1/* 2 * BSS table 3 * Copyright (c) 2009-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "common/ieee802_11_defs.h" 14#include "drivers/driver.h" 15#include "wpa_supplicant_i.h" 16#include "config.h" 17#include "notify.h" 18#include "scan.h" 19#include "bss.h" 20 21 22#define WPA_BSS_FREQ_CHANGED_FLAG BIT(0) 23#define WPA_BSS_SIGNAL_CHANGED_FLAG BIT(1) 24#define WPA_BSS_PRIVACY_CHANGED_FLAG BIT(2) 25#define WPA_BSS_MODE_CHANGED_FLAG BIT(3) 26#define WPA_BSS_WPAIE_CHANGED_FLAG BIT(4) 27#define WPA_BSS_RSNIE_CHANGED_FLAG BIT(5) 28#define WPA_BSS_WPS_CHANGED_FLAG BIT(6) 29#define WPA_BSS_RATES_CHANGED_FLAG BIT(7) 30#define WPA_BSS_IES_CHANGED_FLAG BIT(8) 31 32 33static void wpa_bss_set_hessid(struct wpa_bss *bss) 34{ 35#ifdef CONFIG_INTERWORKING 36 const u8 *ie = wpa_bss_get_ie(bss, WLAN_EID_INTERWORKING); 37 if (ie == NULL || (ie[1] != 7 && ie[1] != 9)) { 38 os_memset(bss->hessid, 0, ETH_ALEN); 39 return; 40 } 41 if (ie[1] == 7) 42 os_memcpy(bss->hessid, ie + 3, ETH_ALEN); 43 else 44 os_memcpy(bss->hessid, ie + 5, ETH_ALEN); 45#endif /* CONFIG_INTERWORKING */ 46} 47 48 49/** 50 * wpa_bss_anqp_alloc - Allocate ANQP data structure for a BSS entry 51 * Returns: Allocated ANQP data structure or %NULL on failure 52 * 53 * The allocated ANQP data structure has its users count set to 1. It may be 54 * shared by multiple BSS entries and each shared entry is freed with 55 * wpa_bss_anqp_free(). 56 */ 57struct wpa_bss_anqp * wpa_bss_anqp_alloc(void) 58{ 59 struct wpa_bss_anqp *anqp; 60 anqp = os_zalloc(sizeof(*anqp)); 61 if (anqp == NULL) 62 return NULL; 63#ifdef CONFIG_INTERWORKING 64 dl_list_init(&anqp->anqp_elems); 65#endif /* CONFIG_INTERWORKING */ 66 anqp->users = 1; 67 return anqp; 68} 69 70 71/** 72 * wpa_bss_anqp_clone - Clone an ANQP data structure 73 * @anqp: ANQP data structure from wpa_bss_anqp_alloc() 74 * Returns: Cloned ANQP data structure or %NULL on failure 75 */ 76static struct wpa_bss_anqp * wpa_bss_anqp_clone(struct wpa_bss_anqp *anqp) 77{ 78 struct wpa_bss_anqp *n; 79 80 n = os_zalloc(sizeof(*n)); 81 if (n == NULL) 82 return NULL; 83 84#define ANQP_DUP(f) if (anqp->f) n->f = wpabuf_dup(anqp->f) 85#ifdef CONFIG_INTERWORKING 86 dl_list_init(&n->anqp_elems); 87 ANQP_DUP(capability_list); 88 ANQP_DUP(venue_name); 89 ANQP_DUP(network_auth_type); 90 ANQP_DUP(roaming_consortium); 91 ANQP_DUP(ip_addr_type_availability); 92 ANQP_DUP(nai_realm); 93 ANQP_DUP(anqp_3gpp); 94 ANQP_DUP(domain_name); 95#endif /* CONFIG_INTERWORKING */ 96#ifdef CONFIG_HS20 97 ANQP_DUP(hs20_capability_list); 98 ANQP_DUP(hs20_operator_friendly_name); 99 ANQP_DUP(hs20_wan_metrics); 100 ANQP_DUP(hs20_connection_capability); 101 ANQP_DUP(hs20_operating_class); 102 ANQP_DUP(hs20_osu_providers_list); 103#endif /* CONFIG_HS20 */ 104#undef ANQP_DUP 105 106 return n; 107} 108 109 110/** 111 * wpa_bss_anqp_unshare_alloc - Unshare ANQP data (if shared) in a BSS entry 112 * @bss: BSS entry 113 * Returns: 0 on success, -1 on failure 114 * 115 * This function ensures the specific BSS entry has an ANQP data structure that 116 * is not shared with any other BSS entry. 117 */ 118int wpa_bss_anqp_unshare_alloc(struct wpa_bss *bss) 119{ 120 struct wpa_bss_anqp *anqp; 121 122 if (bss->anqp && bss->anqp->users > 1) { 123 /* allocated, but shared - clone an unshared copy */ 124 anqp = wpa_bss_anqp_clone(bss->anqp); 125 if (anqp == NULL) 126 return -1; 127 anqp->users = 1; 128 bss->anqp->users--; 129 bss->anqp = anqp; 130 return 0; 131 } 132 133 if (bss->anqp) 134 return 0; /* already allocated and not shared */ 135 136 /* not allocated - allocate a new storage area */ 137 bss->anqp = wpa_bss_anqp_alloc(); 138 return bss->anqp ? 0 : -1; 139} 140 141 142/** 143 * wpa_bss_anqp_free - Free an ANQP data structure 144 * @anqp: ANQP data structure from wpa_bss_anqp_alloc() or wpa_bss_anqp_clone() 145 */ 146static void wpa_bss_anqp_free(struct wpa_bss_anqp *anqp) 147{ 148#ifdef CONFIG_INTERWORKING 149 struct wpa_bss_anqp_elem *elem; 150#endif /* CONFIG_INTERWORKING */ 151 152 if (anqp == NULL) 153 return; 154 155 anqp->users--; 156 if (anqp->users > 0) { 157 /* Another BSS entry holds a pointer to this ANQP info */ 158 return; 159 } 160 161#ifdef CONFIG_INTERWORKING 162 wpabuf_free(anqp->capability_list); 163 wpabuf_free(anqp->venue_name); 164 wpabuf_free(anqp->network_auth_type); 165 wpabuf_free(anqp->roaming_consortium); 166 wpabuf_free(anqp->ip_addr_type_availability); 167 wpabuf_free(anqp->nai_realm); 168 wpabuf_free(anqp->anqp_3gpp); 169 wpabuf_free(anqp->domain_name); 170 171 while ((elem = dl_list_first(&anqp->anqp_elems, 172 struct wpa_bss_anqp_elem, list))) { 173 dl_list_del(&elem->list); 174 wpabuf_free(elem->payload); 175 os_free(elem); 176 } 177#endif /* CONFIG_INTERWORKING */ 178#ifdef CONFIG_HS20 179 wpabuf_free(anqp->hs20_capability_list); 180 wpabuf_free(anqp->hs20_operator_friendly_name); 181 wpabuf_free(anqp->hs20_wan_metrics); 182 wpabuf_free(anqp->hs20_connection_capability); 183 wpabuf_free(anqp->hs20_operating_class); 184 wpabuf_free(anqp->hs20_osu_providers_list); 185#endif /* CONFIG_HS20 */ 186 187 os_free(anqp); 188} 189 190 191static void wpa_bss_update_pending_connect(struct wpa_supplicant *wpa_s, 192 struct wpa_bss *old_bss, 193 struct wpa_bss *new_bss) 194{ 195 struct wpa_radio_work *work; 196 struct wpa_connect_work *cwork; 197 198 work = radio_work_pending(wpa_s, "sme-connect"); 199 if (!work) 200 work = radio_work_pending(wpa_s, "connect"); 201 if (!work) 202 return; 203 204 cwork = work->ctx; 205 if (cwork->bss != old_bss) 206 return; 207 208 wpa_printf(MSG_DEBUG, 209 "Update BSS pointer for the pending connect radio work"); 210 cwork->bss = new_bss; 211 if (!new_bss) 212 cwork->bss_removed = 1; 213} 214 215 216static void wpa_bss_remove(struct wpa_supplicant *wpa_s, struct wpa_bss *bss, 217 const char *reason) 218{ 219 if (wpa_s->last_scan_res) { 220 unsigned int i; 221 for (i = 0; i < wpa_s->last_scan_res_used; i++) { 222 if (wpa_s->last_scan_res[i] == bss) { 223 os_memmove(&wpa_s->last_scan_res[i], 224 &wpa_s->last_scan_res[i + 1], 225 (wpa_s->last_scan_res_used - i - 1) 226 * sizeof(struct wpa_bss *)); 227 wpa_s->last_scan_res_used--; 228 break; 229 } 230 } 231 } 232 wpa_bss_update_pending_connect(wpa_s, bss, NULL); 233 dl_list_del(&bss->list); 234 dl_list_del(&bss->list_id); 235 wpa_s->num_bss--; 236 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: Remove id %u BSSID " MACSTR 237 " SSID '%s' due to %s", bss->id, MAC2STR(bss->bssid), 238 wpa_ssid_txt(bss->ssid, bss->ssid_len), reason); 239 wpas_notify_bss_removed(wpa_s, bss->bssid, bss->id); 240 wpa_bss_anqp_free(bss->anqp); 241 os_free(bss); 242} 243 244 245/** 246 * wpa_bss_get - Fetch a BSS table entry based on BSSID and SSID 247 * @wpa_s: Pointer to wpa_supplicant data 248 * @bssid: BSSID 249 * @ssid: SSID 250 * @ssid_len: Length of @ssid 251 * Returns: Pointer to the BSS entry or %NULL if not found 252 */ 253struct wpa_bss * wpa_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid, 254 const u8 *ssid, size_t ssid_len) 255{ 256 struct wpa_bss *bss; 257 if (!wpa_supplicant_filter_bssid_match(wpa_s, bssid)) 258 return NULL; 259 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 260 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0 && 261 bss->ssid_len == ssid_len && 262 os_memcmp(bss->ssid, ssid, ssid_len) == 0) 263 return bss; 264 } 265 return NULL; 266} 267 268 269static void calculate_update_time(const struct os_reltime *fetch_time, 270 unsigned int age_ms, 271 struct os_reltime *update_time) 272{ 273 os_time_t usec; 274 275 update_time->sec = fetch_time->sec; 276 update_time->usec = fetch_time->usec; 277 update_time->sec -= age_ms / 1000; 278 usec = (age_ms % 1000) * 1000; 279 if (update_time->usec < usec) { 280 update_time->sec--; 281 update_time->usec += 1000000; 282 } 283 update_time->usec -= usec; 284} 285 286 287static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src, 288 struct os_reltime *fetch_time) 289{ 290 dst->flags = src->flags; 291 os_memcpy(dst->bssid, src->bssid, ETH_ALEN); 292 dst->freq = src->freq; 293 dst->beacon_int = src->beacon_int; 294 dst->caps = src->caps; 295 dst->qual = src->qual; 296 dst->noise = src->noise; 297 dst->level = src->level; 298 dst->tsf = src->tsf; 299 dst->est_throughput = src->est_throughput; 300 dst->snr = src->snr; 301 302 calculate_update_time(fetch_time, src->age, &dst->last_update); 303} 304 305 306static int wpa_bss_known(struct wpa_supplicant *wpa_s, struct wpa_bss *bss) 307{ 308 struct wpa_ssid *ssid; 309 310 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) { 311 if (ssid->ssid == NULL || ssid->ssid_len == 0) 312 continue; 313 if (ssid->ssid_len == bss->ssid_len && 314 os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) == 0) 315 return 1; 316 } 317 318 return 0; 319} 320 321 322static int wpa_bss_in_use(struct wpa_supplicant *wpa_s, struct wpa_bss *bss) 323{ 324 if (bss == wpa_s->current_bss) 325 return 1; 326 327 if (wpa_s->current_bss && 328 (bss->ssid_len != wpa_s->current_bss->ssid_len || 329 os_memcmp(bss->ssid, wpa_s->current_bss->ssid, 330 bss->ssid_len) != 