wpa_supplicant/interworking.c

   1 /*
   2  * Interworking (IEEE 802.11u)
   3  * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
   4  * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
   5  *
   6  * This software may be distributed under the terms of the BSD license.
   7  * See README for more details.
   8  */
   9
  10 #include "includes.h"
  11
  12 #include "common.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "common/gas.h"
  15 #include "common/wpa_ctrl.h"
  16 #include "utils/pcsc_funcs.h"
  17 #include "utils/eloop.h"
  18 #include "drivers/driver.h"
  19 #include "eap_common/eap_defs.h"
  20 #include "eap_peer/eap.h"
  21 #include "eap_peer/eap_methods.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "rsn_supp/wpa.h"
  24 #include "wpa_supplicant_i.h"
  25 #include "config.h"
  26 #include "config_ssid.h"
  27 #include "bss.h"
  28 #include "scan.h"
  29 #include "notify.h"
  30 #include "driver_i.h"
  31 #include "gas_query.h"
  32 #include "hs20_supplicant.h"
  33 #include "interworking.h"
  34
  35
  36 #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  37 #define INTERWORKING_3GPP
  38 #else
  39 #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  40 #define INTERWORKING_3GPP
  41 #else
  42 #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  43 #define INTERWORKING_3GPP
  44 #endif
  45 #endif
  46 #endif
  47
  48 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  49 static struct wpa_cred * interworking_credentials_available_realm(
  50         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  51         int *excluded);
  52 static struct wpa_cred * interworking_credentials_available_3gpp(
  53         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  54         int *excluded);
  55
  56
  57 static int cred_prio_cmp(const struct wpa_cred *a, const struct wpa_cred *b)
  58 {
  59         if (a->priority > b->priority)
  60                 return 1;
  61         if (a->priority < b->priority)
  62                 return -1;
  63         if (a->provisioning_sp == NULL || b->provisioning_sp == NULL ||
  64             os_strcmp(a->provisioning_sp, b->provisioning_sp) != 0)
  65                 return 0;
  66         if (a->sp_priority < b->sp_priority)
  67                 return 1;
  68         if (a->sp_priority > b->sp_priority)
  69                 return -1;
  70         return 0;
  71 }
  72
  73
  74 static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  75 {
  76         unsigned int tried;
  77
  78         if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  79                 wpa_supplicant_cancel_sched_scan(wpa_s);
  80                 wpa_s->own_disconnect_req = 1;
  81                 wpa_supplicant_deauthenticate(wpa_s,
  82                                               WLAN_REASON_DEAUTH_LEAVING);
  83         }
  84         wpa_s->disconnected = 0;
  85         wpa_s->reassociate = 1;
  86         tried = wpa_s->interworking_fast_assoc_tried;
  87         wpa_s->interworking_fast_assoc_tried = 1;
  88
  89         if (!tried && wpa_supplicant_fast_associate(wpa_s) >= 0)
  90                 return;
  91
  92         wpa_s->interworking_fast_assoc_tried = 0;
  93         wpa_supplicant_req_scan(wpa_s, 0, 0);
  94 }
  95
  96
  97 static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  98                                       struct wpabuf *extra)
  99 {
 100         struct wpabuf *buf;
 101         size_t i;
 102         u8 *len_pos;
 103
 104         buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
 105                                          (extra ? wpabuf_len(extra) : 0));
 106         if (buf == NULL)
 107                 return NULL;
 108
 109         if (num_ids > 0) {
 110                 len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
 111                 for (i = 0; i < num_ids; i++)
 112                         wpabuf_put_le16(buf, info_ids[i]);
 113                 gas_anqp_set_element_len(buf, len_pos);
 114         }
 115         if (extra)
 116                 wpabuf_put_buf(buf, extra);
 117
 118         gas_anqp_set_len(buf);
 119
 120         return buf;
 121 }
 122
 123
 124 static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
 125                                       u8 dialog_token,
 126                                       enum gas_query_result result,
 127                                       const struct wpabuf *adv_proto,
 128                                       const struct wpabuf *resp,
 129                                       u16 status_code)
 130 {
 131         struct wpa_supplicant *wpa_s = ctx;
 132
 133         wpa_printf(MSG_DEBUG, "ANQP: Response callback dst=" MACSTR
 134                    " dialog_token=%u result=%d status_code=%u",
 135                    MAC2STR(dst), dialog_token, result, status_code);
 136         anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
 137                      status_code);
 138         interworking_next_anqp_fetch(wpa_s);
 139 }
 140
 141
 142 static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
 143 {
 144         struct wpa_cred *cred;
 145
 146         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 147                 if (cred->roaming_consortium_len)
 148                         return 1;
 149                 if (cred->required_roaming_consortium_len)
 150                         return 1;
 151                 if (cred->num_roaming_consortiums)
 152                         return 1;
 153         }
 154         return 0;
 155 }
 156
 157
 158 static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
 159 {
 160         struct wpa_cred *cred;
 161
 162         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 163                 if (cred->pcsc || cred->imsi)
 164                         return 1;
 165         }
 166         return 0;
 167 }
 168
 169
 170 static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
 171 {
 172         struct wpa_cred *cred;
 173
 174         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 175                 if (cred->pcsc || cred->imsi)
 176                         continue;
 177                 if (!cred->eap_method)
 178                         return 1;
 179                 if (cred->realm && cred->roaming_consortium_len == 0)
 180                         return 1;
 181         }
 182         return 0;
 183 }
 184
 185
 186 static int cred_with_domain(struct wpa_supplicant *wpa_s)
 187 {
 188         struct wpa_cred *cred;
 189
 190         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 191                 if (cred->domain || cred->pcsc || cred->imsi ||
 192                     cred->roaming_partner)
 193                         return 1;
 194         }
 195         return 0;
 196 }
 197
 198
 199 #ifdef CONFIG_HS20
 200
 201 static int cred_with_min_backhaul(struct wpa_supplicant *wpa_s)
 202 {
 203         struct wpa_cred *cred;
 204
 205         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 206                 if (cred->min_dl_bandwidth_home ||
 207                     cred->min_ul_bandwidth_home ||
 208                     cred->min_dl_bandwidth_roaming ||
 209                     cred->min_ul_bandwidth_roaming)
 210                         return 1;
 211         }
 212         return 0;
 213 }
 214
 215
 216 static int cred_with_conn_capab(struct wpa_supplicant *wpa_s)
 217 {
 218         struct wpa_cred *cred;
 219
 220         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 221                 if (cred->num_req_conn_capab)
 222                         return 1;
 223         }
 224         return 0;
 225 }
 226
 227 #endif /* CONFIG_HS20 */
 228
 229
 230 static int additional_roaming_consortiums(struct wpa_bss *bss)
 231 {
 232         const u8 *ie;
 233         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
 234         if (ie == NULL || ie[1] == 0)
 235                 return 0;
 236         return ie[2]; /* Number of ANQP OIs */
 237 }
 238
 239
 240 static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
 241 {
 242         struct wpa_supplicant *wpa_s = eloop_ctx;
 243         interworking_next_anqp_fetch(wpa_s);
 244 }
 245
 246
 247 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
 248                                       struct wpa_bss *bss)
 249 {
 250         struct wpabuf *buf;
 251         int ret = 0;
 252         int res;
 253         u16 info_ids[8];
 254         size_t num_info_ids = 0;
 255         struct wpabuf *extra = NULL;
 256         int all = wpa_s->fetch_all_anqp;
 257
 258         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
 259                 MAC2STR(bss->bssid));
 260         wpa_s->interworking_gas_bss = bss;
 261
 262         info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
 263         if (all) {
 264                 info_ids[num_info_ids++] = ANQP_VENUE_NAME;
 265                 info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
 266         }
 267         if (all || (cred_with_roaming_consortium(wpa_s) &&
 268                     additional_roaming_consortiums(bss)))
 269                 info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
 270         if (all)
 271                 info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
 272         if (all || cred_with_nai_realm(wpa_s))
 273                 info_ids[num_info_ids++] = ANQP_NAI_REALM;
 274         if (all || cred_with_3gpp(wpa_s)) {
 275                 info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
 276                 wpa_supplicant_scard_init(wpa_s, NULL);
 277         }
 278         if (all || cred_with_domain(wpa_s))
 279                 info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
 280         wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
 281                     (u8 *) info_ids, num_info_ids * 2);
 282
 283 #ifdef CONFIG_HS20
 284         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
 285                 u8 *len_pos;
 286
 287                 extra = wpabuf_alloc(100);
 288                 if (!extra)
 289                         return -1;
 290
 291                 len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
 292                 wpabuf_put_be24(extra, OUI_WFA);
 293                 wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
 294                 wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
 295                 wpabuf_put_u8(extra, 0); /* Reserved */
 296                 wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
 297                 if (all)
 298                         wpabuf_put_u8(extra,
 299                                       HS20_STYPE_OPERATOR_FRIENDLY_NAME);
 300                 if (all || cred_with_min_backhaul(wpa_s))
 301                         wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
 302                 if (all || cred_with_conn_capab(wpa_s))
 303                         wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
 304                 if (all)
 305                         wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
 306                 if (all) {
 307                         wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_LIST);
 308                         wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_NAI_LIST);
 309                 }
 310                 gas_anqp_set_element_len(extra, len_pos);
 311         }
 312 #endif /* CONFIG_HS20 */
 313
 314         buf = anqp_build_req(info_ids, num_info_ids, extra);
 315         wpabuf_free(extra);
 316         if (buf == NULL)
 317                 return -1;
 318
 319         res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, 0, buf,
 320                             interworking_anqp_resp_cb, wpa_s);
 321         if (res < 0) {
 322                 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
 323                 wpabuf_free(buf);
 324                 ret = -1;
 325                 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
 326                                        NULL);
 327         } else
 328                 wpa_msg(wpa_s, MSG_DEBUG,
 329                         "ANQP: Query started with dialog token %u", res);
 330
 331         return ret;
 332 }
 333
 334
 335 struct nai_realm_eap {
 336         u8 method;
 337         u8 inner_method;
 338         enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
 339         u8 cred_type;
 340         u8 tunneled_cred_type;
 341 };
 342
 343 struct nai_realm {
 344         u8 encoding;
 345         char *realm;
 346         u8 eap_count;
 347         struct nai_realm_eap *eap;
 348 };
 349
 350
 351 static void nai_realm_free(struct nai_realm *realms, u16 count)
 352 {
 353         u16 i;
 354
 355         if (realms == NULL)
 356                 return;
 357         for (i = 0; i < count; i++) {
 358                 os_free(realms[i].eap);
 359                 os_free(realms[i].realm);
 360         }
 361         os_free(realms);
 362 }
 363
 364
 365 static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
 366                                       const u8 *end)
 367 {
 368         u8 elen, auth_count, a;
 369         const u8 *e_end;
 370
 371         if (end - pos < 3) {
 372                 wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
 373                 return NULL;
 374         }
 375
 376         elen = *pos++;
 377         if (elen > end - pos || elen < 2) {
 378                 wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
 379                 return NULL;
 380         }
 381         e_end = pos + elen;
 382         e->method = *pos++;
 383         auth_count = *pos++;
 384         wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
 385                    elen, e->method, auth_count);
 386
 387         for (a = 0; a < auth_count; a++) {
 388                 u8 id, len;
 389
 390                 if (end - pos < 2) {
 391                         wpa_printf(MSG_DEBUG,
 392                                    "No room for Authentication Parameter subfield header");
 393                         return NULL;
 394                 }
 395
 396                 id = *pos++;
 397                 len = *pos++;
 398                 if (len > end - pos) {
 399                         wpa_printf(MSG_DEBUG,
 400                                    "No room for Authentication Parameter subfield");
 401                         return NULL;
 402                 }
 403
 404                 switch (id) {
 405                 case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
 406                         if (len < 1)
 407                                 break;
 408                         e->inner_non_eap = *pos;
 409                         if (e->method != EAP_TYPE_TTLS)
 410                                 break;
 411                         switch (*pos) {
 412                         case NAI_REALM_INNER_NON_EAP_PAP:
 413                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
 414                                 break;
 415                         case NAI_REALM_INNER_NON_EAP_CHAP:
 416                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
 417                                 break;
 418                         case NAI_REALM_INNER_NON_EAP_MSCHAP:
 419                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
 420                                 break;
 421                         case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
 422                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
 423                                 break;
 424                         }
 425                         break;
 426                 case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
 427                         if (len < 1)
 428                                 break;
 429                         e->inner_method = *pos;
 430                         wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
 431                                    e->inner_method);
 432                         break;
 433                 case NAI_REALM_EAP_AUTH_CRED_TYPE:
