contrib/wpa/wpa_supplicant/interworking.c

   1 /*
   2  * Interworking (IEEE 802.11u)
   3  * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
   4  * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
   5  *
   6  * This software may be distributed under the terms of the BSD license.
   7  * See README for more details.
   8  */
   9
  10 #include "includes.h"
  11
  12 #include "common.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "common/gas.h"
  15 #include "common/wpa_ctrl.h"
  16 #include "utils/pcsc_funcs.h"
  17 #include "utils/eloop.h"
  18 #include "drivers/driver.h"
  19 #include "eap_common/eap_defs.h"
  20 #include "eap_peer/eap.h"
  21 #include "eap_peer/eap_methods.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "rsn_supp/wpa.h"
  24 #include "wpa_supplicant_i.h"
  25 #include "config.h"
  26 #include "config_ssid.h"
  27 #include "bss.h"
  28 #include "scan.h"
  29 #include "notify.h"
  30 #include "driver_i.h"
  31 #include "gas_query.h"
  32 #include "hs20_supplicant.h"
  33 #include "interworking.h"
  34
  35
  36 #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  37 #define INTERWORKING_3GPP
  38 #else
  39 #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  40 #define INTERWORKING_3GPP
  41 #else
  42 #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  43 #define INTERWORKING_3GPP
  44 #endif
  45 #endif
  46 #endif
  47
  48 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  49 static struct wpa_cred * interworking_credentials_available_realm(
  50         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  51         int *excluded);
  52 static struct wpa_cred * interworking_credentials_available_3gpp(
  53         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  54         int *excluded);
  55
  56
  57 static int cred_prio_cmp(const struct wpa_cred *a, const struct wpa_cred *b)
  58 {
  59         if (a->priority > b->priority)
  60                 return 1;
  61         if (a->priority < b->priority)
  62                 return -1;
  63         if (a->provisioning_sp == NULL || b->provisioning_sp == NULL ||
  64             os_strcmp(a->provisioning_sp, b->provisioning_sp) != 0)
  65                 return 0;
  66         if (a->sp_priority < b->sp_priority)
  67                 return 1;
  68         if (a->sp_priority > b->sp_priority)
  69                 return -1;
  70         return 0;
  71 }
  72
  73
  74 static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  75 {
  76         unsigned int tried;
  77
  78         if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  79                 wpa_supplicant_cancel_sched_scan(wpa_s);
  80                 wpa_s->own_disconnect_req = 1;
  81                 wpa_supplicant_deauthenticate(wpa_s,
  82                                               WLAN_REASON_DEAUTH_LEAVING);
  83         }
  84         wpa_s->disconnected = 0;
  85         wpa_s->reassociate = 1;
  86         tried = wpa_s->interworking_fast_assoc_tried;
  87         wpa_s->interworking_fast_assoc_tried = 1;
  88
  89         if (!tried && wpa_supplicant_fast_associate(wpa_s) >= 0)
  90                 return;
  91
  92         wpa_s->interworking_fast_assoc_tried = 0;
  93         wpa_supplicant_req_scan(wpa_s, 0, 0);
  94 }
  95
  96
  97 static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  98                                       struct wpabuf *extra)
  99 {
 100         struct wpabuf *buf;
 101         size_t i;
 102         u8 *len_pos;
 103
 104         buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
 105                                          (extra ? wpabuf_len(extra) : 0));
 106         if (buf == NULL)
 107                 return NULL;
 108
 109         if (num_ids > 0) {
 110                 len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
 111                 for (i = 0; i < num_ids; i++)
 112                         wpabuf_put_le16(buf, info_ids[i]);
 113                 gas_anqp_set_element_len(buf, len_pos);
 114         }
 115         if (extra)
 116                 wpabuf_put_buf(buf, extra);
 117
 118         gas_anqp_set_len(buf);
 119
 120         return buf;
 121 }
 122
 123
 124 static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
 125                                       u8 dialog_token,
 126                                       enum gas_query_result result,
 127                                       const struct wpabuf *adv_proto,
 128                                       const struct wpabuf *resp,
 129                                       u16 status_code)
 130 {
 131         struct wpa_supplicant *wpa_s = ctx;
 132
 133         wpa_printf(MSG_DEBUG, "ANQP: Response callback dst=" MACSTR
 134                    " dialog_token=%u result=%d status_code=%u",
 135                    MAC2STR(dst), dialog_token, result, status_code);
 136         anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
 137                      status_code);
 138         interworking_next_anqp_fetch(wpa_s);
 139 }
 140
 141
 142 static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
 143 {
 144         struct wpa_cred *cred;
 145
 146         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 147                 if (cred->roaming_consortium_len)
 148                         return 1;
 149                 if (cred->required_roaming_consortium_len)
 150                         return 1;
 151                 if (cred->num_roaming_consortiums)
 152                         return 1;
 153         }
 154         return 0;
 155 }
 156
 157
 158 static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
 159 {
 160         struct wpa_cred *cred;
 161
 162         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 163                 if (cred->pcsc || cred->imsi)
 164                         return 1;
 165         }
 166         return 0;
 167 }
 168
 169
 170 static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
 171 {
 172         struct wpa_cred *cred;
 173
 174         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 175                 if (cred->pcsc || cred->imsi)
 176                         continue;
 177                 if (!cred->eap_method)
 178                         return 1;
 179                 if (cred->realm && cred->roaming_consortium_len == 0)
 180                         return 1;
 181         }
 182         return 0;
 183 }
 184
 185
 186 static int cred_with_domain(struct wpa_supplicant *wpa_s)
 187 {
 188         struct wpa_cred *cred;
 189
 190         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 191                 if (cred->domain || cred->pcsc || cred->imsi ||
 192                     cred->roaming_partner)
 193                         return 1;
 194         }
 195         return 0;
 196 }
 197
 198
 199 #ifdef CONFIG_HS20
 200
 201 static int cred_with_min_backhaul(struct wpa_supplicant *wpa_s)
 202 {
 203         struct wpa_cred *cred;
 204
 205         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 206                 if (cred->min_dl_bandwidth_home ||
 207                     cred->min_ul_bandwidth_home ||
 208                     cred->min_dl_bandwidth_roaming ||
 209                     cred->min_ul_bandwidth_roaming)
 210                         return 1;
 211         }
 212         return 0;
 213 }
 214
 215
 216 static int cred_with_conn_capab(struct wpa_supplicant *wpa_s)
 217 {
 218         struct wpa_cred *cred;
 219
 220         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 221                 if (cred->num_req_conn_capab)
 222                         return 1;
 223         }
 224         return 0;
 225 }
 226
 227 #endif /* CONFIG_HS20 */
 228
 229
 230 static int additional_roaming_consortiums(struct wpa_bss *bss)
 231 {
 232         const u8 *ie;
 233         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
 234         if (ie == NULL || ie[1] == 0)
 235                 return 0;
 236         return ie[2]; /* Number of ANQP OIs */
 237 }
 238
 239
 240 static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
 241 {
 242         struct wpa_supplicant *wpa_s = eloop_ctx;
 243         interworking_next_anqp_fetch(wpa_s);
 244 }
 245
 246
 247 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
 248                                       struct wpa_bss *bss)
 249 {
 250         struct wpabuf *buf;
 251         int ret = 0;
 252         int res;
 253         u16 info_ids[8];
 254         size_t num_info_ids = 0;
 255         struct wpabuf *extra = NULL;
 256         int all = wpa_s->fetch_all_anqp;
 257
 258         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
 259                 MAC2STR(bss->bssid));
 260         wpa_s->interworking_gas_bss = bss;
 261
 262         info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
 263         if (all) {
 264                 info_ids[num_info_ids++] = ANQP_VENUE_NAME;
 265                 info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
 266         }
 267         if (all || (cred_with_roaming_consortium(wpa_s) &&
 268                     additional_roaming_consortiums(bss)))
 269                 info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
 270         if (all)
 271                 info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
 272         if (all || cred_with_nai_realm(wpa_s))
 273                 info_ids[num_info_ids++] = ANQP_NAI_REALM;
 274         if (all || cred_with_3gpp(wpa_s)) {
 275                 info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
 276                 wpa_supplicant_scard_init(wpa_s, NULL);
 277         }
 278         if (all || cred_with_domain(wpa_s))
 279                 info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
 280         wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
 281                     (u8 *) info_ids, num_info_ids * 2);
 282
 283 #ifdef CONFIG_HS20
 284         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
 285                 u8 *len_pos;
 286
 287                 extra = wpabuf_alloc(100);
 288                 if (!extra)
 289                         return -1;
 290
 291                 len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
 292                 wpabuf_put_be24(extra, OUI_WFA);
 293                 wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
 294                 wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
 295                 wpabuf_put_u8(extra, 0); /* Reserved */
 296                 wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
 297                 if (all)
 298                         wpabuf_put_u8(extra,
 299                                       HS20_STYPE_OPERATOR_FRIENDLY_NAME);
 300                 if (all || cred_with_min_backhaul(wpa_s))
 301                         wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
 302                 if (all || cred_with_conn_capab(wpa_s))
 303                         wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
 304                 if (all)
 305                         wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
 306                 if (all) {
 307                         wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_LIST);
 308                         wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_NAI_LIST);
 309                 }
 310                 gas_anqp_set_element_len(extra, len_pos);
 311         }
 312 #endif /* CONFIG_HS20 */
 313
 314         buf = anqp_build_req(info_ids, num_info_ids, extra);
 315         wpabuf_free(extra);
 316         if (buf == NULL)
 317                 return -1;
 318
 319         res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, 0, buf,
 320                             interworking_anqp_resp_cb, wpa_s);
 321         if (res < 0) {
 322                 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
 323                 wpabuf_free(buf);
 324                 ret = -1;
 325                 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
 326                                        NULL);
 327         } else
 328                 wpa_msg(wpa_s, MSG_DEBUG,
 329                         "ANQP: Query started with dialog token %u", res);
 330
 331         return ret;
 332 }
 333
 334
 335 struct nai_realm_eap {
 336         u8 method;
 337         u8 inner_method;
 338         enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
 339         u8 cred_type;
 340         u8 tunneled_cred_type;
 341 };
 342
 343 struct nai_realm {
 344         u8 encoding;
 345         char *realm;
 346         u8 eap_count;
 347         struct nai_realm_eap *eap;
 348 };
 349
 350
 351 static void nai_realm_free(struct nai_realm *realms, u16 count)
 352 {
 353         u16 i;
 354
 355         if (realms == NULL)
 356                 return;
 357         for (i = 0; i < count; i++) {
 358                 os_free(realms[i].eap);
 359                 os_free(realms[i].realm);
 360         }
 361         os_free(realms);
 362 }
 363
 364
 365 static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
 366                                       const u8 *end)
 367 {
 368         u8 elen, auth_count, a;
 369         const u8 *e_end;
 370
 371         if (end - pos < 3) {
 372                 wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
 373                 return NULL;
 374         }
 375
 376         elen = *pos++;
 377         if (elen > end - pos || elen < 2) {
 378                 wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
 379                 return NULL;
 380         }
 381         e_end = pos + elen;
 382         e->method = *pos++;
 383         auth_count = *pos++;
 384         wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
 385                    elen, e->method, auth_count);
 386
 387         for (a = 0; a < auth_count; a++) {
 388                 u8 id, len;
 389
 390                 if (end - pos < 2) {
 391                         wpa_printf(MSG_DEBUG,
 392                                    "No room for Authentication Parameter subfield header");
 393                         return NULL;
 394                 }
 395
 396                 id = *pos++;
 397                 len = *pos++;
 398                 if (len > end - pos) {
 399                         wpa_printf(MSG_DEBUG,
 400                                    "No room for Authentication Parameter subfield");
 401                         return NULL;
 402                 }
 403
 404                 switch (id) {
 405                 case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
 406                         if (len < 1)
 407                                 break;
 408                         e->inner_non_eap = *pos;
 409                         if (e->method != EAP_TYPE_TTLS)
 410                                 break;
 411                         switch (*pos) {
 412                         case NAI_REALM_INNER_NON_EAP_PAP:
 413                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
 414                                 break;
 415                         case NAI_REALM_INNER_NON_EAP_CHAP:
 416                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
 417                                 break;
 418                         case NAI_REALM_INNER_NON_EAP_MSCHAP:
 419                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
 420                                 break;
 421                         case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
 422                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
 423                                 break;
 424                         }
 425                         break;
 426                 case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
 427                         if (len < 1)
 428                                 break;
 429                         e->inner_method = *pos;
 430                         wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
 431                                    e->inner_method);
 432                         break;
 433                 case NAI_REALM_EAP_AUTH_CRED_TYPE:
 434                         if (len < 1)
 435                                 break;
 436                         e->cred_type = *pos;
 437                         wpa_printf(MSG_DEBUG, "Credential Type: %u",
 438                                    e->cred_type);
 439                         break;
 440                 case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
 441                         if (len < 1)
 442                                 break;
 443                         e->tunneled_cred_type = *pos;
 444                         wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
 445                                    "Type: %u", e->tunneled_cred_type);
 446                         break;
 447                 default:
 448                         wpa_printf(MSG_DEBUG, "Unsupported Authentication "
 449                                    "Parameter: id=%u len=%u", id, len);
 450                         wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
 451                                     "Value", pos, len);
 452                         break;
 453                 }
 454
 455                 pos += len;
 456         }
 457
 458         return e_end;
 459 }
 460
 461
 462 static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
 463                                         const u8 *end)
 464 {
 465         u16 len;
 466         const u8 *f_end;
 467         u8 realm_len, e;
 468
 469         if (end - pos < 4) {
 470                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 471                            "fixed fields");
 472                 return NULL;
 473         }
 474
 475         len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
 476         pos += 2;
 477         if (len > end - pos || len < 3) {
 478                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 479                            "(len=%u; left=%u)",
 480                            len, (unsigned int) (end - pos));
 481                 return NULL;
 482         }
 483         f_end = pos + len;
 484
 485         r->encoding = *pos++;
 486         realm_len = *pos++;
 487         if (realm_len > f_end - pos) {
 488                 wpa_printf(MSG_DEBUG, "No room for NAI Realm "
 489                            "(len=%u; left=%u)",
 490                            realm_len, (unsigned int) (f_end - pos));
 491                 return NULL;
 492         }
 493         wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
 494         r->realm = dup_binstr(pos, realm_len);
 495         if (r->realm == NULL)
 496                 return NULL;
 497         pos += realm_len;
 498
 499         if (f_end - pos < 1) {
 500                 wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
 501                 return NULL;
 502         }
 503         r->eap_count = *pos++;
 504         wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
 505         if (r->eap_count * 3 > f_end - pos) {
 506                 wpa_printf(MSG_DEBUG, "No room for EAP Methods");
 507                 return NULL;
 508         }
 509         r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
 510         if (r->eap == NULL)
 511                 return NULL;
 512
 513         for (e = 0; e < r->eap_count; e++) {
 514                 pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
 515                 if (pos == NULL)
 516                         return NULL;
 517         }
 518
 519         return f_end;
 520 }
 521
 522
 523 static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
 524 {
 525         struct nai_realm *realm;
 526         const u8 *pos, *end;
 527         u16 i, num;
 528         size_t left;
 529
 530         if (anqp == NULL)
 531                 return NULL;
 532         left = wpabuf_len(anqp);
 533         if (left < 2)
 534                 return NULL;
 535
 536         pos = wpabuf_head_u8(anqp);
 537         end = pos + left;
 538         num = WPA_GET_LE16(pos);
 539         wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
 540         pos += 2;
 541         left -= 2;
 542
 543         if (num > left / 5) {
 544                 wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
 545                            "enough data (%u octets) for that many realms",
 546                            num, (unsigned int) left);
 547                 return NULL;
 548         }
 549
 550         realm = os_calloc(num, sizeof(struct nai_realm));
 551         if (realm == NULL)
 552                 return NULL;
 553
 554         for (i = 0; i < num; i++) {
 555                 pos = nai_realm_parse_realm(&realm[i], pos, end);
 556                 if (pos == NULL) {
 557                         nai_realm_free(realm, num);
 558                         return NULL;
 559                 }
 560         }
 561
 562         *count = num;
 563         return realm;
 564 }
 565
 566
 567 static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
 568 {
 569         char *tmp, *pos, *end;
 570         int match = 0;
 571
 572         if (realm->realm == NULL || home_realm == NULL)
 573                 return 0;
 574
 575         if (os_strchr(realm->realm, ';') == NULL)
 576                 return os_strcasecmp(realm->realm, home_realm) == 0;
 577
 578         tmp = os_strdup(realm->realm);
 579         if (tmp == NULL)
 580                 return 0;
 581
 582         pos = tmp;
 583         while (*pos) {
 584                 end = os_strchr(pos, ';');
 585                 if (end)
 586                         *end = '\0';
 587                 if (os_strcasecmp(pos, home_realm) == 0) {
 588                         match = 1;
 589                         break;
 590                 }
 591                 if (end == NULL)
 592                         break;
 593                 pos = end + 1;
 594         }
 595
 596         os_free(tmp);
 597
 598         return match;
 599 }
 600
 601
 602 static int nai_realm_cred_username(struct wpa_supplicant *wpa_s,
 603                                    struct nai_realm_eap *eap)
 604 {
 605         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
 606                 wpa_msg(wpa_s, MSG_DEBUG,
 607                         "nai-realm-cred-username: EAP method not supported: %d",
 608                         eap->method);
 609                 return 0; /* method not supported */
 610         }
 611
 612         if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP &&
 613             eap->method != EAP_TYPE_FAST) {
 614                 /* Only tunneled methods with username/password supported */
 615                 wpa_msg(wpa_s, MSG_DEBUG,
 616                         "nai-realm-cred-username: Method: %d is not TTLS, PEAP, or FAST",
 617                         eap->method);
 618                 return 0;
 619         }
 620
 621         if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) {
 622                 if (eap->inner_method &&
 623                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
 624                         wpa_msg(wpa_s, MSG_DEBUG,
 625                                 "nai-realm-cred-username: PEAP/FAST: Inner method not supported: %d",
 626                                 eap->inner_method);
 627                         return 0;
 628                 }
 629                 if (!eap->inner_method &&
 630                     eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) {
 631                         wpa_msg(wpa_s, MSG_DEBUG,
 632                                 "nai-realm-cred-username: MSCHAPv2 not supported");
 633                         return 0;
 634                 }
 635         }
 636
 637         if (eap->method == EAP_TYPE_TTLS) {
 638                 if (eap->inner_method == 0 && eap->inner_non_eap == 0)
 639                         return 1; /* Assume TTLS/MSCHAPv2 is used */
 640                 if (eap->inner_method &&
 641                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
 642                         wpa_msg(wpa_s, MSG_DEBUG,
 643                                 "nai-realm-cred-username: TTLS, but inner not supported: %d",
 644                                 eap->inner_method);
 645                         return 0;
 646                 }
 647                 if (eap->inner_non_eap &&
 648                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
 649                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
 650                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
 651                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) {
 652                         wpa_msg(wpa_s, MSG_DEBUG,
 653                                 "nai-realm-cred-username: TTLS, inner-non-eap not supported: %d",
 654                                 eap->inner_non_eap);
 655                         return 0;
 656                 }
 657         }
 658
 659         if (eap->inner_method &&
 660             eap->inner_method != EAP_TYPE_GTC &&
 661             eap->inner_method != EAP_TYPE_MSCHAPV2) {
 662                 wpa_msg(wpa_s, MSG_DEBUG,
 663                         "nai-realm-cred-username: inner-method not GTC or MSCHAPv2: %d",
 664                         eap->inner_method);
 665                 return 0;
 666         }
 667
 668         return 1;
 669 }
 670
 671
 672 static int nai_realm_cred_cert(struct wpa_supplicant *wpa_s,
 673                                struct nai_realm_eap *eap)
 674 {
 675         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
 676                 wpa_msg(wpa_s, MSG_DEBUG,
 677                         "nai-realm-cred-cert: Method not supported: %d",
 678                         eap->method);
 679                 return 0; /* method not supported */
 680         }
 681
 682         if (eap->method != EAP_TYPE_TLS) {
 683                 /* Only EAP-TLS supported for credential authentication */
 684                 wpa_msg(wpa_s, MSG_DEBUG,
 685                         "nai-realm-cred-cert: Method not TLS: %d",
 686                         eap->method);
 687                 return 0;
 688         }
 689
 690         return 1;
 691 }
 692
 693
 694 static struct nai_realm_eap * nai_realm_find_eap(struct wpa_supplicant *wpa_s,
 695                                                  struct wpa_cred *cred,
 696                                                  struct nai_realm *realm)
 697 {
 698         u8 e;
 699
 700         if (cred->username == NULL ||
 701             cred->username[0] == '\0' ||
 702             ((cred->password == NULL ||
 703               cred->password[0] == '\0') &&
 704              (cred->private_key == NULL ||
 705               cred->private_key[0] == '\0'))) {
 706                 wpa_msg(wpa_s, MSG_DEBUG,
 707                         "nai-realm-find-eap: incomplete cred info: username: %s  password: %s private_key: %s",
 708                         cred->username ? cred->username : "NULL",
 709                         cred->password ? cred->password : "NULL",
 710                         cred->private_key ? cred->private_key : "NULL");
 711                 return NULL;
 712         }
 713
 714         for (e = 0; e < realm->eap_count; e++) {
 715                 struct nai_realm_eap *eap = &realm->eap[e];
 716                 if (cred->password && cred->password[0] &&
 717                     nai_realm_cred_username(wpa_s, eap))
 718                         return eap;
 719                 if (cred->private_key && cred->private_key[0] &&
 720                     nai_realm_cred_cert(wpa_s, eap))
 721                         return eap;
 722         }
 723
 724         return NULL;
 725 }
 726
 727
 728 #ifdef INTERWORKING_3GPP
 729
 730 static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
 731 {
 732         u8 plmn[3], plmn2[3];
 733         const u8 *pos, *end;
 734         u8 udhl;
 735
 736         /*
 737          * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network
 738          * operator is allowed to include only two digits of the MNC, so allow
 739          * matches based on both two and three digit MNC assumptions. Since some
 740          * SIM/USIM cards may not expose MNC length conveniently, we may be
 741          * provided the default MNC length 3 here and as such, checking with MNC
 742          * length 2 is justifiable even though 3GPP TS 24.234 does not mention
 743          * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used
 744          * with otherwise matching values would not be good idea in general, so
 745          * this should not result in selecting incorrect networks.
 746          */
 747         /* Match with 3 digit MNC */
 748         plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 749         plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4);
 750         plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 751         /* Match with 2 digit MNC */
 752         plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 753         plmn2[1] = (imsi[2] - '0') | 0xf0;
 754         plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 755
 756         if (anqp == NULL)
 757                 return 0;
 758         pos = wpabuf_head_u8(anqp);
 759         end = pos + wpabuf_len(anqp);
 760         if (end - pos < 2)
 761                 return 0;
 762         if (*pos != 0) {
 763                 wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
 764                 return 0;
 765         }
 766         pos++;
 767         udhl = *pos++;
 768         if (udhl > end - pos) {
 769                 wpa_printf(MSG_DEBUG, "Invalid UDHL");
 770                 return 0;
 771         }
 772         end = pos + udhl;
 773
 774         wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)",
 775                    plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2],
 776                    imsi, mnc_len);
 777
 778         while (end - pos >= 2) {
 779                 u8 iei, len;
 780                 const u8 *l_end;
 781                 iei = *pos++;
 782                 len = *pos++ & 0x7f;
 783                 if (len > end - pos)
 784                         break;
 785                 l_end = pos + len;
 786
 787                 if (iei == 0 && len > 0) {
 788                         /* PLMN List */
 789                         u8 num, i;
 790                         wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element",
 791                                     pos, len);
 792                         num = *pos++;
 793                         for (i = 0; i < num; i++) {
 794                                 if (l_end - pos < 3)
 795                                         break;
 796                                 if (os_memcmp(pos, plmn, 3) == 0 ||
 797                                     os_memcmp(pos, plmn2, 3) == 0)
 798                                         return 1; /* Found matching PLMN */
 799                                 pos += 3;
 800                         }
 801                 } else {
 802                         wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element",
 803                                     pos, len);
 804                 }
 805
 806                 pos = l_end;
 807         }
 808
 809         return 0;
 810 }
 811
 812
 813 static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
 814                           size_t mnc_len, char prefix)
 815 {
 816         const char *sep, *msin;
 817         char *end, *pos;
 818         size_t msin_len, plmn_len;
 819
 820         /*
 821          * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
 822          * Root NAI:
 823          * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
 824          * <MNC> is zero-padded to three digits in case two-digit MNC is used
 825          */
 826
 827         if (imsi == NULL || os_strlen(imsi) > 16) {
 828                 wpa_printf(MSG_DEBUG, "No valid IMSI available");
 829                 return -1;
 830         }
 831         sep = os_strchr(imsi, '-');
 832         if (sep) {
 833                 plmn_len = sep - imsi;
 834                 msin = sep + 1;
 835         } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
