1 /*
2  * wpa_supplicant - Radio Measurements
3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_common.h"
14 #include "wpa_supplicant_i.h"
15 #include "driver_i.h"
16 #include "bss.h"
17 #include "scan.h"
18 #include "p2p_supplicant.h"
19 
20 
wpas_rrm_neighbor_rep_timeout_handler(void * data,void * user_ctx)21 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
22 {
23 	struct rrm_data *rrm = data;
24 
25 	if (!rrm->notify_neighbor_rep) {
26 		wpa_printf(MSG_ERROR,
27 			   "RRM: Unexpected neighbor report timeout");
28 		return;
29 	}
30 
31 	wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
32 	rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
33 
34 	rrm->notify_neighbor_rep = NULL;
35 	rrm->neighbor_rep_cb_ctx = NULL;
36 }
37 
38 
39 /*
40  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
41  * @wpa_s: Pointer to wpa_supplicant
42  */
wpas_rrm_reset(struct wpa_supplicant * wpa_s)43 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
44 {
45 	wpa_s->rrm.rrm_used = 0;
46 
47 	eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
48 			     NULL);
49 	if (wpa_s->rrm.notify_neighbor_rep)
50 		wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
51 	wpa_s->rrm.next_neighbor_rep_token = 1;
52 	wpas_clear_beacon_rep_data(wpa_s);
53 }
54 
55 
56 /*
57  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
58  * @wpa_s: Pointer to wpa_supplicant
59  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
60  * @report_len: Length of neighbor report buffer
61  */
wpas_rrm_process_neighbor_rep(struct wpa_supplicant * wpa_s,const u8 * report,size_t report_len)62 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
63 				   const u8 *report, size_t report_len)
64 {
65 	struct wpabuf *neighbor_rep;
66 
67 	wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
68 	if (report_len < 1)
69 		return;
70 
71 	if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
72 		wpa_printf(MSG_DEBUG,
73 			   "RRM: Discarding neighbor report with token %d (expected %d)",
74 			   report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
75 		return;
76 	}
77 
78 	eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
79 			     NULL);
80 
81 	if (!wpa_s->rrm.notify_neighbor_rep) {
82 		wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
83 		return;
84 	}
85 
86 	/* skipping the first byte, which is only an id (dialog token) */
87 	neighbor_rep = wpabuf_alloc(report_len - 1);
88 	if (!neighbor_rep) {
89 		wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
90 		return;
91 	}
92 	wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
93 	wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
94 		   report[0]);
95 	wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
96 				       neighbor_rep);
97 	wpa_s->rrm.notify_neighbor_rep = NULL;
98 	wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
99 }
100 
101 
102 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
103 /* Workaround different, undefined for Windows, error codes used here */
104 #define ENOTCONN -1
105 #define EOPNOTSUPP -1
106 #define ECANCELED -1
107 #endif
108 
109 /* Measurement Request element + Location Subject + Maximum Age subelement */
110 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
111 /* Measurement Request element + Location Civic Request */
112 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
113 
114 
115 /**
116  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
117  * @wpa_s: Pointer to wpa_supplicant
118  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
119  *	  is sent in the request.
120  * @lci: if set, neighbor request will include LCI request
121  * @civic: if set, neighbor request will include civic location request
122  * @cb: Callback function to be called once the requested report arrives, or
123  *	timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
124  *	In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
125  *	the requester's responsibility to free it.
126  *	In the latter case NULL will be sent in 'neighbor_rep'.
127  * @cb_ctx: Context value to send the callback function
128  * Returns: 0 in case of success, negative error code otherwise
129  *
130  * In case there is a previous request which has not been answered yet, the
131  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
132  * Request must contain a callback function.
133  */
wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant * wpa_s,const struct wpa_ssid_value * ssid,int lci,int civic,void (* cb)(void * ctx,struct wpabuf * neighbor_rep),void * cb_ctx)134 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
135 				       const struct wpa_ssid_value *ssid,
136 				       int lci, int civic,
137 				       void (*cb)(void *ctx,
138 						  struct wpabuf *neighbor_rep),
139 				       void *cb_ctx)
140 {
141 	struct wpabuf *buf;
142 	const u8 *rrm_ie;
143 
144 	if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
145 		wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
146 		return -ENOTCONN;
147 	}
148 
149 	if (!wpa_s->rrm.rrm_used) {
150 		wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
151 		return -EOPNOTSUPP;
152 	}
153 
154 	rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
155 				WLAN_EID_RRM_ENABLED_CAPABILITIES);
156 	if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
157 	    !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
158 		wpa_printf(MSG_DEBUG,
159 			   "RRM: No network support for Neighbor Report.");
160 		return -EOPNOTSUPP;
161 	}
162 
163 	/* Refuse if there's a live request */
164 	if (wpa_s->rrm.notify_neighbor_rep) {
165 		wpa_printf(MSG_DEBUG,
166 			   "RRM: Currently handling previous Neighbor Report.");
167 		return -EBUSY;
168 	}
169 
170 	/* 3 = action category + action code + dialog token */
171 	buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
172 			   (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
173 			   (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
174 	if (buf == NULL) {
175 		wpa_printf(MSG_DEBUG,
176 			   "RRM: Failed to allocate Neighbor Report Request");
177 		return -ENOMEM;
178 	}
179 
180 	wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
181 		   (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
182 		   wpa_s->rrm.next_neighbor_rep_token);
183 
184 	wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
185 	wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
186 	wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
187 	if (ssid) {
188 		wpabuf_put_u8(buf, WLAN_EID_SSID);
189 		wpabuf_put_u8(buf, ssid->ssid_len);
190 		wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
191 	}
192 
193 	if (lci) {
194 		/* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
195 		wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
196 		wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
197 
198 		/*
199 		 * Measurement token; nonzero number that is unique among the
200 		 * Measurement Request elements in a particular frame.
201 		 */
202 		wpabuf_put_u8(buf, 1); /* Measurement Token */
203 
204 		/*
205 		 * Parallel, Enable, Request, and Report bits are 0, Duration is
206 		 * reserved.
207 		 */
208 		wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
209 		wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
210 
211 		/* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
212 		/* Location Subject */
213 		wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
214 
215 		/* Optional Subelements */
216 		/*
217 		 * IEEE P802.11-REVmc/D5.0 Figure 9-170
218 		 * The Maximum Age subelement is required, otherwise the AP can
219 		 * send only data that was determined after receiving the
220 		 * request. Setting it here to unlimited age.
221 		 */
222 		wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
223 		wpabuf_put_u8(buf, 2);
224 		wpabuf_put_le16(buf, 0xffff);
225 	}
226 
227 	if (civic) {
228 		/* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
229 		wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
230 		wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
231 
232 		/*
233 		 * Measurement token; nonzero number that is unique among the
234 		 * Measurement Request elements in a particular frame.
235 		 */
236 		wpabuf_put_u8(buf, 2); /* Measurement Token */
237 
238 		/*
239 		 * Parallel, Enable, Request, and Report bits are 0, Duration is
240 		 * reserved.
