blob: 80cb6bbd7dfa06b7b301b0dbb3f4c50694ee8c46 [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * wpa_supplicant - SME
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08003 * Copyright (c) 2009-2014, Jouni Malinen <j@w1.fi>
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07004 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08005 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07007 */
8
9#include "includes.h"
10
11#include "common.h"
12#include "utils/eloop.h"
13#include "common/ieee802_11_defs.h"
14#include "common/ieee802_11_common.h"
Hai Shalom74f70d42019-02-11 14:42:39 -080015#include "common/ocv.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070016#include "eapol_supp/eapol_supp_sm.h"
17#include "common/wpa_common.h"
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080018#include "common/sae.h"
Hai Shalom021b0b52019-04-10 11:17:58 -070019#include "common/dpp.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070020#include "rsn_supp/wpa.h"
21#include "rsn_supp/pmksa_cache.h"
22#include "config.h"
23#include "wpa_supplicant_i.h"
24#include "driver_i.h"
25#include "wpas_glue.h"
26#include "wps_supplicant.h"
27#include "p2p_supplicant.h"
28#include "notify.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070029#include "bss.h"
30#include "scan.h"
31#include "sme.h"
Dmitry Shmidt04949592012-07-19 12:16:46 -070032#include "hs20_supplicant.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070033
34#define SME_AUTH_TIMEOUT 5
35#define SME_ASSOC_TIMEOUT 5
36
37static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
38static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
Dmitry Shmidt04949592012-07-19 12:16:46 -070039static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070040static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070041
42
Dmitry Shmidtd5e49232012-12-03 15:08:10 -080043#ifdef CONFIG_SAE
44
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080045static int index_within_array(const int *array, int idx)
46{
47 int i;
48 for (i = 0; i < idx; i++) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -080049 if (array[i] <= 0)
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080050 return 0;
51 }
52 return 1;
53}
54
55
56static int sme_set_sae_group(struct wpa_supplicant *wpa_s)
57{
58 int *groups = wpa_s->conf->sae_groups;
Hai Shalom021b0b52019-04-10 11:17:58 -070059 int default_groups[] = { 19, 20, 21, 0 };
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080060
Dmitry Shmidtcce06662013-11-04 18:44:24 -080061 if (!groups || groups[0] <= 0)
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080062 groups = default_groups;
63
64 /* Configuration may have changed, so validate current index */
65 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
66 return -1;
67
68 for (;;) {
69 int group = groups[wpa_s->sme.sae_group_index];
Dmitry Shmidt41712582015-06-29 11:02:15 -070070 if (group <= 0)
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080071 break;
72 if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
73 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
74 wpa_s->sme.sae.group);
Hai Shalom74f70d42019-02-11 14:42:39 -080075 return 0;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080076 }
77 wpa_s->sme.sae_group_index++;
78 }
79
80 return -1;
81}
82
83
84static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
85 struct wpa_ssid *ssid,
Hai Shalom021b0b52019-04-10 11:17:58 -070086 const u8 *bssid, int external,
Hai Shalom899fcc72020-10-19 14:38:18 -070087 int reuse, int *ret_use_pt,
88 bool *ret_use_pk)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -080089{
90 struct wpabuf *buf;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -080091 size_t len;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -070092 const char *password;
Hai Shalomc3565922019-10-28 11:58:20 -070093 struct wpa_bss *bss;
94 int use_pt = 0;
Hai Shalom899fcc72020-10-19 14:38:18 -070095 bool use_pk = false;
96 u8 rsnxe_capa = 0;
Hai Shalomc3565922019-10-28 11:58:20 -070097
98 if (ret_use_pt)
99 *ret_use_pt = 0;
Hai Shalom899fcc72020-10-19 14:38:18 -0700100 if (ret_use_pk)
101 *ret_use_pk = false;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800102
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700103#ifdef CONFIG_TESTING_OPTIONS
104 if (wpa_s->sae_commit_override) {
105 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
106 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
107 if (!buf)
108 return NULL;
Hai Shalom021b0b52019-04-10 11:17:58 -0700109 if (!external) {
110 wpabuf_put_le16(buf, 1); /* Transaction seq# */
111 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
112 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700113 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
114 return buf;
115 }
116#endif /* CONFIG_TESTING_OPTIONS */
117
118 password = ssid->sae_password;
119 if (!password)
120 password = ssid->passphrase;
121 if (!password) {
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800122 wpa_printf(MSG_DEBUG, "SAE: No password available");
123 return NULL;
124 }
125
Hai Shalom021b0b52019-04-10 11:17:58 -0700126 if (reuse && wpa_s->sme.sae.tmp &&
127 os_memcmp(bssid, wpa_s->sme.sae.tmp->bssid, ETH_ALEN) == 0) {
128 wpa_printf(MSG_DEBUG,
129 "SAE: Reuse previously generated PWE on a retry with the same AP");
Hai Shalom899fcc72020-10-19 14:38:18 -0700130 use_pt = wpa_s->sme.sae.h2e;
131 use_pk = wpa_s->sme.sae.pk;
Hai Shalom021b0b52019-04-10 11:17:58 -0700132 goto reuse_data;
133 }
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800134 if (sme_set_sae_group(wpa_s) < 0) {
135 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
136 return NULL;
137 }
138
Hai Shalom899fcc72020-10-19 14:38:18 -0700139 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
Hai Shaloma20dcd72022-02-04 13:43:00 -0800140 if (!bss) {
141 wpa_printf(MSG_DEBUG,
142 "SAE: BSS not available, update scan result to get BSS");
143 wpa_supplicant_update_scan_results(wpa_s);
144 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
145 }
Hai Shalom899fcc72020-10-19 14:38:18 -0700146 if (bss) {
147 const u8 *rsnxe;
148
149 rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
150 if (rsnxe && rsnxe[1] >= 1)
151 rsnxe_capa = rsnxe[2];
152 }
153
Hai Shalomfdcde762020-04-02 11:19:20 -0700154 if (ssid->sae_password_id && wpa_s->conf->sae_pwe != 3)
155 use_pt = 1;
Hai Shalom899fcc72020-10-19 14:38:18 -0700156#ifdef CONFIG_SAE_PK
157 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
158 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
159 ((ssid->sae_password &&
160 sae_pk_valid_password(ssid->sae_password)) ||
161 (!ssid->sae_password && ssid->passphrase &&
162 sae_pk_valid_password(ssid->passphrase)))) {
163 use_pt = 1;
164 use_pk = true;
165 }
166
167 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
168 wpa_printf(MSG_DEBUG,
169 "SAE: Cannot use PK with the selected AP");
170 return NULL;
171 }
172#endif /* CONFIG_SAE_PK */
Hai Shalomfdcde762020-04-02 11:19:20 -0700173
174 if (use_pt || wpa_s->conf->sae_pwe == 1 || wpa_s->conf->sae_pwe == 2) {
Hai Shalom899fcc72020-10-19 14:38:18 -0700175 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
Hai Shalomc3565922019-10-28 11:58:20 -0700176
Hai Shalomfdcde762020-04-02 11:19:20 -0700177 if ((wpa_s->conf->sae_pwe == 1 || ssid->sae_password_id) &&
178 wpa_s->conf->sae_pwe != 3 &&
179 !use_pt) {
Hai Shalomc3565922019-10-28 11:58:20 -0700180 wpa_printf(MSG_DEBUG,
181 "SAE: Cannot use H2E with the selected AP");
182 return NULL;
183 }
184 }
185
186 if (use_pt &&
187 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
188 wpa_s->own_addr, bssid,
Hai Shalom899fcc72020-10-19 14:38:18 -0700189 wpa_s->sme.sae_rejected_groups, NULL) < 0)
Hai Shalomc3565922019-10-28 11:58:20 -0700190 return NULL;
191 if (!use_pt &&
192 sae_prepare_commit(wpa_s->own_addr, bssid,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700193 (u8 *) password, os_strlen(password),
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800194 &wpa_s->sme.sae) < 0) {
195 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
196 return NULL;
197 }
Hai Shalom899fcc72020-10-19 14:38:18 -0700198 if (wpa_s->sme.sae.tmp) {
Hai Shalom021b0b52019-04-10 11:17:58 -0700199 os_memcpy(wpa_s->sme.sae.tmp->bssid, bssid, ETH_ALEN);
Hai Shalom899fcc72020-10-19 14:38:18 -0700200 if (use_pt && use_pk)
201 wpa_s->sme.sae.pk = 1;
202#ifdef CONFIG_SAE_PK
203 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
204 ETH_ALEN);
205 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, bssid, ETH_ALEN);
206 sae_pk_set_password(&wpa_s->sme.sae, password);
207#endif /* CONFIG_SAE_PK */
208 }
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800209
Hai Shalom021b0b52019-04-10 11:17:58 -0700210reuse_data:
Hai Shalomfdcde762020-04-02 11:19:20 -0700211 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
Roshan Pius3a1667e2018-07-03 15:17:14 -0700212 if (ssid->sae_password_id)
213 len += 4 + os_strlen(ssid->sae_password_id);
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800214 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800215 if (buf == NULL)
216 return NULL;
Roshan Pius3a1667e2018-07-03 15:17:14 -0700217 if (!external) {
218 wpabuf_put_le16(buf, 1); /* Transaction seq# */
Hai Shalom899fcc72020-10-19 14:38:18 -0700219 if (use_pk)
220 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
221 else if (use_pt)
222 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
223 else
224 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
Roshan Pius3a1667e2018-07-03 15:17:14 -0700225 }
Hai Shalomfdcde762020-04-02 11:19:20 -0700226 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
227 ssid->sae_password_id) < 0) {
228 wpabuf_free(buf);
229 return NULL;
230 }
Hai Shalomc3565922019-10-28 11:58:20 -0700231 if (ret_use_pt)
232 *ret_use_pt = use_pt;
Hai Shalom899fcc72020-10-19 14:38:18 -0700233 if (ret_use_pk)
234 *ret_use_pk = use_pk;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800235
236 return buf;
237}
238
239
Roshan Pius3a1667e2018-07-03 15:17:14 -0700240static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
241 int external)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800242{
243 struct wpabuf *buf;
244
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800245 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800246 if (buf == NULL)
247 return NULL;
248
Roshan Pius3a1667e2018-07-03 15:17:14 -0700249 if (!external) {
250 wpabuf_put_le16(buf, 2); /* Transaction seq# */
251 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
252 }
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800253 sae_write_confirm(&wpa_s->sme.sae, buf);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800254
255 return buf;
256}
257
258#endif /* CONFIG_SAE */
259
260
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800261/**
262 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
263 * @wpa_s: Pointer to wpa_supplicant data
264 * @bss: Pointer to the bss which is the target of authentication attempt
265 */
266static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
267 struct wpa_bss *bss)
268{
269 const u8 rrm_ie_len = 5;
270 u8 *pos;
271 const u8 *rrm_ie;
272
273 wpa_s->rrm.rrm_used = 0;
274
275 wpa_printf(MSG_DEBUG,
276 "RRM: Determining whether RRM can be used - device support: 0x%x",
277 wpa_s->drv_rrm_flags);
278
279 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
280 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
281 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
282 return;
283 }
284
Dmitry Shmidt849734c2016-05-27 09:59:01 -0700285 if (!((wpa_s->drv_rrm_flags &
286 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
287 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
288 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800289 wpa_printf(MSG_DEBUG,
290 "RRM: Insufficient RRM support in driver - do not use RRM");
291 return;
292 }
293
294 if (sizeof(wpa_s->sme.assoc_req_ie) <
295 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
296 wpa_printf(MSG_INFO,
297 "RRM: Unable to use RRM, no room for RRM IE");
298 return;
299 }
300
301 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
302 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
303 os_memset(pos, 0, 2 + rrm_ie_len);
304 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
305 *pos++ = rrm_ie_len;
306
Hai Shalom60840252021-02-19 19:02:11 -0800307 /* Set supported capabilities flags */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800308 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
309 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
310
Dmitry Shmidt29333592017-01-09 12:27:11 -0800311 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
312 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
313 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
314
Dmitry Shmidt849734c2016-05-27 09:59:01 -0700315 if (wpa_s->lci)
316 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
317
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800318 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
319 wpa_s->rrm.rrm_used = 1;
320}
321
322
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800323static void sme_send_authentication(struct wpa_supplicant *wpa_s,
324 struct wpa_bss *bss, struct wpa_ssid *ssid,
325 int start)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700326{
327 struct wpa_driver_auth_params params;
328 struct wpa_ssid *old_ssid;
329#ifdef CONFIG_IEEE80211R
330 const u8 *ie;
331#endif /* CONFIG_IEEE80211R */
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700332#if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700333 const u8 *md = NULL;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700334#endif /* CONFIG_IEEE80211R || CONFIG_FILS */
Hai Shalomfdcde762020-04-02 11:19:20 -0700335 int bssid_changed;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800336 struct wpabuf *resp = NULL;
Dmitry Shmidt09f57ba2014-06-10 16:07:13 -0700337 u8 ext_capab[18];
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800338 int ext_capab_len;
Dmitry Shmidt7f656022015-02-25 14:36:37 -0800339 int skip_auth;
Hai Shalom39ba6fc2019-01-22 12:40:38 -0800340 u8 *wpa_ie;
341 size_t wpa_ie_len;
Hai Shalomce48b4a2018-09-05 11:41:35 -0700342#ifdef CONFIG_MBO
343 const u8 *mbo_ie;
344#endif /* CONFIG_MBO */
Hai Shalomfdcde762020-04-02 11:19:20 -0700345 int omit_rsnxe = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700346
347 if (bss == NULL) {
348 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
349 "the network");
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800350 wpas_connect_work_done(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700351 return;
352 }
353
Dmitry Shmidt7f656022015-02-25 14:36:37 -0800354 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
355 wpa_s->reassoc_same_bss;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700356 wpa_s->current_bss = bss;
357
358 os_memset(&params, 0, sizeof(params));
359 wpa_s->reassociate = 0;
360
361 params.freq = bss->freq;
362 params.bssid = bss->bssid;
363 params.ssid = bss->ssid;
364 params.ssid_len = bss->ssid_len;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800365 params.p2p = ssid->p2p_group;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700366
367 if (wpa_s->sme.ssid_len != params.ssid_len ||
368 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
369 wpa_s->sme.prev_bssid_set = 0;
370
371 wpa_s->sme.freq = params.freq;
372 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
373 wpa_s->sme.ssid_len = params.ssid_len;
374
375 params.auth_alg = WPA_AUTH_ALG_OPEN;
376#ifdef IEEE8021X_EAPOL
377 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
378 if (ssid->leap) {
379 if (ssid->non_leap == 0)
380 params.auth_alg = WPA_AUTH_ALG_LEAP;
381 else
382 params.auth_alg |= WPA_AUTH_ALG_LEAP;
383 }
384 }
385#endif /* IEEE8021X_EAPOL */
386 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
387 params.auth_alg);
388 if (ssid->auth_alg) {
389 params.auth_alg = ssid->auth_alg;
390 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
391 "0x%x", params.auth_alg);
392 }
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800393#ifdef CONFIG_SAE
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800394 wpa_s->sme.sae_pmksa_caching = 0;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800395 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
396 const u8 *rsn;
397 struct wpa_ie_data ied;
398
399 rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800400 if (!rsn) {
401 wpa_dbg(wpa_s, MSG_DEBUG,
402 "SAE enabled, but target BSS does not advertise RSN");
Hai Shalom021b0b52019-04-10 11:17:58 -0700403#ifdef CONFIG_DPP
404 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
405 (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
406 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
407 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
408#endif /* CONFIG_DPP */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800409 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
410 wpa_key_mgmt_sae(ied.key_mgmt)) {
411 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
412 params.auth_alg = WPA_AUTH_ALG_SAE;
413 } else {
414 wpa_dbg(wpa_s, MSG_DEBUG,
415 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800416 }
417 }
418#endif /* CONFIG_SAE */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700419
Hai Shalomfdcde762020-04-02 11:19:20 -0700420#ifdef CONFIG_WEP
421 {
422 int i;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700423
Hai Shalomfdcde762020-04-02 11:19:20 -0700424 for (i = 0; i < NUM_WEP_KEYS; i++) {
425 if (ssid->wep_key_len[i])
426 params.wep_key[i] = ssid->wep_key[i];
427 params.wep_key_len[i] = ssid->wep_key_len[i];
428 }
429 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
430 }
431#endif /* CONFIG_WEP */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700432
433 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
434 wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800435 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700436 int try_opportunistic;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700437 const u8 *cache_id = NULL;
438
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800439 try_opportunistic = (ssid->proactive_key_caching < 0 ?