 836                 plmn_len = 3 + mnc_len;
 837                 msin = imsi + plmn_len;
 838         } else
 839                 return -1;
 840         if (plmn_len != 5 && plmn_len != 6)
 841                 return -1;
 842         msin_len = os_strlen(msin);
 843
 844         pos = nai;
 845         end = nai + nai_len;
 846         if (prefix)
 847                 *pos++ = prefix;
 848         os_memcpy(pos, imsi, plmn_len);
 849         pos += plmn_len;
 850         os_memcpy(pos, msin, msin_len);
 851         pos += msin_len;
 852         pos += os_snprintf(pos, end - pos, "@wlan.mnc");
 853         if (plmn_len == 5) {
 854                 *pos++ = '0';
 855                 *pos++ = imsi[3];
 856                 *pos++ = imsi[4];
 857         } else {
 858                 *pos++ = imsi[3];
 859                 *pos++ = imsi[4];
 860                 *pos++ = imsi[5];
 861         }
 862         os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
 863                     imsi[0], imsi[1], imsi[2]);
 864
 865         return 0;
 866 }
 867
 868
 869 static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
 870 {
 871         char nai[100];
 872         if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
 873                 return -1;
 874         return wpa_config_set_quoted(ssid, "identity", nai);
 875 }
 876
 877 #endif /* INTERWORKING_3GPP */
 878
 879
 880 static int already_connected(struct wpa_supplicant *wpa_s,
 881                              struct wpa_cred *cred, struct wpa_bss *bss)
 882 {
 883         struct wpa_ssid *ssid, *sel_ssid;
 884         struct wpa_bss *selected;
 885
 886         if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL)
 887                 return 0;
 888
 889         ssid = wpa_s->current_ssid;
 890         if (ssid->parent_cred != cred)
 891                 return 0;
 892
 893         if (ssid->ssid_len != bss->ssid_len ||
 894             os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
 895                 return 0;
 896
 897         sel_ssid = NULL;
 898         selected = wpa_supplicant_pick_network(wpa_s, &sel_ssid);
 899         if (selected && sel_ssid && sel_ssid->priority > ssid->priority)
 900                 return 0; /* higher priority network in scan results */
 901
 902         return 1;
 903 }
 904
 905
 906 static void remove_duplicate_network(struct wpa_supplicant *wpa_s,
 907                                      struct wpa_cred *cred,
 908                                      struct wpa_bss *bss)
 909 {
 910         struct wpa_ssid *ssid;
 911
 912         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 913                 if (ssid->parent_cred != cred)
 914                         continue;
 915                 if (ssid->ssid_len != bss->ssid_len ||
 916                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
 917                         continue;
 918
 919                 break;
 920         }
 921
 922         if (ssid == NULL)
 923                 return;
 924
 925         wpa_printf(MSG_DEBUG, "Interworking: Remove duplicate network entry for the same credential");
 926
 927         if (ssid == wpa_s->current_ssid) {
 928                 wpa_sm_set_config(wpa_s->wpa, NULL);
 929                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 930                 wpa_s->own_disconnect_req = 1;
 931                 wpa_supplicant_deauthenticate(wpa_s,
 932                                               WLAN_REASON_DEAUTH_LEAVING);
 933         }
 934
 935         wpas_notify_network_removed(wpa_s, ssid);
 936         wpa_config_remove_network(wpa_s->conf, ssid->id);
 937 }
 938
 939
 940 static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
 941                                         struct wpa_ssid *ssid)
 942 {
 943         const char *key_mgmt = NULL;
 944 #ifdef CONFIG_IEEE80211R
 945         int res;
 946         struct wpa_driver_capa capa;
 947
 948         res = wpa_drv_get_capa(wpa_s, &capa);
 949         if (res == 0 && capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT) {
 950                 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
 951                         "WPA-EAP WPA-EAP-SHA256 FT-EAP" :
 952                         "WPA-EAP FT-EAP";
 953         }
 954 #endif /* CONFIG_IEEE80211R */
 955
 956         if (!key_mgmt)
 957                 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
 958                         "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP";
 959         if (wpa_config_set(ssid, "key_mgmt", key_mgmt, 0) < 0 ||
 960             wpa_config_set(ssid, "proto", "RSN", 0) < 0 ||
 961             wpa_config_set(ssid, "ieee80211w", "1", 0) < 0 ||
 962             wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
 963                 return -1;
 964         return 0;
 965 }
 966
 967
 968 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
 969                                      struct wpa_cred *cred,
 970                                      struct wpa_bss *bss, int only_add)
 971 {
 972 #ifdef INTERWORKING_3GPP
 973         struct wpa_ssid *ssid;
 974         int eap_type;
 975         int res;
 976         char prefix;
 977
 978         if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
 979                 return -1;
 980
 981         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
 982                 " (3GPP)", MAC2STR(bss->bssid));
 983
 984         if (already_connected(wpa_s, cred, bss)) {
 985                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
 986                         MAC2STR(bss->bssid));
 987                 return wpa_s->current_ssid->id;
 988         }
 989
 990         remove_duplicate_network(wpa_s, cred, bss);
 991
 992         ssid = wpa_config_add_network(wpa_s->conf);
 993         if (ssid == NULL)
 994                 return -1;
 995         ssid->parent_cred = cred;
 996
 997         wpas_notify_network_added(wpa_s, ssid);
 998         wpa_config_set_network_defaults(ssid);
 999         ssid->priority = cred->priority;
1000         ssid->temporary = 1;
1001         ssid->ssid = os_zalloc(bss->ssid_len + 1);
1002         if (ssid->ssid == NULL)
1003                 goto fail;
1004         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1005         ssid->ssid_len = bss->ssid_len;
1006         ssid->eap.sim_num = cred->sim_num;
1007
1008         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1009                 goto fail;
1010
1011         eap_type = EAP_TYPE_SIM;
1012         if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
1013                 eap_type = EAP_TYPE_AKA;
1014         if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
1015                 if (cred->eap_method[0].method == EAP_TYPE_SIM ||
1016                     cred->eap_method[0].method == EAP_TYPE_AKA ||
1017                     cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
1018                         eap_type = cred->eap_method[0].method;
1019         }
1020
1021         switch (eap_type) {
1022         case EAP_TYPE_SIM:
1023                 prefix = '1';
1024                 res = wpa_config_set(ssid, "eap", "SIM", 0);
1025                 break;
1026         case EAP_TYPE_AKA:
1027                 prefix = '0';
1028                 res = wpa_config_set(ssid, "eap", "AKA", 0);
1029                 break;
1030         case EAP_TYPE_AKA_PRIME:
1031                 prefix = '6';
1032                 res = wpa_config_set(ssid, "eap", "AKA'", 0);
1033                 break;
1034         default:
1035                 res = -1;
1036                 break;
1037         }
1038         if (res < 0) {
1039                 wpa_msg(wpa_s, MSG_DEBUG,
1040                         "Selected EAP method (%d) not supported", eap_type);
1041                 goto fail;
1042         }
1043
1044         if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
1045                 wpa_msg(wpa_s, MSG_DEBUG, "Failed to set Root NAI");
1046                 goto fail;
1047         }
1048
1049         if (cred->milenage && cred->milenage[0]) {
1050                 if (wpa_config_set_quoted(ssid, "password",
1051                                           cred->milenage) < 0)
1052                         goto fail;
1053         } else if (cred->pcsc) {
1054                 if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
1055                         goto fail;
1056                 if (wpa_s->conf->pcsc_pin &&
1057                     wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
1058                     < 0)
1059                         goto fail;
1060         }
1061
1062         wpa_s->next_ssid = ssid;
1063         wpa_config_update_prio_list(wpa_s->conf);
1064         if (!only_add)
1065                 interworking_reconnect(wpa_s);
1066
1067         return ssid->id;
1068
1069 fail:
1070         wpas_notify_network_removed(wpa_s, ssid);
1071         wpa_config_remove_network(wpa_s->conf, ssid->id);
1072 #endif /* INTERWORKING_3GPP */
1073         return -1;
1074 }
1075
1076
1077 static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
1078                                             size_t rc_len)
1079 {
1080         const u8 *pos, *end;
1081         u8 lens;
1082
1083         if (ie == NULL)
1084                 return 0;
1085
1086         pos = ie + 2;
1087         end = ie + 2 + ie[1];
1088
1089         /* Roaming Consortium element:
1090          * Number of ANQP OIs
1091          * OI #1 and #2 lengths
1092          * OI #1, [OI #2], [OI #3]
1093          */
1094
1095         if (end - pos < 2)
1096                 return 0;
1097
1098         pos++; /* skip Number of ANQP OIs */
1099         lens = *pos++;
1100         if ((lens & 0x0f) + (lens >> 4) > end - pos)
1101                 return 0;
1102
1103         if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1104                 return 1;
1105         pos += lens & 0x0f;
1106
1107         if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1108                 return 1;
1109         pos += lens >> 4;
1110
1111         if (pos < end && (size_t) (end - pos) == rc_len &&
1112             os_memcmp(pos, rc_id, rc_len) == 0)
1113                 return 1;
1114
1115         return 0;
1116 }
1117
1118
1119 static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
1120                                          const u8 *rc_id, size_t rc_len)
1121 {
1122         const u8 *pos, *end;
1123         u8 len;
1124
1125         if (anqp == NULL)
1126                 return 0;
1127
1128         pos = wpabuf_head(anqp);
1129         end = pos + wpabuf_len(anqp);
1130
1131         /* Set of <OI Length, OI> duples */
1132         while (pos < end) {
1133                 len = *pos++;
1134                 if (len > end - pos)
1135                         break;
1136                 if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1137                         return 1;
1138                 pos += len;
1139         }
1140
1141         return 0;
1142 }
1143
1144
1145 static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
1146                                     const u8 *rc_id, size_t rc_len)
1147 {
1148         return roaming_consortium_element_match(ie, rc_id, rc_len) ||
1149                 roaming_consortium_anqp_match(anqp, rc_id, rc_len);
1150 }
1151
1152
1153 static int cred_roaming_consortiums_match(const u8 *ie,
1154                                           const struct wpabuf *anqp,
1155                                           const struct wpa_cred *cred)
1156 {
1157         unsigned int i;
1158
1159         for (i = 0; i < cred->num_roaming_consortiums; i++) {
1160                 if (roaming_consortium_match(ie, anqp,
1161                                              cred->roaming_consortiums[i],
1162                                              cred->roaming_consortiums_len[i]))
1163                         return 1;
1164         }
1165
1166         return 0;
1167 }
1168
1169
1170 static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss)
1171 {
1172         const u8 *ie;
1173
1174         if (cred->required_roaming_consortium_len == 0)
1175                 return 0;
1176
1177         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1178
1179         if (ie == NULL &&
1180             (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
1181                 return 1;
1182
1183         return !roaming_consortium_match(ie,
1184                                          bss->anqp ?
1185                                          bss->anqp->roaming_consortium : NULL,
1186                                          cred->required_roaming_consortium,
1187                                          cred->required_roaming_consortium_len);
1188 }
1189
1190
1191 static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
1192 {
1193         size_t i;
1194
1195         if (!cred->excluded_ssid)
1196                 return 0;
1197
1198         for (i = 0; i < cred->num_excluded_ssid; i++) {
1199                 struct excluded_ssid *e = &cred->excluded_ssid[i];
1200                 if (bss->ssid_len == e->ssid_len &&
1201                     os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
1202                         return 1;
1203         }
1204
1205         return 0;
1206 }
1207
1208
1209 static int cred_below_min_backhaul(struct wpa_supplicant *wpa_s,
1210                                    struct wpa_cred *cred, struct wpa_bss *bss)
1211 {
1212 #ifdef CONFIG_HS20
1213         int res;
1214         unsigned int dl_bandwidth, ul_bandwidth;
1215         const u8 *wan;
1216         u8 wan_info, dl_load, ul_load;
1217         u16 lmd;
1218         u32 ul_speed, dl_speed;
1219
1220         if (!cred->min_dl_bandwidth_home &&
1221             !cred->min_ul_bandwidth_home &&
1222             !cred->min_dl_bandwidth_roaming &&
1223             !cred->min_ul_bandwidth_roaming)
1224                 return 0; /* No bandwidth constraint specified */
1225
1226         if (bss->anqp == NULL || bss->anqp->hs20_wan_metrics == NULL)
1227                 return 0; /* No WAN Metrics known - ignore constraint */
1228
1229         wan = wpabuf_head(bss->anqp->hs20_wan_metrics);
1230         wan_info = wan[0];
1231         if (wan_info & BIT(3))
1232                 return 1; /* WAN link at capacity */
1233         lmd = WPA_GET_LE16(wan + 11);
1234         if (lmd == 0)
1235                 return 0; /* Downlink/Uplink Load was not measured */
1236         dl_speed = WPA_GET_LE32(wan + 1);
1237         ul_speed = WPA_GET_LE32(wan + 5);
1238         dl_load = wan[9];
1239         ul_load = wan[10];
1240
1241         if (dl_speed >= 0xffffff)
1242                 dl_bandwidth = dl_speed / 255 * (255 - dl_load);
1243         else
1244                 dl_bandwidth = dl_speed * (255 - dl_load) / 255;
1245
1246         if (ul_speed >= 0xffffff)
1247                 ul_bandwidth = ul_speed / 255 * (255 - ul_load);
1248         else
1249                 ul_bandwidth = ul_speed * (255 - ul_load) / 255;
1250
1251         res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1252                                         bss->anqp->domain_name : NULL);
1253         if (res > 0) {
1254                 if (cred->min_dl_bandwidth_home > dl_bandwidth)
1255                         return 1;
1256                 if (cred->min_ul_bandwidth_home > ul_bandwidth)
1257                         return 1;
1258         } else {
1259                 if (cred->min_dl_bandwidth_roaming > dl_bandwidth)
1260                         return 1;
1261                 if (cred->min_ul_bandwidth_roaming > ul_bandwidth)
1262                         return 1;
1263         }
1264 #endif /* CONFIG_HS20 */
1265
1266         return 0;
1267 }
1268
1269
1270 static int cred_over_max_bss_load(struct wpa_supplicant *wpa_s,
1271                                   struct wpa_cred *cred, struct wpa_bss *bss)
1272 {
1273         const u8 *ie;
1274         int res;
1275
1276         if (!cred->max_bss_load)
1277                 return 0; /* No BSS Load constraint specified */
1278