241 		 */
242 		wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
243 		/* Measurement Type */
244 		wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
245 
246 		/* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
247 		 * Location Civic request */
248 		/* Location Subject */
249 		wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
250 		wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
251 		/* Location Service Interval Units: Seconds */
252 		wpabuf_put_u8(buf, 0);
253 		/* Location Service Interval: 0 - Only one report is requested
254 		 */
255 		wpabuf_put_le16(buf, 0);
256 		/* No optional subelements */
257 	}
258 
259 	wpa_s->rrm.next_neighbor_rep_token++;
260 
261 	if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
262 				wpa_s->own_addr, wpa_s->bssid,
263 				wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
264 		wpa_printf(MSG_DEBUG,
265 			   "RRM: Failed to send Neighbor Report Request");
266 		wpabuf_free(buf);
267 		return -ECANCELED;
268 	}
269 
270 	wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
271 	wpa_s->rrm.notify_neighbor_rep = cb;
272 	eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
273 			       wpas_rrm_neighbor_rep_timeout_handler,
274 			       &wpa_s->rrm, NULL);
275 
276 	wpabuf_free(buf);
277 	return 0;
278 }
279 
280 
wpas_rrm_report_elem(struct wpabuf ** buf,u8 token,u8 mode,u8 type,const u8 * data,size_t data_len)281 static int wpas_rrm_report_elem(struct wpabuf **buf, u8 token, u8 mode, u8 type,
282 				const u8 *data, size_t data_len)
283 {
284 	if (wpabuf_resize(buf, 5 + data_len))
285 		return -1;
286 
287 	wpabuf_put_u8(*buf, WLAN_EID_MEASURE_REPORT);
288 	wpabuf_put_u8(*buf, 3 + data_len);
289 	wpabuf_put_u8(*buf, token);
290 	wpabuf_put_u8(*buf, mode);
291 	wpabuf_put_u8(*buf, type);
292 
293 	if (data_len)
294 		wpabuf_put_data(*buf, data, data_len);
295 
296 	return 0;
297 }
298 
299 
300 static int
wpas_rrm_build_lci_report(struct wpa_supplicant * wpa_s,const struct rrm_measurement_request_element * req,struct wpabuf ** buf)301 wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
302 			  const struct rrm_measurement_request_element *req,
303 			  struct wpabuf **buf)
304 {
305 	u8 subject;
306 	u16 max_age = 0;
307 	struct os_reltime t, diff;
308 	unsigned long diff_l;
309 	const u8 *subelem;
310 	const u8 *request = req->variable;
311 	size_t len = req->len - 3;
312 
313 	if (len < 1)
314 		return -1;
315 
316 	if (!wpa_s->lci)
317 		goto reject;
318 
319 	subject = *request++;
320 	len--;
321 
322 	wpa_printf(MSG_DEBUG, "Measurement request location subject=%u",
323 		   subject);
324 
325 	if (subject != LOCATION_SUBJECT_REMOTE) {
326 		wpa_printf(MSG_INFO,
327 			   "Not building LCI report - bad location subject");
328 		return 0;
329 	}
330 
331 	/* Subelements are formatted exactly like elements */
332 	wpa_hexdump(MSG_DEBUG, "LCI request subelements", request, len);
333 	subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
334 	if (subelem && subelem[1] == 2)
335 		max_age = WPA_GET_LE16(subelem + 2);
336 
337 	if (os_get_reltime(&t))
338 		goto reject;
339 
340 	os_reltime_sub(&t, &wpa_s->lci_time, &diff);
341 	/* LCI age is calculated in 10th of a second units. */
342 	diff_l = diff.sec * 10 + diff.usec / 100000;
343 
344 	if (max_age != 0xffff && max_age < diff_l)
345 		goto reject;
346 
347 	if (wpas_rrm_report_elem(buf, req->token,
348 				 MEASUREMENT_REPORT_MODE_ACCEPT, req->type,
349 				 wpabuf_head_u8(wpa_s->lci),
350 				 wpabuf_len(wpa_s->lci)) < 0) {
351 		wpa_printf(MSG_DEBUG, "Failed to add LCI report element");
352 		return -1;
353 	}
354 
355 	return 0;
356 
357 reject:
358 	if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
359 	    wpas_rrm_report_elem(buf, req->token,
360 				 MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
361 				 req->type, NULL, 0) < 0) {
362 		wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
363 		return -1;
364 	}
365 
366 	return 0;
367 }
368 
369 
wpas_rrm_send_msr_report_mpdu(struct wpa_supplicant * wpa_s,const u8 * data,size_t len)370 static void wpas_rrm_send_msr_report_mpdu(struct wpa_supplicant *wpa_s,
371 					  const u8 *data, size_t len)
372 {
373 	struct wpabuf *report = wpabuf_alloc(len + 3);
374 
375 	if (!report)
376 		return;
377 
378 	wpabuf_put_u8(report, WLAN_ACTION_RADIO_MEASUREMENT);
379 	wpabuf_put_u8(report, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
380 	wpabuf_put_u8(report, wpa_s->rrm.token);
381 
382 	wpabuf_put_data(report, data, len);
383 
384 	if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
385 				wpa_s->own_addr, wpa_s->bssid,
386 				wpabuf_head(report), wpabuf_len(report), 0)) {
387 		wpa_printf(MSG_ERROR,
388 			   "RRM: Radio measurement report failed: Sending Action frame failed");
389 	}
390 
391 	wpabuf_free(report);
392 }
393 
394 
wpas_rrm_beacon_rep_update_last_frame(u8 * pos,size_t len)395 static int wpas_rrm_beacon_rep_update_last_frame(u8 *pos, size_t len)
396 {
397 	struct rrm_measurement_report_element *msr_rep;
398 	u8 *end = pos + len;
399 	u8 *msr_rep_end;
400 	struct rrm_measurement_beacon_report *rep = NULL;
401 	u8 *subelem;
402 
403 	/* Find the last beacon report element */
404 	while (end - pos >= (int) sizeof(*msr_rep)) {
405 		msr_rep = (struct rrm_measurement_report_element *) pos;
406 		msr_rep_end = pos + msr_rep->len + 2;
407 
408 		if (msr_rep->eid != WLAN_EID_MEASURE_REPORT ||
409 		    msr_rep_end > end) {
410 			/* Should not happen. This indicates a bug. */
411 			wpa_printf(MSG_ERROR,
412 				   "RRM: non-measurement report element in measurement report frame");
413 			return -1;
414 		}
415 
416 		if (msr_rep->type == MEASURE_TYPE_BEACON)
417 			rep = (struct rrm_measurement_beacon_report *)
418 				msr_rep->variable;
419 
420 		pos += pos[1] + 2;
421 	}
422 
423 	if (!rep)
424 		return 0;
425 
426 	subelem = rep->variable;
427 	while (subelem + 2 < msr_rep_end &&
428 	       subelem[0] != WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION)
429 		subelem += 2 + subelem[1];
430 
431 	if (subelem + 2 < msr_rep_end &&
