contrib/wpa/wpa_supplicant/sme.c

   1 /*
   2  * wpa_supplicant - SME
   3  * Copyright (c) 2009-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "utils/eloop.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "common/ieee802_11_common.h"
  15 #include "common/ocv.h"
  16 #include "eapol_supp/eapol_supp_sm.h"
  17 #include "common/wpa_common.h"
  18 #include "common/sae.h"
  19 #include "common/dpp.h"
  20 #include "rsn_supp/wpa.h"
  21 #include "rsn_supp/pmksa_cache.h"
  22 #include "config.h"
  23 #include "wpa_supplicant_i.h"
  24 #include "driver_i.h"
  25 #include "wpas_glue.h"
  26 #include "wps_supplicant.h"
  27 #include "p2p_supplicant.h"
  28 #include "notify.h"
  29 #include "bss.h"
  30 #include "scan.h"
  31 #include "sme.h"
  32 #include "hs20_supplicant.h"
  33
  34 #define SME_AUTH_TIMEOUT 5
  35 #define SME_ASSOC_TIMEOUT 5
  36
  37 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
  38 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
  39 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
  40 #ifdef CONFIG_IEEE80211W
  41 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
  42 #endif /* CONFIG_IEEE80211W */
  43
  44
  45 #ifdef CONFIG_SAE
  46
  47 static int index_within_array(const int *array, int idx)
  48 {
  49         int i;
  50         for (i = 0; i < idx; i++) {
  51                 if (array[i] <= 0)
  52                         return 0;
  53         }
  54         return 1;
  55 }
  56
  57
  58 static int sme_set_sae_group(struct wpa_supplicant *wpa_s)
  59 {
  60         int *groups = wpa_s->conf->sae_groups;
  61         int default_groups[] = { 19, 20, 21, 0 };
  62
  63         if (!groups || groups[0] <= 0)
  64                 groups = default_groups;
  65
  66         /* Configuration may have changed, so validate current index */
  67         if (!index_within_array(groups, wpa_s->sme.sae_group_index))
  68                 return -1;
  69
  70         for (;;) {
  71                 int group = groups[wpa_s->sme.sae_group_index];
  72                 if (group <= 0)
  73                         break;
  74                 if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
  75                         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
  76                                 wpa_s->sme.sae.group);
  77                         return 0;
  78                 }
  79                 wpa_s->sme.sae_group_index++;
  80         }
  81
  82         return -1;
  83 }
  84
  85
  86 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
  87                                                  struct wpa_ssid *ssid,
  88                                                  const u8 *bssid, int external,
  89                                                  int reuse)
  90 {
  91         struct wpabuf *buf;
  92         size_t len;
  93         const char *password;
  94
  95 #ifdef CONFIG_TESTING_OPTIONS
  96         if (wpa_s->sae_commit_override) {
  97                 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
  98                 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
  99                 if (!buf)
 100                         return NULL;
 101                 if (!external) {
 102                         wpabuf_put_le16(buf, 1); /* Transaction seq# */
 103                         wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
 104                 }
 105                 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
 106                 return buf;
 107         }
 108 #endif /* CONFIG_TESTING_OPTIONS */
 109
 110         password = ssid->sae_password;
 111         if (!password)
 112                 password = ssid->passphrase;
 113         if (!password) {
 114                 wpa_printf(MSG_DEBUG, "SAE: No password available");
 115                 return NULL;
 116         }
 117
 118         if (reuse && wpa_s->sme.sae.tmp &&
 119             os_memcmp(bssid, wpa_s->sme.sae.tmp->bssid, ETH_ALEN) == 0) {
 120                 wpa_printf(MSG_DEBUG,
 121                            "SAE: Reuse previously generated PWE on a retry with the same AP");
 122                 goto reuse_data;
 123         }
 124         if (sme_set_sae_group(wpa_s) < 0) {
 125                 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
 126                 return NULL;
 127         }
 128
 129         if (sae_prepare_commit(wpa_s->own_addr, bssid,
 130                                (u8 *) password, os_strlen(password),
 131                                ssid->sae_password_id,
 132                                &wpa_s->sme.sae) < 0) {
 133                 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
 134                 return NULL;
 135         }
 136         if (wpa_s->sme.sae.tmp)
 137                 os_memcpy(wpa_s->sme.sae.tmp->bssid, bssid, ETH_ALEN);
 138
 139 reuse_data:
 140         len = wpa_s->sme.sae_token ? wpabuf_len(wpa_s->sme.sae_token) : 0;
 141         if (ssid->sae_password_id)
 142                 len += 4 + os_strlen(ssid->sae_password_id);
 143         buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
 144         if (buf == NULL)
 145                 return NULL;
 146         if (!external) {
 147                 wpabuf_put_le16(buf, 1); /* Transaction seq# */
 148                 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
 149         }
 150         sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
 151                          ssid->sae_password_id);
 152
 153         return buf;
 154 }
 155
 156
 157 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
 158                                                   int external)
 159 {
 160         struct wpabuf *buf;
 161
 162         buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
 163         if (buf == NULL)
 164                 return NULL;
 165
 166         if (!external) {
 167                 wpabuf_put_le16(buf, 2); /* Transaction seq# */
 168                 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
 169         }
 170         sae_write_confirm(&wpa_s->sme.sae, buf);
 171
 172         return buf;
 173 }
 174
 175 #endif /* CONFIG_SAE */
 176
 177
 178 /**
 179  * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
 180  * @wpa_s: Pointer to wpa_supplicant data
 181  * @bss: Pointer to the bss which is the target of authentication attempt
 182  */
 183 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
 184                                 struct wpa_bss *bss)
 185 {
 186         const u8 rrm_ie_len = 5;
 187         u8 *pos;
 188         const u8 *rrm_ie;
 189
 190         wpa_s->rrm.rrm_used = 0;
 191
 192         wpa_printf(MSG_DEBUG,
 193                    "RRM: Determining whether RRM can be used - device support: 0x%x",
 194                    wpa_s->drv_rrm_flags);
 195
 196         rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
 197         if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
 198                 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
 199                 return;
 200         }
 201
 202         if (!((wpa_s->drv_rrm_flags &
 203                WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
 204               (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
 205             !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
 206                 wpa_printf(MSG_DEBUG,
 207                            "RRM: Insufficient RRM support in driver - do not use RRM");
 208                 return;
 209         }
 210
 211         if (sizeof(wpa_s->sme.assoc_req_ie) <
 212             wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
 213                 wpa_printf(MSG_INFO,
 214                            "RRM: Unable to use RRM, no room for RRM IE");
 215                 return;
 216         }
 217
 218         wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
 219         pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
 220         os_memset(pos, 0, 2 + rrm_ie_len);
 221         *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
 222         *pos++ = rrm_ie_len;
 223
 224         /* Set supported capabilites flags */
 225         if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
 226                 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
 227
 228         *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
 229                 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
 230                 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
 231
 232         if (wpa_s->lci)
 233                 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
 234
 235         wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
 236         wpa_s->rrm.rrm_used = 1;
 237 }
 238
 239
 240 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
 241                                     struct wpa_bss *bss, struct wpa_ssid *ssid,
 242                                     int start)
 243 {
 244         struct wpa_driver_auth_params params;
 245         struct wpa_ssid *old_ssid;
 246 #ifdef CONFIG_IEEE80211R
 247         const u8 *ie;
 248 #endif /* CONFIG_IEEE80211R */
 249 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
 250         const u8 *md = NULL;
 251 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
 252         int i, bssid_changed;
 253         struct wpabuf *resp = NULL;
 254         u8 ext_capab[18];
 255         int ext_capab_len;
 256         int skip_auth;
 257         u8 *wpa_ie;
 258         size_t wpa_ie_len;
 259 #ifdef CONFIG_MBO
 260         const u8 *mbo_ie;
 261 #endif /* CONFIG_MBO */
 262
 263         if (bss == NULL) {
 264                 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
 265                         "the network");
 266                 wpas_connect_work_done(wpa_s);
 267                 return;
 268         }
 269
 270         skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
 271                 wpa_s->reassoc_same_bss;
 272         wpa_s->current_bss = bss;
 273
 274         os_memset(&params, 0, sizeof(params));
 275         wpa_s->reassociate = 0;
 276
 277         params.freq = bss->freq;
 278         params.bssid = bss->bssid;
 279         params.ssid = bss->ssid;
 280         params.ssid_len = bss->ssid_len;
 281         params.p2p = ssid->p2p_group;
 282
 283         if (wpa_s->sme.ssid_len != params.ssid_len ||
 284             os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
 285                 wpa_s->sme.prev_bssid_set = 0;
 286
 287         wpa_s->sme.freq = params.freq;
 288         os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
 289         wpa_s->sme.ssid_len = params.ssid_len;
 290
 291         params.auth_alg = WPA_AUTH_ALG_OPEN;
 292 #ifdef IEEE8021X_EAPOL
 293         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 294                 if (ssid->leap) {
 295                         if (ssid->non_leap == 0)
 296                                 params.auth_alg = WPA_AUTH_ALG_LEAP;
 297                         else
 298                                 params.auth_alg |= WPA_AUTH_ALG_LEAP;
 299                 }
 300         }
 301 #endif /* IEEE8021X_EAPOL */
 302         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
 303                 params.auth_alg);
 304         if (ssid->auth_alg) {
 305                 params.auth_alg = ssid->auth_alg;
 306                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
 307                         "0x%x", params.auth_alg);
 308         }
 309 #ifdef CONFIG_SAE
 310         wpa_s->sme.sae_pmksa_caching = 0;
 311         if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
 312                 const u8 *rsn;
 313                 struct wpa_ie_data ied;
 314
 315                 rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
 316                 if (!rsn) {
 317                         wpa_dbg(wpa_s, MSG_DEBUG,
 318                                 "SAE enabled, but target BSS does not advertise RSN");
 319 #ifdef CONFIG_DPP
 320                 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
 321                            (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
 322                            (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
 323                         wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
 324 #endif /* CONFIG_DPP */
 325                 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
 326                            wpa_key_mgmt_sae(ied.key_mgmt)) {
 327                         wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
 328                         params.auth_alg = WPA_AUTH_ALG_SAE;
 329                 } else {
 330                         wpa_dbg(wpa_s, MSG_DEBUG,
 331                                 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
 332                 }
 333         }
 334 #endif /* CONFIG_SAE */
 335
 336         for (i = 0; i < NUM_WEP_KEYS; i++) {
 337                 if (ssid->wep_key_len[i])
 338                         params.wep_key[i] = ssid->wep_key[i];
 339                 params.wep_key_len[i] = ssid->wep_key_len[i];
 340         }
 341         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
 342
 343         bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
 344         os_memset(wpa_s->bssid, 0, ETH_ALEN);
 345         os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
 346         if (bssid_changed)
 347                 wpas_notify_bssid_changed(wpa_s);
 348
 349         if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
 350              wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
 351             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
 352                 int try_opportunistic;
 353                 const u8 *cache_id = NULL;
 354
 355                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
 356                                      wpa_s->conf->okc :
 357                                      ssid->proactive_key_caching) &&
 358                         (ssid->proto & WPA_PROTO_RSN);
 359 #ifdef CONFIG_FILS
 360                 if (wpa_key_mgmt_fils(ssid->key_mgmt))
 361                         cache_id = wpa_bss_get_fils_cache_id(bss);
 362 #endif /* CONFIG_FILS */
 363                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
 364                                             wpa_s->current_ssid,
 365                                             try_opportunistic, cache_id,
 366                                             0) == 0)
 367                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
 368                 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
 369                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
 370                                               wpa_s->sme.assoc_req_ie,
 371                                               &wpa_s->sme.assoc_req_ie_len)) {
 372                         wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
 373                                 "key management and encryption suites");
 374                         wpas_connect_work_done(wpa_s);
 375                         return;
 376                 }
 377 #ifdef CONFIG_HS20
 378         } else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
 379                    (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
 380                 /* No PMKSA caching, but otherwise similar to RSN/WPA */
 381                 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
 382                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
 383                                               wpa_s->sme.assoc_req_ie,
 384                                               &wpa_s->sme.assoc_req_ie_len)) {
 385                         wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
 386                                 "key management and encryption suites");
 387                         wpas_connect_work_done(wpa_s);
 388                         return;
 389                 }
 390 #endif /* CONFIG_HS20 */
 391         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
 392                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
 393                 /*
 394                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
 395                  * use non-WPA since the scan results did not indicate that the
 396                  * AP is using WPA or WPA2.