 434                         if (len < 1)
 435                                 break;
 436                         e->cred_type = *pos;
 437                         wpa_printf(MSG_DEBUG, "Credential Type: %u",
 438                                    e->cred_type);
 439                         break;
 440                 case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
 441                         if (len < 1)
 442                                 break;
 443                         e->tunneled_cred_type = *pos;
 444                         wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
 445                                    "Type: %u", e->tunneled_cred_type);
 446                         break;
 447                 default:
 448                         wpa_printf(MSG_DEBUG, "Unsupported Authentication "
 449                                    "Parameter: id=%u len=%u", id, len);
 450                         wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
 451                                     "Value", pos, len);
 452                         break;
 453                 }
 454
 455                 pos += len;
 456         }
 457
 458         return e_end;
 459 }
 460
 461
 462 static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
 463                                         const u8 *end)
 464 {
 465         u16 len;
 466         const u8 *f_end;
 467         u8 realm_len, e;
 468
 469         if (end - pos < 4) {
 470                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 471                            "fixed fields");
 472                 return NULL;
 473         }
 474
 475         len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
 476         pos += 2;
 477         if (len > end - pos || len < 3) {
 478                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 479                            "(len=%u; left=%u)",
 480                            len, (unsigned int) (end - pos));
 481                 return NULL;
 482         }
 483         f_end = pos + len;
 484
 485         r->encoding = *pos++;
 486         realm_len = *pos++;
 487         if (realm_len > f_end - pos) {
 488                 wpa_printf(MSG_DEBUG, "No room for NAI Realm "
 489                            "(len=%u; left=%u)",
 490                            realm_len, (unsigned int) (f_end - pos));
 491                 return NULL;
 492         }
 493         wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
 494         r->realm = dup_binstr(pos, realm_len);
 495         if (r->realm == NULL)
 496                 return NULL;
 497         pos += realm_len;
 498
 499         if (f_end - pos < 1) {
 500                 wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
 501                 return NULL;
 502         }
 503         r->eap_count = *pos++;
 504         wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
 505         if (r->eap_count * 3 > f_end - pos) {
 506                 wpa_printf(MSG_DEBUG, "No room for EAP Methods");
 507                 return NULL;
 508         }
 509         r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
 510         if (r->eap == NULL)
 511                 return NULL;
 512
 513         for (e = 0; e < r->eap_count; e++) {
 514                 pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
 515                 if (pos == NULL)
 516                         return NULL;
 517         }
 518
 519         return f_end;
 520 }
 521
 522
 523 static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
 524 {
 525         struct nai_realm *realm;
 526         const u8 *pos, *end;
 527         u16 i, num;
 528         size_t left;
 529
 530         if (anqp == NULL)
 531                 return NULL;
 532         left = wpabuf_len(anqp);
 533         if (left < 2)
 534                 return NULL;
 535
 536         pos = wpabuf_head_u8(anqp);
 537         end = pos + left;
 538         num = WPA_GET_LE16(pos);
 539         wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
 540         pos += 2;
 541         left -= 2;
 542
 543         if (num > left / 5) {
 544                 wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
 545                            "enough data (%u octets) for that many realms",
 546                            num, (unsigned int) left);
 547                 return NULL;
 548         }
 549
 550         realm = os_calloc(num, sizeof(struct nai_realm));
 551         if (realm == NULL)
 552                 return NULL;
 553
 554         for (i = 0; i < num; i++) {
 555                 pos = nai_realm_parse_realm(&realm[i], pos, end);
 556                 if (pos == NULL) {
 557                         nai_realm_free(realm, num);
 558                         return NULL;
 559                 }
 560         }
 561
 562         *count = num;
 563         return realm;
 564 }
 565
 566
 567 static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
 568 {
 569         char *tmp, *pos, *end;
 570         int match = 0;
 571
 572         if (realm->realm == NULL || home_realm == NULL)
 573                 return 0;
 574
 575         if (os_strchr(realm->realm, ';') == NULL)
 576                 return os_strcasecmp(realm->realm, home_realm) == 0;
 577
 578         tmp = os_strdup(realm->realm);
 579         if (tmp == NULL)
 580                 return 0;
 581
 582         pos = tmp;
 583         while (*pos) {
 584                 end = os_strchr(pos, ';');
 585                 if (end)
 586                         *end = '\0';
 587                 if (os_strcasecmp(pos, home_realm) == 0) {
 588                         match = 1;
 589                         break;
 590                 }
 591                 if (end == NULL)
 592                         break;
 593                 pos = end + 1;
 594         }
 595
 596         os_free(tmp);
 597
 598         return match;
 599 }
 600
 601
 602 static int nai_realm_cred_username(struct wpa_supplicant *wpa_s,
 603                                    struct nai_realm_eap *eap)
 604 {
 605         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
 606                 wpa_msg(wpa_s, MSG_DEBUG,
 607                         "nai-realm-cred-username: EAP method not supported: %d",
 608                         eap->method);
 609                 return 0; /* method not supported */
 610         }
 611
 612         if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP &&
 613             eap->method != EAP_TYPE_FAST) {
 614                 /* Only tunneled methods with username/password supported */
 615                 wpa_msg(wpa_s, MSG_DEBUG,
 616                         "nai-realm-cred-username: Method: %d is not TTLS, PEAP, or FAST",
 617                         eap->method);
 618                 return 0;
 619         }
 620
 621         if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) {
 622                 if (eap->inner_method &&
 623                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
 624                         wpa_msg(wpa_s, MSG_DEBUG,
 625                                 "nai-realm-cred-username: PEAP/FAST: Inner method not supported: %d",
 626                                 eap->inner_method);
 627                         return 0;
 628                 }
 629                 if (!eap->inner_method &&
 630                     eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) {
 631                         wpa_msg(wpa_s, MSG_DEBUG,
 632                                 "nai-realm-cred-username: MSCHAPv2 not supported");
 633                         return 0;
 634                 }
 635         }
 636
 637         if (eap->method == EAP_TYPE_TTLS) {
 638                 if (eap->inner_method == 0 && eap->inner_non_eap == 0)
 639                         return 1; /* Assume TTLS/MSCHAPv2 is used */
 640                 if (eap->inner_method &&
 641                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
 642                         wpa_msg(wpa_s, MSG_DEBUG,
 643                                 "nai-realm-cred-username: TTLS, but inner not supported: %d",
 644                                 eap->inner_method);
 645                         return 0;
 646                 }
 647                 if (eap->inner_non_eap &&
 648                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
 649                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
 650                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
 651                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) {
 652                         wpa_msg(wpa_s, MSG_DEBUG,
 653                                 "nai-realm-cred-username: TTLS, inner-non-eap not supported: %d",
 654                                 eap->inner_non_eap);
 655                         return 0;
 656                 }
 657         }
 658
 659         if (eap->inner_method &&
 660             eap->inner_method != EAP_TYPE_GTC &&
 661             eap->inner_method != EAP_TYPE_MSCHAPV2) {
 662                 wpa_msg(wpa_s, MSG_DEBUG,
 663                         "nai-realm-cred-username: inner-method not GTC or MSCHAPv2: %d",
 664                         eap->inner_method);
 665                 return 0;
 666         }
 667
 668         return 1;
 669 }
 670
 671
 672 static int nai_realm_cred_cert(struct wpa_supplicant *wpa_s,
 673                                struct nai_realm_eap *eap)
 674 {
 675         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
 676                 wpa_msg(wpa_s, MSG_DEBUG,
 677                         "nai-realm-cred-cert: Method not supported: %d",
 678                         eap->method);
 679                 return 0; /* method not supported */
 680         }
 681
 682         if (eap->method != EAP_TYPE_TLS) {
 683                 /* Only EAP-TLS supported for credential authentication */
 684                 wpa_msg(wpa_s, MSG_DEBUG,
 685                         "nai-realm-cred-cert: Method not TLS: %d",
 686                         eap->method);
 687                 return 0;
 688         }
 689
 690         return 1;
 691 }
 692
 693
 694 static struct nai_realm_eap * nai_realm_find_eap(struct wpa_supplicant *wpa_s,
 695                                                  struct wpa_cred *cred,
 696                                                  struct nai_realm *realm)
 697 {
 698         u8 e;
 699
 700         if (cred->username == NULL ||
 701             cred->username[0] == '\0' ||
 702             ((cred->password == NULL ||
 703               cred->password[0] == '\0') &&
 704              (cred->private_key == NULL ||
 705               cred->private_key[0] == '\0'))) {
 706                 wpa_msg(wpa_s, MSG_DEBUG,
 707                         "nai-realm-find-eap: incomplete cred info: username: %s  password: %s private_key: %s",
 708                         cred->username ? cred->username : "NULL",
 709                         cred->password ? cred->password : "NULL",
 710                         cred->private_key ? cred->private_key : "NULL");
 711                 return NULL;
 712         }
 713
 714         for (e = 0; e < realm->eap_count; e++) {
 715                 struct nai_realm_eap *eap = &realm->eap[e];
 716                 if (cred->password && cred->password[0] &&
 717                     nai_realm_cred_username(wpa_s, eap))
 718                         return eap;
 719                 if (cred->private_key && cred->private_key[0] &&
 720                     nai_realm_cred_cert(wpa_s, eap))
 721                         return eap;
 722         }
 723
 724         return NULL;
 725 }
 726
 727
 728 #ifdef INTERWORKING_3GPP
 729
 730 static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
 731 {
 732         u8 plmn[3], plmn2[3];
 733         const u8 *pos, *end;
 734         u8 udhl;
 735
 736         /*
 737          * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network
 738          * operator is allowed to include only two digits of the MNC, so allow
 739          * matches based on both two and three digit MNC assumptions. Since some
 740          * SIM/USIM cards may not expose MNC length conveniently, we may be
 741          * provided the default MNC length 3 here and as such, checking with MNC
 742          * length 2 is justifiable even though 3GPP TS 24.234 does not mention
 743          * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used
 744          * with otherwise matching values would not be good idea in general, so
 745          * this should not result in selecting incorrect networks.
 746          */
 747         /* Match with 3 digit MNC */
 748         plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 749         plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4);
 750         plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 751         /* Match with 2 digit MNC */
 752         plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 753         plmn2[1] = (imsi[2] - '0') | 0xf0;
 754         plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 755
 756         if (anqp == NULL)
 757                 return 0;
 758         pos = wpabuf_head_u8(anqp);
 759         end = pos + wpabuf_len(anqp);
 760         if (end - pos < 2)
 761                 return 0;
 762         if (*pos != 0) {
 763                 wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
 764                 return 0;
 765         }
 766         pos++;
 767         udhl = *pos++;
 768         if (udhl > end - pos) {
 769                 wpa_printf(MSG_DEBUG, "Invalid UDHL");
 770                 return 0;
 771         }
 772         end = pos + udhl;
 773
 774         wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)",
 775                    plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2],
 776                    imsi, mnc_len);
 777
 778         while (end - pos >= 2) {
 779                 u8 iei, len;
 780                 const u8 *l_end;
 781                 iei = *pos++;
 782                 len = *pos++ & 0x7f;
 783                 if (len > end - pos)
 784                         break;
 785                 l_end = pos + len;
 786
 787                 if (iei == 0 && len > 0) {
 788                         /* PLMN List */
 789                         u8 num, i;
 790                         wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element",
 791                                     pos, len);
 792                         num = *pos++;
 793                         for (i = 0; i < num; i++) {
 794                                 if (l_end - pos < 3)
 795                                         break;
 796                                 if (os_memcmp(pos, plmn, 3) == 0 ||
 797                                     os_memcmp(pos, plmn2, 3) == 0)
 798                                         return 1; /* Found matching PLMN */
 799                                 pos += 3;
 800                         }
 801                 } else {
 802                         wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element",
 803                                     pos, len);
 804                 }
 805
 806                 pos = l_end;
 807         }
 808
 809         return 0;
 810 }
 811
 812
 813 static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
 814                           size_t mnc_len, char prefix)
 815 {
 816         const char *sep, *msin;
 817         char *end, *pos;
 818         size_t msin_len, plmn_len;
 819
 820         /*
 821          * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
 822          * Root NAI:
 823          * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
 824          * <MNC> is zero-padded to three digits in case two-digit MNC is used
 825          */
 826
 827         if (imsi == NULL || os_strlen(imsi) > 16) {
 828                 wpa_printf(MSG_DEBUG, "No valid IMSI available");
 829                 return -1;
 830         }
 831         sep = os_strchr(imsi, '-');
 832         if (sep) {
 833                 plmn_len = sep - imsi;
 834                 msin = sep + 1;