432 	    subelem[0] == WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION &&
433 	    subelem[1] == 1 &&
434 	    subelem + BEACON_REPORT_LAST_INDICATION_SUBELEM_LEN <= end)
435 		subelem[2] = 1;
436 
437 	return 0;
438 }
439 
440 
wpas_rrm_send_msr_report(struct wpa_supplicant * wpa_s,struct wpabuf * buf)441 static void wpas_rrm_send_msr_report(struct wpa_supplicant *wpa_s,
442 				     struct wpabuf *buf)
443 {
444 	int len = wpabuf_len(buf);
445 	u8 *pos = wpabuf_mhead_u8(buf), *next = pos;
446 
447 #define MPDU_REPORT_LEN (int) (IEEE80211_MAX_MMPDU_SIZE - IEEE80211_HDRLEN - 3)
448 
449 	while (len) {
450 		int send_len = (len > MPDU_REPORT_LEN) ? next - pos : len;
451 
452 		if (send_len == len)
453 			wpas_rrm_beacon_rep_update_last_frame(pos, len);
454 
455 		if (send_len == len ||
456 		    (send_len + next[1] + 2) > MPDU_REPORT_LEN) {
457 			wpas_rrm_send_msr_report_mpdu(wpa_s, pos, send_len);
458 			len -= send_len;
459 			pos = next;
460 		}
461 
462 		if (len)
463 			next += next[1] + 2;
464 	}
465 #undef MPDU_REPORT_LEN
466 }
467 
468 
wpas_add_channel(u8 op_class,u8 chan,u8 num_primary_channels,int * freqs)469 static int wpas_add_channel(u8 op_class, u8 chan, u8 num_primary_channels,
470 			    int *freqs)
471 {
472 	size_t i;
473 
474 	for (i = 0; i < num_primary_channels; i++) {
475 		u8 primary_chan = chan - (2 * num_primary_channels - 2) + i * 4;
476 
477 		freqs[i] = ieee80211_chan_to_freq(NULL, op_class, primary_chan);
478 		/* ieee80211_chan_to_freq() is not really meant for this
479 		 * conversion of 20 MHz primary channel numbers for wider VHT
480 		 * channels, so handle those as special cases here for now. */
481 		if (freqs[i] < 0 &&
482 		    (op_class == 128 || op_class == 129 || op_class == 130))
483 			freqs[i] = 5000 + 5 * primary_chan;
484 		if (freqs[i] < 0) {
485 			wpa_printf(MSG_DEBUG,
486 				   "Beacon Report: Invalid channel %u",
487 				   chan);
488 			return -1;
489 		}
490 	}
491 
492 	return 0;
493 }
494 
495 
wpas_add_channels(const struct oper_class_map * op,struct hostapd_hw_modes * mode,int active,const u8 * channels,const u8 size)496 static int * wpas_add_channels(const struct oper_class_map *op,
497 			       struct hostapd_hw_modes *mode, int active,
498 			       const u8 *channels, const u8 size)
499 {
500 	int *freqs, *next_freq;
501 	u8 num_primary_channels, i;
502 	u8 num_chans;
503 
504 	num_chans = channels ? size :
505 		(op->max_chan - op->min_chan) / op->inc + 1;
506 
507 	if (op->bw == BW80 || op->bw == BW80P80)
508 		num_primary_channels = 4;
509 	else if (op->bw == BW160)
510 		num_primary_channels = 8;
511 	else
512 		num_primary_channels = 1;
513 
514 	/* one extra place for the zero-terminator */
515 	freqs = os_calloc(num_chans * num_primary_channels + 1, sizeof(*freqs));
516 	if (!freqs) {
517 		wpa_printf(MSG_ERROR,
518 			   "Beacon Report: Failed to allocate freqs array");
519 		return NULL;
520 	}
521 
522 	next_freq = freqs;
523 	for  (i = 0; i < num_chans; i++) {
524 		u8 chan = channels ? channels[i] : op->min_chan + i * op->inc;
525 		enum chan_allowed res = verify_channel(mode, chan, op->bw);
526 
527 		if (res == NOT_ALLOWED || (res == NO_IR && active))
528 			continue;
529 
530 		if (wpas_add_channel(op->op_class, chan, num_primary_channels,
531 				     next_freq) < 0) {
532 			os_free(freqs);
533 			return NULL;
534 		}
535 
536 		next_freq += num_primary_channels;
537 	}
538 
539 	if (!freqs[0]) {
540 		os_free(freqs);
541 		return NULL;
542 	}
543 
544 	return freqs;
545 }
546 
547 
wpas_op_class_freqs(const struct oper_class_map * op,struct hostapd_hw_modes * mode,int active)548 static int * wpas_op_class_freqs(const struct oper_class_map *op,
549 				 struct hostapd_hw_modes *mode, int active)
550 {
551 	u8 channels_80mhz[] = { 42, 58, 106, 122, 138, 155 };
552 	u8 channels_160mhz[] = { 50, 114 };
553 
554 	/*
555 	 * When adding all channels in the operating class, 80 + 80 MHz
556 	 * operating classes are like 80 MHz channels because we add all valid
557 	 * channels anyway.
558 	 */
559 	if (op->bw == BW80 || op->bw == BW80P80)
560 		return wpas_add_channels(op, mode, active, channels_80mhz,
561 					 ARRAY_SIZE(channels_80mhz));
562 
563 	if (op->bw == BW160)
564 		return wpas_add_channels(op, mode, active, channels_160mhz,
565 					 ARRAY_SIZE(channels_160mhz));
566 
567 	return wpas_add_channels(op, mode, active, NULL, 0);
568 }
569 
570 
wpas_channel_report_freqs(struct wpa_supplicant * wpa_s,int active,const char * country,const u8 * subelems,size_t len)571 static int * wpas_channel_report_freqs(struct wpa_supplicant *wpa_s, int active,
572 				       const char *country, const u8 *subelems,
573 				       size_t len)
574 {
575 	int *freqs = NULL, *new_freqs;
576 	const u8 *end = subelems + len;
577 
578 	while (end - subelems > 2) {
579 		const struct oper_class_map *op;
580 		const u8 *ap_chan_elem, *pos;
581 		u8 left;
582 		struct hostapd_hw_modes *mode;
583 
584 		ap_chan_elem = get_ie(subelems, end - subelems,
585 				      WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL);
586 		if (!ap_chan_elem)
587 			break;
588 		pos = ap_chan_elem + 2;
589 		left = ap_chan_elem[1];
590 		if (left < 1)
591 			break;
592 		subelems = ap_chan_elem + 2 + left;
593 
594 		op = get_oper_class(country, *pos);
595 		if (!op) {
596 			wpa_printf(MSG_DEBUG,
597 				   "Beacon request: unknown operating class in AP Channel Report subelement %u",
598 				   *pos);
599 			goto out;
600 		}
601 		pos++;
602 		left--;
603 
604 		mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode);
605 		if (!mode)
606 			continue;
607 
608 		/*
609 		 * For 80 + 80 MHz operating classes, this AP Channel Report
610 		 * element should be followed by another element specifying
611 		 * the second 80 MHz channel. For now just add this 80 MHz
612 		 * channel, the second 80 MHz channel will be added when the
613 		 * next element is parsed.
614 		 * TODO: Verify that this AP Channel Report element is followed
615 		 * by a corresponding AP Channel Report element as specified in
616 		 * IEEE Std 802.11-2016, 11.11.9.1.
