1 /* 2 * wpa_supplicant - WNM 3 * Copyright (c) 2011-2013, Qualcomm Atheros, Inc. 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "common/ieee802_11_defs.h" 13 #include "common/wpa_ctrl.h" 14 #include "rsn_supp/wpa.h" 15 #include "wpa_supplicant_i.h" 16 #include "driver_i.h" 17 #include "scan.h" 18 #include "ctrl_iface.h" 19 #include "bss.h" 20 #include "wnm_sta.h" 21 22 #define MAX_TFS_IE_LEN 1024 23 #define WNM_MAX_NEIGHBOR_REPORT 10 24 25 26 /* get the TFS IE from driver */ 27 static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf, 28 u16 *buf_len, enum wnm_oper oper) 29 { 30 wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper); 31 32 return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len); 33 } 34 35 36 /* set the TFS IE to driver */ 37 static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s, 38 const u8 *addr, u8 *buf, u16 *buf_len, 39 enum wnm_oper oper) 40 { 41 wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper); 42 43 return wpa_drv_wnm_oper(wpa_s, oper, addr, buf, buf_len); 44 } 45 46 47 /* MLME-SLEEPMODE.request */ 48 int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s, 49 u8 action, u16 intval, struct wpabuf *tfs_req) 50 { 51 struct ieee80211_mgmt *mgmt; 52 int res; 53 size_t len; 54 struct wnm_sleep_element *wnmsleep_ie; 55 u8 *wnmtfs_ie; 56 u8 wnmsleep_ie_len; 57 u16 wnmtfs_ie_len; /* possibly multiple IE(s) */ 58 enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD : 59 WNM_SLEEP_TFS_REQ_IE_NONE; 60 61 wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request " 62 "action=%s to " MACSTR, 63 action == 0 ? "enter" : "exit", 64 MAC2STR(wpa_s->bssid)); 65 66 /* WNM-Sleep Mode IE */ 67 wnmsleep_ie_len = sizeof(struct wnm_sleep_element); 68 wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element)); 69 if (wnmsleep_ie == NULL) 70 return -1; 71 wnmsleep_ie->eid = WLAN_EID_WNMSLEEP; 72 wnmsleep_ie->len = wnmsleep_ie_len - 2; 73 wnmsleep_ie->action_type = action; 74 wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT; 75 wnmsleep_ie->intval = host_to_le16(intval); 76 wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element", 77 (u8 *) wnmsleep_ie, wnmsleep_ie_len); 78 79 /* TFS IE(s) */ 80 if (tfs_req) { 81 wnmtfs_ie_len = wpabuf_len(tfs_req); 82 wnmtfs_ie = os_malloc(wnmtfs_ie_len); 83 if (wnmtfs_ie == NULL) { 84 os_free(wnmsleep_ie); 85 return -1; 86 } 87 os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len); 88 } else { 89 wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN); 90 if (wnmtfs_ie == NULL) { 91 os_free(wnmsleep_ie); 92 return -1; 93 } 94 if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len, 95 tfs_oper)) { 96 wnmtfs_ie_len = 0; 97 os_free(wnmtfs_ie); 98 wnmtfs_ie = NULL; 99 } 100 } 101 wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element", 102 (u8 *) wnmtfs_ie, wnmtfs_ie_len); 103 104 mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len); 105 if (mgmt == NULL) { 106 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for " 107 "WNM-Sleep Request action frame"); 108 os_free(wnmsleep_ie); 109 os_free(wnmtfs_ie); 110 return -1; 111 } 112 113 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN); 114 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN); 115 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN); 116 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 117 WLAN_FC_STYPE_ACTION); 118 mgmt->u.action.category = WLAN_ACTION_WNM; 119 mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ; 120 mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1; 121 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie, 122 wnmsleep_ie_len); 123 /* copy TFS IE here */ 124 if (wnmtfs_ie_len > 0) { 125 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable + 126 wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len); 127 } 128 129 len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len + 130 wnmtfs_ie_len; 131 132 res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 133 wpa_s->own_addr, wpa_s->bssid, 134 &mgmt->u.action.category, len, 0); 135 if (res < 0) 136 wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request " 137 "(action=%d, intval=%d)", action, intval); 138 139 os_free(wnmsleep_ie); 140 os_free(wnmtfs_ie); 141 os_free(mgmt); 142 143 return res; 144 } 145 146 147 static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s, 148 u8 *tfsresp_ie_start, 149 u8 *tfsresp_ie_end) 150 { 151 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM, 152 wpa_s->bssid, NULL, NULL); 153 /* remove GTK/IGTK ?? */ 154 155 /* set the TFS Resp IE(s) */ 156 if (tfsresp_ie_start && tfsresp_ie_end && 157 tfsresp_ie_end - tfsresp_ie_start >= 0) { 158 u16 tfsresp_ie_len; 159 tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) - 160 tfsresp_ie_start; 161 wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found"); 162 /* pass the TFS Resp IE(s) to driver for processing */ 163 if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid, 164 tfsresp_ie_start, 165 &tfsresp_ie_len, 166 WNM_SLEEP_TFS_RESP_IE_SET)) 167 wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE"); 168 } 169 } 170 171 172 static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s, 173 const u8 *frm, u16 key_len_total) 174 { 175 u8 *ptr, *end; 176 u8 gtk_len; 177 178 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM, wpa_s->bssid, 179 NULL, NULL); 180 181 /* Install GTK/IGTK */ 182 183 /* point to key data field */ 184 ptr = (u8 *) frm + 1 + 2; 185 end = ptr + key_len_total; 186 wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total); 187 188 while (ptr + 1 < end) { 189 if (ptr + 2 + ptr[1] > end) { 190 wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element " 191 "length"); 192 if (end > ptr) { 193 wpa_hexdump(MSG_DEBUG, "WNM: Remaining data", 194 ptr, end - ptr); 195 } 196 break; 197 } 198 if (*ptr == WNM_SLEEP_SUBELEM_GTK) { 199 if (ptr[1] < 11 + 5) { 200 wpa_printf(MSG_DEBUG, "WNM: Too short GTK " 201 "subelem"); 202 break; 203 } 204 gtk_len = *(ptr + 4); 205 if (ptr[1] < 11 + gtk_len || 206 gtk_len < 5 || gtk_len > 32) { 207 wpa_printf(MSG_DEBUG, "WNM: Invalid GTK " 208 "subelem"); 209 break; 210 } 211 wpa_wnmsleep_install_key( 212 wpa_s->wpa, 213 WNM_SLEEP_SUBELEM_GTK, 214 ptr); 215 ptr += 13 + gtk_len; 216 #ifdef CONFIG_IEEE80211W 217 } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) { 218 if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) { 219 wpa_printf(MSG_DEBUG, "WNM: Too short IGTK " 220 "subelem"); 221 break; 222 } 223 wpa_wnmsleep_install_key(wpa_s->wpa, 224 WNM_SLEEP_SUBELEM_IGTK, ptr); 225 ptr += 10 + WPA_IGTK_LEN; 226 #endif /* CONFIG_IEEE80211W */ 227 } else 228 break; /* skip the loop */ 229 } 230 } 231 232 233 static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, 234 const u8 *frm, int len) 235 { 236 /* 237 * Action [1] | Diaglog Token [1] | Key Data Len [2] | Key Data | 238 * WNM-Sleep Mode IE | TFS Response IE 239 */ 240 u8 *pos = (u8 *) frm; /* point to payload after the action field */ 241 u16 key_len_total = le_to_host16(*((u16 *)(frm+2))); 242 struct wnm_sleep_element *wnmsleep_ie = NULL; 243 /* multiple TFS Resp IE (assuming consecutive) */ 244 u8 *tfsresp_ie_start = NULL; 245 u8 *tfsresp_ie_end = NULL; 246 247 wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d", 248 frm[0], key_len_total); 249 pos += 3 + key_len_total; 250 if (pos > frm + len) { 251 wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field"); 252 return; 253 } 254 while (pos - frm < len) { 255 u8 ie_len = *(pos + 1); 256 if (pos + 2 + ie_len > frm + len) { 257 wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len); 258 break; 259 } 260 wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len); 261 if (*pos == WLAN_EID_WNMSLEEP) 262 wnmsleep_ie = (struct wnm_sleep_element *) pos; 263 else if (*pos == WLAN_EID_TFS_RESP) { 264 if (!tfsresp_ie_start) 265 tfsresp_ie_start = pos; 266 tfsresp_ie_end = pos; 267 } else 268 wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos); 269 pos += ie_len + 2; 270 } 271 272 if (!wnmsleep_ie) { 273 wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found"); 274 return; 275 } 276 277 if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || 278 wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { 279 wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " 280 "frame (action=%d, intval=%d)", 281 wnmsleep_ie->action_type, wnmsleep_ie->intval); 282 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) { 283 wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start, 284 tfsresp_ie_end); 285 } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) { 286 wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total); 287 } 288 } else { 289 wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame " 290 "(action=%d, intval=%d)", 291 wnmsleep_ie->action_type, wnmsleep_ie->intval); 292 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) 293 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL, 294 wpa_s->bssid, NULL, NULL); 295 else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) 296 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL, 297 wpa_s->bssid, NULL, NULL); 298 } 299 } 300 301 302 void wnm_deallocate_memory(struct wpa_supplicant *wpa_s) 303 { 304 int i; 305 306 for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) { 307 os_free(wpa_s->wnm_neighbor_report_elements[i].tsf_info); 308 os_free(wpa_s->wnm_neighbor_report_elements[i].con_coun_str); 309 os_free(wpa_s->wnm_neighbor_report_elements[i].bss_tran_can); 310 os_free(wpa_s->wnm_neighbor_report_elements[i].bss_term_dur); 311 os_free(wpa_s->wnm_neighbor_report_elements[i].bearing); 312 os_free(wpa_s->wnm_neighbor_report_elements[i].meas_pilot); 313 os_free(wpa_s->wnm_neighbor_report_elements[i].rrm_cap); 314 os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid); 315 } 316 317 os_free(wpa_s->wnm_neighbor_report_elements); 318 wpa_s->wnm_neighbor_report_elements = NULL; 319 } 320 321 322 static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, 323 u8 id, u8 elen, const u8 *pos) 324 { 325 switch (id) { 326 case WNM_NEIGHBOR_TSF: 327 if (elen < 2 + 2) { 328 wpa_printf(MSG_DEBUG, "WNM: Too short TSF"); 329 break; 330 } 331 rep->tsf_info = os_zalloc(sizeof(struct