 397                  */
 398                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
 399                 wpa_s->sme.assoc_req_ie_len = 0;
 400         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
 401                 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
 402                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
 403                                               wpa_s->sme.assoc_req_ie,
 404                                               &wpa_s->sme.assoc_req_ie_len)) {
 405                         wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
 406                                 "key management and encryption suites (no "
 407                                 "scan results)");
 408                         wpas_connect_work_done(wpa_s);
 409                         return;
 410                 }
 411 #ifdef CONFIG_WPS
 412         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 413                 struct wpabuf *wps_ie;
 414                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
 415                 if (wps_ie && wpabuf_len(wps_ie) <=
 416                     sizeof(wpa_s->sme.assoc_req_ie)) {
 417                         wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
 418                         os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
 419                                   wpa_s->sme.assoc_req_ie_len);
 420                 } else
 421                         wpa_s->sme.assoc_req_ie_len = 0;
 422                 wpabuf_free(wps_ie);
 423                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
 424 #endif /* CONFIG_WPS */
 425         } else {
 426                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
 427                 wpa_s->sme.assoc_req_ie_len = 0;
 428         }
 429
 430         /* In case the WPA vendor IE is used, it should be placed after all the
 431          * non-vendor IEs, as the lower layer expects the IEs to be ordered as
 432          * defined in the standard. Store the WPA IE so it can later be
 433          * inserted at the correct location.
 434          */
 435         wpa_ie = NULL;
 436         wpa_ie_len = 0;
 437         if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
 438                 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
 439                                    wpa_s->sme.assoc_req_ie_len);
 440                 if (wpa_ie) {
 441                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
 442
 443                         wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
 444                         wpa_s->sme.assoc_req_ie_len = 0;
 445                 } else {
 446                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
 447                         wpas_connect_work_done(wpa_s);
 448                         return;
 449                 }
 450         }
 451
 452 #ifdef CONFIG_IEEE80211R
 453         ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
 454         if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
 455                 md = ie + 2;
 456         wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
 457         if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
 458                    !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
 459                 md = NULL;
 460         if (md) {
 461                 /* Prepare for the next transition */
 462                 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
 463         }
 464
 465         if (md) {
 466                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
 467                         md[0], md[1]);
 468
 469                 if (wpa_s->sme.assoc_req_ie_len + 5 <
 470                     sizeof(wpa_s->sme.assoc_req_ie)) {
 471                         struct rsn_mdie *mdie;
 472                         u8 *pos = wpa_s->sme.assoc_req_ie +
 473                                 wpa_s->sme.assoc_req_ie_len;
 474                         *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 475                         *pos++ = sizeof(*mdie);
 476                         mdie = (struct rsn_mdie *) pos;
 477                         os_memcpy(mdie->mobility_domain, md,
 478                                   MOBILITY_DOMAIN_ID_LEN);
 479                         mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
 480                         wpa_s->sme.assoc_req_ie_len += 5;
 481                 }
 482
 483                 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
 484                     os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
 485                     wpa_sm_has_ptk(wpa_s->wpa)) {
 486                         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
 487                                 "over-the-air");
 488                         params.auth_alg = WPA_AUTH_ALG_FT;
 489                         params.ie = wpa_s->sme.ft_ies;
 490                         params.ie_len = wpa_s->sme.ft_ies_len;
 491                 }
 492         }
 493 #endif /* CONFIG_IEEE80211R */
 494
 495 #ifdef CONFIG_IEEE80211W
 496         wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
 497         if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
 498                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
 499                 struct wpa_ie_data _ie;
 500                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
 501                     _ie.capabilities &
 502                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
 503                         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
 504                                 "MFP: require MFP");
 505                         wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
 506                 }
 507         }
 508 #endif /* CONFIG_IEEE80211W */
 509
 510 #ifdef CONFIG_P2P
 511         if (wpa_s->global->p2p) {
 512                 u8 *pos;
 513                 size_t len;
 514                 int res;
 515                 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
 516                 len = sizeof(wpa_s->sme.assoc_req_ie) -
 517                         wpa_s->sme.assoc_req_ie_len;
 518                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
 519                                             ssid->p2p_group);
 520                 if (res >= 0)
 521                         wpa_s->sme.assoc_req_ie_len += res;
 522         }
 523 #endif /* CONFIG_P2P */
 524
 525 #ifdef CONFIG_FST
 526         if (wpa_s->fst_ies) {
 527                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
 528
 529                 if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
 530                     sizeof(wpa_s->sme.assoc_req_ie)) {
 531                         os_memcpy(wpa_s->sme.assoc_req_ie +
 532                                   wpa_s->sme.assoc_req_ie_len,
 533                                   wpabuf_head(wpa_s->fst_ies),
 534                                   fst_ies_len);
 535                         wpa_s->sme.assoc_req_ie_len += fst_ies_len;
 536                 }
 537         }
 538 #endif /* CONFIG_FST */
 539
 540         sme_auth_handle_rrm(wpa_s, bss);
 541
 542         wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
 543                 wpa_s, ssid, bss->freq,
 544                 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
 545                 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
 546
 547         if (params.p2p)
 548                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
 549         else
 550                 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
 551
 552         ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
 553                                              sizeof(ext_capab));
 554         if (ext_capab_len > 0) {
 555                 u8 *pos = wpa_s->sme.assoc_req_ie;
 556                 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
 557                         pos += 2 + pos[1];
 558                 os_memmove(pos + ext_capab_len, pos,
 559                            wpa_s->sme.assoc_req_ie_len -
 560                            (pos - wpa_s->sme.assoc_req_ie));
 561                 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
 562                 os_memcpy(pos, ext_capab, ext_capab_len);
 563         }
 564
 565 #ifdef CONFIG_HS20
 566         if (is_hs20_network(wpa_s, ssid, bss)) {
 567                 struct wpabuf *hs20;
 568
 569                 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
 570                 if (hs20) {
 571                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
 572                         size_t len;
 573
 574                         wpas_hs20_add_indication(hs20, pps_mo_id,
 575                                                  get_hs20_version(bss));
 576                         wpas_hs20_add_roam_cons_sel(hs20, ssid);
 577                         len = sizeof(wpa_s->sme.assoc_req_ie) -
 578                                 wpa_s->sme.assoc_req_ie_len;
 579                         if (wpabuf_len(hs20) <= len) {
 580                                 os_memcpy(wpa_s->sme.assoc_req_ie +
 581                                           wpa_s->sme.assoc_req_ie_len,
 582                                           wpabuf_head(hs20), wpabuf_len(hs20));
 583                                 wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
 584                         }
 585                         wpabuf_free(hs20);
 586                 }
 587         }
 588 #endif /* CONFIG_HS20 */
 589
 590         if (wpa_ie) {
 591                 size_t len;
 592
 593                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
 594
 595                 len = sizeof(wpa_s->sme.assoc_req_ie) -
 596                         wpa_s->sme.assoc_req_ie_len;
 597
 598                 if (len > wpa_ie_len) {
 599                         os_memcpy(wpa_s->sme.assoc_req_ie +
 600                                   wpa_s->sme.assoc_req_ie_len,
 601                                   wpa_ie, wpa_ie_len);
 602                         wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
 603                 } else {
 604                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
 605                 }
 606
 607                 os_free(wpa_ie);
 608         }
 609
 610         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
 611                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
 612                 size_t len;
 613
 614                 len = sizeof(wpa_s->sme.assoc_req_ie) -
 615                         wpa_s->sme.assoc_req_ie_len;
 616                 if (wpabuf_len(buf) <= len) {
 617                         os_memcpy(wpa_s->sme.assoc_req_ie +
 618                                   wpa_s->sme.assoc_req_ie_len,
 619                                   wpabuf_head(buf), wpabuf_len(buf));
 620                         wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
 621                 }
 622         }
 623
 624 #ifdef CONFIG_MBO
 625         mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
 626         if (mbo_ie) {
 627                 int len;
 628
 629                 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
 630                                   wpa_s->sme.assoc_req_ie_len,
 631                                   sizeof(wpa_s->sme.assoc_req_ie) -
 632                                   wpa_s->sme.assoc_req_ie_len,
 633                                   !!mbo_attr_from_mbo_ie(mbo_ie,
 634                                                          OCE_ATTR_ID_CAPA_IND));
 635                 if (len >= 0)
 636                         wpa_s->sme.assoc_req_ie_len += len;
 637         }
 638 #endif /* CONFIG_MBO */
 639
 640 #ifdef CONFIG_SAE
 641         if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
 642             pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid, ssid, 0,
 643                                     NULL,
 644                                     wpa_s->key_mgmt == WPA_KEY_MGMT_FT_SAE ?