617 		 */
618 		new_freqs = wpas_add_channels(op, mode, active, pos, left);
619 		if (new_freqs)
620 			int_array_concat(&freqs, new_freqs);
621 
622 		os_free(new_freqs);
623 	}
624 
625 	return freqs;
626 out:
627 	os_free(freqs);
628 	return NULL;
629 }
630 
631 
wpas_beacon_request_freqs(struct wpa_supplicant * wpa_s,u8 op_class,u8 chan,int active,const u8 * subelems,size_t len)632 static int * wpas_beacon_request_freqs(struct wpa_supplicant *wpa_s,
633 				       u8 op_class, u8 chan, int active,
634 				       const u8 *subelems, size_t len)
635 {
636 	int *freqs = NULL, *ext_freqs = NULL;
637 	struct hostapd_hw_modes *mode;
638 	const char *country = NULL;
639 	const struct oper_class_map *op;
640 	const u8 *elem;
641 
642 	if (!wpa_s->current_bss)
643 		return NULL;
644 	elem = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
645 	if (elem && elem[1] >= 2)
646 		country = (const char *) (elem + 2);
647 
648 	op = get_oper_class(country, op_class);
649 	if (!op) {
650 		wpa_printf(MSG_DEBUG,
651 			   "Beacon request: invalid operating class %d",
652 			   op_class);
653 		return NULL;
654 	}
655 
656 	mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode);
657 	if (!mode)
658 		return NULL;
659 
660 	switch (chan) {
661 	case 0:
662 		freqs = wpas_op_class_freqs(op, mode, active);
663 		if (!freqs)
664 			return NULL;
665 		break;
666 	case 255:
667 		/* freqs will be added from AP channel subelements */
668 		break;
669 	default:
670 		freqs = wpas_add_channels(op, mode, active, &chan, 1);
671 		if (!freqs)
672 			return NULL;
673 		break;
674 	}
675 
676 	ext_freqs = wpas_channel_report_freqs(wpa_s, active, country, subelems,
677 					      len);
678 	if (ext_freqs) {
679 		int_array_concat(&freqs, ext_freqs);
680 		os_free(ext_freqs);
681 		int_array_sort_unique(freqs);
682 	}
683 
684 	return freqs;
685 }
686 
687 
wpas_get_op_chan_phy(int freq,const u8 * ies,size_t ies_len,u8 * op_class,u8 * chan,u8 * phy_type)688 static int wpas_get_op_chan_phy(int freq, const u8 *ies, size_t ies_len,
689 				u8 *op_class, u8 *chan, u8 *phy_type)
690 {
691 	const u8 *ie;
692 	int sec_chan = 0, vht = 0;
693 	struct ieee80211_ht_operation *ht_oper = NULL;
694 	struct ieee80211_vht_operation *vht_oper = NULL;
695 	u8 seg0, seg1;
696 
697 	ie = get_ie(ies, ies_len, WLAN_EID_HT_OPERATION);
698 	if (ie && ie[1] >= sizeof(struct ieee80211_ht_operation)) {
699 		u8 sec_chan_offset;
700 
701 		ht_oper = (struct ieee80211_ht_operation *) (ie + 2);
702 		sec_chan_offset = ht_oper->ht_param &
703 			HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
704 		if (sec_chan_offset == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
705 			sec_chan = 1;
706 		else if (sec_chan_offset ==
707 			 HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
708 			sec_chan = -1;
709 	}
710 
711 	ie = get_ie(ies, ies_len, WLAN_EID_VHT_OPERATION);
712 	if (ie && ie[1] >= sizeof(struct ieee80211_vht_operation)) {
713 		vht_oper = (struct ieee80211_vht_operation *) (ie + 2);
714 
715 		switch (vht_oper->vht_op_info_chwidth) {
716 		case 1:
717 			seg0 = vht_oper->vht_op_info_chan_center_freq_seg0_idx;
718 			seg1 = vht_oper->vht_op_info_chan_center_freq_seg1_idx;
719 			if (seg1 && abs(seg1 - seg0) == 8)
720 				vht = CHANWIDTH_160MHZ;
721 			else if (seg1)
722 				vht = CHANWIDTH_80P80MHZ;
723 			else
724 				vht = CHANWIDTH_80MHZ;
725 			break;
726 		case 2:
727 			vht = CHANWIDTH_160MHZ;
728 			break;
729 		case 3:
730 			vht = CHANWIDTH_80P80MHZ;
731 			break;
732 		default:
733 			vht = CHANWIDTH_USE_HT;
734 			break;
735 		}
736 	}
737 
738 	if (ieee80211_freq_to_channel_ext(freq, sec_chan, vht, op_class,
739 					  chan) == NUM_HOSTAPD_MODES) {
740 		wpa_printf(MSG_DEBUG,
741 			   "Cannot determine operating class and channel");
742 		return -1;
743 	}
744 
745 	*phy_type = ieee80211_get_phy_type(freq, ht_oper != NULL,
746 					   vht_oper != NULL);
747 	if (*phy_type == PHY_TYPE_UNSPECIFIED) {
748 		wpa_printf(MSG_DEBUG, "Cannot determine phy type");
749 		return -1;
750 	}
751 
752 	return 0;
753 }
754 
755 
wpas_beacon_rep_add_frame_body(struct bitfield * eids,enum beacon_report_detail detail,struct wpa_bss * bss,u8 * buf,size_t buf_len,u8 ** ies_buf,size_t * ie_len,int add_fixed)756 static int wpas_beacon_rep_add_frame_body(struct bitfield *eids,
757 					  enum beacon_report_detail detail,
758 					  struct wpa_bss *bss, u8 *buf,
759 					  size_t buf_len, u8 **ies_buf,
760 					  size_t *ie_len, int add_fixed)
761 {
762 	u8 *ies = *ies_buf;
763 	size_t ies_len = *ie_len;
764 	u8 *pos = buf;
765 	int rem_len;
766 
767 	rem_len = 255 - sizeof(struct rrm_measurement_beacon_report) -
768 		sizeof(struct rrm_measurement_report_element) - 2 -
769 		REPORTED_FRAME_BODY_SUBELEM_LEN;
770 
771 	if (detail > BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
772 		wpa_printf(MSG_DEBUG,
773 			   "Beacon Request: Invalid reporting detail: %d",
774 			   detail);
775 		return -1;
776 	}
777 
778 	if (detail == BEACON_REPORT_DETAIL_NONE)
779 		return 0;
780 
781 	/*
782 	 * Minimal frame body subelement size: EID(1) + length(1) + TSF(8) +
783 	 * beacon interval(2) + capabilities(2) = 14 bytes
784 	 */
785 	if (add_fixed && buf_len < 14)
786 		return -1;
787 
788 	*pos++ = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY;
789 	/* The length will be filled later */
790 	pos++;
791 
792 	if (add_fixed) {
793 		WPA_PUT_LE64(pos, bss->tsf);
794 		pos += sizeof(bss->tsf);
795 		WPA_PUT_LE16(pos, bss->beacon_int);
796 		pos += 2;
797 		WPA_PUT_LE16(pos, bss->caps);
798 		pos += 2;
799 	}
800 
801 	rem_len -= pos - buf;
802 
803 	/*
804 	 * According to IEEE Std 802.11-2016, 9.4.2.22.7, if the reported frame
805 	 * body subelement causes the element to exceed the maximum element
806 	 * size, the subelement is truncated so that the last IE is a complete
807 	 * IE. So even when required to report all IEs, add elements one after
808 	 * the other and stop once there is no more room in the measurement
809 	 * element.
810 	 */
811 	while (ies_len > 2 && 2U + ies[1] <= ies_len && rem_len > 0) {
812 		if (detail == BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS ||
813 		    (eids && bitfield_is_set(eids, ies[0]))) {
814 			u8 elen = ies[1];
815 
816 			if (2 + elen > buf + buf_len - pos ||
817 			    2 + elen > rem_len)
818 				break;
819 
820 			*pos++ = ies[0];
821 			*pos++ = elen;
822 			os_memcpy(pos, ies + 2, elen);
823 			pos += elen;
824 			rem_len -= 2 + elen;
825 		}
826 
827 		ies_len -= 2 + ies[1];
828 		ies += 2 + ies[1];
829 	}
830 
831 	*ie_len = ies_len;
832 	*ies_buf = ies;
833 
834 	/* Now the length is known */
835 	buf[1] = pos - buf - 2;
836 	return pos - buf;
837 }
838 
839 
wpas_add_beacon_rep_elem(struct beacon_rep_data * data,struct wpa_bss * bss,struct wpabuf ** wpa_buf,struct rrm_measurement_beacon_report * rep,u8 ** ie,size_t * ie_len,u8 idx)840 static int wpas_add_beacon_rep_elem(struct beacon_rep_data *data,
841 				    struct wpa_bss *bss,
842 				    struct wpabuf **wpa_buf,
843 				    struct rrm_measurement_beacon_report *rep,
844 				    u8 **ie, size_t *ie_len, u8 idx)
845 {
846 	int ret;
847 	u8 *buf, *pos;
848 	u32 subelems_len = REPORTED_FRAME_BODY_SUBELEM_LEN +
849 		(data->last_indication ?
