1 /* 2 * wpa_supplicant - SME 3 * Copyright (c) 2009-2014, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "utils/eloop.h" 13 #include "common/ieee802_11_defs.h" 14 #include "common/ieee802_11_common.h" 15 #include "eapol_supp/eapol_supp_sm.h" 16 #include "common/wpa_common.h" 17 #include "common/sae.h" 18 #include "rsn_supp/wpa.h" 19 #include "rsn_supp/pmksa_cache.h" 20 #include "config.h" 21 #include "wpa_supplicant_i.h" 22 #include "driver_i.h" 23 #include "wpas_glue.h" 24 #include "wps_supplicant.h" 25 #include "p2p_supplicant.h" 26 #include "notify.h" 27 #include "bss.h" 28 #include "scan.h" 29 #include "sme.h" 30 #include "hs20_supplicant.h" 31 32 #define SME_AUTH_TIMEOUT 5 33 #define SME_ASSOC_TIMEOUT 5 34 35 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx); 36 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx); 37 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx); 38 #ifdef CONFIG_IEEE80211W 39 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s); 40 #endif /* CONFIG_IEEE80211W */ 41 42 43 #ifdef CONFIG_SAE 44 45 static int index_within_array(const int *array, int idx) 46 { 47 int i; 48 for (i = 0; i < idx; i++) { 49 if (array[i] <= 0) 50 return 0; 51 } 52 return 1; 53 } 54 55 56 static int sme_set_sae_group(struct wpa_supplicant *wpa_s) 57 { 58 int *groups = wpa_s->conf->sae_groups; 59 int default_groups[] = { 19, 20, 21, 25, 26, 0 }; 60 61 if (!groups || groups[0] <= 0) 62 groups = default_groups; 63 64 /* Configuration may have changed, so validate current index */ 65 if (!index_within_array(groups, wpa_s->sme.sae_group_index)) 66 return -1; 67 68 for (;;) { 69 int group = groups[wpa_s->sme.sae_group_index]; 70 if (group < 0) 71 break; 72 if (sae_set_group(&wpa_s->sme.sae, group) == 0) { 73 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d", 74 wpa_s->sme.sae.group); 75 return 0; 76 } 77 wpa_s->sme.sae_group_index++; 78 } 79 80 return -1; 81 } 82 83 84 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s, 85 struct wpa_ssid *ssid, 86 const u8 *bssid) 87 { 88 struct wpabuf *buf; 89 size_t len; 90 91 if (ssid->passphrase == NULL) { 92 wpa_printf(MSG_DEBUG, "SAE: No password available"); 93 return NULL; 94 } 95 96 if (sme_set_sae_group(wpa_s) < 0) { 97 wpa_printf(MSG_DEBUG, "SAE: Failed to select group"); 98 return NULL; 99 } 100 101 if (sae_prepare_commit(wpa_s->own_addr, bssid, 102 (u8 *) ssid->passphrase, 103 os_strlen(ssid->passphrase), 104 &wpa_s->sme.sae) < 0) { 105 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE"); 106 return NULL; 107 } 108 109 len = wpa_s->sme.sae_token ? wpabuf_len(wpa_s->sme.sae_token) : 0; 110 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len); 111 if (buf == NULL) 112 return NULL; 113 114 wpabuf_put_le16(buf, 1); /* Transaction seq# */ 115 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS); 116 sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token); 117 118 return buf; 119 } 120 121 122 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s) 123 { 124 struct wpabuf *buf; 125 126 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN); 127 if (buf == NULL) 128 return NULL; 129 130 wpabuf_put_le16(buf, 2); /* Transaction seq# */ 131 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS); 132 sae_write_confirm(&wpa_s->sme.sae, buf); 133 134 return buf; 135 } 136 137 #endif /* CONFIG_SAE */ 138 139 140 static void sme_send_authentication(struct wpa_supplicant *wpa_s, 141 struct wpa_bss *bss, struct wpa_ssid *ssid, 142 int start) 143 { 144 struct wpa_driver_auth_params params; 145 struct wpa_ssid *old_ssid; 146 #ifdef CONFIG_IEEE80211R 147 const u8 *ie; 148 #endif /* CONFIG_IEEE80211R */ 149 #ifdef CONFIG_IEEE80211R 150 const u8 *md = NULL; 151 #endif /* CONFIG_IEEE80211R */ 152 int i, bssid_changed; 153 struct wpabuf *resp = NULL; 154 u8 ext_capab[10]; 155 int ext_capab_len; 156 157 if (bss == NULL) { 158 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for " 159 "the network"); 160 wpas_connect_work_done(wpa_s); 161 return; 162 } 163 164 wpa_s->current_bss = bss; 165 166 os_memset(¶ms, 0, sizeof(params)); 167 wpa_s->reassociate = 0; 168 169 params.freq = bss->freq; 170 params.bssid = bss->bssid; 171 params.ssid = bss->ssid; 172 params.ssid_len = bss->ssid_len; 173 params.p2p = ssid->p2p_group; 174 175 if (wpa_s->sme.ssid_len != params.ssid_len || 176 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0) 177 wpa_s->sme.prev_bssid_set = 0; 178 179 wpa_s->sme.freq = params.freq; 180 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len); 181 wpa_s->sme.ssid_len = params.ssid_len; 182 183 params.auth_alg = WPA_AUTH_ALG_OPEN; 184 #ifdef IEEE8021X_EAPOL 185 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) { 186 if (ssid->leap) { 187 if (ssid->non_leap == 0) 188 params.auth_alg = WPA_AUTH_ALG_LEAP; 189 else 190 params.auth_alg |= WPA_AUTH_ALG_LEAP; 191 } 192 } 193 #endif /* IEEE8021X_EAPOL */ 194 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", 195 params.auth_alg); 196 if (ssid->auth_alg) { 197 params.auth_alg = ssid->auth_alg; 198 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: " 199 "0x%x", params.auth_alg); 200 } 201 #ifdef CONFIG_SAE 202 if (wpa_key_mgmt_sae(ssid->key_mgmt)) { 203 const u8 *rsn; 204 struct wpa_ie_data ied; 205 206 rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN); 