1 /*
2 * Interworking (IEEE 802.11u)
3 * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
4 * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
5 *
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
8 */
9
10 #include "includes.h"
11
12 #include "common.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/gas.h"
15 #include "common/wpa_ctrl.h"
16 #include "utils/pcsc_funcs.h"
17 #include "utils/eloop.h"
18 #include "drivers/driver.h"
19 #include "eap_common/eap_defs.h"
20 #include "eap_peer/eap.h"
21 #include "eap_peer/eap_methods.h"
22 #include "eapol_supp/eapol_supp_sm.h"
23 #include "rsn_supp/wpa.h"
24 #include "wpa_supplicant_i.h"
25 #include "config.h"
26 #include "config_ssid.h"
27 #include "bss.h"
28 #include "scan.h"
29 #include "notify.h"
30 #include "driver_i.h"
31 #include "gas_query.h"
32 #include "hs20_supplicant.h"
33 #include "interworking.h"
34
35
36 #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
37 #define INTERWORKING_3GPP
38 #else
39 #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
40 #define INTERWORKING_3GPP
41 #else
42 #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
43 #define INTERWORKING_3GPP
44 #endif
45 #endif
46 #endif
47
48 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
49 static struct wpa_cred * interworking_credentials_available_realm(
50 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
51 int *excluded);
52 static struct wpa_cred * interworking_credentials_available_3gpp(
53 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
54 int *excluded);
55
56
cred_prio_cmp(const struct wpa_cred * a,const struct wpa_cred * b)57 static int cred_prio_cmp(const struct wpa_cred *a, const struct wpa_cred *b)
58 {
59 if (a->priority > b->priority)
60 return 1;
61 if (a->priority < b->priority)
62 return -1;
63 if (a->provisioning_sp == NULL || b->provisioning_sp == NULL ||
64 os_strcmp(a->provisioning_sp, b->provisioning_sp) != 0)
65 return 0;
66 if (a->sp_priority < b->sp_priority)
67 return 1;
68 if (a->sp_priority > b->sp_priority)
69 return -1;
70 return 0;
71 }
72
73
interworking_reconnect(struct wpa_supplicant * wpa_s)74 static void interworking_reconnect(struct wpa_supplicant *wpa_s)
75 {
76 unsigned int tried;
77
78 if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
79 wpa_supplicant_cancel_sched_scan(wpa_s);
80 wpa_s->own_disconnect_req = 1;
81 wpa_supplicant_deauthenticate(wpa_s,
82 WLAN_REASON_DEAUTH_LEAVING);
83 }
84 wpa_s->disconnected = 0;
85 wpa_s->reassociate = 1;
86 tried = wpa_s->interworking_fast_assoc_tried;
87 wpa_s->interworking_fast_assoc_tried = 1;
88
89 if (!tried && wpa_supplicant_fast_associate(wpa_s) >= 0)
90 return;
91
92 wpa_s->interworking_fast_assoc_tried = 0;
93 wpa_supplicant_req_scan(wpa_s, 0, 0);
94 }
95
96
anqp_build_req(u16 info_ids[],size_t num_ids,struct wpabuf * extra)97 static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
98 struct wpabuf *extra)
99 {
100 struct wpabuf *buf;
101 size_t i;
102 u8 *len_pos;
103
104 buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
105 (extra ? wpabuf_len(extra) : 0));
106 if (buf == NULL)
107 return NULL;
108
109 if (num_ids > 0) {
110 len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
111 for (i = 0; i < num_ids; i++)
112 wpabuf_put_le16(buf, info_ids[i]);
113 gas_anqp_set_element_len(buf, len_pos);
114 }
115 if (extra)
116 wpabuf_put_buf(buf, extra);
117
118 gas_anqp_set_len(buf);
119
120 return buf;
121 }
122
123
interworking_anqp_resp_cb(void * ctx,const u8 * dst,u8 dialog_token,enum gas_query_result result,const struct wpabuf * adv_proto,const struct wpabuf * resp,u16 status_code)124 static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
125 u8 dialog_token,
126 enum gas_query_result result,
127 const struct wpabuf *adv_proto,
128 const struct wpabuf *resp,
129 u16 status_code)
130 {
131 struct wpa_supplicant *wpa_s = ctx;
132
133 wpa_printf(MSG_DEBUG, "ANQP: Response callback dst=" MACSTR
134 " dialog_token=%u result=%d status_code=%u",
135 MAC2STR(dst), dialog_token, result, status_code);
136 anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
137 status_code);
138 interworking_next_anqp_fetch(wpa_s);
139 }
140
141
cred_with_roaming_consortium(struct wpa_supplicant * wpa_s)142 static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
