contrib/wpa/wpa_supplicant/wnm_sta.c

   1 /*
   2  * wpa_supplicant - WNM
   3  * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "common/ieee802_11_defs.h"
  13 #include "common/ieee802_11_common.h"
  14 #include "common/wpa_ctrl.h"
  15 #include "rsn_supp/wpa.h"
  16 #include "wpa_supplicant_i.h"
  17 #include "driver_i.h"
  18 #include "scan.h"
  19 #include "ctrl_iface.h"
  20 #include "bss.h"
  21 #include "wnm_sta.h"
  22 #include "hs20_supplicant.h"
  23
  24 #define MAX_TFS_IE_LEN  1024
  25 #define WNM_MAX_NEIGHBOR_REPORT 10
  26
  27 #define WNM_SCAN_RESULT_AGE 2 /* 2 seconds */
  28
  29 /* get the TFS IE from driver */
  30 static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf,
  31                                    u16 *buf_len, enum wnm_oper oper)
  32 {
  33         wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper);
  34
  35         return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len);
  36 }
  37
  38
  39 /* set the TFS IE to driver */
  40 static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s,
  41                                    const u8 *addr, const u8 *buf, u16 buf_len,
  42                                    enum wnm_oper oper)
  43 {
  44         u16 len = buf_len;
  45
  46         wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper);
  47
  48         return wpa_drv_wnm_oper(wpa_s, oper, addr, (u8 *) buf, &len);
  49 }
  50
  51
  52 /* MLME-SLEEPMODE.request */
  53 int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s,
  54                                  u8 action, u16 intval, struct wpabuf *tfs_req)
  55 {
  56         struct ieee80211_mgmt *mgmt;
  57         int res;
  58         size_t len;
  59         struct wnm_sleep_element *wnmsleep_ie;
  60         u8 *wnmtfs_ie;
  61         u8 wnmsleep_ie_len;
  62         u16 wnmtfs_ie_len;  /* possibly multiple IE(s) */
  63         enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD :
  64                 WNM_SLEEP_TFS_REQ_IE_NONE;
  65
  66         wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request "
  67                    "action=%s to " MACSTR,
  68                    action == 0 ? "enter" : "exit",
  69                    MAC2STR(wpa_s->bssid));
  70
  71         /* WNM-Sleep Mode IE */
  72         wnmsleep_ie_len = sizeof(struct wnm_sleep_element);
  73         wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element));
  74         if (wnmsleep_ie == NULL)
  75                 return -1;
  76         wnmsleep_ie->eid = WLAN_EID_WNMSLEEP;
  77         wnmsleep_ie->len = wnmsleep_ie_len - 2;
  78         wnmsleep_ie->action_type = action;
  79         wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT;
  80         wnmsleep_ie->intval = host_to_le16(intval);
  81         wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element",
  82                     (u8 *) wnmsleep_ie, wnmsleep_ie_len);
  83
  84         /* TFS IE(s) */
  85         if (tfs_req) {
  86                 wnmtfs_ie_len = wpabuf_len(tfs_req);
  87                 wnmtfs_ie = os_malloc(wnmtfs_ie_len);
  88                 if (wnmtfs_ie == NULL) {
  89                         os_free(wnmsleep_ie);
  90                         return -1;
  91                 }
  92                 os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len);
  93         } else {
  94                 wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN);
  95                 if (wnmtfs_ie == NULL) {
  96                         os_free(wnmsleep_ie);
  97                         return -1;
  98                 }
  99                 if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len,
 100                                             tfs_oper)) {
 101                         wnmtfs_ie_len = 0;
 102                         os_free(wnmtfs_ie);
 103                         wnmtfs_ie = NULL;
 104                 }
 105         }
 106         wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element",
 107                     (u8 *) wnmtfs_ie, wnmtfs_ie_len);
 108
 109         mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len);
 110         if (mgmt == NULL) {
 111                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
 112                            "WNM-Sleep Request action frame");
 113                 os_free(wnmsleep_ie);
 114                 os_free(wnmtfs_ie);
 115                 return -1;
 116         }
 117
 118         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 119         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 120         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 121         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 122                                            WLAN_FC_STYPE_ACTION);
 123         mgmt->u.action.category = WLAN_ACTION_WNM;
 124         mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ;
 125         mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1;
 126         os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie,
 127                   wnmsleep_ie_len);
 128         /* copy TFS IE here */
 129         if (wnmtfs_ie_len > 0) {
 130                 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable +
 131                           wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len);
 132         }
 133
 134         len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len +
 135                 wnmtfs_ie_len;
 136
 137         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 138                                   wpa_s->own_addr, wpa_s->bssid,
 139                                   &mgmt->u.action.category, len, 0);
 140         if (res < 0)
 141                 wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request "
 142                            "(action=%d, intval=%d)", action, intval);
 143         else
 144                 wpa_s->wnmsleep_used = 1;
 145
 146         os_free(wnmsleep_ie);
 147         os_free(wnmtfs_ie);
 148         os_free(mgmt);
 149
 150         return res;
 151 }
 152
 153
 154 static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s,
 155                                          const u8 *tfsresp_ie_start,
 156                                          const u8 *tfsresp_ie_end)
 157 {
 158         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM,
 159                          wpa_s->bssid, NULL, NULL);
 160         /* remove GTK/IGTK ?? */
 161
 162         /* set the TFS Resp IE(s) */
 163         if (tfsresp_ie_start && tfsresp_ie_end &&
 164             tfsresp_ie_end - tfsresp_ie_start >= 0) {
 165                 u16 tfsresp_ie_len;
 166                 tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) -
 167                         tfsresp_ie_start;
 168                 wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found");
 169                 /* pass the TFS Resp IE(s) to driver for processing */
 170                 if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid,
 171                                             tfsresp_ie_start,
 172                                             tfsresp_ie_len,
 173                                             WNM_SLEEP_TFS_RESP_IE_SET))
 174                         wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE");
 175         }
 176 }
 177
 178
 179 static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
 180                                         const u8 *frm, u16 key_len_total)
 181 {
 182         u8 *ptr, *end;
 183         u8 gtk_len;
 184
 185         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM,  wpa_s->bssid,
 186                          NULL, NULL);
 187
 188         /* Install GTK/IGTK */
 189
 190         /* point to key data field */
 191         ptr = (u8 *) frm + 1 + 2;
 192         end = ptr + key_len_total;
 193         wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
 194
 195         if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) {
 196                 wpa_msg(wpa_s, MSG_INFO,
 197                         "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled");
 198                 return;
 199         }
 200
 201         while (end - ptr > 1) {
 202                 if (2 + ptr[1] > end - ptr) {
 203                         wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
 204                                    "length");
 205                         if (end > ptr) {
 206                                 wpa_hexdump(MSG_DEBUG, "WNM: Remaining data",
 207                                             ptr, end - ptr);
 208                         }
 209                         break;
 210                 }
 211                 if (*ptr == WNM_SLEEP_SUBELEM_GTK) {
 212                         if (ptr[1] < 11 + 5) {
 213                                 wpa_printf(MSG_DEBUG, "WNM: Too short GTK "
 214                                            "subelem");
 215                                 break;
 216                         }
 217                         gtk_len = *(ptr + 4);
 218                         if (ptr[1] < 11 + gtk_len ||
 219                             gtk_len < 5 || gtk_len > 32) {
 220                                 wpa_printf(MSG_DEBUG, "WNM: Invalid GTK "
 221                                            "subelem");
 222                                 break;
 223                         }
 224                         wpa_wnmsleep_install_key(
 225                                 wpa_s->wpa,
 226                                 WNM_SLEEP_SUBELEM_GTK,
 227                                 ptr);
 228                         ptr += 13 + gtk_len;
 229 #ifdef CONFIG_IEEE80211W
 230                 } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) {
 231                         if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) {
 232                                 wpa_printf(MSG_DEBUG, "WNM: Too short IGTK "