850 		 BEACON_REPORT_LAST_INDICATION_SUBELEM_LEN : 0);
851 
852 	/* Maximum element length: Beacon Report element + Reported Frame Body
853 	 * subelement + all IEs of the reported Beacon frame + Reported Frame
854 	 * Body Fragment ID subelement */
855 	buf = os_malloc(sizeof(*rep) + 14 + *ie_len + subelems_len);
856 	if (!buf)
857 		return -1;
858 
859 	os_memcpy(buf, rep, sizeof(*rep));
860 
861 	ret = wpas_beacon_rep_add_frame_body(data->eids, data->report_detail,
862 					     bss, buf + sizeof(*rep),
863 					     14 + *ie_len, ie, ie_len,
864 					     idx == 0);
865 	if (ret < 0)
866 		goto out;
867 
868 	pos = buf + ret + sizeof(*rep);
869 	pos[0] = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY_FRAGMENT_ID;
870 	pos[1] = 2;
871 
872 	/*
873 	 * Only one Beacon Report Measurement is supported at a time, so
874 	 * the Beacon Report ID can always be set to 1.
875 	 */
876 	pos[2] = 1;
877 
878 	/* Fragment ID Number (bits 0..6) and More Frame Body Fragments (bit 7)
879  */
880 	pos[3] = idx;
881 	if (data->report_detail != BEACON_REPORT_DETAIL_NONE && *ie_len)
882 		pos[3] |= REPORTED_FRAME_BODY_MORE_FRAGMENTS;
883 	else
884 		pos[3] &= ~REPORTED_FRAME_BODY_MORE_FRAGMENTS;
885 
886 	pos += REPORTED_FRAME_BODY_SUBELEM_LEN;
887 
888 	if (data->last_indication) {
889 		pos[0] = WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION;
890 		pos[1] = 1;
891 
892 		/* This field will be updated later if this is the last frame */
893 		pos[2] = 0;
894 	}
895 
896 	ret = wpas_rrm_report_elem(wpa_buf, data->token,
897 				   MEASUREMENT_REPORT_MODE_ACCEPT,
898 				   MEASURE_TYPE_BEACON, buf,
899 				   ret + sizeof(*rep) + subelems_len);
900 out:
901 	os_free(buf);
902 	return ret;
903 }
904 
905 
wpas_add_beacon_rep(struct wpa_supplicant * wpa_s,struct wpabuf ** wpa_buf,struct wpa_bss * bss,u64 start,u64 parent_tsf)906 static int wpas_add_beacon_rep(struct wpa_supplicant *wpa_s,
907 			       struct wpabuf **wpa_buf, struct wpa_bss *bss,
908 			       u64 start, u64 parent_tsf)
909 {
910 	struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
911 	u8 *ies = (u8 *) (bss + 1);
912 	u8 *pos = ies;
913 	size_t ies_len = bss->ie_len ? bss->ie_len : bss->beacon_ie_len;
914 	struct rrm_measurement_beacon_report rep;
915 	u8 idx = 0;
916 
917 	if (os_memcmp(data->bssid, broadcast_ether_addr, ETH_ALEN) != 0 &&
918 	    os_memcmp(data->bssid, bss->bssid, ETH_ALEN) != 0)
919 		return 0;
920 
921 	if (data->ssid_len &&
922 	    (data->ssid_len != bss->ssid_len ||
923 	     os_memcmp(data->ssid, bss->ssid, bss->ssid_len) != 0))
924 		return 0;
925 
926 	if (wpas_get_op_chan_phy(bss->freq, ies, ies_len, &rep.op_class,
927 				 &rep.channel, &rep.report_info) < 0)
928 		return 0;
929 
930 	rep.start_time = host_to_le64(start);
931 	rep.duration = host_to_le16(data->scan_params.duration);
932 	rep.rcpi = rssi_to_rcpi(bss->level);
933 	rep.rsni = 255; /* 255 indicates that RSNI is not available */
934 	os_memcpy(rep.bssid, bss->bssid, ETH_ALEN);
935 	rep.antenna_id = 0; /* unknown */
936 	rep.parent_tsf = host_to_le32(parent_tsf);
937 
938 	do {
939 		int ret;
940 
941 		ret = wpas_add_beacon_rep_elem(data, bss, wpa_buf, &rep,
942 					       &pos, &ies_len, idx++);
943 		if (ret)
944 			return ret;
945 	} while (data->report_detail != BEACON_REPORT_DETAIL_NONE &&
946 		 ies_len >= 2);
947 
948 	return 0;
949 }
950 
951 
wpas_beacon_rep_no_results(struct wpa_supplicant * wpa_s,struct wpabuf ** buf)952 static int wpas_beacon_rep_no_results(struct wpa_supplicant *wpa_s,
953 				      struct wpabuf **buf)
954 {
955 	return wpas_rrm_report_elem(buf, wpa_s->beacon_rep_data.token,
956 				    MEASUREMENT_REPORT_MODE_ACCEPT,
957 				    MEASURE_TYPE_BEACON, NULL, 0);
958 }
959 
960 
wpas_beacon_rep_table(struct wpa_supplicant * wpa_s,struct wpabuf ** buf)961 static void wpas_beacon_rep_table(struct wpa_supplicant *wpa_s,
962 				  struct wpabuf **buf)
963 {
964 	size_t i;
965 
966 	for (i = 0; i < wpa_s->last_scan_res_used; i++) {
967 		if (wpas_add_beacon_rep(wpa_s, buf, wpa_s->last_scan_res[i],
968 					0, 0) < 0)
969 			break;
970 	}
971 
972 	if (!(*buf))
973 		wpas_beacon_rep_no_results(wpa_s, buf);
974 
975 	wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", *buf);
976 }
977 
978 
wpas_rrm_refuse_request(struct wpa_supplicant * wpa_s)979 void wpas_rrm_refuse_request(struct wpa_supplicant *wpa_s)
980 {
981 	if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr)) {
982 		struct wpabuf *buf = NULL;
983 
984 		if (wpas_rrm_report_elem(&buf, wpa_s->beacon_rep_data.token,
985 					 MEASUREMENT_REPORT_MODE_REJECT_REFUSED,
986 					 MEASURE_TYPE_BEACON, NULL, 0)) {
987 			wpa_printf(MSG_ERROR, "RRM: Memory allocation failed");
988 			wpabuf_free(buf);
989 			return;
990 		}
991 
992 		wpas_rrm_send_msr_report(wpa_s, buf);
993 		wpabuf_free(buf);
994 	}
995 
996 	wpas_clear_beacon_rep_data(wpa_s);
997 }
998 
999 
wpas_rrm_scan_timeout(void * eloop_ctx,void * timeout_ctx)1000 static void wpas_rrm_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1001 {
1002 	struct wpa_supplicant *wpa_s = eloop_ctx;
1003 	struct wpa_driver_scan_params *params =
1004 		&wpa_s->beacon_rep_data.scan_params;
1005 	u16 prev_duration = params->duration;
1006 
1007 	if (!wpa_s->current_bss)
1008 		return;
1009 
1010 	if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) &&
1011 	    params->duration) {
1012 		wpa_printf(MSG_DEBUG,
1013 			   "RRM: Cannot set scan duration due to missing driver support");
1014 		params->duration = 0;
1015 	}
1016 	os_get_reltime(&wpa_s->beacon_rep_scan);
1017 	if (wpa_s->scanning || wpas_p2p_in_progress(wpa_s) ||
1018 	    wpa_supplicant_trigger_scan(wpa_s, params))
1019 		wpas_rrm_refuse_request(wpa_s);
1020 	params->duration = prev_duration;
1021 }
1022 
1023 
wpas_rm_handle_beacon_req_subelem(struct wpa_supplicant * wpa_s,struct beacon_rep_data * data,u8 sid,u8 slen,const u8 * subelem)1024 static int wpas_rm_handle_beacon_req_subelem(struct wpa_supplicant *wpa_s,
1025 					     struct beacon_rep_data *data,
1026 					     u8 sid, u8 slen, const u8 *subelem)
1027 {
1028 	u8 report_info, i;
1029 
1030 	switch (sid) {
1031 	case WLAN_BEACON_REQUEST_SUBELEM_SSID:
1032 		if (!slen) {
1033 			wpa_printf(MSG_DEBUG,
1034 				   "SSID subelement with zero length - wildcard SSID");
1035 			break;
1036 		}
1037 