440 wpa_s->conf->okc :
441 ssid->proactive_key_caching) &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700442 (ssid->proto & WPA_PROTO_RSN);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700443#ifdef CONFIG_FILS
444 if (wpa_key_mgmt_fils(ssid->key_mgmt))
445 cache_id = wpa_bss_get_fils_cache_id(bss);
446#endif /* CONFIG_FILS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700447 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
448 wpa_s->current_ssid,
Roshan Pius3a1667e2018-07-03 15:17:14 -0700449 try_opportunistic, cache_id,
450 0) == 0)
Dmitry Shmidt216983b2015-02-06 10:50:36 -0800451 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700452 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
453 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
454 wpa_s->sme.assoc_req_ie,
455 &wpa_s->sme.assoc_req_ie_len)) {
456 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
457 "key management and encryption suites");
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800458 wpas_connect_work_done(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700459 return;
460 }
Hai Shalom74f70d42019-02-11 14:42:39 -0800461#ifdef CONFIG_HS20
462 } else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
463 (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
464 /* No PMKSA caching, but otherwise similar to RSN/WPA */
465 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
466 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
467 wpa_s->sme.assoc_req_ie,
468 &wpa_s->sme.assoc_req_ie_len)) {
469 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
470 "key management and encryption suites");
471 wpas_connect_work_done(wpa_s);
472 return;
473 }
474#endif /* CONFIG_HS20 */
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700475 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
476 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
477 /*
478 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
479 * use non-WPA since the scan results did not indicate that the
480 * AP is using WPA or WPA2.
481 */
482 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
483 wpa_s->sme.assoc_req_ie_len = 0;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800484 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700485 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
486 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
487 wpa_s->sme.assoc_req_ie,
488 &wpa_s->sme.assoc_req_ie_len)) {
489 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
490 "key management and encryption suites (no "
491 "scan results)");
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800492 wpas_connect_work_done(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700493 return;
494 }
495#ifdef CONFIG_WPS
496 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
497 struct wpabuf *wps_ie;
498 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
499 if (wps_ie && wpabuf_len(wps_ie) <=
500 sizeof(wpa_s->sme.assoc_req_ie)) {
501 wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
502 os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
503 wpa_s->sme.assoc_req_ie_len);
504 } else
505 wpa_s->sme.assoc_req_ie_len = 0;
506 wpabuf_free(wps_ie);
507 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
508#endif /* CONFIG_WPS */
509 } else {
510 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
511 wpa_s->sme.assoc_req_ie_len = 0;
512 }
513
Hai Shalom39ba6fc2019-01-22 12:40:38 -0800514 /* In case the WPA vendor IE is used, it should be placed after all the
515 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
516 * defined in the standard. Store the WPA IE so it can later be
517 * inserted at the correct location.
518 */
519 wpa_ie = NULL;
520 wpa_ie_len = 0;
521 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
522 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
523 wpa_s->sme.assoc_req_ie_len);
524 if (wpa_ie) {
525 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
526
527 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
528 wpa_s->sme.assoc_req_ie_len = 0;
529 } else {
530 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
531 wpas_connect_work_done(wpa_s);
532 return;
533 }
534 }
535
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700536#ifdef CONFIG_IEEE80211R
537 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
538 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
539 md = ie + 2;
540 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
Hai Shalom021b0b52019-04-10 11:17:58 -0700541 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
542 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
543 md = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700544 if (md) {
545 /* Prepare for the next transition */
546 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
547 }
548
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700549 if (md) {
550 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
551 md[0], md[1]);
552
Hai Shalomfdcde762020-04-02 11:19:20 -0700553 omit_rsnxe = !wpa_bss_get_ie(bss, WLAN_EID_RSNX);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700554 if (wpa_s->sme.assoc_req_ie_len + 5 <
555 sizeof(wpa_s->sme.assoc_req_ie)) {
556 struct rsn_mdie *mdie;
557 u8 *pos = wpa_s->sme.assoc_req_ie +
558 wpa_s->sme.assoc_req_ie_len;
559 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
560 *pos++ = sizeof(*mdie);
561 mdie = (struct rsn_mdie *) pos;
562 os_memcpy(mdie->mobility_domain, md,
563 MOBILITY_DOMAIN_ID_LEN);
564 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
565 wpa_s->sme.assoc_req_ie_len += 5;
566 }
567
Hai Shalom74f70d42019-02-11 14:42:39 -0800568 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700569 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
570 wpa_sm_has_ptk(wpa_s->wpa)) {
571 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
572 "over-the-air");
573 params.auth_alg = WPA_AUTH_ALG_FT;
574 params.ie = wpa_s->sme.ft_ies;
575 params.ie_len = wpa_s->sme.ft_ies_len;
576 }
577 }
578#endif /* CONFIG_IEEE80211R */
579
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800580 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800581 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700582 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
583 struct wpa_ie_data _ie;
584 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
585 _ie.capabilities &
586 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
587 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
588 "MFP: require MFP");
589 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
590 }
591 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700592
593#ifdef CONFIG_P2P
594 if (wpa_s->global->p2p) {
595 u8 *pos;
596 size_t len;
597 int res;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700598 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
599 len = sizeof(wpa_s->sme.assoc_req_ie) -
600 wpa_s->sme.assoc_req_ie_len;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800601 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
602 ssid->p2p_group);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700603 if (res >= 0)
604 wpa_s->sme.assoc_req_ie_len += res;
605 }
606#endif /* CONFIG_P2P */
607
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800608#ifdef CONFIG_FST
609 if (wpa_s->fst_ies) {
610 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
611
612 if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
613 sizeof(wpa_s->sme.assoc_req_ie)) {
614 os_memcpy(wpa_s->sme.assoc_req_ie +
615 wpa_s->sme.assoc_req_ie_len,
616 wpabuf_head(wpa_s->fst_ies),
617 fst_ies_len);
618 wpa_s->sme.assoc_req_ie_len += fst_ies_len;
619 }
620 }
621#endif /* CONFIG_FST */
622
623 sme_auth_handle_rrm(wpa_s, bss);
624
Dmitry Shmidt29333592017-01-09 12:27:11 -0800625 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
Hai Shalomfdcde762020-04-02 11:19:20 -0700626 wpa_s, ssid, bss,
Dmitry Shmidt29333592017-01-09 12:27:11 -0800627 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
628 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800629
Dmitry Shmidtd5ab1b52016-06-21 12:38:41 -0700630 if (params.p2p)
631 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
632 else
633 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
634
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800635 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
636 sizeof(ext_capab));
637 if (ext_capab_len > 0) {
638 u8 *pos = wpa_s->sme.assoc_req_ie;
639 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
640 pos += 2 + pos[1];
641 os_memmove(pos + ext_capab_len, pos,
642 wpa_s->sme.assoc_req_ie_len -
643 (pos - wpa_s->sme.assoc_req_ie));
644 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
645 os_memcpy(pos, ext_capab, ext_capab_len);
646 }
647
Ahmed ElArabawy0ff61c52019-12-26 12:38:39 -0800648#ifdef CONFIG_TESTING_OPTIONS
649 if (wpa_s->rsnxe_override_assoc &&
650 wpabuf_len(wpa_s->rsnxe_override_assoc) <=
651 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
652 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
653 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
654 wpabuf_head(wpa_s->rsnxe_override_assoc),
655 wpabuf_len(wpa_s->rsnxe_override_assoc));
656 wpa_s->sme.assoc_req_ie_len +=
657 wpabuf_len(wpa_s->rsnxe_override_assoc);
658 } else
659#endif /* CONFIG_TESTING_OPTIONS */
Hai Shalomc3565922019-10-28 11:58:20 -0700660 if (wpa_s->rsnxe_len > 0 &&
661 wpa_s->rsnxe_len <=
Hai Shalomfdcde762020-04-02 11:19:20 -0700662 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
663 !omit_rsnxe) {
Hai Shalomc3565922019-10-28 11:58:20 -0700664 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
665 wpa_s->rsnxe, wpa_s->rsnxe_len);
666 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
667 }
668
Dmitry Shmidt04949592012-07-19 12:16:46 -0700669#ifdef CONFIG_HS20
Hai Shalomcded4e22022-01-28 15:29:52 -0800670 if (is_hs20_network(wpa_s, ssid, bss)
671#ifndef ANDROID /* Android does not use the native HS 2.0 config */
672 && is_hs20_config(wpa_s)
673#endif /* ANDROID */
674 ) {
Dmitry Shmidt04949592012-07-19 12:16:46 -0700675 struct wpabuf *hs20;
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800676
Roshan Pius3a1667e2018-07-03 15:17:14 -0700677 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
Dmitry Shmidt04949592012-07-19 12:16:46 -0700678 if (hs20) {
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800679 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700680 size_t len;
681
Hai Shalom74f70d42019-02-11 14:42:39 -0800682 wpas_hs20_add_indication(hs20, pps_mo_id,
683 get_hs20_version(bss));
Roshan Pius3a1667e2018-07-03 15:17:14 -0700684 wpas_hs20_add_roam_cons_sel(hs20, ssid);
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700685 len = sizeof(wpa_s->sme.assoc_req_ie) -
686 wpa_s->sme.assoc_req_ie_len;
687 if (wpabuf_len(hs20) <= len) {
688 os_memcpy(wpa_s->sme.assoc_req_ie +
689 wpa_s->sme.assoc_req_ie_len,
690 wpabuf_head(hs20), wpabuf_len(hs20));
691 wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
692 }
Dmitry Shmidt04949592012-07-19 12:16:46 -0700693 wpabuf_free(hs20);
694 }
695 }
696#endif /* CONFIG_HS20 */
697
Hai Shalom39ba6fc2019-01-22 12:40:38 -0800698 if (wpa_ie) {
699 size_t len;
700
701 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
702
703 len = sizeof(wpa_s->sme.assoc_req_ie) -
704 wpa_s->sme.assoc_req_ie_len;
705
706 if (len > wpa_ie_len) {
707 os_memcpy(wpa_s->sme.assoc_req_ie +
708 wpa_s->sme.assoc_req_ie_len,
709 wpa_ie, wpa_ie_len);
710 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
711 } else {
712 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
713 }
714
715 os_free(wpa_ie);
716 }
717
Dmitry Shmidt2f74e362015-01-21 13:19:05 -0800718 if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
719 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
720 size_t len;
721
722 len = sizeof(wpa_s->sme.assoc_req_ie) -
723 wpa_s->sme.assoc_req_ie_len;
724 if (wpabuf_len(buf) <= len) {
725 os_memcpy(wpa_s->sme.assoc_req_ie +
726 wpa_s->sme.assoc_req_ie_len,
727 wpabuf_head(buf), wpabuf_len(buf));
728 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
729 }
730 }
731
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800732#ifdef CONFIG_MBO
Hai Shalomce48b4a2018-09-05 11:41:35 -0700733 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
Hai Shalomc3565922019-10-28 11:58:20 -0700734 if (!wpa_s->disable_mbo_oce && mbo_ie) {
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800735 int len;
736
737 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
738 wpa_s->sme.assoc_req_ie_len,
739 sizeof(wpa_s->sme.assoc_req_ie) -
Hai Shalomce48b4a2018-09-05 11:41:35 -0700740 wpa_s->sme.assoc_req_ie_len,
741 !!mbo_attr_from_mbo_ie(mbo_ie,
742 OCE_ATTR_ID_CAPA_IND));
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800743 if (len >= 0)
744 wpa_s->sme.assoc_req_ie_len += len;
745 }
746#endif /* CONFIG_MBO */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800747
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800748#ifdef CONFIG_SAE
Dmitry Shmidt7f656022015-02-25 14:36:37 -0800749 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700750 pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid, ssid, 0,
Hai Shalom021b0b52019-04-10 11:17:58 -0700751 NULL,
752 wpa_s->key_mgmt == WPA_KEY_MGMT_FT_SAE ?