 835         } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
 836                 plmn_len = 3 + mnc_len;
 837                 msin = imsi + plmn_len;
 838         } else
 839                 return -1;
 840         if (plmn_len != 5 && plmn_len != 6)
 841                 return -1;
 842         msin_len = os_strlen(msin);
 843
 844         pos = nai;
 845         end = nai + nai_len;
 846         if (prefix)
 847                 *pos++ = prefix;
 848         os_memcpy(pos, imsi, plmn_len);
 849         pos += plmn_len;
 850         os_memcpy(pos, msin, msin_len);
 851         pos += msin_len;
 852         pos += os_snprintf(pos, end - pos, "@wlan.mnc");
 853         if (plmn_len == 5) {
 854                 *pos++ = '0';
 855                 *pos++ = imsi[3];
 856                 *pos++ = imsi[4];
 857         } else {
 858                 *pos++ = imsi[3];
 859                 *pos++ = imsi[4];
 860                 *pos++ = imsi[5];
 861         }
 862         os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
 863                     imsi[0], imsi[1], imsi[2]);
 864
 865         return 0;
 866 }
 867
 868
 869 static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
 870 {
 871         char nai[100];
 872         if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
 873                 return -1;
 874         return wpa_config_set_quoted(ssid, "identity", nai);
 875 }
 876
 877 #endif /* INTERWORKING_3GPP */
 878
 879
 880 static int already_connected(struct wpa_supplicant *wpa_s,
 881                              struct wpa_cred *cred, struct wpa_bss *bss)
 882 {
 883         struct wpa_ssid *ssid, *sel_ssid;
 884         struct wpa_bss *selected;
 885
 886         if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL)
 887                 return 0;
 888
 889         ssid = wpa_s->current_ssid;
 890         if (ssid->parent_cred != cred)
 891                 return 0;
 892
 893         if (ssid->ssid_len != bss->ssid_len ||
 894             os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
 895                 return 0;
 896
 897         sel_ssid = NULL;
 898         selected = wpa_supplicant_pick_network(wpa_s, &sel_ssid);
 899         if (selected && sel_ssid && sel_ssid->priority > ssid->priority)
 900                 return 0; /* higher priority network in scan results */
 901
 902         return 1;
 903 }
 904
 905
 906 static void remove_duplicate_network(struct wpa_supplicant *wpa_s,
 907                                      struct wpa_cred *cred,
 908                                      struct wpa_bss *bss)
 909 {
 910         struct wpa_ssid *ssid;
 911
 912         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 913                 if (ssid->parent_cred != cred)
 914                         continue;
 915                 if (ssid->ssid_len != bss->ssid_len ||
 916                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
 917                         continue;
 918
 919                 break;
 920         }
 921
 922         if (ssid == NULL)
 923                 return;
 924
 925         wpa_printf(MSG_DEBUG, "Interworking: Remove duplicate network entry for the same credential");
 926
 927         if (ssid == wpa_s->current_ssid) {
 928                 wpa_sm_set_config(wpa_s->wpa, NULL);
 929                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 930                 wpa_s->own_disconnect_req = 1;
 931                 wpa_supplicant_deauthenticate(wpa_s,
 932                                               WLAN_REASON_DEAUTH_LEAVING);
 933         }
 934
 935         wpas_notify_network_removed(wpa_s, ssid);
 936         wpa_config_remove_network(wpa_s->conf, ssid->id);
 937 }
 938
 939
 940 static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
 941                                         struct wpa_ssid *ssid)
 942 {
 943         const char *key_mgmt = NULL;
 944 #ifdef CONFIG_IEEE80211R
 945         int res;
 946         struct wpa_driver_capa capa;
 947
 948         res = wpa_drv_get_capa(wpa_s, &capa);
 949         if (res == 0 && capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT) {
 950                 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
 951                         "WPA-EAP WPA-EAP-SHA256 FT-EAP" :
 952                         "WPA-EAP FT-EAP";
 953         }
 954 #endif /* CONFIG_IEEE80211R */
 955
 956         if (!key_mgmt)
 957                 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
 958                         "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP";
 959         if (wpa_config_set(ssid, "key_mgmt", key_mgmt, 0) < 0 ||
 960             wpa_config_set(ssid, "proto", "RSN", 0) < 0 ||
 961             wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
 962                 return -1;
 963         return 0;
 964 }
 965
 966
 967 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
 968                                      struct wpa_cred *cred,
 969                                      struct wpa_bss *bss, int only_add)
 970 {
 971 #ifdef INTERWORKING_3GPP
 972         struct wpa_ssid *ssid;
 973         int eap_type;
 974         int res;
 975         char prefix;
 976
 977         if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
 978                 return -1;
 979
 980         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
 981                 " (3GPP)", MAC2STR(bss->bssid));
 982
 983         if (already_connected(wpa_s, cred, bss)) {
 984                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
 985                         MAC2STR(bss->bssid));
 986                 return wpa_s->current_ssid->id;
 987         }
 988
 989         remove_duplicate_network(wpa_s, cred, bss);
 990
 991         ssid = wpa_config_add_network(wpa_s->conf);
 992         if (ssid == NULL)
 993                 return -1;
 994         ssid->parent_cred = cred;
 995
 996         wpas_notify_network_added(wpa_s, ssid);
 997         wpa_config_set_network_defaults(ssid);
 998         ssid->priority = cred->priority;
 999         ssid->temporary = 1;
1000         ssid->ssid = os_zalloc(bss->ssid_len + 1);
1001         if (ssid->ssid == NULL)
1002                 goto fail;
1003         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1004         ssid->ssid_len = bss->ssid_len;
1005         ssid->eap.sim_num = cred->sim_num;
1006
1007         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1008                 goto fail;
1009
1010         eap_type = EAP_TYPE_SIM;
1011         if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
1012                 eap_type = EAP_TYPE_AKA;
1013         if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
1014                 if (cred->eap_method[0].method == EAP_TYPE_SIM ||
1015                     cred->eap_method[0].method == EAP_TYPE_AKA ||
1016                     cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
1017                         eap_type = cred->eap_method[0].method;
1018         }
1019
1020         switch (eap_type) {
1021         case EAP_TYPE_SIM:
1022                 prefix = '1';
1023                 res = wpa_config_set(ssid, "eap", "SIM", 0);
1024                 break;
1025         case EAP_TYPE_AKA:
1026                 prefix = '0';
1027                 res = wpa_config_set(ssid, "eap", "AKA", 0);
1028                 break;
1029         case EAP_TYPE_AKA_PRIME:
1030                 prefix = '6';
1031                 res = wpa_config_set(ssid, "eap", "AKA'", 0);
1032                 break;
1033         default:
1034                 res = -1;
1035                 break;
1036         }
1037         if (res < 0) {
1038                 wpa_msg(wpa_s, MSG_DEBUG,
1039                         "Selected EAP method (%d) not supported", eap_type);
1040                 goto fail;
1041         }
1042
1043         if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
1044                 wpa_msg(wpa_s, MSG_DEBUG, "Failed to set Root NAI");
1045                 goto fail;
1046         }
1047
1048         if (cred->milenage && cred->milenage[0]) {
1049                 if (wpa_config_set_quoted(ssid, "password",
1050                                           cred->milenage) < 0)
1051                         goto fail;
1052         } else if (cred->pcsc) {
1053                 if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
1054                         goto fail;
1055                 if (wpa_s->conf->pcsc_pin &&
1056                     wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
1057                     < 0)
1058                         goto fail;
1059         }
1060
1061         wpa_s->next_ssid = ssid;
1062         wpa_config_update_prio_list(wpa_s->conf);
1063         if (!only_add)
1064                 interworking_reconnect(wpa_s);
1065
1066         return ssid->id;
1067
1068 fail:
1069         wpas_notify_network_removed(wpa_s, ssid);
1070         wpa_config_remove_network(wpa_s->conf, ssid->id);
1071 #endif /* INTERWORKING_3GPP */
1072         return -1;
1073 }
1074
1075
1076 static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
1077                                             size_t rc_len)
1078 {
1079         const u8 *pos, *end;
1080         u8 lens;
1081
1082         if (ie == NULL)
1083                 return 0;
1084
1085         pos = ie + 2;
1086         end = ie + 2 + ie[1];
1087
1088         /* Roaming Consortium element:
1089          * Number of ANQP OIs
1090          * OI #1 and #2 lengths
1091          * OI #1, [OI #2], [OI #3]
1092          */
1093
1094         if (end - pos < 2)
1095                 return 0;
1096
1097         pos++; /* skip Number of ANQP OIs */
1098         lens = *pos++;
1099         if ((lens & 0x0f) + (lens >> 4) > end - pos)
1100                 return 0;
1101
1102         if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1103                 return 1;
1104         pos += lens & 0x0f;
1105
1106         if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1107                 return 1;
1108         pos += lens >> 4;
1109
1110         if (pos < end && (size_t) (end - pos) == rc_len &&
1111             os_memcmp(pos, rc_id, rc_len) == 0)
1112                 return 1;
1113
1114         return 0;
1115 }
1116
1117
1118 static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
1119                                          const u8 *rc_id, size_t rc_len)
1120 {
1121         const u8 *pos, *end;
1122         u8 len;
1123
1124         if (anqp == NULL)
1125                 return 0;
1126
1127         pos = wpabuf_head(anqp);
1128         end = pos + wpabuf_len(anqp);
1129
1130         /* Set of <OI Length, OI> duples */
1131         while (pos < end) {
1132                 len = *pos++;
1133                 if (len > end - pos)
1134                         break;
1135                 if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1136                         return 1;
1137                 pos += len;
1138         }
1139
1140         return 0;
1141 }
1142
1143
1144 static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
1145                                     const u8 *rc_id, size_t rc_len)
1146 {
1147         return roaming_consortium_element_match(ie, rc_id, rc_len) ||
1148                 roaming_consortium_anqp_match(anqp, rc_id, rc_len);
1149 }
1150
1151
1152 static int cred_roaming_consortiums_match(const u8 *ie,
1153                                           const struct wpabuf *anqp,
1154                                           const struct wpa_cred *cred)
1155 {
1156         unsigned int i;
1157
1158         for (i = 0; i < cred->num_roaming_consortiums; i++) {
1159                 if (roaming_consortium_match(ie, anqp,
1160                                              cred->roaming_consortiums[i],
1161                                              cred->roaming_consortiums_len[i]))
1162                         return 1;
1163         }
1164
1165         return 0;
1166 }
1167
1168
1169 static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss)
1170 {
1171         const u8 *ie;
1172
1173         if (cred->required_roaming_consortium_len == 0)
1174                 return 0;
1175
1176         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1177
1178         if (ie == NULL &&
1179             (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
1180                 return 1;
1181
1182         return !roaming_consortium_match(ie,
1183                                          bss->anqp ?
1184                                          bss->anqp->roaming_consortium : NULL,
1185                                          cred->required_roaming_consortium,
1186                                          cred->required_roaming_consortium_len);
1187 }
1188
1189
1190 static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
1191 {
1192         size_t i;
1193
1194         if (!cred->excluded_ssid)
1195                 return 0;
1196
1197         for (i = 0; i < cred->num_excluded_ssid; i++) {
1198                 struct excluded_ssid *e = &cred->excluded_ssid[i];
1199                 if (bss->ssid_len == e->ssid_len &&
1200                     os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
1201                         return 1;
1202         }
1203
1204         return 0;
1205 }
1206
1207
1208 static int cred_below_min_backhaul(struct wpa_supplicant *wpa_s,
1209                                    struct wpa_cred *cred, struct wpa_bss *bss)
1210 {
1211 #ifdef CONFIG_HS20
1212         int res;
1213         unsigned int dl_bandwidth, ul_bandwidth;
1214         const u8 *wan;
1215         u8 wan_info, dl_load, ul_load;
1216         u16 lmd;
1217         u32 ul_speed, dl_speed;
1218
1219         if (!cred->min_dl_bandwidth_home &&
1220             !cred->min_ul_bandwidth_home &&
1221             !cred->min_dl_bandwidth_roaming &&
1222             !cred->min_ul_bandwidth_roaming)
1223                 return 0; /* No bandwidth constraint specified */
1224
1225         if (bss->anqp == NULL || bss->anqp->hs20_wan_metrics == NULL)
1226                 return 0; /* No WAN Metrics known - ignore constraint */
1227
1228         wan = wpabuf_head(bss->anqp->hs20_wan_metrics);
1229         wan_info = wan[0];
1230         if (wan_info & BIT(3))
1231                 return 1; /* WAN link at capacity */
1232         lmd = WPA_GET_LE16(wan + 11);
1233         if (lmd == 0)
1234                 return 0; /* Downlink/Uplink Load was not measured */
1235         dl_speed = WPA_GET_LE32(wan + 1);
1236         ul_speed = WPA_GET_LE32(wan + 5);
1237         dl_load = wan[9];
1238         ul_load = wan[10];
1239
1240         if (dl_speed >= 0xffffff)
1241                 dl_bandwidth = dl_speed / 255 * (255 - dl_load);
1242         else
1243                 dl_bandwidth = dl_speed * (255 - dl_load) / 255;
1244
1245         if (ul_speed >= 0xffffff)
1246                 ul_bandwidth = ul_speed / 255 * (255 - ul_load);
1247         else
1248                 ul_bandwidth = ul_speed * (255 - ul_load) / 255;
1249
1250         res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1251                                         bss->anqp->domain_name : NULL);
1252         if (res > 0) {
1253                 if (cred->min_dl_bandwidth_home > dl_bandwidth)
1254                         return 1;
1255                 if (cred->min_ul_bandwidth_home > ul_bandwidth)
1256                         return 1;
1257         } else {
1258                 if (cred->min_dl_bandwidth_roaming > dl_bandwidth)
1259                         return 1;
1260                 if (cred->min_ul_bandwidth_roaming > ul_bandwidth)
1261                         return 1;
1262         }
1263 #endif /* CONFIG_HS20 */
1264
1265         return 0;
1266 }
1267
1268
1269 static int cred_over_max_bss_load(struct wpa_supplicant *wpa_s,
1270                                   struct wpa_cred *cred, struct wpa_bss *bss)
1271 {
1272         const u8 *ie;
1273         int res;
1274
1275         if (!cred->max_bss_load)
1276                 return 0; /* No BSS Load constraint specified */
1277
1278         ie = wpa_bss_get_ie(bss, WLAN_EID_BSS_LOAD);