1038 		if (slen > SSID_MAX_LEN) {
1039 			wpa_printf(MSG_DEBUG,
1040 				   "Invalid SSID subelement length: %u", slen);
1041 			return -1;
1042 		}
1043 
1044 		data->ssid_len = slen;
1045 		os_memcpy(data->ssid, subelem, data->ssid_len);
1046 		break;
1047 	case WLAN_BEACON_REQUEST_SUBELEM_INFO:
1048 		if (slen != 2) {
1049 			wpa_printf(MSG_DEBUG,
1050 				   "Invalid reporting information subelement length: %u",
1051 				   slen);
1052 			return -1;
1053 		}
1054 
1055 		report_info = subelem[0];
1056 		if (report_info != 0) {
1057 			wpa_printf(MSG_DEBUG,
1058 				   "reporting information=%u is not supported",
1059 				   report_info);
1060 			return 0;
1061 		}
1062 		break;
1063 	case WLAN_BEACON_REQUEST_SUBELEM_DETAIL:
1064 		if (slen != 1) {
1065 			wpa_printf(MSG_DEBUG,
1066 				   "Invalid reporting detail subelement length: %u",
1067 				   slen);
1068 			return -1;
1069 		}
1070 
1071 		data->report_detail = subelem[0];
1072 		if (data->report_detail >
1073 		    BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
1074 			wpa_printf(MSG_DEBUG, "Invalid reporting detail: %u",
1075 				   subelem[0]);
1076 			return -1;
1077 		}
1078 
1079 		break;
1080 	case WLAN_BEACON_REQUEST_SUBELEM_REQUEST:
1081 		if (data->report_detail !=
1082 		    BEACON_REPORT_DETAIL_REQUESTED_ONLY) {
1083 			wpa_printf(MSG_DEBUG,
1084 				   "Beacon request: request subelement is present but report detail is %u",
1085 				   data->report_detail);
1086 			return -1;
1087 		}
1088 
1089 		if (!slen) {
1090 			wpa_printf(MSG_DEBUG,
1091 				   "Invalid request subelement length: %u",
1092 				   slen);
1093 			return -1;
1094 		}
1095 
1096 		if (data->eids) {
1097 			wpa_printf(MSG_DEBUG,
1098 				   "Beacon Request: Request subelement appears more than once");
1099 			return -1;
1100 		}
1101 
1102 		data->eids = bitfield_alloc(255);
1103 		if (!data->eids) {
1104 			wpa_printf(MSG_DEBUG, "Failed to allocate EIDs bitmap");
1105 			return -1;
1106 		}
1107 
1108 		for (i = 0; i < slen; i++)
1109 			bitfield_set(data->eids, subelem[i]);
1110 		break;
1111 	case WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL:
1112 		/* Skip - it will be processed when freqs are added */
1113 		break;
1114 	case WLAN_BEACON_REQUEST_SUBELEM_LAST_INDICATION:
1115 		if (slen != 1) {
1116 			wpa_printf(MSG_DEBUG,
1117 				   "Beacon request: Invalid last indication request subelement length: %u",
1118 				   slen);
1119 			return -1;
1120 		}
1121 
1122 		data->last_indication = subelem[0];
1123 		break;
1124 	default:
1125 		wpa_printf(MSG_DEBUG,
1126 			   "Beacon request: Unknown subelement id %u", sid);
1127 		break;
1128 	}
1129 
1130 	return 1;
1131 }
1132 
1133 
1134 /**
1135  * Returns 0 if the next element can be processed, 1 if some operation was
1136  * triggered, and -1 if processing failed (i.e., the element is in invalid
1137  * format or an internal error occurred).
1138  */
1139 static int
wpas_rm_handle_beacon_req(struct wpa_supplicant * wpa_s,u8 elem_token,int duration_mandatory,const struct rrm_measurement_beacon_request * req,size_t len,struct wpabuf ** buf)1140 wpas_rm_handle_beacon_req(struct wpa_supplicant *wpa_s,
1141 			  u8 elem_token, int duration_mandatory,
1142 			  const struct rrm_measurement_beacon_request *req,
1143 			  size_t len, struct wpabuf **buf)
1144 {
1145 	struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1146 	struct wpa_driver_scan_params *params = &data->scan_params;
1147 	const u8 *subelems;
1148 	size_t elems_len;
1149 	u16 rand_interval;
1150 	u32 interval_usec;
1151 	u32 _rand;
1152 	int ret = 0, res;
1153 	u8 reject_mode;
1154 
1155 	if (len < sizeof(*req))
1156 		return -1;
1157 
1158 	if (req->mode != BEACON_REPORT_MODE_PASSIVE &&
1159 	    req->mode != BEACON_REPORT_MODE_ACTIVE &&
1160 	    req->mode != BEACON_REPORT_MODE_TABLE)
1161 		return 0;
1162 
1163 	subelems = req->variable;
1164 	elems_len = len - sizeof(*req);
1165 	rand_interval = le_to_host16(req->rand_interval);
1166 
1167 	os_free(params->freqs);
1168 	os_memset(params, 0, sizeof(*params));
1169 
1170 	data->token = elem_token;
1171 
1172 	/* default reporting detail is all fixed length fields and all
1173 	 * elements */
1174 	data->report_detail = BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS;
1175 	os_memcpy(data->bssid, req->bssid, ETH_ALEN);
1176 
1177 	while (elems_len >= 2) {
1178 		if (subelems[1] > elems_len - 2) {
1179 			wpa_printf(MSG_DEBUG,
1180 				   "Beacon Request: Truncated subelement");
1181 			ret = -1;
1182 			goto out;
1183 		}
1184 
1185 		res = wpas_rm_handle_beacon_req_subelem(
1186 			wpa_s, data, subelems[0], subelems[1], &subelems[2]);
1187 		if (res < 0) {
1188 			ret = res;
1189 			goto out;
1190 		} else if (!res) {
1191 			reject_mode = MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE;
1192 			goto out_reject;
1193 		}
1194 
1195 		elems_len -= 2 + subelems[1];
1196 		subelems += 2 + subelems[1];
1197 	}
1198 
1199 	if (req->mode == BEACON_REPORT_MODE_TABLE) {
1200 		wpas_beacon_rep_table(wpa_s, buf);
1201 		goto out;
1202 	}
1203 
1204 	params->freqs = wpas_beacon_request_freqs(
1205 		wpa_s, req->oper_class, req->channel,
1206 		req->mode == BEACON_REPORT_MODE_ACTIVE,
1207 		req->variable, len - sizeof(*req));
1208 	if (!params->freqs) {
1209 		wpa_printf(MSG_DEBUG, "Beacon request: No valid channels");
1210 		reject_mode = MEASUREMENT_REPORT_MODE_REJECT_REFUSED;
1211 		goto out_reject;
1212 	}
1213 
1214 	params->duration = le_to_host16(req->duration);
1215 	params->duration_mandatory = duration_mandatory;
1216 	if (!params->duration) {
1217 		wpa_printf(MSG_DEBUG, "Beacon request: Duration is 0");
1218 		ret = -1;
1219 		goto out;
1220 	}
1221 
1222 	params->only_new_results = 1;
1223 
1224 	if (req->mode == BEACON_REPORT_MODE_ACTIVE) {
1225 		params->ssids[params->num_ssids].ssid = data->ssid;
1226 		params->ssids[params->num_ssids++].ssid_len = data->ssid_len;
1227 	}
1228 
1229 	if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
1230 		_rand = os_random();
1231 	interval_usec = (_rand % (rand_interval + 1)) * 1024;
1232 	eloop_register_timeout(0, interval_usec, wpas_rrm_scan_timeout, wpa_s,
1233 			       NULL);
1234 	return 1;
1235 out_reject:
1236 	if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1237 	    wpas_rrm_report_elem(buf, elem_token, reject_mode,