207 if (rsn && 208 wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0) { 209 if (wpa_key_mgmt_sae(ied.key_mgmt)) { 210 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg"); 211 params.auth_alg = WPA_AUTH_ALG_SAE; 212 } 213 } 214 } 215 #endif /* CONFIG_SAE */ 216 217 for (i = 0; i < NUM_WEP_KEYS; i++) { 218 if (ssid->wep_key_len[i]) 219 params.wep_key[i] = ssid->wep_key[i]; 220 params.wep_key_len[i] = ssid->wep_key_len[i]; 221 } 222 params.wep_tx_keyidx = ssid->wep_tx_keyidx; 223 224 bssid_changed = !is_zero_ether_addr(wpa_s->bssid); 225 os_memset(wpa_s->bssid, 0, ETH_ALEN); 226 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN); 227 if (bssid_changed) 228 wpas_notify_bssid_changed(wpa_s); 229 230 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) || 231 wpa_bss_get_ie(bss, WLAN_EID_RSN)) && 232 wpa_key_mgmt_wpa(ssid->key_mgmt)) { 233 int try_opportunistic; 234 try_opportunistic = (ssid->proactive_key_caching < 0 ? 235 wpa_s->conf->okc : 236 ssid->proactive_key_caching) && 237 (ssid->proto & WPA_PROTO_RSN); 238 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid, 239 wpa_s->current_ssid, 240 try_opportunistic) == 0) 241 eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1); 242 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie); 243 if (wpa_supplicant_set_suites(wpa_s, bss, ssid, 244 wpa_s->sme.assoc_req_ie, 245 &wpa_s->sme.assoc_req_ie_len)) { 246 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA " 247 "key management and encryption suites"); 248 wpas_connect_work_done(wpa_s); 249 return; 250 } 251 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && 252 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) { 253 /* 254 * Both WPA and non-WPA IEEE 802.1X enabled in configuration - 255 * use non-WPA since the scan results did not indicate that the 256 * AP is using WPA or WPA2. 257 */ 258 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid); 259 wpa_s->sme.assoc_req_ie_len = 0; 260 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) { 261 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie); 262 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid, 263 wpa_s->sme.assoc_req_ie, 264 &wpa_s->sme.assoc_req_ie_len)) { 265 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA " 266 "key management and encryption suites (no " 267 "scan results)"); 268 wpas_connect_work_done(wpa_s); 269 return; 270 } 271 #ifdef CONFIG_WPS 272 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) { 273 struct wpabuf *wps_ie; 274 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid)); 275 if (wps_ie && wpabuf_len(wps_ie) <= 276 sizeof(wpa_s->sme.assoc_req_ie)) { 277 wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie); 278 os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie), 279 wpa_s->sme.assoc_req_ie_len); 280 } else 281 wpa_s->sme.assoc_req_ie_len = 0; 282 wpabuf_free(wps_ie); 283 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid); 284 #endif /* CONFIG_WPS */ 285 } else { 286 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid); 287 wpa_s->sme.assoc_req_ie_len = 0; 288 } 289 290 #ifdef CONFIG_IEEE80211R 291 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN); 292 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN) 293 md = ie + 2; 294 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0); 295 if (md) { 296 /* Prepare for the next transition */ 297 wpa_ft_prepare_auth_request(wpa_s->wpa, ie); 298 } 299 300 if (md && wpa_key_mgmt_ft(ssid->key_mgmt)) { 301 if (wpa_s->sme.assoc_req_ie_len + 5 < 302 sizeof(wpa_s->sme.assoc_req_ie)) { 303 struct rsn_mdie *mdie; 304 u8 *pos = wpa_s->sme.assoc_req_ie + 305 wpa_s->sme.assoc_req_ie_len; 306 *pos++ = WLAN_EID_MOBILITY_DOMAIN; 307 *pos++ = sizeof(*mdie); 308 mdie = (struct rsn_mdie *) pos; 309 os_memcpy(mdie->mobility_domain, md, 310 MOBILITY_DOMAIN_ID_LEN); 311 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN]; 312 wpa_s->sme.assoc_req_ie_len += 5; 313 } 314 315 if (wpa_s->sme.ft_used && 316 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 && 317 wpa_sm_has_ptk(wpa_s->wpa)) { 318 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT " 319 "over-the-air"); 320 params.auth_alg = WPA_AUTH_ALG_FT; 321 params.ie = wpa_s->sme.ft_ies; 322 params.ie_len = wpa_s->sme.ft_ies_len; 323 } 324 } 325 #endif /* CONFIG_IEEE80211R */ 326 327 #ifdef CONFIG_IEEE80211W 328 wpa_s->sme.mfp = ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ? 329 wpa_s->conf->pmf : ssid->ieee80211w; 330 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) { 331 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN); 332 struct wpa_ie_data _ie; 333 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 && 334 _ie.capabilities & 335 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) { 336 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports " 337 "MFP: require MFP"); 338 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED; 339 } 340 } 341 #endif /* CONFIG_IEEE80211W */ 342 343 #ifdef CONFIG_P2P 344 if (wpa_s->global->p2p) { 345 u8 *pos; 346 size_t len; 347 int res; 348 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len; 349 len = sizeof(wpa_s->sme.assoc_req_ie) - 350 wpa_s->sme.assoc_req_ie_len; 351 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len, 