 233                                            "subelem");
 234                                 break;
 235                         }
 236                         wpa_wnmsleep_install_key(wpa_s->wpa,
 237                                                  WNM_SLEEP_SUBELEM_IGTK, ptr);
 238                         ptr += 10 + WPA_IGTK_LEN;
 239 #endif /* CONFIG_IEEE80211W */
 240                 } else
 241                         break; /* skip the loop */
 242         }
 243 }
 244
 245
 246 static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
 247                                         const u8 *frm, int len)
 248 {
 249         /*
 250          * Action [1] | Dialog Token [1] | Key Data Len [2] | Key Data |
 251          * WNM-Sleep Mode IE | TFS Response IE
 252          */
 253         const u8 *pos = frm; /* point to payload after the action field */
 254         u16 key_len_total;
 255         struct wnm_sleep_element *wnmsleep_ie = NULL;
 256         /* multiple TFS Resp IE (assuming consecutive) */
 257         const u8 *tfsresp_ie_start = NULL;
 258         const u8 *tfsresp_ie_end = NULL;
 259         size_t left;
 260
 261         if (!wpa_s->wnmsleep_used) {
 262                 wpa_printf(MSG_DEBUG,
 263                            "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
 264                 return;
 265         }
 266
 267         if (len < 3)
 268                 return;
 269         key_len_total = WPA_GET_LE16(frm + 1);
 270
 271         wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d",
 272                    frm[0], key_len_total);
 273         left = len - 3;
 274         if (key_len_total > left) {
 275                 wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
 276                 return;
 277         }
 278         pos += 3 + key_len_total;
 279         while (pos - frm + 1 < len) {
 280                 u8 ie_len = *(pos + 1);
 281                 if (2 + ie_len > frm + len - pos) {
 282                         wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len);
 283                         break;
 284                 }
 285                 wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len);
 286                 if (*pos == WLAN_EID_WNMSLEEP && ie_len >= 4)
 287                         wnmsleep_ie = (struct wnm_sleep_element *) pos;
 288                 else if (*pos == WLAN_EID_TFS_RESP) {
 289                         if (!tfsresp_ie_start)
 290                                 tfsresp_ie_start = pos;
 291                         tfsresp_ie_end = pos;
 292                 } else
 293                         wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
 294                 pos += ie_len + 2;
 295         }
 296
 297         if (!wnmsleep_ie) {
 298                 wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
 299                 return;
 300         }
 301
 302         wpa_s->wnmsleep_used = 0;
 303
 304         if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
 305             wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
 306                 wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
 307                            "frame (action=%d, intval=%d)",
 308                            wnmsleep_ie->action_type, wnmsleep_ie->intval);
 309                 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
 310                         wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
 311                                                      tfsresp_ie_end);
 312                 } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
 313                         wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
 314                 }
 315         } else {
 316                 wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "
 317                            "(action=%d, intval=%d)",
 318                            wnmsleep_ie->action_type, wnmsleep_ie->intval);
 319                 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER)
 320                         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL,
 321                                          wpa_s->bssid, NULL, NULL);
 322                 else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT)
 323                         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL,
 324                                          wpa_s->bssid, NULL, NULL);
 325         }
 326 }
 327
 328
 329 void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
 330 {
 331         int i;
 332
 333         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
 334                 os_free(wpa_s->wnm_neighbor_report_elements[i].meas_pilot);
 335                 os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
 336         }
 337
 338         wpa_s->wnm_num_neighbor_report = 0;
 339         os_free(wpa_s->wnm_neighbor_report_elements);
 340         wpa_s->wnm_neighbor_report_elements = NULL;
 341 }
 342
 343
 344 static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
 345                                            u8 id, u8 elen, const u8 *pos)
 346 {
 347         switch (id) {
 348         case WNM_NEIGHBOR_TSF:
 349                 if (elen < 2 + 2) {
 350                         wpa_printf(MSG_DEBUG, "WNM: Too short TSF");
 351                         break;
 352                 }
 353                 rep->tsf_offset = WPA_GET_LE16(pos);
 354                 rep->beacon_int = WPA_GET_LE16(pos + 2);
 355                 rep->tsf_present = 1;
 356                 break;
 357         case WNM_NEIGHBOR_CONDENSED_COUNTRY_STRING:
 358                 if (elen < 2) {
 359                         wpa_printf(MSG_DEBUG, "WNM: Too short condensed "
 360                                    "country string");
 361                         break;
 362                 }
 363                 os_memcpy(rep->country, pos, 2);
 364                 rep->country_present = 1;
 365                 break;
 366         case WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE:
 367                 if (elen < 1) {
 368                         wpa_printf(MSG_DEBUG, "WNM: Too short BSS transition "
 369                                    "candidate");
 370                         break;
 371                 }
 372                 rep->preference = pos[0];
 373                 rep->preference_present = 1;
 374                 break;
 375         case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
 376                 rep->bss_term_tsf = WPA_GET_LE64(pos);
 377                 rep->bss_term_dur = WPA_GET_LE16(pos + 8);
 378                 rep->bss_term_present = 1;
 379                 break;
 380         case WNM_NEIGHBOR_BEARING:
 381                 if (elen < 8) {
 382                         wpa_printf(MSG_DEBUG, "WNM: Too short neighbor "
 383                                    "bearing");
 384                         break;
 385                 }
 386                 rep->bearing = WPA_GET_LE16(pos);
 387                 rep->distance = WPA_GET_LE32(pos + 2);
 388                 rep->rel_height = WPA_GET_LE16(pos + 2 + 4);
 389                 rep->bearing_present = 1;
 390                 break;
 391         case WNM_NEIGHBOR_MEASUREMENT_PILOT:
 392                 if (elen < 1) {
 393                         wpa_printf(MSG_DEBUG, "WNM: Too short measurement "
 394                                    "pilot");
 395                         break;
 396                 }
 397                 os_free(rep->meas_pilot);
 398                 rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot));
 399                 if (rep->meas_pilot == NULL)
 400                         break;
 401                 rep->meas_pilot->measurement_pilot = pos[0];
 402                 rep->meas_pilot->subelem_len = elen - 1;
 403                 os_memcpy(rep->meas_pilot->subelems, pos + 1, elen - 1);
 404                 break;
 405         case WNM_NEIGHBOR_RRM_ENABLED_CAPABILITIES:
 406                 if (elen < 5) {
 407                         wpa_printf(MSG_DEBUG, "WNM: Too short RRM enabled "
 408                                    "capabilities");
 409                         break;
 410                 }
 411                 os_memcpy(rep->rm_capab, pos, 5);
 412                 rep->rm_capab_present = 1;
 413                 break;
 414         case WNM_NEIGHBOR_MULTIPLE_BSSID:
 415                 if (elen < 1) {
 416                         wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID");
 417                         break;
 418                 }
 419                 os_free(rep->mul_bssid);
 420                 rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid));
 421                 if (rep->mul_bssid == NULL)
 422                         break;
 423                 rep->mul_bssid->max_bssid_indicator = pos[0];
 424                 rep->mul_bssid->subelem_len = elen - 1;
 425                 os_memcpy(rep->mul_bssid->subelems, pos + 1, elen - 1);
 426                 break;
 427         }
 428 }
 429
 430
 431 static int wnm_nei_get_chan(struct wpa_supplicant *wpa_s, u8 op_class, u8 chan)
 432 {
 433         struct wpa_bss *bss = wpa_s->current_bss;
 434         const char *country = NULL;
 435         int freq;
 436
 437         if (bss) {
 438                 const u8 *elem = wpa_bss_get_ie(bss, WLAN_EID_COUNTRY);
 439
 440                 if (elem && elem[1] >= 2)
 441                         country = (const char *) (elem + 2);
 442         }
 443
 444         freq = ieee80211_chan_to_freq(country, op_class, chan);
 445         if (freq <= 0 && op_class == 0) {
 446                 /*
 447                  * Some APs do not advertise correct operating class
 448                  * information. Try to determine the most likely operating
 449                  * frequency based on the channel number.