 645                                     WPA_KEY_MGMT_FT_SAE :
 646                                     WPA_KEY_MGMT_SAE) == 0) {
 647                 wpa_dbg(wpa_s, MSG_DEBUG,
 648                         "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
 649                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
 650                 params.auth_alg = WPA_AUTH_ALG_OPEN;
 651                 wpa_s->sme.sae_pmksa_caching = 1;
 652         }
 653
 654         if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
 655                 if (start)
 656                         resp = sme_auth_build_sae_commit(wpa_s, ssid,
 657                                                          bss->bssid, 0,
 658                                                          start == 2);
 659                 else
 660                         resp = sme_auth_build_sae_confirm(wpa_s, 0);
 661                 if (resp == NULL) {
 662                         wpas_connection_failed(wpa_s, bss->bssid);
 663                         return;
 664                 }
 665                 params.auth_data = wpabuf_head(resp);
 666                 params.auth_data_len = wpabuf_len(resp);
 667                 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
 668         }
 669 #endif /* CONFIG_SAE */
 670
 671         old_ssid = wpa_s->current_ssid;
 672         wpa_s->current_ssid = ssid;
 673         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
 674         wpa_supplicant_initiate_eapol(wpa_s);
 675
 676 #ifdef CONFIG_FILS
 677         /* TODO: FILS operations can in some cases be done between different
 678          * network_ctx (i.e., same credentials can be used with multiple
 679          * networks). */
 680         if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
 681             wpa_key_mgmt_fils(ssid->key_mgmt)) {
 682                 const u8 *indic;
 683                 u16 fils_info;
 684                 const u8 *realm, *username, *rrk;
 685                 size_t realm_len, username_len, rrk_len;
 686                 u16 next_seq_num;
 687
 688                 /*
 689                  * Check FILS Indication element (FILS Information field) bits
 690                  * indicating supported authentication algorithms against local
 691                  * configuration (ssid->fils_dh_group). Try to use FILS
 692                  * authentication only if the AP supports the combination in the
 693                  * network profile. */
 694                 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
 695                 if (!indic || indic[1] < 2) {
 696                         wpa_printf(MSG_DEBUG, "SME: " MACSTR
 697                                    " does not include FILS Indication element - cannot use FILS authentication with it",
 698                                    MAC2STR(bss->bssid));
 699                         goto no_fils;
 700                 }
 701
 702                 fils_info = WPA_GET_LE16(indic + 2);
 703                 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
 704                         wpa_printf(MSG_DEBUG, "SME: " MACSTR
 705                                    " does not support FILS SK without PFS - cannot use FILS authentication with it",
 706                                    MAC2STR(bss->bssid));
 707                         goto no_fils;
 708                 }
 709                 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
 710                         wpa_printf(MSG_DEBUG, "SME: " MACSTR
 711                                    " does not support FILS SK with PFS - cannot use FILS authentication with it",
 712                                    MAC2STR(bss->bssid));
 713                         goto no_fils;
 714                 }
 715
 716                 if (wpa_s->last_con_fail_realm &&
 717                     eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
 718                                           &username, &username_len,
 719                                           &realm, &realm_len, &next_seq_num,
 720                                           &rrk, &rrk_len) == 0 &&
 721                     realm && realm_len == wpa_s->last_con_fail_realm_len &&
 722                     os_memcmp(realm, wpa_s->last_con_fail_realm,
 723                               realm_len) == 0) {
 724                         wpa_printf(MSG_DEBUG,
 725                                    "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
 726                         goto no_fils;
 727                 }
 728
 729                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
 730                                             ssid, 0,
 731                                             wpa_bss_get_fils_cache_id(bss),
 732                                             0) == 0)
 733                         wpa_printf(MSG_DEBUG,
 734                                    "SME: Try to use FILS with PMKSA caching");
 735                 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
 736                 if (resp) {
 737                         int auth_alg;
 738
 739                         if (ssid->fils_dh_group)
 740                                 wpa_printf(MSG_DEBUG,
 741                                            "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
 742                                            ssid->fils_dh_group);
 743                         else
 744                                 wpa_printf(MSG_DEBUG,
 745                                            "SME: Try to use FILS SK authentication without PFS");
 746                         auth_alg = ssid->fils_dh_group ?
 747                                 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
 748                         params.auth_alg = auth_alg;
 749                         params.auth_data = wpabuf_head(resp);
 750                         params.auth_data_len = wpabuf_len(resp);
 751                         wpa_s->sme.auth_alg = auth_alg;
 752                 }
 753         }
 754 no_fils:
 755 #endif /* CONFIG_FILS */
 756
 757         wpa_supplicant_cancel_sched_scan(wpa_s);
 758         wpa_supplicant_cancel_scan(wpa_s);
 759
 760         wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
 761                 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
 762                 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
 763
 764         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
 765         wpa_clear_keys(wpa_s, bss->bssid);
 766         wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
 767         if (old_ssid != wpa_s->current_ssid)
 768                 wpas_notify_network_changed(wpa_s);
 769
 770 #ifdef CONFIG_HS20
 771         hs20_configure_frame_filters(wpa_s);
 772 #endif /* CONFIG_HS20 */
 773
 774 #ifdef CONFIG_P2P
 775         /*
 776          * If multi-channel concurrency is not supported, check for any
 777          * frequency conflict. In case of any frequency conflict, remove the
 778          * least prioritized connection.
 779          */
 780         if (wpa_s->num_multichan_concurrent < 2) {
 781                 int freq, num;
 782                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
 783                 if (num > 0 && freq > 0 && freq != params.freq) {
 784                         wpa_printf(MSG_DEBUG,
 785                                    "Conflicting frequency found (%d != %d)",
 786                                    freq, params.freq);
 787                         if (wpas_p2p_handle_frequency_conflicts(wpa_s,
 788                                                                 params.freq,
 789                                                                 ssid) < 0) {
 790                                 wpas_connection_failed(wpa_s, bss->bssid);
 791                                 wpa_supplicant_mark_disassoc(wpa_s);
 792                                 wpabuf_free(resp);
 793                                 wpas_connect_work_done(wpa_s);
 794                                 return;
 795                         }
 796                 }
 797         }
 798 #endif /* CONFIG_P2P */
 799
 800         if (skip_auth) {
 801                 wpa_msg(wpa_s, MSG_DEBUG,
 802                         "SME: Skip authentication step on reassoc-to-same-BSS");
 803                 wpabuf_free(resp);
 804                 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
 805                 return;
 806         }
 807
 808
 809         wpa_s->sme.auth_alg = params.auth_alg;
 810         if (wpa_drv_authenticate(wpa_s, &params) < 0) {
 811                 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
 812                         "driver failed");
 813                 wpas_connection_failed(wpa_s, bss->bssid);
 814                 wpa_supplicant_mark_disassoc(wpa_s);
 815                 wpabuf_free(resp);
 816                 wpas_connect_work_done(wpa_s);
 817                 return;
 818         }
 819
 820         eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
 821                                NULL);
 822
 823         /*
 824          * Association will be started based on the authentication event from
 825          * the driver.
 826          */
 827
 828         wpabuf_free(resp);
 829 }
 830
 831
 832 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
 833 {
 834         struct wpa_connect_work *cwork = work->ctx;
 835         struct wpa_supplicant *wpa_s = work->wpa_s;
 836
 837         if (deinit) {
 838                 if (work->started)
 839                         wpa_s->connect_work = NULL;
 840
 841                 wpas_connect_work_free(cwork);
 842                 return;
 843         }
 844
 845         wpa_s->connect_work = work;
 846
 847         if (cwork->bss_removed ||
 848             !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
 849             wpas_network_disabled(wpa_s, cwork->ssid)) {
 850                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
 851                 wpas_connect_work_done(wpa_s);
 852                 return;
 853         }
 854
 855         /* Starting new connection, so clear the possibly used WPA IE from the
 856          * previous association. */
 857         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 858
 859         sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
 860 }
 861
 862
 863 void sme_authenticate(struct wpa_supplicant *wpa_s,
 864                       struct wpa_bss *bss, struct wpa_ssid *ssid)
 865 {
 866         struct wpa_connect_work *cwork;
 867
 868         if (bss == NULL || ssid == NULL)
 869                 return;
 870         if (wpa_s->connect_work) {
 871                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
 872                 return;
 873         }
 874
 875         if (radio_work_pending(wpa_s, "sme-connect")) {
 876                 /*
 877                  * The previous sme-connect work might no longer be valid due to
 878                  * the fact that the BSS list was updated. In addition, it makes
 879                  * sense to adhere to the 'newer' decision.