352 ssid->p2p_group); 353 if (res >= 0) 354 wpa_s->sme.assoc_req_ie_len += res; 355 } 356 #endif /* CONFIG_P2P */ 357 358 #ifdef CONFIG_HS20 359 if (is_hs20_network(wpa_s, ssid, bss)) { 360 struct wpabuf *hs20; 361 hs20 = wpabuf_alloc(20); 362 if (hs20) { 363 wpas_hs20_add_indication(hs20); 364 os_memcpy(wpa_s->sme.assoc_req_ie + 365 wpa_s->sme.assoc_req_ie_len, 366 wpabuf_head(hs20), wpabuf_len(hs20)); 367 wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20); 368 wpabuf_free(hs20); 369 } 370 } 371 #endif /* CONFIG_HS20 */ 372 373 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab); 374 if (ext_capab_len > 0) { 375 u8 *pos = wpa_s->sme.assoc_req_ie; 376 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN) 377 pos += 2 + pos[1]; 378 os_memmove(pos + ext_capab_len, pos, 379 wpa_s->sme.assoc_req_ie_len - 380 (pos - wpa_s->sme.assoc_req_ie)); 381 wpa_s->sme.assoc_req_ie_len += ext_capab_len; 382 os_memcpy(pos, ext_capab, ext_capab_len); 383 } 384 385 #ifdef CONFIG_SAE 386 if (params.auth_alg == WPA_AUTH_ALG_SAE) { 387 if (start) 388 resp = sme_auth_build_sae_commit(wpa_s, ssid, 389 bss->bssid); 390 else 391 resp = sme_auth_build_sae_confirm(wpa_s); 392 if (resp == NULL) { 393 wpas_connect_work_done(wpa_s); 394 return; 395 } 396 params.sae_data = wpabuf_head(resp); 397 params.sae_data_len = wpabuf_len(resp); 398 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED; 399 } 400 #endif /* CONFIG_SAE */ 401 402 wpa_supplicant_cancel_sched_scan(wpa_s); 403 wpa_supplicant_cancel_scan(wpa_s); 404 405 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR 406 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid), 407 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq); 408 409 wpa_clear_keys(wpa_s, bss->bssid); 410 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING); 411 old_ssid = wpa_s->current_ssid; 412 wpa_s->current_ssid = ssid; 413 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid); 414 wpa_supplicant_initiate_eapol(wpa_s); 415 if (old_ssid != wpa_s->current_ssid) 416 wpas_notify_network_changed(wpa_s); 417 418 wpa_s->sme.auth_alg = params.auth_alg; 419 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) { 420 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the " 421 "driver failed"); 422 wpas_connection_failed(wpa_s, bss->bssid); 423 wpa_supplicant_mark_disassoc(wpa_s); 424 wpabuf_free(resp); 425 wpas_connect_work_done(wpa_s); 426 return; 427 } 428 429 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s, 430 NULL); 431 432 /* 433 * Association will be started based on the authentication event from 434 * the driver. 435 */ 436 437 wpabuf_free(resp); 438 } 439 440 441 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit) 442 { 443 struct wpa_connect_work *cwork = work->ctx; 444 struct wpa_supplicant *wpa_s = work->wpa_s; 445 446 if (deinit) { 447 wpas_connect_work_free(cwork); 448 return; 449 } 450 451 wpa_s->connect_work = work; 452 453 if (!wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid)) { 454 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt"); 455 wpas_connect_work_done(wpa_s); 456 return; 457 } 458 459 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1); 460 } 461 462 463 void sme_authenticate(struct wpa_supplicant *wpa_s, 464 struct wpa_bss *bss, struct wpa_ssid *ssid) 465 { 466 struct wpa_connect_work *cwork; 467 468 if (bss == NULL || ssid == NULL) 469 return; 470 if (wpa_s->connect_work) { 471 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist"); 472 return; 473 } 474 475 cwork = os_zalloc(sizeof(*cwork)); 476 if (cwork == NULL) 477 return; 478 cwork->bss = bss; 479 cwork->ssid = ssid; 480 cwork->sme = 1; 481 482 #ifdef CONFIG_SAE 483 wpa_s->sme.sae.state = SAE_NOTHING; 484 wpa_s->sme.sae.send_confirm = 0; 485 wpa_s->sme.sae_group_index = 0; 486 #endif /* CONFIG_SAE */ 487 488 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1, 489 sme_auth_start_cb, cwork) < 0) 490 wpas_connect_work_free(cwork); 491 } 492 493 494 #ifdef CONFIG_SAE 495 496 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction, 497 u16 status_code, const u8 *data, size_t len) 498 { 499 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u " 500 "status code %u", auth_transaction, status_code); 501 502 if (auth_transaction == 1 && 503 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ && 504 wpa_s->sme.sae.state == SAE_COMMITTED && 505 wpa_s->current_bss && wpa_s->current_ssid) { 506 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE anti-clogging token " 507 "requested"); 508 wpabuf_free(wpa_s->sme.sae_token); 509 wpa_s->sme.sae_token = wpabuf_alloc_copy(data, len); 510 sme_send_authentication(wpa_s, wpa_s->current_bss, 511 wpa_s->current_ssid, 1); 512 return 0; 513 } 514 515 if (auth_transaction == 1 && 516 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED && 517 wpa_s->sme.sae.state == SAE_COMMITTED && 518 wpa_s->current_bss && wpa_s->current_ssid) { 519 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported"); 520 wpa_s->sme.sae_group_index++; 521 if (sme_set_sae_group(wpa_s) < 0) 522 return -1; /* no other groups enabled */ 523 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group"); 524 sme_send_authentication(wpa_s, wpa_s->current_bss, 525 wpa_s->current_ssid, 1); 526 return 0; 527 } 528 529 if (status_code != WLAN_STATUS_SUCCESS) 530 return -1; 531 532 if (auth_transaction == 1) { 533 int *groups = wpa_s->conf->sae_groups; 534 535 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit"); 536 if (wpa_s->current_bss == NULL || 537 wpa_s->current_ssid == NULL) 538 return -1; 539 if (wpa_s->sme.sae.state != SAE_COMMITTED) 540 return -1; 541 if (groups && groups[0] <= 0) 542 groups = NULL; 543 if (sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL, 544 groups) != WLAN_STATUS_SUCCESS) 545 return -1; 546 547 if (sae_process_commit(&wpa_s->sme.sae) < 0) { 548 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer " 549 "commit"); 550 return -1; 551 } 552 553 wpabuf_free(wpa_s->sme.sae_token); 554 wpa_s->sme.sae_token = NULL; 555 sme_send_authentication(wpa_s, wpa_s->current_bss, 556 wpa_s->current_ssid, 0); 557 return 0; 558 } else if (auth_transaction == 2) { 559 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm"); 560 if (wpa_s->sme.sae.state != SAE_CONFIRMED) 561 return -1; 562 if (sae_check_confirm(&wpa_s->sme.sae, data, len) < 0) 563 return -1; 564 wpa_s->sme.sae.state = SAE_ACCEPTED; 565 sae_clear_temp_data(&wpa_s->sme.sae); 566 return 1; 567 } 568 569 return -1; 570 } 571 #endif /* CONFIG_SAE */ 572 573 574 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data) 575 { 576 struct wpa_ssid *ssid = wpa_s->current_ssid; 577 578 if (ssid == NULL) { 579 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event " 580 "when network is not selected"); 581 return; 582 } 583 584 if (wpa_s->wpa_state != WPA_AUTHENTICATING) { 585 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event " 586 "when not in authenticating state"); 587 return; 588 } 589 590 if (os_memcmp(wpa_s->pending_bssid, data->auth.peer, ETH_ALEN) != 0) { 591 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with " 592 "unexpected peer " MACSTR, 593 MAC2STR(data->auth.peer)); 594 return; 595 } 596 597 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR 598 " auth_type=%d auth_transaction=%d status_code=%d", 599 MAC2STR(data->auth.peer), data->auth.auth_type, 600 data->auth.auth_transaction, data->auth.status_code); 601 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs", 602 data->auth.ies, data->auth.ies_len); 603 604 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL); 605 606 #ifdef CONFIG_SAE 607 if (data->auth.auth_type == WLAN_AUTH_SAE) { 608 int res; 609 res = sme_sae_auth(wpa_s, data->auth.auth_transaction, 610 data->auth.status_code, data->auth.ies, 611 data->auth.ies_len); 612 if (res < 0) { 613 wpas_connection_failed(wpa_s, wpa_s->pending_bssid); 614 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); 615 616 } 617 if (res != 1) 618 return; 619 620 wpa_printf(MSG_DEBUG, "SME: SAE completed - setting PMK for " 621 "4-way handshake"); 622 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN); 623 } 624 #endif /* CONFIG_SAE */ 625 626 if (data->auth.status_code != WLAN_STATUS_SUCCESS) { 627 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication failed (status " 628 "code %d)", data->auth.status_code); 629 630 if (data->auth.status_code != 631 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG || 632 wpa_s->sme.auth_alg == data->auth.auth_type || 633 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) { 634 wpas_connection_failed(wpa_s, wpa_s->pending_bssid); 635 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); 636 return; 637 } 638 639 wpas_connect_work_done(wpa_s); 640 641 switch (data->auth.auth_type) { 642 case WLAN_AUTH_OPEN: 643 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED; 644 645 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth"); 646 wpa_supplicant_associate(wpa_s, wpa_s->current_bss, 647 wpa_s->current_ssid); 648 return; 649 650 case WLAN_AUTH_SHARED_KEY: 651 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP; 652 653 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth"); 654 wpa_supplicant_associate(wpa_s, wpa_s->current_bss, 655 wpa_s->current_ssid); 656 return; 657 658 default: 659 return; 660 } 661 } 662 663 #ifdef CONFIG_IEEE80211R 664 if (data->auth.auth_type == WLAN_AUTH_FT) { 665 union wpa_event_data edata; 666 os_memset(&edata, 0, sizeof(edata)); 667 edata.ft_ies.ies = data->auth.ies; 668 edata.ft_ies.ies_len = data->auth.ies_len; 669 os_memcpy(edata.ft_ies.target_ap, data->auth.peer, ETH_ALEN); 670 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &edata); 671 } 672 #endif /* CONFIG_IEEE80211R */ 673 674 sme_associate(wpa_s, ssid->mode, data->auth.peer, 675 data->auth.auth_type); 676 } 677 678 679 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode, 680 const u8 *bssid, u16 auth_type) 681 { 682 struct wpa_driver_associate_params params; 683 struct ieee802_11_elems elems; 684 #ifdef CONFIG_HT_OVERRIDES 685 struct ieee80211_ht_capabilities htcaps; 686 struct ieee80211_ht_capabilities htcaps_mask; 687 #endif /* CONFIG_HT_OVERRIDES */ 688 #ifdef CONFIG_VHT_OVERRIDES 689 struct ieee80211_vht_capabilities vhtcaps; 690 struct ieee80211_vht_capabilities vhtcaps_mask; 691 #endif /* CONFIG_VHT_OVERRIDES */ 692 693 os_memset(¶ms, 0, sizeof(params)); 694 params.bssid = bssid; 695 params.ssid = wpa_s->sme.ssid; 696 params.ssid_len = wpa_s->sme.ssid_len; 697 params.freq = wpa_s->sme.freq; 698 params.bg_scan_period = wpa_s->current_ssid ? 