1238 				 MEASURE_TYPE_BEACON, NULL, 0) < 0) {
1239 		wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1240 		ret = -1;
1241 	}
1242 out:
1243 	wpas_clear_beacon_rep_data(wpa_s);
1244 	return ret;
1245 }
1246 
1247 
1248 static int
wpas_rrm_handle_msr_req_element(struct wpa_supplicant * wpa_s,const struct rrm_measurement_request_element * req,struct wpabuf ** buf)1249 wpas_rrm_handle_msr_req_element(
1250 	struct wpa_supplicant *wpa_s,
1251 	const struct rrm_measurement_request_element *req,
1252 	struct wpabuf **buf)
1253 {
1254 	int duration_mandatory;
1255 
1256 	wpa_printf(MSG_DEBUG, "Measurement request type %d token %d",
1257 		   req->type, req->token);
1258 
1259 	if (req->mode & MEASUREMENT_REQUEST_MODE_ENABLE) {
1260 		/* Enable bit is not supported for now */
1261 		wpa_printf(MSG_DEBUG, "RRM: Enable bit not supported, ignore");
1262 		return 0;
1263 	}
1264 
1265 	if ((req->mode & MEASUREMENT_REQUEST_MODE_PARALLEL) &&
1266 	    req->type > MEASURE_TYPE_RPI_HIST) {
1267 		/* Parallel measurements are not supported for now */
1268 		wpa_printf(MSG_DEBUG,
1269 			   "RRM: Parallel measurements are not supported, reject");
1270 		goto reject;
1271 	}
1272 
1273 	duration_mandatory =
1274 		!!(req->mode & MEASUREMENT_REQUEST_MODE_DURATION_MANDATORY);
1275 
1276 	switch (req->type) {
1277 	case MEASURE_TYPE_LCI:
1278 		return wpas_rrm_build_lci_report(wpa_s, req, buf);
1279 	case MEASURE_TYPE_BEACON:
1280 		if (duration_mandatory &&
1281 		    !(wpa_s->drv_rrm_flags &
1282 		      WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL)) {
1283 			wpa_printf(MSG_DEBUG,
1284 				   "RRM: Driver does not support dwell time configuration - reject beacon report with mandatory duration");
1285 			goto reject;
1286 		}
1287 		return wpas_rm_handle_beacon_req(wpa_s, req->token,
1288 						 duration_mandatory,
1289 						 (const void *) req->variable,
1290 						 req->len - 3, buf);
1291 	default:
1292 		wpa_printf(MSG_INFO,
1293 			   "RRM: Unsupported radio measurement type %u",
1294 			   req->type);
1295 		break;
1296 	}
1297 
1298 reject:
1299 	if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1300 	    wpas_rrm_report_elem(buf, req->token,
1301 				 MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
1302 				 req->type, NULL, 0) < 0) {
1303 		wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1304 		return -1;
1305 	}
1306 
1307 	return 0;
1308 }
1309 
1310 
1311 static struct wpabuf *
wpas_rrm_process_msr_req_elems(struct wpa_supplicant * wpa_s,const u8 * pos,size_t len)1312 wpas_rrm_process_msr_req_elems(struct wpa_supplicant *wpa_s, const u8 *pos,
1313 			       size_t len)
1314 {
1315 	struct wpabuf *buf = NULL;
1316 
1317 	while (len) {
1318 		const struct rrm_measurement_request_element *req;
1319 		int res;
1320 
1321 		if (len < 2) {
1322 			wpa_printf(MSG_DEBUG, "RRM: Truncated element");
1323 			goto out;
1324 		}
1325 
1326 		req = (const struct rrm_measurement_request_element *) pos;
1327 		if (req->eid != WLAN_EID_MEASURE_REQUEST) {
1328 			wpa_printf(MSG_DEBUG,
1329 				   "RRM: Expected Measurement Request element, but EID is %u",
1330 				   req->eid);
1331 			goto out;
1332 		}
1333 
1334 		if (req->len < 3) {
1335 			wpa_printf(MSG_DEBUG, "RRM: Element length too short");
1336 			goto out;
1337 		}
1338 
1339 		if (req->len > len - 2) {
1340 			wpa_printf(MSG_DEBUG, "RRM: Element length too long");
1341 			goto out;
1342 		}
1343 
1344 		res = wpas_rrm_handle_msr_req_element(wpa_s, req, &buf);
1345 		if (res < 0)
1346 			goto out;
1347 
1348 		pos += req->len + 2;
1349 		len -= req->len + 2;
1350 	}
1351 
1352 	return buf;
1353 
1354 out:
1355 	wpabuf_free(buf);
1356 	return NULL;
1357 }
1358 
1359 
wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant * wpa_s,const u8 * src,const u8 * dst,const u8 * frame,size_t len)1360 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
1361 					       const u8 *src, const u8 *dst,
1362 					       const u8 *frame, size_t len)
1363 {
1364 	struct wpabuf *report;
1365 
1366 	if (wpa_s->wpa_state != WPA_COMPLETED) {
1367 		wpa_printf(MSG_INFO,
1368 			   "RRM: Ignoring radio measurement request: Not associated");
1369 		return;
1370 	}
1371 
1372 	if (!wpa_s->rrm.rrm_used) {
1373 		wpa_printf(MSG_INFO,
1374 			   "RRM: Ignoring radio measurement request: Not RRM network");
1375 		return;
1376 	}
1377 
1378 	if (len < 3) {
1379 		wpa_printf(MSG_INFO,
1380 			   "RRM: Ignoring too short radio measurement request");
1381 		return;
1382 	}
1383 
1384 	wpa_s->rrm.token = *frame;
1385 	os_memcpy(wpa_s->rrm.dst_addr, dst, ETH_ALEN);
1386 
1387 	/* Number of repetitions is not supported */
1388 
1389 	report = wpas_rrm_process_msr_req_elems(wpa_s, frame + 3, len - 3);
1390 	if (!report)
1391 		return;
1392 
1393 	wpas_rrm_send_msr_report(wpa_s, report);
1394 	wpabuf_free(report);
1395 }
1396 
1397 
wpas_rrm_handle_link_measurement_request(struct wpa_supplicant * wpa_s,const u8 * src,const u8 * frame,size_t len,int rssi)1398 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
1399 					      const u8 *src,
1400 					      const u8 *frame, size_t len,
1401 					      int rssi)
1402 {
1403 	struct wpabuf *buf;
1404 	const struct rrm_link_measurement_request *req;
1405 	struct rrm_link_measurement_report report;
1406 
1407 	if (wpa_s->wpa_state != WPA_COMPLETED) {
1408 		wpa_printf(MSG_INFO,
1409 			   "RRM: Ignoring link measurement request. Not associated");
1410 		return;
1411 	}
1412 
1413 	if (!wpa_s->rrm.rrm_used) {
1414 		wpa_printf(MSG_INFO,
1415 			   "RRM: Ignoring link measurement request. Not RRM network");
1416 		return;
1417 	}
1418 
1419 	if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
1420 		wpa_printf(MSG_INFO,
1421 			   "RRM: Measurement report failed. TX power insertion not supported");
1422 		return;
1423 	}
1424 
1425 	req = (const struct rrm_link_measurement_request *) frame;
1426 	if (len < sizeof(*req)) {
1427 		wpa_printf(MSG_INFO,
1428 			   "RRM: Link measurement report failed. Request too short");
1429 		return;
1430 	}
1431 
1432 	os_memset(&report, 0, sizeof(report));
1433 	report.dialog_token = req->dialog_token;
1434 	report.tpc.eid = WLAN_EID_TPC_REPORT;
1435 	report.tpc.len = 2;
1436 	/* Note: The driver is expected to update report.tpc.tx_power and
1437 	 * report.tpc.link_margin subfields when sending out this frame.
