sched_scan_supported)
4633			wpa_s->mac_addr_rand_supported |=
4634				(MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4635	}
4636	if (wpa_s->max_remain_on_chan == 0)
4637		wpa_s->max_remain_on_chan = 1000;
4638
4639	/*
4640	 * Only take p2p_mgmt parameters when P2P Device is supported.
4641	 * Doing it here as it determines whether l2_packet_init() will be done
4642	 * during wpa_supplicant_driver_init().
4643	 */
4644	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4645		wpa_s->p2p_mgmt = iface->p2p_mgmt;
4646	else
4647		iface->p2p_mgmt = 1;
4648
4649	if (wpa_s->num_multichan_concurrent == 0)
4650		wpa_s->num_multichan_concurrent = 1;
4651
4652	if (wpa_supplicant_driver_init(wpa_s) < 0)
4653		return -1;
4654
4655#ifdef CONFIG_TDLS
4656	if ((!iface->p2p_mgmt ||
4657	     !(wpa_s->drv_flags &
4658	       WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4659	    wpa_tdls_init(wpa_s->wpa))
4660		return -1;
4661#endif /* CONFIG_TDLS */
4662
4663	if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4664	    wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4665		wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4666		return -1;
4667	}
4668
4669#ifdef CONFIG_FST
4670	if (wpa_s->conf->fst_group_id) {
4671		struct fst_iface_cfg cfg;
4672		struct fst_wpa_obj iface_obj;
4673
4674		fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4675		os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4676			   sizeof(cfg.group_id));
4677		cfg.priority = wpa_s->conf->fst_priority;
4678		cfg.llt = wpa_s->conf->fst_llt;
4679
4680		wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4681					&iface_obj, &cfg);
4682		if (!wpa_s->fst) {
4683			wpa_msg(wpa_s, MSG_ERROR,
4684				"FST: Cannot attach iface %s to group %s",
4685				wpa_s->ifname, cfg.group_id);
4686			return -1;
4687		}
4688	}
4689#endif /* CONFIG_FST */
4690
4691	if (wpas_wps_init(wpa_s))
4692		return -1;
4693
4694	if (wpa_supplicant_init_eapol(wpa_s) < 0)
4695		return -1;
4696	wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4697
4698	wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4699	if (wpa_s->ctrl_iface == NULL) {
4700		wpa_printf(MSG_ERROR,
4701			   "Failed to initialize control interface '%s'.\n"
4702			   "You may have another wpa_supplicant process "
4703			   "already running or the file was\n"
4704			   "left by an unclean termination of wpa_supplicant "
4705			   "in which case you will need\n"
4706			   "to manually remove this file before starting "
4707			   "wpa_supplicant again.\n",
4708			   wpa_s->conf->ctrl_interface);
4709		return -1;
4710	}
4711
4712	wpa_s->gas = gas_query_init(wpa_s);
4713	if (wpa_s->gas == NULL) {
4714		wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4715		return -1;
4716	}
4717
4718	if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4719		wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4720		return -1;
4721	}
4722
4723	if (wpa_bss_init(wpa_s) < 0)
4724		return -1;
4725
4726	/*
4727	 * Set Wake-on-WLAN triggers, if configured.
4728	 * Note: We don't restore/remove the triggers on shutdown (it doesn't
4729	 * have effect anyway when the interface is down).
4730	 */
4731	if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4732		return -1;
4733
4734#ifdef CONFIG_EAP_PROXY
4735{
4736	size_t len;
4737	wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4738						     &len);
4739	if (wpa_s->mnc_len > 0) {
4740		wpa_s->imsi[len] = '\0';
4741		wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4742			   wpa_s->imsi, wpa_s->mnc_len);
4743	} else {
4744		wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4745	}
4746}
4747#endif /* CONFIG_EAP_PROXY */
4748
4749	if (pcsc_reader_init(wpa_s) < 0)
4750		return -1;
4751
4752	if (wpas_init_ext_pw(wpa_s) < 0)
4753		return -1;
4754
4755	wpas_rrm_reset(wpa_s);
4756
4757	wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4758
4759#ifdef CONFIG_HS20
4760	hs20_init(wpa_s);
4761#endif /* CONFIG_HS20 */
4762
4763	return 0;
4764}
4765
4766
4767static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4768					int notify, int terminate)
4769{
4770	struct wpa_global *global = wpa_s->global;
4771	struct wpa_supplicant *iface, *prev;
4772
4773	if (wpa_s == wpa_s->parent)
4774		wpas_p2p_group_remove(wpa_s, "*");
4775
4776	iface = global->ifaces;
4777	while (iface) {
4778		if (iface == wpa_s || iface->parent != wpa_s) {
4779			iface = iface->next;
4780			continue;
4781		}
4782		wpa_printf(MSG_DEBUG,
4783			   "Remove remaining child interface %s from parent %s",
4784			   iface->ifname, wpa_s->ifname);
4785		prev = iface;
4786		iface = iface->next;
4787		wpa_supplicant_remove_iface(global, prev, terminate);
4788	}
4789
4790	wpa_s->disconnected = 1;
4791	if (wpa_s->drv_priv) {
4792		wpa_supplicant_deauthenticate(wpa_s,
4793					      WLAN_REASON_DEAUTH_LEAVING);
4794
4795		wpa_drv_set_countermeasures(wpa_s, 0);
4796		wpa_clear_keys(wpa_s, NULL);
4797	}
4798
4799	wpa_supplicant_cleanup(wpa_s);
4800	wpas_p2p_deinit_iface(wpa_s);
4801
4802	wpas_ctrl_radio_work_flush(wpa_s);
4803	radio_remove_interface(wpa_s);
4804
4805#ifdef CONFIG_FST
4806	if (wpa_s->fst) {
4807		fst_detach(wpa_s->fst);
4808		wpa_s->fst = NULL;
4809	}
4810	if (wpa_s->received_mb_ies) {
4811		wpabuf_free(wpa_s->received_mb_ies);
4812		wpa_s->received_mb_ies = NULL;
4813	}
4814#endif /* CONFIG_FST */
4815
4816	if (wpa_s->drv_priv)
4817		wpa_drv_deinit(wpa_s);
4818
4819	if (notify)
4820		wpas_notify_iface_removed(wpa_s);
4821
4822	if (terminate)
4823		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4824
4825	if (wpa_s->ctrl_iface) {
4826		wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4827		wpa_s->ctrl_iface = NULL;
4828	}
4829
4830#ifdef CONFIG_MESH
4831	if (wpa_s->ifmsh) {
4832		wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4833		wpa_s->ifmsh = NULL;
4834	}
4835#endif /* CONFIG_MESH */
4836
4837	if (wpa_s->conf != NULL) {
4838		wpa_config_free(wpa_s->conf);
4839		wpa_s->conf = NULL;
4840	}
4841
4842	os_free(wpa_s->ssids_from_scan_req);
4843
4844	os_free(wpa_s);
4845}
4846
4847
4848/**
4849 * wpa_supplicant_add_iface - Add a new network interface
4850 * @global: Pointer to global data from wpa_supplicant_init()
4851 * @iface: Interface configuration options
4852 * @parent: Parent interface or %NULL to assign new interface as parent
4853 * Returns: Pointer to the created interface or %NULL on failure
4854 *
4855 * This function is used to add new network interfaces for %wpa_supplicant.