1279         if (ie == NULL || ie[1] < 3)
1280                 return 0; /* No BSS Load advertised */
1281
1282         res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1283                                         bss->anqp->domain_name : NULL);
1284         if (res <= 0)
1285                 return 0; /* Not a home network */
1286
1287         return ie[4] > cred->max_bss_load;
1288 }
1289
1290
1291 #ifdef CONFIG_HS20
1292
1293 static int has_proto_match(const u8 *pos, const u8 *end, u8 proto)
1294 {
1295         while (end - pos >= 4) {
1296                 if (pos[0] == proto && pos[3] == 1 /* Open */)
1297                         return 1;
1298                 pos += 4;
1299         }
1300
1301         return 0;
1302 }
1303
1304
1305 static int has_proto_port_match(const u8 *pos, const u8 *end, u8 proto,
1306                                 u16 port)
1307 {
1308         while (end - pos >= 4) {
1309                 if (pos[0] == proto && WPA_GET_LE16(&pos[1]) == port &&
1310                     pos[3] == 1 /* Open */)
1311                         return 1;
1312                 pos += 4;
1313         }
1314
1315         return 0;
1316 }
1317
1318 #endif /* CONFIG_HS20 */
1319
1320
1321 static int cred_conn_capab_missing(struct wpa_supplicant *wpa_s,
1322                                    struct wpa_cred *cred, struct wpa_bss *bss)
1323 {
1324 #ifdef CONFIG_HS20
1325         int res;
1326         const u8 *capab, *end;
1327         unsigned int i, j;
1328         int *ports;
1329
1330         if (!cred->num_req_conn_capab)
1331                 return 0; /* No connection capability constraint specified */
1332
1333         if (bss->anqp == NULL || bss->anqp->hs20_connection_capability == NULL)
1334                 return 0; /* No Connection Capability known - ignore constraint
1335                            */
1336
1337         res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1338                                         bss->anqp->domain_name : NULL);
1339         if (res > 0)
1340                 return 0; /* No constraint in home network */
1341
1342         capab = wpabuf_head(bss->anqp->hs20_connection_capability);
1343         end = capab + wpabuf_len(bss->anqp->hs20_connection_capability);
1344
1345         for (i = 0; i < cred->num_req_conn_capab; i++) {
1346                 ports = cred->req_conn_capab_port[i];
1347                 if (!ports) {
1348                         if (!has_proto_match(capab, end,
1349                                              cred->req_conn_capab_proto[i]))
1350                                 return 1;
1351                 } else {
1352                         for (j = 0; ports[j] > -1; j++) {
1353                                 if (!has_proto_port_match(
1354                                             capab, end,
1355                                             cred->req_conn_capab_proto[i],
1356                                             ports[j]))
1357                                         return 1;
1358                         }
1359                 }
1360         }
1361 #endif /* CONFIG_HS20 */
1362
1363         return 0;
1364 }
1365
1366
1367 static struct wpa_cred * interworking_credentials_available_roaming_consortium(
1368         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
1369         int *excluded)
1370 {
1371         struct wpa_cred *cred, *selected = NULL;
1372         const u8 *ie;
1373         const struct wpabuf *anqp;
1374         int is_excluded = 0;
1375
1376         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1377         anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL;
1378
1379         if (!ie && !anqp)
1380                 return NULL;
1381
1382         if (wpa_s->conf->cred == NULL)
1383                 return NULL;
1384
1385         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1386                 if (cred->roaming_consortium_len == 0 &&
1387                     cred->num_roaming_consortiums == 0)
1388                         continue;
1389
1390                 if ((cred->roaming_consortium_len == 0 ||
1391                      !roaming_consortium_match(ie, anqp,
1392                                                cred->roaming_consortium,
1393                                                cred->roaming_consortium_len)) &&
1394                     !cred_roaming_consortiums_match(ie, anqp, cred))
1395                         continue;
1396
1397                 if (cred_no_required_oi_match(cred, bss))
1398                         continue;
1399                 if (!ignore_bw && cred_below_min_backhaul(wpa_s, cred, bss))
1400                         continue;
1401                 if (!ignore_bw && cred_over_max_bss_load(wpa_s, cred, bss))
1402                         continue;
1403                 if (!ignore_bw && cred_conn_capab_missing(wpa_s, cred, bss))
1404                         continue;
1405                 if (cred_excluded_ssid(cred, bss)) {
1406                         if (excluded == NULL)
1407                                 continue;
1408                         if (selected == NULL) {
1409                                 selected = cred;
1410                                 is_excluded = 1;
1411                         }
1412                 } else {
1413                         if (selected == NULL || is_excluded ||
1414                             cred_prio_cmp(selected, cred) < 0) {
1415                                 selected = cred;
1416                                 is_excluded = 0;
1417                         }
1418                 }
1419         }
1420
1421         if (excluded)
1422                 *excluded = is_excluded;
1423
1424         return selected;
1425 }
1426
1427
1428 static int interworking_set_eap_params(struct wpa_ssid *ssid,
1429                                        struct wpa_cred *cred, int ttls)
1430 {
1431         if (cred->eap_method) {
1432                 ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
1433                         cred->eap_method->method == EAP_TYPE_TTLS;
1434
1435                 os_free(ssid->eap.eap_methods);
1436                 ssid->eap.eap_methods =
1437                         os_malloc(sizeof(struct eap_method_type) * 2);
1438                 if (ssid->eap.eap_methods == NULL)
1439                         return -1;
1440                 os_memcpy(ssid->eap.eap_methods, cred->eap_method,
1441                           sizeof(*cred->eap_method));
1442                 ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
1443                 ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
1444         }
1445
1446         if (ttls && cred->username && cred->username[0]) {
1447                 const char *pos;
1448                 char *anon;
1449                 /* Use anonymous NAI in Phase 1 */
1450                 pos = os_strchr(cred->username, '@');
1451                 if (pos) {
1452                         size_t buflen = 9 + os_strlen(pos) + 1;
1453                         anon = os_malloc(buflen);
1454                         if (anon == NULL)
1455                                 return -1;
1456                         os_snprintf(anon, buflen, "anonymous%s", pos);
1457                 } else if (cred->realm) {
1458                         size_t buflen = 10 + os_strlen(cred->realm) + 1;
1459                         anon = os_malloc(buflen);
1460                         if (anon == NULL)
1461                                 return -1;
1462                         os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
1463                 } else {
1464                         anon = os_strdup("anonymous");
1465                         if (anon == NULL)
1466                                 return -1;
1467                 }
1468                 if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
1469                     0) {
1470                         os_free(anon);
1471                         return -1;
1472                 }
1473                 os_free(anon);
1474         }
1475
1476         if (!ttls && cred->username && cred->username[0] && cred->realm &&
1477             !os_strchr(cred->username, '@')) {
1478                 char *id;
1479                 size_t buflen;
1480                 int res;
1481
1482                 buflen = os_strlen(cred->username) + 1 +
1483                         os_strlen(cred->realm) + 1;
1484
1485                 id = os_malloc(buflen);
1486                 if (!id)
1487                         return -1;
1488                 os_snprintf(id, buflen, "%s@%s", cred->username, cred->realm);
1489                 res = wpa_config_set_quoted(ssid, "identity", id);
1490                 os_free(id);
1491                 if (res < 0)
1492                         return -1;
1493         } else if (cred->username && cred->username[0] &&
1494             wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
1495                 return -1;
1496
1497         if (cred->password && cred->password[0]) {
1498                 if (cred->ext_password &&
1499                     wpa_config_set(ssid, "password", cred->password, 0) < 0)
1500                         return -1;
1501                 if (!cred->ext_password &&
1502                     wpa_config_set_quoted(ssid, "password", cred->password) <
1503                     0)
1504                         return -1;
1505         }
1506
1507         if (cred->client_cert && cred->client_cert[0] &&
1508             wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
1509                 return -1;
1510
1511 #ifdef ANDROID
1512         if (cred->private_key &&
1513             os_strncmp(cred->private_key, "keystore://", 11) == 0) {
1514                 /* Use OpenSSL engine configuration for Android keystore */
1515                 if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
1516                     wpa_config_set_quoted(ssid, "key_id",
1517                                           cred->private_key + 11) < 0 ||
1518                     wpa_config_set(ssid, "engine", "1", 0) < 0)
1519                         return -1;
1520         } else
1521 #endif /* ANDROID */
1522         if (cred->private_key && cred->private_key[0] &&
1523             wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
1524                 return -1;
1525
1526         if (cred->private_key_passwd && cred->private_key_passwd[0] &&
1527             wpa_config_set_quoted(ssid, "private_key_passwd",
1528                                   cred->private_key_passwd) < 0)
1529                 return -1;
1530
1531         if (cred->phase1) {
1532                 os_free(ssid->eap.phase1);
1533                 ssid->eap.phase1 = os_strdup(cred->phase1);
1534         }
1535         if (cred->phase2) {
1536                 os_free(ssid->eap.phase2);
1537                 ssid->eap.phase2 = os_strdup(cred->phase2);
1538         }
1539
1540         if (cred->ca_cert && cred->ca_cert[0] &&
1541             wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
1542                 return -1;
1543
1544         if (cred->domain_suffix_match && cred->domain_suffix_match[0] &&
1545             wpa_config_set_quoted(ssid, "domain_suffix_match",
1546                                   cred->domain_suffix_match) < 0)
1547                 return -1;
1548
1549         ssid->eap.ocsp = cred->ocsp;
1550
1551         return 0;
1552 }
1553
1554
1555 static int interworking_connect_roaming_consortium(
1556         struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
1557         struct wpa_bss *bss, int only_add)
1558 {
1559         struct wpa_ssid *ssid;
1560         const u8 *ie;
1561         const struct wpabuf *anqp;
1562         unsigned int i;
1563
1564         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
1565                 " based on roaming consortium match", MAC2STR(bss->bssid));
1566
1567         if (already_connected(wpa_s, cred, bss)) {
1568                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1569                         MAC2STR(bss->bssid));
1570                 return wpa_s->current_ssid->id;
1571         }
1572
1573         remove_duplicate_network(wpa_s, cred, bss);
1574
1575         ssid = wpa_config_add_network(wpa_s->conf);
1576         if (ssid == NULL)
1577                 return -1;
1578         ssid->parent_cred = cred;
1579         wpas_notify_network_added(wpa_s, ssid);
1580         wpa_config_set_network_defaults(ssid);
1581         ssid->priority = cred->priority;
1582         ssid->temporary = 1;
1583         ssid->ssid = os_zalloc(bss->ssid_len + 1);
1584         if (ssid->ssid == NULL)
1585                 goto fail;
1586         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1587         ssid->ssid_len = bss->ssid_len;
1588
1589         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1590                 goto fail;
1591
1592         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1593         anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL;
1594         for (i = 0; (ie || anqp) && i < cred->num_roaming_consortiums; i++) {
1595                 if (!roaming_consortium_match(
1596                             ie, anqp, cred->roaming_consortiums[i],
1597                             cred->roaming_consortiums_len[i]))
1598                         continue;
1599
1600                 ssid->roaming_consortium_selection =
1601                         os_malloc(cred->roaming_consortiums_len[i]);
1602                 if (!ssid->roaming_consortium_selection)
1603                         goto fail;
1604                 os_memcpy(ssid->roaming_consortium_selection,
1605                           cred->roaming_consortiums[i],
1606                           cred->roaming_consortiums_len[i]);
1607                 ssid->roaming_consortium_selection_len =
1608                         cred->roaming_consortiums_len[i];
1609                 break;
1610         }
1611
1612         if (cred->eap_method == NULL) {
1613                 wpa_msg(wpa_s, MSG_DEBUG,
1614                         "Interworking: No EAP method set for credential using roaming consortium");
1615                 goto fail;
1616         }
1617
1618         if (interworking_set_eap_params(
1619                     ssid, cred,
1620                     cred->eap_method->vendor == EAP_VENDOR_IETF &&
1621                     cred->eap_method->method == EAP_TYPE_TTLS) < 0)
1622                 goto fail;
1623
1624         wpa_s->next_ssid = ssid;
1625         wpa_config_update_prio_list(wpa_s->conf);
1626         if (!only_add)
1627                 interworking_reconnect(wpa_s);
1628
1629         return ssid->id;
1630
1631 fail:
1632         wpas_notify_network_removed(wpa_s, ssid);
1633         wpa_config_remove_network(wpa_s->conf, ssid->id);
1634         return -1;
1635 }
1636
1637
1638 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
1639                          int only_add)
1640 {
1641         struct wpa_cred *cred, *cred_rc, *cred_3gpp;
1642         struct wpa_ssid *ssid;
1643         struct nai_realm *realm;
1644         struct nai_realm_eap *eap = NULL;
1645         u16 count, i;
1646         char buf[100];
1647         int excluded = 0, *excl = &excluded;
1648         const char *name;
1649
1650         if (wpa_s->conf->cred == NULL || bss == NULL)
1651                 return -1;
1652         if (disallowed_bssid(wpa_s, bss->bssid) ||
1653             disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
1654                 wpa_msg(wpa_s, MSG_DEBUG,
1655                         "Interworking: Reject connection to disallowed BSS "
1656                         MACSTR, MAC2STR(bss->bssid));
1657                 return -1;
1658         }
1659
1660         wpa_printf(MSG_DEBUG, "Interworking: Considering BSS " MACSTR
1661                    " for connection",
1662                    MAC2STR(bss->bssid));
1663
1664         if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
1665                 /*
1666                  * We currently support only HS 2.0 networks and those are
1667                  * required to use WPA2-Enterprise.