 880                  */
 881                 wpa_dbg(wpa_s, MSG_DEBUG,
 882                         "SME: Remove previous pending sme-connect");
 883                 radio_remove_works(wpa_s, "sme-connect", 0);
 884         }
 885
 886         wpas_abort_ongoing_scan(wpa_s);
 887
 888         cwork = os_zalloc(sizeof(*cwork));
 889         if (cwork == NULL)
 890                 return;
 891         cwork->bss = bss;
 892         cwork->ssid = ssid;
 893         cwork->sme = 1;
 894
 895 #ifdef CONFIG_SAE
 896         wpa_s->sme.sae.state = SAE_NOTHING;
 897         wpa_s->sme.sae.send_confirm = 0;
 898         wpa_s->sme.sae_group_index = 0;
 899 #endif /* CONFIG_SAE */
 900
 901         if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
 902                            sme_auth_start_cb, cwork) < 0)
 903                 wpas_connect_work_free(cwork);
 904 }
 905
 906
 907 #ifdef CONFIG_SAE
 908
 909 static int sme_external_auth_build_buf(struct wpabuf *buf,
 910                                        struct wpabuf *params,
 911                                        const u8 *sa, const u8 *da,
 912                                        u16 auth_transaction, u16 seq_num)
 913 {
 914         struct ieee80211_mgmt *resp;
 915
 916         resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
 917                                         u.auth.variable));
 918
 919         resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
 920                                            (WLAN_FC_STYPE_AUTH << 4));
 921         os_memcpy(resp->da, da, ETH_ALEN);
 922         os_memcpy(resp->sa, sa, ETH_ALEN);
 923         os_memcpy(resp->bssid, da, ETH_ALEN);
 924         resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
 925         resp->seq_ctrl = host_to_le16(seq_num << 4);
 926         resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
 927         resp->u.auth.status_code = host_to_le16(WLAN_STATUS_SUCCESS);
 928         if (params)
 929                 wpabuf_put_buf(buf, params);
 930
 931         return 0;
 932 }
 933
 934
 935 static void sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
 936                                               const u8 *bssid,
 937                                               struct wpa_ssid *ssid)
 938 {
 939         struct wpabuf *resp, *buf;
 940
 941         resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid, 1, 0);
 942         if (!resp)
 943                 return;
 944
 945         wpa_s->sme.sae.state = SAE_COMMITTED;
 946         buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp));
 947         if (!buf) {
 948                 wpabuf_free(resp);
 949                 return;
 950         }
 951
 952         wpa_s->sme.seq_num++;
 953         sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
 954                                     bssid, 1, wpa_s->sme.seq_num);
 955         wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0);
 956         wpabuf_free(resp);
 957         wpabuf_free(buf);
 958 }
 959
 960
 961 static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
 962                                           u16 status)
 963 {
 964         struct external_auth params;
 965
 966         os_memset(&params, 0, sizeof(params));
 967         params.status = status;
 968         params.ssid = wpa_s->sme.ext_auth.ssid;
 969         params.ssid_len = wpa_s->sme.ext_auth.ssid_len;
 970         params.bssid = wpa_s->sme.ext_auth.bssid;
 971         wpa_drv_send_external_auth_status(wpa_s, &params);
 972 }
 973
 974
 975 static void sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
 976                                            union wpa_event_data *data)
 977 {
 978         struct wpa_ssid *ssid;
 979         size_t ssid_str_len = data->external_auth.ssid_len;
 980         const u8 *ssid_str = data->external_auth.ssid;
 981
 982         /* Get the SSID conf from the ssid string obtained */
 983         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 984                 if (!wpas_network_disabled(wpa_s, ssid) &&
 985                     ssid_str_len == ssid->ssid_len &&
 986                     os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
 987                     (ssid->key_mgmt & (WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE)))
 988                         break;
 989         }
 990         if (ssid)
 991                 sme_external_auth_send_sae_commit(wpa_s,
 992                                                   data->external_auth.bssid,
 993                                                   ssid);
 994         else
 995                 sme_send_external_auth_status(wpa_s,
 996                                               WLAN_STATUS_UNSPECIFIED_FAILURE);
 997 }
 998
 999
1000 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1001                                                const u8 *da)
1002 {
1003         struct wpabuf *resp, *buf;
1004
1005         resp = sme_auth_build_sae_confirm(wpa_s, 1);
1006         if (!resp) {
1007                 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1008                 return;
1009         }
1010
1011         wpa_s->sme.sae.state = SAE_CONFIRMED;
1012         buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp));
1013         if (!buf) {
1014                 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1015                 wpabuf_free(resp);
1016                 return;
1017         }
1018         wpa_s->sme.seq_num++;
1019         sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1020                                     da, 2, wpa_s->sme.seq_num);
1021         wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0);
1022         wpabuf_free(resp);
1023         wpabuf_free(buf);
1024 }
1025
1026
1027 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1028                                union wpa_event_data *data)
1029 {
1030         if (RSN_SELECTOR_GET(&data->external_auth.key_mgmt_suite) !=
1031             RSN_AUTH_KEY_MGMT_SAE)
1032                 return;
1033
1034         if (data->external_auth.action == EXT_AUTH_START) {
1035                 os_memcpy(&wpa_s->sme.ext_auth, data,
1036                           sizeof(struct external_auth));
1037                 wpa_s->sme.seq_num = 0;
1038                 wpa_s->sme.sae.state = SAE_NOTHING;
1039                 wpa_s->sme.sae.send_confirm = 0;
1040                 wpa_s->sme.sae_group_index = 0;
1041                 sme_handle_external_auth_start(wpa_s, data);
1042         } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1043                 /* Report failure to driver for the wrong trigger */
1044                 sme_send_external_auth_status(wpa_s,
1045                                               WLAN_STATUS_UNSPECIFIED_FAILURE);
1046         }
1047 }
1048
1049
1050 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
1051                         u16 status_code, const u8 *data, size_t len,
1052                         int external, const u8 *sa)
1053 {
1054         int *groups;
1055
1056         wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1057                 "status code %u", auth_transaction, status_code);
1058
1059         if (auth_transaction == 1 &&
1060             status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1061             wpa_s->sme.sae.state == SAE_COMMITTED &&
1062             (external || wpa_s->current_bss) && wpa_s->current_ssid) {
1063                 int default_groups[] = { 19, 20, 21, 0 };
1064                 u16 group;
1065
1066                 groups = wpa_s->conf->sae_groups;
1067                 if (!groups || groups[0] <= 0)
1068                         groups = default_groups;
1069
1070                 if (len < sizeof(le16)) {
1071                         wpa_dbg(wpa_s, MSG_DEBUG,
1072                                 "SME: Too short SAE anti-clogging token request");
1073                         return -1;
1074                 }
1075                 group = WPA_GET_LE16(data);
1076                 wpa_dbg(wpa_s, MSG_DEBUG,
1077                         "SME: SAE anti-clogging token requested (group %u)",
1078                         group);
1079                 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1080                     WLAN_STATUS_SUCCESS) {
1081                         wpa_dbg(wpa_s, MSG_ERROR,
1082                                 "SME: SAE group %u of anti-clogging request is invalid",
1083                                 group);
1084                         return -1;
1085                 }
1086                 wpabuf_free(wpa_s->sme.sae_token);
1087                 wpa_s->sme.sae_token = wpabuf_alloc_copy(data + sizeof(le16),
1088                                                          len - sizeof(le16));
1089                 if (!external)
1090                         sme_send_authentication(wpa_s, wpa_s->current_bss,
1091                                                 wpa_s->current_ssid, 2);
1092                 else
1093                         sme_external_auth_send_sae_commit(
1094                                 wpa_s, wpa_s->sme.ext_auth.bssid,
1095                                 wpa_s->current_ssid);
1096                 return 0;
1097         }
1098
1099         if (auth_transaction == 1 &&
1100             status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1101             wpa_s->sme.sae.state == SAE_COMMITTED &&
1102             (external || wpa_s->current_bss) && wpa_s->current_ssid) {
1103                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
1104                 wpa_s->sme.sae_group_index++;
1105                 if (sme_set_sae_group(wpa_s) < 0)
1106                         return -1; /* no other groups enabled */
1107                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
1108                 if (!external)
1109                         sme_send_authentication(wpa_s, wpa_s->current_bss,
1110                                                 wpa_s->current_ssid, 1);
1111                 else
1112                         sme_external_auth_send_sae_commit(
1113                                 wpa_s, wpa_s->sme.ext_auth.bssid,
1114                                 wpa_s->current_ssid);
1115                 return 0;
1116         }
1117
1118         if (auth_transaction == 1 &&
1119             status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1120                 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1121
1122                 wpa_msg(wpa_s, MSG_INFO,
1123                         WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1124                         MAC2STR(bssid));
1125                 return -1;
1126         }
1127
1128         if (status_code != WLAN_STATUS_SUCCESS)
1129                 return -1;
1130
1131         if (auth_transaction == 1) {
1132                 u16 res;
1133
1134                 groups = wpa_s->conf->sae_groups;
1135
1136                 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
1137                 if ((!external && wpa_s->current_bss == NULL) ||
1138                     wpa_s->current_ssid == NULL)
1139                         return -1;
1140                 if (wpa_s->sme.sae.state != SAE_COMMITTED)
1141                         return -1;
1142                 if (groups && groups[0] <= 0)
1143                         groups = NULL;
1144                 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
1145                                        groups);
1146                 if (res == SAE_SILENTLY_DISCARD) {
1147                         wpa_printf(MSG_DEBUG,
1148                                    "SAE: Drop commit message due to reflection attack");
1149                         return 0;
1150                 }
1151                 if (res != WLAN_STATUS_SUCCESS)
1152                         return -1;
1153
1154                 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1155                         wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1156                                    "commit");
1157                         return -1;
1158                 }
1159
1160                 wpabuf_free(wpa_s->sme.sae_token);
1161                 wpa_s->sme.sae_token = NULL;
1162                 if (!external)
1163                         sme_send_authentication(wpa_s, wpa_s->current_bss,
1164                                                 wpa_s->current_ssid, 0);
1165                 else
1166                         sme_external_auth_send_sae_confirm(wpa_s, sa);
1167                 return 0;
1168         } else if (auth_transaction == 2) {
1169                 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
1170                 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
1171                         return -1;
1172                 if (sae_check_confirm(&wpa_s->sme.sae, data, len) < 0)
1173                         return -1;
1174                 wpa_s->sme.sae.state = SAE_ACCEPTED;
1175                 sae_clear_temp_data(&wpa_s->sme.sae);
1176
1177                 if (external) {
1178                         /* Report success to driver */
1179                         sme_send_external_auth_status(wpa_s,
1180                                                       WLAN_STATUS_SUCCESS);
1181                 }
1182
1183                 return 1;
1184         }
1185
1186         return -1;
1187 }
1188
1189
1190 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1191                                const u8 *auth_frame, size_t len)
1192 {
1193         const struct ieee80211_mgmt *header;
1194         size_t auth_length;
1195
1196         header = (const struct ieee80211_mgmt *) auth_frame;
1197         auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1198
1199         if (len < auth_length) {
1200                 /* Notify failure to the driver */
1201                 sme_send_external_auth_status(wpa_s,
1202                                               WLAN_STATUS_UNSPECIFIED_FAILURE);
1203                 return;
1204         }
1205
1206         if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
1207                 int res;
1208
1209                 res = sme_sae_auth(
1210                         wpa_s, le_to_host16(header->u.auth.auth_transaction),
1211                         le_to_host16(header->u.auth.status_code),
1212                         header->u.auth.variable,
1213                         len - auth_length, 1, header->sa);
1214                 if (res < 0) {
1215                         /* Notify failure to the driver */
1216                         sme_send_external_auth_status(
1217                                 wpa_s, WLAN_STATUS_UNSPECIFIED_FAILURE);
1218                         return;
1219                 }
1220                 if (res != 1)
1221                         return;
1222
1223                 wpa_printf(MSG_DEBUG,
1224                            "SME: SAE completed - setting PMK for 4-way handshake");
1225                 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN,
1226                                wpa_s->sme.sae.pmkid, wpa_s->pending_bssid);
1227         }
1228 }
1229
1230 #endif /* CONFIG_SAE */
1231
1232
1233 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
1234 {
1235         struct wpa_ssid *ssid = wpa_s->current_ssid;
1236
1237         if (ssid == NULL) {
1238                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1239                         "when network is not selected");
1240                 return;
1241         }
1242
1243         if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
1244                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1245                         "when not in authenticating state");
1246                 return;
1247         }
1248
1249         if (os_memcmp(wpa_s->pending_bssid, data->auth.peer, ETH_ALEN) != 0) {
1250                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
1251                         "unexpected peer " MACSTR,
1252                         MAC2STR(data->auth.peer));
1253                 return;
1254         }
1255
1256         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
1257                 " auth_type=%d auth_transaction=%d status_code=%d",
1258                 MAC2STR(data->auth.peer), data->auth.auth_type,
1259                 data->auth.auth_transaction, data->auth.status_code);
1260         wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
1261                     data->auth.ies, data->auth.ies_len);
1262
1263         eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
1264
1265 #ifdef CONFIG_SAE
1266         if (data->auth.auth_type == WLAN_AUTH_SAE) {
1267                 int res;
1268                 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
1269                                    data->auth.status_code, data->auth.ies,
1270                                    data->auth.ies_len, 0, NULL);
1271                 if (res < 0) {
1272                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1273                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1274
1275                 }
1276                 if (res != 1)
1277                         return;
1278
1279                 wpa_printf(MSG_DEBUG, "SME: SAE completed - setting PMK for "
1280                            "4-way handshake");
1281                 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN,