4856 * This can be called before wpa_supplicant_run() to add interfaces before the
4857 * main event loop has been started. In addition, new interfaces can be added
4858 * dynamically while %wpa_supplicant is already running. This could happen,
4859 * e.g., when a hotplug network adapter is inserted.
4860 */
4861struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4862						 struct wpa_interface *iface,
4863						 struct wpa_supplicant *parent)
4864{
4865	struct wpa_supplicant *wpa_s;
4866	struct wpa_interface t_iface;
4867	struct wpa_ssid *ssid;
4868
4869	if (global == NULL || iface == NULL)
4870		return NULL;
4871
4872	wpa_s = wpa_supplicant_alloc(parent);
4873	if (wpa_s == NULL)
4874		return NULL;
4875
4876	wpa_s->global = global;
4877
4878	t_iface = *iface;
4879	if (global->params.override_driver) {
4880		wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4881			   "('%s' -> '%s')",
4882			   iface->driver, global->params.override_driver);
4883		t_iface.driver = global->params.override_driver;
4884	}
4885	if (global->params.override_ctrl_interface) {
4886		wpa_printf(MSG_DEBUG, "Override interface parameter: "
4887			   "ctrl_interface ('%s' -> '%s')",
4888			   iface->ctrl_interface,
4889			   global->params.override_ctrl_interface);
4890		t_iface.ctrl_interface =
4891			global->params.override_ctrl_interface;
4892	}
4893	if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4894		wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4895			   iface->ifname);
4896		wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4897		return NULL;
4898	}
4899
4900	if (iface->p2p_mgmt == 0) {
4901		/* Notify the control interfaces about new iface */
4902		if (wpas_notify_iface_added(wpa_s)) {
4903			wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4904			return NULL;
4905		}
4906
4907		for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4908			wpas_notify_network_added(wpa_s, ssid);
4909	}
4910
4911	wpa_s->next = global->ifaces;
4912	global->ifaces = wpa_s;
4913
4914	wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4915	wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4916
4917#ifdef CONFIG_P2P
4918	if (wpa_s->global->p2p == NULL &&
4919	    !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4920	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4921	    wpas_p2p_add_p2pdev_interface(
4922		    wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4923		wpa_printf(MSG_INFO,
4924			   "P2P: Failed to enable P2P Device interface");
4925		/* Try to continue without. P2P will be disabled. */
4926	}
4927#endif /* CONFIG_P2P */
4928
4929	return wpa_s;
4930}
4931
4932
4933/**
4934 * wpa_supplicant_remove_iface - Remove a network interface
4935 * @global: Pointer to global data from wpa_supplicant_init()
4936 * @wpa_s: Pointer to the network interface to be removed
4937 * Returns: 0 if interface was removed, -1 if interface was not found
4938 *
4939 * This function can be used to dynamically remove network interfaces from
4940 * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4941 * addition, this function is used to remove all remaining interfaces when
4942 * %wpa_supplicant is terminated.
4943 */
4944int wpa_supplicant_remove_iface(struct wpa_global *global,
4945				struct wpa_supplicant *wpa_s,
4946				int terminate)
4947{
4948	struct wpa_supplicant *prev;
4949#ifdef CONFIG_MESH
4950	unsigned int mesh_if_created = wpa_s->mesh_if_created;
4951	char *ifname = NULL;
4952#endif /* CONFIG_MESH */
4953
4954	/* Remove interface from the global list of interfaces */
4955	prev = global->ifaces;
4956	if (prev == wpa_s) {
4957		global->ifaces = wpa_s->next;
4958	} else {
4959		while (prev && prev->next != wpa_s)
4960			prev = prev->next;
4961		if (prev == NULL)
4962			return -1;
4963		prev->next = wpa_s->next;
4964	}
4965
4966	wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4967
4968#ifdef CONFIG_MESH
4969	if (mesh_if_created) {
4970		ifname = os_strdup(wpa_s->ifname);
4971		if (ifname == NULL) {
4972			wpa_dbg(wpa_s, MSG_ERROR,
4973				"mesh: Failed to malloc ifname");
4974			return -1;
4975		}
4976	}
4977#endif /* CONFIG_MESH */
4978
4979	if (global->p2p_group_formation == wpa_s)
4980		global->p2p_group_formation = NULL;
4981	if (global->p2p_invite_group == wpa_s)
4982		global->p2p_invite_group = NULL;
4983	wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4984
4985#ifdef CONFIG_MESH
4986	if (mesh_if_created) {
4987		wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4988		os_free(ifname);
4989	}
4990#endif /* CONFIG_MESH */
4991
4992	return 0;
4993}
4994
4995
4996/**
4997 * wpa_supplicant_get_eap_mode - Get the current EAP mode
4998 * @wpa_s: Pointer to the network interface
4999 * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5000 */
5001const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5002{
5003	const char *eapol_method;
5004
5005        if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5006            wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5007		return "NO-EAP";
5008	}
5009
5010	eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5011	if (eapol_method == NULL)
5012		return "UNKNOWN-EAP";
5013
5014	return eapol_method;
5015}
5016
5017
5018/**
5019 * wpa_supplicant_get_iface - Get a new network interface
5020 * @global: Pointer to global data from wpa_supplicant_init()
5021 * @ifname: Interface name
5022 * Returns: Pointer to the interface or %NULL if not found
5023 */
5024struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5025						 const char *ifname)
5026{
5027	struct wpa_supplicant *wpa_s;
5028
5029	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5030		if (os_strcmp(wpa_s->ifname, ifname) == 0)
5031			return wpa_s;
5032	}
5033	return NULL;
5034}