1279         ie = wpa_bss_get_ie(bss, WLAN_EID_BSS_LOAD);
1280         if (ie == NULL || ie[1] < 3)
1281                 return 0; /* No BSS Load advertised */
1282
1283         res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1284                                         bss->anqp->domain_name : NULL);
1285         if (res <= 0)
1286                 return 0; /* Not a home network */
1287
1288         return ie[4] > cred->max_bss_load;
1289 }
1290
1291
1292 #ifdef CONFIG_HS20
1293
1294 static int has_proto_match(const u8 *pos, const u8 *end, u8 proto)
1295 {
1296         while (end - pos >= 4) {
1297                 if (pos[0] == proto && pos[3] == 1 /* Open */)
1298                         return 1;
1299                 pos += 4;
1300         }
1301
1302         return 0;
1303 }
1304
1305
1306 static int has_proto_port_match(const u8 *pos, const u8 *end, u8 proto,
1307                                 u16 port)
1308 {
1309         while (end - pos >= 4) {
1310                 if (pos[0] == proto && WPA_GET_LE16(&pos[1]) == port &&
1311                     pos[3] == 1 /* Open */)
1312                         return 1;
1313                 pos += 4;
1314         }
1315
1316         return 0;
1317 }
1318
1319 #endif /* CONFIG_HS20 */
1320
1321
1322 static int cred_conn_capab_missing(struct wpa_supplicant *wpa_s,
1323                                    struct wpa_cred *cred, struct wpa_bss *bss)
1324 {
1325 #ifdef CONFIG_HS20
1326         int res;
1327         const u8 *capab, *end;
1328         unsigned int i, j;
1329         int *ports;
1330
1331         if (!cred->num_req_conn_capab)
1332                 return 0; /* No connection capability constraint specified */
1333
1334         if (bss->anqp == NULL || bss->anqp->hs20_connection_capability == NULL)
1335                 return 0; /* No Connection Capability known - ignore constraint
1336                            */
1337
1338         res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1339                                         bss->anqp->domain_name : NULL);
1340         if (res > 0)
1341                 return 0; /* No constraint in home network */
1342
1343         capab = wpabuf_head(bss->anqp->hs20_connection_capability);
1344         end = capab + wpabuf_len(bss->anqp->hs20_connection_capability);
1345
1346         for (i = 0; i < cred->num_req_conn_capab; i++) {
1347                 ports = cred->req_conn_capab_port[i];
1348                 if (!ports) {
1349                         if (!has_proto_match(capab, end,
1350                                              cred->req_conn_capab_proto[i]))
1351                                 return 1;
1352                 } else {
1353                         for (j = 0; ports[j] > -1; j++) {
1354                                 if (!has_proto_port_match(
1355                                             capab, end,
1356                                             cred->req_conn_capab_proto[i],
1357                                             ports[j]))
1358                                         return 1;
1359                         }
1360                 }
1361         }
1362 #endif /* CONFIG_HS20 */
1363
1364         return 0;
1365 }
1366
1367
1368 static struct wpa_cred * interworking_credentials_available_roaming_consortium(
1369         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
1370         int *excluded)
1371 {
1372         struct wpa_cred *cred, *selected = NULL;
1373         const u8 *ie;
1374         const struct wpabuf *anqp;
1375         int is_excluded = 0;
1376
1377         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1378         anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL;
1379
1380         if (!ie && !anqp)
1381                 return NULL;
1382
1383         if (wpa_s->conf->cred == NULL)
1384                 return NULL;
1385
1386         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1387                 if (cred->roaming_consortium_len == 0 &&
1388                     cred->num_roaming_consortiums == 0)
1389                         continue;
1390
1391                 if ((cred->roaming_consortium_len == 0 ||
1392                      !roaming_consortium_match(ie, anqp,
1393                                                cred->roaming_consortium,
1394                                                cred->roaming_consortium_len)) &&
1395                     !cred_roaming_consortiums_match(ie, anqp, cred))
1396                         continue;
1397
1398                 if (cred_no_required_oi_match(cred, bss))
1399                         continue;
1400                 if (!ignore_bw && cred_below_min_backhaul(wpa_s, cred, bss))
1401                         continue;
1402                 if (!ignore_bw && cred_over_max_bss_load(wpa_s, cred, bss))
1403                         continue;
1404                 if (!ignore_bw && cred_conn_capab_missing(wpa_s, cred, bss))
1405                         continue;
1406                 if (cred_excluded_ssid(cred, bss)) {
1407                         if (excluded == NULL)
1408                                 continue;
1409                         if (selected == NULL) {
1410                                 selected = cred;
1411                                 is_excluded = 1;
1412                         }
1413                 } else {
1414                         if (selected == NULL || is_excluded ||
1415                             cred_prio_cmp(selected, cred) < 0) {
1416                                 selected = cred;
1417                                 is_excluded = 0;
1418                         }
1419                 }
1420         }
1421
1422         if (excluded)
1423                 *excluded = is_excluded;
1424
1425         return selected;
1426 }
1427
1428
1429 static int interworking_set_eap_params(struct wpa_ssid *ssid,
1430                                        struct wpa_cred *cred, int ttls)
1431 {
1432         if (cred->eap_method) {
1433                 ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
1434                         cred->eap_method->method == EAP_TYPE_TTLS;
1435
1436                 os_free(ssid->eap.eap_methods);
1437                 ssid->eap.eap_methods =
1438                         os_malloc(sizeof(struct eap_method_type) * 2);
1439                 if (ssid->eap.eap_methods == NULL)
1440                         return -1;
1441                 os_memcpy(ssid->eap.eap_methods, cred->eap_method,
1442                           sizeof(*cred->eap_method));
1443                 ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
1444                 ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
1445         }
1446
1447         if (ttls && cred->username && cred->username[0]) {
1448                 const char *pos;
1449                 char *anon;
1450                 /* Use anonymous NAI in Phase 1 */
1451                 pos = os_strchr(cred->username, '@');
1452                 if (pos) {
1453                         size_t buflen = 9 + os_strlen(pos) + 1;
1454                         anon = os_malloc(buflen);
1455                         if (anon == NULL)
1456                                 return -1;
1457                         os_snprintf(anon, buflen, "anonymous%s", pos);
1458                 } else if (cred->realm) {
1459                         size_t buflen = 10 + os_strlen(cred->realm) + 1;
1460                         anon = os_malloc(buflen);
1461                         if (anon == NULL)
1462                                 return -1;
1463                         os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
1464                 } else {
1465                         anon = os_strdup("anonymous");
1466                         if (anon == NULL)
1467                                 return -1;
1468                 }
1469                 if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
1470                     0) {
1471                         os_free(anon);
1472                         return -1;
1473                 }
1474                 os_free(anon);
1475         }
1476
1477         if (!ttls && cred->username && cred->username[0] && cred->realm &&
1478             !os_strchr(cred->username, '@')) {
1479                 char *id;
1480                 size_t buflen;
1481                 int res;
1482
1483                 buflen = os_strlen(cred->username) + 1 +
1484                         os_strlen(cred->realm) + 1;
1485
1486                 id = os_malloc(buflen);
1487                 if (!id)
1488                         return -1;
1489                 os_snprintf(id, buflen, "%s@%s", cred->username, cred->realm);
1490                 res = wpa_config_set_quoted(ssid, "identity", id);
1491                 os_free(id);
1492                 if (res < 0)
1493                         return -1;
1494         } else if (cred->username && cred->username[0] &&
1495             wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
1496                 return -1;
1497
1498         if (cred->password && cred->password[0]) {
1499                 if (cred->ext_password &&
1500                     wpa_config_set(ssid, "password", cred->password, 0) < 0)
1501                         return -1;
1502                 if (!cred->ext_password &&
1503                     wpa_config_set_quoted(ssid, "password", cred->password) <
1504                     0)
1505                         return -1;
1506         }
1507
1508         if (cred->client_cert && cred->client_cert[0] &&
1509             wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
1510                 return -1;
1511
1512 #ifdef ANDROID
1513         if (cred->private_key &&
1514             os_strncmp(cred->private_key, "keystore://", 11) == 0) {
1515                 /* Use OpenSSL engine configuration for Android keystore */
1516                 if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
1517                     wpa_config_set_quoted(ssid, "key_id",
1518                                           cred->private_key + 11) < 0 ||
1519                     wpa_config_set(ssid, "engine", "1", 0) < 0)
1520                         return -1;
1521         } else
1522 #endif /* ANDROID */
1523         if (cred->private_key && cred->private_key[0] &&
1524             wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
1525                 return -1;
1526
1527         if (cred->private_key_passwd && cred->private_key_passwd[0] &&
1528             wpa_config_set_quoted(ssid, "private_key_passwd",
1529                                   cred->private_key_passwd) < 0)
1530                 return -1;
1531
1532         if (cred->phase1) {
1533                 os_free(ssid->eap.phase1);
1534                 ssid->eap.phase1 = os_strdup(cred->phase1);
1535         }
1536         if (cred->phase2) {
1537                 os_free(ssid->eap.phase2);
1538                 ssid->eap.phase2 = os_strdup(cred->phase2);
1539         }
1540
1541         if (cred->ca_cert && cred->ca_cert[0] &&
1542             wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
1543                 return -1;
1544
1545         if (cred->domain_suffix_match && cred->domain_suffix_match[0] &&
1546             wpa_config_set_quoted(ssid, "domain_suffix_match",
1547                                   cred->domain_suffix_match) < 0)
1548                 return -1;
1549
1550         ssid->eap.ocsp = cred->ocsp;
1551
1552         return 0;
1553 }
1554
1555
1556 static int interworking_connect_roaming_consortium(
1557         struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
1558         struct wpa_bss *bss, int only_add)
1559 {
1560         struct wpa_ssid *ssid;
1561         const u8 *ie;
1562         const struct wpabuf *anqp;
1563         unsigned int i;
1564
1565         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
1566                 " based on roaming consortium match", MAC2STR(bss->bssid));
1567
1568         if (already_connected(wpa_s, cred, bss)) {
1569                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1570                         MAC2STR(bss->bssid));
1571                 return wpa_s->current_ssid->id;
1572         }
1573
1574         remove_duplicate_network(wpa_s, cred, bss);
1575
1576         ssid = wpa_config_add_network(wpa_s->conf);
1577         if (ssid == NULL)
1578                 return -1;
1579         ssid->parent_cred = cred;
1580         wpas_notify_network_added(wpa_s, ssid);
1581         wpa_config_set_network_defaults(ssid);
1582         ssid->priority = cred->priority;
1583         ssid->temporary = 1;
1584         ssid->ssid = os_zalloc(bss->ssid_len + 1);
1585         if (ssid->ssid == NULL)
1586                 goto fail;
1587         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1588         ssid->ssid_len = bss->ssid_len;
1589
1590         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1591                 goto fail;
1592
1593         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1594         anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL;
1595         for (i = 0; (ie || anqp) && i < cred->num_roaming_consortiums; i++) {
1596                 if (!roaming_consortium_match(
1597                             ie, anqp, cred->roaming_consortiums[i],
1598                             cred->roaming_consortiums_len[i]))
1599                         continue;
1600
1601                 ssid->roaming_consortium_selection =
1602                         os_malloc(cred->roaming_consortiums_len[i]);
1603                 if (!ssid->roaming_consortium_selection)
1604                         goto fail;
1605                 os_memcpy(ssid->roaming_consortium_selection,
1606                           cred->roaming_consortiums[i],
1607                           cred->roaming_consortiums_len[i]);
1608                 ssid->roaming_consortium_selection_len =
1609                         cred->roaming_consortiums_len[i];
1610                 break;
1611         }
1612
1613         if (cred->eap_method == NULL) {
1614                 wpa_msg(wpa_s, MSG_DEBUG,
1615                         "Interworking: No EAP method set for credential using roaming consortium");
1616                 goto fail;
1617         }
1618
1619         if (interworking_set_eap_params(
1620                     ssid, cred,
1621                     cred->eap_method->vendor == EAP_VENDOR_IETF &&
1622                     cred->eap_method->method == EAP_TYPE_TTLS) < 0)
1623                 goto fail;
1624
1625         wpa_s->next_ssid = ssid;
1626         wpa_config_update_prio_list(wpa_s->conf);
1627         if (!only_add)
1628                 interworking_reconnect(wpa_s);
1629
1630         return ssid->id;
1631
1632 fail:
1633         wpas_notify_network_removed(wpa_s, ssid);
1634         wpa_config_remove_network(wpa_s->conf, ssid->id);
1635         return -1;
1636 }
1637
1638
1639 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
1640                          int only_add)
1641 {
1642         struct wpa_cred *cred, *cred_rc, *cred_3gpp;
1643         struct wpa_ssid *ssid;
1644         struct nai_realm *realm;
1645         struct nai_realm_eap *eap = NULL;
1646         u16 count, i;
1647         char buf[100];
1648         int excluded = 0, *excl = &excluded;
1649         const char *name;
1650
1651         if (wpa_s->conf->cred == NULL || bss == NULL)
1652                 return -1;
1653         if (disallowed_bssid(wpa_s, bss->bssid) ||
1654             disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
1655                 wpa_msg(wpa_s, MSG_DEBUG,
1656                         "Interworking: Reject connection to disallowed BSS "
1657                         MACSTR, MAC2STR(bss->bssid));
1658                 return -1;
1659         }
1660
1661         wpa_printf(MSG_DEBUG, "Interworking: Considering BSS " MACSTR
1662                    " for connection",
1663                    MAC2STR(bss->bssid));
1664
1665         if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
1666                 /*
1667                  * We currently support only HS 2.0 networks and those are
1668                  * required to use WPA2-Enterprise.