 450                  */
 451                 if (chan >= 1 && chan <= 13)
 452                         freq = 2407 + chan * 5;
 453                 else if (chan == 14)
 454                         freq = 2484;
 455                 else if (chan >= 36 && chan <= 169)
 456                         freq = 5000 + chan * 5;
 457         }
 458         return freq;
 459 }
 460
 461
 462 static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s,
 463                                       const u8 *pos, u8 len,
 464                                       struct neighbor_report *rep)
 465 {
 466         u8 left = len;
 467
 468         if (left < 13) {
 469                 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor report");
 470                 return;
 471         }
 472
 473         os_memcpy(rep->bssid, pos, ETH_ALEN);
 474         rep->bssid_info = WPA_GET_LE32(pos + ETH_ALEN);
 475         rep->regulatory_class = *(pos + 10);
 476         rep->channel_number = *(pos + 11);
 477         rep->phy_type = *(pos + 12);
 478
 479         pos += 13;
 480         left -= 13;
 481
 482         while (left >= 2) {
 483                 u8 id, elen;
 484
 485                 id = *pos++;
 486                 elen = *pos++;
 487                 wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen);
 488                 left -= 2;
 489                 if (elen > left) {
 490                         wpa_printf(MSG_DEBUG,
 491                                    "WNM: Truncated neighbor report subelement");
 492                         break;
 493                 }
 494                 wnm_parse_neighbor_report_elem(rep, id, elen, pos);
 495                 left -= elen;
 496                 pos += elen;
 497         }
 498
 499         rep->freq = wnm_nei_get_chan(wpa_s, rep->regulatory_class,
 500                                      rep->channel_number);
 501 }
 502
 503
 504 static struct wpa_bss *
 505 compare_scan_neighbor_results(struct wpa_supplicant *wpa_s, os_time_t age_secs)
 506 {
 507
 508         u8 i;
 509         struct wpa_bss *bss = wpa_s->current_bss;
 510         struct wpa_bss *target;
 511
 512         if (!bss)
 513                 return NULL;
 514
 515         wpa_printf(MSG_DEBUG, "WNM: Current BSS " MACSTR " RSSI %d",
 516                    MAC2STR(wpa_s->bssid), bss->level);
 517
 518         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
 519                 struct neighbor_report *nei;
 520
 521                 nei = &wpa_s->wnm_neighbor_report_elements[i];
 522                 if (nei->preference_present && nei->preference == 0) {
 523                         wpa_printf(MSG_DEBUG, "Skip excluded BSS " MACSTR,
 524                                    MAC2STR(nei->bssid));
 525                         continue;
 526                 }
 527
 528                 target = wpa_bss_get_bssid(wpa_s, nei->bssid);
 529                 if (!target) {
 530                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 531                                    " (pref %d) not found in scan results",
 532                                    MAC2STR(nei->bssid),
 533                                    nei->preference_present ? nei->preference :
 534                                    -1);
 535                         continue;
 536                 }
 537
 538                 if (age_secs) {
 539                         struct os_reltime now;
 540
 541                         if (os_get_reltime(&now) == 0 &&
 542                             os_reltime_expired(&now, &target->last_update,
 543                                                age_secs)) {
 544                                 wpa_printf(MSG_DEBUG,
 545                                            "Candidate BSS is more than %ld seconds old",
 546                                            age_secs);
 547                                 continue;
 548                         }
 549                 }
 550
 551                 if (bss->ssid_len != target->ssid_len ||
 552                     os_memcmp(bss->ssid, target->ssid, bss->ssid_len) != 0) {
 553                         /*
 554                          * TODO: Could consider allowing transition to another
 555                          * ESS if PMF was enabled for the association.
 556                          */
 557                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 558                                    " (pref %d) in different ESS",
 559                                    MAC2STR(nei->bssid),
 560                                    nei->preference_present ? nei->preference :
 561                                    -1);
 562                         continue;
 563                 }
 564
 565                 if (wpa_s->current_ssid &&
 566                     !wpa_scan_res_match(wpa_s, 0, target, wpa_s->current_ssid,
 567                                         1)) {
 568                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 569                                    " (pref %d) does not match the current network profile",
 570                                    MAC2STR(nei->bssid),
 571                                    nei->preference_present ? nei->preference :
 572                                    -1);
 573                         continue;
 574                 }
 575
 576                 if (wpa_is_bss_tmp_disallowed(wpa_s, target->bssid)) {
 577                         wpa_printf(MSG_DEBUG,
 578                                    "MBO: Candidate BSS " MACSTR
 579                                    " retry delay is not over yet",
 580                                    MAC2STR(nei->bssid));
 581                         continue;
 582                 }
 583
 584                 if (target->level < bss->level && target->level < -80) {
 585                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 586                                    " (pref %d) does not have sufficient signal level (%d)",
 587                                    MAC2STR(nei->bssid),
 588                                    nei->preference_present ? nei->preference :
 589                                    -1,
 590                                    target->level);
 591                         continue;
 592                 }
 593
 594                 wpa_printf(MSG_DEBUG,
 595                            "WNM: Found an acceptable preferred transition candidate BSS "
 596                            MACSTR " (RSSI %d)",
 597                            MAC2STR(nei->bssid), target->level);
 598                 return target;
 599         }
 600
 601         return NULL;
 602 }
 603
 604
 605 static int wpa_bss_ies_eq(struct wpa_bss *a, struct wpa_bss *b, u8 eid)
 606 {
 607         const u8 *ie_a, *ie_b;
 608
 609         if (!a || !b)
 610                 return 0;
 611
 612         ie_a = wpa_bss_get_ie(a, eid);
 613         ie_b = wpa_bss_get_ie(b, eid);
 614
 615         if (!ie_a || !ie_b || ie_a[1] != ie_b[1])
 616                 return 0;
 617
 618         return os_memcmp(ie_a, ie_b, ie_a[1]) == 0;
 619 }
 620
 621
 622 static u32 wnm_get_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 623 {
 624         u32 info = 0;
 625
 626         info |= NEI_REP_BSSID_INFO_AP_UNKNOWN_REACH;
 627
 628         /*
 629          * Leave the security and key scope bits unset to indicate that the
 630          * security information is not available.