753 WPA_KEY_MGMT_FT_SAE :
754 WPA_KEY_MGMT_SAE) == 0) {
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800755 wpa_dbg(wpa_s, MSG_DEBUG,
756 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
Roshan Pius3a1667e2018-07-03 15:17:14 -0700757 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800758 params.auth_alg = WPA_AUTH_ALG_OPEN;
759 wpa_s->sme.sae_pmksa_caching = 1;
760 }
761
Dmitry Shmidt7f656022015-02-25 14:36:37 -0800762 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800763 if (start)
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800764 resp = sme_auth_build_sae_commit(wpa_s, ssid,
Hai Shalom021b0b52019-04-10 11:17:58 -0700765 bss->bssid, 0,
Hai Shalom899fcc72020-10-19 14:38:18 -0700766 start == 2, NULL,
767 NULL);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800768 else
Roshan Pius3a1667e2018-07-03 15:17:14 -0700769 resp = sme_auth_build_sae_confirm(wpa_s, 0);
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800770 if (resp == NULL) {
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800771 wpas_connection_failed(wpa_s, bss->bssid);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800772 return;
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800773 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800774 params.auth_data = wpabuf_head(resp);
775 params.auth_data_len = wpabuf_len(resp);
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800776 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800777 }
778#endif /* CONFIG_SAE */
779
Hai Shalomfdcde762020-04-02 11:19:20 -0700780 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
781 os_memset(wpa_s->bssid, 0, ETH_ALEN);
782 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
783 if (bssid_changed)
784 wpas_notify_bssid_changed(wpa_s);
785
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800786 old_ssid = wpa_s->current_ssid;
787 wpa_s->current_ssid = ssid;
788 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
789 wpa_supplicant_initiate_eapol(wpa_s);
790
791#ifdef CONFIG_FILS
792 /* TODO: FILS operations can in some cases be done between different
793 * network_ctx (i.e., same credentials can be used with multiple
794 * networks). */
795 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
796 wpa_key_mgmt_fils(ssid->key_mgmt)) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700797 const u8 *indic;
798 u16 fils_info;
Hai Shalomce48b4a2018-09-05 11:41:35 -0700799 const u8 *realm, *username, *rrk;
800 size_t realm_len, username_len, rrk_len;
801 u16 next_seq_num;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700802
803 /*
804 * Check FILS Indication element (FILS Information field) bits
805 * indicating supported authentication algorithms against local
806 * configuration (ssid->fils_dh_group). Try to use FILS
807 * authentication only if the AP supports the combination in the
808 * network profile. */
809 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
810 if (!indic || indic[1] < 2) {
811 wpa_printf(MSG_DEBUG, "SME: " MACSTR
812 " does not include FILS Indication element - cannot use FILS authentication with it",
813 MAC2STR(bss->bssid));
814 goto no_fils;
815 }
816
817 fils_info = WPA_GET_LE16(indic + 2);
818 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
819 wpa_printf(MSG_DEBUG, "SME: " MACSTR
820 " does not support FILS SK without PFS - cannot use FILS authentication with it",
821 MAC2STR(bss->bssid));
822 goto no_fils;
823 }
824 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
825 wpa_printf(MSG_DEBUG, "SME: " MACSTR
826 " does not support FILS SK with PFS - cannot use FILS authentication with it",
827 MAC2STR(bss->bssid));
828 goto no_fils;
829 }
830
Hai Shalomce48b4a2018-09-05 11:41:35 -0700831 if (wpa_s->last_con_fail_realm &&
832 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
833 &username, &username_len,
834 &realm, &realm_len, &next_seq_num,
835 &rrk, &rrk_len) == 0 &&
836 realm && realm_len == wpa_s->last_con_fail_realm_len &&
837 os_memcmp(realm, wpa_s->last_con_fail_realm,
838 realm_len) == 0) {
839 wpa_printf(MSG_DEBUG,
840 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
841 goto no_fils;
842 }
843
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800844 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700845 ssid, 0,
Roshan Pius3a1667e2018-07-03 15:17:14 -0700846 wpa_bss_get_fils_cache_id(bss),
847 0) == 0)
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800848 wpa_printf(MSG_DEBUG,
849 "SME: Try to use FILS with PMKSA caching");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700850 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800851 if (resp) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700852 int auth_alg;
853
854 if (ssid->fils_dh_group)
855 wpa_printf(MSG_DEBUG,
856 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
857 ssid->fils_dh_group);
858 else
859 wpa_printf(MSG_DEBUG,
860 "SME: Try to use FILS SK authentication without PFS");
861 auth_alg = ssid->fils_dh_group ?
862 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
863 params.auth_alg = auth_alg;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800864 params.auth_data = wpabuf_head(resp);
865 params.auth_data_len = wpabuf_len(resp);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700866 wpa_s->sme.auth_alg = auth_alg;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800867 }
868 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700869no_fils:
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800870#endif /* CONFIG_FILS */
871
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800872 wpa_supplicant_cancel_sched_scan(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700873 wpa_supplicant_cancel_scan(wpa_s);
874
875 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
876 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
877 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
878
Hai Shalome21d4e82020-04-29 16:34:06 -0700879 eapol_sm_notify_portValid(wpa_s->eapol, false);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700880 wpa_clear_keys(wpa_s, bss->bssid);
881 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700882 if (old_ssid != wpa_s->current_ssid)
883 wpas_notify_network_changed(wpa_s);
884
Dmitry Shmidt849734c2016-05-27 09:59:01 -0700885#ifdef CONFIG_HS20
886 hs20_configure_frame_filters(wpa_s);
887#endif /* CONFIG_HS20 */
888
Dmitry Shmidtf9bdef92014-04-25 10:46:36 -0700889#ifdef CONFIG_P2P
890 /*
891 * If multi-channel concurrency is not supported, check for any
892 * frequency conflict. In case of any frequency conflict, remove the
893 * least prioritized connection.
894 */
895 if (wpa_s->num_multichan_concurrent < 2) {
896 int freq, num;
897 num = get_shared_radio_freqs(wpa_s, &freq, 1);
898 if (num > 0 && freq > 0 && freq != params.freq) {
899 wpa_printf(MSG_DEBUG,
900 "Conflicting frequency found (%d != %d)",
901 freq, params.freq);
902 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
903 params.freq,
904 ssid) < 0) {
905 wpas_connection_failed(wpa_s, bss->bssid);
906 wpa_supplicant_mark_disassoc(wpa_s);
907 wpabuf_free(resp);
908 wpas_connect_work_done(wpa_s);
909 return;
910 }
911 }
912 }
913#endif /* CONFIG_P2P */
914
Dmitry Shmidt7f656022015-02-25 14:36:37 -0800915 if (skip_auth) {
916 wpa_msg(wpa_s, MSG_DEBUG,
917 "SME: Skip authentication step on reassoc-to-same-BSS");
918 wpabuf_free(resp);
919 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
920 return;
921 }
922
923
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700924 wpa_s->sme.auth_alg = params.auth_alg;
925 if (wpa_drv_authenticate(wpa_s, &params) < 0) {
926 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
927 "driver failed");
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800928 wpas_connection_failed(wpa_s, bss->bssid);
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -0800929 wpa_supplicant_mark_disassoc(wpa_s);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800930 wpabuf_free(resp);
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800931 wpas_connect_work_done(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700932 return;
933 }
934
935 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
936 NULL);
937
938 /*
939 * Association will be started based on the authentication event from
940 * the driver.
941 */
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800942
943 wpabuf_free(resp);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700944}
945
946
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800947static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
948{
949 struct wpa_connect_work *cwork = work->ctx;
950 struct wpa_supplicant *wpa_s = work->wpa_s;
951
Hai Shaloma20dcd72022-02-04 13:43:00 -0800952 wpa_s->roam_in_progress = false;
953#ifdef CONFIG_WNM
954 wpa_s->bss_trans_mgmt_in_progress = false;
955#endif /* CONFIG_WNM */
956
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800957 if (deinit) {
Dmitry Shmidtbd14a572014-02-18 10:33:49 -0800958 if (work->started)
959 wpa_s->connect_work = NULL;
960
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800961 wpas_connect_work_free(cwork);
962 return;
963 }
964
965 wpa_s->connect_work = work;
966
Dmitry Shmidt2e425d62014-11-10 11:18:27 -0800967 if (cwork->bss_removed ||
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800968 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
969 wpas_network_disabled(wpa_s, cwork->ssid)) {
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800970 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
971 wpas_connect_work_done(wpa_s);
972 return;
973 }
974
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800975 /* Starting new connection, so clear the possibly used WPA IE from the
976 * previous association. */
977 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
Hai Shalomc3565922019-10-28 11:58:20 -0700978 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
979 wpa_s->rsnxe_len = 0;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800980
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800981 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
982}
983
984
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800985void sme_authenticate(struct wpa_supplicant *wpa_s,
986 struct wpa_bss *bss, struct wpa_ssid *ssid)
987{
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800988 struct wpa_connect_work *cwork;
989
990 if (bss == NULL || ssid == NULL)
991 return;
992 if (wpa_s->connect_work) {
993 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
994 return;
995 }
996
Hai Shaloma20dcd72022-02-04 13:43:00 -0800997 if (wpa_s->roam_in_progress) {
998 wpa_dbg(wpa_s, MSG_DEBUG,
999 "SME: Reject sme_authenticate() in favor of explicit roam request");
1000 return;
1001 }
1002#ifdef CONFIG_WNM
1003 if (wpa_s->bss_trans_mgmt_in_progress) {
1004 wpa_dbg(wpa_s, MSG_DEBUG,
1005 "SME: Reject sme_authenticate() in favor of BSS transition management request");
1006 return;
1007 }
1008#endif /* CONFIG_WNM */
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08001009 if (radio_work_pending(wpa_s, "sme-connect")) {
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001010 /*
1011 * The previous sme-connect work might no longer be valid due to
1012 * the fact that the BSS list was updated. In addition, it makes
1013 * sense to adhere to the 'newer' decision.