143 {
144 struct wpa_cred *cred;
145
146 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
147 if (cred->roaming_consortium_len)
148 return 1;
149 if (cred->required_roaming_consortium_len)
150 return 1;
151 if (cred->num_roaming_consortiums)
152 return 1;
153 }
154 return 0;
155 }
156
157
cred_with_3gpp(struct wpa_supplicant * wpa_s)158 static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
159 {
160 struct wpa_cred *cred;
161
162 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
163 if (cred->pcsc || cred->imsi)
164 return 1;
165 }
166 return 0;
167 }
168
169
cred_with_nai_realm(struct wpa_supplicant * wpa_s)170 static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
171 {
172 struct wpa_cred *cred;
173
174 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
175 if (cred->pcsc || cred->imsi)
176 continue;
177 if (!cred->eap_method)
178 return 1;
179 if (cred->realm)
180 return 1;
181 }
182 return 0;
183 }
184
185
cred_with_domain(struct wpa_supplicant * wpa_s)186 static int cred_with_domain(struct wpa_supplicant *wpa_s)
187 {
188 struct wpa_cred *cred;
189
190 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
191 if (cred->domain || cred->pcsc || cred->imsi ||
192 cred->roaming_partner)
193 return 1;
194 }
195 return 0;
196 }
197
198
199 #ifdef CONFIG_HS20
200
cred_with_min_backhaul(struct wpa_supplicant * wpa_s)201 static int cred_with_min_backhaul(struct wpa_supplicant *wpa_s)
202 {
203 struct wpa_cred *cred;
204
205 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
206 if (cred->min_dl_bandwidth_home ||
207 cred->min_ul_bandwidth_home ||
208 cred->min_dl_bandwidth_roaming ||
209 cred->min_ul_bandwidth_roaming)
210 return 1;
211 }
212 return 0;
213 }
214
215
cred_with_conn_capab(struct wpa_supplicant * wpa_s)216 static int cred_with_conn_capab(struct wpa_supplicant *wpa_s)
217 {
218 struct wpa_cred *cred;
219
220 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
221 if (cred->num_req_conn_capab)
222 return 1;
223 }
224 return 0;
225 }
226
227 #endif /* CONFIG_HS20 */
228
229
additional_roaming_consortiums(struct wpa_bss * bss)230 static int additional_roaming_consortiums(struct wpa_bss *bss)
231 {
232 const u8 *ie;
233 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
234 if (ie == NULL || ie[1] == 0)
235 return 0;
236 return ie[2]; /* Number of ANQP OIs */
237 }
238
239
interworking_continue_anqp(void * eloop_ctx,void * sock_ctx)240 static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
241 {
242 struct wpa_supplicant *wpa_s = eloop_ctx;
243 interworking_next_anqp_fetch(wpa_s);
244 }
245
246
interworking_anqp_send_req(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)247 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
248 struct wpa_bss *bss)
249 {
250 struct wpabuf *buf;
251 int ret = 0;
252 int res;
253 u16 info_ids[8];
254 size_t num_info_ids = 0;
255 struct wpabuf *extra = NULL;
256 int all = wpa_s->fetch_all_anqp;
257
258 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
259 MAC2STR(bss->bssid));
260 wpa_s->interworking_gas_bss = bss;
261
262 info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
263 if (all) {
264 info_ids[num_info_ids++] = ANQP_VENUE_NAME;
265 info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
266 }
267 if (all || (cred_with_roaming_consortium(wpa_s) &&
268 additional_roaming_consortiums(bss)))
269 info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
270 if (all)
271 info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
272 if (all || cred_with_nai_realm(wpa_s))
273 info_ids[num_info_ids++] = ANQP_NAI_REALM;
274 if (all || cred_with_3gpp(wpa_s)) {
275 info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
276 wpa_supplicant_scard_init(wpa_s, NULL);
277 }
278 if (all || cred_with_domain(wpa_s))
279 info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
280 wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
281 (u8 *) info_ids, num_info_ids * 2);
282
283 #ifdef CONFIG_HS20
284 if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
285 u8 *len_pos;
286
287 extra = wpabuf_alloc(100);
288 if (!extra)
289 return -1;
290
291 len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
292 wpabuf_put_be24(extra, OUI_WFA);
293 wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