0)) 331 return 0; /* SSID has changed */ 332 333 return !is_zero_ether_addr(bss->bssid) && 334 (os_memcmp(bss->bssid, wpa_s->bssid, ETH_ALEN) == 0 || 335 os_memcmp(bss->bssid, wpa_s->pending_bssid, ETH_ALEN) == 0); 336} 337 338 339static int wpa_bss_remove_oldest_unknown(struct wpa_supplicant *wpa_s) 340{ 341 struct wpa_bss *bss; 342 343 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 344 if (!wpa_bss_known(wpa_s, bss)) { 345 wpa_bss_remove(wpa_s, bss, __func__); 346 return 0; 347 } 348 } 349 350 return -1; 351} 352 353 354static int wpa_bss_remove_oldest(struct wpa_supplicant *wpa_s) 355{ 356 struct wpa_bss *bss; 357 358 /* 359 * Remove the oldest entry that does not match with any configured 360 * network. 361 */ 362 if (wpa_bss_remove_oldest_unknown(wpa_s) == 0) 363 return 0; 364 365 /* 366 * Remove the oldest entry that isn't currently in use. 367 */ 368 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 369 if (!wpa_bss_in_use(wpa_s, bss)) { 370 wpa_bss_remove(wpa_s, bss, __func__); 371 return 0; 372 } 373 } 374 375 return -1; 376} 377 378 379static struct wpa_bss * wpa_bss_add(struct wpa_supplicant *wpa_s, 380 const u8 *ssid, size_t ssid_len, 381 struct wpa_scan_res *res, 382 struct os_reltime *fetch_time) 383{ 384 struct wpa_bss *bss; 385 386 bss = os_zalloc(sizeof(*bss) + res->ie_len + res->beacon_ie_len); 387 if (bss == NULL) 388 return NULL; 389 bss->id = wpa_s->bss_next_id++; 390 bss->last_update_idx = wpa_s->bss_update_idx; 391 wpa_bss_copy_res(bss, res, fetch_time); 392 os_memcpy(bss->ssid, ssid, ssid_len); 393 bss->ssid_len = ssid_len; 394 bss->ie_len = res->ie_len; 395 bss->beacon_ie_len = res->beacon_ie_len; 396 os_memcpy(bss + 1, res + 1, res->ie_len + res->beacon_ie_len); 397 wpa_bss_set_hessid(bss); 398 399 if (wpa_s->num_bss + 1 > wpa_s->conf->bss_max_count && 400 wpa_bss_remove_oldest(wpa_s) != 0) { 401 wpa_printf(MSG_ERROR, "Increasing the MAX BSS count to %d " 402 "because all BSSes are in use. We should normally " 403 "not get here!", (int) wpa_s->num_bss + 1); 404 wpa_s->conf->bss_max_count = wpa_s->num_bss + 1; 405 } 406 407 dl_list_add_tail(&wpa_s->bss, &bss->list); 408 dl_list_add_tail(&wpa_s->bss_id, &bss->list_id); 409 wpa_s->num_bss++; 410 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: Add new id %u BSSID " MACSTR 411 " SSID '%s' freq %d", 412 bss->id, MAC2STR(bss->bssid), wpa_ssid_txt(ssid, ssid_len), 413 bss->freq); 414 wpas_notify_bss_added(wpa_s, bss->bssid, bss->id); 415 return bss; 416} 417 418 419static int are_ies_equal(const struct wpa_bss *old, 420 const struct wpa_scan_res *new_res, u32 ie) 421{ 422 const u8 *old_ie, *new_ie; 423 struct wpabuf *old_ie_buff = NULL; 424 struct wpabuf *new_ie_buff = NULL; 425 int new_ie_len, old_ie_len, ret, is_multi; 426 427 switch (ie) { 428 case WPA_IE_VENDOR_TYPE: 429 old_ie = wpa_bss_get_vendor_ie(old, ie); 430 new_ie = wpa_scan_get_vendor_ie(new_res, ie); 431 is_multi = 0; 432 break; 433 case WPS_IE_VENDOR_TYPE: 434 old_ie_buff = wpa_bss_get_vendor_ie_multi(old, ie); 435 new_ie_buff = wpa_scan_get_vendor_ie_multi(new_res, ie); 436 is_multi = 1; 437 break; 438 case WLAN_EID_RSN: 439 case WLAN_EID_SUPP_RATES: 440 case WLAN_EID_EXT_SUPP_RATES: 441 old_ie = wpa_bss_get_ie(old, ie); 442 new_ie = wpa_scan_get_ie(new_res, ie); 443 is_multi = 0; 444 break; 445 default: 446 wpa_printf(MSG_DEBUG, "bss: %s: cannot compare IEs", __func__); 447 return 0; 448 } 449 450 if (is_multi) { 451 /* in case of multiple IEs stored in buffer */ 452 old_ie = old_ie_buff ? wpabuf_head_u8(old_ie_buff) : NULL; 453 new_ie = new_ie_buff ? wpabuf_head_u8(new_ie_buff) : NULL; 454 old_ie_len = old_ie_buff ? wpabuf_len(old_ie_buff) : 0; 455 new_ie_len = new_ie_buff ? wpabuf_len(new_ie_buff) : 0; 456 } else { 457 /* in case of single IE */ 458 old_ie_len = old_ie ? old_ie[1] + 2 : 0; 459 new_ie_len = new_ie ? new_ie[1] + 2 : 0; 460 } 461 462 if (!old_ie || !new_ie) 463 ret = !old_ie && !new_ie; 464 else 465 ret = (old_ie_len == new_ie_len && 466 os_memcmp(old_ie, new_ie, old_ie_len) == 0); 467 468 wpabuf_free(old_ie_buff); 469 wpabuf_free(new_ie_buff); 470 471 return ret; 472} 473 474 475static u32 wpa_bss_compare_res(const struct wpa_bss *old, 476 const struct wpa_scan_res *new_res) 477{ 478 u32 changes = 0; 479 int caps_diff = old->caps ^ new_res->caps; 480 481 if (old->freq != new_res->freq) 482 changes |= WPA_BSS_FREQ_CHANGED_FLAG; 483 484 if (old->level != new_res->level) 485 changes |= WPA_BSS_SIGNAL_CHANGED_FLAG; 486 487 if (caps_diff & IEEE80211_CAP_PRIVACY) 488 changes |= WPA_BSS_PRIVACY_CHANGED_FLAG; 489 490 if (caps_diff & IEEE80211_CAP_IBSS) 491 changes |= WPA_BSS_MODE_CHANGED_FLAG; 492 493 if (old->ie_len == new_res->ie_len && 494 os_memcmp(old + 1, new_res + 1, old->ie_len) == 0) 495 return changes; 496 changes |= WPA_BSS_IES_CHANGED_FLAG; 497 498 if (!are_ies_equal(old, new_res, WPA_IE_VENDOR_TYPE)) 499 changes |= WPA_BSS_WPAIE_CHANGED_FLAG; 500 501 if (!are_ies_equal(old, new_res, WLAN_EID_RSN)) 502 changes |= WPA_BSS_RSNIE_CHANGED_FLAG; 503 504 if (!are_ies_equal(old, new_res, WPS_IE_VENDOR_TYPE)) 505 changes |= WPA_BSS_WPS_CHANGED_FLAG; 506 507 if (!are_ies_equal(old, new_res, WLAN_EID_SUPP_RATES) || 508 !are_ies_equal(old, new_res, WLAN_EID_EXT_SUPP_RATES)) 509 changes |= WPA_BSS_RATES_CHANGED_FLAG; 510 511 return changes; 512} 513 514 515static void notify_bss_changes(struct wpa_supplicant *wpa_s, u32 changes, 516 const struct wpa_bss *bss) 517{ 518 if (changes & WPA_BSS_FREQ_CHANGED_FLAG) 519 wpas_notify_bss_freq_changed(wpa_s, bss->id); 520 521 if (changes & WPA_BSS_SIGNAL_CHANGED_FLAG) 522 wpas_notify_bss_signal_changed(wpa_s, bss->id); 523 524 if (changes & WPA_BSS_PRIVACY_CHANGED_FLAG) 525 wpas_notify_bss_privacy_changed(wpa_s, bss->id); 526 527 if (changes & WPA_BSS_MODE_CHANGED_FLAG) 528 wpas_notify_bss_mode_changed(wpa_s, bss->id); 529 530 if (changes & WPA_BSS_WPAIE_CHANGED_FLAG) 531 wpas_notify_bss_wpaie_changed(wpa_s, bss->id); 532 533 if (changes & WPA_BSS_RSNIE_CHANGED_FLAG) 534 wpas_notify_bss_rsnie_changed(wpa_s, bss->id); 535 536 if (changes & WPA_BSS_WPS_CHANGED_FLAG) 537 wpas_notify_bss_wps_changed(wpa_s, bss->id); 538 539 if (changes & WPA_BSS_IES_CHANGED_FLAG) 540 wpas_notify_bss_ies_changed(wpa_s, bss->id); 541 542 if (changes & WPA_BSS_RATES_CHANGED_FLAG) 543 wpas_notify_bss_rates_changed(wpa_s, bss->id); 544 545 wpas_notify_bss_seen(wpa_s, bss->id); 546} 547 548 549static struct wpa_bss * 550wpa_bss_update(struct wpa_supplicant *wpa_s, struct wpa_bss *bss, 551 struct wpa_scan_res *res, struct os_reltime *fetch_time) 552{ 553 u32 changes; 554 555 changes = wpa_bss_compare_res(bss, res); 556 if (changes & WPA_BSS_FREQ_CHANGED_FLAG) 557 wpa_printf(MSG_DEBUG, "BSS: " MACSTR " changed freq %d --> %d", 558 MAC2STR(bss->bssid), bss->freq, res->freq); 559 bss->scan_miss_count = 0; 560 bss->last_update_idx = wpa_s->bss_update_idx; 561 wpa_bss_copy_res(bss, res, fetch_time); 562 /* Move the entry to the end of the list */ 563 dl_list_del(&bss->list); 564#ifdef CONFIG_P2P 565 if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) && 566 !wpa_scan_get_vendor_ie(res, P2P_IE_VENDOR_TYPE)) { 567 /* 568 * This can happen when non-P2P station interface runs a scan 569 * without P2P IE in the Probe Request frame. P2P GO would reply 570 * to that with a Probe Response that does not include P2P IE. 571 * Do not update the IEs in this BSS entry to avoid such loss of 572 * information that may be needed for P2P operations to 573 * determine group information. 574 */ 575 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: Do not update scan IEs for " 576 MACSTR " since that would remove P2P IE information", 577 MAC2STR(bss->bssid)); 578 } else 579#endif /* CONFIG_P2P */ 580 if (bss->ie_len + bss->beacon_ie_len >= 581 res->ie_len + res->beacon_ie_len) { 582 os_memcpy(bss + 1, res + 1, res->ie_len + res->beacon_ie_len); 583 bss->ie_len = res->ie_len; 584 bss->beacon_ie_len = res->beacon_ie_len; 585 } else { 586 struct wpa_bss *nbss; 587 struct dl_list *prev = bss->list_id.prev; 588 dl_list_del(&bss->list_id); 589 nbss = os_realloc(bss, sizeof(*bss) + res->ie_len + 590 res->beacon_ie_len); 591 if (nbss) { 592 unsigned int i; 593 for (i = 0; i < wpa_s->last_scan_res_used; i++) { 594 if (wpa_s->last_scan_res[i] == bss) { 595 wpa_s->last_scan_res[i] = nbss; 596 break; 597 } 598 } 599 if (wpa_s->current_bss == bss) 600 wpa_s->current_bss = nbss; 601 wpa_bss_update_pending_connect(wpa_s, bss, nbss); 602 bss = nbss; 603 os_memcpy(bss + 1, res + 1, 604 res->ie_len + res->beacon_ie_len); 605 bss->ie_len = res->ie_len; 606 bss->beacon_ie_len = res->beacon_ie_len; 607 } 608 dl_list_add(prev, &bss->list_id); 609 } 610 if (changes & WPA_BSS_IES_CHANGED_FLAG) 611 wpa_bss_set_hessid(bss); 612 dl_list_add_tail(&wpa_s->bss, &bss->list); 613 614 notify_bss_changes(wpa_s, changes, bss); 615 616 return bss; 617} 618 619 620/** 621 * wpa_bss_update_start - Start a BSS table update from scan results 622 * @wpa_s: Pointer to wpa_supplicant data 623 * 624 * This function is called at the start of each BSS table update round for new 625 * scan results. The actual scan result entries are indicated with calls to 626 * wpa_bss_update_scan_res() and the update round is finished with a call to 627 * wpa_bss_update_end(). 