5035
5036
5037#ifndef CONFIG_NO_WPA_MSG
5038static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5039{
5040	struct wpa_supplicant *wpa_s = ctx;
5041	if (wpa_s == NULL)
5042		return NULL;
5043	return wpa_s->ifname;
5044}
5045#endif /* CONFIG_NO_WPA_MSG */
5046
5047
5048#ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5049#define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5050#endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5051
5052/* Periodic cleanup tasks */
5053static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5054{
5055	struct wpa_global *global = eloop_ctx;
5056	struct wpa_supplicant *wpa_s;
5057
5058	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5059			       wpas_periodic, global, NULL);
5060
5061#ifdef CONFIG_P2P
5062	if (global->p2p)
5063		p2p_expire_peers(global->p2p);
5064#endif /* CONFIG_P2P */
5065
5066	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5067		wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5068#ifdef CONFIG_AP
5069		ap_periodic(wpa_s);
5070#endif /* CONFIG_AP */
5071	}
5072}
5073
5074
5075/**
5076 * wpa_supplicant_init - Initialize %wpa_supplicant
5077 * @params: Parameters for %wpa_supplicant
5078 * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5079 *
5080 * This function is used to initialize %wpa_supplicant. After successful
5081 * initialization, the returned data pointer can be used to add and remove
5082 * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5083 */
5084struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5085{
5086	struct wpa_global *global;
5087	int ret, i;
5088
5089	if (params == NULL)
5090		return NULL;
5091
5092#ifdef CONFIG_DRIVER_NDIS
5093	{
5094		void driver_ndis_init_ops(void);
5095		driver_ndis_init_ops();
5096	}
5097#endif /* CONFIG_DRIVER_NDIS */
5098
5099#ifndef CONFIG_NO_WPA_MSG
5100	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5101#endif /* CONFIG_NO_WPA_MSG */
5102
5103	if (params->wpa_debug_file_path)
5104		wpa_debug_open_file(params->wpa_debug_file_path);
5105	else
5106		wpa_debug_setup_stdout();
5107	if (params->wpa_debug_syslog)
5108		wpa_debug_open_syslog();
5109	if (params->wpa_debug_tracing) {
5110		ret = wpa_debug_open_linux_tracing();
5111		if (ret) {
5112			wpa_printf(MSG_ERROR,
5113				   "Failed to enable trace logging");
5114			return NULL;
5115		}
5116	}
5117
5118	ret = eap_register_methods();
5119	if (ret) {
5120		wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5121		if (ret == -2)
5122			wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5123				   "the same EAP type.");
5124		return NULL;
5125	}
5126
5127	global = os_zalloc(sizeof(*global));
5128	if (global == NULL)
5129		return NULL;
5130	dl_list_init(&global->p2p_srv_bonjour);
5131	dl_list_init(&global->p2p_srv_upnp);
5132	global->params.daemonize = params->daemonize;
5133	global->params.wait_for_monitor = params->wait_for_monitor;
5134	global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5135	if (params->pid_file)
5136		global->params.pid_file = os_strdup(params->pid_file);
5137	if (params->ctrl_interface)
5138		global->params.ctrl_interface =
5139			os_strdup(params->ctrl_interface);
5140	if (params->ctrl_interface_group)
5141		global->params.ctrl_interface_group =
5142			os_strdup(params->ctrl_interface_group);
5143	if (params->override_driver)
5144		global->params.override_driver =
5145			os_strdup(params->override_driver);
5146	if (params->override_ctrl_interface)
5147		global->params.override_ctrl_interface =
5148			os_strdup(params->override_ctrl_interface);
5149#ifdef CONFIG_P2P
5150	if (params->conf_p2p_dev)
5151		global->params.conf_p2p_dev =
5152			os_strdup(params->conf_p2p_dev);
5153#endif /* CONFIG_P2P */
5154	wpa_debug_level = global->params.wpa_debug_level =
5155		params->wpa_debug_level;
5156	wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5157		params->wpa_debug_show_keys;
5158	wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5159		params->wpa_debug_timestamp;
5160
5161	wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5162
5163	if (eloop_init()) {
5164		wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5165		wpa_supplicant_deinit(global);
5166		return NULL;
5167	}
5168
5169	random_init(params->entropy_file);
5170
5171	global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5172	if (global->ctrl_iface == NULL) {
5173		wpa_supplicant_deinit(global);
5174		return NULL;
5175	}
5176
5177	if (wpas_notify_supplicant_initialized(global)) {
5178		wpa_supplicant_deinit(global);
5179		return NULL;
5180	}
5181
5182	for (i = 0; wpa_drivers[i]; i++)
5183		global->drv_count++;
5184	if (global->drv_count == 0) {
5185		wpa_printf(MSG_ERROR, "No drivers enabled");
5186		wpa_supplicant_deinit(global);
5187		return NULL;
5188	}
5189	global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5190	if (global->drv_priv == NULL) {
5191		wpa_supplicant_deinit(global);
5192		return NULL;
5193	}
5194
5195#ifdef CONFIG_WIFI_DISPLAY
5196	if (wifi_display_init(global) < 0) {
5197		wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5198		wpa_supplicant_deinit(global);
5199		return NULL;
5200	}
5201#endif /* CONFIG_WIFI_DISPLAY */
5202
5203	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5204			       wpas_periodic, global, NULL);
5205
5206	return global;
5207}
5208
5209
5210/**
5211 * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5212 * @global: Pointer to global data from wpa_supplicant_init()
5213 * Returns: 0 after successful event loop run, -1 on failure
5214 *
5215 * This function starts the main event loop and continues running as long as
5216 * there are any remaining events. In most cases, this function is running as
5217 * long as the %wpa_supplicant process in still in use.