1668                  */
1669                 wpa_msg(wpa_s, MSG_DEBUG,
1670                         "Interworking: Network does not use RSN");
1671                 return -1;
1672         }
1673
1674         cred_rc = interworking_credentials_available_roaming_consortium(
1675                 wpa_s, bss, 0, excl);
1676         if (cred_rc) {
1677                 wpa_msg(wpa_s, MSG_DEBUG,
1678                         "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d",
1679                         cred_rc->priority, cred_rc->sp_priority);
1680                 if (excl && !(*excl))
1681                         excl = NULL;
1682         }
1683
1684         cred = interworking_credentials_available_realm(wpa_s, bss, 0, excl);
1685         if (cred) {
1686                 wpa_msg(wpa_s, MSG_DEBUG,
1687                         "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d",
1688                         cred->priority, cred->sp_priority);
1689                 if (excl && !(*excl))
1690                         excl = NULL;
1691         }
1692
1693         cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss, 0,
1694                                                             excl);
1695         if (cred_3gpp) {
1696                 wpa_msg(wpa_s, MSG_DEBUG,
1697                         "Interworking: Highest 3GPP matching credential priority %d sp_priority %d",
1698                         cred_3gpp->priority, cred_3gpp->sp_priority);
1699                 if (excl && !(*excl))
1700                         excl = NULL;
1701         }
1702
1703         if (!cred_rc && !cred && !cred_3gpp) {
1704                 wpa_msg(wpa_s, MSG_DEBUG,
1705                         "Interworking: No full credential matches - consider options without BW(etc.) limits");
1706                 cred_rc = interworking_credentials_available_roaming_consortium(
1707                         wpa_s, bss, 1, excl);
1708                 if (cred_rc) {
1709                         wpa_msg(wpa_s, MSG_DEBUG,
1710                                 "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d (ignore BW)",
1711                                 cred_rc->priority, cred_rc->sp_priority);
1712                         if (excl && !(*excl))
1713                                 excl = NULL;
1714                 }
1715
1716                 cred = interworking_credentials_available_realm(wpa_s, bss, 1,
1717                                                                 excl);
1718                 if (cred) {
1719                         wpa_msg(wpa_s, MSG_DEBUG,
1720                                 "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d (ignore BW)",
1721                                 cred->priority, cred->sp_priority);
1722                         if (excl && !(*excl))
1723                                 excl = NULL;
1724                 }
1725
1726                 cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss,
1727                                                                     1, excl);
1728                 if (cred_3gpp) {
1729                         wpa_msg(wpa_s, MSG_DEBUG,
1730                                 "Interworking: Highest 3GPP matching credential priority %d sp_priority %d (ignore BW)",
1731                                 cred_3gpp->priority, cred_3gpp->sp_priority);
1732                         if (excl && !(*excl))
1733                                 excl = NULL;
1734                 }
1735         }
1736
1737         if (cred_rc &&
1738             (cred == NULL || cred_prio_cmp(cred_rc, cred) >= 0) &&
1739             (cred_3gpp == NULL || cred_prio_cmp(cred_rc, cred_3gpp) >= 0))
1740                 return interworking_connect_roaming_consortium(wpa_s, cred_rc,
1741                                                                bss, only_add);
1742
1743         if (cred_3gpp &&
1744             (cred == NULL || cred_prio_cmp(cred_3gpp, cred) >= 0)) {
1745                 return interworking_connect_3gpp(wpa_s, cred_3gpp, bss,
1746                                                  only_add);
1747         }
1748
1749         if (cred == NULL) {
1750                 wpa_msg(wpa_s, MSG_DEBUG,
1751                         "Interworking: No matching credentials found for "
1752                         MACSTR, MAC2STR(bss->bssid));
1753                 return -1;
1754         }
1755
1756         realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
1757                                 &count);
1758         if (realm == NULL) {
1759                 wpa_msg(wpa_s, MSG_DEBUG,
1760                         "Interworking: Could not parse NAI Realm list from "
1761                         MACSTR, MAC2STR(bss->bssid));
1762                 return -1;
1763         }
1764
1765         for (i = 0; i < count; i++) {
1766                 if (!nai_realm_match(&realm[i], cred->realm))
1767                         continue;
1768                 eap = nai_realm_find_eap(wpa_s, cred, &realm[i]);
1769                 if (eap)
1770                         break;
1771         }
1772
1773         if (!eap) {
1774                 wpa_msg(wpa_s, MSG_DEBUG,
1775                         "Interworking: No matching credentials and EAP method found for "
1776                         MACSTR, MAC2STR(bss->bssid));
1777                 nai_realm_free(realm, count);
1778                 return -1;
1779         }
1780
1781         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR,
1782                 MAC2STR(bss->bssid));
1783
1784         if (already_connected(wpa_s, cred, bss)) {
1785                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1786                         MAC2STR(bss->bssid));
1787                 nai_realm_free(realm, count);
1788                 return 0;
1789         }
1790
1791         remove_duplicate_network(wpa_s, cred, bss);
1792
1793         ssid = wpa_config_add_network(wpa_s->conf);
1794         if (ssid == NULL) {
1795                 nai_realm_free(realm, count);
1796                 return -1;
1797         }
1798         ssid->parent_cred = cred;
1799         wpas_notify_network_added(wpa_s, ssid);
1800         wpa_config_set_network_defaults(ssid);
1801         ssid->priority = cred->priority;
1802         ssid->temporary = 1;
1803         ssid->ssid = os_zalloc(bss->ssid_len + 1);
1804         if (ssid->ssid == NULL)
1805                 goto fail;
1806         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1807         ssid->ssid_len = bss->ssid_len;
1808
1809         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1810                 goto fail;
1811
1812         if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
1813                                                      eap->method), 0) < 0)
1814                 goto fail;
1815
1816         switch (eap->method) {
1817         case EAP_TYPE_TTLS:
1818                 if (eap->inner_method) {
1819                         name = eap_get_name(EAP_VENDOR_IETF, eap->inner_method);
1820                         if (!name)
1821                                 goto fail;
1822                         os_snprintf(buf, sizeof(buf), "\"autheap=%s\"", name);
1823                         if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1824                                 goto fail;
1825                         break;
1826                 }
1827                 switch (eap->inner_non_eap) {
1828                 case NAI_REALM_INNER_NON_EAP_PAP:
1829                         if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
1830                             0)
1831                                 goto fail;
1832                         break;
1833                 case NAI_REALM_INNER_NON_EAP_CHAP:
1834                         if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
1835                             < 0)
1836                                 goto fail;
1837                         break;
1838                 case NAI_REALM_INNER_NON_EAP_MSCHAP:
1839                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
1840                                            0) < 0)
1841                                 goto fail;
1842                         break;
1843                 case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
1844                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1845                                            0) < 0)
1846                                 goto fail;
1847                         break;
1848                 default:
1849                         /* EAP params were not set - assume TTLS/MSCHAPv2 */
1850                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1851                                            0) < 0)
1852                                 goto fail;
1853                         break;
1854                 }
1855                 break;
1856         case EAP_TYPE_PEAP:
1857         case EAP_TYPE_FAST:
1858                 if (wpa_config_set(ssid, "phase1", "\"fast_provisioning=2\"",
1859                                    0) < 0)
1860                         goto fail;
1861                 if (wpa_config_set(ssid, "pac_file",
1862                                    "\"blob://pac_interworking\"", 0) < 0)
1863                         goto fail;
1864                 name = eap_get_name(EAP_VENDOR_IETF,
1865                                     eap->inner_method ? eap->inner_method :
1866                                     EAP_TYPE_MSCHAPV2);
1867                 if (name == NULL)
1868                         goto fail;
1869                 os_snprintf(buf, sizeof(buf), "\"auth=%s\"", name);
1870                 if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1871                         goto fail;
1872                 break;
1873         case EAP_TYPE_TLS:
1874                 break;
1875         }
1876
1877         if (interworking_set_eap_params(ssid, cred,
1878                                         eap->method == EAP_TYPE_TTLS) < 0)
1879                 goto fail;
1880
1881         nai_realm_free(realm, count);
1882
1883         wpa_s->next_ssid = ssid;
1884         wpa_config_update_prio_list(wpa_s->conf);
1885         if (!only_add)
1886                 interworking_reconnect(wpa_s);
1887
1888         return ssid->id;
1889
1890 fail:
1891         wpas_notify_network_removed(wpa_s, ssid);
1892         wpa_config_remove_network(wpa_s->conf, ssid->id);
1893         nai_realm_free(realm, count);
1894         return -1;
1895 }
1896
1897
1898 #ifdef PCSC_FUNCS
1899 static int interworking_pcsc_read_imsi(struct wpa_supplicant *wpa_s)
1900 {
1901         size_t len;
1902
1903         if (wpa_s->imsi[0] && wpa_s->mnc_len)
1904                 return 0;
1905
1906         len = sizeof(wpa_s->imsi) - 1;
1907         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
1908                 scard_deinit(wpa_s->scard);
1909                 wpa_s->scard = NULL;
1910                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
1911                 return -1;
1912         }
1913         wpa_s->imsi[len] = '\0';
1914         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
1915         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
1916                    wpa_s->imsi, wpa_s->mnc_len);
1917
1918         return 0;
1919 }
1920 #endif /* PCSC_FUNCS */
1921
1922
1923 static struct wpa_cred * interworking_credentials_available_3gpp(
1924         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
1925         int *excluded)
1926 {
1927         struct wpa_cred *selected = NULL;
1928 #ifdef INTERWORKING_3GPP
1929         struct wpa_cred *cred;
1930         int ret;
1931         int is_excluded = 0;
1932
1933         if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL) {
1934                 wpa_msg(wpa_s, MSG_DEBUG,
1935                         "interworking-avail-3gpp: not avail, anqp: %p  anqp_3gpp: %p",
1936                         bss->anqp, bss->anqp ? bss->anqp->anqp_3gpp : NULL);
1937                 return NULL;
1938         }
1939
1940 #ifdef CONFIG_EAP_PROXY
1941         if (!wpa_s->imsi[0]) {
1942                 size_t len;
1943                 wpa_msg(wpa_s, MSG_DEBUG,
1944                         "Interworking: IMSI not available - try to read again through eap_proxy");
1945                 wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, -1,
1946                                                              wpa_s->imsi,
1947                                                              &len);
1948                 if (wpa_s->mnc_len > 0) {
1949                         wpa_s->imsi[len] = '\0';
1950                         wpa_msg(wpa_s, MSG_DEBUG,
1951                                 "eap_proxy: IMSI %s (MNC length %d)",
1952                                 wpa_s->imsi, wpa_s->mnc_len);
1953                 } else {
1954                         wpa_msg(wpa_s, MSG_DEBUG,
1955                                 "eap_proxy: IMSI not available");
1956                 }
1957         }
1958 #endif /* CONFIG_EAP_PROXY */
1959
1960         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1961                 char *sep;
1962                 const char *imsi;
1963                 int mnc_len;
1964                 char imsi_buf[16];
1965                 size_t msin_len;
1966
1967 #ifdef PCSC_FUNCS
1968                 if (cred->pcsc && wpa_s->scard) {
1969                         if (interworking_pcsc_read_imsi(wpa_s) < 0)
1970                                 continue;
1971                         imsi = wpa_s->imsi;
1972                         mnc_len = wpa_s->mnc_len;
1973                         goto compare;
1974                 }
1975 #endif /* PCSC_FUNCS */
1976 #ifdef CONFIG_EAP_PROXY
1977                 if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
1978                         imsi = wpa_s->imsi;
1979                         mnc_len = wpa_s->mnc_len;
1980                         goto compare;
1981                 }
1982 #endif /* CONFIG_EAP_PROXY */
1983
1984                 if (cred->imsi == NULL || !cred->imsi[0] ||
1985                     (!wpa_s->conf->external_sim &&
1986                      (cred->milenage == NULL || !cred->milenage[0])))
1987                         continue;
1988
1989                 sep = os_strchr(cred->imsi, '-');
1990                 if (sep == NULL ||
1991                     (sep - cred->imsi != 5 && sep - cred->imsi != 6))
1992                         continue;
1993                 mnc_len = sep - cred->imsi - 3;
1994                 os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len);
1995                 sep++;
1996                 msin_len = os_strlen(cred->imsi);
1997                 if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1)
1998                         msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1;
1999                 os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len);
2000                 imsi_buf[3 + mnc_len + msin_len] = '\0';
2001                 imsi = imsi_buf;
2002
2003 #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
2004         compare:
2005 #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
2006                 wpa_msg(wpa_s, MSG_DEBUG,
2007                         "Interworking: Parsing 3GPP info from " MACSTR,
2008                         MAC2STR(bss->bssid));
2009                 ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
2010                 wpa_msg(wpa_s, MSG_DEBUG, "PLMN match %sfound",
2011                         ret ? "" : "not ");
2012                 if (ret) {
2013                         if (cred_no_required_oi_match(cred, bss))
2014                                 continue;
2015                         if (!ignore_bw &&
2016                             cred_below_min_backhaul(wpa_s, cred, bss))
2017                                 continue;
2018                         if (!ignore_bw &&
2019                             cred_over_max_bss_load(wpa_s, cred, bss))
2020                                 continue;
2021                         if (!ignore_bw &&
2022                             cred_conn_capab_missing(wpa_s, cred, bss))
2023                                 continue;
2024                         if (cred_excluded_ssid(cred, bss)) {
2025                                 if (excluded == NULL)
2026                                         continue;
2027                                 if (selected == NULL) {
2028                                         selected = cred;
2029                                         is_excluded = 1;
2030                                 }
2031                         } else {
2032                                 if (selected == NULL || is_excluded ||
2033                                     cred_prio_cmp(selected, cred) < 0) {
2034                                         selected = cred;
2035                                         is_excluded = 0;
2036                                 }
2037                         }
2038                 }
2039         }
2040
2041         if (excluded)
2042                 *excluded = is_excluded;
2043 #endif /* INTERWORKING_3GPP */
2044         return selected;
2045 }
2046
2047
2048 static struct wpa_cred * interworking_credentials_available_realm(
2049         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
2050         int *excluded)
2051 {
2052         struct wpa_cred *cred, *selected = NULL;
2053         struct nai_realm *realm;
2054         u16 count, i;
2055         int is_excluded = 0;
2056
2057         if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