1014 */
1015 wpa_dbg(wpa_s, MSG_DEBUG,
1016 "SME: Remove previous pending sme-connect");
1017 radio_remove_works(wpa_s, "sme-connect", 0);
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08001018 }
1019
Dmitry Shmidtd7ff03d2015-12-04 14:49:35 -08001020 wpas_abort_ongoing_scan(wpa_s);
1021
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08001022 cwork = os_zalloc(sizeof(*cwork));
1023 if (cwork == NULL)
1024 return;
1025 cwork->bss = bss;
1026 cwork->ssid = ssid;
1027 cwork->sme = 1;
1028
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001029#ifdef CONFIG_SAE
1030 wpa_s->sme.sae.state = SAE_NOTHING;
1031 wpa_s->sme.sae.send_confirm = 0;
Dmitry Shmidtcce06662013-11-04 18:44:24 -08001032 wpa_s->sme.sae_group_index = 0;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001033#endif /* CONFIG_SAE */
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08001034
1035 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
1036 sme_auth_start_cb, cwork) < 0)
1037 wpas_connect_work_free(cwork);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001038}
1039
1040
1041#ifdef CONFIG_SAE
1042
Roshan Pius3a1667e2018-07-03 15:17:14 -07001043static int sme_external_auth_build_buf(struct wpabuf *buf,
1044 struct wpabuf *params,
1045 const u8 *sa, const u8 *da,
Hai Shalomc3565922019-10-28 11:58:20 -07001046 u16 auth_transaction, u16 seq_num,
1047 u16 status_code)
Roshan Pius3a1667e2018-07-03 15:17:14 -07001048{
1049 struct ieee80211_mgmt *resp;
1050
1051 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
1052 u.auth.variable));
1053
1054 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
1055 (WLAN_FC_STYPE_AUTH << 4));
1056 os_memcpy(resp->da, da, ETH_ALEN);
1057 os_memcpy(resp->sa, sa, ETH_ALEN);
1058 os_memcpy(resp->bssid, da, ETH_ALEN);
Hai Shalom74f70d42019-02-11 14:42:39 -08001059 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
1060 resp->seq_ctrl = host_to_le16(seq_num << 4);
1061 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
Hai Shalomc3565922019-10-28 11:58:20 -07001062 resp->u.auth.status_code = host_to_le16(status_code);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001063 if (params)
1064 wpabuf_put_buf(buf, params);
1065
1066 return 0;
1067}
1068
1069
Hai Shalom81f62d82019-07-22 12:10:00 -07001070static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
1071 const u8 *bssid,
1072 struct wpa_ssid *ssid)
Roshan Pius3a1667e2018-07-03 15:17:14 -07001073{
1074 struct wpabuf *resp, *buf;
Hai Shalomc3565922019-10-28 11:58:20 -07001075 int use_pt;
Hai Shalom899fcc72020-10-19 14:38:18 -07001076 bool use_pk;
1077 u16 status;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001078
Hai Shalom899fcc72020-10-19 14:38:18 -07001079 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid, 1, 0, &use_pt,
1080 &use_pk);
Hai Shalom81f62d82019-07-22 12:10:00 -07001081 if (!resp) {
1082 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
1083 return -1;
1084 }
Roshan Pius3a1667e2018-07-03 15:17:14 -07001085
1086 wpa_s->sme.sae.state = SAE_COMMITTED;
1087 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp));
1088 if (!buf) {
1089 wpabuf_free(resp);
Hai Shalom81f62d82019-07-22 12:10:00 -07001090 return -1;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001091 }
1092
1093 wpa_s->sme.seq_num++;
Hai Shalom899fcc72020-10-19 14:38:18 -07001094 if (use_pk)
1095 status = WLAN_STATUS_SAE_PK;
1096 else if (use_pt)
1097 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
1098 else
1099 status = WLAN_STATUS_SUCCESS;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001100 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
Hai Shalom899fcc72020-10-19 14:38:18 -07001101 bssid, 1, wpa_s->sme.seq_num, status);
Hai Shalomfdcde762020-04-02 11:19:20 -07001102 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001103 wpabuf_free(resp);
1104 wpabuf_free(buf);
Hai Shalom81f62d82019-07-22 12:10:00 -07001105
1106 return 0;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001107}
1108
1109
1110static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
1111 u16 status)
1112{
1113 struct external_auth params;
1114
1115 os_memset(&params, 0, sizeof(params));
1116 params.status = status;
Hai Shalom66904732019-05-29 11:54:04 -07001117 params.ssid = wpa_s->sme.ext_auth_ssid;
1118 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
1119 params.bssid = wpa_s->sme.ext_auth_bssid;
Hai Shalomc3565922019-10-28 11:58:20 -07001120 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
1121 params.pmkid = wpa_s->sme.sae.pmkid;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001122 wpa_drv_send_external_auth_status(wpa_s, &params);
1123}
1124
1125
Hai Shalom81f62d82019-07-22 12:10:00 -07001126static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
1127 union wpa_event_data *data)
Roshan Pius3a1667e2018-07-03 15:17:14 -07001128{
1129 struct wpa_ssid *ssid;
1130 size_t ssid_str_len = data->external_auth.ssid_len;
Hai Shalom5f92bc92019-04-18 11:54:11 -07001131 const u8 *ssid_str = data->external_auth.ssid;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001132
1133 /* Get the SSID conf from the ssid string obtained */
1134 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1135 if (!wpas_network_disabled(wpa_s, ssid) &&
1136 ssid_str_len == ssid->ssid_len &&
Hai Shalom74f70d42019-02-11 14:42:39 -08001137 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
Hai Shalom021b0b52019-04-10 11:17:58 -07001138 (ssid->key_mgmt & (WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE)))
Roshan Pius3a1667e2018-07-03 15:17:14 -07001139 break;
1140 }
Hai Shalom81f62d82019-07-22 12:10:00 -07001141 if (!ssid ||
1142 sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
1143 ssid) < 0)
1144 return -1;
1145
1146 return 0;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001147}
1148
1149
1150static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1151 const u8 *da)
1152{
1153 struct wpabuf *resp, *buf;
1154
1155 resp = sme_auth_build_sae_confirm(wpa_s, 1);
1156 if (!resp) {
1157 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1158 return;
1159 }
1160
1161 wpa_s->sme.sae.state = SAE_CONFIRMED;
1162 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp));
1163 if (!buf) {
1164 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1165 wpabuf_free(resp);
1166 return;
1167 }
1168 wpa_s->sme.seq_num++;
1169 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
Hai Shalomc3565922019-10-28 11:58:20 -07001170 da, 2, wpa_s->sme.seq_num,
1171 WLAN_STATUS_SUCCESS);
Hai Shalomfdcde762020-04-02 11:19:20 -07001172 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001173 wpabuf_free(resp);
1174 wpabuf_free(buf);
1175}
1176
1177
1178void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1179 union wpa_event_data *data)
1180{
1181 if (RSN_SELECTOR_GET(&data->external_auth.key_mgmt_suite) !=
1182 RSN_AUTH_KEY_MGMT_SAE)
1183 return;
1184
1185 if (data->external_auth.action == EXT_AUTH_START) {
Hai Shalom66904732019-05-29 11:54:04 -07001186 if (!data->external_auth.bssid || !data->external_auth.ssid)
1187 return;
1188 os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
1189 ETH_ALEN);
1190 os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
1191 data->external_auth.ssid_len);
1192 wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001193 wpa_s->sme.seq_num = 0;
1194 wpa_s->sme.sae.state = SAE_NOTHING;
1195 wpa_s->sme.sae.send_confirm = 0;
1196 wpa_s->sme.sae_group_index = 0;
Hai Shalom81f62d82019-07-22 12:10:00 -07001197 if (sme_handle_external_auth_start(wpa_s, data) < 0)
1198 sme_send_external_auth_status(wpa_s,
1199 WLAN_STATUS_UNSPECIFIED_FAILURE);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001200 } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1201 /* Report failure to driver for the wrong trigger */
1202 sme_send_external_auth_status(wpa_s,
1203 WLAN_STATUS_UNSPECIFIED_FAILURE);
1204 }
1205}
1206
1207
Hai Shalomc3565922019-10-28 11:58:20 -07001208static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
1209{
1210 int *groups = wpa_s->conf->sae_groups;
1211 int default_groups[] = { 19, 20, 21, 0 };
1212 int i;
1213
1214 if (!groups)
1215 groups = default_groups;
1216
1217 for (i = 0; groups[i] > 0; i++) {
1218 if (groups[i] == group)
1219 return 1;
1220 }
1221
1222 return 0;
1223}
1224
1225
1226static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
1227 const struct wpabuf *groups)
1228{
1229 size_t i, count;
1230 const u8 *pos;
1231
1232 if (!groups)
1233 return 0;
1234
1235 pos = wpabuf_head(groups);
1236 count = wpabuf_len(groups) / 2;
1237 for (i = 0; i < count; i++) {
1238 int enabled;
1239 u16 group;
1240
1241 group = WPA_GET_LE16(pos);
1242 pos += 2;
1243 enabled = sme_sae_is_group_enabled(wpa_s, group);
1244 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
1245 group, enabled ? "enabled" : "disabled");
1246 if (enabled)
1247 return 1;
1248 }
1249
1250 return 0;
1251}
1252
1253
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001254static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
Roshan Pius3a1667e2018-07-03 15:17:14 -07001255 u16 status_code, const u8 *data, size_t len,
1256 int external, const u8 *sa)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001257{
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001258 int *groups;
1259
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001260 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1261 "status code %u", auth_transaction, status_code);
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001262
1263 if (auth_transaction == 1 &&
1264 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1265 wpa_s->sme.sae.state == SAE_COMMITTED &&
Roshan Pius3a1667e2018-07-03 15:17:14 -07001266 (external || wpa_s->current_bss) && wpa_s->current_ssid) {
Hai Shalom021b0b52019-04-10 11:17:58 -07001267 int default_groups[] = { 19, 20, 21, 0 };
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001268 u16 group;
Hai Shalomfdcde762020-04-02 11:19:20 -07001269 const u8 *token_pos;
1270 size_t token_len;
1271 int h2e = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001272
1273 groups = wpa_s->conf->sae_groups;
1274 if (!groups || groups[0] <= 0)
1275 groups = default_groups;
1276
Hai Shalomfdcde762020-04-02 11:19:20 -07001277 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
1278 data, len);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001279 if (len < sizeof(le16)) {
1280 wpa_dbg(wpa_s, MSG_DEBUG,
1281 "SME: Too short SAE anti-clogging token request");
1282 return -1;
1283 }
1284 group = WPA_GET_LE16(data);
1285 wpa_dbg(wpa_s, MSG_DEBUG,
1286 "SME: SAE anti-clogging token requested (group %u)",
1287 group);
1288 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1289 WLAN_STATUS_SUCCESS) {
1290 wpa_dbg(wpa_s, MSG_ERROR,
1291 "SME: SAE group %u of anti-clogging request is invalid",
1292 group);
1293 return -1;
1294 }
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001295 wpabuf_free(wpa_s->sme.sae_token);
Hai Shalomfdcde762020-04-02 11:19:20 -07001296 token_pos = data + sizeof(le16);
1297 token_len = len - sizeof(le16);
Hai Shalom899fcc72020-10-19 14:38:18 -07001298 h2e = wpa_s->sme.sae.h2e;
Hai Shalomfdcde762020-04-02 11:19:20 -07001299 if (h2e) {
Sunil8cd6f4d2022-06-28 18:40:46 +00001300 u8 id, elen, extid;
1301
Hai Shalomfdcde762020-04-02 11:19:20 -07001302 if (token_len < 3) {
1303 wpa_dbg(wpa_s, MSG_DEBUG,
1304 "SME: Too short SAE anti-clogging token container");
1305 return -1;
1306 }
Sunil8cd6f4d2022-06-28 18:40:46 +00001307 id = *token_pos++;
1308 elen = *token_pos++;
1309 extid = *token_pos++;
1310 if (id != WLAN_EID_EXTENSION ||
1311 elen == 0 || elen > token_len - 2 ||
1312 extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
Hai Shalomfdcde762020-04-02 11:19:20 -07001313 wpa_dbg(wpa_s, MSG_DEBUG,
1314 "SME: Invalid SAE anti-clogging token container header");
1315 return -1;
1316 }
Sunil8cd6f4d2022-06-28 18:40:46 +00001317 token_len = elen - 1;
Hai Shalomfdcde762020-04-02 11:19:20 -07001318 }
1319 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
1320 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
1321 wpa_s->sme.sae_token);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001322 if (!external)
1323 sme_send_authentication(wpa_s, wpa_s->current_bss,
Hai Shalom021b0b52019-04-10 11:17:58 -07001324 wpa_s->current_ssid, 2);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001325 else
1326 sme_external_auth_send_sae_commit(
Hai Shalom66904732019-05-29 11:54:04 -07001327 wpa_s, wpa_s->sme.ext_auth_bssid,
Roshan Pius3a1667e2018-07-03 15:17:14 -07001328 wpa_s->current_ssid);
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001329 return 0;
1330 }
1331
1332 if (auth_transaction == 1 &&
1333 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1334 wpa_s->sme.sae.state == SAE_COMMITTED &&
Roshan Pius3a1667e2018-07-03 15:17:14 -07001335 (external || wpa_s->current_bss) && wpa_s->current_ssid) {
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001336 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
Hai Shalomc3565922019-10-28 11:58:20 -07001337 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
1338 wpa_s->sme.sae.group);
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001339 wpa_s->sme.sae_group_index++;
1340 if (sme_set_sae_group(wpa_s) < 0)
1341 return -1; /* no other groups enabled */
1342 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
Roshan Pius3a1667e2018-07-03 15:17:14 -07001343 if (!external)
1344 sme_send_authentication(wpa_s, wpa_s->current_bss,
1345 wpa_s->current_ssid, 1);
1346 else
1347 sme_external_auth_send_sae_commit(
Hai Shalom66904732019-05-29 11:54:04 -07001348 wpa_s, wpa_s->sme.ext_auth_bssid,
Roshan Pius3a1667e2018-07-03 15:17:14 -07001349 wpa_s->current_ssid);
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001350 return 0;
1351 }
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001352
Roshan Pius3a1667e2018-07-03 15:17:14 -07001353 if (auth_transaction == 1 &&
1354 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1355 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1356
1357 wpa_msg(wpa_s, MSG_INFO,
1358 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1359 MAC2STR(bssid));
1360 return -1;
1361 }
1362
Hai Shalomc3565922019-10-28 11:58:20 -07001363 if (status_code != WLAN_STATUS_SUCCESS &&
Hai Shalom899fcc72020-10-19 14:38:18 -07001364 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
Hai Shaloma20dcd72022-02-04 13:43:00 -08001365 status_code != WLAN_STATUS_SAE_PK) {
1366 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1367
1368 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1369 " auth_type=%u auth_transaction=%u status_code=%u",
1370 MAC2STR(bssid), WLAN_AUTH_SAE,
1371 auth_transaction, status_code);
Sunil Ravia04bd252022-05-02 22:54:18 -07001372 return -2;
Hai Shaloma20dcd72022-02-04 13:43:00 -08001373 }
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001374
1375 if (auth_transaction == 1) {
Dmitry Shmidt41712582015-06-29 11:02:15 -07001376 u16 res;
1377
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001378 groups = wpa_s->conf->sae_groups;
Dmitry Shmidtcce06662013-11-04 18:44:24 -08001379
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001380 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
Roshan Pius3a1667e2018-07-03 15:17:14 -07001381 if ((!external && wpa_s->current_bss == NULL) ||
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001382 wpa_s->current_ssid == NULL)
1383 return -1;
Hai Shalomc3565922019-10-28 11:58:20 -07001384 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
1385 wpa_printf(MSG_DEBUG,
1386 "SAE: Ignore commit message while waiting for confirm");
1387 return 0;
1388 }
Hai Shalom899fcc72020-10-19 14:38:18 -07001389 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
Hai Shalomfdcde762020-04-02 11:19:20 -07001390 wpa_printf(MSG_DEBUG,
1391 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
1392 return -1;
1393 }
Hai Shalom899fcc72020-10-19 14:38:18 -07001394 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
Hai Shalomfdcde762020-04-02 11:19:20 -07001395 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
1396 wpa_printf(MSG_DEBUG,
1397 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
1398 return -1;
1399 }
Hai Shalom899fcc72020-10-19 14:38:18 -07001400 if (!wpa_s->sme.sae.pk &&
1401 status_code == WLAN_STATUS_SAE_PK) {
1402 wpa_printf(MSG_DEBUG,
1403 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
1404 return -1;
1405 }
Hai Shalomfdcde762020-04-02 11:19:20 -07001406
Dmitry Shmidtcce06662013-11-04 18:44:24 -08001407 if (groups && groups[0] <= 0)
1408 groups = NULL;
Dmitry Shmidt41712582015-06-29 11:02:15 -07001409 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
Hai Shalomc3565922019-10-28 11:58:20 -07001410 groups, status_code ==
Hai Shalom899fcc72020-10-19 14:38:18 -07001411 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1412 status_code == WLAN_STATUS_SAE_PK);