5218 */
5219int wpa_supplicant_run(struct wpa_global *global)
5220{
5221	struct wpa_supplicant *wpa_s;
5222
5223	if (global->params.daemonize &&
5224	    (wpa_supplicant_daemon(global->params.pid_file) ||
5225	     eloop_sock_requeue()))
5226		return -1;
5227
5228	if (global->params.wait_for_monitor) {
5229		for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5230			if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5231				wpa_supplicant_ctrl_iface_wait(
5232					wpa_s->ctrl_iface);
5233	}
5234
5235	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5236	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5237
5238	eloop_run();
5239
5240	return 0;
5241}
5242
5243
5244/**
5245 * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5246 * @global: Pointer to global data from wpa_supplicant_init()
5247 *
5248 * This function is called to deinitialize %wpa_supplicant and to free all
5249 * allocated resources. Remaining network interfaces will also be removed.
5250 */
5251void wpa_supplicant_deinit(struct wpa_global *global)
5252{
5253	int i;
5254
5255	if (global == NULL)
5256		return;
5257
5258	eloop_cancel_timeout(wpas_periodic, global, NULL);
5259
5260#ifdef CONFIG_WIFI_DISPLAY
5261	wifi_display_deinit(global);
5262#endif /* CONFIG_WIFI_DISPLAY */
5263
5264	while (global->ifaces)
5265		wpa_supplicant_remove_iface(global, global->ifaces, 1);
5266
5267	if (global->ctrl_iface)
5268		wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5269
5270	wpas_notify_supplicant_deinitialized(global);
5271
5272	eap_peer_unregister_methods();
5273#ifdef CONFIG_AP
5274	eap_server_unregister_methods();
5275#endif /* CONFIG_AP */
5276
5277	for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5278		if (!global->drv_priv[i])
5279			continue;
5280		wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5281	}
5282	os_free(global->drv_priv);
5283
5284	random_deinit();
5285
5286	eloop_destroy();
5287
5288	if (global->params.pid_file) {
5289		os_daemonize_terminate(global->params.pid_file);
5290		os_free(global->params.pid_file);
5291	}
5292	os_free(global->params.ctrl_interface);
5293	os_free(global->params.ctrl_interface_group);
5294	os_free(global->params.override_driver);
5295	os_free(global->params.override_ctrl_interface);
5296#ifdef CONFIG_P2P
5297	os_free(global->params.conf_p2p_dev);
5298#endif /* CONFIG_P2P */
5299
5300	os_free(global->p2p_disallow_freq.range);
5301	os_free(global->p2p_go_avoid_freq.range);
5302	os_free(global->add_psk);
5303
5304	os_free(global);
5305	wpa_debug_close_syslog();
5306	wpa_debug_close_file();
5307	wpa_debug_close_linux_tracing();
5308}
5309
5310
5311void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5312{
5313	if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5314	    wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5315		char country[3];
5316		country[0] = wpa_s->conf->country[0];
5317		country[1] = wpa_s->conf->country[1];
5318		country[2] = '\0';
5319		if (wpa_drv_set_country(wpa_s, country) < 0) {
5320			wpa_printf(MSG_ERROR, "Failed to set country code "
5321				   "'%s'", country);
5322		}
5323	}
5324
5325	if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5326		wpas_init_ext_pw(wpa_s);
5327
5328	if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5329		wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5330
5331#ifdef CONFIG_WPS
5332	wpas_wps_update_config(wpa_s);
5333#endif /* CONFIG_WPS */
5334	wpas_p2p_update_config(wpa_s);
5335	wpa_s->conf->changed_parameters = 0;
5336}
5337
5338
5339void add_freq(int *freqs, int *num_freqs, int freq)
5340{
5341	int i;
5342
5343	for (i = 0; i < *num_freqs; i++) {
5344		if (freqs[i] == freq)
5345			return;
5346	}
5347
5348	freqs[*num_freqs] = freq;
5349	(*num_freqs)++;
5350}
5351
5352
5353static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5354{
5355	struct wpa_bss *bss, *cbss;
5356	const int max_freqs = 10;
5357	int *freqs;
5358	int num_freqs = 0;
5359
5360	freqs = os_calloc(max_freqs + 1, sizeof(int));
5361	if (freqs == NULL)
5362		return NULL;
5363
5364	cbss = wpa_s->current_bss;
5365
5366	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5367		if (bss == cbss)
5368			continue;
5369		if (bss->ssid_len == cbss->ssid_len &&
5370		    os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5371		    wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5372			add_freq(freqs, &num_freqs, bss->freq);
5373			if (num_freqs == max_freqs)
5374				break;
5375		}
5376	}
5377
5378	if (num_freqs == 0) {
5379		os_free(freqs);
5380		freqs = NULL;
5381	}
5382
5383	return freqs;
5384}
5385
5386
5387void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5388{
5389	int timeout;
5390	int count;
5391	int *freqs = NULL;
5392
5393	wpas_connect_work_done(wpa_s);
5394
5395	/*
5396	 * Remove possible authentication timeout since the connection failed.
5397	 */
5398	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5399
5400	/*
5401	 * There is no point in blacklisting the AP if this event is
5402	 * generated based on local request to disconnect.
5403	 */
5404	if (wpa_s->own_disconnect_req) {
5405		wpa_s->own_disconnect_req = 0;
5406		wpa_dbg(wpa_s, MSG_DEBUG,
5407			"Ignore connection failure due to local request to disconnect");
5408		return;
5409	}
5410	if (wpa_s->disconnected) {
5411		wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5412			"indication since interface has been put into "
5413			"disconnected state");
5414		return;
5415	}
5416
5417	/*
5418	 * Add the failed BSSID into the blacklist and speed up next scan
5419	 * attempt if there could be other APs that could accept association.
5420	 * The current blacklist count indicates how many times we have tried
5421	 * connecting to this AP and multiple attempts mean that other APs are
5422	 * either not available or has already been tried, so that we can start
5423	 * increasing the delay here to avoid constant scanning.