628 */ 629void wpa_bss_update_start(struct wpa_supplicant *wpa_s) 630{ 631 wpa_s->bss_update_idx++; 632 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: Start scan result update %u", 633 wpa_s->bss_update_idx); 634 wpa_s->last_scan_res_used = 0; 635} 636 637 638/** 639 * wpa_bss_update_scan_res - Update a BSS table entry based on a scan result 640 * @wpa_s: Pointer to wpa_supplicant data 641 * @res: Scan result 642 * @fetch_time: Time when the result was fetched from the driver 643 * 644 * This function updates a BSS table entry (or adds one) based on a scan result. 645 * This is called separately for each scan result between the calls to 646 * wpa_bss_update_start() and wpa_bss_update_end(). 647 */ 648void wpa_bss_update_scan_res(struct wpa_supplicant *wpa_s, 649 struct wpa_scan_res *res, 650 struct os_reltime *fetch_time) 651{ 652 const u8 *ssid, *p2p, *mesh; 653 struct wpa_bss *bss; 654 655 if (wpa_s->conf->ignore_old_scan_res) { 656 struct os_reltime update; 657 calculate_update_time(fetch_time, res->age, &update); 658 if (os_reltime_before(&update, &wpa_s->scan_trigger_time)) { 659 struct os_reltime age; 660 os_reltime_sub(&wpa_s->scan_trigger_time, &update, 661 &age); 662 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: Ignore driver BSS " 663 "table entry that is %u.%06u seconds older " 664 "than our scan trigger", 665 (unsigned int) age.sec, 666 (unsigned int) age.usec); 667 return; 668 } 669 } 670 671 ssid = wpa_scan_get_ie(res, WLAN_EID_SSID); 672 if (ssid == NULL) { 673 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: No SSID IE included for " 674 MACSTR, MAC2STR(res->bssid)); 675 return; 676 } 677 if (ssid[1] > SSID_MAX_LEN) { 678 wpa_dbg(wpa_s, MSG_DEBUG, "BSS: Too long SSID IE included for " 679 MACSTR, MAC2STR(res->bssid)); 680 return; 681 } 682 683 p2p = wpa_scan_get_vendor_ie(res, P2P_IE_VENDOR_TYPE); 684#ifdef CONFIG_P2P 685 if (p2p == NULL && 686 wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE) { 687 /* 688 * If it's a P2P specific interface, then don't update 689 * the scan result without a P2P IE. 690 */ 691 wpa_printf(MSG_DEBUG, "BSS: No P2P IE - skipping BSS " MACSTR 692 " update for P2P interface", MAC2STR(res->bssid)); 693 return; 694 } 695#endif /* CONFIG_P2P */ 696 if (p2p && ssid[1] == P2P_WILDCARD_SSID_LEN && 697 os_memcmp(ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) == 0) 698 return; /* Skip P2P listen discovery results here */ 699 700 /* TODO: add option for ignoring BSSes we are not interested in 701 * (to save memory) */ 702 703 mesh = wpa_scan_get_ie(res, WLAN_EID_MESH_ID); 704 if (mesh && mesh[1] <= SSID_MAX_LEN) 705 ssid = mesh; 706 707 bss = wpa_bss_get(wpa_s, res->bssid, ssid + 2, ssid[1]); 708 if (bss == NULL) 709 bss = wpa_bss_add(wpa_s, ssid + 2, ssid[1], res, fetch_time); 710 else { 711 bss = wpa_bss_update(wpa_s, bss, res, fetch_time); 712 if (wpa_s->last_scan_res) { 713 unsigned int i; 714 for (i = 0; i < wpa_s->last_scan_res_used; i++) { 715 if (bss == wpa_s->last_scan_res[i]) { 716 /* Already in the list */ 717 return; 718 } 719 } 720 } 721 } 722 723 if (bss == NULL) 724 return; 725 if (wpa_s->last_scan_res_used >= wpa_s->last_scan_res_size) { 726 struct wpa_bss **n; 727 unsigned int siz; 728 if (wpa_s->last_scan_res_size == 0) 729 siz = 32; 730 else 731 siz = wpa_s->last_scan_res_size * 2; 732 n = os_realloc_array(wpa_s->last_scan_res, siz, 733 sizeof(struct wpa_bss *)); 734 if (n == NULL) 735 return; 736 wpa_s->last_scan_res = n; 737 wpa_s->last_scan_res_size = siz; 738 } 739 740 if (wpa_s->last_scan_res) 741 wpa_s->last_scan_res[wpa_s->last_scan_res_used++] = bss; 742} 743 744 745static int wpa_bss_included_in_scan(const struct wpa_bss *bss, 746 const struct scan_info *info) 747{ 748 int found; 749 size_t i; 750 751 if (info == NULL) 752 return 1; 753 754 if (info->num_freqs) { 755 found = 0; 756 for (i = 0; i < info->num_freqs; i++) { 757 if (bss->freq == info->freqs[i]) { 758 found = 1; 759 break; 760 } 761 } 762 if (!found) 763 return 0; 764 } 765 766 if (info->num_ssids) { 767 found = 0; 768 for (i = 0; i < info->num_ssids; i++) { 769 const struct wpa_driver_scan_ssid *s = &info->ssids[i]; 770 if ((s->ssid == NULL || s->ssid_len == 0) || 771 (s->ssid_len == bss->ssid_len && 772 os_memcmp(s->ssid, bss->ssid, bss->ssid_len) == 773 0)) { 774 found = 1; 775 break; 776 } 777 } 778 if (!found) 779 return 0; 780 } 781 782 return 1; 783} 784 785 786/** 787 * wpa_bss_update_end - End a BSS table update from scan results 788 * @wpa_s: Pointer to wpa_supplicant data 789 * @info: Information about scan parameters 790 * @new_scan: Whether this update round was based on a new scan 791 * 792 * This function is called at the end of each BSS table update round for new 793 * scan results. The start of the update was indicated with a call to 794 * wpa_bss_update_start(). 