Dmitry Shmidt41712582015-06-29 11:02:15 -07001413 if (res == SAE_SILENTLY_DISCARD) {
1414 wpa_printf(MSG_DEBUG,
1415 "SAE: Drop commit message due to reflection attack");
1416 return 0;
1417 }
1418 if (res != WLAN_STATUS_SUCCESS)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001419 return -1;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001420
Hai Shalomc3565922019-10-28 11:58:20 -07001421 if (wpa_s->sme.sae.tmp &&
1422 sme_check_sae_rejected_groups(
1423 wpa_s,
Ahmed ElArabawy0ff61c52019-12-26 12:38:39 -08001424 wpa_s->sme.sae.tmp->peer_rejected_groups))
Hai Shalomc3565922019-10-28 11:58:20 -07001425 return -1;
1426
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001427 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1428 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1429 "commit");
1430 return -1;
1431 }
1432
1433 wpabuf_free(wpa_s->sme.sae_token);
1434 wpa_s->sme.sae_token = NULL;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001435 if (!external)
1436 sme_send_authentication(wpa_s, wpa_s->current_bss,
1437 wpa_s->current_ssid, 0);
1438 else
1439 sme_external_auth_send_sae_confirm(wpa_s, sa);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001440 return 0;
1441 } else if (auth_transaction == 2) {
Hai Shalomc3565922019-10-28 11:58:20 -07001442 if (status_code != WLAN_STATUS_SUCCESS)
1443 return -1;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001444 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001445 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001446 return -1;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001447 if (sae_check_confirm(&wpa_s->sme.sae, data, len) < 0)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001448 return -1;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001449 wpa_s->sme.sae.state = SAE_ACCEPTED;
1450 sae_clear_temp_data(&wpa_s->sme.sae);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001451
1452 if (external) {
1453 /* Report success to driver */
1454 sme_send_external_auth_status(wpa_s,
1455 WLAN_STATUS_SUCCESS);
1456 }
1457
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001458 return 1;
1459 }
1460
1461 return -1;
1462}
Roshan Pius3a1667e2018-07-03 15:17:14 -07001463
1464
Hai Shalomc3565922019-10-28 11:58:20 -07001465static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
1466{
1467 wpa_printf(MSG_DEBUG,
1468 "SME: SAE completed - setting PMK for 4-way handshake");
1469 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN,
1470 wpa_s->sme.sae.pmkid, bssid);
1471 if (wpa_s->conf->sae_pmkid_in_assoc) {
1472 /* Update the own RSNE contents now that we have set the PMK
1473 * and added a PMKSA cache entry based on the successfully
1474 * completed SAE exchange. In practice, this will add the PMKID
1475 * into RSNE. */
1476 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
1477 sizeof(wpa_s->sme.assoc_req_ie)) {
1478 wpa_msg(wpa_s, MSG_WARNING,
1479 "RSN: Not enough room for inserting own PMKID into RSNE");
1480 return -1;
1481 }
1482 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
1483 &wpa_s->sme.assoc_req_ie_len,
1484 wpa_s->sme.sae.pmkid) < 0)
1485 return -1;
1486 wpa_hexdump(MSG_DEBUG,
1487 "SME: Updated Association Request IEs",
1488 wpa_s->sme.assoc_req_ie,
1489 wpa_s->sme.assoc_req_ie_len);
1490 }
1491
1492 return 0;
1493}
1494
1495
Roshan Pius3a1667e2018-07-03 15:17:14 -07001496void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1497 const u8 *auth_frame, size_t len)
1498{
1499 const struct ieee80211_mgmt *header;
1500 size_t auth_length;
1501
1502 header = (const struct ieee80211_mgmt *) auth_frame;
1503 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1504
1505 if (len < auth_length) {
1506 /* Notify failure to the driver */
1507 sme_send_external_auth_status(wpa_s,
1508 WLAN_STATUS_UNSPECIFIED_FAILURE);
1509 return;
1510 }
1511
Hai Shalom74f70d42019-02-11 14:42:39 -08001512 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
Roshan Pius3a1667e2018-07-03 15:17:14 -07001513 int res;
1514
Hai Shalom74f70d42019-02-11 14:42:39 -08001515 res = sme_sae_auth(
1516 wpa_s, le_to_host16(header->u.auth.auth_transaction),
1517 le_to_host16(header->u.auth.status_code),
1518 header->u.auth.variable,
1519 len - auth_length, 1, header->sa);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001520 if (res < 0) {
1521 /* Notify failure to the driver */
1522 sme_send_external_auth_status(
Sunil Ravia04bd252022-05-02 22:54:18 -07001523 wpa_s,
1524 res == -2 ?
1525 le_to_host16(header->u.auth.status_code) :
1526 WLAN_STATUS_UNSPECIFIED_FAILURE);
Roshan Pius3a1667e2018-07-03 15:17:14 -07001527 return;
1528 }
1529 if (res != 1)
1530 return;
1531
Hai Shalomc3565922019-10-28 11:58:20 -07001532 if (sme_sae_set_pmk(wpa_s, wpa_s->sme.ext_auth_bssid) < 0)
1533 return;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001534 }
1535}
1536
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001537#endif /* CONFIG_SAE */
1538
1539
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001540void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
1541{
1542 struct wpa_ssid *ssid = wpa_s->current_ssid;
1543
1544 if (ssid == NULL) {
1545 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1546 "when network is not selected");
1547 return;
1548 }
1549
1550 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
1551 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1552 "when not in authenticating state");
1553 return;
1554 }
1555
1556 if (os_memcmp(wpa_s->pending_bssid, data->auth.peer, ETH_ALEN) != 0) {
1557 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
1558 "unexpected peer " MACSTR,
1559 MAC2STR(data->auth.peer));
1560 return;
1561 }
1562
1563 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001564 " auth_type=%d auth_transaction=%d status_code=%d",
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001565 MAC2STR(data->auth.peer), data->auth.auth_type,
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001566 data->auth.auth_transaction, data->auth.status_code);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001567 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
1568 data->auth.ies, data->auth.ies_len);
1569
1570 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
1571
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001572#ifdef CONFIG_SAE
1573 if (data->auth.auth_type == WLAN_AUTH_SAE) {
1574 int res;
1575 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
1576 data->auth.status_code, data->auth.ies,
Hai Shaloma20dcd72022-02-04 13:43:00 -08001577 data->auth.ies_len, 0, data->auth.peer);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001578 if (res < 0) {
1579 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1580 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1581
1582 }
1583 if (res != 1)
1584 return;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001585
Hai Shalomc3565922019-10-28 11:58:20 -07001586 if (sme_sae_set_pmk(wpa_s, wpa_s->pending_bssid) < 0)
1587 return;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001588 }
1589#endif /* CONFIG_SAE */
1590
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001591 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001592 char *ie_txt = NULL;
1593
1594 if (data->auth.ies && data->auth.ies_len) {
1595 size_t buflen = 2 * data->auth.ies_len + 1;
1596 ie_txt = os_malloc(buflen);
1597 if (ie_txt) {
1598 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
1599 data->auth.ies_len);
1600 }
1601 }
1602 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001603 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001604 MAC2STR(data->auth.peer), data->auth.auth_type,
1605 data->auth.auth_transaction, data->auth.status_code,
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001606 ie_txt ? " ie=" : "",
1607 ie_txt ? ie_txt : "");
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001608 os_free(ie_txt);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001609
Hai Shalomce48b4a2018-09-05 11:41:35 -07001610#ifdef CONFIG_FILS
1611 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
1612 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
1613 fils_connection_failure(wpa_s);
1614#endif /* CONFIG_FILS */
1615
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001616 if (data->auth.status_code !=
1617 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
1618 wpa_s->sme.auth_alg == data->auth.auth_type ||
1619 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
1620 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Dmitry Shmidt04949592012-07-19 12:16:46 -07001621 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001622 return;
1623 }
1624
Dmitry Shmidt97672262014-02-03 13:02:54 -08001625 wpas_connect_work_done(wpa_s);
1626
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001627 switch (data->auth.auth_type) {
1628 case WLAN_AUTH_OPEN:
1629 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
1630
1631 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
1632 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
1633 wpa_s->current_ssid);
1634 return;
1635
1636 case WLAN_AUTH_SHARED_KEY:
1637 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
1638
1639 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
1640 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
1641 wpa_s->current_ssid);
1642 return;
1643
1644 default:
1645 return;
1646 }
1647 }
1648
1649#ifdef CONFIG_IEEE80211R
1650 if (data->auth.auth_type == WLAN_AUTH_FT) {
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001651 const u8 *ric_ies = NULL;
1652 size_t ric_ies_len = 0;
1653
1654 if (wpa_s->ric_ies) {
1655 ric_ies = wpabuf_head(wpa_s->ric_ies);
1656 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
1657 }
Dmitry Shmidt41712582015-06-29 11:02:15 -07001658 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
1659 data->auth.ies_len, 0,
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001660 data->auth.peer,
1661 ric_ies, ric_ies_len) < 0) {
Dmitry Shmidt41712582015-06-29 11:02:15 -07001662 wpa_dbg(wpa_s, MSG_DEBUG,
1663 "SME: FT Authentication response processing failed");
1664 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1665 MACSTR
1666 " reason=%d locally_generated=1",
1667 MAC2STR(wpa_s->pending_bssid),
1668 WLAN_REASON_DEAUTH_LEAVING);
1669 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1670 wpa_supplicant_mark_disassoc(wpa_s);
1671 return;
1672 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001673 }
1674#endif /* CONFIG_IEEE80211R */
1675
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001676#ifdef CONFIG_FILS
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001677 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
1678 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
1679 u16 expect_auth_type;
1680
1681 expect_auth_type = wpa_s->sme.auth_alg ==
1682 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
1683 WLAN_AUTH_FILS_SK;
1684 if (data->auth.auth_type != expect_auth_type) {
1685 wpa_dbg(wpa_s, MSG_DEBUG,
1686 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
1687 data->auth.auth_type, expect_auth_type);
1688 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1689 MACSTR
1690 " reason=%d locally_generated=1",
1691 MAC2STR(wpa_s->pending_bssid),
1692 WLAN_REASON_DEAUTH_LEAVING);
1693 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1694 wpa_supplicant_mark_disassoc(wpa_s);
1695 return;
1696 }
1697
1698 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
1699 data->auth.ies, data->auth.ies_len) < 0) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001700 wpa_dbg(wpa_s, MSG_DEBUG,
1701 "SME: FILS Authentication response processing failed");
1702 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1703 MACSTR
1704 " reason=%d locally_generated=1",
1705 MAC2STR(wpa_s->pending_bssid),
1706 WLAN_REASON_DEAUTH_LEAVING);
1707 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1708 wpa_supplicant_mark_disassoc(wpa_s);
1709 return;
1710 }
1711 }
1712#endif /* CONFIG_FILS */
1713
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001714 sme_associate(wpa_s, ssid->mode, data->auth.peer,
1715 data->auth.auth_type);
1716}
1717
1718
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001719#ifdef CONFIG_IEEE80211R
1720static void remove_ie(u8 *buf, size_t *len, u8 eid)
1721{
1722 u8 *pos, *next, *end;
1723
1724 pos = (u8 *) get_ie(buf, *len, eid);
1725 if (pos) {
1726 next = pos + 2 + pos[1];
1727 end = buf + *len;
1728 *len -= 2 + pos[1];
1729 os_memmove(pos, next, end - next);
1730 }
1731}
1732#endif /* CONFIG_IEEE80211R */
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001733
1734
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001735void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
1736 const u8 *bssid, u16 auth_type)
1737{
1738 struct wpa_driver_associate_params params;
1739 struct ieee802_11_elems elems;
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001740 struct wpa_ssid *ssid = wpa_s->current_ssid;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001741#ifdef CONFIG_FILS
1742 u8 nonces[2 * FILS_NONCE_LEN];
1743#endif /* CONFIG_FILS */
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08001744#ifdef CONFIG_HT_OVERRIDES
1745 struct ieee80211_ht_capabilities htcaps;
1746 struct ieee80211_ht_capabilities htcaps_mask;
1747#endif /* CONFIG_HT_OVERRIDES */
Dmitry Shmidt2f023192013-03-12 12:44:17 -07001748#ifdef CONFIG_VHT_OVERRIDES
1749 struct ieee80211_vht_capabilities vhtcaps;
1750 struct ieee80211_vht_capabilities vhtcaps_mask;
1751#endif /* CONFIG_VHT_OVERRIDES */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001752
1753 os_memset(&params, 0, sizeof(params));
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001754
1755#ifdef CONFIG_FILS
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001756 if (auth_type == WLAN_AUTH_FILS_SK ||
1757 auth_type == WLAN_AUTH_FILS_SK_PFS) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001758 struct wpabuf *buf;
1759 const u8 *snonce, *anonce;
Paul Stewart092955c2017-02-06 09:13:09 -08001760 const unsigned int max_hlp = 20;
1761 struct wpabuf *hlp[max_hlp];
1762 unsigned int i, num_hlp = 0;
1763 struct fils_hlp_req *req;
1764
1765 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
1766 list) {
1767 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
1768 wpabuf_len(req->pkt));
1769 if (!hlp[num_hlp])
1770 break;
1771 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
1772 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
1773 ETH_ALEN);
1774 wpabuf_put_data(hlp[num_hlp],
1775 "\xaa\xaa\x03\x00\x00\x00", 6);
1776 wpabuf_put_buf(hlp[num_hlp], req->pkt);
1777 num_hlp++;
1778 if (num_hlp >= max_hlp)
1779 break;
1780 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001781
1782 buf = fils_build_assoc_req(wpa_s->wpa, &params.fils_kek,
1783 &params.fils_kek_len, &snonce,
Paul Stewart092955c2017-02-06 09:13:09 -08001784 &anonce,
1785 (const struct wpabuf **) hlp,
1786 num_hlp);
1787 for (i = 0; i < num_hlp; i++)
1788 wpabuf_free(hlp[i]);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001789 if (!buf)
1790 return;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001791 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
1792 wpa_s->sme.assoc_req_ie,
1793 wpa_s->sme.assoc_req_ie_len);
1794#ifdef CONFIG_IEEE80211R
1795 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
1796 /* Remove RSNE and MDE to allow them to be overridden
1797 * with FILS+FT specific values from
1798 * fils_build_assoc_req(). */
1799 remove_ie(wpa_s->sme.assoc_req_ie,
1800 &wpa_s->sme.assoc_req_ie_len,
1801 WLAN_EID_RSN);
1802 wpa_hexdump(MSG_DEBUG,
1803 "FILS: assoc_req after RSNE removal",
1804 wpa_s->sme.assoc_req_ie,
1805 wpa_s->sme.assoc_req_ie_len);
1806 remove_ie(wpa_s->sme.assoc_req_ie,
1807 &wpa_s->sme.assoc_req_ie_len,
1808 WLAN_EID_MOBILITY_DOMAIN);
1809 wpa_hexdump(MSG_DEBUG,
1810 "FILS: assoc_req after MDE removal",
1811 wpa_s->sme.assoc_req_ie,
1812 wpa_s->sme.assoc_req_ie_len);
1813 }
1814#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001815 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
1816 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
1817 sizeof(wpa_s->sme.assoc_req_ie)) {
1818 wpa_printf(MSG_ERROR,
1819 "FILS: Not enough buffer room for own AssocReq elements");
1820 wpabuf_free(buf);
1821 return;
1822 }
1823 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1824 wpabuf_head(buf), wpabuf_len(buf));
1825 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
1826 wpabuf_free(buf);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001827 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
1828 wpa_s->sme.assoc_req_ie,
1829 wpa_s->sme.assoc_req_ie_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001830
1831 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
1832 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
1833 params.fils_nonces = nonces;
1834 params.fils_nonces_len = sizeof(nonces);
1835 }
1836#endif /* CONFIG_FILS */
1837