1282                                wpa_s->sme.sae.pmkid, wpa_s->pending_bssid);
1283         }
1284 #endif /* CONFIG_SAE */
1285
1286         if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
1287                 char *ie_txt = NULL;
1288
1289                 if (data->auth.ies && data->auth.ies_len) {
1290                         size_t buflen = 2 * data->auth.ies_len + 1;
1291                         ie_txt = os_malloc(buflen);
1292                         if (ie_txt) {
1293                                 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
1294                                                  data->auth.ies_len);
1295                         }
1296                 }
1297                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1298                         " auth_type=%u auth_transaction=%u status_code=%u%s%s",
1299                         MAC2STR(data->auth.peer), data->auth.auth_type,
1300                         data->auth.auth_transaction, data->auth.status_code,
1301                         ie_txt ? " ie=" : "",
1302                         ie_txt ? ie_txt : "");
1303                 os_free(ie_txt);
1304
1305 #ifdef CONFIG_FILS
1306                 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
1307                     wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
1308                         fils_connection_failure(wpa_s);
1309 #endif /* CONFIG_FILS */
1310
1311                 if (data->auth.status_code !=
1312                     WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
1313                     wpa_s->sme.auth_alg == data->auth.auth_type ||
1314                     wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
1315                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1316                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1317                         return;
1318                 }
1319
1320                 wpas_connect_work_done(wpa_s);
1321
1322                 switch (data->auth.auth_type) {
1323                 case WLAN_AUTH_OPEN:
1324                         wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
1325
1326                         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
1327                         wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
1328                                                  wpa_s->current_ssid);
1329                         return;
1330
1331                 case WLAN_AUTH_SHARED_KEY:
1332                         wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
1333
1334                         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
1335                         wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
1336                                                  wpa_s->current_ssid);
1337                         return;
1338
1339                 default:
1340                         return;
1341                 }
1342         }
1343
1344 #ifdef CONFIG_IEEE80211R
1345         if (data->auth.auth_type == WLAN_AUTH_FT) {
1346                 const u8 *ric_ies = NULL;
1347                 size_t ric_ies_len = 0;
1348
1349                 if (wpa_s->ric_ies) {
1350                         ric_ies = wpabuf_head(wpa_s->ric_ies);
1351                         ric_ies_len = wpabuf_len(wpa_s->ric_ies);
1352                 }
1353                 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
1354                                             data->auth.ies_len, 0,
1355                                             data->auth.peer,
1356                                             ric_ies, ric_ies_len) < 0) {
1357                         wpa_dbg(wpa_s, MSG_DEBUG,
1358                                 "SME: FT Authentication response processing failed");
1359                         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1360                                 MACSTR
1361                                 " reason=%d locally_generated=1",
1362                                 MAC2STR(wpa_s->pending_bssid),
1363                                 WLAN_REASON_DEAUTH_LEAVING);
1364                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1365                         wpa_supplicant_mark_disassoc(wpa_s);
1366                         return;
1367                 }
1368         }
1369 #endif /* CONFIG_IEEE80211R */
1370
1371 #ifdef CONFIG_FILS
1372         if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
1373             data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
1374                 u16 expect_auth_type;
1375
1376                 expect_auth_type = wpa_s->sme.auth_alg ==
1377                         WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
1378                         WLAN_AUTH_FILS_SK;
1379                 if (data->auth.auth_type != expect_auth_type) {
1380                         wpa_dbg(wpa_s, MSG_DEBUG,
1381                                 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
1382                                 data->auth.auth_type, expect_auth_type);
1383                         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1384                                 MACSTR
1385                                 " reason=%d locally_generated=1",
1386                                 MAC2STR(wpa_s->pending_bssid),
1387                                 WLAN_REASON_DEAUTH_LEAVING);
1388                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1389                         wpa_supplicant_mark_disassoc(wpa_s);
1390                         return;
1391                 }
1392
1393                 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
1394                                       data->auth.ies, data->auth.ies_len) < 0) {
1395                         wpa_dbg(wpa_s, MSG_DEBUG,
1396                                 "SME: FILS Authentication response processing failed");
1397                         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1398                                 MACSTR
1399                                 " reason=%d locally_generated=1",
1400                                 MAC2STR(wpa_s->pending_bssid),
1401                                 WLAN_REASON_DEAUTH_LEAVING);
1402                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1403                         wpa_supplicant_mark_disassoc(wpa_s);
1404                         return;
1405                 }
1406         }
1407 #endif /* CONFIG_FILS */
1408
1409         sme_associate(wpa_s, ssid->mode, data->auth.peer,
1410                       data->auth.auth_type);
1411 }
1412
1413
1414 #ifdef CONFIG_IEEE80211R
1415 static void remove_ie(u8 *buf, size_t *len, u8 eid)
1416 {
1417         u8 *pos, *next, *end;
1418
1419         pos = (u8 *) get_ie(buf, *len, eid);
1420         if (pos) {
1421                 next = pos + 2 + pos[1];
1422                 end = buf + *len;
1423                 *len -= 2 + pos[1];
1424                 os_memmove(pos, next, end - next);
1425         }
1426 }
1427 #endif /* CONFIG_IEEE80211R */
1428
1429
1430 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
1431                    const u8 *bssid, u16 auth_type)
1432 {
1433         struct wpa_driver_associate_params params;
1434         struct ieee802_11_elems elems;
1435 #ifdef CONFIG_FILS
1436         u8 nonces[2 * FILS_NONCE_LEN];
1437 #endif /* CONFIG_FILS */
1438 #ifdef CONFIG_HT_OVERRIDES
1439         struct ieee80211_ht_capabilities htcaps;
1440         struct ieee80211_ht_capabilities htcaps_mask;
1441 #endif /* CONFIG_HT_OVERRIDES */
1442 #ifdef CONFIG_VHT_OVERRIDES
1443         struct ieee80211_vht_capabilities vhtcaps;
1444         struct ieee80211_vht_capabilities vhtcaps_mask;
1445 #endif /* CONFIG_VHT_OVERRIDES */
1446
1447         os_memset(&params, 0, sizeof(params));
1448
1449 #ifdef CONFIG_FILS
1450         if (auth_type == WLAN_AUTH_FILS_SK ||
1451             auth_type == WLAN_AUTH_FILS_SK_PFS) {
1452                 struct wpabuf *buf;
1453                 const u8 *snonce, *anonce;
1454                 const unsigned int max_hlp = 20;
1455                 struct wpabuf *hlp[max_hlp];
1456                 unsigned int i, num_hlp = 0;
1457                 struct fils_hlp_req *req;
1458
1459                 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
1460                                  list) {
1461                         hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
1462                                               wpabuf_len(req->pkt));
1463                         if (!hlp[num_hlp])
1464                                 break;
1465                         wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
1466                         wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
1467                                         ETH_ALEN);
1468                         wpabuf_put_data(hlp[num_hlp],
1469                                         "\xaa\xaa\x03\x00\x00\x00", 6);
1470                         wpabuf_put_buf(hlp[num_hlp], req->pkt);
1471                         num_hlp++;
1472                         if (num_hlp >= max_hlp)
1473                                 break;
1474                 }
1475
1476                 buf = fils_build_assoc_req(wpa_s->wpa, &params.fils_kek,
1477                                            &params.fils_kek_len, &snonce,
1478                                            &anonce,
1479                                            (const struct wpabuf **) hlp,
1480                                            num_hlp);
1481                 for (i = 0; i < num_hlp; i++)
1482                         wpabuf_free(hlp[i]);
1483                 if (!buf)
1484                         return;
1485                 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
1486                             wpa_s->sme.assoc_req_ie,
1487                             wpa_s->sme.assoc_req_ie_len);
1488 #ifdef CONFIG_IEEE80211R
1489                 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
1490                         /* Remove RSNE and MDE to allow them to be overridden
1491                          * with FILS+FT specific values from
1492                          * fils_build_assoc_req(). */
1493                         remove_ie(wpa_s->sme.assoc_req_ie,
1494                                   &wpa_s->sme.assoc_req_ie_len,
1495                                   WLAN_EID_RSN);
1496                         wpa_hexdump(MSG_DEBUG,
1497                                     "FILS: assoc_req after RSNE removal",
1498                                     wpa_s->sme.assoc_req_ie,
1499                                     wpa_s->sme.assoc_req_ie_len);
1500                         remove_ie(wpa_s->sme.assoc_req_ie,
1501                                   &wpa_s->sme.assoc_req_ie_len,
1502                                   WLAN_EID_MOBILITY_DOMAIN);
1503                         wpa_hexdump(MSG_DEBUG,
1504                                     "FILS: assoc_req after MDE removal",
1505                                     wpa_s->sme.assoc_req_ie,
1506                                     wpa_s->sme.assoc_req_ie_len);
1507                 }
1508 #endif /* CONFIG_IEEE80211R */
1509                 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
1510                 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
1511                     sizeof(wpa_s->sme.assoc_req_ie)) {
1512                         wpa_printf(MSG_ERROR,
1513                                    "FILS: Not enough buffer room for own AssocReq elements");
1514                         wpabuf_free(buf);
1515                         return;
1516                 }
1517                 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1518                           wpabuf_head(buf), wpabuf_len(buf));
1519                 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
1520                 wpabuf_free(buf);
1521                 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
1522                             wpa_s->sme.assoc_req_ie,
1523                             wpa_s->sme.assoc_req_ie_len);
1524
1525                 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
1526                 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
1527                 params.fils_nonces = nonces;
1528                 params.fils_nonces_len = sizeof(nonces);
1529         }
1530 #endif /* CONFIG_FILS */
1531
1532 #ifdef CONFIG_OWE
1533 #ifdef CONFIG_TESTING_OPTIONS
1534         if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
1535                        WLAN_EID_EXT_OWE_DH_PARAM)) {
1536                 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
1537         } else
1538 #endif /* CONFIG_TESTING_OPTIONS */
1539         if (auth_type == WLAN_AUTH_OPEN &&
1540             wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
1541                 struct wpabuf *owe_ie;
1542                 u16 group;
1543
1544                 if (wpa_s->current_ssid && wpa_s->current_ssid->owe_group) {
1545                         group = wpa_s->current_ssid->owe_group;
1546                 } else if (wpa_s->assoc_status_code ==
1547                            WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
1548                         if (wpa_s->last_owe_group == 19)
1549                                 group = 20;
1550                         else if (wpa_s->last_owe_group == 20)
1551                                 group = 21;
1552                         else
1553                                 group = OWE_DH_GROUP;
1554                 } else {
1555                         group = OWE_DH_GROUP;
1556                 }
1557
1558                 wpa_s->last_owe_group = group;
1559                 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
1560                 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
1561                 if (!owe_ie) {
1562                         wpa_printf(MSG_ERROR,
1563                                    "OWE: Failed to build IE for Association Request frame");
1564                         return;
1565                 }
1566                 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
1567                     sizeof(wpa_s->sme.assoc_req_ie)) {
1568                         wpa_printf(MSG_ERROR,
1569                                    "OWE: Not enough buffer room for own Association Request frame elements");
1570                         wpabuf_free(owe_ie);
1571                         return;
1572                 }
1573                 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1574                           wpabuf_head(owe_ie), wpabuf_len(owe_ie));
1575                 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
1576                 wpabuf_free(owe_ie);
1577         }
1578 #endif /* CONFIG_OWE */
1579
1580 #ifdef CONFIG_DPP2
1581         if (wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && wpa_s->current_ssid &&
1582             wpa_s->current_ssid->dpp_netaccesskey) {
1583                 struct wpa_ssid *ssid = wpa_s->current_ssid;
1584
1585                 dpp_pfs_free(wpa_s->dpp_pfs);
1586                 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
1587                                               ssid->dpp_netaccesskey_len);
1588                 if (!wpa_s->dpp_pfs) {
1589                         wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
1590                         /* Try to continue without PFS */
1591                         goto pfs_fail;
1592                 }
1593                 if (wpa_s->sme.assoc_req_ie_len +
1594                     wpabuf_len(wpa_s->dpp_pfs->ie) >
1595                     sizeof(wpa_s->sme.assoc_req_ie)) {
1596                         wpa_printf(MSG_ERROR,
1597                                    "DPP: Not enough buffer room for own Association Request frame elements");
1598                         dpp_pfs_free(wpa_s->dpp_pfs);
1599                         wpa_s->dpp_pfs = NULL;
1600                         goto pfs_fail;
1601                 }
1602                 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1603                           wpabuf_head(wpa_s->dpp_pfs->ie),
1604                           wpabuf_len(wpa_s->dpp_pfs->ie));
1605                 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
1606         }
1607 pfs_fail:
1608 #endif /* CONFIG_DPP2 */
1609
1610         if (wpa_s->current_ssid && wpa_s->current_ssid->multi_ap_backhaul_sta) {
1611                 size_t multi_ap_ie_len;
1612
1613                 multi_ap_ie_len = add_multi_ap_ie(
1614                         wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1615                         sizeof(wpa_s->sme.assoc_req_ie) -
1616                         wpa_s->sme.assoc_req_ie_len,
1617                         MULTI_AP_BACKHAUL_STA);
1618                 if (multi_ap_ie_len == 0) {
1619                         wpa_printf(MSG_ERROR,
1620                                    "Multi-AP: Failed to build Multi-AP IE");
1621                         return;
1622                 }
1623                 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
1624         }
1625
1626         params.bssid = bssid;
1627         params.ssid = wpa_s->sme.ssid;
1628         params.ssid_len = wpa_s->sme.ssid_len;
1629         params.freq.freq = wpa_s->sme.freq;
1630         params.bg_scan_period = wpa_s->current_ssid ?