 631          */
 632
 633         if (bss->caps & WLAN_CAPABILITY_SPECTRUM_MGMT)
 634                 info |= NEI_REP_BSSID_INFO_SPECTRUM_MGMT;
 635         if (bss->caps & WLAN_CAPABILITY_QOS)
 636                 info |= NEI_REP_BSSID_INFO_QOS;
 637         if (bss->caps & WLAN_CAPABILITY_APSD)
 638                 info |= NEI_REP_BSSID_INFO_APSD;
 639         if (bss->caps & WLAN_CAPABILITY_RADIO_MEASUREMENT)
 640                 info |= NEI_REP_BSSID_INFO_RM;
 641         if (bss->caps & WLAN_CAPABILITY_DELAYED_BLOCK_ACK)
 642                 info |= NEI_REP_BSSID_INFO_DELAYED_BA;
 643         if (bss->caps & WLAN_CAPABILITY_IMM_BLOCK_ACK)
 644                 info |= NEI_REP_BSSID_INFO_IMM_BA;
 645         if (wpa_bss_ies_eq(bss, wpa_s->current_bss, WLAN_EID_MOBILITY_DOMAIN))
 646                 info |= NEI_REP_BSSID_INFO_MOBILITY_DOMAIN;
 647         if (wpa_bss_ies_eq(bss, wpa_s->current_bss, WLAN_EID_HT_CAP))
 648                 info |= NEI_REP_BSSID_INFO_HT;
 649
 650         return info;
 651 }
 652
 653
 654 static int wnm_add_nei_rep(u8 *buf, size_t len, const u8 *bssid, u32 bss_info,
 655                            u8 op_class, u8 chan, u8 phy_type, u8 pref)
 656 {
 657         u8 *pos = buf;
 658
 659         if (len < 18) {
 660                 wpa_printf(MSG_DEBUG,
 661                            "WNM: Not enough room for Neighbor Report element");
 662                 return -1;
 663         }
 664
 665         *pos++ = WLAN_EID_NEIGHBOR_REPORT;
 666         /* length: 13 for basic neighbor report + 3 for preference subelement */
 667         *pos++ = 16;
 668         os_memcpy(pos, bssid, ETH_ALEN);
 669         pos += ETH_ALEN;
 670         WPA_PUT_LE32(pos, bss_info);
 671         pos += 4;
 672         *pos++ = op_class;
 673         *pos++ = chan;
 674         *pos++ = phy_type;
 675         *pos++ = WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE;
 676         *pos++ = 1;
 677         *pos++ = pref;
 678         return pos - buf;
 679 }
 680
 681
 682 static int wnm_nei_rep_add_bss(struct wpa_supplicant *wpa_s,
 683                                struct wpa_bss *bss, u8 *buf, size_t len,
 684                                u8 pref)
 685 {
 686         const u8 *ie;
 687         u8 op_class, chan;
 688         int sec_chan = 0, vht = 0;
 689         enum phy_type phy_type;
 690         u32 info;
 691         struct ieee80211_ht_operation *ht_oper = NULL;
 692         struct ieee80211_vht_operation *vht_oper = NULL;
 693
 694         ie = wpa_bss_get_ie(bss, WLAN_EID_HT_OPERATION);
 695         if (ie && ie[1] >= 2) {
 696                 ht_oper = (struct ieee80211_ht_operation *) (ie + 2);
 697
 698                 if (ht_oper->ht_param & HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
 699                         sec_chan = 1;
 700                 else if (ht_oper->ht_param &
 701                          HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
 702                         sec_chan = -1;
 703         }
 704
 705         ie = wpa_bss_get_ie(bss, WLAN_EID_VHT_OPERATION);
 706         if (ie && ie[1] >= 1) {
 707                 vht_oper = (struct ieee80211_vht_operation *) (ie + 2);
 708
 709                 if (vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_80MHZ ||
 710                     vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_160MHZ ||
 711                     vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_80P80MHZ)
 712                         vht = vht_oper->vht_op_info_chwidth;
 713         }
 714
 715         if (ieee80211_freq_to_channel_ext(bss->freq, sec_chan, vht, &op_class,
 716                                           &chan) == NUM_HOSTAPD_MODES) {
 717                 wpa_printf(MSG_DEBUG,
 718                            "WNM: Cannot determine operating class and channel");
 719                 return -2;
 720         }
 721
 722         phy_type = ieee80211_get_phy_type(bss->freq, (ht_oper != NULL),
 723                                           (vht_oper != NULL));
 724         if (phy_type == PHY_TYPE_UNSPECIFIED) {
 725                 wpa_printf(MSG_DEBUG,
 726                            "WNM: Cannot determine BSS phy type for Neighbor Report");
 727                 return -2;
 728         }
 729
 730         info = wnm_get_bss_info(wpa_s, bss);
 731
 732         return wnm_add_nei_rep(buf, len, bss->bssid, info, op_class, chan,
 733                                phy_type, pref);
 734 }
 735
 736
 737 static int wnm_add_cand_list(struct wpa_supplicant *wpa_s, u8 *buf, size_t len)
 738 {
 739         u8 *pos = buf;
 740         unsigned int i, pref = 255;
 741         struct os_reltime now;
 742         struct wpa_ssid *ssid = wpa_s->current_ssid;
 743
 744         if (!ssid)
 745                 return 0;
 746
 747         /*
 748          * TODO: Define when scan results are no longer valid for the candidate
 749          * list.
 750          */
 751         os_get_reltime(&now);
 752         if (os_reltime_expired(&now, &wpa_s->last_scan, 10))
 753                 return 0;
 754
 755         wpa_printf(MSG_DEBUG,
 756                    "WNM: Add candidate list to BSS Transition Management Response frame");
 757         for (i = 0; i < wpa_s->last_scan_res_used && pref; i++) {
 758                 struct wpa_bss *bss = wpa_s->last_scan_res[i];
 759                 int res;
 760
 761                 if (wpa_scan_res_match(wpa_s, i, bss, ssid, 1)) {
 762                         res = wnm_nei_rep_add_bss(wpa_s, bss, pos, len, pref--);
 763                         if (res == -2)
 764                                 continue; /* could not build entry for BSS */
 765                         if (res < 0)
 766                                 break; /* no more room for candidates */
 767                         if (pref == 1)
 768                                 break;
 769
 770                         pos += res;
 771                         len -= res;
 772                 }
 773         }
 774
 775         wpa_hexdump(MSG_DEBUG,
 776                     "WNM: BSS Transition Management Response candidate list",
 777                     buf, pos - buf);
 778
 779         return pos - buf;
 780 }
 781
 782
 783 static void wnm_send_bss_transition_mgmt_resp(
 784         struct wpa_supplicant *wpa_s, u8 dialog_token,
 785         enum bss_trans_mgmt_status_code status, u8 delay,
 786         const u8 *target_bssid)
 787 {
 788         u8 buf[2000], *pos;
 789         struct ieee80211_mgmt *mgmt;
 790         size_t len;
 791         int res;
 792
 793         wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Response "
 794                    "to " MACSTR " dialog_token=%u status=%u delay=%d",
 795                    MAC2STR(wpa_s->bssid), dialog_token, status, delay);
 796         if (!wpa_s->current_bss) {
 797                 wpa_printf(MSG_DEBUG,
 798                            "WNM: Current BSS not known - drop response");
 799                 return;
 800         }
 801
 802         mgmt = (struct ieee80211_mgmt *) buf;
 803         os_memset(&buf, 0, sizeof(buf));
 804         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 805         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 806         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 807         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 808                                            WLAN_FC_STYPE_ACTION);
 809         mgmt->u.action.category = WLAN_ACTION_WNM;
 810         mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP;
 811         mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token;
 812         mgmt->u.action.u.bss_tm_resp.status_code = status;
 813         mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay;
 814         pos = mgmt->u.action.u.bss_tm_resp.variable;
 815         if (target_bssid) {
 816                 os_memcpy(pos, target_bssid, ETH_ALEN);
 817                 pos += ETH_ALEN;
 818         } else if (status == WNM_BSS_TM_ACCEPT) {
 819                 /*
 820                  * P802.11-REVmc clarifies that the Target BSSID field is always
 821                  * present when status code is zero, so use a fake value here if
 822                  * no BSSID is yet known.