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001838#ifdef CONFIG_OWE
1839#ifdef CONFIG_TESTING_OPTIONS
1840 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
1841 WLAN_EID_EXT_OWE_DH_PARAM)) {
1842 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
1843 } else
1844#endif /* CONFIG_TESTING_OPTIONS */
1845 if (auth_type == WLAN_AUTH_OPEN &&
1846 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
1847 struct wpabuf *owe_ie;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001848 u16 group;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001849
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001850 if (ssid && ssid->owe_group) {
1851 group = ssid->owe_group;
Hai Shalom74f70d42019-02-11 14:42:39 -08001852 } else if (wpa_s->assoc_status_code ==
1853 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
Roshan Pius3a1667e2018-07-03 15:17:14 -07001854 if (wpa_s->last_owe_group == 19)
1855 group = 20;
1856 else if (wpa_s->last_owe_group == 20)
1857 group = 21;
1858 else
1859 group = OWE_DH_GROUP;
Hai Shalom74f70d42019-02-11 14:42:39 -08001860 } else {
1861 group = OWE_DH_GROUP;
Roshan Pius3a1667e2018-07-03 15:17:14 -07001862 }
Hai Shalom74f70d42019-02-11 14:42:39 -08001863
Roshan Pius3a1667e2018-07-03 15:17:14 -07001864 wpa_s->last_owe_group = group;
1865 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001866 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
1867 if (!owe_ie) {
1868 wpa_printf(MSG_ERROR,
1869 "OWE: Failed to build IE for Association Request frame");
1870 return;
1871 }
1872 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
1873 sizeof(wpa_s->sme.assoc_req_ie)) {
1874 wpa_printf(MSG_ERROR,
1875 "OWE: Not enough buffer room for own Association Request frame elements");
1876 wpabuf_free(owe_ie);
1877 return;
1878 }
1879 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1880 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
1881 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
1882 wpabuf_free(owe_ie);
1883 }
1884#endif /* CONFIG_OWE */
1885
Hai Shalom021b0b52019-04-10 11:17:58 -07001886#ifdef CONFIG_DPP2
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001887 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
1888 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
1889 !ssid->dpp_pfs_fallback) {
1890 struct rsn_pmksa_cache_entry *pmksa;
1891
1892 pmksa = pmksa_cache_get_current(wpa_s->wpa);
1893 if (!pmksa || !pmksa->dpp_pfs)
1894 goto pfs_fail;
Hai Shalom021b0b52019-04-10 11:17:58 -07001895
1896 dpp_pfs_free(wpa_s->dpp_pfs);
1897 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
1898 ssid->dpp_netaccesskey_len);
1899 if (!wpa_s->dpp_pfs) {
1900 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
1901 /* Try to continue without PFS */
1902 goto pfs_fail;
1903 }
1904 if (wpa_s->sme.assoc_req_ie_len +
1905 wpabuf_len(wpa_s->dpp_pfs->ie) >
1906 sizeof(wpa_s->sme.assoc_req_ie)) {
1907 wpa_printf(MSG_ERROR,
1908 "DPP: Not enough buffer room for own Association Request frame elements");
1909 dpp_pfs_free(wpa_s->dpp_pfs);
1910 wpa_s->dpp_pfs = NULL;
1911 goto pfs_fail;
1912 }
1913 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1914 wpabuf_head(wpa_s->dpp_pfs->ie),
1915 wpabuf_len(wpa_s->dpp_pfs->ie));
1916 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
1917 }
1918pfs_fail:
1919#endif /* CONFIG_DPP2 */
1920
Hai Shalom899fcc72020-10-19 14:38:18 -07001921 wpa_s->mscs_setup_done = false;
Hai Shalom60840252021-02-19 19:02:11 -08001922 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
1923 wpa_s->robust_av.valid_config) {
Hai Shalom899fcc72020-10-19 14:38:18 -07001924 struct wpabuf *mscs_ie;
1925 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
1926
Hai Shalom899fcc72020-10-19 14:38:18 -07001927 buf_len = 3 + /* MSCS descriptor IE header */
1928 1 + /* Request type */
1929 2 + /* User priority control */
1930 4 + /* Stream timeout */
1931 3 + /* TCLAS Mask IE header */
1932 wpa_s->robust_av.frame_classifier_len;
1933 mscs_ie = wpabuf_alloc(buf_len);
1934 if (!mscs_ie) {
1935 wpa_printf(MSG_INFO,
1936 "MSCS: Failed to allocate MSCS IE");
1937 goto mscs_fail;
1938 }
1939
1940 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
1941 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
1942 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
1943 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
1944 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
1945 mscs_ie_len = wpabuf_len(mscs_ie);
1946 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
1947 wpabuf_head(mscs_ie), mscs_ie_len);
1948 *wpa_ie_len += mscs_ie_len;
1949 }
1950
1951 wpabuf_free(mscs_ie);
1952 }
1953mscs_fail:
1954
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001955 if (ssid && ssid->multi_ap_backhaul_sta) {
Hai Shalom74f70d42019-02-11 14:42:39 -08001956 size_t multi_ap_ie_len;
1957
1958 multi_ap_ie_len = add_multi_ap_ie(
1959 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1960 sizeof(wpa_s->sme.assoc_req_ie) -
1961 wpa_s->sme.assoc_req_ie_len,
1962 MULTI_AP_BACKHAUL_STA);
1963 if (multi_ap_ie_len == 0) {
1964 wpa_printf(MSG_ERROR,
1965 "Multi-AP: Failed to build Multi-AP IE");
1966 return;
1967 }
1968 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
1969 }
1970
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001971 params.bssid = bssid;
1972 params.ssid = wpa_s->sme.ssid;
1973 params.ssid_len = wpa_s->sme.ssid_len;
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001974 params.freq.freq = wpa_s->sme.freq;
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001975 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001976 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
1977 wpa_s->sme.assoc_req_ie : NULL;
1978 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
Hai Shalom74f70d42019-02-11 14:42:39 -08001979 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
1980 params.wpa_ie, params.wpa_ie_len);
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08001981 params.pairwise_suite = wpa_s->pairwise_cipher;
1982 params.group_suite = wpa_s->group_cipher;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001983 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
Dmitry Shmidt15907092014-03-25 10:42:57 -07001984 params.key_mgmt_suite = wpa_s->key_mgmt;
1985 params.wpa_proto = wpa_s->wpa_proto;
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08001986#ifdef CONFIG_HT_OVERRIDES
1987 os_memset(&htcaps, 0, sizeof(htcaps));
1988 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
1989 params.htcaps = (u8 *) &htcaps;
1990 params.htcaps_mask = (u8 *) &htcaps_mask;
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001991 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08001992#endif /* CONFIG_HT_OVERRIDES */
Dmitry Shmidt2f023192013-03-12 12:44:17 -07001993#ifdef CONFIG_VHT_OVERRIDES
1994 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
1995 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
1996 params.vhtcaps = &vhtcaps;
1997 params.vhtcaps_mask = &vhtcaps_mask;
Hai Shalom4fbc08f2020-05-18 12:37:00 -07001998 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
Dmitry Shmidt2f023192013-03-12 12:44:17 -07001999#endif /* CONFIG_VHT_OVERRIDES */
Hai Shalomfdcde762020-04-02 11:19:20 -07002000#ifdef CONFIG_HE_OVERRIDES
Hai Shalom4fbc08f2020-05-18 12:37:00 -07002001 wpa_supplicant_apply_he_overrides(wpa_s, ssid, &params);
Hai Shalomfdcde762020-04-02 11:19:20 -07002002#endif /* CONFIG_HE_OVERRIDES */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002003#ifdef CONFIG_IEEE80211R
Hai Shalom74f70d42019-02-11 14:42:39 -08002004 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
2005 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
2006 WLAN_EID_RIC_DATA)) {
2007 /* There seems to be a pretty inconvenient bug in the Linux
2008 * kernel IE splitting functionality when RIC is used. For now,
2009 * skip correct behavior in IE construction here (i.e., drop the
2010 * additional non-FT-specific IEs) to avoid kernel issues. This
2011 * is fine since RIC is used only for testing purposes in the
2012 * current implementation. */
2013 wpa_printf(MSG_INFO,
2014 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002015 params.wpa_ie = wpa_s->sme.ft_ies;
2016 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
Hai Shalom74f70d42019-02-11 14:42:39 -08002017 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
2018 const u8 *rm_en, *pos, *end;
2019 size_t rm_en_len = 0;
2020 u8 *rm_en_dup = NULL, *wpos;
2021
2022 /* Remove RSNE, MDE, FTE to allow them to be overridden with
2023 * FT specific values */
2024 remove_ie(wpa_s->sme.assoc_req_ie,
2025 &wpa_s->sme.assoc_req_ie_len,
2026 WLAN_EID_RSN);
2027 remove_ie(wpa_s->sme.assoc_req_ie,
2028 &wpa_s->sme.assoc_req_ie_len,
2029 WLAN_EID_MOBILITY_DOMAIN);
2030 remove_ie(wpa_s->sme.assoc_req_ie,
2031 &wpa_s->sme.assoc_req_ie_len,
2032 WLAN_EID_FAST_BSS_TRANSITION);
2033 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
2034 wpa_s->sme.assoc_req_ie_len,
2035 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2036 if (rm_en) {
2037 /* Need to remove RM Enabled Capabilities element as
2038 * well temporarily, so that it can be placed between
2039 * RSNE and MDE. */
2040 rm_en_len = 2 + rm_en[1];
2041 rm_en_dup = os_memdup(rm_en, rm_en_len);
2042 remove_ie(wpa_s->sme.assoc_req_ie,
2043 &wpa_s->sme.assoc_req_ie_len,
2044 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2045 }
2046 wpa_hexdump(MSG_DEBUG,
2047 "SME: Association Request IEs after FT IE removal",
2048 wpa_s->sme.assoc_req_ie,
2049 wpa_s->sme.assoc_req_ie_len);
2050 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
2051 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
2052 wpa_printf(MSG_ERROR,
2053 "SME: Not enough buffer room for FT IEs in Association Request frame");
2054 os_free(rm_en_dup);
2055 return;
2056 }
2057
2058 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
2059 rm_en_len,
2060 wpa_s->sme.assoc_req_ie,
2061 wpa_s->sme.assoc_req_ie_len);
2062 pos = wpa_s->sme.ft_ies;
2063 end = pos + wpa_s->sme.ft_ies_len;
2064 wpos = wpa_s->sme.assoc_req_ie;
2065 if (*pos == WLAN_EID_RSN) {
2066 os_memcpy(wpos, pos, 2 + pos[1]);
2067 wpos += 2 + pos[1];
2068 pos += 2 + pos[1];
2069 }
2070 if (rm_en_dup) {
2071 os_memcpy(wpos, rm_en_dup, rm_en_len);
2072 wpos += rm_en_len;
2073 os_free(rm_en_dup);
2074 }
2075 os_memcpy(wpos, pos, end - pos);
2076 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
2077 rm_en_len;
2078 params.wpa_ie = wpa_s->sme.assoc_req_ie;
2079 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2080 wpa_hexdump(MSG_DEBUG,
2081 "SME: Association Request IEs after FT override",
2082 params.wpa_ie, params.wpa_ie_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002083 }
2084#endif /* CONFIG_IEEE80211R */
2085 params.mode = mode;
2086 params.mgmt_frame_protection = wpa_s->sme.mfp;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002087 params.rrm_used = wpa_s->rrm.rrm_used;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002088 if (wpa_s->sme.prev_bssid_set)
2089 params.prev_bssid = wpa_s->sme.prev_bssid;
2090
2091 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2092 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
2093 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002094 params.freq.freq);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002095
2096 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2097
2098 if (params.wpa_ie == NULL ||
2099 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
2100 < 0) {
2101 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
2102 os_memset(&elems, 0, sizeof(elems));
2103 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002104 if (elems.rsn_ie) {
2105 params.wpa_proto = WPA_PROTO_RSN;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002106 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
2107 elems.rsn_ie_len + 2);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002108 } else if (elems.wpa_ie) {
2109 params.wpa_proto = WPA_PROTO_WPA;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002110 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
2111 elems.wpa_ie_len + 2);
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002112 } else if (elems.osen) {
2113 params.wpa_proto = WPA_PROTO_OSEN;
2114 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
2115 elems.osen_len + 2);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002116 } else
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002117 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
Hai Shalomc3565922019-10-28 11:58:20 -07002118 if (elems.rsnxe)
2119 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
2120 elems.rsnxe_len + 2);
2121 else
2122 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
Hai Shalom4fbc08f2020-05-18 12:37:00 -07002123 if (ssid && ssid->p2p_group)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002124 params.p2p = 1;
2125
Dmitry Shmidt9c175262016-03-03 10:20:07 -08002126 if (wpa_s->p2pdev->set_sta_uapsd)
2127 params.uapsd = wpa_s->p2pdev->sta_uapsd;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002128 else
2129 params.uapsd = -1;
2130
2131 if (wpa_drv_associate(wpa_s, &params) < 0) {
2132 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
2133 "driver failed");
2134 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Dmitry Shmidt04949592012-07-19 12:16:46 -07002135 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002136 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2137 return;
2138 }
2139
2140 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
2141 NULL);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002142
2143#ifdef CONFIG_TESTING_OPTIONS
2144 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
2145 wpa_s->last_assoc_req_wpa_ie = NULL;
2146 if (params.wpa_ie)
2147 wpa_s->last_assoc_req_wpa_ie =
2148 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
2149#endif /* CONFIG_TESTING_OPTIONS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002150}
2151
2152
2153int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2154 const u8 *ies, size_t ies_len)
2155{
2156 if (md == NULL || ies == NULL) {
2157 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
2158 os_free(wpa_s->sme.ft_ies);
2159 wpa_s->sme.ft_ies = NULL;
2160 wpa_s->sme.ft_ies_len = 0;
2161 wpa_s->sme.ft_used = 0;
2162 return 0;
2163 }
2164
2165 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
2166 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
2167 os_free(wpa_s->sme.ft_ies);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002168 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002169 if (wpa_s->sme.ft_ies == NULL)
2170 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002171 wpa_s->sme.ft_ies_len = ies_len;
2172 return 0;
2173}
2174
2175
2176static void sme_deauth(struct wpa_supplicant *wpa_s)
2177{
2178 int bssid_changed;
2179
2180 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2181
2182 if (wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
2183 WLAN_REASON_DEAUTH_LEAVING) < 0) {
2184 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
2185 "failed");
2186 }
2187 wpa_s->sme.prev_bssid_set = 0;
2188
2189 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2190 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2191 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2192 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2193 if (bssid_changed)
2194 wpas_notify_bssid_changed(wpa_s);
2195}
2196
2197
2198void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
2199 union wpa_event_data *data)
2200{
2201 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
2202 "status code %d", MAC2STR(wpa_s->pending_bssid),
2203 data->assoc_reject.status_code);
2204
2205 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2206
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002207#ifdef CONFIG_SAE
2208 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
2209 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
2210 wpa_dbg(wpa_s, MSG_DEBUG,
2211 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
2212 wpa_sm_aborted_cached(wpa_s->wpa);
2213 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
2214 if (wpa_s->current_bss) {
2215 struct wpa_bss *bss = wpa_s->current_bss;
2216 struct wpa_ssid *ssid = wpa_s->current_ssid;
2217
2218 wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
2219 WLAN_REASON_DEAUTH_LEAVING);
2220 wpas_connect_work_done(wpa_s);
2221 wpa_supplicant_mark_disassoc(wpa_s);
2222 wpa_supplicant_connect(wpa_s, bss, ssid);
2223 return;
2224 }
2225 }
2226#endif /* CONFIG_SAE */
2227
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002228 /*
2229 * For now, unconditionally terminate the previous authentication. In
2230 * theory, this should not be needed, but mac80211 gets quite confused
2231 * if the authentication is left pending.. Some roaming cases might
2232 * benefit from using the previous authentication, so this could be
2233 * optimized in the future.