2058                 return NULL;
2059
2060         if (wpa_s->conf->cred == NULL)
2061                 return NULL;
2062
2063         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
2064                 MACSTR, MAC2STR(bss->bssid));
2065         realm = nai_realm_parse(bss->anqp->nai_realm, &count);
2066         if (realm == NULL) {
2067                 wpa_msg(wpa_s, MSG_DEBUG,
2068                         "Interworking: Could not parse NAI Realm list from "
2069                         MACSTR, MAC2STR(bss->bssid));
2070                 return NULL;
2071         }
2072
2073         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2074                 if (cred->realm == NULL)
2075                         continue;
2076
2077                 for (i = 0; i < count; i++) {
2078                         if (!nai_realm_match(&realm[i], cred->realm))
2079                                 continue;
2080                         if (nai_realm_find_eap(wpa_s, cred, &realm[i])) {
2081                                 if (cred_no_required_oi_match(cred, bss))
2082                                         continue;
2083                                 if (!ignore_bw &&
2084                                     cred_below_min_backhaul(wpa_s, cred, bss))
2085                                         continue;
2086                                 if (!ignore_bw &&
2087                                     cred_over_max_bss_load(wpa_s, cred, bss))
2088                                         continue;
2089                                 if (!ignore_bw &&
2090                                     cred_conn_capab_missing(wpa_s, cred, bss))
2091                                         continue;
2092                                 if (cred_excluded_ssid(cred, bss)) {
2093                                         if (excluded == NULL)
2094                                                 continue;
2095                                         if (selected == NULL) {
2096                                                 selected = cred;
2097                                                 is_excluded = 1;
2098                                         }
2099                                 } else {
2100                                         if (selected == NULL || is_excluded ||
2101                                             cred_prio_cmp(selected, cred) < 0)
2102                                         {
2103                                                 selected = cred;
2104                                                 is_excluded = 0;
2105                                         }
2106                                 }
2107                                 break;
2108                         } else {
2109                                 wpa_msg(wpa_s, MSG_DEBUG,
2110                                         "Interworking: realm-find-eap returned false");
2111                         }
2112                 }
2113         }
2114
2115         nai_realm_free(realm, count);
2116
2117         if (excluded)
2118                 *excluded = is_excluded;
2119
2120         return selected;
2121 }
2122
2123
2124 static struct wpa_cred * interworking_credentials_available_helper(
2125         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
2126         int *excluded)
2127 {
2128         struct wpa_cred *cred, *cred2;
2129         int excluded1, excluded2 = 0;
2130
2131         if (disallowed_bssid(wpa_s, bss->bssid) ||
2132             disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
2133                 wpa_printf(MSG_DEBUG, "Interworking: Ignore disallowed BSS "
2134                            MACSTR, MAC2STR(bss->bssid));
2135                 return NULL;
2136         }
2137
2138         cred = interworking_credentials_available_realm(wpa_s, bss, ignore_bw,
2139                                                         &excluded1);
2140         cred2 = interworking_credentials_available_3gpp(wpa_s, bss, ignore_bw,
2141                                                         &excluded2);
2142         if (cred && cred2 &&
2143             (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
2144                 cred = cred2;
2145                 excluded1 = excluded2;
2146         }
2147         if (!cred) {
2148                 cred = cred2;
2149                 excluded1 = excluded2;
2150         }
2151
2152         cred2 = interworking_credentials_available_roaming_consortium(
2153                 wpa_s, bss, ignore_bw, &excluded2);
2154         if (cred && cred2 &&
2155             (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
2156                 cred = cred2;
2157                 excluded1 = excluded2;
2158         }
2159         if (!cred) {
2160                 cred = cred2;
2161                 excluded1 = excluded2;
2162         }
2163
2164         if (excluded)
2165                 *excluded = excluded1;
2166         return cred;
2167 }
2168
2169
2170 static struct wpa_cred * interworking_credentials_available(
2171         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int *excluded)
2172 {
2173         struct wpa_cred *cred;
2174
2175         if (excluded)
2176                 *excluded = 0;
2177         cred = interworking_credentials_available_helper(wpa_s, bss, 0,
2178                                                          excluded);
2179         if (cred)
2180                 return cred;
2181         return interworking_credentials_available_helper(wpa_s, bss, 1,
2182                                                          excluded);
2183 }
2184
2185
2186 int domain_name_list_contains(struct wpabuf *domain_names,
2187                               const char *domain, int exact_match)
2188 {
2189         const u8 *pos, *end;
2190         size_t len;
2191
2192         len = os_strlen(domain);
2193         pos = wpabuf_head(domain_names);
2194         end = pos + wpabuf_len(domain_names);
2195
2196         while (end - pos > 1) {
2197                 u8 elen;
2198
2199                 elen = *pos++;
2200                 if (elen > end - pos)
2201                         break;
2202
2203                 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
2204                                   pos, elen);
2205                 if (elen == len &&
2206                     os_strncasecmp(domain, (const char *) pos, len) == 0)
2207                         return 1;
2208                 if (!exact_match && elen > len && pos[elen - len - 1] == '.') {
2209                         const char *ap = (const char *) pos;
2210                         int offset = elen - len;
2211
2212                         if (os_strncasecmp(domain, ap + offset, len) == 0)
2213                                 return 1;
2214                 }
2215
2216                 pos += elen;
2217         }
2218
2219         return 0;
2220 }
2221
2222
2223 int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
2224                               struct wpa_cred *cred,
2225                               struct wpabuf *domain_names)
2226 {
2227         size_t i;
2228         int ret = -1;
2229 #ifdef INTERWORKING_3GPP
2230         char nai[100], *realm;
2231
2232         char *imsi = NULL;
2233         int mnc_len = 0;
2234         if (cred->imsi)
2235                 imsi = cred->imsi;
2236 #ifdef PCSC_FUNCS
2237         else if (cred->pcsc && wpa_s->scard) {
2238                 if (interworking_pcsc_read_imsi(wpa_s) < 0)
2239                         return -1;
2240                 imsi = wpa_s->imsi;
2241                 mnc_len = wpa_s->mnc_len;
2242         }
2243 #endif /* PCSC_FUNCS */
2244 #ifdef CONFIG_EAP_PROXY
2245         else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
2246                 imsi = wpa_s->imsi;
2247                 mnc_len = wpa_s->mnc_len;
2248         }
2249 #endif /* CONFIG_EAP_PROXY */
2250         if (domain_names &&
2251             imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
2252                 realm = os_strchr(nai, '@');
2253                 if (realm)
2254                         realm++;
2255                 wpa_msg(wpa_s, MSG_DEBUG,
2256                         "Interworking: Search for match with SIM/USIM domain %s",
2257                         realm);
2258                 if (realm &&
2259                     domain_name_list_contains(domain_names, realm, 1))
2260                         return 1;
2261                 if (realm)
2262                         ret = 0;
2263         }
2264 #endif /* INTERWORKING_3GPP */
2265
2266         if (domain_names == NULL || cred->domain == NULL)
2267                 return ret;
2268
2269         for (i = 0; i < cred->num_domain; i++) {
2270                 wpa_msg(wpa_s, MSG_DEBUG,
2271                         "Interworking: Search for match with home SP FQDN %s",
2272                         cred->domain[i]);
2273                 if (domain_name_list_contains(domain_names, cred->domain[i], 1))
2274                         return 1;
2275         }
2276
2277         return 0;
2278 }
2279
2280
2281 static int interworking_home_sp(struct wpa_supplicant *wpa_s,
2282                                 struct wpabuf *domain_names)
2283 {
2284         struct wpa_cred *cred;
2285
2286         if (domain_names == NULL || wpa_s->conf->cred == NULL)
2287                 return -1;
2288
2289         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2290                 int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
2291                 if (res)
2292                         return res;
2293         }
2294
2295         return 0;
2296 }
2297
2298
2299 static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
2300 {
2301         struct wpa_bss *bss;
2302         struct wpa_ssid *ssid;
2303
2304         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2305                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
2306                         if (wpas_network_disabled(wpa_s, ssid) ||
2307                             ssid->mode != WPAS_MODE_INFRA)
2308                                 continue;
2309                         if (ssid->ssid_len != bss->ssid_len ||
2310                             os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
2311                             0)
2312                                 continue;
2313                         /*
2314                          * TODO: Consider more accurate matching of security
2315                          * configuration similarly to what is done in events.c
2316                          */
2317                         return 1;
2318                 }
2319         }
2320
2321         return 0;
2322 }
2323
2324
2325 static int roaming_partner_match(struct wpa_supplicant *wpa_s,
2326                                  struct roaming_partner *partner,
2327                                  struct wpabuf *domain_names)
2328 {
2329         wpa_printf(MSG_DEBUG, "Interworking: Comparing roaming_partner info fqdn='%s' exact_match=%d priority=%u country='%s'",
2330                    partner->fqdn, partner->exact_match, partner->priority,
2331                    partner->country);
2332         wpa_hexdump_ascii(MSG_DEBUG, "Interworking: Domain names",
2333                           wpabuf_head(domain_names),
2334                           wpabuf_len(domain_names));
2335         if (!domain_name_list_contains(domain_names, partner->fqdn,
2336                                        partner->exact_match))
2337                 return 0;
2338         /* TODO: match Country */
2339         return 1;
2340 }
2341
2342
2343 static u8 roaming_prio(struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
2344                        struct wpa_bss *bss)
2345 {
2346         size_t i;
2347
2348         if (bss->anqp == NULL || bss->anqp->domain_name == NULL) {
2349                 wpa_printf(MSG_DEBUG, "Interworking: No ANQP domain name info -> use default roaming partner priority 128");
2350                 return 128; /* cannot check preference with domain name */
2351         }
2352
2353         if (interworking_home_sp_cred(wpa_s, cred, bss->anqp->domain_name) > 0)
2354         {
2355                 wpa_printf(MSG_DEBUG, "Interworking: Determined to be home SP -> use maximum preference 0 as roaming partner priority");
2356                 return 0; /* max preference for home SP network */
2357         }
2358
2359         for (i = 0; i < cred->num_roaming_partner; i++) {
2360                 if (roaming_partner_match(wpa_s, &cred->roaming_partner[i],
2361                                           bss->anqp->domain_name)) {
2362                         wpa_printf(MSG_DEBUG, "Interworking: Roaming partner preference match - priority %u",
2363                                    cred->roaming_partner[i].priority);
2364                         return cred->roaming_partner[i].priority;
2365                 }
2366         }
2367
2368         wpa_printf(MSG_DEBUG, "Interworking: No roaming partner preference match - use default roaming partner priority 128");
2369         return 128;
2370 }
2371
2372
2373 static struct wpa_bss * pick_best_roaming_partner(struct wpa_supplicant *wpa_s,
2374                                                   struct wpa_bss *selected,
2375                                                   struct wpa_cred *cred)
2376 {
2377         struct wpa_bss *bss;
2378         u8 best_prio, prio;
2379         struct wpa_cred *cred2;
2380
2381         /*
2382          * Check if any other BSS is operated by a more preferred roaming
2383          * partner.
2384          */
2385
2386         best_prio = roaming_prio(wpa_s, cred, selected);
2387         wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for selected BSS "
2388                    MACSTR " (cred=%d)", best_prio, MAC2STR(selected->bssid),
2389                    cred->id);
2390
2391         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2392                 if (bss == selected)
2393                         continue;
2394                 cred2 = interworking_credentials_available(wpa_s, bss, NULL);
2395                 if (!cred2)
2396                         continue;
2397                 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN))
2398                         continue;
2399                 prio = roaming_prio(wpa_s, cred2, bss);
2400                 wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for BSS "
2401                            MACSTR " (cred=%d)", prio, MAC2STR(bss->bssid),
2402                            cred2->id);
2403                 if (prio < best_prio) {
2404                         int bh1, bh2, load1, load2, conn1, conn2;
2405                         bh1 = cred_below_min_backhaul(wpa_s, cred, selected);
2406                         load1 = cred_over_max_bss_load(wpa_s, cred, selected);
2407                         conn1 = cred_conn_capab_missing(wpa_s, cred, selected);
2408                         bh2 = cred_below_min_backhaul(wpa_s, cred2, bss);
2409                         load2 = cred_over_max_bss_load(wpa_s, cred2, bss);
2410                         conn2 = cred_conn_capab_missing(wpa_s, cred2, bss);
2411                         wpa_printf(MSG_DEBUG, "Interworking: old: %d %d %d  new: %d %d %d",
2412                                    bh1, load1, conn1, bh2, load2, conn2);
2413                         if (bh1 || load1 || conn1 || !(bh2 || load2 || conn2)) {
2414                                 wpa_printf(MSG_DEBUG, "Interworking: Better roaming partner " MACSTR " selected", MAC2STR(bss->bssid));
2415                                 best_prio = prio;
2416                                 selected = bss;
2417                         }
2418                 }
2419         }
2420
2421         return selected;
2422 }
2423
2424
2425 static void interworking_select_network(struct wpa_supplicant *wpa_s)
2426 {
2427         struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
2428         struct wpa_bss *selected2 = NULL, *selected2_home = NULL;
2429         unsigned int count = 0;
2430         const char *type;
2431         int res;
2432         struct wpa_cred *cred, *selected_cred = NULL;
2433         struct wpa_cred *selected_home_cred = NULL;
2434         struct wpa_cred *selected2_cred = NULL;
2435         struct wpa_cred *selected2_home_cred = NULL;
2436
2437         wpa_s->network_select = 0;
2438
2439         wpa_printf(MSG_DEBUG, "Interworking: Select network (auto_select=%d)",
2440                    wpa_s->auto_select);
2441         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2442                 int excluded = 0;
2443                 int bh, bss_load, conn_capab;
2444                 cred = interworking_credentials_available(wpa_s, bss,
2445                                                           &excluded);
2446                 if (!cred)
2447                         continue;
2448
2449                 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
2450                         /*
2451                          * We currently support only HS 2.0 networks and those
2452                          * are required to use WPA2-Enterprise.
2453                          */
2454                         wpa_msg(wpa_s, MSG_DEBUG,
2455                                 "Interworking: Credential match with " MACSTR
2456                                 " but network does not use RSN",
2457                                 MAC2STR(bss->bssid));
2458                         continue;
2459                 }
2460                 if (!excluded)
2461                         count++;
2462                 res = interworking_home_sp(wpa_s, bss->anqp ?