tsf_info)); 332 if (rep->tsf_info == NULL) 333 break; 334 rep->tsf_info->present = 1; 335 os_memcpy(rep->tsf_info->tsf_offset, pos, 2); 336 os_memcpy(rep->tsf_info->beacon_interval, pos + 2, 2); 337 break; 338 case WNM_NEIGHBOR_CONDENSED_COUNTRY_STRING: 339 if (elen < 2) { 340 wpa_printf(MSG_DEBUG, "WNM: Too short condensed " 341 "country string"); 342 break; 343 } 344 rep->con_coun_str = 345 os_zalloc(sizeof(struct condensed_country_string)); 346 if (rep->con_coun_str == NULL) 347 break; 348 rep->con_coun_str->present = 1; 349 os_memcpy(rep->con_coun_str->country_string, pos, 2); 350 break; 351 case WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE: 352 if (elen < 1) { 353 wpa_printf(MSG_DEBUG, "WNM: Too short BSS transition " 354 "candidate"); 355 break; 356 } 357 rep->bss_tran_can = 358 os_zalloc(sizeof(struct bss_transition_candidate)); 359 if (rep->bss_tran_can == NULL) 360 break; 361 rep->bss_tran_can->present = 1; 362 rep->bss_tran_can->preference = pos[0]; 363 break; 364 case WNM_NEIGHBOR_BSS_TERMINATION_DURATION: 365 if (elen < 12) { 366 wpa_printf(MSG_DEBUG, "WNM: Too short BSS termination " 367 "duration"); 368 break; 369 } 370 rep->bss_term_dur = 371 os_zalloc(sizeof(struct bss_termination_duration)); 372 if (rep->bss_term_dur == NULL) 373 break; 374 rep->bss_term_dur->present = 1; 375 os_memcpy(rep->bss_term_dur->duration, pos, 12); 376 break; 377 case WNM_NEIGHBOR_BEARING: 378 if (elen < 8) { 379 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor " 380 "bearing"); 381 break; 382 } 383 rep->bearing = os_zalloc(sizeof(struct bearing)); 384 if (rep->bearing == NULL) 385 break; 386 rep->bearing->present = 1; 387 os_memcpy(rep->bearing->bearing, pos, 8); 388 break; 389 case WNM_NEIGHBOR_MEASUREMENT_PILOT: 390 if (elen < 2) { 391 wpa_printf(MSG_DEBUG, "WNM: Too short measurement " 392 "pilot"); 393 break; 394 } 395 rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot)); 396 if (rep->meas_pilot == NULL) 397 break; 398 rep->meas_pilot->present = 1; 399 rep->meas_pilot->measurement_pilot = pos[0]; 400 rep->meas_pilot->num_vendor_specific = pos[1]; 401 os_memcpy(rep->meas_pilot->vendor_specific, pos + 2, elen - 2); 402 break; 403 case WNM_NEIGHBOR_RRM_ENABLED_CAPABILITIES: 404 if (elen < 4) { 405 wpa_printf(MSG_DEBUG, "WNM: Too short RRM enabled " 406 "capabilities"); 407 break; 408 } 409 rep->rrm_cap = 410 os_zalloc(sizeof(struct rrm_enabled_capabilities)); 411 if (rep->rrm_cap == NULL) 412 break; 413 rep->rrm_cap->present = 1; 414 os_memcpy(rep->rrm_cap->capabilities, pos, 4); 415 break; 416 case WNM_NEIGHBOR_MULTIPLE_BSSID: 417 if (elen < 2) { 418 wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID"); 419 break; 420 } 421 rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid)); 422 if (rep->mul_bssid == NULL) 423 break; 424 rep->mul_bssid->present = 1; 425 rep->mul_bssid->max_bssid_indicator = pos[0]; 426 rep->mul_bssid->num_vendor_specific = pos[1]; 427 os_memcpy(rep->mul_bssid->vendor_specific, pos + 2, elen - 2); 428 break; 429 } 430 } 431 432 433 static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s, 434 const u8 *pos, u8 len, 435 struct neighbor_report *rep) 436 { 437 u8 left = len; 438 439 if (left < 13) { 440 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor report"); 441 return; 442 } 443 444 os_memcpy(rep->bssid, pos, ETH_ALEN); 445 os_memcpy(rep->bssid_information, pos + ETH_ALEN, 4); 