699 wpa_s->current_ssid->bg_scan_period : -1; 700 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ? 701 wpa_s->sme.assoc_req_ie : NULL; 702 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len; 703 params.pairwise_suite = wpa_s->pairwise_cipher; 704 params.group_suite = wpa_s->group_cipher; 705 #ifdef CONFIG_HT_OVERRIDES 706 os_memset(&htcaps, 0, sizeof(htcaps)); 707 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask)); 708 params.htcaps = (u8 *) &htcaps; 709 params.htcaps_mask = (u8 *) &htcaps_mask; 710 wpa_supplicant_apply_ht_overrides(wpa_s, wpa_s->current_ssid, ¶ms); 711 #endif /* CONFIG_HT_OVERRIDES */ 712 #ifdef CONFIG_VHT_OVERRIDES 713 os_memset(&vhtcaps, 0, sizeof(vhtcaps)); 714 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask)); 715 params.vhtcaps = &vhtcaps; 716 params.vhtcaps_mask = &vhtcaps_mask; 717 wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, ¶ms); 718 #endif /* CONFIG_VHT_OVERRIDES */ 719 #ifdef CONFIG_IEEE80211R 720 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) { 721 params.wpa_ie = wpa_s->sme.ft_ies; 722 params.wpa_ie_len = wpa_s->sme.ft_ies_len; 723 } 724 #endif /* CONFIG_IEEE80211R */ 725 params.mode = mode; 726 params.mgmt_frame_protection = wpa_s->sme.mfp; 727 if (wpa_s->sme.prev_bssid_set) 728 params.prev_bssid = wpa_s->sme.prev_bssid; 729 730 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR 731 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid), 732 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "", 733 params.freq); 734 735 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING); 736 737 if (params.wpa_ie == NULL || 738 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0) 739 < 0) { 740 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!"); 741 os_memset(&elems, 0, sizeof(elems)); 742 } 743 if (elems.rsn_ie) { 744 params.wpa_proto = WPA_PROTO_RSN; 745 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2, 746 elems.rsn_ie_len + 2); 747 } else if (elems.wpa_ie) { 748 params.wpa_proto = WPA_PROTO_WPA; 749 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2, 750 elems.wpa_ie_len + 2); 751 } else 752 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0); 753 if (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group) 754 params.p2p = 1; 755 756 if (wpa_s->parent->set_sta_uapsd) 757 params.uapsd = wpa_s->parent->sta_uapsd; 758 else 759 params.uapsd = -1; 760 761 if (wpa_drv_associate(wpa_s, ¶ms) < 0) { 762 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the " 763 "driver failed"); 764 wpas_connection_failed(wpa_s, wpa_s->pending_bssid); 765 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); 766 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN); 767 return; 768 } 769 770 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s, 771 NULL); 772 } 773 774 775 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md, 776 const u8 *ies, size_t ies_len) 777 { 778 if (md == NULL || ies == NULL) { 779 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain"); 780 os_free(wpa_s->sme.ft_ies); 781 wpa_s->sme.ft_ies = NULL; 782 wpa_s->sme.ft_ies_len = 0; 783 wpa_s->sme.ft_used = 0; 784 return 0; 785 } 786 787 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN); 788 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len); 789 os_free(wpa_s->sme.ft_ies); 790 wpa_s->sme.ft_ies = os_malloc(ies_len); 791 if (wpa_s->sme.ft_ies == NULL) 792 return -1; 793 os_memcpy(wpa_s->sme.ft_ies, ies, ies_len); 794 wpa_s->sme.ft_ies_len = ies_len; 795 return 0; 796 } 797 798 799 static void sme_deauth(struct wpa_supplicant *wpa_s) 800 { 801 int bssid_changed; 802 803 bssid_changed = !is_zero_ether_addr(wpa_s->bssid); 804 805 if (wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid, 806 WLAN_REASON_DEAUTH_LEAVING) < 0) { 807 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver " 808 "failed"); 809 } 810 wpa_s->sme.prev_bssid_set = 0; 811 812 wpas_connection_failed(wpa_s, wpa_s->pending_bssid); 813 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); 814 os_memset(wpa_s->bssid, 0, ETH_ALEN); 815 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN); 816 if (bssid_changed) 817 wpas_notify_bssid_changed(wpa_s); 818 } 819 820 821 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s, 822 union wpa_event_data *data) 823 { 824 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: " 825 "status code %d", MAC2STR(wpa_s->pending_bssid), 826 data->assoc_reject.status_code); 827 828 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL); 829 830 /* 831 * For now, unconditionally terminate the previous authentication. In 832 * theory, this should not be needed, but mac80211 gets quite confused 833 * if the authentication is left pending.. Some roaming cases might 834 * benefit from using the previous authentication, so this could be 835 * optimized in the future. 