2463                                            bss->anqp->domain_name : NULL);
2464                 if (res > 0)
2465                         type = "home";
2466                 else if (res == 0)
2467                         type = "roaming";
2468                 else
2469                         type = "unknown";
2470                 bh = cred_below_min_backhaul(wpa_s, cred, bss);
2471                 bss_load = cred_over_max_bss_load(wpa_s, cred, bss);
2472                 conn_capab = cred_conn_capab_missing(wpa_s, cred, bss);
2473                 wpa_msg(wpa_s, MSG_INFO, "%s" MACSTR " type=%s%s%s%s id=%d priority=%d sp_priority=%d",
2474                         excluded ? INTERWORKING_BLACKLISTED : INTERWORKING_AP,
2475                         MAC2STR(bss->bssid), type,
2476                         bh ? " below_min_backhaul=1" : "",
2477                         bss_load ? " over_max_bss_load=1" : "",
2478                         conn_capab ? " conn_capab_missing=1" : "",
2479                         cred->id, cred->priority, cred->sp_priority);
2480                 if (excluded)
2481                         continue;
2482                 if (wpa_s->auto_select ||
2483                     (wpa_s->conf->auto_interworking &&
2484                      wpa_s->auto_network_select)) {
2485                         if (bh || bss_load || conn_capab) {
2486                                 if (selected2_cred == NULL ||
2487                                     cred_prio_cmp(cred, selected2_cred) > 0) {
2488                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2");
2489                                         selected2 = bss;
2490                                         selected2_cred = cred;
2491                                 }
2492                                 if (res > 0 &&
2493                                     (selected2_home_cred == NULL ||
2494                                      cred_prio_cmp(cred, selected2_home_cred) >
2495                                      0)) {
2496                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2_home");
2497                                         selected2_home = bss;
2498                                         selected2_home_cred = cred;
2499                                 }
2500                         } else {
2501                                 if (selected_cred == NULL ||
2502                                     cred_prio_cmp(cred, selected_cred) > 0) {
2503                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected");
2504                                         selected = bss;
2505                                         selected_cred = cred;
2506                                 }
2507                                 if (res > 0 &&
2508                                     (selected_home_cred == NULL ||
2509                                      cred_prio_cmp(cred, selected_home_cred) >
2510                                      0)) {
2511                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected_home");
2512                                         selected_home = bss;
2513                                         selected_home_cred = cred;
2514                                 }
2515                         }
2516                 }
2517         }
2518
2519         if (selected_home && selected_home != selected &&
2520             selected_home_cred &&
2521             (selected_cred == NULL ||
2522              cred_prio_cmp(selected_home_cred, selected_cred) >= 0)) {
2523                 /* Prefer network operated by the Home SP */
2524                 wpa_printf(MSG_DEBUG, "Interworking: Overrided selected with selected_home");
2525                 selected = selected_home;
2526                 selected_cred = selected_home_cred;
2527         }
2528
2529         if (!selected) {
2530                 if (selected2_home) {
2531                         wpa_printf(MSG_DEBUG, "Interworking: Use home BSS with BW limit mismatch since no other network could be selected");
2532                         selected = selected2_home;
2533                         selected_cred = selected2_home_cred;
2534                 } else if (selected2) {
2535                         wpa_printf(MSG_DEBUG, "Interworking: Use visited BSS with BW limit mismatch since no other network could be selected");
2536                         selected = selected2;
2537                         selected_cred = selected2_cred;
2538                 }
2539         }
2540
2541         if (count == 0) {
2542                 /*
2543                  * No matching network was found based on configured
2544                  * credentials. Check whether any of the enabled network blocks
2545                  * have matching APs.
2546                  */
2547                 if (interworking_find_network_match(wpa_s)) {
2548                         wpa_msg(wpa_s, MSG_DEBUG,
2549                                 "Interworking: Possible BSS match for enabled network configurations");
2550                         if (wpa_s->auto_select) {
2551                                 interworking_reconnect(wpa_s);
2552                                 return;
2553                         }
2554                 }
2555
2556                 if (wpa_s->auto_network_select) {
2557                         wpa_msg(wpa_s, MSG_DEBUG,
2558                                 "Interworking: Continue scanning after ANQP fetch");
2559                         wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
2560                                                 0);
2561                         return;
2562                 }
2563
2564                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
2565                         "with matching credentials found");
2566                 if (wpa_s->wpa_state == WPA_SCANNING)
2567                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2568         }
2569
2570         if (selected) {
2571                 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR,
2572                            MAC2STR(selected->bssid));
2573                 selected = pick_best_roaming_partner(wpa_s, selected,
2574                                                      selected_cred);
2575                 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR
2576                            " (after best roaming partner selection)",
2577                            MAC2STR(selected->bssid));
2578                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_SELECTED MACSTR,
2579                         MAC2STR(selected->bssid));
2580                 interworking_connect(wpa_s, selected, 0);
2581         } else if (wpa_s->wpa_state == WPA_SCANNING)
2582                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2583 }
2584
2585
2586 static struct wpa_bss_anqp *
2587 interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
2588 {
2589         struct wpa_bss *other;
2590
2591         if (is_zero_ether_addr(bss->hessid))
2592                 return NULL; /* Cannot be in the same homegenous ESS */
2593
2594         dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
2595                 if (other == bss)
2596                         continue;
2597                 if (other->anqp == NULL)
2598                         continue;
2599                 if (other->anqp->roaming_consortium == NULL &&
2600                     other->anqp->nai_realm == NULL &&
2601                     other->anqp->anqp_3gpp == NULL &&
2602                     other->anqp->domain_name == NULL)
2603                         continue;
2604                 if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
2605                         continue;
2606                 if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
2607                         continue;
2608                 if (bss->ssid_len != other->ssid_len ||
2609                     os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
2610                         continue;
2611
2612                 wpa_msg(wpa_s, MSG_DEBUG,
2613                         "Interworking: Share ANQP data with already fetched BSSID "
2614                         MACSTR " and " MACSTR,
2615                         MAC2STR(other->bssid), MAC2STR(bss->bssid));
2616                 other->anqp->users++;
2617                 return other->anqp;
2618         }
2619
2620         return NULL;
2621 }
2622
2623
2624 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
2625 {
2626         struct wpa_bss *bss;
2627         int found = 0;
2628         const u8 *ie;
2629
2630         wpa_printf(MSG_DEBUG, "Interworking: next_anqp_fetch - "
2631                    "fetch_anqp_in_progress=%d fetch_osu_icon_in_progress=%d",
2632                    wpa_s->fetch_anqp_in_progress,
2633                    wpa_s->fetch_osu_icon_in_progress);
2634
2635         if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress) {
2636                 wpa_printf(MSG_DEBUG, "Interworking: Stop next-ANQP-fetch");
2637                 return;
2638         }
2639
2640 #ifdef CONFIG_HS20
2641         if (wpa_s->fetch_osu_icon_in_progress) {
2642                 wpa_printf(MSG_DEBUG, "Interworking: Next icon (in progress)");
2643                 hs20_next_osu_icon(wpa_s);
2644                 return;
2645         }
2646 #endif /* CONFIG_HS20 */
2647
2648         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2649                 if (!(bss->caps & IEEE80211_CAP_ESS))
2650                         continue;
2651                 ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
2652                 if (ie == NULL || ie[1] < 4 || !(ie[5] & 0x80))
2653                         continue; /* AP does not support Interworking */
2654                 if (disallowed_bssid(wpa_s, bss->bssid) ||
2655                     disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len))
2656                         continue; /* Disallowed BSS */
2657
2658                 if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
2659                         if (bss->anqp == NULL) {
2660                                 bss->anqp = interworking_match_anqp_info(wpa_s,
2661                                                                          bss);
2662                                 if (bss->anqp) {
2663                                         /* Shared data already fetched */
2664                                         continue;
2665                                 }
2666                                 bss->anqp = wpa_bss_anqp_alloc();
2667                                 if (bss->anqp == NULL)
2668                                         break;
2669                         }
2670                         found++;
2671                         bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
2672                         wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
2673                                 MACSTR, MAC2STR(bss->bssid));
2674                         interworking_anqp_send_req(wpa_s, bss);
2675                         break;
2676                 }
2677         }
2678
2679         if (found == 0) {
2680 #ifdef CONFIG_HS20
2681                 if (wpa_s->fetch_osu_info) {
2682                         if (wpa_s->num_prov_found == 0 &&
2683                             wpa_s->fetch_osu_waiting_scan &&
2684                             wpa_s->num_osu_scans < 3) {
2685                                 wpa_printf(MSG_DEBUG, "HS 2.0: No OSU providers seen - try to scan again");
2686                                 hs20_start_osu_scan(wpa_s);
2687                                 return;
2688                         }
2689                         wpa_printf(MSG_DEBUG, "Interworking: Next icon");
2690                         hs20_osu_icon_fetch(wpa_s);
2691                         return;
2692                 }
2693 #endif /* CONFIG_HS20 */
2694                 wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
2695                 wpa_s->fetch_anqp_in_progress = 0;
2696                 if (wpa_s->network_select)
2697                         interworking_select_network(wpa_s);
2698         }
2699 }
2700
2701
2702 void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
2703 {
2704         struct wpa_bss *bss;
2705
2706         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
2707                 bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
2708
2709         wpa_s->fetch_anqp_in_progress = 1;
2710
2711         /*
2712          * Start actual ANQP operation from eloop call to make sure the loop
2713          * does not end up using excessive recursion.
2714          */
2715         eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s, NULL);
2716 }
2717
2718
2719 int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
2720 {
2721         if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
2722                 return 0;
2723
2724         wpa_s->network_select = 0;
2725         wpa_s->fetch_all_anqp = 1;
2726         wpa_s->fetch_osu_info = 0;
2727
2728         interworking_start_fetch_anqp(wpa_s);
2729
2730         return 0;
2731 }
2732
2733
2734 void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
2735 {
2736         if (!wpa_s->fetch_anqp_in_progress)
2737                 return;
2738
2739         wpa_s->fetch_anqp_in_progress = 0;
2740 }
2741
2742
2743 int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
2744                   u16 info_ids[], size_t num_ids, u32 subtypes,
2745                   u32 mbo_subtypes)
2746 {
2747         struct wpabuf *buf;
2748         struct wpabuf *extra_buf = NULL;
2749         int ret = 0;
2750         int freq;
2751         struct wpa_bss *bss;
2752         int res;
2753
2754         bss = wpa_bss_get_bssid(wpa_s, dst);
2755         if (!bss) {
2756                 wpa_printf(MSG_WARNING,
2757                            "ANQP: Cannot send query to unknown BSS "
2758                            MACSTR, MAC2STR(dst));
2759                 return -1;
2760         }
2761
2762         wpa_bss_anqp_unshare_alloc(bss);
2763         freq = bss->freq;
2764
2765         wpa_msg(wpa_s, MSG_DEBUG,
2766                 "ANQP: Query Request to " MACSTR " for %u id(s)",
2767                 MAC2STR(dst), (unsigned int) num_ids);
2768
2769 #ifdef CONFIG_HS20
2770         if (subtypes != 0) {
2771                 extra_buf = wpabuf_alloc(100);
2772                 if (extra_buf == NULL)
2773                         return -1;
2774                 hs20_put_anqp_req(subtypes, NULL, 0, extra_buf);
2775         }
2776 #endif /* CONFIG_HS20 */
2777
2778 #ifdef CONFIG_MBO
2779         if (mbo_subtypes) {
2780                 struct wpabuf *mbo;
2781
2782                 mbo = mbo_build_anqp_buf(wpa_s, bss, mbo_subtypes);
2783                 if (mbo) {
2784                         if (wpabuf_resize(&extra_buf, wpabuf_len(mbo))) {
2785                                 wpabuf_free(extra_buf);
2786                                 wpabuf_free(mbo);
2787                                 return -1;
2788                         }
2789                         wpabuf_put_buf(extra_buf, mbo);
2790                         wpabuf_free(mbo);
2791                 }
2792         }
2793 #endif /* CONFIG_MBO */
2794
2795         buf = anqp_build_req(info_ids, num_ids, extra_buf);
2796         wpabuf_free(extra_buf);
2797         if (buf == NULL)
2798                 return -1;
2799
2800         res = gas_query_req(wpa_s->gas, dst, freq, 0, buf, anqp_resp_cb, wpa_s);
2801         if (res < 0) {
2802                 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
2803                 wpabuf_free(buf);
2804                 ret = -1;
2805         } else {
2806                 wpa_msg(wpa_s, MSG_DEBUG,
2807                         "ANQP: Query started with dialog token %u", res);
2808         }
2809
2810         return ret;
2811 }
2812
2813
2814 static void anqp_add_extra(struct wpa_supplicant *wpa_s,
2815                            struct wpa_bss_anqp *anqp, u16 info_id,
2816                            const u8 *data, size_t slen)
2817 {
2818         struct wpa_bss_anqp_elem *tmp, *elem = NULL;
2819
2820         if (!anqp)
2821                 return;
2822
2823         dl_list_for_each(tmp, &anqp->anqp_elems, struct wpa_bss_anqp_elem,
2824                          list) {
2825                 if (tmp->infoid == info_id) {
2826                         elem = tmp;
2827                         break;
2828                 }
2829         }
2830
2831         if (!elem) {
2832                 elem = os_zalloc(sizeof(*elem));
2833                 if (!elem)
2834                         return;
2835                 elem->infoid = info_id;
2836                 dl_list_add(&anqp->anqp_elems, &elem->list);
2837         } else {
2838                 wpabuf_free(elem->payload);
2839         }
2840
2841         elem->payload = wpabuf_alloc_copy(data, slen);
2842         if (!elem->payload) {
2843                 dl_list_del(&elem->list);
2844                 os_free(elem);
2845         }
2846 }
2847
2848
2849 static void interworking_parse_venue_url(struct wpa_supplicant *wpa_s,
2850                                          const u8 *data, size_t len)
2851 {
2852         const u8 *pos = data, *end = data + len;