 823                  */
 824                 os_memset(pos, 0, ETH_ALEN);
 825                 pos += ETH_ALEN;
 826         }
 827
 828         if (status == WNM_BSS_TM_ACCEPT)
 829                 pos += wnm_add_cand_list(wpa_s, pos, buf + sizeof(buf) - pos);
 830
 831 #ifdef CONFIG_MBO
 832         if (status != WNM_BSS_TM_ACCEPT) {
 833                 pos += wpas_mbo_ie_bss_trans_reject(
 834                         wpa_s, pos, buf + sizeof(buf) - pos,
 835                         MBO_TRANSITION_REJECT_REASON_UNSPECIFIED);
 836         }
 837 #endif /* CONFIG_MBO */
 838
 839         len = pos - (u8 *) &mgmt->u.action.category;
 840
 841         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 842                                   wpa_s->own_addr, wpa_s->bssid,
 843                                   &mgmt->u.action.category, len, 0);
 844         if (res < 0) {
 845                 wpa_printf(MSG_DEBUG,
 846                            "WNM: Failed to send BSS Transition Management Response");
 847         }
 848 }
 849
 850
 851 static void wnm_bss_tm_connect(struct wpa_supplicant *wpa_s,
 852                                struct wpa_bss *bss, struct wpa_ssid *ssid,
 853                                int after_new_scan)
 854 {
 855         wpa_dbg(wpa_s, MSG_DEBUG,
 856                 "WNM: Transition to BSS " MACSTR
 857                 " based on BSS Transition Management Request (old BSSID "
 858                 MACSTR " after_new_scan=%d)",
 859                 MAC2STR(bss->bssid), MAC2STR(wpa_s->bssid), after_new_scan);
 860
 861         /* Send the BSS Management Response - Accept */
 862         if (wpa_s->wnm_reply) {
 863                 wpa_s->wnm_reply = 0;
 864                 wpa_printf(MSG_DEBUG,
 865                            "WNM: Sending successful BSS Transition Management Response");
 866                 wnm_send_bss_transition_mgmt_resp(wpa_s,
 867                                                   wpa_s->wnm_dialog_token,
 868                                                   WNM_BSS_TM_ACCEPT,
 869                                                   0, bss->bssid);
 870         }
 871
 872         if (bss == wpa_s->current_bss) {
 873                 wpa_printf(MSG_DEBUG,
 874                            "WNM: Already associated with the preferred candidate");
 875                 wnm_deallocate_memory(wpa_s);
 876                 return;
 877         }
 878
 879         wpa_s->reassociate = 1;
 880         wpa_printf(MSG_DEBUG, "WNM: Issuing connect");
 881         wpa_supplicant_connect(wpa_s, bss, ssid);
 882         wnm_deallocate_memory(wpa_s);
 883 }
 884
 885
 886 int wnm_scan_process(struct wpa_supplicant *wpa_s, int reply_on_fail)
 887 {
 888         struct wpa_bss *bss;
 889         struct wpa_ssid *ssid = wpa_s->current_ssid;
 890         enum bss_trans_mgmt_status_code status = WNM_BSS_TM_REJECT_UNSPECIFIED;
 891
 892         if (!wpa_s->wnm_neighbor_report_elements)
 893                 return 0;
 894
 895         wpa_dbg(wpa_s, MSG_DEBUG,
 896                 "WNM: Process scan results for BSS Transition Management");
 897         if (os_reltime_before(&wpa_s->wnm_cand_valid_until,
 898                               &wpa_s->scan_trigger_time)) {
 899                 wpa_printf(MSG_DEBUG, "WNM: Previously stored BSS transition candidate list is not valid anymore - drop it");
 900                 wnm_deallocate_memory(wpa_s);
 901                 return 0;
 902         }
 903
 904         if (!wpa_s->current_bss ||
 905             os_memcmp(wpa_s->wnm_cand_from_bss, wpa_s->current_bss->bssid,
 906                       ETH_ALEN) != 0) {
 907                 wpa_printf(MSG_DEBUG, "WNM: Stored BSS transition candidate list not from the current BSS - ignore it");
 908                 return 0;
 909         }
 910
 911         /* Compare the Neighbor Report and scan results */
 912         bss = compare_scan_neighbor_results(wpa_s, 0);
 913         if (!bss) {
 914                 wpa_printf(MSG_DEBUG, "WNM: No BSS transition candidate match found");
 915                 status = WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES;
 916                 goto send_bss_resp_fail;
 917         }
 918
 919         /* Associate to the network */
 920         wnm_bss_tm_connect(wpa_s, bss, ssid, 1);
 921         return 1;
 922
 923 send_bss_resp_fail:
 924         if (!reply_on_fail)
 925                 return 0;
 926
 927         /* Send reject response for all the failures */
 928
 929         if (wpa_s->wnm_reply) {
 930                 wpa_s->wnm_reply = 0;
 931                 wnm_send_bss_transition_mgmt_resp(wpa_s,
 932                                                   wpa_s->wnm_dialog_token,
 933                                                   status, 0, NULL);
 934         }
 935         wnm_deallocate_memory(wpa_s);
 936
 937         return 0;
 938 }
 939
 940
 941 static int cand_pref_compar(const void *a, const void *b)
 942 {
 943         const struct neighbor_report *aa = a;
 944         const struct neighbor_report *bb = b;
 945
 946         if (!aa->preference_present && !bb->preference_present)
 947                 return 0;
 948         if (!aa->preference_present)
 949                 return 1;
 950         if (!bb->preference_present)
 951                 return -1;
 952         if (bb->preference > aa->preference)
 953                 return 1;
 954         if (bb->preference < aa->preference)
 955                 return -1;
 956         return 0;
 957 }
 958
 959
 960 static void wnm_sort_cand_list(struct wpa_supplicant *wpa_s)
 961 {
 962         if (!wpa_s->wnm_neighbor_report_elements)
 963                 return;
 964         qsort(wpa_s->wnm_neighbor_report_elements,
 965               wpa_s->wnm_num_neighbor_report, sizeof(struct neighbor_report),
 966               cand_pref_compar);
 967 }
 968
 969
 970 static void wnm_dump_cand_list(struct wpa_supplicant *wpa_s)
 971 {
 972         unsigned int i;
 973
 974         wpa_printf(MSG_DEBUG, "WNM: BSS Transition Candidate List");
 975         if (!wpa_s->wnm_neighbor_report_elements)
 976                 return;
 977         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
 978                 struct neighbor_report *nei;
 979
 980                 nei = &wpa_s->wnm_neighbor_report_elements[i];
 981                 wpa_printf(MSG_DEBUG, "%u: " MACSTR
 982                            " info=0x%x op_class=%u chan=%u phy=%u pref=%d freq=%d",
 983                            i, MAC2STR(nei->bssid), nei->bssid_info,
 984                            nei->regulatory_class,
 985                            nei->channel_number, nei->phy_type,
 986                            nei->preference_present ? nei->preference : -1,
 987                            nei->freq);
 988         }
 989 }
 990
 991
 992 static int chan_supported(struct wpa_supplicant *wpa_s, int freq)
 993 {
 994         unsigned int i;
 995
 996         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 997                 struct hostapd_hw_modes *mode = &wpa_s->hw.modes[i];
 998                 int j;
 999
1000                 for (j = 0; j < mode->num_channels; j++) {
1001                         struct hostapd_channel_data *chan;
1002
1003                         chan = &mode->channels[j];
1004                         if (chan->freq == freq &&
1005                             !(chan->flag & HOSTAPD_CHAN_DISABLED))
1006                                 return 1;
1007                 }
1008         }
1009
1010         return 0;
1011 }
1012
1013
1014 static void wnm_set_scan_freqs(struct wpa_supplicant *wpa_s)
1015 {
1016         int *freqs;
1017         int num_freqs = 0;
1018         unsigned int i;
1019
1020         if (!wpa_s->wnm_neighbor_report_elements)
1021                 return;
1022
1023         if (wpa_s->hw.modes == NULL)
1024                 return;
1025
1026         os_free(wpa_s->next_scan_freqs);
1027         wpa_s->next_scan_freqs = NULL;
1028
1029         freqs = os_calloc(wpa_s->wnm_num_neighbor_report + 1, sizeof(int));