1631                 wpa_s->current_ssid->bg_scan_period : -1;
1632         params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
1633                 wpa_s->sme.assoc_req_ie : NULL;
1634         params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
1635         wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
1636                     params.wpa_ie, params.wpa_ie_len);
1637         params.pairwise_suite = wpa_s->pairwise_cipher;
1638         params.group_suite = wpa_s->group_cipher;
1639         params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
1640         params.key_mgmt_suite = wpa_s->key_mgmt;
1641         params.wpa_proto = wpa_s->wpa_proto;
1642 #ifdef CONFIG_HT_OVERRIDES
1643         os_memset(&htcaps, 0, sizeof(htcaps));
1644         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
1645         params.htcaps = (u8 *) &htcaps;
1646         params.htcaps_mask = (u8 *) &htcaps_mask;
1647         wpa_supplicant_apply_ht_overrides(wpa_s, wpa_s->current_ssid, &params);
1648 #endif /* CONFIG_HT_OVERRIDES */
1649 #ifdef CONFIG_VHT_OVERRIDES
1650         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
1651         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
1652         params.vhtcaps = &vhtcaps;
1653         params.vhtcaps_mask = &vhtcaps_mask;
1654         wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
1655 #endif /* CONFIG_VHT_OVERRIDES */
1656 #ifdef CONFIG_IEEE80211R
1657         if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
1658             get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
1659                    WLAN_EID_RIC_DATA)) {
1660                 /* There seems to be a pretty inconvenient bug in the Linux
1661                  * kernel IE splitting functionality when RIC is used. For now,
1662                  * skip correct behavior in IE construction here (i.e., drop the
1663                  * additional non-FT-specific IEs) to avoid kernel issues. This
1664                  * is fine since RIC is used only for testing purposes in the
1665                  * current implementation. */
1666                 wpa_printf(MSG_INFO,
1667                            "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
1668                 params.wpa_ie = wpa_s->sme.ft_ies;
1669                 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
1670         } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
1671                 const u8 *rm_en, *pos, *end;
1672                 size_t rm_en_len = 0;
1673                 u8 *rm_en_dup = NULL, *wpos;
1674
1675                 /* Remove RSNE, MDE, FTE to allow them to be overridden with
1676                  * FT specific values */
1677                 remove_ie(wpa_s->sme.assoc_req_ie,
1678                           &wpa_s->sme.assoc_req_ie_len,
1679                           WLAN_EID_RSN);
1680                 remove_ie(wpa_s->sme.assoc_req_ie,
1681                           &wpa_s->sme.assoc_req_ie_len,
1682                           WLAN_EID_MOBILITY_DOMAIN);
1683                 remove_ie(wpa_s->sme.assoc_req_ie,
1684                           &wpa_s->sme.assoc_req_ie_len,
1685                           WLAN_EID_FAST_BSS_TRANSITION);
1686                 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
1687                                wpa_s->sme.assoc_req_ie_len,
1688                                WLAN_EID_RRM_ENABLED_CAPABILITIES);
1689                 if (rm_en) {
1690                         /* Need to remove RM Enabled Capabilities element as
1691                          * well temporarily, so that it can be placed between
1692                          * RSNE and MDE. */
1693                         rm_en_len = 2 + rm_en[1];
1694                         rm_en_dup = os_memdup(rm_en, rm_en_len);
1695                         remove_ie(wpa_s->sme.assoc_req_ie,
1696                                   &wpa_s->sme.assoc_req_ie_len,
1697                                   WLAN_EID_RRM_ENABLED_CAPABILITIES);
1698                 }
1699                 wpa_hexdump(MSG_DEBUG,
1700                             "SME: Association Request IEs after FT IE removal",
1701                             wpa_s->sme.assoc_req_ie,
1702                             wpa_s->sme.assoc_req_ie_len);
1703                 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
1704                     rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
1705                         wpa_printf(MSG_ERROR,
1706                                    "SME: Not enough buffer room for FT IEs in Association Request frame");
1707                         os_free(rm_en_dup);
1708                         return;
1709                 }
1710
1711                 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
1712                            rm_en_len,
1713                            wpa_s->sme.assoc_req_ie,
1714                            wpa_s->sme.assoc_req_ie_len);
1715                 pos = wpa_s->sme.ft_ies;
1716                 end = pos + wpa_s->sme.ft_ies_len;
1717                 wpos = wpa_s->sme.assoc_req_ie;
1718                 if (*pos == WLAN_EID_RSN) {
1719                         os_memcpy(wpos, pos, 2 + pos[1]);
1720                         wpos += 2 + pos[1];
1721                         pos += 2 + pos[1];
1722                 }
1723                 if (rm_en_dup) {
1724                         os_memcpy(wpos, rm_en_dup, rm_en_len);
1725                         wpos += rm_en_len;
1726                         os_free(rm_en_dup);
1727                 }
1728                 os_memcpy(wpos, pos, end - pos);
1729                 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
1730                         rm_en_len;
1731                 params.wpa_ie = wpa_s->sme.assoc_req_ie;
1732                 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
1733                 wpa_hexdump(MSG_DEBUG,
1734                             "SME: Association Request IEs after FT override",
1735                             params.wpa_ie, params.wpa_ie_len);
1736         }
1737 #endif /* CONFIG_IEEE80211R */
1738         params.mode = mode;
1739         params.mgmt_frame_protection = wpa_s->sme.mfp;
1740         params.rrm_used = wpa_s->rrm.rrm_used;
1741         if (wpa_s->sme.prev_bssid_set)
1742                 params.prev_bssid = wpa_s->sme.prev_bssid;
1743
1744         wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1745                 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
1746                 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
1747                 params.freq.freq);
1748
1749         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
1750
1751         if (params.wpa_ie == NULL ||
1752             ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
1753             < 0) {
1754                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
1755                 os_memset(&elems, 0, sizeof(elems));
1756         }
1757         if (elems.rsn_ie) {
1758                 params.wpa_proto = WPA_PROTO_RSN;
1759                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
1760                                         elems.rsn_ie_len + 2);
1761         } else if (elems.wpa_ie) {
1762                 params.wpa_proto = WPA_PROTO_WPA;
1763                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
1764                                         elems.wpa_ie_len + 2);
1765         } else if (elems.osen) {
1766                 params.wpa_proto = WPA_PROTO_OSEN;
1767                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
1768                                         elems.osen_len + 2);
1769         } else
1770                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1771         if (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group)
1772                 params.p2p = 1;
1773
1774         if (wpa_s->p2pdev->set_sta_uapsd)
1775                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
1776         else
1777                 params.uapsd = -1;
1778
1779         if (wpa_drv_associate(wpa_s, &params) < 0) {
1780                 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
1781                         "driver failed");
1782                 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1783                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1784                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1785                 return;
1786         }
1787
1788         eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
1789                                NULL);
1790
1791 #ifdef CONFIG_TESTING_OPTIONS
1792         wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
1793         wpa_s->last_assoc_req_wpa_ie = NULL;
1794         if (params.wpa_ie)
1795                 wpa_s->last_assoc_req_wpa_ie =
1796                         wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
1797 #endif /* CONFIG_TESTING_OPTIONS */
1798 }
1799
1800
1801 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
1802                       const u8 *ies, size_t ies_len)
1803 {
1804         if (md == NULL || ies == NULL) {
1805                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
1806                 os_free(wpa_s->sme.ft_ies);
1807                 wpa_s->sme.ft_ies = NULL;
1808                 wpa_s->sme.ft_ies_len = 0;
1809                 wpa_s->sme.ft_used = 0;
1810                 return 0;
1811         }
1812
1813         os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
1814         wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
1815         os_free(wpa_s->sme.ft_ies);
1816         wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
1817         if (wpa_s->sme.ft_ies == NULL)
1818                 return -1;
1819         wpa_s->sme.ft_ies_len = ies_len;
1820         return 0;
1821 }
1822
1823
1824 static void sme_deauth(struct wpa_supplicant *wpa_s)
1825 {
1826         int bssid_changed;
1827
1828         bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1829
1830         if (wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
1831                                    WLAN_REASON_DEAUTH_LEAVING) < 0) {
1832                 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
1833                         "failed");
1834         }
1835         wpa_s->sme.prev_bssid_set = 0;
1836
1837         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1838         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1839         os_memset(wpa_s->bssid, 0, ETH_ALEN);
1840         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1841         if (bssid_changed)
1842                 wpas_notify_bssid_changed(wpa_s);
1843 }
1844
1845
1846 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
1847                             union wpa_event_data *data)
1848 {
1849         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
1850                 "status code %d", MAC2STR(wpa_s->pending_bssid),
1851                 data->assoc_reject.status_code);
1852
1853         eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
1854
1855 #ifdef CONFIG_SAE
1856         if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
1857             wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
1858                 wpa_dbg(wpa_s, MSG_DEBUG,
1859                         "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
1860                 wpa_sm_aborted_cached(wpa_s->wpa);
1861                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
1862                 if (wpa_s->current_bss) {
1863                         struct wpa_bss *bss = wpa_s->current_bss;
1864                         struct wpa_ssid *ssid = wpa_s->current_ssid;
1865
1866                         wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
1867                                                WLAN_REASON_DEAUTH_LEAVING);
1868                         wpas_connect_work_done(wpa_s);
1869                         wpa_supplicant_mark_disassoc(wpa_s);
1870                         wpa_supplicant_connect(wpa_s, bss, ssid);
1871                         return;
1872                 }
1873         }
1874 #endif /* CONFIG_SAE */
1875
1876         /*
1877          * For now, unconditionally terminate the previous authentication. In
1878          * theory, this should not be needed, but mac80211 gets quite confused
1879          * if the authentication is left pending.. Some roaming cases might
1880          * benefit from using the previous authentication, so this could be
1881          * optimized in the future.