2853         char url[255];
2854
2855         while (end - pos >= 2) {
2856                 u8 slen, num;
2857
2858                 slen = *pos++;
2859                 if (slen < 1 || slen > end - pos) {
2860                         wpa_printf(MSG_DEBUG,
2861                                    "ANQP: Truncated Venue URL Duple field");
2862                         return;
2863                 }
2864
2865                 num = *pos++;
2866                 os_memcpy(url, pos, slen - 1);
2867                 url[slen - 1] = '\0';
2868                 wpa_msg(wpa_s, MSG_INFO, RX_VENUE_URL "%u %s", num, url);
2869                 pos += slen - 1;
2870         }
2871 }
2872
2873
2874 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
2875                                             struct wpa_bss *bss, const u8 *sa,
2876                                             u16 info_id,
2877                                             const u8 *data, size_t slen,
2878                                             u8 dialog_token)
2879 {
2880         const u8 *pos = data;
2881         struct wpa_bss_anqp *anqp = NULL;
2882         u8 type;
2883
2884         if (bss)
2885                 anqp = bss->anqp;
2886
2887         switch (info_id) {
2888         case ANQP_CAPABILITY_LIST:
2889                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2890                         " ANQP Capability list", MAC2STR(sa));
2891                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Capability list",
2892                                   pos, slen);
2893                 if (anqp) {
2894                         wpabuf_free(anqp->capability_list);
2895                         anqp->capability_list = wpabuf_alloc_copy(pos, slen);
2896                 }
2897                 break;
2898         case ANQP_VENUE_NAME:
2899                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2900                         " Venue Name", MAC2STR(sa));
2901                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
2902                 if (anqp) {
2903                         wpabuf_free(anqp->venue_name);
2904                         anqp->venue_name = wpabuf_alloc_copy(pos, slen);
2905                 }
2906                 break;
2907         case ANQP_NETWORK_AUTH_TYPE:
2908                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2909                         " Network Authentication Type information",
2910                         MAC2STR(sa));
2911                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
2912                                   "Type", pos, slen);
2913                 if (anqp) {
2914                         wpabuf_free(anqp->network_auth_type);
2915                         anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
2916                 }
2917                 break;
2918         case ANQP_ROAMING_CONSORTIUM:
2919                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2920                         " Roaming Consortium list", MAC2STR(sa));
2921                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
2922                                   pos, slen);
2923                 if (anqp) {
2924                         wpabuf_free(anqp->roaming_consortium);
2925                         anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
2926                 }
2927                 break;
2928         case ANQP_IP_ADDR_TYPE_AVAILABILITY:
2929                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2930                         " IP Address Type Availability information",
2931                         MAC2STR(sa));
2932                 wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
2933                             pos, slen);
2934                 if (anqp) {
2935                         wpabuf_free(anqp->ip_addr_type_availability);
2936                         anqp->ip_addr_type_availability =
2937                                 wpabuf_alloc_copy(pos, slen);
2938                 }
2939                 break;
2940         case ANQP_NAI_REALM:
2941                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2942                         " NAI Realm list", MAC2STR(sa));
2943                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
2944                 if (anqp) {
2945                         wpabuf_free(anqp->nai_realm);
2946                         anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
2947                 }
2948                 break;
2949         case ANQP_3GPP_CELLULAR_NETWORK:
2950                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2951                         " 3GPP Cellular Network information", MAC2STR(sa));
2952                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
2953                                   pos, slen);
2954                 if (anqp) {
2955                         wpabuf_free(anqp->anqp_3gpp);
2956                         anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
2957                 }
2958                 break;
2959         case ANQP_DOMAIN_NAME:
2960                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2961                         " Domain Name list", MAC2STR(sa));
2962                 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
2963                 if (anqp) {
2964                         wpabuf_free(anqp->domain_name);
2965                         anqp->domain_name = wpabuf_alloc_copy(pos, slen);
2966                 }
2967                 break;
2968 #ifdef CONFIG_FILS
2969         case ANQP_FILS_REALM_INFO:
2970                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2971                         " FILS Realm Information", MAC2STR(sa));
2972                 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: FILS Realm Information",
2973                         pos, slen);
2974                 if (anqp) {
2975                         wpabuf_free(anqp->fils_realm_info);
2976                         anqp->fils_realm_info = wpabuf_alloc_copy(pos, slen);
2977                 }
2978                 break;
2979 #endif /* CONFIG_FILS */
2980         case ANQP_VENUE_URL:
2981                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR " Venue URL",
2982                         MAC2STR(sa));
2983                 anqp_add_extra(wpa_s, anqp, info_id, pos, slen);
2984
2985                 if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
2986                         wpa_printf(MSG_DEBUG,
2987                                    "ANQP: Ignore Venue URL since PMF was not enabled");
2988                         break;
2989                 }
2990                 interworking_parse_venue_url(wpa_s, pos, slen);
2991                 break;
2992         case ANQP_VENDOR_SPECIFIC:
2993                 if (slen < 3)
2994                         return;
2995
2996                 switch (WPA_GET_BE24(pos)) {
2997                 case OUI_WFA:
2998                         pos += 3;
2999                         slen -= 3;
3000
3001                         if (slen < 1)
3002                                 return;
3003                         type = *pos++;
3004                         slen--;
3005
3006                         switch (type) {
3007 #ifdef CONFIG_HS20
3008                         case HS20_ANQP_OUI_TYPE:
3009                                 hs20_parse_rx_hs20_anqp_resp(wpa_s, bss, sa,
3010                                                              pos, slen,
3011                                                              dialog_token);
3012                                 break;
3013 #endif /* CONFIG_HS20 */
3014 #ifdef CONFIG_MBO
3015                         case MBO_ANQP_OUI_TYPE:
3016                                 mbo_parse_rx_anqp_resp(wpa_s, bss, sa,
3017                                                        pos, slen);
3018                                 break;
3019 #endif /* CONFIG_MBO */
3020                         default:
3021                                 wpa_msg(wpa_s, MSG_DEBUG,
3022                                         "ANQP: Unsupported ANQP vendor type %u",
3023                                         type);
3024                                 break;
3025                         }
3026                         break;
3027                 default:
3028                         wpa_msg(wpa_s, MSG_DEBUG,
3029                                 "Interworking: Unsupported vendor-specific ANQP OUI %06x",
3030                                 WPA_GET_BE24(pos));
3031                         return;
3032                 }
3033                 break;
3034         default:
3035                 wpa_msg(wpa_s, MSG_DEBUG,
3036                         "Interworking: Unsupported ANQP Info ID %u", info_id);
3037                 anqp_add_extra(wpa_s, anqp, info_id, data, slen);
3038                 break;
3039         }
3040 }
3041
3042
3043 void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
3044                   enum gas_query_result result,
3045                   const struct wpabuf *adv_proto,
3046                   const struct wpabuf *resp, u16 status_code)
3047 {
3048         struct wpa_supplicant *wpa_s = ctx;
3049         const u8 *pos;
3050         const u8 *end;
3051         u16 info_id;
3052         u16 slen;
3053         struct wpa_bss *bss = NULL, *tmp;
3054         const char *anqp_result = "SUCCESS";
3055
3056         wpa_printf(MSG_DEBUG, "Interworking: anqp_resp_cb dst=" MACSTR
3057                    " dialog_token=%u result=%d status_code=%u",
3058                    MAC2STR(dst), dialog_token, result, status_code);
3059         if (result != GAS_QUERY_SUCCESS) {
3060 #ifdef CONFIG_HS20
3061                 if (wpa_s->fetch_osu_icon_in_progress)
3062                         hs20_icon_fetch_failed(wpa_s);
3063 #endif /* CONFIG_HS20 */
3064                 anqp_result = "FAILURE";
3065                 goto out;
3066         }
3067
3068         pos = wpabuf_head(adv_proto);
3069         if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
3070             pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
3071                 wpa_msg(wpa_s, MSG_DEBUG,
3072                         "ANQP: Unexpected Advertisement Protocol in response");
3073 #ifdef CONFIG_HS20
3074                 if (wpa_s->fetch_osu_icon_in_progress)
3075                         hs20_icon_fetch_failed(wpa_s);
3076 #endif /* CONFIG_HS20 */
3077                 anqp_result = "INVALID_FRAME";
3078                 goto out;
3079         }
3080
3081         /*
3082          * If possible, select the BSS entry based on which BSS entry was used
3083          * for the request. This can help in cases where multiple BSS entries
3084          * may exist for the same AP.
3085          */
3086         dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
3087                 if (tmp == wpa_s->interworking_gas_bss &&
3088                     os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
3089                         bss = tmp;
3090                         break;
3091                 }
3092         }
3093         if (bss == NULL)
3094                 bss = wpa_bss_get_bssid(wpa_s, dst);
3095
3096         pos = wpabuf_head(resp);
3097         end = pos + wpabuf_len(resp);
3098
3099         while (pos < end) {
3100                 unsigned int left = end - pos;
3101
3102                 if (left < 4) {
3103                         wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Invalid element");
3104                         anqp_result = "INVALID_FRAME";
3105                         goto out_parse_done;
3106                 }
3107                 info_id = WPA_GET_LE16(pos);
3108                 pos += 2;
3109                 slen = WPA_GET_LE16(pos);
3110                 pos += 2;
3111                 left -= 4;
3112                 if (left < slen) {
3113                         wpa_msg(wpa_s, MSG_DEBUG,
3114                                 "ANQP: Invalid element length for Info ID %u",
3115                                 info_id);
3116                         anqp_result = "INVALID_FRAME";
3117                         goto out_parse_done;
3118                 }
3119                 interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
3120                                                 slen, dialog_token);
3121                 pos += slen;
3122         }
3123
3124 out_parse_done:
3125 #ifdef CONFIG_HS20
3126         hs20_notify_parse_done(wpa_s);
3127 #endif /* CONFIG_HS20 */
3128 out:
3129         wpa_msg(wpa_s, MSG_INFO, ANQP_QUERY_DONE "addr=" MACSTR " result=%s",
3130                 MAC2STR(dst), anqp_result);
3131 }
3132
3133
3134 static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
3135                                           struct wpa_scan_results *scan_res)
3136 {
3137         wpa_msg(wpa_s, MSG_DEBUG,
3138                 "Interworking: Scan results available - start ANQP fetch");
3139         interworking_start_fetch_anqp(wpa_s);
3140 }
3141
3142
3143 int interworking_select(struct wpa_supplicant *wpa_s, int auto_select,
3144                         int *freqs)
3145 {
3146         interworking_stop_fetch_anqp(wpa_s);
3147         wpa_s->network_select = 1;
3148         wpa_s->auto_network_select = 0;
3149         wpa_s->auto_select = !!auto_select;
3150         wpa_s->fetch_all_anqp = 0;
3151         wpa_s->fetch_osu_info = 0;
3152         wpa_msg(wpa_s, MSG_DEBUG,
3153                 "Interworking: Start scan for network selection");
3154         wpa_s->scan_res_handler = interworking_scan_res_handler;
3155         wpa_s->normal_scans = 0;
3156         wpa_s->scan_req = MANUAL_SCAN_REQ;
3157         os_free(wpa_s->manual_scan_freqs);
3158         wpa_s->manual_scan_freqs = freqs;
3159         wpa_s->after_wps = 0;
3160         wpa_s->known_wps_freq = 0;
3161         wpa_supplicant_req_scan(wpa_s, 0, 0);
3162
3163         return 0;
3164 }
3165
3166
3167 static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
3168                         enum gas_query_result result,
3169                         const struct wpabuf *adv_proto,
3170                         const struct wpabuf *resp, u16 status_code)
3171 {
3172         struct wpa_supplicant *wpa_s = ctx;
3173         struct wpabuf *n;
3174
3175         wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
3176                 " dialog_token=%d status_code=%d resp_len=%d",
3177                 MAC2STR(addr), dialog_token, status_code,
3178                 resp ? (int) wpabuf_len(resp) : -1);
3179         if (!resp)
3180                 return;
3181
3182         n = wpabuf_dup(resp);
3183         if (n == NULL)
3184                 return;
3185         wpabuf_free(wpa_s->prev_gas_resp);
3186         wpa_s->prev_gas_resp = wpa_s->last_gas_resp;
3187         os_memcpy(wpa_s->prev_gas_addr, wpa_s->last_gas_addr, ETH_ALEN);
3188         wpa_s->prev_gas_dialog_token = wpa_s->last_gas_dialog_token;
3189         wpa_s->last_gas_resp = n;
3190         os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
3191         wpa_s->last_gas_dialog_token = dialog_token;
3192 }
3193
3194
3195 int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
3196                      const struct wpabuf *adv_proto,
3197                      const struct wpabuf *query)
3198 {
3199         struct wpabuf *buf;
3200         int ret = 0;
3201         int freq;
3202         struct wpa_bss *bss;
3203         int res;
3204         size_t len;
3205         u8 query_resp_len_limit = 0;
3206
3207         freq = wpa_s->assoc_freq;
3208         bss = wpa_bss_get_bssid(wpa_s, dst);
3209         if (bss)
3210                 freq = bss->freq;
3211         if (freq <= 0)
3212                 return -1;
3213
3214         wpa_msg(wpa_s, MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
3215                 MAC2STR(dst), freq);
3216         wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
3217         wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
3218
3219         len = 3 + wpabuf_len(adv_proto) + 2;
3220         if (query)
3221                 len += wpabuf_len(query);
3222         buf = gas_build_initial_req(0, len);
3223         if (buf == NULL)
3224                 return -1;
3225
3226         /* Advertisement Protocol IE */
3227         wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
3228         wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
3229         wpabuf_put_u8(buf, query_resp_len_limit & 0x7f);
3230         wpabuf_put_buf(buf, adv_proto);
3231
3232         /* GAS Query */
3233         if (query) {
3234                 wpabuf_put_le16(buf, wpabuf_len(query));
3235                 wpabuf_put_buf(buf, query);
3236         } else
3237                 wpabuf_put_le16(buf, 0);
3238
3239         res = gas_query_req(wpa_s->gas, dst, freq, 0, buf, gas_resp_cb, wpa_s);
3240         if (res < 0) {
3241                 wpa_msg(wpa_s, MSG_DEBUG, "GAS: Failed to send Query Request");
3242                 wpabuf_free(buf);
3243                 ret = -1;
3244         } else
3245                 wpa_msg(wpa_s, MSG_DEBUG,
3246                         "GAS: Query started with dialog token %u", res);
3247
3248         return ret;
3249 }