294 wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
295 wpabuf_put_u8(extra, 0); /* Reserved */
296 wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
297 if (all)
298 wpabuf_put_u8(extra,
299 HS20_STYPE_OPERATOR_FRIENDLY_NAME);
300 if (all || cred_with_min_backhaul(wpa_s))
301 wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
302 if (all || cred_with_conn_capab(wpa_s))
303 wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
304 if (all)
305 wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
306 if (all) {
307 wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_LIST);
308 wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_NAI_LIST);
309 }
310 gas_anqp_set_element_len(extra, len_pos);
311 }
312 #endif /* CONFIG_HS20 */
313
314 buf = anqp_build_req(info_ids, num_info_ids, extra);
315 wpabuf_free(extra);
316 if (buf == NULL)
317 return -1;
318
319 res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, 0, 0, buf,
320 interworking_anqp_resp_cb, wpa_s);
321 if (res < 0) {
322 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
323 wpabuf_free(buf);
324 ret = -1;
325 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
326 NULL);
327 } else
328 wpa_msg(wpa_s, MSG_DEBUG,
329 "ANQP: Query started with dialog token %u", res);
330
331 return ret;
332 }
333
334
335 struct nai_realm_eap {
336 u8 method;
337 u8 inner_method;
338 enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
339 u8 cred_type;
340 u8 tunneled_cred_type;
341 };
342
343 struct nai_realm {
344 u8 encoding;
345 char *realm;
346 u8 eap_count;
347 struct nai_realm_eap *eap;
348 };
349
350
nai_realm_free(struct nai_realm * realms,u16 count)351 static void nai_realm_free(struct nai_realm *realms, u16 count)
352 {
353 u16 i;
354
355 if (realms == NULL)
356 return;
357 for (i = 0; i < count; i++) {
358 os_free(realms[i].eap);
359 os_free(realms[i].realm);
360 }
361 os_free(realms);
362 }
363
364
nai_realm_parse_eap(struct nai_realm_eap * e,const u8 * pos,const u8 * end)365 static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
366 const u8 *end)
367 {
368 u8 elen, auth_count, a;
369 const u8 *e_end;
370
371 if (end - pos < 3) {
372 wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
373 return NULL;
374 }
375
376 elen = *pos++;
377 if (elen > end - pos || elen < 2) {
378 wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
379 return NULL;
380 }
381 e_end = pos + elen;
382 e->method = *pos++;
383 auth_count = *pos++;
384 wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
385 elen, e->method, auth_count);
386
387 for (a = 0; a < auth_count; a++) {
388 u8 id, len;
389
390 if (end - pos < 2) {
391 wpa_printf(MSG_DEBUG,
392 "No room for Authentication Parameter subfield header");
393 return NULL;
394 }
395
396 id = *pos++;
397 len = *pos++;
398 if (len > end - pos) {
399 wpa_printf(MSG_DEBUG,
400 "No room for Authentication Parameter subfield");
401 return NULL;
402 }
403
404 switch (id) {
405 case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
406 if (len < 1)
407 break;
408 e->inner_non_eap = *pos;
409 if (e->method != EAP_TYPE_TTLS)
410 break;
411 switch (*pos) {
412 case NAI_REALM_INNER_NON_EAP_PAP:
413 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
414 break;
415 case NAI_REALM_INNER_NON_EAP_CHAP:
416 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
417 break;
418 case NAI_REALM_INNER_NON_EAP_MSCHAP:
419 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
420 break;
421 case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
422 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
423 break;
424 }
425 break;
426 case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
427 if (len < 1)
428 break;
429 e->inner_method = *pos;
430 wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
431 e->inner_method);
432 break;
433 case NAI_REALM_EAP_AUTH_CRED_TYPE:
434 if (len < 1)
435 break;
436 e->cred_type = *pos;
437 wpa_printf(MSG_DEBUG, "Credential Type: %u",
438 e->cred_type);
439 break;
440 case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
441 if (len < 1)
442 break;
443 e->tunneled_cred_type = *pos;
444 wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
445 "Type: %u", e->tunneled_cred_type);
446 break;
447 default:
448 wpa_printf(MSG_DEBUG, "Unsupported Authentication "
449 "Parameter: id=%u len=%u", id, len);
450 wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
451 "Value", pos, len);
452 break;
453 }
454
455 pos += len;
456 }
457
458 return e_end;
459 }
460
461
nai_realm_parse_realm(struct nai_realm * r,const u8 * pos,const u8 * end)462 static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
463 const u8 *end)
464 {
465 u16 len;
466 const u8 *f_end;
467 u8 realm_len, e;
468
469 if (end - pos < 4) {
470 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
471 "fixed fields");
472 return NULL;
473 }
474
475 len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
476 pos += 2;
477 if (len > end - pos || len < 3) {
478 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
479 "(len=%u; left=%u)",
480 len, (unsigned int) (end - pos));
481 return NULL;
482 }
483 f_end = pos + len;
484
485 r->encoding = *pos++;
486 realm_len = *pos++;
487 if (realm_len > f_end - pos) {
488 wpa_printf(MSG_DEBUG, "No room for NAI Realm "
489 "(len=%u; left=%u)",
490 realm_len, (unsigned int) (f_end - pos));
491 return NULL;
492 }
493 wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
494 r->realm = dup_binstr(pos, realm_len);
495 if (r->realm == NULL)
496 return NULL;
497 pos += realm_len;
498
499 if (f_end - pos < 1) {
500 wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
501 return NULL;
502 }
503 r->eap_count = *pos++;
504 wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
505 if (r->eap_count * 3 > f_end - pos) {
506 wpa_printf(MSG_DEBUG, "No room for EAP Methods");
507 return NULL;
508 }
509 r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
510 if (r->eap == NULL)
511 return NULL;
512
513 for (e = 0; e < r->eap_count; e++) {
514 pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
515 if (pos == NULL)
516 return NULL;
517 }
518
519 return f_end;
520 }
521
522
nai_realm_parse(struct wpabuf * anqp,u16 * count)523 static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
524 {
525 struct nai_realm *realm;
526 const u8 *pos, *end;
527 u16 i, num;
528 size_t left;
529
530 if (anqp == NULL)
531 return NULL;
532 left = wpabuf_len(anqp);
533 if (left < 2)
534 return NULL;
535
536 pos = wpabuf_head_u8(anqp);
537 end = pos + left;
538 num = WPA_GET_LE16(pos);
539 wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
540 pos += 2;
541 left -= 2;
542
543 if (num > left / 5) {
544 wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
545 "enough data (%u octets) for that many realms",
546 num, (unsigned int) left);
547 return NULL;
548 }
549
550 realm = os_calloc(num, sizeof(struct nai_realm));
551 if (realm == NULL)
552 return NULL;
553
554 for (i = 0; i < num; i++) {
555 pos = nai_realm_parse_realm(&realm[i], pos, end);
556 if (pos == NULL) {
557 nai_realm_free(realm, num);
558 return NULL;
559 }
560 }
561
562 *count = num;
563 return realm;
564 }
565
566
nai_realm_match(struct nai_realm * realm,const char * home_realm)567 static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
568 {
569 char *tmp, *pos, *end;
570 int match = 0;
571
572 if (realm->realm == NULL || home_realm == NULL)
573 return 0;
574
575 if (os_strchr(realm->realm, ';') == NULL)
576 return os_strcasecmp(realm->realm, home_realm) == 0;
577
578 tmp = os_strdup(realm->realm);
579 if (tmp == NULL)
580 return 0;
581
582 pos = tmp;
583 while (*pos) {
584 end = os_strchr(pos, ';');
585 if (end)
586 *end = '\0';
587 if (os_strcasecmp(pos, home_realm) == 0) {
588 match = 1;
589 break;
590 }
591 if (end == NULL)
592 break;
593 pos = end + 1;
594 }
595
596 os_free(tmp);
597
598 return match;
599 }
600
601
nai_realm_cred_username(struct wpa_supplicant * wpa_s,struct nai_realm_eap * eap)602 static int nai_realm_cred_username(struct wpa_supplicant *wpa_s,
603 struct nai_realm_eap *eap)
604 {
605 if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
606 wpa_msg(wpa_s, MSG_DEBUG,
607 "nai-realm-cred-username: EAP method not supported: %d",
608 eap->method);
609 return 0; /* method not supported */
610 }
611
612 if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP &&
613 eap->method != EAP_TYPE_FAST) {
614 /* Only tunneled methods with username/password supported */
615 wpa_msg(wpa_s, MSG_DEBUG,
616 "nai-realm-cred-username: Method: %d is not TTLS, PEAP, or FAST",