5424	 */
5425	count = wpa_blacklist_add(wpa_s, bssid);
5426	if (count == 1 && wpa_s->current_bss) {
5427		/*
5428		 * This BSS was not in the blacklist before. If there is
5429		 * another BSS available for the same ESS, we should try that
5430		 * next. Otherwise, we may as well try this one once more
5431		 * before allowing other, likely worse, ESSes to be considered.
5432		 */
5433		freqs = get_bss_freqs_in_ess(wpa_s);
5434		if (freqs) {
5435			wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5436				"has been seen; try it next");
5437			wpa_blacklist_add(wpa_s, bssid);
5438			/*
5439			 * On the next scan, go through only the known channels
5440			 * used in this ESS based on previous scans to speed up
5441			 * common load balancing use case.
5442			 */
5443			os_free(wpa_s->next_scan_freqs);
5444			wpa_s->next_scan_freqs = freqs;
5445		}
5446	}
5447
5448	/*
5449	 * Add previous failure count in case the temporary blacklist was
5450	 * cleared due to no other BSSes being available.
5451	 */
5452	count += wpa_s->extra_blacklist_count;
5453
5454	if (count > 3 && wpa_s->current_ssid) {
5455		wpa_printf(MSG_DEBUG, "Continuous association failures - "
5456			   "consider temporary network disabling");
5457		wpas_auth_failed(wpa_s, "CONN_FAILED");
5458	}
5459
5460	switch (count) {
5461	case 1:
5462		timeout = 100;
5463		break;
5464	case 2:
5465		timeout = 500;
5466		break;
5467	case 3:
5468		timeout = 1000;
5469		break;
5470	case 4:
5471		timeout = 5000;
5472		break;
5473	default:
5474		timeout = 10000;
5475		break;
5476	}
5477
5478	wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5479		"ms", count, timeout);
5480
5481	/*
5482	 * TODO: if more than one possible AP is available in scan results,
5483	 * could try the other ones before requesting a new scan.
5484	 */
5485	wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5486				1000 * (timeout % 1000));
5487}
5488
5489
5490int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5491{
5492	return wpa_s->conf->ap_scan == 2 ||
5493		(wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5494}
5495
5496
5497#if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5498int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5499					      struct wpa_ssid *ssid,
5500					      const char *field,
5501					      const char *value)
5502{
5503#ifdef IEEE8021X_EAPOL
5504	struct eap_peer_config *eap = &ssid->eap;
5505
5506	wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5507	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5508			      (const u8 *) value, os_strlen(value));
5509
5510	switch (wpa_supplicant_ctrl_req_from_string(field)) {
5511	case WPA_CTRL_REQ_EAP_IDENTITY:
5512		os_free(eap->identity);
5513		eap->identity = (u8 *) os_strdup(value);
5514		eap->identity_len = os_strlen(value);
5515		eap->pending_req_identity = 0;
5516		if (ssid == wpa_s->current_ssid)
5517			wpa_s->reassociate = 1;
5518		break;
5519	case WPA_CTRL_REQ_EAP_PASSWORD:
5520		bin_clear_free(eap->password, eap->password_len);
5521		eap->password = (u8 *) os_strdup(value);
5522		eap->password_len = os_strlen(value);
5523		eap->pending_req_password = 0;
5524		if (ssid == wpa_s->current_ssid)
5525			wpa_s->reassociate = 1;
5526		break;
5527	case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5528		bin_clear_free(eap->new_password, eap->new_password_len);
5529		eap->new_password = (u8 *) os_strdup(value);
5530		eap->new_password_len = os_strlen(value);
5531		eap->pending_req_new_password = 0;
5532		if (ssid == wpa_s->current_ssid)
5533			wpa_s->reassociate = 1;
5534		break;
5535	case WPA_CTRL_REQ_EAP_PIN:
5536		str_clear_free(eap->pin);
5537		eap->pin = os_strdup(value);
5538		eap->pending_req_pin = 0;
5539		if (ssid == wpa_s->current_ssid)
5540			wpa_s->reassociate = 1;
5541		break;
5542	case WPA_CTRL_REQ_EAP_OTP:
5543		bin_clear_free(eap->otp, eap->otp_len);
5544		eap->otp = (u8 *) os_strdup(value);
5545		eap->otp_len = os_strlen(value);
5546		os_free(eap->pending_req_otp);
5547		eap->pending_req_otp = NULL;
5548		eap->pending_req_otp_len = 0;
5549		break;
5550	case WPA_CTRL_REQ_EAP_PASSPHRASE:
5551		str_clear_free(eap->private_key_passwd);
5552		eap->private_key_passwd = os_strdup(value);
5553		eap->pending_req_passphrase = 0;
5554		if (ssid == wpa_s->current_ssid)
5555			wpa_s->reassociate = 1;
5556		break;
5557	case WPA_CTRL_REQ_SIM:
5558		str_clear_free(eap->external_sim_resp);
5559		eap->external_sim_resp = os_strdup(value);
5560		break;
5561	case WPA_CTRL_REQ_PSK_PASSPHRASE:
5562		if (wpa_config_set(ssid, "psk", value, 0) < 0)
5563			return -1;
5564		ssid->mem_only_psk = 1;
5565		if (ssid->passphrase)
5566			wpa_config_update_psk(ssid);
5567		if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5568			wpa_supplicant_req_scan(wpa_s, 0, 0);
5569		break;
5570	case WPA_CTRL_REQ_EXT_CERT_CHECK:
5571		if (eap->pending_ext_cert_check != PENDING_CHECK)
5572			return -1;
5573		if (os_strcmp(value, "good") == 0)
5574			eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5575		else if (os_strcmp(value, "bad") == 0)
5576			eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5577		else
5578			return -1;
5579		break;
5580	default:
5581		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5582		return -1;
5583	}
5584
5585	return 0;
5586#else /* IEEE8021X_EAPOL */
5587	wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5588	return -1;
5589#endif /* IEEE8021X_EAPOL */
5590}
5591#endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5592
5593
5594int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5595{
5596	int i;
5597	unsigned int drv_enc;
5598
5599	if (wpa_s->p2p_mgmt)
5600		return 1; /* no normal network profiles on p2p_mgmt interface */
5601
5602	if (ssid == NULL)
5603		return 1;
5604
5605	if (ssid->disabled)
5606		return 1;
5607
5608	if (wpa_s->drv_capa_known)
5609		drv_enc = wpa_s->drv_enc;
5610	else
5611		drv_enc = (unsigned int) -1;
5612
5613	for (i = 0; i < NUM_WEP_KEYS; i++) {
5614		size_t len = ssid->wep_key_len[i];
5615		if (len == 0)
5616			continue;
5617		if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5618			continue;
5619		if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5620			continue;
5621		if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5622			continue;
5623		return 1; /* invalid WEP key */
5624	}
5625
5626	if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5627	    (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5628	    !ssid->mem_only_psk)
5629		return 1;
5630
5631	return 0;
5632}
5633
5634
5635int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5636{
5637#ifdef CONFIG_IEEE80211W
5638	if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5639		if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5640		    !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5641			/*
5642			 * Driver does not support BIP -- ignore pmf=1 default
5643			 * since the connection with PMF would fail and the
5644			 * configuration does not require PMF to be enabled.