836 */ 837 sme_deauth(wpa_s); 838 } 839 840 841 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s, 842 union wpa_event_data *data) 843 { 844 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out"); 845 wpas_connection_failed(wpa_s, wpa_s->pending_bssid); 846 wpa_supplicant_mark_disassoc(wpa_s); 847 } 848 849 850 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s, 851 union wpa_event_data *data) 852 { 853 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out"); 854 wpas_connection_failed(wpa_s, wpa_s->pending_bssid); 855 wpa_supplicant_mark_disassoc(wpa_s); 856 } 857 858 859 void sme_event_disassoc(struct wpa_supplicant *wpa_s, 860 struct disassoc_info *info) 861 { 862 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received"); 863 if (wpa_s->sme.prev_bssid_set) { 864 /* 865 * cfg80211/mac80211 can get into somewhat confused state if 866 * the AP only disassociates us and leaves us in authenticated 867 * state. For now, force the state to be cleared to avoid 868 * confusing errors if we try to associate with the AP again. 869 */ 870 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear " 871 "driver state"); 872 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid, 873 WLAN_REASON_DEAUTH_LEAVING); 874 } 875 } 876 877 878 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx) 879 { 880 struct wpa_supplicant *wpa_s = eloop_ctx; 881 if (wpa_s->wpa_state == WPA_AUTHENTICATING) { 882 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout"); 883 sme_deauth(wpa_s); 884 } 885 } 886 887 888 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx) 889 { 890 struct wpa_supplicant *wpa_s = eloop_ctx; 891 if (wpa_s->wpa_state == WPA_ASSOCIATING) { 892 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout"); 893 sme_deauth(wpa_s); 894 } 895 } 896 897 898 void sme_state_changed(struct wpa_supplicant *wpa_s) 899 { 900 /* Make sure timers are cleaned up appropriately. */ 901 if (wpa_s->wpa_state != WPA_ASSOCIATING) 902 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL); 903 if (wpa_s->wpa_state != WPA_AUTHENTICATING) 904 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL); 905 } 906 907 908 void sme_disassoc_while_authenticating(struct wpa_supplicant *wpa_s, 909 const u8 *prev_pending_bssid) 910 { 911 /* 912 * mac80211-workaround to force deauth on failed auth cmd, 913 * requires us to remain in authenticating state to allow the 914 * second authentication attempt to be continued properly. 915 */ 916 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Allow pending authentication " 917 "to proceed after disconnection event"); 918 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING); 919 os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN); 920 921 /* 922 * Re-arm authentication timer in case auth fails for whatever reason. 923 */ 924 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL); 925 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s, 926 NULL); 927 } 928 929 930 void sme_deinit(struct wpa_supplicant *wpa_s) 931 { 932 os_free(wpa_s->sme.ft_ies); 933 wpa_s->sme.ft_ies = NULL; 934 wpa_s->sme.ft_ies_len = 0; 935 #ifdef CONFIG_IEEE80211W 936 sme_stop_sa_query(wpa_s); 937 #endif /* CONFIG_IEEE80211W */ 938 #ifdef CONFIG_SAE 939 wpabuf_free(wpa_s->sme.sae_token); 940 wpa_s->sme.sae_token = NULL; 941 sae_clear_data(&wpa_s->sme.sae); 942 #endif /* CONFIG_SAE */ 943 944 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL); 945 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL); 946 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL); 947 } 948 949 950 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s, 951 const u8 *chan_list, u8 num_channels, 952 u8 num_intol) 953 { 954 struct ieee80211_2040_bss_coex_ie *bc_ie; 955 struct ieee80211_2040_intol_chan_report *ic_report; 956 struct wpabuf *buf; 957 958 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR, 959 MAC2STR(wpa_s->bssid)); 960 961 buf = wpabuf_alloc(2 + /* action.category + action_code */ 962 sizeof(struct ieee80211_2040_bss_coex_ie) + 963 sizeof(struct ieee80211_2040_intol_chan_report) + 964 num_channels); 965 if (buf == NULL) 966 return; 967 968 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC); 969 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX); 970 971 bc_ie = wpabuf_put(buf, sizeof(*bc_ie)); 972 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE; 973 bc_ie->length = 1; 974 if (num_intol) 975 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ; 976 977 if (num_channels > 0) { 978 ic_report = wpabuf_put(buf, sizeof(*ic_report)); 979 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT; 980 ic_report->length = num_channels + 1; 981 ic_report->op_class = 0; 982 os_memcpy(wpabuf_put(buf, num_channels), chan_list, 983 num_channels); 984 } 985 986 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 987 wpa_s->own_addr, wpa_s->bssid, 988 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) { 989 wpa_msg(wpa_s, MSG_INFO, 990 "SME: Failed to send 20/40 BSS Coexistence frame"); 991 } 992 993 wpabuf_free(buf); 994 } 995 996 997 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s) 998 { 999 struct wpa_bss *bss; 1000 const u8 *ie; 1001 u16 ht_cap; 1002 u8 chan_list[P2P_MAX_CHANNELS], channel; 1003 u8 num_channels = 0, num_intol = 0, i; 1004 1005 if (!wpa_s->sme.sched_obss_scan) 1006 return 0; 1007 1008 wpa_s->sme.sched_obss_scan = 0; 1009 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED) 1010 return 1; 1011 1012 /* 1013 * Check whether AP uses regulatory triplet or channel triplet in 1014 * country info. Right now the operating class of the BSS channel 1015 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12), 1016 * based on the assumption that operating class triplet is not used in 1017 * beacon frame. If the First Channel Number/Operating Extension 1018 * Identifier octet has a positive integer value of 201 or greater, 1019 * then its operating class triplet. 