1669                  */
1670                 wpa_msg(wpa_s, MSG_DEBUG,
1671                         "Interworking: Network does not use RSN");
1672                 return -1;
1673         }
1674
1675         cred_rc = interworking_credentials_available_roaming_consortium(
1676                 wpa_s, bss, 0, excl);
1677         if (cred_rc) {
1678                 wpa_msg(wpa_s, MSG_DEBUG,
1679                         "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d",
1680                         cred_rc->priority, cred_rc->sp_priority);
1681                 if (excl && !(*excl))
1682                         excl = NULL;
1683         }
1684
1685         cred = interworking_credentials_available_realm(wpa_s, bss, 0, excl);
1686         if (cred) {
1687                 wpa_msg(wpa_s, MSG_DEBUG,
1688                         "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d",
1689                         cred->priority, cred->sp_priority);
1690                 if (excl && !(*excl))
1691                         excl = NULL;
1692         }
1693
1694         cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss, 0,
1695                                                             excl);
1696         if (cred_3gpp) {
1697                 wpa_msg(wpa_s, MSG_DEBUG,
1698                         "Interworking: Highest 3GPP matching credential priority %d sp_priority %d",
1699                         cred_3gpp->priority, cred_3gpp->sp_priority);
1700                 if (excl && !(*excl))
1701                         excl = NULL;
1702         }
1703
1704         if (!cred_rc && !cred && !cred_3gpp) {
1705                 wpa_msg(wpa_s, MSG_DEBUG,
1706                         "Interworking: No full credential matches - consider options without BW(etc.) limits");
1707                 cred_rc = interworking_credentials_available_roaming_consortium(
1708                         wpa_s, bss, 1, excl);
1709                 if (cred_rc) {
1710                         wpa_msg(wpa_s, MSG_DEBUG,
1711                                 "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d (ignore BW)",
1712                                 cred_rc->priority, cred_rc->sp_priority);
1713                         if (excl && !(*excl))
1714                                 excl = NULL;
1715                 }
1716
1717                 cred = interworking_credentials_available_realm(wpa_s, bss, 1,
1718                                                                 excl);
1719                 if (cred) {
1720                         wpa_msg(wpa_s, MSG_DEBUG,
1721                                 "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d (ignore BW)",
1722                                 cred->priority, cred->sp_priority);
1723                         if (excl && !(*excl))
1724                                 excl = NULL;
1725                 }
1726
1727                 cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss,
1728                                                                     1, excl);
1729                 if (cred_3gpp) {
1730                         wpa_msg(wpa_s, MSG_DEBUG,
1731                                 "Interworking: Highest 3GPP matching credential priority %d sp_priority %d (ignore BW)",
1732                                 cred_3gpp->priority, cred_3gpp->sp_priority);
1733                         if (excl && !(*excl))
1734                                 excl = NULL;
1735                 }
1736         }
1737
1738         if (cred_rc &&
1739             (cred == NULL || cred_prio_cmp(cred_rc, cred) >= 0) &&
1740             (cred_3gpp == NULL || cred_prio_cmp(cred_rc, cred_3gpp) >= 0))
1741                 return interworking_connect_roaming_consortium(wpa_s, cred_rc,
1742                                                                bss, only_add);
1743
1744         if (cred_3gpp &&
1745             (cred == NULL || cred_prio_cmp(cred_3gpp, cred) >= 0)) {
1746                 return interworking_connect_3gpp(wpa_s, cred_3gpp, bss,
1747                                                  only_add);
1748         }
1749
1750         if (cred == NULL) {
1751                 wpa_msg(wpa_s, MSG_DEBUG,
1752                         "Interworking: No matching credentials found for "
1753                         MACSTR, MAC2STR(bss->bssid));
1754                 return -1;
1755         }
1756
1757         realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
1758                                 &count);
1759         if (realm == NULL) {
1760                 wpa_msg(wpa_s, MSG_DEBUG,
1761                         "Interworking: Could not parse NAI Realm list from "
1762                         MACSTR, MAC2STR(bss->bssid));
1763                 return -1;
1764         }
1765
1766         for (i = 0; i < count; i++) {
1767                 if (!nai_realm_match(&realm[i], cred->realm))
1768                         continue;
1769                 eap = nai_realm_find_eap(wpa_s, cred, &realm[i]);
1770                 if (eap)
1771                         break;
1772         }
1773
1774         if (!eap) {
1775                 wpa_msg(wpa_s, MSG_DEBUG,
1776                         "Interworking: No matching credentials and EAP method found for "
1777                         MACSTR, MAC2STR(bss->bssid));
1778                 nai_realm_free(realm, count);
1779                 return -1;
1780         }
1781
1782         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR,
1783                 MAC2STR(bss->bssid));
1784
1785         if (already_connected(wpa_s, cred, bss)) {
1786                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1787                         MAC2STR(bss->bssid));
1788                 nai_realm_free(realm, count);
1789                 return 0;
1790         }
1791
1792         remove_duplicate_network(wpa_s, cred, bss);
1793
1794         ssid = wpa_config_add_network(wpa_s->conf);
1795         if (ssid == NULL) {
1796                 nai_realm_free(realm, count);
1797                 return -1;
1798         }
1799         ssid->parent_cred = cred;
1800         wpas_notify_network_added(wpa_s, ssid);
1801         wpa_config_set_network_defaults(ssid);
1802         ssid->priority = cred->priority;
1803         ssid->temporary = 1;
1804         ssid->ssid = os_zalloc(bss->ssid_len + 1);
1805         if (ssid->ssid == NULL)
1806                 goto fail;
1807         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1808         ssid->ssid_len = bss->ssid_len;
1809
1810         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1811                 goto fail;
1812
1813         if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
1814                                                      eap->method), 0) < 0)
1815                 goto fail;
1816
1817         switch (eap->method) {
1818         case EAP_TYPE_TTLS:
1819                 if (eap->inner_method) {
1820                         name = eap_get_name(EAP_VENDOR_IETF, eap->inner_method);
1821                         if (!name)
1822                                 goto fail;
1823                         os_snprintf(buf, sizeof(buf), "\"autheap=%s\"", name);
1824                         if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1825                                 goto fail;
1826                         break;
1827                 }
1828                 switch (eap->inner_non_eap) {
1829                 case NAI_REALM_INNER_NON_EAP_PAP:
1830                         if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
1831                             0)
1832                                 goto fail;
1833                         break;
1834                 case NAI_REALM_INNER_NON_EAP_CHAP:
1835                         if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
1836                             < 0)
1837                                 goto fail;
1838                         break;
1839                 case NAI_REALM_INNER_NON_EAP_MSCHAP:
1840                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
1841                                            0) < 0)
1842                                 goto fail;
1843                         break;
1844                 case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
1845                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1846                                            0) < 0)
1847                                 goto fail;
1848                         break;
1849                 default:
1850                         /* EAP params were not set - assume TTLS/MSCHAPv2 */
1851                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1852                                            0) < 0)
1853                                 goto fail;
1854                         break;
1855                 }
1856                 break;
1857         case EAP_TYPE_PEAP:
1858         case EAP_TYPE_FAST:
1859                 if (wpa_config_set(ssid, "phase1", "\"fast_provisioning=2\"",
1860                                    0) < 0)
1861                         goto fail;
1862                 if (wpa_config_set(ssid, "pac_file",
1863                                    "\"blob://pac_interworking\"", 0) < 0)
1864                         goto fail;
1865                 name = eap_get_name(EAP_VENDOR_IETF,
1866                                     eap->inner_method ? eap->inner_method :
1867                                     EAP_TYPE_MSCHAPV2);
1868                 if (name == NULL)
1869                         goto fail;
1870                 os_snprintf(buf, sizeof(buf), "\"auth=%s\"", name);
1871                 if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1872                         goto fail;
1873                 break;
1874         case EAP_TYPE_TLS:
1875                 break;
1876         }
1877
1878         if (interworking_set_eap_params(ssid, cred,
1879                                         eap->method == EAP_TYPE_TTLS) < 0)
1880                 goto fail;
1881
1882         nai_realm_free(realm, count);
1883
1884         wpa_s->next_ssid = ssid;
1885         wpa_config_update_prio_list(wpa_s->conf);
1886         if (!only_add)
1887                 interworking_reconnect(wpa_s);
1888
1889         return ssid->id;
1890
1891 fail:
1892         wpas_notify_network_removed(wpa_s, ssid);
1893         wpa_config_remove_network(wpa_s->conf, ssid->id);
1894         nai_realm_free(realm, count);
1895         return -1;
1896 }
1897
1898
1899 #ifdef PCSC_FUNCS
1900 static int interworking_pcsc_read_imsi(struct wpa_supplicant *wpa_s)
1901 {
1902         size_t len;
1903
1904         if (wpa_s->imsi[0] && wpa_s->mnc_len)
1905                 return 0;
1906
1907         len = sizeof(wpa_s->imsi) - 1;
1908         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
1909                 scard_deinit(wpa_s->scard);
1910                 wpa_s->scard = NULL;
1911                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
1912                 return -1;
1913         }
1914         wpa_s->imsi[len] = '\0';
1915         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
1916         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
1917                    wpa_s->imsi, wpa_s->mnc_len);
1918
1919         return 0;
1920 }
1921 #endif /* PCSC_FUNCS */
1922
1923
1924 static struct wpa_cred * interworking_credentials_available_3gpp(
1925         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
1926         int *excluded)
1927 {
1928         struct wpa_cred *selected = NULL;
1929 #ifdef INTERWORKING_3GPP
1930         struct wpa_cred *cred;
1931         int ret;
1932         int is_excluded = 0;
1933
1934         if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL) {
1935                 wpa_msg(wpa_s, MSG_DEBUG,
1936                         "interworking-avail-3gpp: not avail, anqp: %p  anqp_3gpp: %p",
1937                         bss->anqp, bss->anqp ? bss->anqp->anqp_3gpp : NULL);
1938                 return NULL;
1939         }
1940
1941 #ifdef CONFIG_EAP_PROXY
1942         if (!wpa_s->imsi[0]) {
1943                 size_t len;
1944                 wpa_msg(wpa_s, MSG_DEBUG,
1945                         "Interworking: IMSI not available - try to read again through eap_proxy");
1946                 wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, -1,
1947                                                              wpa_s->imsi,
1948                                                              &len);
1949                 if (wpa_s->mnc_len > 0) {
1950                         wpa_s->imsi[len] = '\0';
1951                         wpa_msg(wpa_s, MSG_DEBUG,
1952                                 "eap_proxy: IMSI %s (MNC length %d)",
1953                                 wpa_s->imsi, wpa_s->mnc_len);
1954                 } else {
1955                         wpa_msg(wpa_s, MSG_DEBUG,
1956                                 "eap_proxy: IMSI not available");
1957                 }
1958         }
1959 #endif /* CONFIG_EAP_PROXY */
1960
1961         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1962                 char *sep;
1963                 const char *imsi;
1964                 int mnc_len;
1965                 char imsi_buf[16];
1966                 size_t msin_len;
1967
1968 #ifdef PCSC_FUNCS
1969                 if (cred->pcsc && wpa_s->scard) {
1970                         if (interworking_pcsc_read_imsi(wpa_s) < 0)
1971                                 continue;
1972                         imsi = wpa_s->imsi;
1973                         mnc_len = wpa_s->mnc_len;
1974                         goto compare;
1975                 }
1976 #endif /* PCSC_FUNCS */
1977 #ifdef CONFIG_EAP_PROXY
1978                 if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
1979                         imsi = wpa_s->imsi;
1980                         mnc_len = wpa_s->mnc_len;
1981                         goto compare;
1982                 }
1983 #endif /* CONFIG_EAP_PROXY */
1984
1985                 if (cred->imsi == NULL || !cred->imsi[0] ||
1986                     (!wpa_s->conf->external_sim &&
1987                      (cred->milenage == NULL || !cred->milenage[0])))
1988                         continue;
1989
1990                 sep = os_strchr(cred->imsi, '-');
1991                 if (sep == NULL ||
1992                     (sep - cred->imsi != 5 && sep - cred->imsi != 6))
1993                         continue;
1994                 mnc_len = sep - cred->imsi - 3;
1995                 os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len);
1996                 sep++;
1997                 msin_len = os_strlen(cred->imsi);
1998                 if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1)
1999                         msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1;
2000                 os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len);
2001                 imsi_buf[3 + mnc_len + msin_len] = '\0';
2002                 imsi = imsi_buf;
2003
2004 #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
2005         compare:
2006 #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
2007                 wpa_msg(wpa_s, MSG_DEBUG,
2008                         "Interworking: Parsing 3GPP info from " MACSTR,
2009                         MAC2STR(bss->bssid));
2010                 ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
2011                 wpa_msg(wpa_s, MSG_DEBUG, "PLMN match %sfound",
2012                         ret ? "" : "not ");
2013                 if (ret) {
2014                         if (cred_no_required_oi_match(cred, bss))
2015                                 continue;
2016                         if (!ignore_bw &&
2017                             cred_below_min_backhaul(wpa_s, cred, bss))
2018                                 continue;
2019                         if (!ignore_bw &&
2020                             cred_over_max_bss_load(wpa_s, cred, bss))
2021                                 continue;
2022                         if (!ignore_bw &&
2023                             cred_conn_capab_missing(wpa_s, cred, bss))
2024                                 continue;
2025                         if (cred_excluded_ssid(cred, bss)) {
2026                                 if (excluded == NULL)
2027                                         continue;
2028                                 if (selected == NULL) {
2029                                         selected = cred;
2030                                         is_excluded = 1;
2031                                 }
2032                         } else {
2033                                 if (selected == NULL || is_excluded ||
2034                                     cred_prio_cmp(selected, cred) < 0) {
2035                                         selected = cred;
2036                                         is_excluded = 0;
2037                                 }
2038                         }
2039                 }
2040         }
2041
2042         if (excluded)
2043                 *excluded = is_excluded;
2044 #endif /* INTERWORKING_3GPP */
2045         return selected;
2046 }
2047
2048
2049 static struct wpa_cred * interworking_credentials_available_realm(
2050         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
2051         int *excluded)
2052 {
2053         struct wpa_cred *cred, *selected = NULL;
2054         struct nai_realm *realm;
2055         u16 count, i;
2056         int is_excluded = 0;
2057
2058         if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