1438 	 * Similarly, the driver would need to update report.rx_ant_id and
1439 	 * report.tx_ant_id subfields. */
1440 	report.rsni = 255; /* 255 indicates that RSNI is not available */
1441 	report.rcpi = rssi_to_rcpi(rssi);
1442 
1443 	/* action_category + action_code */
1444 	buf = wpabuf_alloc(2 + sizeof(report));
1445 	if (buf == NULL) {
1446 		wpa_printf(MSG_ERROR,
1447 			   "RRM: Link measurement report failed. Buffer allocation failed");
1448 		return;
1449 	}
1450 
1451 	wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
1452 	wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
1453 	wpabuf_put_data(buf, &report, sizeof(report));
1454 	wpa_hexdump_buf(MSG_DEBUG, "RRM: Link measurement report", buf);
1455 
1456 	if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
1457 				wpa_s->own_addr, wpa_s->bssid,
1458 				wpabuf_head(buf), wpabuf_len(buf), 0)) {
1459 		wpa_printf(MSG_ERROR,
1460 			   "RRM: Link measurement report failed. Send action failed");
1461 	}
1462 	wpabuf_free(buf);
1463 }
1464 
1465 
wpas_beacon_rep_scan_process(struct wpa_supplicant * wpa_s,struct wpa_scan_results * scan_res,struct scan_info * info)1466 int wpas_beacon_rep_scan_process(struct wpa_supplicant *wpa_s,
1467 				 struct wpa_scan_results *scan_res,
1468 				 struct scan_info *info)
1469 {
1470 	size_t i = 0;
1471 	struct wpabuf *buf = NULL;
1472 
1473 	if (!wpa_s->beacon_rep_data.token)
1474 		return 0;
1475 
1476 	if (!wpa_s->current_bss)
1477 		goto out;
1478 
1479 	/* If the measurement was aborted, don't report partial results */
1480 	if (info->aborted)
1481 		goto out;
1482 
1483 	wpa_printf(MSG_DEBUG, "RRM: TSF BSSID: " MACSTR " current BSS: " MACSTR,
1484 		   MAC2STR(info->scan_start_tsf_bssid),
1485 		   MAC2STR(wpa_s->current_bss->bssid));
1486 	if ((wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1487 	    os_memcmp(info->scan_start_tsf_bssid, wpa_s->current_bss->bssid,
1488 		      ETH_ALEN) != 0) {
1489 		wpa_printf(MSG_DEBUG,
1490 			   "RRM: Ignore scan results due to mismatching TSF BSSID");
1491 		goto out;
1492 	}
1493 
1494 	for (i = 0; i < scan_res->num; i++) {
1495 		struct wpa_bss *bss =
1496 			wpa_bss_get_bssid(wpa_s, scan_res->res[i]->bssid);
1497 
1498 		if (!bss)
1499 			continue;
1500 
1501 		if ((wpa_s->drv_rrm_flags &
1502 		     WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1503 		    os_memcmp(scan_res->res[i]->tsf_bssid,
1504 			      wpa_s->current_bss->bssid, ETH_ALEN) != 0) {
1505 			wpa_printf(MSG_DEBUG,
1506 				   "RRM: Ignore scan result for " MACSTR
1507 				   " due to mismatching TSF BSSID" MACSTR,
1508 				   MAC2STR(scan_res->res[i]->bssid),
1509 				   MAC2STR(scan_res->res[i]->tsf_bssid));
1510 			continue;
1511 		}
1512 
1513 		/*
1514 		 * Don't report results that were not received during the
1515 		 * current measurement.
1516 		 */
1517 		if (!(wpa_s->drv_rrm_flags &
1518 		      WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT)) {
1519 			struct os_reltime update_time, diff;
1520 
1521 			/* For now, allow 8 ms older results due to some
1522 			 * unknown issue with cfg80211 BSS table updates during
1523 			 * a scan with the current BSS.
1524 			 * TODO: Fix this more properly to avoid having to have
1525 			 * this type of hacks in place. */
1526 			calculate_update_time(&scan_res->fetch_time,
1527 					      scan_res->res[i]->age,
1528 					      &update_time);
1529 			os_reltime_sub(&wpa_s->beacon_rep_scan,
1530 				       &update_time, &diff);
1531 			if (os_reltime_before(&update_time,
1532 					      &wpa_s->beacon_rep_scan) &&
1533 			    (diff.sec || diff.usec >= 8000)) {
1534 				wpa_printf(MSG_DEBUG,
1535 					   "RRM: Ignore scan result for " MACSTR
1536 					   " due to old update (age(ms) %u, calculated age %u.%06u seconds)",
1537 					   MAC2STR(scan_res->res[i]->bssid),
1538 					   scan_res->res[i]->age,
1539 					   (unsigned int) diff.sec,
1540 					   (unsigned int) diff.usec);
1541 				continue;
1542 			}
1543 		} else if (info->scan_start_tsf >
1544 			   scan_res->res[i]->parent_tsf) {
1545 			continue;
1546 		}
1547 
1548 		if (wpas_add_beacon_rep(wpa_s, &buf, bss, info->scan_start_tsf,
1549 					scan_res->res[i]->parent_tsf) < 0)
1550 			break;
1551 	}
1552 
1553 	if (!buf && wpas_beacon_rep_no_results(wpa_s, &buf))
1554 		goto out;
1555 
1556 	wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", buf);
1557 
1558 	wpas_rrm_send_msr_report(wpa_s, buf);
1559 	wpabuf_free(buf);
1560 
1561 out:
1562 	wpas_clear_beacon_rep_data(wpa_s);
1563 	return 1;
1564 }
1565 
1566 
wpas_clear_beacon_rep_data(struct wpa_supplicant * wpa_s)1567 void wpas_clear_beacon_rep_data(struct wpa_supplicant *wpa_s)
1568 {
1569 	struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1570 
1571 	eloop_cancel_timeout(wpas_rrm_scan_timeout, wpa_s, NULL);
1572 	bitfield_free(data->eids);
1573 	os_free(data->scan_params.freqs);
1574 	os_memset(data, 0, sizeof(*data));
1575 }
1576