1020 * 1021 * TODO: If Supported Operating Classes element is present in beacon 1022 * frame, have to lookup operating class in Annex E and fill them in 1023 * 2040 coex frame. 1024 */ 1025 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY); 1026 if (ie && (ie[1] >= 6) && (ie[5] >= 201)) 1027 return 1; 1028 1029 os_memset(chan_list, 0, sizeof(chan_list)); 1030 1031 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 1032 /* Skip other band bss */ 1033 enum hostapd_hw_mode mode; 1034 mode = ieee80211_freq_to_chan(bss->freq, &channel); 1035 if (mode != HOSTAPD_MODE_IEEE80211G && 1036 mode != HOSTAPD_MODE_IEEE80211B) 1037 continue; 1038 1039 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP); 1040 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0; 1041 1042 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) { 1043 /* Check whether the channel is already considered */ 1044 for (i = 0; i < num_channels; i++) { 1045 if (channel == chan_list[i]) 1046 break; 1047 } 1048 if (i != num_channels) 1049 continue; 1050 1051 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT) 1052 num_intol++; 1053 1054 chan_list[num_channels++] = channel; 1055 } 1056 } 1057 1058 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol); 1059 return 1; 1060 } 1061 1062 1063 static struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes, 1064 u16 num_modes, 1065 enum hostapd_hw_mode mode) 1066 { 1067 u16 i; 1068 1069 for (i = 0; i < num_modes; i++) { 1070 if (modes[i].mode == mode) 1071 return &modes[i]; 1072 } 1073 1074 return NULL; 1075 } 1076 1077 1078 static void wpa_setband_scan_freqs_list(struct wpa_supplicant *wpa_s, 1079 enum hostapd_hw_mode band, 1080 struct wpa_driver_scan_params *params) 1081 { 1082 /* Include only supported channels for the specified band */ 1083 struct hostapd_hw_modes *mode; 1084 int count, i; 1085 1086 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, band); 1087 if (mode == NULL) { 1088 /* No channels supported in this band - use empty list */ 1089 params->freqs = os_zalloc(sizeof(int)); 1090 return; 1091 } 1092 1093 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int)); 1094 if (params->freqs == NULL) 1095 return; 1096 for (count = 0, i = 0; i < mode->num_channels; i++) { 1097 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED) 1098 continue; 1099 params->freqs[count++] = mode->channels[i].freq; 1100 } 1101 } 1102 1103 1104 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx) 1105 { 1106 struct wpa_supplicant *wpa_s = eloop_ctx; 1107 struct wpa_driver_scan_params params; 1108 1109 if (!wpa_s->current_bss) { 1110 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request"); 1111 return; 1112 } 1113 1114 os_memset(¶ms, 0, sizeof(params)); 1115 wpa_setband_scan_freqs_list(wpa_s, HOSTAPD_MODE_IEEE80211G, ¶ms); 1116 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan"); 1117 1118 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms)) 1119 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan"); 1120 else 1121 wpa_s->sme.sched_obss_scan = 1; 1122 os_free(params.freqs); 1123 1124 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0, 1125 sme_obss_scan_timeout, wpa_s, NULL); 1126 } 1127 1128 1129 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable) 1130 { 1131 const u8 *ie; 1132 struct wpa_bss *bss = wpa_s->current_bss; 1133 struct wpa_ssid *ssid = wpa_s->current_ssid; 1134 struct hostapd_hw_modes *hw_mode = NULL; 1135 int i; 1136 1137 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL); 1138 wpa_s->sme.sched_obss_scan = 0; 1139 if (!enable) 1140 return; 1141 1142 /* 1143 * Schedule OBSS scan if driver is using station SME in wpa_supplicant 1144 * or it expects OBSS scan to be performed by wpa_supplicant. 1145 */ 1146 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) || 1147 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) || 1148 ssid == NULL || ssid->mode != IEEE80211_MODE_INFRA) 1149 return; 1150 1151 if (!wpa_s->hw.modes) 1152 return; 1153 1154 /* only HT caps in 11g mode are relevant */ 1155 for (i = 0; i < wpa_s->hw.num_modes; i++) { 1156 hw_mode = &wpa_s->hw.modes[i]; 1157 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G) 1158 break; 1159 } 1160 1161 /* Driver does not support HT40 for 11g or doesn't have 11g. */ 1162 if (i == wpa_s->hw.num_modes || !hw_mode || 1163 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) 1164 return; 1165 1166 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500) 1167 return; /* Not associated on 2.4 GHz band */ 1168 1169 /* Check whether AP supports HT40 */ 1170 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP); 1171 if (!ie || ie[1] < 2 || 1172 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) 1173 return; /* AP does not support HT40 */ 1174 1175 ie = wpa_bss_get_ie(wpa_s->current_bss, 1176 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS); 1177 if (!ie || ie[1] < 14) 1178 return; /* AP does not request OBSS scans */ 1179 1180 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6); 1181 if (wpa_s->sme.obss_scan_int < 10) { 