2059                 return NULL;
2060
2061         if (wpa_s->conf->cred == NULL)
2062                 return NULL;
2063
2064         wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
2065                 MACSTR, MAC2STR(bss->bssid));
2066         realm = nai_realm_parse(bss->anqp->nai_realm, &count);
2067         if (realm == NULL) {
2068                 wpa_msg(wpa_s, MSG_DEBUG,
2069                         "Interworking: Could not parse NAI Realm list from "
2070                         MACSTR, MAC2STR(bss->bssid));
2071                 return NULL;
2072         }
2073
2074         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2075                 if (cred->realm == NULL)
2076                         continue;
2077
2078                 for (i = 0; i < count; i++) {
2079                         if (!nai_realm_match(&realm[i], cred->realm))
2080                                 continue;
2081                         if (nai_realm_find_eap(wpa_s, cred, &realm[i])) {
2082                                 if (cred_no_required_oi_match(cred, bss))
2083                                         continue;
2084                                 if (!ignore_bw &&
2085                                     cred_below_min_backhaul(wpa_s, cred, bss))
2086                                         continue;
2087                                 if (!ignore_bw &&
2088                                     cred_over_max_bss_load(wpa_s, cred, bss))
2089                                         continue;
2090                                 if (!ignore_bw &&
2091                                     cred_conn_capab_missing(wpa_s, cred, bss))
2092                                         continue;
2093                                 if (cred_excluded_ssid(cred, bss)) {
2094                                         if (excluded == NULL)
2095                                                 continue;
2096                                         if (selected == NULL) {
2097                                                 selected = cred;
2098                                                 is_excluded = 1;
2099                                         }
2100                                 } else {
2101                                         if (selected == NULL || is_excluded ||
2102                                             cred_prio_cmp(selected, cred) < 0)
2103                                         {
2104                                                 selected = cred;
2105                                                 is_excluded = 0;
2106                                         }
2107                                 }
2108                                 break;
2109                         } else {
2110                                 wpa_msg(wpa_s, MSG_DEBUG,
2111                                         "Interworking: realm-find-eap returned false");
2112                         }
2113                 }
2114         }
2115
2116         nai_realm_free(realm, count);
2117
2118         if (excluded)
2119                 *excluded = is_excluded;
2120
2121         return selected;
2122 }
2123
2124
2125 static struct wpa_cred * interworking_credentials_available_helper(
2126         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
2127         int *excluded)
2128 {
2129         struct wpa_cred *cred, *cred2;
2130         int excluded1, excluded2 = 0;
2131
2132         if (disallowed_bssid(wpa_s, bss->bssid) ||
2133             disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
2134                 wpa_printf(MSG_DEBUG, "Interworking: Ignore disallowed BSS "
2135                            MACSTR, MAC2STR(bss->bssid));
2136                 return NULL;
2137         }
2138
2139         cred = interworking_credentials_available_realm(wpa_s, bss, ignore_bw,
2140                                                         &excluded1);
2141         cred2 = interworking_credentials_available_3gpp(wpa_s, bss, ignore_bw,
2142                                                         &excluded2);
2143         if (cred && cred2 &&
2144             (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
2145                 cred = cred2;
2146                 excluded1 = excluded2;
2147         }
2148         if (!cred) {
2149                 cred = cred2;
2150                 excluded1 = excluded2;
2151         }
2152
2153         cred2 = interworking_credentials_available_roaming_consortium(
2154                 wpa_s, bss, ignore_bw, &excluded2);
2155         if (cred && cred2 &&
2156             (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
2157                 cred = cred2;
2158                 excluded1 = excluded2;
2159         }
2160         if (!cred) {
2161                 cred = cred2;
2162                 excluded1 = excluded2;
2163         }
2164
2165         if (excluded)
2166                 *excluded = excluded1;
2167         return cred;
2168 }
2169
2170
2171 static struct wpa_cred * interworking_credentials_available(
2172         struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int *excluded)
2173 {
2174         struct wpa_cred *cred;
2175
2176         if (excluded)
2177                 *excluded = 0;
2178         cred = interworking_credentials_available_helper(wpa_s, bss, 0,
2179                                                          excluded);
2180         if (cred)
2181                 return cred;
2182         return interworking_credentials_available_helper(wpa_s, bss, 1,
2183                                                          excluded);
2184 }
2185
2186
2187 int domain_name_list_contains(struct wpabuf *domain_names,
2188                               const char *domain, int exact_match)
2189 {
2190         const u8 *pos, *end;
2191         size_t len;
2192
2193         len = os_strlen(domain);
2194         pos = wpabuf_head(domain_names);
2195         end = pos + wpabuf_len(domain_names);
2196
2197         while (end - pos > 1) {
2198                 u8 elen;
2199
2200                 elen = *pos++;
2201                 if (elen > end - pos)
2202                         break;
2203
2204                 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
2205                                   pos, elen);
2206                 if (elen == len &&
2207                     os_strncasecmp(domain, (const char *) pos, len) == 0)
2208                         return 1;
2209                 if (!exact_match && elen > len && pos[elen - len - 1] == '.') {
2210                         const char *ap = (const char *) pos;
2211                         int offset = elen - len;
2212
2213                         if (os_strncasecmp(domain, ap + offset, len) == 0)
2214                                 return 1;
2215                 }
2216
2217                 pos += elen;
2218         }
2219
2220         return 0;
2221 }
2222
2223
2224 int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
2225                               struct wpa_cred *cred,
2226                               struct wpabuf *domain_names)
2227 {
2228         size_t i;
2229         int ret = -1;
2230 #ifdef INTERWORKING_3GPP
2231         char nai[100], *realm;
2232
2233         char *imsi = NULL;
2234         int mnc_len = 0;
2235         if (cred->imsi)
2236                 imsi = cred->imsi;
2237 #ifdef PCSC_FUNCS
2238         else if (cred->pcsc && wpa_s->scard) {
2239                 if (interworking_pcsc_read_imsi(wpa_s) < 0)
2240                         return -1;
2241                 imsi = wpa_s->imsi;
2242                 mnc_len = wpa_s->mnc_len;
2243         }
2244 #endif /* PCSC_FUNCS */
2245 #ifdef CONFIG_EAP_PROXY
2246         else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
2247                 imsi = wpa_s->imsi;
2248                 mnc_len = wpa_s->mnc_len;
2249         }
2250 #endif /* CONFIG_EAP_PROXY */
2251         if (domain_names &&
2252             imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
2253                 realm = os_strchr(nai, '@');
2254                 if (realm)
2255                         realm++;
2256                 wpa_msg(wpa_s, MSG_DEBUG,
2257                         "Interworking: Search for match with SIM/USIM domain %s",
2258                         realm);
2259                 if (realm &&
2260                     domain_name_list_contains(domain_names, realm, 1))
2261                         return 1;
2262                 if (realm)
2263                         ret = 0;
2264         }
2265 #endif /* INTERWORKING_3GPP */
2266
2267         if (domain_names == NULL || cred->domain == NULL)
2268                 return ret;
2269
2270         for (i = 0; i < cred->num_domain; i++) {
2271                 wpa_msg(wpa_s, MSG_DEBUG,
2272                         "Interworking: Search for match with home SP FQDN %s",
2273                         cred->domain[i]);
2274                 if (domain_name_list_contains(domain_names, cred->domain[i], 1))
2275                         return 1;
2276         }
2277
2278         return 0;
2279 }
2280
2281
2282 static int interworking_home_sp(struct wpa_supplicant *wpa_s,
2283                                 struct wpabuf *domain_names)
2284 {
2285         struct wpa_cred *cred;
2286
2287         if (domain_names == NULL || wpa_s->conf->cred == NULL)
2288                 return -1;
2289
2290         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2291                 int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
2292                 if (res)
2293                         return res;
2294         }
2295
2296         return 0;
2297 }
2298
2299
2300 static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
2301 {
2302         struct wpa_bss *bss;
2303         struct wpa_ssid *ssid;
2304
2305         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2306                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
2307                         if (wpas_network_disabled(wpa_s, ssid) ||
2308                             ssid->mode != WPAS_MODE_INFRA)
2309                                 continue;
2310                         if (ssid->ssid_len != bss->ssid_len ||
2311                             os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
2312                             0)
2313                                 continue;
2314                         /*
2315                          * TODO: Consider more accurate matching of security
2316                          * configuration similarly to what is done in events.c
2317                          */
2318                         return 1;
2319                 }
2320         }
2321
2322         return 0;
2323 }
2324
2325
2326 static int roaming_partner_match(struct wpa_supplicant *wpa_s,
2327                                  struct roaming_partner *partner,
2328                                  struct wpabuf *domain_names)
2329 {
2330         wpa_printf(MSG_DEBUG, "Interworking: Comparing roaming_partner info fqdn='%s' exact_match=%d priority=%u country='%s'",
2331                    partner->fqdn, partner->exact_match, partner->priority,
2332                    partner->country);
2333         wpa_hexdump_ascii(MSG_DEBUG, "Interworking: Domain names",
2334                           wpabuf_head(domain_names),
2335                           wpabuf_len(domain_names));
2336         if (!domain_name_list_contains(domain_names, partner->fqdn,
2337                                        partner->exact_match))
2338                 return 0;
2339         /* TODO: match Country */
2340         return 1;
2341 }
2342
2343
2344 static u8 roaming_prio(struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
2345                        struct wpa_bss *bss)
2346 {
2347         size_t i;
2348
2349         if (bss->anqp == NULL || bss->anqp->domain_name == NULL) {
2350                 wpa_printf(MSG_DEBUG, "Interworking: No ANQP domain name info -> use default roaming partner priority 128");
2351                 return 128; /* cannot check preference with domain name */
2352         }
2353
2354         if (interworking_home_sp_cred(wpa_s, cred, bss->anqp->domain_name) > 0)
2355         {
2356                 wpa_printf(MSG_DEBUG, "Interworking: Determined to be home SP -> use maximum preference 0 as roaming partner priority");
2357                 return 0; /* max preference for home SP network */
2358         }
2359
2360         for (i = 0; i < cred->num_roaming_partner; i++) {
2361                 if (roaming_partner_match(wpa_s, &cred->roaming_partner[i],
2362                                           bss->anqp->domain_name)) {
2363                         wpa_printf(MSG_DEBUG, "Interworking: Roaming partner preference match - priority %u",
2364                                    cred->roaming_partner[i].priority);
2365                         return cred->roaming_partner[i].priority;
2366                 }
2367         }
2368
2369         wpa_printf(MSG_DEBUG, "Interworking: No roaming partner preference match - use default roaming partner priority 128");
2370         return 128;
2371 }
2372
2373
2374 static struct wpa_bss * pick_best_roaming_partner(struct wpa_supplicant *wpa_s,
2375                                                   struct wpa_bss *selected,
2376                                                   struct wpa_cred *cred)
2377 {
2378         struct wpa_bss *bss;
2379         u8 best_prio, prio;
2380         struct wpa_cred *cred2;
2381
2382         /*
2383          * Check if any other BSS is operated by a more preferred roaming
2384          * partner.
2385          */
2386
2387         best_prio = roaming_prio(wpa_s, cred, selected);
2388         wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for selected BSS "
2389                    MACSTR " (cred=%d)", best_prio, MAC2STR(selected->bssid),
2390                    cred->id);
2391
2392         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2393                 if (bss == selected)
2394                         continue;
2395                 cred2 = interworking_credentials_available(wpa_s, bss, NULL);
2396                 if (!cred2)
2397                         continue;
2398                 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN))
2399                         continue;
2400                 prio = roaming_prio(wpa_s, cred2, bss);
2401                 wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for BSS "
2402                            MACSTR " (cred=%d)", prio, MAC2STR(bss->bssid),
2403                            cred2->id);
2404                 if (prio < best_prio) {
2405                         int bh1, bh2, load1, load2, conn1, conn2;
2406                         bh1 = cred_below_min_backhaul(wpa_s, cred, selected);
2407                         load1 = cred_over_max_bss_load(wpa_s, cred, selected);
2408                         conn1 = cred_conn_capab_missing(wpa_s, cred, selected);
2409                         bh2 = cred_below_min_backhaul(wpa_s, cred2, bss);
2410                         load2 = cred_over_max_bss_load(wpa_s, cred2, bss);
2411                         conn2 = cred_conn_capab_missing(wpa_s, cred2, bss);
2412                         wpa_printf(MSG_DEBUG, "Interworking: old: %d %d %d  new: %d %d %d",
2413                                    bh1, load1, conn1, bh2, load2, conn2);
2414                         if (bh1 || load1 || conn1 || !(bh2 || load2 || conn2)) {
2415                                 wpa_printf(MSG_DEBUG, "Interworking: Better roaming partner " MACSTR " selected", MAC2STR(bss->bssid));
2416                                 best_prio = prio;
2417                                 selected = bss;
2418                         }
2419                 }
2420         }
2421
2422         return selected;
2423 }
2424
2425
2426 static void interworking_select_network(struct wpa_supplicant *wpa_s)
2427 {
2428         struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
2429         struct wpa_bss *selected2 = NULL, *selected2_home = NULL;
2430         unsigned int count = 0;
2431         const char *type;
2432         int res;
2433         struct wpa_cred *cred, *selected_cred = NULL;
2434         struct wpa_cred *selected_home_cred = NULL;
2435         struct wpa_cred *selected2_cred = NULL;
2436         struct wpa_cred *selected2_home_cred = NULL;
2437
2438         wpa_s->network_select = 0;
2439
2440         wpa_printf(MSG_DEBUG, "Interworking: Select network (auto_select=%d)",
2441                    wpa_s->auto_select);
2442         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2443                 int excluded = 0;
2444                 int bh, bss_load, conn_capab;
2445                 cred = interworking_credentials_available(wpa_s, bss,
2446                                                           &excluded);
2447                 if (!cred)
2448                         continue;
2449
2450                 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
2451                         /*
2452                          * We currently support only HS 2.0 networks and those
2453                          * are required to use WPA2-Enterprise.
2454                          */
2455                         wpa_msg(wpa_s, MSG_DEBUG,
2456                                 "Interworking: Credential match with " MACSTR
2457                                 " but network does not use RSN",
2458                                 MAC2STR(bss->bssid));
2459                         continue;
2460                 }
2461                 if (!excluded)
2462                         count++;
2463                 res = interworking_home_sp(wpa_s, bss->anqp ?