617 eap->method);
618 return 0;
619 }
620
621 if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) {
622 if (eap->inner_method &&
623 eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
624 wpa_msg(wpa_s, MSG_DEBUG,
625 "nai-realm-cred-username: PEAP/FAST: Inner method not supported: %d",
626 eap->inner_method);
627 return 0;
628 }
629 if (!eap->inner_method &&
630 eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) {
631 wpa_msg(wpa_s, MSG_DEBUG,
632 "nai-realm-cred-username: MSCHAPv2 not supported");
633 return 0;
634 }
635 }
636
637 if (eap->method == EAP_TYPE_TTLS) {
638 if (eap->inner_method == 0 && eap->inner_non_eap == 0)
639 return 1; /* Assume TTLS/MSCHAPv2 is used */
640 if (eap->inner_method &&
641 eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
642 wpa_msg(wpa_s, MSG_DEBUG,
643 "nai-realm-cred-username: TTLS, but inner not supported: %d",
644 eap->inner_method);
645 return 0;
646 }
647 if (eap->inner_non_eap &&
648 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
649 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
650 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
651 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) {
652 wpa_msg(wpa_s, MSG_DEBUG,
653 "nai-realm-cred-username: TTLS, inner-non-eap not supported: %d",
654 eap->inner_non_eap);
655 return 0;
656 }
657 }
658
659 if (eap->inner_method &&
660 eap->inner_method != EAP_TYPE_GTC &&
661 eap->inner_method != EAP_TYPE_MSCHAPV2) {
662 wpa_msg(wpa_s, MSG_DEBUG,
663 "nai-realm-cred-username: inner-method not GTC or MSCHAPv2: %d",
664 eap->inner_method);
665 return 0;
666 }
667
668 return 1;
669 }
670
671
nai_realm_cred_cert(struct wpa_supplicant * wpa_s,struct nai_realm_eap * eap)672 static int nai_realm_cred_cert(struct wpa_supplicant *wpa_s,
673 struct nai_realm_eap *eap)
674 {
675 if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
676 wpa_msg(wpa_s, MSG_DEBUG,
677 "nai-realm-cred-cert: Method not supported: %d",
678 eap->method);
679 return 0; /* method not supported */
680 }
681
682 if (eap->method != EAP_TYPE_TLS) {
683 /* Only EAP-TLS supported for credential authentication */
684 wpa_msg(wpa_s, MSG_DEBUG,
685 "nai-realm-cred-cert: Method not TLS: %d",
686 eap->method);
687 return 0;
688 }
689
690 return 1;
691 }
692
693
nai_realm_find_eap(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct nai_realm * realm)694 static struct nai_realm_eap * nai_realm_find_eap(struct wpa_supplicant *wpa_s,
695 struct wpa_cred *cred,
696 struct nai_realm *realm)
697 {
698 u8 e;
699
700 if (cred->username == NULL ||
701 cred->username[0] == '\0' ||
702 ((cred->password == NULL ||
703 cred->password[0] == '\0') &&
704 (cred->private_key == NULL ||
705 cred->private_key[0] == '\0'))) {
706 wpa_msg(wpa_s, MSG_DEBUG,
707 "nai-realm-find-eap: incomplete cred info: username: %s password: %s private_key: %s",
708 cred->username ? cred->username : "NULL",
709 cred->password ? cred->password : "NULL",
710 cred->private_key ? cred->private_key : "NULL");
711 return NULL;
712 }
713
714 for (e = 0; e < realm->eap_count; e++) {
715 struct nai_realm_eap *eap = &realm->eap[e];
716 if (cred->password && cred->password[0] &&
717 nai_realm_cred_username(wpa_s, eap))
718 return eap;
719 if (cred->private_key && cred->private_key[0] &&
720 nai_realm_cred_cert(wpa_s, eap))
721 return eap;
722 }
723
724 return NULL;
725 }
726
727
728 #ifdef INTERWORKING_3GPP
729
plmn_id_match(struct wpabuf * anqp,const char * imsi,int mnc_len)730 static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
731 {
732 u8 plmn[3], plmn2[3];
733 const u8 *pos, *end;
734 u8 udhl;
735
736 /*
737 * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network
738 * operator is allowed to include only two digits of the MNC, so allow
739 * matches based on both two and three digit MNC assumptions. Since some
740 * SIM/USIM cards may not expose MNC length conveniently, we may be
741 * provided the default MNC length 3 here and as such, checking with MNC
742 * length 2 is justifiable even though 3GPP TS 24.234 does not mention
743 * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used
744 * with otherwise matching values would not be good idea in general, so
745 * this should not result in selecting incorrect networks.