2234 */
2235 sme_deauth(wpa_s);
2236}
2237
2238
2239void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
2240 union wpa_event_data *data)
2241{
2242 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
2243 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08002244 wpa_supplicant_mark_disassoc(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002245}
2246
2247
2248void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
2249 union wpa_event_data *data)
2250{
2251 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
2252 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2253 wpa_supplicant_mark_disassoc(wpa_s);
2254}
2255
2256
2257void sme_event_disassoc(struct wpa_supplicant *wpa_s,
Dmitry Shmidtc2ebb4b2013-07-24 12:57:51 -07002258 struct disassoc_info *info)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002259{
2260 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002261 if (wpa_s->sme.prev_bssid_set) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002262 /*
2263 * cfg80211/mac80211 can get into somewhat confused state if
2264 * the AP only disassociates us and leaves us in authenticated
2265 * state. For now, force the state to be cleared to avoid
2266 * confusing errors if we try to associate with the AP again.
2267 */
2268 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
2269 "driver state");
2270 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
2271 WLAN_REASON_DEAUTH_LEAVING);
2272 }
2273}
2274
2275
2276static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
2277{
2278 struct wpa_supplicant *wpa_s = eloop_ctx;
2279 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
2280 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
2281 sme_deauth(wpa_s);
2282 }
2283}
2284
2285
2286static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
2287{
2288 struct wpa_supplicant *wpa_s = eloop_ctx;
2289 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2290 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
2291 sme_deauth(wpa_s);
2292 }
2293}
2294
2295
2296void sme_state_changed(struct wpa_supplicant *wpa_s)
2297{
2298 /* Make sure timers are cleaned up appropriately. */
2299 if (wpa_s->wpa_state != WPA_ASSOCIATING)
2300 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2301 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
2302 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2303}
2304
2305
2306void sme_disassoc_while_authenticating(struct wpa_supplicant *wpa_s,
2307 const u8 *prev_pending_bssid)
2308{
2309 /*
2310 * mac80211-workaround to force deauth on failed auth cmd,
2311 * requires us to remain in authenticating state to allow the
2312 * second authentication attempt to be continued properly.
2313 */
2314 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Allow pending authentication "
2315 "to proceed after disconnection event");
2316 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
2317 os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
2318
2319 /*
2320 * Re-arm authentication timer in case auth fails for whatever reason.
2321 */
2322 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2323 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
2324 NULL);
2325}
2326
2327
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002328void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
2329{
2330 wpa_s->sme.prev_bssid_set = 0;
2331#ifdef CONFIG_SAE
2332 wpabuf_free(wpa_s->sme.sae_token);
2333 wpa_s->sme.sae_token = NULL;
2334 sae_clear_data(&wpa_s->sme.sae);
2335#endif /* CONFIG_SAE */
2336#ifdef CONFIG_IEEE80211R
Roshan Pius3a1667e2018-07-03 15:17:14 -07002337 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002338 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
2339#endif /* CONFIG_IEEE80211R */
Hai Shalom5f92bc92019-04-18 11:54:11 -07002340 sme_stop_sa_query(wpa_s);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002341}
2342
2343
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002344void sme_deinit(struct wpa_supplicant *wpa_s)
2345{
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002346 sme_clear_on_disassoc(wpa_s);
Hai Shalomc3565922019-10-28 11:58:20 -07002347#ifdef CONFIG_SAE
2348 os_free(wpa_s->sme.sae_rejected_groups);
2349 wpa_s->sme.sae_rejected_groups = NULL;
2350#endif /* CONFIG_SAE */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002351
2352 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2353 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Dmitry Shmidt04949592012-07-19 12:16:46 -07002354 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
2355}
2356
2357
2358static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
2359 const u8 *chan_list, u8 num_channels,
2360 u8 num_intol)
2361{
2362 struct ieee80211_2040_bss_coex_ie *bc_ie;
2363 struct ieee80211_2040_intol_chan_report *ic_report;
2364 struct wpabuf *buf;
2365
Dmitry Shmidtd11f0192014-03-24 12:09:47 -07002366 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
2367 " (num_channels=%u num_intol=%u)",
2368 MAC2STR(wpa_s->bssid), num_channels, num_intol);
2369 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
2370 chan_list, num_channels);
Dmitry Shmidt04949592012-07-19 12:16:46 -07002371
2372 buf = wpabuf_alloc(2 + /* action.category + action_code */
2373 sizeof(struct ieee80211_2040_bss_coex_ie) +
2374 sizeof(struct ieee80211_2040_intol_chan_report) +
2375 num_channels);
2376 if (buf == NULL)
2377 return;
2378
2379 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
2380 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
2381
2382 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
2383 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
2384 bc_ie->length = 1;
2385 if (num_intol)
2386 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
2387
2388 if (num_channels > 0) {
2389 ic_report = wpabuf_put(buf, sizeof(*ic_report));
2390 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
2391 ic_report->length = num_channels + 1;
2392 ic_report->op_class = 0;
2393 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
2394 num_channels);
2395 }
2396
2397 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2398 wpa_s->own_addr, wpa_s->bssid,
2399 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
2400 wpa_msg(wpa_s, MSG_INFO,
2401 "SME: Failed to send 20/40 BSS Coexistence frame");
2402 }
2403
2404 wpabuf_free(buf);
2405}
2406
2407
Hai Shaloma20dcd72022-02-04 13:43:00 -08002408int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
Dmitry Shmidt04949592012-07-19 12:16:46 -07002409{
Hai Shaloma20dcd72022-02-04 13:43:00 -08002410 struct wpa_bss *bss;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002411 const u8 *ie;
Hai Shaloma20dcd72022-02-04 13:43:00 -08002412 u16 ht_cap;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002413 u8 chan_list[P2P_MAX_CHANNELS], channel;
2414 u8 num_channels = 0, num_intol = 0, i;
2415
2416 if (!wpa_s->sme.sched_obss_scan)
2417 return 0;
2418
2419 wpa_s->sme.sched_obss_scan = 0;
2420 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
2421 return 1;
2422
2423 /*
2424 * Check whether AP uses regulatory triplet or channel triplet in
2425 * country info. Right now the operating class of the BSS channel
2426 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
2427 * based on the assumption that operating class triplet is not used in
2428 * beacon frame. If the First Channel Number/Operating Extension
2429 * Identifier octet has a positive integer value of 201 or greater,
2430 * then its operating class triplet.
2431 *
2432 * TODO: If Supported Operating Classes element is present in beacon
2433 * frame, have to lookup operating class in Annex E and fill them in
2434 * 2040 coex frame.
2435 */
2436 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
2437 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
2438 return 1;
2439
2440 os_memset(chan_list, 0, sizeof(chan_list));
2441
Hai Shaloma20dcd72022-02-04 13:43:00 -08002442 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
Ahmed ElArabawy0ff61c52019-12-26 12:38:39 -08002443 /* Skip other band bss */
Hai Shaloma20dcd72022-02-04 13:43:00 -08002444 enum hostapd_hw_mode mode;
Dmitry Shmidt4b060592013-04-29 16:42:49 -07002445 mode = ieee80211_freq_to_chan(bss->freq, &channel);
2446 if (mode != HOSTAPD_MODE_IEEE80211G &&
2447 mode != HOSTAPD_MODE_IEEE80211B)
Dmitry Shmidt04949592012-07-19 12:16:46 -07002448 continue;
2449
Hai Shaloma20dcd72022-02-04 13:43:00 -08002450 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
2451 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
2452 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
2453 " freq=%u chan=%u ht_cap=0x%x",
2454 MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
2455
2456 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
2457 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
Dmitry Shmidtd11f0192014-03-24 12:09:47 -07002458 num_intol++;
2459
Dmitry Shmidt04949592012-07-19 12:16:46 -07002460 /* Check whether the channel is already considered */
2461 for (i = 0; i < num_channels; i++) {
2462 if (channel == chan_list[i])
2463 break;
2464 }
2465 if (i != num_channels)
2466 continue;
2467
Dmitry Shmidt04949592012-07-19 12:16:46 -07002468 chan_list[num_channels++] = channel;
2469 }
2470 }
2471
2472 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
2473 return 1;
2474}
2475
2476
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002477static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
2478 struct wpa_driver_scan_params *params)
Dmitry Shmidt04949592012-07-19 12:16:46 -07002479{
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002480 /* Include only affected channels */
Dmitry Shmidt04949592012-07-19 12:16:46 -07002481 struct hostapd_hw_modes *mode;
2482 int count, i;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002483 int start, end;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002484
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002485 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
Hai Shalom60840252021-02-19 19:02:11 -08002486 HOSTAPD_MODE_IEEE80211G, false);
Dmitry Shmidt04949592012-07-19 12:16:46 -07002487 if (mode == NULL) {
2488 /* No channels supported in this band - use empty list */
2489 params->freqs = os_zalloc(sizeof(int));
2490 return;
2491 }
2492
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002493 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
2494 wpa_s->current_bss) {
2495 const u8 *ie;
2496
2497 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
2498 if (ie && ie[1] >= 2) {
2499 u8 o;
2500
2501 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
2502 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
2503 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
2504 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
2505 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
2506 }
2507 }
2508
2509 start = wpa_s->assoc_freq - 10;
2510 end = wpa_s->assoc_freq + 10;
2511 switch (wpa_s->sme.ht_sec_chan) {
2512 case HT_SEC_CHAN_UNKNOWN:
2513 /* HT40+ possible on channels 1..9 */
2514 if (wpa_s->assoc_freq <= 2452)
2515 start -= 20;
2516 /* HT40- possible on channels 5-13 */
2517 if (wpa_s->assoc_freq >= 2432)
2518 end += 20;
2519 break;
2520 case HT_SEC_CHAN_ABOVE:
2521 end += 20;
2522 break;
2523 case HT_SEC_CHAN_BELOW:
2524 start -= 20;
2525 break;
2526 }
2527 wpa_printf(MSG_DEBUG,
2528 "OBSS: assoc_freq %d possible affected range %d-%d",
2529 wpa_s->assoc_freq, start, end);
2530
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07002531 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
Dmitry Shmidt04949592012-07-19 12:16:46 -07002532 if (params->freqs == NULL)
2533 return;
2534 for (count = 0, i = 0; i < mode->num_channels; i++) {
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002535 int freq;
2536
Dmitry Shmidt04949592012-07-19 12:16:46 -07002537 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
2538 continue;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002539 freq = mode->channels[i].freq;
2540 if (freq - 10 >= end || freq + 10 <= start)
2541 continue; /* not affected */
2542 params->freqs[count++] = freq;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002543 }
2544}
2545
2546
2547static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
2548{
2549 struct wpa_supplicant *wpa_s = eloop_ctx;
2550 struct wpa_driver_scan_params params;
2551
2552 if (!wpa_s->current_bss) {
2553 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
2554 return;
2555 }
2556
2557 os_memset(&params, 0, sizeof(params));
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002558 wpa_obss_scan_freqs_list(wpa_s, &params);
Dmitry Shmidt2271d3f2014-06-23 12:16:31 -07002559 params.low_priority = 1;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002560 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
2561
2562 if (wpa_supplicant_trigger_scan(wpa_s, &params))
2563 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
2564 else
2565 wpa_s->sme.sched_obss_scan = 1;
2566 os_free(params.freqs);
2567
2568 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
2569 sme_obss_scan_timeout, wpa_s, NULL);
2570}
2571
2572
2573void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
2574{
2575 const u8 *ie;
2576 struct wpa_bss *bss = wpa_s->current_bss;
2577 struct wpa_ssid *ssid = wpa_s->current_ssid;
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07002578 struct hostapd_hw_modes *hw_mode = NULL;
2579 int i;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002580
2581 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
2582 wpa_s->sme.sched_obss_scan = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002583 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002584 if (!enable)
2585 return;
2586
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002587 /*
2588 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
2589 * or it expects OBSS scan to be performed by wpa_supplicant.