795 */ 796void wpa_bss_update_end(struct wpa_supplicant *wpa_s, struct scan_info *info, 797 int new_scan) 798{ 799 struct wpa_bss *bss, *n; 800 801 os_get_reltime(&wpa_s->last_scan); 802 if ((info && info->aborted) || !new_scan) 803 return; /* do not expire entries without new scan */ 804 805 dl_list_for_each_safe(bss, n, &wpa_s->bss, struct wpa_bss, list) { 806 if (wpa_bss_in_use(wpa_s, bss)) 807 continue; 808 if (!wpa_bss_included_in_scan(bss, info)) 809 continue; /* expire only BSSes that were scanned */ 810 if (bss->last_update_idx < wpa_s->bss_update_idx) 811 bss->scan_miss_count++; 812 if (bss->scan_miss_count >= 813 wpa_s->conf->bss_expiration_scan_count) { 814 wpa_bss_remove(wpa_s, bss, "no match in scan"); 815 } 816 } 817 818 wpa_printf(MSG_DEBUG, "BSS: last_scan_res_used=%u/%u", 819 wpa_s->last_scan_res_used, wpa_s->last_scan_res_size); 820} 821 822 823/** 824 * wpa_bss_flush_by_age - Flush old BSS entries 825 * @wpa_s: Pointer to wpa_supplicant data 826 * @age: Maximum entry age in seconds 827 * 828 * Remove BSS entries that have not been updated during the last @age seconds. 829 */ 830void wpa_bss_flush_by_age(struct wpa_supplicant *wpa_s, int age) 831{ 832 struct wpa_bss *bss, *n; 833 struct os_reltime t; 834 835 if (dl_list_empty(&wpa_s->bss)) 836 return; 837 838 os_get_reltime(&t); 839 t.sec -= age; 840 841 dl_list_for_each_safe(bss, n, &wpa_s->bss, struct wpa_bss, list) { 842 if (wpa_bss_in_use(wpa_s, bss)) 843 continue; 844 845 if (os_reltime_before(&bss->last_update, &t)) { 846 wpa_bss_remove(wpa_s, bss, __func__); 847 } else 848 break; 849 } 850} 851 852 853/** 854 * wpa_bss_init - Initialize BSS table 855 * @wpa_s: Pointer to wpa_supplicant data 856 * Returns: 0 on success, -1 on failure 857 * 858 * This prepares BSS table lists and timer for periodic updates. The BSS table 859 * is deinitialized with wpa_bss_deinit() once not needed anymore. 860 */ 861int wpa_bss_init(struct wpa_supplicant *wpa_s) 862{ 863 dl_list_init(&wpa_s->bss); 864 dl_list_init(&wpa_s->bss_id); 865 return 0; 866} 867 868 869/** 870 * wpa_bss_flush - Flush all unused BSS entries 871 * @wpa_s: Pointer to wpa_supplicant data 872 */ 873void wpa_bss_flush(struct wpa_supplicant *wpa_s) 874{ 875 struct wpa_bss *bss, *n; 876 877 wpa_s->clear_driver_scan_cache = 1; 878 879 if (wpa_s->bss.next == NULL) 880 return; /* BSS table not yet initialized */ 881 882 dl_list_for_each_safe(bss, n, &wpa_s->bss, struct wpa_bss, list) { 883 if (wpa_bss_in_use(wpa_s, bss)) 884 continue; 885 wpa_bss_remove(wpa_s, bss, __func__); 886 } 887} 888 889 890/** 891 * wpa_bss_deinit - Deinitialize BSS table 892 * @wpa_s: Pointer to wpa_supplicant data 893 */ 894void wpa_bss_deinit(struct wpa_supplicant *wpa_s) 895{ 896 wpa_bss_flush(wpa_s); 897} 898 899 900/** 901 * wpa_bss_get_bssid - Fetch a BSS table entry based on BSSID 902 * @wpa_s: Pointer to wpa_supplicant data 903 * @bssid: BSSID 904 * Returns: Pointer to the BSS entry or %NULL if not found 905 */ 906struct wpa_bss * wpa_bss_get_bssid(struct wpa_supplicant *wpa_s, 907 const u8 *bssid) 908{ 909 struct wpa_bss *bss; 910 if (!wpa_supplicant_filter_bssid_match(wpa_s, bssid)) 911 return NULL; 912 dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss, list) { 913 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0) 914 return bss; 915 } 916 return NULL; 917} 918 919 920/** 921 * wpa_bss_get_bssid_latest - Fetch the latest BSS table entry based on BSSID 922 * @wpa_s: Pointer to wpa_supplicant data 923 * @bssid: BSSID 924 * Returns: Pointer to the BSS entry or %NULL if not found 925 * 926 * This function is like wpa_bss_get_bssid(), but full BSS table is iterated to 927 * find the entry that has the most recent update. This can help in finding the 928 * correct entry in cases where the SSID of the AP may have changed recently 929 * (e.g., in WPS reconfiguration cases). 