5645			 */
5646			return NO_MGMT_FRAME_PROTECTION;
5647		}
5648
5649		return wpa_s->conf->pmf;
5650	}
5651
5652	return ssid->ieee80211w;
5653#else /* CONFIG_IEEE80211W */
5654	return NO_MGMT_FRAME_PROTECTION;
5655#endif /* CONFIG_IEEE80211W */
5656}
5657
5658
5659int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5660{
5661	if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5662		return 1;
5663	if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5664		return 0;
5665	return -1;
5666}
5667
5668
5669void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5670{
5671	struct wpa_ssid *ssid = wpa_s->current_ssid;
5672	int dur;
5673	struct os_reltime now;
5674
5675	if (ssid == NULL) {
5676		wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5677			   "SSID block");
5678		return;
5679	}
5680
5681	if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5682		return;
5683
5684	ssid->auth_failures++;
5685
5686#ifdef CONFIG_P2P
5687	if (ssid->p2p_group &&
5688	    (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5689		/*
5690		 * Skip the wait time since there is a short timeout on the
5691		 * connection to a P2P group.
5692		 */
5693		return;
5694	}
5695#endif /* CONFIG_P2P */
5696
5697	if (ssid->auth_failures > 50)
5698		dur = 300;
5699	else if (ssid->auth_failures > 10)
5700		dur = 120;
5701	else if (ssid->auth_failures > 5)
5702		dur = 90;
5703	else if (ssid->auth_failures > 3)
5704		dur = 60;
5705	else if (ssid->auth_failures > 2)
5706		dur = 30;
5707	else if (ssid->auth_failures > 1)
5708		dur = 20;
5709	else
5710		dur = 10;
5711
5712	if (ssid->auth_failures > 1 &&
5713	    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5714		dur += os_random() % (ssid->auth_failures * 10);
5715
5716	os_get_reltime(&now);
5717	if (now.sec + dur <= ssid->disabled_until.sec)
5718		return;
5719
5720	ssid->disabled_until.sec = now.sec + dur;
5721
5722	wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5723		"id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5724		ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5725		ssid->auth_failures, dur, reason);
5726}
5727
5728
5729void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5730			      struct wpa_ssid *ssid, int clear_failures)
5731{
5732	if (ssid == NULL)
5733		return;
5734
5735	if (ssid->disabled_until.sec) {
5736		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5737			"id=%d ssid=\"%s\"",
5738			ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5739	}
5740	ssid->disabled_until.sec = 0;
5741	ssid->disabled_until.usec = 0;
5742	if (clear_failures)
5743		ssid->auth_failures = 0;
5744}
5745
5746
5747int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5748{
5749	size_t i;
5750
5751	if (wpa_s->disallow_aps_bssid == NULL)
5752		return 0;
5753
5754	for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5755		if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5756			      bssid, ETH_ALEN) == 0)
5757			return 1;
5758	}
5759
5760	return 0;
5761}
5762
5763
5764int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5765		    size_t ssid_len)
5766{
5767	size_t i;
5768
5769	if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5770		return 0;
5771
5772	for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5773		struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5774		if (ssid_len == s->ssid_len &&
5775		    os_memcmp(ssid, s->ssid, ssid_len) == 0)
5776			return 1;
5777	}
5778
5779	return 0;
5780}
5781
5782
5783/**
5784 * wpas_request_connection - Request a new connection
5785 * @wpa_s: Pointer to the network interface
5786 *
5787 * This function is used to request a new connection to be found. It will mark
5788 * the interface to allow reassociation and request a new scan to find a
5789 * suitable network to connect to.
5790 */
5791void wpas_request_connection(struct wpa_supplicant *wpa_s)
5792{
5793	wpa_s->normal_scans = 0;
5794	wpa_s->scan_req = NORMAL_SCAN_REQ;
5795	wpa_supplicant_reinit_autoscan(wpa_s);
5796	wpa_s->extra_blacklist_count = 0;
5797	wpa_s->disconnected = 0;
5798	wpa_s->reassociate = 1;
5799
5800	if (wpa_supplicant_fast_associate(wpa_s) != 1)
5801		wpa_supplicant_req_scan(wpa_s, 0, 0);
5802	else
5803		wpa_s->reattach = 0;
5804}
5805
5806
5807void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5808		    struct wpa_used_freq_data *freqs_data,
5809		    unsigned int len)
5810{
5811	unsigned int i;
5812
5813	wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5814		len, title);
5815	for (i = 0; i < len; i++) {
5816		struct wpa_used_freq_data *cur = &freqs_data[i];
5817		wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5818			i, cur->freq, cur->flags);
5819	}
5820}
5821
5822
5823/*
5824 * Find the operating frequencies of any of the virtual interfaces that
5825 * are using the same radio as the current interface, and in addition, get
5826 * information about the interface types that are using the frequency.