446 rep->regulatory_class = *(pos + 10); 447 rep->channel_number = *(pos + 11); 448 rep->phy_type = *(pos + 12); 449 450 pos += 13; 451 left -= 13; 452 453 while (left >= 2) { 454 u8 id, elen; 455 456 id = *pos++; 457 elen = *pos++; 458 wnm_parse_neighbor_report_elem(rep, id, elen, pos); 459 left -= 2 + elen; 460 pos += elen; 461 } 462 } 463 464 465 static int compare_scan_neighbor_results(struct wpa_supplicant *wpa_s, 466 struct wpa_scan_results *scan_res, 467 struct neighbor_report *neigh_rep, 468 u8 num_neigh_rep, u8 *bssid_to_connect) 469 { 470 471 u8 i, j; 472 473 if (scan_res == NULL || num_neigh_rep == 0) 474 return 0; 475 476 wpa_printf(MSG_DEBUG, "WNM: Current BSS " MACSTR " RSSI %d", 477 MAC2STR(wpa_s->bssid), 478 wpa_s->current_bss ? wpa_s->current_bss->level : 0); 479 480 for (i = 0; i < num_neigh_rep; i++) { 481 for (j = 0; j < scan_res->num; j++) { 482 /* Check for a better RSSI AP */ 483 if (os_memcmp(scan_res->res[j]->bssid, 484 neigh_rep[i].bssid, ETH_ALEN) == 0 && 485 scan_res->res[j]->level > 486 wpa_s->current_bss->level) { 487 /* Got a BSSID with better RSSI value */ 488 os_memcpy(bssid_to_connect, neigh_rep[i].bssid, 489 ETH_ALEN); 490 wpa_printf(MSG_DEBUG, "Found a BSS " MACSTR 491 " with better scan RSSI %d", 492 MAC2STR(scan_res->res[j]->bssid), 493 scan_res->res[j]->level); 494 return 1; 495 } 496 wpa_printf(MSG_DEBUG, "scan_res[%d] " MACSTR 497 " RSSI %d", j, 498 MAC2STR(scan_res->res[j]->bssid), 499 scan_res->res[j]->level); 500 } 501 } 502 503 return 0; 504 } 505 506 507 static void wnm_send_bss_transition_mgmt_resp( 508 struct wpa_supplicant *wpa_s, u8 dialog_token, 509 enum bss_trans_mgmt_status_code status, u8 delay, 510 const u8 *target_bssid) 511 { 512 u8 buf[1000], *pos; 513 struct ieee80211_mgmt *mgmt; 514 size_t len; 515 516 wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Response " 517 "to " MACSTR " dialog_token=%u status=%u delay=%d", 518 MAC2STR(wpa_s->bssid), dialog_token, status, delay); 519 520 mgmt = (struct ieee80211_mgmt *) buf; 521 os_memset(&buf, 0, sizeof(buf)); 522 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN); 523 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN); 524 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN); 525 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 526 WLAN_FC_STYPE_ACTION); 527 mgmt->u.action.category = WLAN_ACTION_WNM; 528 mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP; 529 mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token; 530 mgmt->u.action.u.bss_tm_resp.status_code = status; 531 mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay; 532 pos = mgmt->u.action.u.bss_tm_resp.variable; 533 if (target_bssid) { 534 os_memcpy(pos, target_bssid, ETH_ALEN); 535 pos += ETH_ALEN; 536 } else if (status == WNM_BSS_TM_ACCEPT) { 537 /* 538 * P802.11-REVmc clarifies that the Target BSSID field is always 539 * present when status code is zero, so use a fake value here if 540 * no BSSID is yet known. 