1182 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u " 1183 "replaced with the minimum 10 sec", 1184 wpa_s->sme.obss_scan_int); 1185 wpa_s->sme.obss_scan_int = 10; 1186 } 1187 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec", 1188 wpa_s->sme.obss_scan_int); 1189 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0, 1190 sme_obss_scan_timeout, wpa_s, NULL); 1191 } 1192 1193 1194 #ifdef CONFIG_IEEE80211W 1195 1196 static const unsigned int sa_query_max_timeout = 1000; 1197 static const unsigned int sa_query_retry_timeout = 201; 1198 1199 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s) 1200 { 1201 u32 tu; 1202 struct os_reltime now, passed; 1203 os_get_reltime(&now); 1204 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed); 1205 tu = (passed.sec * 1000000 + passed.usec) / 1024; 1206 if (sa_query_max_timeout < tu) { 1207 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out"); 1208 sme_stop_sa_query(wpa_s); 1209 wpa_supplicant_deauthenticate( 1210 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID); 1211 return 1; 1212 } 1213 1214 return 0; 1215 } 1216 1217 1218 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s, 1219 const u8 *trans_id) 1220 { 1221 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN]; 1222 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to " 1223 MACSTR, MAC2STR(wpa_s->bssid)); 1224 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID", 1225 trans_id, WLAN_SA_QUERY_TR_ID_LEN); 1226 req[0] = WLAN_ACTION_SA_QUERY; 1227 req[1] = WLAN_SA_QUERY_REQUEST; 1228 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN); 1229 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 1230 wpa_s->own_addr, wpa_s->bssid, 1231 req, sizeof(req), 0) < 0) 1232 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query " 1233 "Request"); 1234 } 1235 1236 1237 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx) 1238 { 1239 struct wpa_supplicant *wpa_s = eloop_ctx; 1240 unsigned int timeout, sec, usec; 1241 u8 *trans_id, *nbuf; 1242 1243 if (wpa_s->sme.sa_query_count > 0 && 1244 sme_check_sa_query_timeout(wpa_s)) 1245 return; 1246 1247 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id, 1248 wpa_s->sme.sa_query_count + 1, 1249 WLAN_SA_QUERY_TR_ID_LEN); 1250 if (nbuf == NULL) 1251 return; 1252 if (wpa_s->sme.sa_query_count == 0) { 1253 /* Starting a new SA Query procedure */ 1254 os_get_reltime(&wpa_s->sme.sa_query_start); 1255 } 1256 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN; 1257 wpa_s->sme.sa_query_trans_id = nbuf; 1258 wpa_s->sme.sa_query_count++; 1259 1260 os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN); 1261 1262 timeout = sa_query_retry_timeout; 1263 sec = ((timeout / 1000) * 1024) / 1000; 1264 usec = (timeout % 1000) * 1024; 1265 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL); 1266 1267 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d", 1268 wpa_s->sme.sa_query_count); 1269 1270 sme_send_sa_query_req(wpa_s, trans_id); 1271 } 1272 1273 1274 static void sme_start_sa_query(struct wpa_supplicant *wpa_s) 1275 { 1276 sme_sa_query_timer(wpa_s, NULL); 1277 } 1278 1279 1280 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s) 1281 { 1282 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL); 1283 os_free(wpa_s->sme.sa_query_trans_id); 1284 wpa_s->sme.sa_query_trans_id = NULL; 1285 wpa_s->sme.sa_query_count = 0; 1286 } 1287 1288 1289 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa, 1290 const u8 *da, u16 reason_code) 1291 { 1292 struct wpa_ssid *ssid; 1293 1294 if (wpa_s->wpa_state != WPA_COMPLETED) 1295 return; 1296 ssid = wpa_s->current_ssid; 1297 if (ssid == NULL || 1298 (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ? 1299 wpa_s->conf->pmf : ssid->ieee80211w) == NO_MGMT_FRAME_PROTECTION) 1300 return; 1301 if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) 1302 return; 1303 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA && 1304 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA) 1305 return; 1306 if (wpa_s->sme.sa_query_count > 0) 1307 return; 1308 1309 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - " 1310 "possible AP/STA state mismatch - trigger SA Query"); 1311 sme_start_sa_query(wpa_s); 1312 } 1313 1314 1315 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *sa, 1316 const u8 *data, size_t len) 1317 { 1318 int i; 1319 1320 if (wpa_s->sme.sa_query_trans_id == NULL || 1321 len < 1 + WLAN_SA_QUERY_TR_ID_LEN || 1322 data[0] != WLAN_SA_QUERY_RESPONSE) 1323 return; 1324 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from " 1325 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]); 1326 1327 if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) 1328 return; 1329 1330 for (i = 0; i < wpa_s->sme.sa_query_count; i++) { 1331 if (os_memcmp(wpa_s->sme.sa_query_trans_id + 1332 i * WLAN_SA_QUERY_TR_ID_LEN, 1333 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0) 1334 break; 1335 } 1336 1337 if (i >= wpa_s->sme.sa_query_count) { 1338 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query " 1339 "transaction identifier found"); 1340 return; 1341 } 1342 1343 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received " 1344 "from " MACSTR, MAC2STR(sa)); 1345 sme_stop_sa_query(wpa_s); 1346 } 1347 1348 #endif /* CONFIG_IEEE80211W */ 1349