5827 */
5828int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5829				struct wpa_used_freq_data *freqs_data,
5830				unsigned int len)
5831{
5832	struct wpa_supplicant *ifs;
5833	u8 bssid[ETH_ALEN];
5834	int freq;
5835	unsigned int idx = 0, i;
5836
5837	wpa_dbg(wpa_s, MSG_DEBUG,
5838		"Determining shared radio frequencies (max len %u)", len);
5839	os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5840
5841	dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5842			 radio_list) {
5843		if (idx == len)
5844			break;
5845
5846		if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5847			continue;
5848
5849		if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5850		    ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5851		    ifs->current_ssid->mode == WPAS_MODE_MESH)
5852			freq = ifs->current_ssid->frequency;
5853		else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5854			freq = ifs->assoc_freq;
5855		else
5856			continue;
5857
5858		/* Hold only distinct freqs */
5859		for (i = 0; i < idx; i++)
5860			if (freqs_data[i].freq == freq)
5861				break;
5862
5863		if (i == idx)
5864			freqs_data[idx++].freq = freq;
5865
5866		if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5867			freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5868				WPA_FREQ_USED_BY_P2P_CLIENT :
5869				WPA_FREQ_USED_BY_INFRA_STATION;
5870		}
5871	}
5872
5873	dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5874	return idx;
5875}
5876
5877
5878/*
5879 * Find the operating frequencies of any of the virtual interfaces that
5880 * are using the same radio as the current interface.
5881 */
5882int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5883			   int *freq_array, unsigned int len)
5884{
5885	struct wpa_used_freq_data *freqs_data;
5886	int num, i;
5887
5888	os_memset(freq_array, 0, sizeof(int) * len);
5889
5890	freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5891	if (!freqs_data)
5892		return -1;
5893
5894	num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5895	for (i = 0; i < num; i++)
5896		freq_array[i] = freqs_data[i].freq;
5897
5898	os_free(freqs_data);
5899
5900	return num;
5901}
5902
5903
5904static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5905{
5906	struct rrm_data *rrm = data;
5907
5908	if (!rrm->notify_neighbor_rep) {
5909		wpa_printf(MSG_ERROR,
5910			   "RRM: Unexpected neighbor report timeout");
5911		return;
5912	}
5913
5914	wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5915	rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5916
5917	rrm->notify_neighbor_rep = NULL;
5918	rrm->neighbor_rep_cb_ctx = NULL;
5919}
5920
5921
5922/*
5923 * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5924 * @wpa_s: Pointer to wpa_supplicant
5925 */
5926void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5927{
5928	wpa_s->rrm.rrm_used = 0;
5929
5930	eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5931			     NULL);
5932	if (wpa_s->rrm.notify_neighbor_rep)
5933		wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5934	wpa_s->rrm.next_neighbor_rep_token = 1;
5935}
5936
5937
5938/*
5939 * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5940 * @wpa_s: Pointer to wpa_supplicant
5941 * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5942 * @report_len: Length of neighbor report buffer
5943 */
5944void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5945				   const u8 *report, size_t report_len)
5946{
5947	struct wpabuf *neighbor_rep;
5948
5949	wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5950	if (report_len < 1)
5951		return;
5952
5953	if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5954		wpa_printf(MSG_DEBUG,
5955			   "RRM: Discarding neighbor report with token %d (expected %d)",
5956			   report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5957		return;
5958	}
5959
5960	eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5961			     NULL);
5962
5963	if (!wpa_s->rrm.notify_neighbor_rep) {
5964		wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5965		return;
5966	}
5967
5968	/* skipping the first byte, which is only an id (dialog token) */
5969	neighbor_rep = wpabuf_alloc(report_len - 1);
5970	if (neighbor_rep == NULL)
5971		return;
5972	wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5973	wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5974		   report[0]);
5975	wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5976				       neighbor_rep);
5977	wpa_s->rrm.notify_neighbor_rep = NULL;
5978	wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5979}
5980
5981
5982#if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5983/* Workaround different, undefined for Windows, error codes used here */
5984#define ENOTCONN -1
5985#define EOPNOTSUPP -1
5986#define ECANCELED -1
5987#endif
5988
5989/**
5990 * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5991 * @wpa_s: Pointer to wpa_supplicant
5992 * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5993 *	  is sent in the request.
5994 * @cb: Callback function to be called once the requested report arrives, or
5995 *	timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5996 *	In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5997 *	the requester's responsibility to free it.
5998 *	In the latter case NULL will be sent in 'neighbor_rep'.
5999 * @cb_ctx: Context value to send the callback function
6000 * Returns: 0 in case of success, negative error code otherwise
6001 *
6002 * In case there is a previous request which has not been answered yet, the
6003 * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6004 * Request must contain a callback function.
6005 */
6006int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6007				       const struct wpa_ssid *ssid,
6008				       void (*cb)(void *ctx,
6009						  struct wpabuf *neighbor_rep),
6010				       void *cb_ctx)
6011{
6012	struct wpabuf *buf;
6013	const u8 *rrm_ie;
6014
6015	if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6016		wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6017		return -ENOTCONN;
6018	}
6019
6020	if (!wpa_s->rrm.rrm_used) {
6021		wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6022		return -EOPNOTSUPP;
6023	}
6024
6025	rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6026				WLAN_EID_RRM_ENABLED_CAPABILITIES);
6027	if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6028	    !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6029		wpa_printf(MSG_DEBUG,
6030			   "RRM: No network support for Neighbor Report.");
6031		return -EOPNOTSUPP;
6032	}
6033
6034	if (!cb) {
6035		wpa_printf(MSG_DEBUG,