1030         if (freqs == NULL)
1031                 return;
1032
1033         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
1034                 struct neighbor_report *nei;
1035
1036                 nei = &wpa_s->wnm_neighbor_report_elements[i];
1037                 if (nei->freq <= 0) {
1038                         wpa_printf(MSG_DEBUG,
1039                                    "WNM: Unknown neighbor operating frequency for "
1040                                    MACSTR " - scan all channels",
1041                                    MAC2STR(nei->bssid));
1042                         os_free(freqs);
1043                         return;
1044                 }
1045                 if (chan_supported(wpa_s, nei->freq))
1046                         add_freq(freqs, &num_freqs, nei->freq);
1047         }
1048
1049         if (num_freqs == 0) {
1050                 os_free(freqs);
1051                 return;
1052         }
1053
1054         wpa_printf(MSG_DEBUG,
1055                    "WNM: Scan %d frequencies based on transition candidate list",
1056                    num_freqs);
1057         wpa_s->next_scan_freqs = freqs;
1058 }
1059
1060
1061 static int wnm_fetch_scan_results(struct wpa_supplicant *wpa_s)
1062 {
1063         struct wpa_scan_results *scan_res;
1064         struct wpa_bss *bss;
1065         struct wpa_ssid *ssid = wpa_s->current_ssid;
1066         u8 i, found = 0;
1067         size_t j;
1068
1069         wpa_dbg(wpa_s, MSG_DEBUG,
1070                 "WNM: Fetch current scan results from the driver for checking transition candidates");
1071         scan_res = wpa_drv_get_scan_results2(wpa_s);
1072         if (!scan_res) {
1073                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Failed to get scan results");
1074                 return 0;
1075         }
1076
1077         if (scan_res->fetch_time.sec == 0)
1078                 os_get_reltime(&scan_res->fetch_time);
1079
1080         filter_scan_res(wpa_s, scan_res);
1081
1082         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
1083                 struct neighbor_report *nei;
1084
1085                 nei = &wpa_s->wnm_neighbor_report_elements[i];
1086                 if (nei->preference_present && nei->preference == 0)
1087                         continue;
1088
1089                 for (j = 0; j < scan_res->num; j++) {
1090                         struct wpa_scan_res *res;
1091                         const u8 *ssid_ie;
1092
1093                         res = scan_res->res[j];
1094                         if (os_memcmp(nei->bssid, res->bssid, ETH_ALEN) != 0 ||
1095                             res->age > WNM_SCAN_RESULT_AGE * 1000)
1096                                 continue;
1097                         bss = wpa_s->current_bss;
1098                         ssid_ie = wpa_scan_get_ie(res, WLAN_EID_SSID);
1099                         if (bss && ssid_ie &&
1100                             (bss->ssid_len != ssid_ie[1] ||
1101                              os_memcmp(bss->ssid, ssid_ie + 2,
1102                                        bss->ssid_len) != 0))
1103                                 continue;
1104
1105                         /* Potential candidate found */
1106                         found = 1;
1107                         scan_snr(res);
1108                         scan_est_throughput(wpa_s, res);
1109                         wpa_bss_update_scan_res(wpa_s, res,
1110                                                 &scan_res->fetch_time);
1111                 }
1112         }
1113
1114         wpa_scan_results_free(scan_res);
1115         if (!found) {
1116                 wpa_dbg(wpa_s, MSG_DEBUG,
1117                         "WNM: No transition candidate matches existing scan results");
1118                 return 0;
1119         }
1120
1121         bss = compare_scan_neighbor_results(wpa_s, WNM_SCAN_RESULT_AGE);
1122         if (!bss) {
1123                 wpa_dbg(wpa_s, MSG_DEBUG,
1124                         "WNM: Comparison of scan results against transition candidates did not find matches");
1125                 return 0;
1126         }
1127
1128         /* Associate to the network */
1129         wnm_bss_tm_connect(wpa_s, bss, ssid, 0);
1130         return 1;
1131 }
1132
1133
1134 static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
1135                                              const u8 *pos, const u8 *end,
1136                                              int reply)
1137 {
1138         unsigned int beacon_int;
1139         u8 valid_int;
1140 #ifdef CONFIG_MBO
1141         const u8 *vendor;
1142 #endif /* CONFIG_MBO */
1143
1144         if (end - pos < 5)
1145                 return;
1146
1147         if (wpa_s->current_bss)
1148                 beacon_int = wpa_s->current_bss->beacon_int;
1149         else
1150                 beacon_int = 100; /* best guess */
1151
1152         wpa_s->wnm_dialog_token = pos[0];
1153         wpa_s->wnm_mode = pos[1];
1154         wpa_s->wnm_dissoc_timer = WPA_GET_LE16(pos + 2);
1155         valid_int = pos[4];
1156         wpa_s->wnm_reply = reply;
1157
1158         wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: "
1159                    "dialog_token=%u request_mode=0x%x "
1160                    "disassoc_timer=%u validity_interval=%u",
1161                    wpa_s->wnm_dialog_token, wpa_s->wnm_mode,
1162                    wpa_s->wnm_dissoc_timer, valid_int);
1163
1164 #if defined(CONFIG_MBO) && defined(CONFIG_TESTING_OPTIONS)
1165         if (wpa_s->reject_btm_req_reason) {
1166                 wpa_printf(MSG_INFO,
1167                            "WNM: Testing - reject BSS Transition Management Request: reject_btm_req_reason=%d",
1168                            wpa_s->reject_btm_req_reason);
1169                 wnm_send_bss_transition_mgmt_resp(wpa_s,
1170                                                   wpa_s->wnm_dialog_token,
1171                                                   wpa_s->reject_btm_req_reason,
1172                                                   0, NULL);
1173                 return;
1174         }
1175 #endif /* CONFIG_MBO && CONFIG_TESTING_OPTIONS */
1176
1177         pos += 5;
1178
1179         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
1180                 if (end - pos < 12) {
1181                         wpa_printf(MSG_DEBUG, "WNM: Too short BSS TM Request");
1182                         return;
1183                 }
1184                 os_memcpy(wpa_s->wnm_bss_termination_duration, pos, 12);
1185                 pos += 12; /* BSS Termination Duration */
1186         }
1187
1188         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) {
1189                 char url[256];
1190
1191                 if (end - pos < 1 || 1 + pos[0] > end - pos) {
1192                         wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition "
1193                                    "Management Request (URL)");
1194                         return;
1195                 }
1196                 os_memcpy(url, pos + 1, pos[0]);
1197                 url[pos[0]] = '\0';
1198                 pos += 1 + pos[0];
1199
1200                 wpa_msg(wpa_s, MSG_INFO, ESS_DISASSOC_IMMINENT "%d %u %s",
1201                         wpa_sm_pmf_enabled(wpa_s->wpa),
1202                         wpa_s->wnm_dissoc_timer * beacon_int * 128 / 125, url);
1203         }
1204
1205         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
1206                 wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - "
1207                         "Disassociation Timer %u", wpa_s->wnm_dissoc_timer);
1208                 if (wpa_s->wnm_dissoc_timer && !wpa_s->scanning) {
1209                         /* TODO: mark current BSS less preferred for
1210                          * selection */
1211                         wpa_printf(MSG_DEBUG, "Trying to find another BSS");
1212                         wpa_supplicant_req_scan(wpa_s, 0, 0);
1213                 }
1214         }
1215