2590 */
2591 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
2592 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
Hai Shalom81f62d82019-07-22 12:10:00 -07002593 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002594 return;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002595
Hai Shaloma20dcd72022-02-04 13:43:00 -08002596#ifdef CONFIG_HT_OVERRIDES
2597 /* No need for OBSS scan if HT40 is explicitly disabled */
2598 if (ssid->disable_ht40)
2599 return;
2600#endif /* CONFIG_HT_OVERRIDES */
2601
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07002602 if (!wpa_s->hw.modes)
2603 return;
2604
2605 /* only HT caps in 11g mode are relevant */
2606 for (i = 0; i < wpa_s->hw.num_modes; i++) {
2607 hw_mode = &wpa_s->hw.modes[i];
2608 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
2609 break;
2610 }
2611
2612 /* Driver does not support HT40 for 11g or doesn't have 11g. */
2613 if (i == wpa_s->hw.num_modes || !hw_mode ||
2614 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2615 return;
Dmitry Shmidt04949592012-07-19 12:16:46 -07002616
2617 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
2618 return; /* Not associated on 2.4 GHz band */
2619
2620 /* Check whether AP supports HT40 */
2621 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
2622 if (!ie || ie[1] < 2 ||
2623 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2624 return; /* AP does not support HT40 */
2625
2626 ie = wpa_bss_get_ie(wpa_s->current_bss,
2627 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
2628 if (!ie || ie[1] < 14)
2629 return; /* AP does not request OBSS scans */
2630
2631 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
2632 if (wpa_s->sme.obss_scan_int < 10) {
2633 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
2634 "replaced with the minimum 10 sec",
2635 wpa_s->sme.obss_scan_int);
2636 wpa_s->sme.obss_scan_int = 10;
2637 }
2638 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
2639 wpa_s->sme.obss_scan_int);
2640 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
2641 sme_obss_scan_timeout, wpa_s, NULL);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002642}
2643
2644
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002645static const unsigned int sa_query_max_timeout = 1000;
2646static const unsigned int sa_query_retry_timeout = 201;
Hai Shalom74f70d42019-02-11 14:42:39 -08002647static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002648
2649static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
2650{
2651 u32 tu;
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08002652 struct os_reltime now, passed;
2653 os_get_reltime(&now);
2654 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002655 tu = (passed.sec * 1000000 + passed.usec) / 1024;
2656 if (sa_query_max_timeout < tu) {
2657 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
2658 sme_stop_sa_query(wpa_s);
2659 wpa_supplicant_deauthenticate(
2660 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
2661 return 1;
2662 }
2663
2664 return 0;
2665}
2666
2667
2668static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
2669 const u8 *trans_id)
2670{
Hai Shalom74f70d42019-02-11 14:42:39 -08002671 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
2672 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
2673
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002674 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
2675 MACSTR, MAC2STR(wpa_s->bssid));
2676 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
2677 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
2678 req[0] = WLAN_ACTION_SA_QUERY;
2679 req[1] = WLAN_SA_QUERY_REQUEST;
2680 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
Hai Shalom74f70d42019-02-11 14:42:39 -08002681
2682#ifdef CONFIG_OCV
2683 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2684 struct wpa_channel_info ci;
2685
2686 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2687 wpa_printf(MSG_WARNING,
2688 "Failed to get channel info for OCI element in SA Query Request frame");
2689 return;
2690 }
2691
Hai Shalom899fcc72020-10-19 14:38:18 -07002692#ifdef CONFIG_TESTING_OPTIONS
2693 if (wpa_s->oci_freq_override_saquery_req) {
2694 wpa_printf(MSG_INFO,
2695 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
2696 ci.frequency,
2697 wpa_s->oci_freq_override_saquery_req);
2698 ci.frequency = wpa_s->oci_freq_override_saquery_req;
2699 }
2700#endif /* CONFIG_TESTING_OPTIONS */
2701
Hai Shalom74f70d42019-02-11 14:42:39 -08002702 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
2703 return;
2704
2705 req_len += OCV_OCI_EXTENDED_LEN;
2706 }
2707#endif /* CONFIG_OCV */
2708
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002709 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2710 wpa_s->own_addr, wpa_s->bssid,
Hai Shalom74f70d42019-02-11 14:42:39 -08002711 req, req_len, 0) < 0)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002712 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
2713 "Request");
2714}
2715
2716
2717static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
2718{
2719 struct wpa_supplicant *wpa_s = eloop_ctx;
2720 unsigned int timeout, sec, usec;
2721 u8 *trans_id, *nbuf;
2722
2723 if (wpa_s->sme.sa_query_count > 0 &&
2724 sme_check_sa_query_timeout(wpa_s))
2725 return;
2726
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07002727 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
2728 wpa_s->sme.sa_query_count + 1,
2729 WLAN_SA_QUERY_TR_ID_LEN);
Dmitry Shmidt58d12ad2016-07-28 10:07:03 -07002730 if (nbuf == NULL) {
2731 sme_stop_sa_query(wpa_s);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002732 return;
Dmitry Shmidt58d12ad2016-07-28 10:07:03 -07002733 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002734 if (wpa_s->sme.sa_query_count == 0) {
2735 /* Starting a new SA Query procedure */
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08002736 os_get_reltime(&wpa_s->sme.sa_query_start);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002737 }
2738 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
2739 wpa_s->sme.sa_query_trans_id = nbuf;
2740 wpa_s->sme.sa_query_count++;
2741
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07002742 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
2743 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
Dmitry Shmidt58d12ad2016-07-28 10:07:03 -07002744 sme_stop_sa_query(wpa_s);
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07002745 return;
2746 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002747
2748 timeout = sa_query_retry_timeout;
2749 sec = ((timeout / 1000) * 1024) / 1000;
2750 usec = (timeout % 1000) * 1024;
2751 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
2752
2753 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
2754 wpa_s->sme.sa_query_count);
2755
2756 sme_send_sa_query_req(wpa_s, trans_id);
2757}
2758
2759
2760static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
2761{
2762 sme_sa_query_timer(wpa_s, NULL);
2763}
2764
2765
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002766static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002767{
Hai Shalom5f92bc92019-04-18 11:54:11 -07002768 if (wpa_s->sme.sa_query_trans_id)
2769 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002770 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
2771 os_free(wpa_s->sme.sa_query_trans_id);
2772 wpa_s->sme.sa_query_trans_id = NULL;
2773 wpa_s->sme.sa_query_count = 0;
2774}
2775
2776
2777void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
2778 const u8 *da, u16 reason_code)
2779{
2780 struct wpa_ssid *ssid;
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07002781 struct os_reltime now;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002782
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002783 if (wpa_s->wpa_state != WPA_COMPLETED)
2784 return;
2785 ssid = wpa_s->current_ssid;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002786 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002787 return;
2788 if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
2789 return;
2790 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
2791 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
2792 return;
2793 if (wpa_s->sme.sa_query_count > 0)
2794 return;
Hai Shalomfdcde762020-04-02 11:19:20 -07002795#ifdef CONFIG_TESTING_OPTIONS
2796 if (wpa_s->disable_sa_query)
2797 return;
2798#endif /* CONFIG_TESTING_OPTIONS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002799
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07002800 os_get_reltime(&now);
2801 if (wpa_s->sme.last_unprot_disconnect.sec &&
2802 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
2803 return; /* limit SA Query procedure frequency */
2804 wpa_s->sme.last_unprot_disconnect = now;
2805
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002806 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
2807 "possible AP/STA state mismatch - trigger SA Query");
2808 sme_start_sa_query(wpa_s);
2809}
2810
2811
Hai Shalom74f70d42019-02-11 14:42:39 -08002812void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
2813{
2814 unsigned int usec;
2815 u32 _rand;
2816
2817 if (wpa_s->wpa_state != WPA_COMPLETED ||
2818 !wpa_sm_ocv_enabled(wpa_s->wpa))
2819 return;
2820
2821 wpa_dbg(wpa_s, MSG_DEBUG,
2822 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
2823 sme_stop_sa_query(wpa_s);
2824
2825 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
2826 _rand = os_random();
2827 usec = _rand % (sa_query_ch_switch_max_delay + 1);
2828 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
2829}
2830
2831
2832static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
2833 const u8 *sa, const u8 *data,
2834 size_t len)
2835{
2836 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
2837 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
2838
2839 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
2840 MACSTR, MAC2STR(wpa_s->bssid));
2841
2842 resp[0] = WLAN_ACTION_SA_QUERY;
2843 resp[1] = WLAN_SA_QUERY_RESPONSE;
2844 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
2845
2846#ifdef CONFIG_OCV
2847 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2848 struct wpa_channel_info ci;
2849
2850 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2851 wpa_printf(MSG_WARNING,
2852 "Failed to get channel info for OCI element in SA Query Response frame");
2853 return;
2854 }
2855
Hai Shalom899fcc72020-10-19 14:38:18 -07002856#ifdef CONFIG_TESTING_OPTIONS
2857 if (wpa_s->oci_freq_override_saquery_resp) {
2858 wpa_printf(MSG_INFO,
2859 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
2860 ci.frequency,
2861 wpa_s->oci_freq_override_saquery_resp);
2862 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
2863 }
2864#endif /* CONFIG_TESTING_OPTIONS */
2865
Hai Shalom74f70d42019-02-11 14:42:39 -08002866 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
2867 return;
2868
2869 resp_len += OCV_OCI_EXTENDED_LEN;
2870 }
2871#endif /* CONFIG_OCV */
2872
2873 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2874 wpa_s->own_addr, wpa_s->bssid,
2875 resp, resp_len, 0) < 0)
2876 wpa_msg(wpa_s, MSG_INFO,
2877 "SME: Failed to send SA Query Response");
2878}
2879
2880
2881static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
2882 const u8 *sa, const u8 *data,
2883 size_t len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002884{
2885 int i;
2886
Hai Shalom74f70d42019-02-11 14:42:39 -08002887 if (!wpa_s->sme.sa_query_trans_id)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002888 return;
Hai Shalom74f70d42019-02-11 14:42:39 -08002889
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002890 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
2891 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
2892
2893 if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
2894 return;
2895
2896 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
2897 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
2898 i * WLAN_SA_QUERY_TR_ID_LEN,
2899 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
2900 break;
2901 }
2902
2903 if (i >= wpa_s->sme.sa_query_count) {
2904 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
2905 "transaction identifier found");
2906 return;
2907 }
2908
2909 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
2910 "from " MACSTR, MAC2STR(sa));
2911 sme_stop_sa_query(wpa_s);
2912}
2913
Hai Shalom74f70d42019-02-11 14:42:39 -08002914
Hai Shaloma20dcd72022-02-04 13:43:00 -08002915void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
Hai Shalom74f70d42019-02-11 14:42:39 -08002916 const u8 *data, size_t len)
2917{
2918 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
2919 return;
Hai Shaloma20dcd72022-02-04 13:43:00 -08002920 if (is_multicast_ether_addr(da)) {
2921 wpa_printf(MSG_DEBUG,
2922 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
2923 MAC2STR(da), MAC2STR(sa));
2924 return;
2925 }
Hai Shalom74f70d42019-02-11 14:42:39 -08002926
2927 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
2928 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
2929
2930#ifdef CONFIG_OCV
2931 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2932 struct ieee802_11_elems elems;
2933 struct wpa_channel_info ci;
2934
2935 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
2936 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
2937 &elems, 1) == ParseFailed) {
2938 wpa_printf(MSG_DEBUG,
2939 "SA Query: Failed to parse elements");
2940 return;
2941 }
2942
2943 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2944 wpa_printf(MSG_WARNING,
2945 "Failed to get channel info to validate received OCI in SA Query Action frame");
2946 return;
2947 }
2948
2949 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
2950 channel_width_to_int(ci.chanwidth),
Hai Shalom899fcc72020-10-19 14:38:18 -07002951 ci.seg1_idx) != OCI_SUCCESS) {
2952 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
2953 " frame=saquery%s error=%s",
2954 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
2955 "req" : "resp", ocv_errorstr);
Hai Shalom74f70d42019-02-11 14:42:39 -08002956 return;
2957 }
2958 }
2959#endif /* CONFIG_OCV */
2960
2961 if (data[0] == WLAN_SA_QUERY_REQUEST)
2962 sme_process_sa_query_request(wpa_s, sa, data, len);
2963 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
2964 sme_process_sa_query_response(wpa_s, sa, data, len);
2965}