746 */
747 /* Match with 3 digit MNC */
748 plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
749 plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4);
750 plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
751 /* Match with 2 digit MNC */
752 plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
753 plmn2[1] = (imsi[2] - '0') | 0xf0;
754 plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
755
756 if (anqp == NULL)
757 return 0;
758 pos = wpabuf_head_u8(anqp);
759 end = pos + wpabuf_len(anqp);
760 if (end - pos < 2)
761 return 0;
762 if (*pos != 0) {
763 wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
764 return 0;
765 }
766 pos++;
767 udhl = *pos++;
768 if (udhl > end - pos) {
769 wpa_printf(MSG_DEBUG, "Invalid UDHL");
770 return 0;
771 }
772 end = pos + udhl;
773
774 wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)",
775 plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2],
776 imsi, mnc_len);
777
778 while (end - pos >= 2) {
779 u8 iei, len;
780 const u8 *l_end;
781 iei = *pos++;
782 len = *pos++ & 0x7f;
783 if (len > end - pos)
784 break;
785 l_end = pos + len;
786
787 if (iei == 0 && len > 0) {
788 /* PLMN List */
789 u8 num, i;
790 wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element",
791 pos, len);
792 num = *pos++;
793 for (i = 0; i < num; i++) {
794 if (l_end - pos < 3)
795 break;
796 if (os_memcmp(pos, plmn, 3) == 0 ||
797 os_memcmp(pos, plmn2, 3) == 0)
798 return 1; /* Found matching PLMN */
799 pos += 3;
800 }
801 } else {
802 wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element",
803 pos, len);
804 }
805
806 pos = l_end;
807 }
808
809 return 0;
810 }
811
812
build_root_nai(char * nai,size_t nai_len,const char * imsi,size_t mnc_len,char prefix)813 static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
814 size_t mnc_len, char prefix)
815 {
816 const char *sep, *msin;
817 char *end, *pos;
818 size_t msin_len, plmn_len;
819
820 /*
821 * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
822 * Root NAI:
823 * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
824 * <MNC> is zero-padded to three digits in case two-digit MNC is used
825 */
826
827 if (imsi == NULL || os_strlen(imsi) > 16) {
828 wpa_printf(MSG_DEBUG, "No valid IMSI available");
829 return -1;
830 }
831 sep = os_strchr(imsi, '-');
832 if (sep) {
833 plmn_len = sep - imsi;
834 msin = sep + 1;
835 } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
836 plmn_len = 3 + mnc_len;
837 msin = imsi + plmn_len;
838 } else
839 return -1;
840 if (plmn_len != 5 && plmn_len != 6)
841 return -1;
842 msin_len = os_strlen(msin);
843
844 pos = nai;
845 end = nai + nai_len;
846 if (prefix)
847 *pos++ = prefix;
848 os_memcpy(pos, imsi, plmn_len);
849 pos += plmn_len;
850 os_memcpy(pos, msin, msin_len);
851 pos += msin_len;
852 pos += os_snprintf(pos, end - pos, "@wlan.mnc");
853 if (plmn_len == 5) {
854 *pos++ = '0';
855 *pos++ = imsi[3];
856 *pos++ = imsi[4];
857 } else {
858 *pos++ = imsi[3];
859 *pos++ = imsi[4];
860 *pos++ = imsi[5];
861 }
862 os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
863 imsi[0], imsi[1], imsi[2]);
864