1216 #ifdef CONFIG_MBO
1217         vendor = get_ie(pos, end - pos, WLAN_EID_VENDOR_SPECIFIC);
1218         if (vendor)
1219                 wpas_mbo_ie_trans_req(wpa_s, vendor + 2, vendor[1]);
1220 #endif /* CONFIG_MBO */
1221
1222         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED) {
1223                 unsigned int valid_ms;
1224
1225                 wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
1226                 wnm_deallocate_memory(wpa_s);
1227                 wpa_s->wnm_neighbor_report_elements = os_calloc(
1228                         WNM_MAX_NEIGHBOR_REPORT,
1229                         sizeof(struct neighbor_report));
1230                 if (wpa_s->wnm_neighbor_report_elements == NULL)
1231                         return;
1232
1233                 while (end - pos >= 2 &&
1234                        wpa_s->wnm_num_neighbor_report < WNM_MAX_NEIGHBOR_REPORT)
1235                 {
1236                         u8 tag = *pos++;
1237                         u8 len = *pos++;
1238
1239                         wpa_printf(MSG_DEBUG, "WNM: Neighbor report tag %u",
1240                                    tag);
1241                         if (len > end - pos) {
1242                                 wpa_printf(MSG_DEBUG, "WNM: Truncated request");
1243                                 return;
1244                         }
1245                         if (tag == WLAN_EID_NEIGHBOR_REPORT) {
1246                                 struct neighbor_report *rep;
1247                                 rep = &wpa_s->wnm_neighbor_report_elements[
1248                                         wpa_s->wnm_num_neighbor_report];
1249                                 wnm_parse_neighbor_report(wpa_s, pos, len, rep);
1250                                 wpa_s->wnm_num_neighbor_report++;
1251                         }
1252
1253                         pos += len;
1254                 }
1255
1256                 if (!wpa_s->wnm_num_neighbor_report) {
1257                         wpa_printf(MSG_DEBUG,
1258                                    "WNM: Candidate list included bit is set, but no candidates found");
1259                         wnm_send_bss_transition_mgmt_resp(
1260                                 wpa_s, wpa_s->wnm_dialog_token,
1261                                 WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES,
1262                                 0, NULL);
1263                         return;
1264                 }
1265
1266                 wnm_sort_cand_list(wpa_s);
1267                 wnm_dump_cand_list(wpa_s);
1268                 valid_ms = valid_int * beacon_int * 128 / 125;
1269                 wpa_printf(MSG_DEBUG, "WNM: Candidate list valid for %u ms",
1270                            valid_ms);
1271                 os_get_reltime(&wpa_s->wnm_cand_valid_until);
1272                 wpa_s->wnm_cand_valid_until.sec += valid_ms / 1000;
1273                 wpa_s->wnm_cand_valid_until.usec += (valid_ms % 1000) * 1000;
1274                 wpa_s->wnm_cand_valid_until.sec +=
1275                         wpa_s->wnm_cand_valid_until.usec / 1000000;
1276                 wpa_s->wnm_cand_valid_until.usec %= 1000000;
1277                 os_memcpy(wpa_s->wnm_cand_from_bss, wpa_s->bssid, ETH_ALEN);
1278
1279                 /*
1280                  * Fetch the latest scan results from the kernel and check for
1281                  * candidates based on those results first. This can help in
1282                  * finding more up-to-date information should the driver has
1283                  * done some internal scanning operations after the last scan
1284                  * result update in wpa_supplicant.
1285                  */
1286                 if (wnm_fetch_scan_results(wpa_s) > 0)
1287                         return;
1288
1289                 /*
1290                  * Try to use previously received scan results, if they are
1291                  * recent enough to use for a connection.
1292                  */
1293                 if (wpa_s->last_scan_res_used > 0) {
1294                         struct os_reltime now;
1295
1296                         os_get_reltime(&now);
1297                         if (!os_reltime_expired(&now, &wpa_s->last_scan, 10)) {
1298                                 wpa_printf(MSG_DEBUG,
1299                                            "WNM: Try to use recent scan results");
1300                                 if (wnm_scan_process(wpa_s, 0) > 0)
1301                                         return;
1302                                 wpa_printf(MSG_DEBUG,
1303                                            "WNM: No match in previous scan results - try a new scan");
1304                         }
1305                 }
1306
1307                 wnm_set_scan_freqs(wpa_s);
1308                 if (wpa_s->wnm_num_neighbor_report == 1) {
1309                         os_memcpy(wpa_s->next_scan_bssid,
1310                                   wpa_s->wnm_neighbor_report_elements[0].bssid,
1311                                   ETH_ALEN);
1312                         wpa_printf(MSG_DEBUG,
1313                                    "WNM: Scan only for a specific BSSID since there is only a single candidate "
1314                                    MACSTR, MAC2STR(wpa_s->next_scan_bssid));
1315                 }
1316                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1317         } else if (reply) {
1318                 enum bss_trans_mgmt_status_code status;
1319                 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT)
1320                         status = WNM_BSS_TM_ACCEPT;
1321                 else {
1322                         wpa_msg(wpa_s, MSG_INFO, "WNM: BSS Transition Management Request did not include candidates");
1323                         status = WNM_BSS_TM_REJECT_UNSPECIFIED;
1324                 }
1325                 wnm_send_bss_transition_mgmt_resp(wpa_s,
1326                                                   wpa_s->wnm_dialog_token,
1327                                                   status, 0, NULL);
1328         }
1329 }
1330
1331
1332 int wnm_send_bss_transition_mgmt_query(struct wpa_supplicant *wpa_s,
1333                                        u8 query_reason, int cand_list)
1334 {
1335         u8 buf[2000], *pos;
1336         struct ieee80211_mgmt *mgmt;
1337         size_t len;
1338         int ret;
1339
1340         wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Query to "
1341                    MACSTR " query_reason=%u%s",
1342                    MAC2STR(wpa_s->bssid), query_reason,
1343                    cand_list ? " candidate list" : "");
1344
1345         mgmt = (struct ieee80211_mgmt *) buf;
1346         os_memset(&buf, 0, sizeof(buf));
1347         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
1348         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1349         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1350         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1351                                            WLAN_FC_STYPE_ACTION);
1352         mgmt->u.action.category = WLAN_ACTION_WNM;
1353         mgmt->u.action.u.bss_tm_query.action = WNM_BSS_TRANS_MGMT_QUERY;
1354         mgmt->u.action.u.bss_tm_query.dialog_token = 1;
1355         mgmt->u.action.u.bss_tm_query.query_reason = query_reason;
1356         pos = mgmt->u.action.u.bss_tm_query.variable;
1357
1358         if (cand_list)
1359                 pos += wnm_add_cand_list(wpa_s, pos, buf + sizeof(buf) - pos);
1360
1361         len = pos - (u8 *) &mgmt->u.action.category;
1362
1363         ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
1364                                   wpa_s->own_addr, wpa_s->bssid,
1365                                   &mgmt->u.action.category, len, 0);
1366
1367         return ret;
1368 }
1369
1370
1371 static void ieee802_11_rx_wnm_notif_req_wfa(struct wpa_supplicant *wpa_s,
1372                                             const u8 *sa, const u8 *data,