2464                                            bss->anqp->domain_name : NULL);
2465                 if (res > 0)
2466                         type = "home";
2467                 else if (res == 0)
2468                         type = "roaming";
2469                 else
2470                         type = "unknown";
2471                 bh = cred_below_min_backhaul(wpa_s, cred, bss);
2472                 bss_load = cred_over_max_bss_load(wpa_s, cred, bss);
2473                 conn_capab = cred_conn_capab_missing(wpa_s, cred, bss);
2474                 wpa_msg(wpa_s, MSG_INFO, "%s" MACSTR " type=%s%s%s%s id=%d priority=%d sp_priority=%d",
2475                         excluded ? INTERWORKING_BLACKLISTED : INTERWORKING_AP,
2476                         MAC2STR(bss->bssid), type,
2477                         bh ? " below_min_backhaul=1" : "",
2478                         bss_load ? " over_max_bss_load=1" : "",
2479                         conn_capab ? " conn_capab_missing=1" : "",
2480                         cred->id, cred->priority, cred->sp_priority);
2481                 if (excluded)
2482                         continue;
2483                 if (wpa_s->auto_select ||
2484                     (wpa_s->conf->auto_interworking &&
2485                      wpa_s->auto_network_select)) {
2486                         if (bh || bss_load || conn_capab) {
2487                                 if (selected2_cred == NULL ||
2488                                     cred_prio_cmp(cred, selected2_cred) > 0) {
2489                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2");
2490                                         selected2 = bss;
2491                                         selected2_cred = cred;
2492                                 }
2493                                 if (res > 0 &&
2494                                     (selected2_home_cred == NULL ||
2495                                      cred_prio_cmp(cred, selected2_home_cred) >
2496                                      0)) {
2497                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2_home");
2498                                         selected2_home = bss;
2499                                         selected2_home_cred = cred;
2500                                 }
2501                         } else {
2502                                 if (selected_cred == NULL ||
2503                                     cred_prio_cmp(cred, selected_cred) > 0) {
2504                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected");
2505                                         selected = bss;
2506                                         selected_cred = cred;
2507                                 }
2508                                 if (res > 0 &&
2509                                     (selected_home_cred == NULL ||
2510                                      cred_prio_cmp(cred, selected_home_cred) >
2511                                      0)) {
2512                                         wpa_printf(MSG_DEBUG, "Interworking: Mark as selected_home");
2513                                         selected_home = bss;
2514                                         selected_home_cred = cred;
2515                                 }
2516                         }
2517                 }
2518         }
2519
2520         if (selected_home && selected_home != selected &&
2521             selected_home_cred &&
2522             (selected_cred == NULL ||
2523              cred_prio_cmp(selected_home_cred, selected_cred) >= 0)) {
2524                 /* Prefer network operated by the Home SP */
2525                 wpa_printf(MSG_DEBUG, "Interworking: Overrided selected with selected_home");
2526                 selected = selected_home;
2527                 selected_cred = selected_home_cred;
2528         }
2529
2530         if (!selected) {
2531                 if (selected2_home) {
2532                         wpa_printf(MSG_DEBUG, "Interworking: Use home BSS with BW limit mismatch since no other network could be selected");
2533                         selected = selected2_home;
2534                         selected_cred = selected2_home_cred;
2535                 } else if (selected2) {
2536                         wpa_printf(MSG_DEBUG, "Interworking: Use visited BSS with BW limit mismatch since no other network could be selected");
2537                         selected = selected2;
2538                         selected_cred = selected2_cred;
2539                 }
2540         }
2541
2542         if (count == 0) {
2543                 /*
2544                  * No matching network was found based on configured
2545                  * credentials. Check whether any of the enabled network blocks
2546                  * have matching APs.
2547                  */
2548                 if (interworking_find_network_match(wpa_s)) {
2549                         wpa_msg(wpa_s, MSG_DEBUG,
2550                                 "Interworking: Possible BSS match for enabled network configurations");
2551                         if (wpa_s->auto_select) {
2552                                 interworking_reconnect(wpa_s);
2553                                 return;
2554                         }
2555                 }
2556
2557                 if (wpa_s->auto_network_select) {
2558                         wpa_msg(wpa_s, MSG_DEBUG,
2559                                 "Interworking: Continue scanning after ANQP fetch");
2560                         wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
2561                                                 0);
2562                         return;
2563                 }
2564
2565                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
2566                         "with matching credentials found");
2567                 if (wpa_s->wpa_state == WPA_SCANNING)
2568                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2569         }
2570
2571         if (selected) {
2572                 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR,
2573                            MAC2STR(selected->bssid));
2574                 selected = pick_best_roaming_partner(wpa_s, selected,
2575                                                      selected_cred);
2576                 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR
2577                            " (after best roaming partner selection)",
2578                            MAC2STR(selected->bssid));
2579                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_SELECTED MACSTR,
2580                         MAC2STR(selected->bssid));
2581                 interworking_connect(wpa_s, selected, 0);
2582         } else if (wpa_s->wpa_state == WPA_SCANNING)
2583                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2584 }
2585
2586
2587 static struct wpa_bss_anqp *
2588 interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
2589 {
2590         struct wpa_bss *other;
2591
2592         if (is_zero_ether_addr(bss->hessid))
2593                 return NULL; /* Cannot be in the same homegenous ESS */
2594
2595         dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
2596                 if (other == bss)
2597                         continue;
2598                 if (other->anqp == NULL)
2599                         continue;
2600                 if (other->anqp->roaming_consortium == NULL &&
2601                     other->anqp->nai_realm == NULL &&
2602                     other->anqp->anqp_3gpp == NULL &&
2603                     other->anqp->domain_name == NULL)
2604                         continue;
2605                 if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
2606                         continue;
2607                 if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
2608                         continue;
2609                 if (bss->ssid_len != other->ssid_len ||
2610                     os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
2611                         continue;
2612
2613                 wpa_msg(wpa_s, MSG_DEBUG,
2614                         "Interworking: Share ANQP data with already fetched BSSID "
2615                         MACSTR " and " MACSTR,
2616                         MAC2STR(other->bssid), MAC2STR(bss->bssid));
2617                 other->anqp->users++;
2618                 return other->anqp;
2619         }
2620
2621         return NULL;
2622 }
2623
2624
2625 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
2626 {
2627         struct wpa_bss *bss;
2628         int found = 0;
2629
2630         wpa_printf(MSG_DEBUG, "Interworking: next_anqp_fetch - "
2631                    "fetch_anqp_in_progress=%d fetch_osu_icon_in_progress=%d",
2632                    wpa_s->fetch_anqp_in_progress,
2633                    wpa_s->fetch_osu_icon_in_progress);
2634
2635         if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress) {
2636                 wpa_printf(MSG_DEBUG, "Interworking: Stop next-ANQP-fetch");
2637                 return;
2638         }
2639
2640 #ifdef CONFIG_HS20
2641         if (wpa_s->fetch_osu_icon_in_progress) {
2642                 wpa_printf(MSG_DEBUG, "Interworking: Next icon (in progress)");
2643                 hs20_next_osu_icon(wpa_s);
2644                 return;
2645         }
2646 #endif /* CONFIG_HS20 */
2647
2648         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2649                 if (!(bss->caps & IEEE80211_CAP_ESS))
2650                         continue;
2651                 if (!wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_INTERWORKING))
2652                         continue; /* AP does not support Interworking */
2653                 if (disallowed_bssid(wpa_s, bss->bssid) ||
2654                     disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len))
2655                         continue; /* Disallowed BSS */
2656
2657                 if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
2658                         if (bss->anqp == NULL) {
2659                                 bss->anqp = interworking_match_anqp_info(wpa_s,
2660                                                                          bss);
2661                                 if (bss->anqp) {
2662                                         /* Shared data already fetched */
2663                                         continue;
2664                                 }
2665                                 bss->anqp = wpa_bss_anqp_alloc();
2666                                 if (bss->anqp == NULL)
2667                                         break;
2668                         }
2669                         found++;
2670                         bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
2671                         wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
2672                                 MACSTR, MAC2STR(bss->bssid));
2673                         interworking_anqp_send_req(wpa_s, bss);
2674                         break;
2675                 }
2676         }
2677
2678         if (found == 0) {
2679 #ifdef CONFIG_HS20
2680                 if (wpa_s->fetch_osu_info) {
2681                         if (wpa_s->num_prov_found == 0 &&
2682                             wpa_s->fetch_osu_waiting_scan &&
2683                             wpa_s->num_osu_scans < 3) {
2684                                 wpa_printf(MSG_DEBUG, "HS 2.0: No OSU providers seen - try to scan again");
2685                                 hs20_start_osu_scan(wpa_s);
2686                                 return;
2687                         }
2688                         wpa_printf(MSG_DEBUG, "Interworking: Next icon");
2689                         hs20_osu_icon_fetch(wpa_s);
2690                         return;
2691                 }
2692 #endif /* CONFIG_HS20 */
2693                 wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
2694                 wpa_s->fetch_anqp_in_progress = 0;
2695                 if (wpa_s->network_select)
2696                         interworking_select_network(wpa_s);
2697         }
2698 }
2699
2700
2701 void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
2702 {
2703         struct wpa_bss *bss;
2704
2705         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
2706                 bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
2707
2708         wpa_s->fetch_anqp_in_progress = 1;
2709
2710         /*
2711          * Start actual ANQP operation from eloop call to make sure the loop
2712          * does not end up using excessive recursion.
2713          */
2714         eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s, NULL);
2715 }
2716
2717
2718 int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
2719 {
2720         if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
2721                 return 0;
2722
2723         wpa_s->network_select = 0;
2724         wpa_s->fetch_all_anqp = 1;
2725         wpa_s->fetch_osu_info = 0;
2726
2727         interworking_start_fetch_anqp(wpa_s);
2728
2729         return 0;
2730 }
2731
2732
2733 void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
2734 {
2735         if (!wpa_s->fetch_anqp_in_progress)
2736                 return;
2737
2738         wpa_s->fetch_anqp_in_progress = 0;
2739 }
2740
2741
2742 int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
2743                   u16 info_ids[], size_t num_ids, u32 subtypes,
2744                   u32 mbo_subtypes)
2745 {
2746         struct wpabuf *buf;
2747         struct wpabuf *extra_buf = NULL;
2748         int ret = 0;
2749         int freq;
2750         struct wpa_bss *bss;
2751         int res;
2752
2753         bss = wpa_bss_get_bssid(wpa_s, dst);
2754         if (!bss) {
2755                 wpa_printf(MSG_WARNING,
2756                            "ANQP: Cannot send query to unknown BSS "
2757                            MACSTR, MAC2STR(dst));
2758                 return -1;
2759         }
2760
2761         wpa_bss_anqp_unshare_alloc(bss);
2762         freq = bss->freq;
2763
2764         wpa_msg(wpa_s, MSG_DEBUG,
2765                 "ANQP: Query Request to " MACSTR " for %u id(s)",
2766                 MAC2STR(dst), (unsigned int) num_ids);
2767
2768 #ifdef CONFIG_HS20
2769         if (subtypes != 0) {
2770                 extra_buf = wpabuf_alloc(100);
2771                 if (extra_buf == NULL)
2772                         return -1;
2773                 hs20_put_anqp_req(subtypes, NULL, 0, extra_buf);
2774         }
2775 #endif /* CONFIG_HS20 */
2776
2777 #ifdef CONFIG_MBO
2778         if (mbo_subtypes) {
2779                 struct wpabuf *mbo;
2780
2781                 mbo = mbo_build_anqp_buf(wpa_s, bss, mbo_subtypes);
2782                 if (mbo) {
2783                         if (wpabuf_resize(&extra_buf, wpabuf_len(mbo))) {
2784                                 wpabuf_free(extra_buf);
2785                                 wpabuf_free(mbo);
2786                                 return -1;
2787                         }
2788                         wpabuf_put_buf(extra_buf, mbo);
2789                         wpabuf_free(mbo);
2790                 }
2791         }
2792 #endif /* CONFIG_MBO */
2793
2794         buf = anqp_build_req(info_ids, num_ids, extra_buf);
2795         wpabuf_free(extra_buf);
2796         if (buf == NULL)
2797                 return -1;
2798
2799         res = gas_query_req(wpa_s->gas, dst, freq, 0, buf, anqp_resp_cb, wpa_s);
2800         if (res < 0) {
2801                 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
2802                 wpabuf_free(buf);
2803                 ret = -1;
2804         } else {
2805                 wpa_msg(wpa_s, MSG_DEBUG,
2806                         "ANQP: Query started with dialog token %u", res);
2807         }
2808
2809         return ret;
2810 }
2811
2812
2813 static void anqp_add_extra(struct wpa_supplicant *wpa_s,
2814                            struct wpa_bss_anqp *anqp, u16 info_id,
2815                            const u8 *data, size_t slen)
2816 {
2817         struct wpa_bss_anqp_elem *tmp, *elem = NULL;
2818
2819         if (!anqp)
2820                 return;
2821
2822         dl_list_for_each(tmp, &anqp->anqp_elems, struct wpa_bss_anqp_elem,
2823                          list) {
2824                 if (tmp->infoid == info_id) {
2825                         elem = tmp;
2826                         break;
2827                 }
2828         }
2829
2830         if (!elem) {
2831                 elem = os_zalloc(sizeof(*elem));
2832                 if (!elem)
2833                         return;
2834                 elem->infoid = info_id;
2835                 dl_list_add(&anqp->anqp_elems, &elem->list);
2836         } else {
2837                 wpabuf_free(elem->payload);
2838         }
2839
2840         elem->payload = wpabuf_alloc_copy(data, slen);
2841         if (!elem->payload) {
2842                 dl_list_del(&elem->list);
2843                 os_free(elem);
2844         }
2845 }
2846
2847
2848 static void interworking_parse_venue_url(struct wpa_supplicant *wpa_s,
2849                                          const u8 *data, size_t len)
2850 {
2851         const u8 *pos = data, *end = data + len;