1882          */
1883         sme_deauth(wpa_s);
1884 }
1885
1886
1887 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
1888                               union wpa_event_data *data)
1889 {
1890         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
1891         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1892         wpa_supplicant_mark_disassoc(wpa_s);
1893 }
1894
1895
1896 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
1897                                union wpa_event_data *data)
1898 {
1899         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
1900         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1901         wpa_supplicant_mark_disassoc(wpa_s);
1902 }
1903
1904
1905 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
1906                         struct disassoc_info *info)
1907 {
1908         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
1909         if (wpa_s->sme.prev_bssid_set) {
1910                 /*
1911                  * cfg80211/mac80211 can get into somewhat confused state if
1912                  * the AP only disassociates us and leaves us in authenticated
1913                  * state. For now, force the state to be cleared to avoid
1914                  * confusing errors if we try to associate with the AP again.
1915                  */
1916                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
1917                         "driver state");
1918                 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
1919                                        WLAN_REASON_DEAUTH_LEAVING);
1920         }
1921 }
1922
1923
1924 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
1925 {
1926         struct wpa_supplicant *wpa_s = eloop_ctx;
1927         if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
1928                 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
1929                 sme_deauth(wpa_s);
1930         }
1931 }
1932
1933
1934 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
1935 {
1936         struct wpa_supplicant *wpa_s = eloop_ctx;
1937         if (wpa_s->wpa_state == WPA_ASSOCIATING) {
1938                 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
1939                 sme_deauth(wpa_s);
1940         }
1941 }
1942
1943
1944 void sme_state_changed(struct wpa_supplicant *wpa_s)
1945 {
1946         /* Make sure timers are cleaned up appropriately. */
1947         if (wpa_s->wpa_state != WPA_ASSOCIATING)
1948                 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
1949         if (wpa_s->wpa_state != WPA_AUTHENTICATING)
1950                 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
1951 }
1952
1953
1954 void sme_disassoc_while_authenticating(struct wpa_supplicant *wpa_s,
1955                                        const u8 *prev_pending_bssid)
1956 {
1957         /*
1958          * mac80211-workaround to force deauth on failed auth cmd,
1959          * requires us to remain in authenticating state to allow the
1960          * second authentication attempt to be continued properly.
1961          */
1962         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Allow pending authentication "
1963                 "to proceed after disconnection event");
1964         wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1965         os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
1966
1967         /*
1968          * Re-arm authentication timer in case auth fails for whatever reason.
1969          */
1970         eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
1971         eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
1972                                NULL);
1973 }
1974
1975
1976 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
1977 {
1978         wpa_s->sme.prev_bssid_set = 0;
1979 #ifdef CONFIG_SAE
1980         wpabuf_free(wpa_s->sme.sae_token);
1981         wpa_s->sme.sae_token = NULL;
1982         sae_clear_data(&wpa_s->sme.sae);
1983 #endif /* CONFIG_SAE */
1984 #ifdef CONFIG_IEEE80211R
1985         if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
1986                 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
1987 #endif /* CONFIG_IEEE80211R */
1988 #ifdef CONFIG_IEEE80211W
1989         sme_stop_sa_query(wpa_s);
1990 #endif /* CONFIG_IEEE80211W */
1991 }
1992
1993
1994 void sme_deinit(struct wpa_supplicant *wpa_s)
1995 {
1996         sme_clear_on_disassoc(wpa_s);
1997
1998         eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
1999         eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2000         eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
2001 }
2002
2003
2004 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
2005                                    const u8 *chan_list, u8 num_channels,
2006                                    u8 num_intol)
2007 {
2008         struct ieee80211_2040_bss_coex_ie *bc_ie;
2009         struct ieee80211_2040_intol_chan_report *ic_report;
2010         struct wpabuf *buf;
2011
2012         wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
2013                    " (num_channels=%u num_intol=%u)",
2014                    MAC2STR(wpa_s->bssid), num_channels, num_intol);
2015         wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
2016                     chan_list, num_channels);
2017
2018         buf = wpabuf_alloc(2 + /* action.category + action_code */
2019                            sizeof(struct ieee80211_2040_bss_coex_ie) +
2020                            sizeof(struct ieee80211_2040_intol_chan_report) +
2021                            num_channels);
2022         if (buf == NULL)
2023                 return;
2024
2025         wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
2026         wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
2027
2028         bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
2029         bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
2030         bc_ie->length = 1;
2031         if (num_intol)
2032                 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
2033
2034         if (num_channels > 0) {
2035                 ic_report = wpabuf_put(buf, sizeof(*ic_report));
2036                 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
2037                 ic_report->length = num_channels + 1;
2038                 ic_report->op_class = 0;
2039                 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
2040                           num_channels);
2041         }
2042
2043         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2044                                 wpa_s->own_addr, wpa_s->bssid,
2045                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
2046                 wpa_msg(wpa_s, MSG_INFO,
2047                         "SME: Failed to send 20/40 BSS Coexistence frame");
2048         }
2049
2050         wpabuf_free(buf);
2051 }
2052
2053
2054 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
2055 {
2056         struct wpa_bss *bss;
2057         const u8 *ie;
2058         u16 ht_cap;
2059         u8 chan_list[P2P_MAX_CHANNELS], channel;
2060         u8 num_channels = 0, num_intol = 0, i;
2061
2062         if (!wpa_s->sme.sched_obss_scan)
2063                 return 0;
2064
2065         wpa_s->sme.sched_obss_scan = 0;
2066         if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
2067                 return 1;
2068
2069         /*
2070          * Check whether AP uses regulatory triplet or channel triplet in
2071          * country info. Right now the operating class of the BSS channel
2072          * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
2073          * based on the assumption that operating class triplet is not used in
2074          * beacon frame. If the First Channel Number/Operating Extension
2075          * Identifier octet has a positive integer value of 201 or greater,
2076          * then its operating class triplet.
2077          *
2078          * TODO: If Supported Operating Classes element is present in beacon
2079          * frame, have to lookup operating class in Annex E and fill them in
2080          * 2040 coex frame.
2081          */
2082         ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
2083         if (ie && (ie[1] >= 6) && (ie[5] >= 201))
2084                 return 1;
2085
2086         os_memset(chan_list, 0, sizeof(chan_list));
2087
2088         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2089                 /* Skip other band bss */
2090                 enum hostapd_hw_mode mode;
2091                 mode = ieee80211_freq_to_chan(bss->freq, &channel);
2092                 if (mode != HOSTAPD_MODE_IEEE80211G &&
2093                     mode != HOSTAPD_MODE_IEEE80211B)
2094                         continue;
2095
2096                 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
2097                 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
2098                 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
2099                            " freq=%u chan=%u ht_cap=0x%x",
2100                            MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
2101
2102                 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
2103                         if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
2104                                 num_intol++;
2105
2106                         /* Check whether the channel is already considered */
2107                         for (i = 0; i < num_channels; i++) {
2108                                 if (channel == chan_list[i])
2109                                         break;
2110                         }
2111                         if (i != num_channels)
2112                                 continue;
2113
2114                         chan_list[num_channels++] = channel;
2115                 }
2116         }
2117
2118         sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
2119         return 1;
2120 }
2121
2122
2123 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
2124                                      struct wpa_driver_scan_params *params)
2125 {
2126         /* Include only affected channels */
2127         struct hostapd_hw_modes *mode;
2128         int count, i;
2129         int start, end;
2130
2131         mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
2132                         HOSTAPD_MODE_IEEE80211G);
2133         if (mode == NULL) {
2134                 /* No channels supported in this band - use empty list */
2135                 params->freqs = os_zalloc(sizeof(int));
2136                 return;
2137         }
2138
2139         if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
2140             wpa_s->current_bss) {
2141                 const u8 *ie;
2142
2143                 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
2144                 if (ie && ie[1] >= 2) {
2145                         u8 o;
2146
2147                         o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
2148                         if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
2149                                 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
2150                         else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
2151                                 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
2152                 }
2153         }
2154
2155         start = wpa_s->assoc_freq - 10;
2156         end = wpa_s->assoc_freq + 10;
2157         switch (wpa_s->sme.ht_sec_chan) {
2158         case HT_SEC_CHAN_UNKNOWN:
2159                 /* HT40+ possible on channels 1..9 */
2160                 if (wpa_s->assoc_freq <= 2452)
2161                         start -= 20;
2162                 /* HT40- possible on channels 5-13 */
2163                 if (wpa_s->assoc_freq >= 2432)
2164                         end += 20;
2165                 break;
2166         case HT_SEC_CHAN_ABOVE:
2167                 end += 20;
2168                 break;
2169         case HT_SEC_CHAN_BELOW:
2170                 start -= 20;
2171                 break;
2172         }
2173         wpa_printf(MSG_DEBUG,
2174                    "OBSS: assoc_freq %d possible affected range %d-%d",
2175                    wpa_s->assoc_freq, start, end);
2176
2177         params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
2178         if (params->freqs == NULL)
2179                 return;
2180         for (count = 0, i = 0; i < mode->num_channels; i++) {
2181                 int freq;
2182
2183                 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
2184                         continue;
2185                 freq = mode->channels[i].freq;
2186                 if (freq - 10 >= end || freq + 10 <= start)
2187                         continue; /* not affected */
2188                 params->freqs[count++] = freq;
2189         }
2190 }
2191
2192
2193 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
2194 {
2195         struct wpa_supplicant *wpa_s = eloop_ctx;
2196         struct wpa_driver_scan_params params;
2197
2198         if (!wpa_s->current_bss) {
2199                 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
2200                 return;
2201         }
2202
2203         os_memset(&params, 0, sizeof(params));
2204         wpa_obss_scan_freqs_list(wpa_s, &params);
2205         params.low_priority = 1;
2206         wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
2207
2208         if (wpa_supplicant_trigger_scan(wpa_s, &params))
2209                 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
2210         else
2211                 wpa_s->sme.sched_obss_scan = 1;
2212         os_free(params.freqs);
2213
2214         eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
2215                                sme_obss_scan_timeout, wpa_s, NULL);
2216 }
2217
2218
2219 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
2220 {
2221         const u8 *ie;
2222         struct wpa_bss *bss = wpa_s->current_bss;
2223         struct wpa_ssid *ssid = wpa_s->current_ssid;
2224         struct hostapd_hw_modes *hw_mode = NULL;
2225         int i;
2226
2227         eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
2228         wpa_s->sme.sched_obss_scan = 0;
2229         wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
2230         if (!enable)
2231                 return;
2232
2233         /*
2234          * Schedule OBSS scan if driver is using station SME in wpa_supplicant
2235          * or it expects OBSS scan to be performed by wpa_supplicant.