1373                                             int len)
1374 {
1375         const u8 *pos, *end, *next;
1376         u8 ie, ie_len;
1377
1378         pos = data;
1379         end = data + len;
1380
1381         while (end - pos > 1) {
1382                 ie = *pos++;
1383                 ie_len = *pos++;
1384                 wpa_printf(MSG_DEBUG, "WNM: WFA subelement %u len %u",
1385                            ie, ie_len);
1386                 if (ie_len > end - pos) {
1387                         wpa_printf(MSG_DEBUG, "WNM: Not enough room for "
1388                                    "subelement");
1389                         break;
1390                 }
1391                 next = pos + ie_len;
1392                 if (ie_len < 4) {
1393                         pos = next;
1394                         continue;
1395                 }
1396                 wpa_printf(MSG_DEBUG, "WNM: Subelement OUI %06x type %u",
1397                            WPA_GET_BE24(pos), pos[3]);
1398
1399 #ifdef CONFIG_HS20
1400                 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 5 &&
1401                     WPA_GET_BE24(pos) == OUI_WFA &&
1402                     pos[3] == HS20_WNM_SUB_REM_NEEDED) {
1403                         /* Subscription Remediation subelement */
1404                         const u8 *ie_end;
1405                         u8 url_len;
1406                         char *url;
1407                         u8 osu_method;
1408
1409                         wpa_printf(MSG_DEBUG, "WNM: Subscription Remediation "
1410                                    "subelement");
1411                         ie_end = pos + ie_len;
1412                         pos += 4;
1413                         url_len = *pos++;
1414                         if (url_len == 0) {
1415                                 wpa_printf(MSG_DEBUG, "WNM: No Server URL included");
1416                                 url = NULL;
1417                                 osu_method = 1;
1418                         } else {
1419                                 if (url_len + 1 > ie_end - pos) {
1420                                         wpa_printf(MSG_DEBUG, "WNM: Not enough room for Server URL (len=%u) and Server Method (left %d)",
1421                                                    url_len,
1422                                                    (int) (ie_end - pos));
1423                                         break;
1424                                 }
1425                                 url = os_malloc(url_len + 1);
1426                                 if (url == NULL)
1427                                         break;
1428                                 os_memcpy(url, pos, url_len);
1429                                 url[url_len] = '\0';
1430                                 osu_method = pos[url_len];
1431                         }
1432                         hs20_rx_subscription_remediation(wpa_s, url,
1433                                                          osu_method);
1434                         os_free(url);
1435                         pos = next;
1436                         continue;
1437                 }
1438
1439                 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 8 &&
1440                     WPA_GET_BE24(pos) == OUI_WFA &&
1441                     pos[3] == HS20_WNM_DEAUTH_IMMINENT_NOTICE) {
1442                         const u8 *ie_end;
1443                         u8 url_len;
1444                         char *url;
1445                         u8 code;
1446                         u16 reauth_delay;
1447
1448                         ie_end = pos + ie_len;
1449                         pos += 4;
1450                         code = *pos++;
1451                         reauth_delay = WPA_GET_LE16(pos);
1452                         pos += 2;
1453                         url_len = *pos++;
1454                         wpa_printf(MSG_DEBUG, "WNM: HS 2.0 Deauthentication "
1455                                    "Imminent - Reason Code %u   "
1456                                    "Re-Auth Delay %u  URL Length %u",
1457                                    code, reauth_delay, url_len);
1458                         if (url_len > ie_end - pos)
1459                                 break;
1460                         url = os_malloc(url_len + 1);
1461                         if (url == NULL)
1462                                 break;
1463                         os_memcpy(url, pos, url_len);
1464                         url[url_len] = '\0';
1465                         hs20_rx_deauth_imminent_notice(wpa_s, code,
1466                                                        reauth_delay, url);
1467                         os_free(url);
1468                         pos = next;
1469                         continue;
1470                 }
1471 #endif /* CONFIG_HS20 */
1472
1473                 pos = next;
1474         }
1475 }
1476
1477
1478 static void ieee802_11_rx_wnm_notif_req(struct wpa_supplicant *wpa_s,
1479                                         const u8 *sa, const u8 *frm, int len)
1480 {
1481         const u8 *pos, *end;
1482         u8 dialog_token, type;
1483
1484         /* Dialog Token [1] | Type [1] | Subelements */
1485
1486         if (len < 2 || sa == NULL)
1487                 return;
1488         end = frm + len;
1489         pos = frm;
1490         dialog_token = *pos++;
1491         type = *pos++;
1492
1493         wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Received WNM-Notification Request "
1494                 "(dialog_token %u type %u sa " MACSTR ")",
1495                 dialog_token, type, MAC2STR(sa));
1496         wpa_hexdump(MSG_DEBUG, "WNM-Notification Request subelements",
1497                     pos, end - pos);
1498
1499         if (wpa_s->wpa_state != WPA_COMPLETED ||
1500             os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) {
1501                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: WNM-Notification frame not "
1502                         "from our AP - ignore it");
1503                 return;
1504         }
1505
1506         switch (type) {
1507         case 1:
1508                 ieee802_11_rx_wnm_notif_req_wfa(wpa_s, sa, pos, end - pos);
1509                 break;
1510         default:
1511                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Ignore unknown "
1512                         "WNM-Notification type %u", type);
1513                 break;
1514         }
1515 }
1516
1517
1518 void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
1519                               const struct ieee80211_mgmt *mgmt, size_t len)
1520 {
1521         const u8 *pos, *end;
1522         u8 act;
1523
1524         if (len < IEEE80211_HDRLEN + 2)
1525                 return;
1526
1527         pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
1528         act = *pos++;
1529         end = ((const u8 *) mgmt) + len;
1530
1531         wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR,
1532                    act, MAC2STR(mgmt->sa));
1533         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
1534             os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1535                 wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action "
1536                            "frame");
1537                 return;
1538         }
1539
1540         switch (act) {
1541         case WNM_BSS_TRANS_MGMT_REQ:
1542                 ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end,
1543                                                  !(mgmt->da[0] & 0x01));
1544                 break;
1545         case WNM_SLEEP_MODE_RESP:
1546                 ieee802_11_rx_wnmsleep_resp(wpa_s, pos, end - pos);
1547                 break;
1548         case WNM_NOTIFICATION_REQ:
1549                 ieee802_11_rx_wnm_notif_req(wpa_s, mgmt->sa, pos, end - pos);
1550                 break;
1551         default:
1552                 wpa_printf(MSG_ERROR, "WNM: Unknown request");
1553                 break;
1554         }
1555 }