865 return 0;
866 }
867
868
set_root_nai(struct wpa_ssid * ssid,const char * imsi,char prefix)869 static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
870 {
871 char nai[100];
872 if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
873 return -1;
874 return wpa_config_set_quoted(ssid, "identity", nai);
875 }
876
877 #endif /* INTERWORKING_3GPP */
878
879
already_connected(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss)880 static int already_connected(struct wpa_supplicant *wpa_s,
881 struct wpa_cred *cred, struct wpa_bss *bss)
882 {
883 struct wpa_ssid *ssid, *sel_ssid;
884 struct wpa_bss *selected;
885
886 if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL)
887 return 0;
888
889 ssid = wpa_s->current_ssid;
890 if (ssid->parent_cred != cred)
891 return 0;
892
893 if (ssid->ssid_len != bss->ssid_len ||
894 os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
895 return 0;
896
897 sel_ssid = NULL;
898 selected = wpa_supplicant_pick_network(wpa_s, &sel_ssid);
899 if (selected && sel_ssid && sel_ssid->priority > ssid->priority)
900 return 0; /* higher priority network in scan results */
901
902 return 1;
903 }
904
905
remove_duplicate_network(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss)906 static void remove_duplicate_network(struct wpa_supplicant *wpa_s,
907 struct wpa_cred *cred,
908 struct wpa_bss *bss)
909 {
910 struct wpa_ssid *ssid;
911
912 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
913 if (ssid->parent_cred != cred)
914 continue;
915 if (ssid->ssid_len != bss->ssid_len ||
916 os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
917 continue;
918
919 break;
920 }
921
922 if (ssid == NULL)
923 return;
924
925 wpa_printf(MSG_DEBUG, "Interworking: Remove duplicate network entry for the same credential");
926
927 if (ssid == wpa_s->current_ssid) {
928 wpa_sm_set_config(wpa_s->wpa, NULL);
929 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
930 wpa_s->own_disconnect_req = 1;
931 wpa_supplicant_deauthenticate(wpa_s,
932 WLAN_REASON_DEAUTH_LEAVING);
933 }
934
935 wpas_notify_network_removed(wpa_s, ssid);
936 wpa_config_remove_network(wpa_s->conf, ssid->id);
937 }
938
939
interworking_set_hs20_params(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid)940 static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
941 struct wpa_ssid *ssid)
942 {
943 const char *key_mgmt = NULL;
944 #ifdef CONFIG_IEEE80211R
945 int res;
946 struct wpa_driver_capa capa;
947
948 res = wpa_drv_get_capa(wpa_s, &capa);
949 if (res == 0 && capa.key_mgmt_iftype[WPA_IF_STATION] &
950 WPA_DRIVER_CAPA_KEY_MGMT_FT) {
951 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
952 "WPA-EAP WPA-EAP-SHA256 FT-EAP" :
953 "WPA-EAP FT-EAP";
954 }
955 #endif /* CONFIG_IEEE80211R */
956
957 if (!key_mgmt)
958 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
959 "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP";
960 if (wpa_config_set(ssid, "key_mgmt", key_mgmt, 0) < 0 ||
961 wpa_config_set(ssid, "proto", "RSN", 0) < 0 ||
962 wpa_config_set(ssid, "ieee80211w",
963 wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_REQUIRED ?