2236          */
2237         if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
2238               (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
2239             ssid == NULL || ssid->mode != IEEE80211_MODE_INFRA)
2240                 return;
2241
2242         if (!wpa_s->hw.modes)
2243                 return;
2244
2245         /* only HT caps in 11g mode are relevant */
2246         for (i = 0; i < wpa_s->hw.num_modes; i++) {
2247                 hw_mode = &wpa_s->hw.modes[i];
2248                 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
2249                         break;
2250         }
2251
2252         /* Driver does not support HT40 for 11g or doesn't have 11g. */
2253         if (i == wpa_s->hw.num_modes || !hw_mode ||
2254             !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2255                 return;
2256
2257         if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
2258                 return; /* Not associated on 2.4 GHz band */
2259
2260         /* Check whether AP supports HT40 */
2261         ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
2262         if (!ie || ie[1] < 2 ||
2263             !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2264                 return; /* AP does not support HT40 */
2265
2266         ie = wpa_bss_get_ie(wpa_s->current_bss,
2267                             WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
2268         if (!ie || ie[1] < 14)
2269                 return; /* AP does not request OBSS scans */
2270
2271         wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
2272         if (wpa_s->sme.obss_scan_int < 10) {
2273                 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
2274                            "replaced with the minimum 10 sec",
2275                            wpa_s->sme.obss_scan_int);
2276                 wpa_s->sme.obss_scan_int = 10;
2277         }
2278         wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
2279                    wpa_s->sme.obss_scan_int);
2280         eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
2281                                sme_obss_scan_timeout, wpa_s, NULL);
2282 }
2283
2284
2285 #ifdef CONFIG_IEEE80211W
2286
2287 static const unsigned int sa_query_max_timeout = 1000;
2288 static const unsigned int sa_query_retry_timeout = 201;
2289 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
2290
2291 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
2292 {
2293         u32 tu;
2294         struct os_reltime now, passed;
2295         os_get_reltime(&now);
2296         os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
2297         tu = (passed.sec * 1000000 + passed.usec) / 1024;
2298         if (sa_query_max_timeout < tu) {
2299                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
2300                 sme_stop_sa_query(wpa_s);
2301                 wpa_supplicant_deauthenticate(
2302                         wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
2303                 return 1;
2304         }
2305
2306         return 0;
2307 }
2308
2309
2310 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
2311                                   const u8 *trans_id)
2312 {
2313         u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
2314         u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
2315
2316         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
2317                 MACSTR, MAC2STR(wpa_s->bssid));
2318         wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
2319                     trans_id, WLAN_SA_QUERY_TR_ID_LEN);
2320         req[0] = WLAN_ACTION_SA_QUERY;
2321         req[1] = WLAN_SA_QUERY_REQUEST;
2322         os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
2323
2324 #ifdef CONFIG_OCV
2325         if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2326                 struct wpa_channel_info ci;
2327
2328                 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2329                         wpa_printf(MSG_WARNING,
2330                                    "Failed to get channel info for OCI element in SA Query Request frame");
2331                         return;
2332                 }
2333
2334                 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
2335                         return;
2336
2337                 req_len += OCV_OCI_EXTENDED_LEN;
2338         }
2339 #endif /* CONFIG_OCV */
2340
2341         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2342                                 wpa_s->own_addr, wpa_s->bssid,
2343                                 req, req_len, 0) < 0)
2344                 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
2345                         "Request");
2346 }
2347
2348
2349 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
2350 {
2351         struct wpa_supplicant *wpa_s = eloop_ctx;
2352         unsigned int timeout, sec, usec;
2353         u8 *trans_id, *nbuf;
2354
2355         if (wpa_s->sme.sa_query_count > 0 &&
2356             sme_check_sa_query_timeout(wpa_s))
2357                 return;
2358
2359         nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
2360                                 wpa_s->sme.sa_query_count + 1,
2361                                 WLAN_SA_QUERY_TR_ID_LEN);
2362         if (nbuf == NULL) {
2363                 sme_stop_sa_query(wpa_s);
2364                 return;
2365         }
2366         if (wpa_s->sme.sa_query_count == 0) {
2367                 /* Starting a new SA Query procedure */
2368                 os_get_reltime(&wpa_s->sme.sa_query_start);
2369         }
2370         trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
2371         wpa_s->sme.sa_query_trans_id = nbuf;
2372         wpa_s->sme.sa_query_count++;
2373
2374         if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
2375                 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
2376                 sme_stop_sa_query(wpa_s);
2377                 return;
2378         }
2379
2380         timeout = sa_query_retry_timeout;
2381         sec = ((timeout / 1000) * 1024) / 1000;
2382         usec = (timeout % 1000) * 1024;
2383         eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
2384
2385         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
2386                 wpa_s->sme.sa_query_count);
2387
2388         sme_send_sa_query_req(wpa_s, trans_id);
2389 }
2390
2391
2392 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
2393 {
2394         sme_sa_query_timer(wpa_s, NULL);
2395 }
2396
2397
2398 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
2399 {
2400         if (wpa_s->sme.sa_query_trans_id)
2401                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
2402         eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
2403         os_free(wpa_s->sme.sa_query_trans_id);
2404         wpa_s->sme.sa_query_trans_id = NULL;
2405         wpa_s->sme.sa_query_count = 0;
2406 }
2407
2408
2409 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
2410                                  const u8 *da, u16 reason_code)
2411 {
2412         struct wpa_ssid *ssid;
2413         struct os_reltime now;
2414
2415         if (wpa_s->wpa_state != WPA_COMPLETED)
2416                 return;
2417         ssid = wpa_s->current_ssid;
2418         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
2419                 return;
2420         if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
2421                 return;
2422         if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
2423             reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
2424                 return;
2425         if (wpa_s->sme.sa_query_count > 0)
2426                 return;
2427
2428         os_get_reltime(&now);
2429         if (wpa_s->sme.last_unprot_disconnect.sec &&
2430             !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
2431                 return; /* limit SA Query procedure frequency */
2432         wpa_s->sme.last_unprot_disconnect = now;
2433
2434         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
2435                 "possible AP/STA state mismatch - trigger SA Query");
2436         sme_start_sa_query(wpa_s);
2437 }
2438
2439
2440 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
2441 {
2442         unsigned int usec;
2443         u32 _rand;
2444
2445         if (wpa_s->wpa_state != WPA_COMPLETED ||
2446             !wpa_sm_ocv_enabled(wpa_s->wpa))
2447                 return;
2448
2449         wpa_dbg(wpa_s, MSG_DEBUG,
2450                 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
2451         sme_stop_sa_query(wpa_s);
2452
2453         if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
2454                 _rand = os_random();
2455         usec = _rand % (sa_query_ch_switch_max_delay + 1);
2456         eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
2457 }
2458
2459
2460 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
2461                                          const u8 *sa, const u8 *data,
2462                                          size_t len)
2463 {
2464         u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
2465         u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
2466
2467         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
2468                 MACSTR, MAC2STR(wpa_s->bssid));
2469
2470         resp[0] = WLAN_ACTION_SA_QUERY;
2471         resp[1] = WLAN_SA_QUERY_RESPONSE;
2472         os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
2473
2474 #ifdef CONFIG_OCV
2475         if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2476                 struct wpa_channel_info ci;
2477
2478                 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2479                         wpa_printf(MSG_WARNING,
2480                                    "Failed to get channel info for OCI element in SA Query Response frame");
2481                         return;
2482                 }
2483
2484                 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
2485                         return;
2486
2487                 resp_len += OCV_OCI_EXTENDED_LEN;
2488         }
2489 #endif /* CONFIG_OCV */
2490
2491         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2492                                 wpa_s->own_addr, wpa_s->bssid,
2493                                 resp, resp_len, 0) < 0)
2494                 wpa_msg(wpa_s, MSG_INFO,
2495                         "SME: Failed to send SA Query Response");
2496 }
2497
2498
2499 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
2500                                           const u8 *sa, const u8 *data,
2501                                           size_t len)
2502 {
2503         int i;
2504
2505         if (!wpa_s->sme.sa_query_trans_id)
2506                 return;
2507
2508         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
2509                 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
2510
2511         if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
2512                 return;
2513
2514         for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
2515                 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
2516                               i * WLAN_SA_QUERY_TR_ID_LEN,
2517                               data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
2518                         break;
2519         }
2520
2521         if (i >= wpa_s->sme.sa_query_count) {
2522                 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
2523                         "transaction identifier found");
2524                 return;
2525         }
2526
2527         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
2528                 "from " MACSTR, MAC2STR(sa));
2529         sme_stop_sa_query(wpa_s);
2530 }
2531
2532
2533 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *sa,
2534                      const u8 *data, size_t len)
2535 {
2536         if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
2537                 return;
2538
2539         wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
2540                 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
2541
2542 #ifdef CONFIG_OCV
2543         if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2544                 struct ieee802_11_elems elems;
2545                 struct wpa_channel_info ci;
2546
2547                 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
2548                                            len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
2549                                            &elems, 1) == ParseFailed) {
2550                         wpa_printf(MSG_DEBUG,
2551                                    "SA Query: Failed to parse elements");
2552                         return;
2553                 }
2554
2555                 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2556                         wpa_printf(MSG_WARNING,
2557                                    "Failed to get channel info to validate received OCI in SA Query Action frame");
2558                         return;
2559                 }
2560
2561                 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
2562                                          channel_width_to_int(ci.chanwidth),
2563                                          ci.seg1_idx) != 0) {
2564                         wpa_printf(MSG_WARNING, "%s", ocv_errorstr);
2565                         return;
2566                 }
2567         }
2568 #endif /* CONFIG_OCV */
2569
2570         if (data[0] == WLAN_SA_QUERY_REQUEST)
2571                 sme_process_sa_query_request(wpa_s, sa, data, len);
2572         else if (data[0] == WLAN_SA_QUERY_RESPONSE)
2573                 sme_process_sa_query_response(wpa_s, sa, data, len);
2574 }
2575
2576 #endif /* CONFIG_IEEE80211W */