541 */ 542 os_memset(pos, 0, ETH_ALEN); 543 pos += ETH_ALEN; 544 } 545 546 len = pos - (u8 *) &mgmt->u.action.category; 547 548 wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 549 wpa_s->own_addr, wpa_s->bssid, 550 &mgmt->u.action.category, len, 0); 551 } 552 553 554 void wnm_scan_response(struct wpa_supplicant *wpa_s, 555 struct wpa_scan_results *scan_res) 556 { 557 u8 bssid[ETH_ALEN]; 558 559 if (scan_res == NULL) { 560 wpa_printf(MSG_ERROR, "Scan result is NULL"); 561 goto send_bss_resp_fail; 562 } 563 564 /* Compare the Neighbor Report and scan results */ 565 if (compare_scan_neighbor_results(wpa_s, scan_res, 566 wpa_s->wnm_neighbor_report_elements, 567 wpa_s->wnm_num_neighbor_report, 568 bssid) == 1) { 569 /* Associate to the network */ 570 struct wpa_bss *bss; 571 struct wpa_ssid *ssid = wpa_s->current_ssid; 572 573 bss = wpa_bss_get_bssid(wpa_s, bssid); 574 if (!bss) { 575 wpa_printf(MSG_DEBUG, "WNM: Target AP not found from " 576 "BSS table"); 577 goto send_bss_resp_fail; 578 } 579 580 /* Send the BSS Management Response - Accept */ 581 if (wpa_s->wnm_reply) { 582 wnm_send_bss_transition_mgmt_resp(wpa_s, 583 wpa_s->wnm_dialog_token, 584 WNM_BSS_TM_ACCEPT, 585 0, bssid); 586 } 587 588 wpa_s->reassociate = 1; 589 wpa_supplicant_connect(wpa_s, bss, ssid); 590 wnm_deallocate_memory(wpa_s); 591 return; 592 } 593 594 /* Send reject response for all the failures */ 595 send_bss_resp_fail: 596 wnm_deallocate_memory(wpa_s); 597 if (wpa_s->wnm_reply) { 598 wnm_send_bss_transition_mgmt_resp(wpa_s, 599 wpa_s->wnm_dialog_token, 600 WNM_BSS_TM_REJECT_UNSPECIFIED, 601 0, NULL); 602 } 603 return; 604 } 605 606 607 static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s, 608 const u8 *pos, const u8 *end, 609 int reply) 610 { 611 if (pos + 5 > end) 612 return; 613 614 wpa_s->wnm_dialog_token = pos[0]; 615 wpa_s->wnm_mode = pos[1]; 616 wpa_s->wnm_dissoc_timer = WPA_GET_LE16(pos + 2); 617 wpa_s->wnm_validity_interval = pos[4]; 618 wpa_s->wnm_reply = reply; 619 620 wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: " 621 "dialog_token=%u request_mode=0x%x " 622 "disassoc_timer=%u validity_interval=%u", 623 wpa_s->wnm_dialog_token, wpa_s->wnm_mode, 624 wpa_s->wnm_dissoc_timer, wpa_s->wnm_validity_interval); 625 626 pos += 5; 627 628 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) { 629 if (pos + 12 > end) { 630 wpa_printf(MSG_DEBUG, "WNM: Too short BSS TM Request"); 631 return; 632 } 633 os_memcpy(wpa_s->wnm_bss_termination_duration, pos, 12); 634 pos += 12; /* BSS Termination Duration */ 635 } 636 637 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) { 638 char url[256]; 639 unsigned int beacon_int; 640 641 if (pos + 1 > end || pos + 1 + pos[0] > end) { 642 wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition " 643 "Management Request (URL)"); 644 return; 645 } 646 os_memcpy(url, pos + 1, pos[0]); 647 url[pos[0]] = '\0'; 648 pos += 1 + pos[0]; 649 650 if (wpa_s->current_bss) 651 beacon_int = wpa_s->current_bss->beacon_int; 652 else 653 beacon_int = 100; /* best guess */ 654 655 wpa_msg(wpa_s, MSG_INFO, ESS_DISASSOC_IMMINENT "%d %u %s", 656 wpa_sm_pmf_enabled(wpa_s->wpa), 657 wpa_s->wnm_dissoc_timer * beacon_int * 128 / 125, url); 658 } 659 660 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) { 661 wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - " 662 "Disassociation Timer %u", wpa_s->wnm_dissoc_timer); 663 if (wpa_s->wnm_dissoc_timer && !wpa_s->scanning) { 664 /* TODO: mark current BSS less preferred for 665 * selection */ 666 wpa_printf(MSG_DEBUG, "Trying to find another BSS"); 667 wpa_supplicant_req_scan(wpa_s, 0, 0); 668 } 669 } 670 671 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED) { 672 wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available"); 673 wpa_s->wnm_num_neighbor_report = 0; 674 