930 */ 931struct wpa_bss * wpa_bss_get_bssid_latest(struct wpa_supplicant *wpa_s, 932 const u8 *bssid) 933{ 934 struct wpa_bss *bss, *found = NULL; 935 if (!wpa_supplicant_filter_bssid_match(wpa_s, bssid)) 936 return NULL; 937 dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss, list) { 938 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) != 0) 939 continue; 940 if (found == NULL || 941 os_reltime_before(&found->last_update, &bss->last_update)) 942 found = bss; 943 } 944 return found; 945} 946 947 948#ifdef CONFIG_P2P 949/** 950 * wpa_bss_get_p2p_dev_addr - Fetch a BSS table entry based on P2P Device Addr 951 * @wpa_s: Pointer to wpa_supplicant data 952 * @dev_addr: P2P Device Address of the GO 953 * Returns: Pointer to the BSS entry or %NULL if not found 954 */ 955struct wpa_bss * wpa_bss_get_p2p_dev_addr(struct wpa_supplicant *wpa_s, 956 const u8 *dev_addr) 957{ 958 struct wpa_bss *bss; 959 dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss, list) { 960 u8 addr[ETH_ALEN]; 961 if (p2p_parse_dev_addr((const u8 *) (bss + 1), bss->ie_len, 962 addr) == 0 && 963 os_memcmp(addr, dev_addr, ETH_ALEN) == 0) 964 return bss; 965 } 966 return NULL; 967} 968#endif /* CONFIG_P2P */ 969 970 971/** 972 * wpa_bss_get_id - Fetch a BSS table entry based on identifier 973 * @wpa_s: Pointer to wpa_supplicant data 974 * @id: Unique identifier (struct wpa_bss::id) assigned for the entry 975 * Returns: Pointer to the BSS entry or %NULL if not found 976 */ 977struct wpa_bss * wpa_bss_get_id(struct wpa_supplicant *wpa_s, unsigned int id) 978{ 979 struct wpa_bss *bss; 980 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 981 if (bss->id == id) 982 return bss; 983 } 984 return NULL; 985} 986 987 988/** 989 * wpa_bss_get_id_range - Fetch a BSS table entry based on identifier range 990 * @wpa_s: Pointer to wpa_supplicant data 991 * @idf: Smallest allowed identifier assigned for the entry 992 * @idf: Largest allowed identifier assigned for the entry 993 * Returns: Pointer to the BSS entry or %NULL if not found 994 * 995 * This function is similar to wpa_bss_get_id() but allows a BSS entry with the 996 * smallest id value to be fetched within the specified range without the 997 * caller having to know the exact id. 998 */ 999struct wpa_bss * wpa_bss_get_id_range(struct wpa_supplicant *wpa_s, 1000 unsigned int idf, unsigned int idl) 1001{ 1002 struct wpa_bss *bss; 1003 dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) { 1004 if (bss->id >= idf && bss->id <= idl) 1005 return bss; 1006 } 1007 return NULL; 1008} 1009 1010 1011/** 1012 * wpa_bss_get_ie - Fetch a specified information element from a BSS entry 1013 * @bss: BSS table entry 1014 * @ie: Information element identitifier (WLAN_EID_*) 1015 * Returns: Pointer to the information element (id field) or %NULL if not found 1016 * 1017 * This function returns the first matching information element in the BSS 1018 * entry. 1019 */ 1020const u8 * wpa_bss_get_ie(const struct wpa_bss *bss, u8 ie) 1021{ 1022 return get_ie((const u8 *) (bss + 1), bss->ie_len, ie); 1023} 1024 1025 1026/** 1027 * wpa_bss_get_vendor_ie - Fetch a vendor information element from a BSS entry 1028 * @bss: BSS table entry 1029 * @vendor_type: Vendor type (four octets starting the IE payload) 1030 * Returns: Pointer to the information element (id field) or %NULL if not found 1031 * 1032 * This function returns the first matching information element in the BSS 1033 * entry. 1034 */ 1035const u8 * wpa_bss_get_vendor_ie(const struct wpa_bss *bss, u32 vendor_type) 1036{ 1037 const u8 *end, *pos; 1038 1039 pos = (const u8 *) (bss + 1); 1040 end = pos + bss->ie_len; 1041 1042 while (end - pos > 1) { 1043 if (2 + pos[1] > end - pos) 1044 break; 1045 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && 1046 vendor_type == WPA_GET_BE32(&pos[2])) 1047 return pos; 1048 pos += 2 + pos[1]; 1049 } 1050 1051 return NULL; 1052} 1053 1054 1055/** 1056 * wpa_bss_get_vendor_ie_beacon - Fetch a vendor information from a BSS entry 1057 * @bss: BSS table entry 1058 * @vendor_type: Vendor type (four octets starting the IE payload) 1059 * Returns: Pointer to the information element (id field) or %NULL if not found 1060 * 1061 * This function returns the first matching information element in the BSS 1062 * entry. 1063 * 1064 * This function is like wpa_bss_get_vendor_ie(), but uses IE buffer only 1065 * from Beacon frames instead of either Beacon or Probe Response frames. 