6036			   "RRM: Neighbor Report request must provide a callback.");
6037		return -EINVAL;
6038	}
6039
6040	/* Refuse if there's a live request */
6041	if (wpa_s->rrm.notify_neighbor_rep) {
6042		wpa_printf(MSG_DEBUG,
6043			   "RRM: Currently handling previous Neighbor Report.");
6044		return -EBUSY;
6045	}
6046
6047	/* 3 = action category + action code + dialog token */
6048	buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6049	if (buf == NULL) {
6050		wpa_printf(MSG_DEBUG,
6051			   "RRM: Failed to allocate Neighbor Report Request");
6052		return -ENOMEM;
6053	}
6054
6055	wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6056		   (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6057		   wpa_s->rrm.next_neighbor_rep_token);
6058
6059	wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6060	wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6061	wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6062	if (ssid) {
6063		wpabuf_put_u8(buf, WLAN_EID_SSID);
6064		wpabuf_put_u8(buf, ssid->ssid_len);
6065		wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6066	}
6067
6068	wpa_s->rrm.next_neighbor_rep_token++;
6069
6070	if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6071				wpa_s->own_addr, wpa_s->bssid,
6072				wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6073		wpa_printf(MSG_DEBUG,
6074			   "RRM: Failed to send Neighbor Report Request");
6075		wpabuf_free(buf);
6076		return -ECANCELED;
6077	}
6078
6079	wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6080	wpa_s->rrm.notify_neighbor_rep = cb;
6081	eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6082			       wpas_rrm_neighbor_rep_timeout_handler,
6083			       &wpa_s->rrm, NULL);
6084
6085	wpabuf_free(buf);
6086	return 0;
6087}
6088
6089
6090void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6091					      const u8 *src,
6092					      const u8 *frame, size_t len,
6093					      int rssi)
6094{
6095	struct wpabuf *buf;
6096	const struct rrm_link_measurement_request *req;
6097	struct rrm_link_measurement_report report;
6098
6099	if (wpa_s->wpa_state != WPA_COMPLETED) {
6100		wpa_printf(MSG_INFO,
6101			   "RRM: Ignoring link measurement request. Not associated");
6102		return;
6103	}
6104
6105	if (!wpa_s->rrm.rrm_used) {
6106		wpa_printf(MSG_INFO,
6107			   "RRM: Ignoring link measurement request. Not RRM network");
6108		return;
6109	}
6110
6111	if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6112		wpa_printf(MSG_INFO,
6113			   "RRM: Measurement report failed. TX power insertion not supported");
6114		return;
6115	}
6116
6117	req = (const struct rrm_link_measurement_request *) frame;
6118	if (len < sizeof(*req)) {
6119		wpa_printf(MSG_INFO,
6120			   "RRM: Link measurement report failed. Request too short");
6121		return;
6122	}
6123
6124	os_memset(&report, 0, sizeof(report));
6125	report.tpc.eid = WLAN_EID_TPC_REPORT;
6126	report.tpc.len = 2;
6127	report.rsni = 255; /* 255 indicates that RSNI is not available */
6128	report.dialog_token = req->dialog_token;
6129
6130	/*
6131	 * It's possible to estimate RCPI based on RSSI in dBm. This
6132	 * calculation will not reflect the correct value for high rates,
6133	 * but it's good enough for Action frames which are transmitted
6134	 * with up to 24 Mbps rates.
6135	 */
6136	if (!rssi)
6137		report.rcpi = 255; /* not available */
6138	else if (rssi < -110)
6139		report.rcpi = 0;
6140	else if (rssi > 0)
6141		report.rcpi = 220;
6142	else
6143		report.rcpi = (rssi + 110) * 2;
6144
6145	/* action_category + action_code */
6146	buf = wpabuf_alloc(2 + sizeof(report));
6147	if (buf == NULL) {
6148		wpa_printf(MSG_ERROR,
6149			   "RRM: Link measurement report failed. Buffer allocation failed");
6150		return;
6151	}
6152
6153	wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6154	wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6155	wpabuf_put_data(buf, &report, sizeof(report));
6156	wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6157		    wpabuf_head(buf), wpabuf_len(buf));
6158
6159	if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6160				wpa_s->own_addr, wpa_s->bssid,
6161				wpabuf_head(buf), wpabuf_len(buf), 0)) {
6162		wpa_printf(MSG_ERROR,
6163			   "RRM: Link measurement report failed. Send action failed");
6164	}
6165	wpabuf_free(buf);
6166}
6167
6168
6169struct wpa_supplicant *
6170wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6171{
6172	switch (frame) {
6173#ifdef CONFIG_P2P
6174	case VENDOR_ELEM_PROBE_REQ_P2P:
6175	case VENDOR_ELEM_PROBE_RESP_P2P:
6176	case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6177	case VENDOR_ELEM_BEACON_P2P_GO:
6178	case VENDOR_ELEM_P2P_PD_REQ:
6179	case VENDOR_ELEM_P2P_PD_RESP:
6180	case VENDOR_ELEM_P2P_GO_NEG_REQ:
6181	case VENDOR_ELEM_P2P_GO_NEG_RESP:
6182	case VENDOR_ELEM_P2P_GO_NEG_CONF:
6183	case VENDOR_ELEM_P2P_INV_REQ:
6184	case VENDOR_ELEM_P2P_INV_RESP:
6185	case VENDOR_ELEM_P2P_ASSOC_REQ:
6186	case VENDOR_ELEM_P2P_ASSOC_RESP:
6187		return wpa_s->parent;
6188#endif /* CONFIG_P2P */
6189	default:
6190		return wpa_s;
6191	}
6192}
6193
6194
6195void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6196{
6197	unsigned int i;
6198	char buf[30];
6199
6200	wpa_printf(MSG_DEBUG, "Update vendor elements");
6201
6202	for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6203		if (wpa_s->vendor_elem[i]) {
6204			int res;
6205
6206			res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6207			if (!os_snprintf_error(sizeof(buf), res)) {
6208				wpa_hexdump_buf(MSG_DEBUG, buf,
6209						wpa_s->vendor_elem[i]);
6210			}
6211		}
6212	}
6213
6214#ifdef CONFIG_P2P
6215	if (wpa_s->parent == wpa_s &&
6216	    wpa_s->global->p2p &&
6217	    !wpa_s->global->p2p_disabled)
6218		p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6219#endif /* CONFIG_P2P */
6220}
6221
6222
6223int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6224			    const u8 *elem, size_t len)
6225{
6226	u8 *ie, *end;
6227
6228	ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6229	end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6230
6231	for (; ie + 1 < end; ie += 2 + ie[1]) {
6232		if (ie + len > end)
6233			break;
6234		if (os_memcmp(ie, elem, len) != 0)
6235			continue;
6236
6237		if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6238			wpabuf_free(wpa_s->vendor_elem[frame]);
6239			wpa_s->vendor_elem[frame] = NULL;
6240		} else {
6241			os_memmove(ie, ie + len, end - (ie + len));
6242			wpa_s->vendor_elem[frame]->used -= len;
6243		}
6244		wpas_vendor_elem_update(wpa_s);
6245		return 0;
6246	}
6247
6248	return -1;
6249}
6250