os_free(wpa_s->wnm_neighbor_report_elements); 675 wpa_s->wnm_neighbor_report_elements = os_zalloc( 676 WNM_MAX_NEIGHBOR_REPORT * 677 sizeof(struct neighbor_report)); 678 if (wpa_s->wnm_neighbor_report_elements == NULL) 679 return; 680 681 while (pos + 2 <= end && 682 wpa_s->wnm_num_neighbor_report < WNM_MAX_NEIGHBOR_REPORT) 683 { 684 u8 tag = *pos++; 685 u8 len = *pos++; 686 687 wpa_printf(MSG_DEBUG, "WNM: Neighbor report tag %u", 688 tag); 689 if (pos + len > end) { 690 wpa_printf(MSG_DEBUG, "WNM: Truncated request"); 691 return; 692 } 693 wnm_parse_neighbor_report( 694 wpa_s, pos, len, 695 &wpa_s->wnm_neighbor_report_elements[ 696 wpa_s->wnm_num_neighbor_report]); 697 698 pos += len; 699 wpa_s->wnm_num_neighbor_report++; 700 } 701 702 wpa_s->scan_res_handler = wnm_scan_response; 703 wpa_supplicant_req_scan(wpa_s, 0, 0); 704 } else if (reply) { 705 enum bss_trans_mgmt_status_code status; 706 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) 707 status = WNM_BSS_TM_ACCEPT; 708 else { 709 wpa_msg(wpa_s, MSG_INFO, "WNM: BSS Transition Management Request did not include candidates"); 710 status = WNM_BSS_TM_REJECT_UNSPECIFIED; 711 } 712 wnm_send_bss_transition_mgmt_resp(wpa_s, 713 wpa_s->wnm_dialog_token, 714 status, 0, NULL); 715 } 716 } 717 718 719 int wnm_send_bss_transition_mgmt_query(struct wpa_supplicant *wpa_s, 720 u8 query_reason) 721 { 722 u8 buf[1000], *pos; 723 struct ieee80211_mgmt *mgmt; 724 size_t len; 725 int ret; 726 727 wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Query to " 728 MACSTR " query_reason=%u", 729 MAC2STR(wpa_s->bssid), query_reason); 730 731 mgmt = (struct ieee80211_mgmt *) buf; 732 os_memset(&buf, 0, sizeof(buf)); 733 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN); 734 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN); 735 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN); 736 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 737 WLAN_FC_STYPE_ACTION); 738 mgmt->u.action.category = WLAN_ACTION_WNM; 739 mgmt->u.action.u.bss_tm_query.action = WNM_BSS_TRANS_MGMT_QUERY; 740 mgmt->u.action.u.bss_tm_query.dialog_token = 1; 741 mgmt->u.action.u.bss_tm_query.query_reason = query_reason; 742 pos = mgmt->u.action.u.bss_tm_query.variable; 743 744 len = pos - (u8 *) &mgmt->u.action.category; 745 746 ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 747 wpa_s->own_addr, wpa_s->bssid, 748 &mgmt->u.action.category, len, 0); 749 750 return ret; 751 } 752 753 754 void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s, 755 const struct ieee80211_mgmt *mgmt, size_t len) 756 { 757 const u8 *pos, *end; 758 u8 act; 759 760 if (len < IEEE80211_HDRLEN + 2) 761 return; 762 763 pos = &mgmt->u.action.category; 764 pos++; 765 act = *pos++; 766 end = ((const u8 *) mgmt) + len; 767 768 wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR, 769 act, MAC2STR(mgmt->sa)); 770 if (wpa_s->wpa_state < WPA_ASSOCIATED || 771 os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) { 772 wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action " 773 "frame"); 774 return; 775 } 776 777 switch (act) { 778 case WNM_BSS_TRANS_MGMT_REQ: 779 ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end, 780 !(mgmt->da[0] & 0x01)); 781 break; 782 case WNM_SLEEP_MODE_RESP: 783 ieee802_11_rx_wnmsleep_resp(wpa_s, pos, end - pos); 784 break; 785 default: 786 wpa_printf(MSG_ERROR, "WNM: Unknown request"); 787 break; 788 } 789 } 790