1066 */ 1067const u8 * wpa_bss_get_vendor_ie_beacon(const struct wpa_bss *bss, 1068 u32 vendor_type) 1069{ 1070 const u8 *end, *pos; 1071 1072 if (bss->beacon_ie_len == 0) 1073 return NULL; 1074 1075 pos = (const u8 *) (bss + 1); 1076 pos += bss->ie_len; 1077 end = pos + bss->beacon_ie_len; 1078 1079 while (end - pos > 1) { 1080 if (2 + pos[1] > end - pos) 1081 break; 1082 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && 1083 vendor_type == WPA_GET_BE32(&pos[2])) 1084 return pos; 1085 pos += 2 + pos[1]; 1086 } 1087 1088 return NULL; 1089} 1090 1091 1092/** 1093 * wpa_bss_get_vendor_ie_multi - Fetch vendor IE data from a BSS entry 1094 * @bss: BSS table entry 1095 * @vendor_type: Vendor type (four octets starting the IE payload) 1096 * Returns: Pointer to the information element payload or %NULL if not found 1097 * 1098 * This function returns concatenated payload of possibly fragmented vendor 1099 * specific information elements in the BSS entry. The caller is responsible for 1100 * freeing the returned buffer. 1101 */ 1102struct wpabuf * wpa_bss_get_vendor_ie_multi(const struct wpa_bss *bss, 1103 u32 vendor_type) 1104{ 1105 struct wpabuf *buf; 1106 const u8 *end, *pos; 1107 1108 buf = wpabuf_alloc(bss->ie_len); 1109 if (buf == NULL) 1110 return NULL; 1111 1112 pos = (const u8 *) (bss + 1); 1113 end = pos + bss->ie_len; 1114 1115 while (end - pos > 1) { 1116 if (2 + pos[1] > end - pos) 1117 break; 1118 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && 1119 vendor_type == WPA_GET_BE32(&pos[2])) 1120 wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4); 1121 pos += 2 + pos[1]; 1122 } 1123 1124 if (wpabuf_len(buf) == 0) { 1125 wpabuf_free(buf); 1126 buf = NULL; 1127 } 1128 1129 return buf; 1130} 1131 1132 1133/** 1134 * wpa_bss_get_vendor_ie_multi_beacon - Fetch vendor IE data from a BSS entry 1135 * @bss: BSS table entry 1136 * @vendor_type: Vendor type (four octets starting the IE payload) 1137 * Returns: Pointer to the information element payload or %NULL if not found 1138 * 1139 * This function returns concatenated payload of possibly fragmented vendor 1140 * specific information elements in the BSS entry. The caller is responsible for 1141 * freeing the returned buffer. 1142 * 1143 * This function is like wpa_bss_get_vendor_ie_multi(), but uses IE buffer only 1144 * from Beacon frames instead of either Beacon or Probe Response frames. 1145 */ 1146struct wpabuf * wpa_bss_get_vendor_ie_multi_beacon(const struct wpa_bss *bss, 1147 u32 vendor_type) 1148{ 1149 struct wpabuf *buf; 1150 const u8 *end, *pos; 1151 1152 buf = wpabuf_alloc(bss->beacon_ie_len); 1153 if (buf == NULL) 1154 return NULL; 1155 1156 pos = (const u8 *) (bss + 1); 1157 pos += bss->ie_len; 1158 end = pos + bss->beacon_ie_len; 1159 1160 while (end - pos > 1) { 1161 if (2 + pos[1] > end - pos) 1162 break; 1163 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && 1164 vendor_type == WPA_GET_BE32(&pos[2])) 1165 wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4); 1166 pos += 2 + pos[1]; 1167 } 1168 1169 if (wpabuf_len(buf) == 0) { 1170 wpabuf_free(buf); 1171 buf = NULL; 1172 } 1173 1174 return buf; 1175} 1176 1177 1178/** 1179 * wpa_bss_get_max_rate - Get maximum legacy TX rate supported in a BSS 1180 * @bss: BSS table entry 1181 * Returns: Maximum legacy rate in units of 500 kbps 1182 */ 1183int wpa_bss_get_max_rate(const struct wpa_bss *bss) 1184{ 1185 int rate = 0; 1186 const u8 *ie; 1187 int i; 1188 1189 ie = wpa_bss_get_ie(bss, WLAN_EID_SUPP_RATES); 1190 for (i = 0; ie && i < ie[1]; i++) { 1191 if ((ie[i + 2] & 0x7f) > rate) 1192 rate = ie[i + 2] & 0x7f; 1193 } 1194 1195 ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES); 1196 for (i = 0; ie && i < ie[1]; i++) { 1197 if ((ie[i + 2] & 0x7f) > rate) 1198 rate = ie[i + 2] & 0x7f; 1199 } 1200 1201 return rate; 1202} 1203 1204 1205/** 1206 * wpa_bss_get_bit_rates - Get legacy TX rates supported in a BSS 1207 * @bss: BSS table entry 1208 * @rates: Buffer for returning a pointer to the rates list (units of 500 kbps) 1209 * Returns: number of legacy TX rates or -1 on failure 1210 * 1211 * The caller is responsible for freeing the returned buffer with os_free() in 1212 * case of success. 1213 */ 1214int wpa_bss_get_bit_rates(const struct wpa_bss *bss, u8 **rates) 1215{ 1216 const u8 *ie, *ie2; 1217 int i, j; 1218 unsigned int len; 1219 u8 *r; 1220 1221 ie = wpa_bss_get_ie(bss, WLAN_EID_SUPP_RATES); 1222 ie2 = wpa_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES); 1223 1224 len = (ie ? ie[1] : 0) + (ie2 ? ie2[1] : 0); 1225 1226 r = os_malloc(len); 1227 if (!r) 1228 return -1; 1229 1230 for (i = 0; ie && i < ie[1]; i++) 1231 r[i] = ie[i + 2] & 0x7f; 1232 1233 for (j = 0; ie2 && j < ie2[1]; j++) 1234 r[i + j] = ie2[j + 2] & 0x7f; 1235 1236 *rates = r; 1237 return len; 1238} 1239