2852         char url[255];
2853
2854         while (end - pos >= 2) {
2855                 u8 slen, num;
2856
2857                 slen = *pos++;
2858                 if (slen < 1 || slen > end - pos) {
2859                         wpa_printf(MSG_DEBUG,
2860                                    "ANQP: Truncated Venue URL Duple field");
2861                         return;
2862                 }
2863
2864                 num = *pos++;
2865                 os_memcpy(url, pos, slen - 1);
2866                 url[slen - 1] = '\0';
2867                 wpa_msg(wpa_s, MSG_INFO, RX_VENUE_URL "%u %s", num, url);
2868                 pos += slen - 1;
2869         }
2870 }
2871
2872
2873 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
2874                                             struct wpa_bss *bss, const u8 *sa,
2875                                             u16 info_id,
2876                                             const u8 *data, size_t slen,
2877                                             u8 dialog_token)
2878 {
2879         const u8 *pos = data;
2880         struct wpa_bss_anqp *anqp = NULL;
2881         u8 type;
2882
2883         if (bss)
2884                 anqp = bss->anqp;
2885
2886         switch (info_id) {
2887         case ANQP_CAPABILITY_LIST:
2888                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2889                         " ANQP Capability list", MAC2STR(sa));
2890                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Capability list",
2891                                   pos, slen);
2892                 if (anqp) {
2893                         wpabuf_free(anqp->capability_list);
2894                         anqp->capability_list = wpabuf_alloc_copy(pos, slen);
2895                 }
2896                 break;
2897         case ANQP_VENUE_NAME:
2898                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2899                         " Venue Name", MAC2STR(sa));
2900                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
2901                 if (anqp) {
2902                         wpabuf_free(anqp->venue_name);
2903                         anqp->venue_name = wpabuf_alloc_copy(pos, slen);
2904                 }
2905                 break;
2906         case ANQP_NETWORK_AUTH_TYPE:
2907                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2908                         " Network Authentication Type information",
2909                         MAC2STR(sa));
2910                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
2911                                   "Type", pos, slen);
2912                 if (anqp) {
2913                         wpabuf_free(anqp->network_auth_type);
2914                         anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
2915                 }
2916                 break;
2917         case ANQP_ROAMING_CONSORTIUM:
2918                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2919                         " Roaming Consortium list", MAC2STR(sa));
2920                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
2921                                   pos, slen);
2922                 if (anqp) {
2923                         wpabuf_free(anqp->roaming_consortium);
2924                         anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
2925                 }
2926                 break;
2927         case ANQP_IP_ADDR_TYPE_AVAILABILITY:
2928                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2929                         " IP Address Type Availability information",
2930                         MAC2STR(sa));
2931                 wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
2932                             pos, slen);
2933                 if (anqp) {
2934                         wpabuf_free(anqp->ip_addr_type_availability);
2935                         anqp->ip_addr_type_availability =
2936                                 wpabuf_alloc_copy(pos, slen);
2937                 }
2938                 break;
2939         case ANQP_NAI_REALM:
2940                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2941                         " NAI Realm list", MAC2STR(sa));
2942                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
2943                 if (anqp) {
2944                         wpabuf_free(anqp->nai_realm);
2945                         anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
2946                 }
2947                 break;
2948         case ANQP_3GPP_CELLULAR_NETWORK:
2949                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2950                         " 3GPP Cellular Network information", MAC2STR(sa));
2951                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
2952                                   pos, slen);
2953                 if (anqp) {
2954                         wpabuf_free(anqp->anqp_3gpp);
2955                         anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
2956                 }
2957                 break;
2958         case ANQP_DOMAIN_NAME:
2959                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2960                         " Domain Name list", MAC2STR(sa));
2961                 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
2962                 if (anqp) {
2963                         wpabuf_free(anqp->domain_name);
2964                         anqp->domain_name = wpabuf_alloc_copy(pos, slen);
2965                 }
2966                 break;
2967 #ifdef CONFIG_FILS
2968         case ANQP_FILS_REALM_INFO:
2969                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2970                         " FILS Realm Information", MAC2STR(sa));
2971                 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: FILS Realm Information",
2972                         pos, slen);
2973                 if (anqp) {
2974                         wpabuf_free(anqp->fils_realm_info);
2975                         anqp->fils_realm_info = wpabuf_alloc_copy(pos, slen);
2976                 }
2977                 break;
2978 #endif /* CONFIG_FILS */
2979         case ANQP_VENUE_URL:
2980                 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR " Venue URL",
2981                         MAC2STR(sa));
2982                 anqp_add_extra(wpa_s, anqp, info_id, pos, slen);
2983
2984                 if (!pmf_in_use(wpa_s, sa)) {
2985                         wpa_printf(MSG_DEBUG,
2986                                    "ANQP: Ignore Venue URL since PMF was not enabled");
2987                         break;
2988                 }
2989                 interworking_parse_venue_url(wpa_s, pos, slen);
2990                 break;
2991         case ANQP_VENDOR_SPECIFIC:
2992                 if (slen < 3)
2993                         return;
2994
2995                 switch (WPA_GET_BE24(pos)) {
2996                 case OUI_WFA:
2997                         pos += 3;
2998                         slen -= 3;
2999
3000                         if (slen < 1)
3001                                 return;
3002                         type = *pos++;
3003                         slen--;
3004
3005                         switch (type) {
3006 #ifdef CONFIG_HS20
3007                         case HS20_ANQP_OUI_TYPE:
3008                                 hs20_parse_rx_hs20_anqp_resp(wpa_s, bss, sa,
3009                                                              pos, slen,
3010                                                              dialog_token);
3011                                 break;
3012 #endif /* CONFIG_HS20 */
3013 #ifdef CONFIG_MBO
3014                         case MBO_ANQP_OUI_TYPE:
3015                                 mbo_parse_rx_anqp_resp(wpa_s, bss, sa,
3016                                                        pos, slen);
3017                                 break;
3018 #endif /* CONFIG_MBO */
3019                         default:
3020                                 wpa_msg(wpa_s, MSG_DEBUG,
3021                                         "ANQP: Unsupported ANQP vendor type %u",
3022                                         type);
3023                                 break;
3024                         }
3025                         break;
3026                 default:
3027                         wpa_msg(wpa_s, MSG_DEBUG,
3028                                 "Interworking: Unsupported vendor-specific ANQP OUI %06x",
3029                                 WPA_GET_BE24(pos));
3030                         return;
3031                 }
3032                 break;
3033         default:
3034                 wpa_msg(wpa_s, MSG_DEBUG,
3035                         "Interworking: Unsupported ANQP Info ID %u", info_id);
3036                 anqp_add_extra(wpa_s, anqp, info_id, data, slen);
3037                 break;
3038         }
3039 }
3040
3041
3042 void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
3043                   enum gas_query_result result,
3044                   const struct wpabuf *adv_proto,
3045                   const struct wpabuf *resp, u16 status_code)
3046 {
3047         struct wpa_supplicant *wpa_s = ctx;
3048         const u8 *pos;
3049         const u8 *end;
3050         u16 info_id;
3051         u16 slen;
3052         struct wpa_bss *bss = NULL, *tmp;
3053         const char *anqp_result = "SUCCESS";
3054
3055         wpa_printf(MSG_DEBUG, "Interworking: anqp_resp_cb dst=" MACSTR
3056                    " dialog_token=%u result=%d status_code=%u",
3057                    MAC2STR(dst), dialog_token, result, status_code);
3058         if (result != GAS_QUERY_SUCCESS) {
3059 #ifdef CONFIG_HS20
3060                 if (wpa_s->fetch_osu_icon_in_progress)
3061                         hs20_icon_fetch_failed(wpa_s);
3062 #endif /* CONFIG_HS20 */
3063                 anqp_result = "FAILURE";
3064                 goto out;
3065         }
3066
3067         pos = wpabuf_head(adv_proto);
3068         if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
3069             pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
3070                 wpa_msg(wpa_s, MSG_DEBUG,
3071                         "ANQP: Unexpected Advertisement Protocol in response");
3072 #ifdef CONFIG_HS20
3073                 if (wpa_s->fetch_osu_icon_in_progress)
3074                         hs20_icon_fetch_failed(wpa_s);
3075 #endif /* CONFIG_HS20 */
3076                 anqp_result = "INVALID_FRAME";
3077                 goto out;
3078         }
3079
3080         /*
3081          * If possible, select the BSS entry based on which BSS entry was used
3082          * for the request. This can help in cases where multiple BSS entries
3083          * may exist for the same AP.
3084          */
3085         dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
3086                 if (tmp == wpa_s->interworking_gas_bss &&
3087                     os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
3088                         bss = tmp;
3089                         break;
3090                 }
3091         }
3092         if (bss == NULL)
3093                 bss = wpa_bss_get_bssid(wpa_s, dst);
3094
3095         pos = wpabuf_head(resp);
3096         end = pos + wpabuf_len(resp);
3097
3098         while (pos < end) {
3099                 unsigned int left = end - pos;
3100
3101                 if (left < 4) {
3102                         wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Invalid element");
3103                         anqp_result = "INVALID_FRAME";
3104                         goto out_parse_done;
3105                 }
3106                 info_id = WPA_GET_LE16(pos);
3107                 pos += 2;
3108                 slen = WPA_GET_LE16(pos);
3109                 pos += 2;
3110                 left -= 4;
3111                 if (left < slen) {
3112                         wpa_msg(wpa_s, MSG_DEBUG,
3113                                 "ANQP: Invalid element length for Info ID %u",
3114                                 info_id);
3115                         anqp_result = "INVALID_FRAME";
3116                         goto out_parse_done;
3117                 }
3118                 interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
3119                                                 slen, dialog_token);
3120                 pos += slen;
3121         }
3122
3123 out_parse_done:
3124 #ifdef CONFIG_HS20
3125         hs20_notify_parse_done(wpa_s);
3126 #endif /* CONFIG_HS20 */
3127 out:
3128         wpa_msg(wpa_s, MSG_INFO, ANQP_QUERY_DONE "addr=" MACSTR " result=%s",
3129                 MAC2STR(dst), anqp_result);
3130 }
3131
3132
3133 static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
3134                                           struct wpa_scan_results *scan_res)
3135 {
3136         wpa_msg(wpa_s, MSG_DEBUG,
3137                 "Interworking: Scan results available - start ANQP fetch");
3138         interworking_start_fetch_anqp(wpa_s);
3139 }
3140
3141
3142 int interworking_select(struct wpa_supplicant *wpa_s, int auto_select,
3143                         int *freqs)
3144 {
3145         interworking_stop_fetch_anqp(wpa_s);
3146         wpa_s->network_select = 1;
3147         wpa_s->auto_network_select = 0;
3148         wpa_s->auto_select = !!auto_select;
3149         wpa_s->fetch_all_anqp = 0;
3150         wpa_s->fetch_osu_info = 0;
3151         wpa_msg(wpa_s, MSG_DEBUG,
3152                 "Interworking: Start scan for network selection");
3153         wpa_s->scan_res_handler = interworking_scan_res_handler;
3154         wpa_s->normal_scans = 0;
3155         wpa_s->scan_req = MANUAL_SCAN_REQ;
3156         os_free(wpa_s->manual_scan_freqs);
3157         wpa_s->manual_scan_freqs = freqs;
3158         wpa_s->after_wps = 0;
3159         wpa_s->known_wps_freq = 0;
3160         wpa_supplicant_req_scan(wpa_s, 0, 0);
3161
3162         return 0;
3163 }
3164
3165
3166 static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
3167                         enum gas_query_result result,
3168                         const struct wpabuf *adv_proto,
3169                         const struct wpabuf *resp, u16 status_code)
3170 {
3171         struct wpa_supplicant *wpa_s = ctx;
3172         struct wpabuf *n;
3173
3174         wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
3175                 " dialog_token=%d status_code=%d resp_len=%d",
3176                 MAC2STR(addr), dialog_token, status_code,
3177                 resp ? (int) wpabuf_len(resp) : -1);
3178         if (!resp)
3179                 return;
3180
3181         n = wpabuf_dup(resp);
3182         if (n == NULL)
3183                 return;
3184         wpabuf_free(wpa_s->prev_gas_resp);
3185         wpa_s->prev_gas_resp = wpa_s->last_gas_resp;
3186         os_memcpy(wpa_s->prev_gas_addr, wpa_s->last_gas_addr, ETH_ALEN);
3187         wpa_s->prev_gas_dialog_token = wpa_s->last_gas_dialog_token;
3188         wpa_s->last_gas_resp = n;
3189         os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
3190         wpa_s->last_gas_dialog_token = dialog_token;
3191 }
3192
3193
3194 int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
3195                      const struct wpabuf *adv_proto,
3196                      const struct wpabuf *query)
3197 {
3198         struct wpabuf *buf;
3199         int ret = 0;
3200         int freq;
3201         struct wpa_bss *bss;
3202         int res;
3203         size_t len;
3204         u8 query_resp_len_limit = 0;
3205
3206         freq = wpa_s->assoc_freq;
3207         bss = wpa_bss_get_bssid(wpa_s, dst);
3208         if (bss)
3209                 freq = bss->freq;
3210         if (freq <= 0)
3211                 return -1;
3212
3213         wpa_msg(wpa_s, MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
3214                 MAC2STR(dst), freq);
3215         wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
3216         wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
3217
3218         len = 3 + wpabuf_len(adv_proto) + 2;
3219         if (query)
3220                 len += wpabuf_len(query);
3221         buf = gas_build_initial_req(0, len);
3222         if (buf == NULL)
3223                 return -1;
3224
3225         /* Advertisement Protocol IE */
3226         wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
3227         wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
3228         wpabuf_put_u8(buf, query_resp_len_limit & 0x7f);
3229         wpabuf_put_buf(buf, adv_proto);
3230
3231         /* GAS Query */
3232         if (query) {
3233                 wpabuf_put_le16(buf, wpabuf_len(query));
3234                 wpabuf_put_buf(buf, query);
3235         } else
3236                 wpabuf_put_le16(buf, 0);
3237
3238         res = gas_query_req(wpa_s->gas, dst, freq, 0, buf, gas_resp_cb, wpa_s);
3239         if (res < 0) {
3240                 wpa_msg(wpa_s, MSG_DEBUG, "GAS: Failed to send Query Request");
3241                 wpabuf_free(buf);
3242                 ret = -1;
3243         } else
3244                 wpa_msg(wpa_s, MSG_DEBUG,
3245                         "GAS: Query started with dialog token %u", res);
3246
3247         return ret;
3248 }