964 "2" : "1", 0) < 0 ||
965 wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
966 return -1;
967 return 0;
968 }
969
970
interworking_connect_3gpp(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss,int only_add)971 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
972 struct wpa_cred *cred,
973 struct wpa_bss *bss, int only_add)
974 {
975 #ifdef INTERWORKING_3GPP
976 struct wpa_ssid *ssid;
977 int eap_type;
978 int res;
979 char prefix;
980
981 if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
982 return -1;
983
984 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
985 " (3GPP)", MAC2STR(bss->bssid));
986
987 if (already_connected(wpa_s, cred, bss)) {
988 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
989 MAC2STR(bss->bssid));
990 return wpa_s->current_ssid->id;
991 }
992
993 remove_duplicate_network(wpa_s, cred, bss);
994
995 ssid = wpa_config_add_network(wpa_s->conf);
996 if (ssid == NULL)
997 return -1;
998 ssid->parent_cred = cred;
999
1000 wpas_notify_network_added(wpa_s, ssid);
1001 wpa_config_set_network_defaults(ssid);
1002 ssid->priority = cred->priority;
1003 ssid->temporary = 1;
1004 ssid->ssid = os_zalloc(bss->ssid_len + 1);
1005 if (ssid->ssid == NULL)
1006 goto fail;
1007 os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1008 ssid->ssid_len = bss->ssid_len;
1009 ssid->eap.sim_num = cred->sim_num;
1010
1011 if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1012 goto fail;
1013
1014 eap_type = EAP_TYPE_SIM;
1015 if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
1016 eap_type = EAP_TYPE_AKA;
1017 if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
1018 if (cred->eap_method[0].method == EAP_TYPE_SIM ||
1019 cred->eap_method[0].method == EAP_TYPE_AKA ||
1020 cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
1021 eap_type = cred->eap_method[0].method;
1022 }
1023
1024 switch (eap_type) {
1025 case EAP_TYPE_SIM:
1026 prefix = '1';
1027 res = wpa_config_set(ssid, "eap", "SIM", 0);
1028 break;
1029 case EAP_TYPE_AKA:
1030 prefix = '0';
1031 res = wpa_config_set(ssid, "eap", "AKA", 0);
1032 break;
1033 case EAP_TYPE_AKA_PRIME:
1034 prefix = '6';
1035 res = wpa_config_set(ssid, "eap", "AKA'", 0);
1036 break;
1037 default:
1038 res = -1;
1039 break;
1040 }
1041 if (res < 0) {
1042 wpa_msg(wpa_s, MSG_DEBUG,
1043 "Selected EAP method (%d) not supported", eap_type);
1044 goto fail;
1045 }
1046
1047 if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
1048 wpa_msg(wpa_s, MSG_DEBUG, "Failed to set Root NAI");
1049 goto fail;
1050 }
1051
1052 if (cred->milenage && cred->milenage[0]) {
1053 if (wpa_config_set_quoted(ssid, "password",
1054 cred->milenage) < 0)
1055 goto fail;
1056 } else if (cred->pcsc) {
1057 if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
1058 goto fail;
1059 if (wpa_s->conf->pcsc_pin &&
1060 wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
1061 < 0)
1062 goto fail;
1063 }
1064
1065 wpa_s->next_ssid = ssid;
1066 wpa_config_update_prio_list(wpa_s->conf);
1067 if (!only_add)
1068 interworking_reconnect(wpa_s);
1069
1070 return ssid->id;
1071
1072 fail:
1073 wpas_notify_network_removed(wpa_s, ssid);
1074 wpa_config_remove_network(wpa_s->conf, ssid->id);
1075 #endif /* INTERWORKING_3GPP */
1076 return -1;
1077 }
1078
1079
roaming_consortium_element_match(const u8 * ie,const u8 * rc_id,size_t rc_len)1080 static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
1081 size_t rc_len)
1082 {
1083 const u8 *pos, *end;
1084 u8 lens;
1085
1086 if (ie == NULL)
1087 return 0;
1088
1089 pos = ie + 2;
1090 end = ie + 2 + ie[1];
1091
1092 /* Roaming Consortium element:
1093 * Number of ANQP OIs
1094 * OI #1 and #2 lengths
1095 * OI #1, [OI #2], [OI #3]
1096 */
1097
1098 if (end - pos < 2)
1099 return 0;
1100
1101 pos++; /* skip Number of ANQP OIs */
1102 lens = *pos++;
1103 if ((lens & 0x0f) + (lens >> 4) > end - pos)
1104 return 0;
1105
1106 if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1107 return 1;
1108 pos += lens & 0x0f;
1109
1110 if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1111 return 1;
1112 pos += lens >> 4;
1113
1114 if (pos < end && (size_t) (end - pos) == rc_len &&
1115 os_memcmp(pos, rc_id, rc_len) == 0)
1116 return 1;
1117
1118 return 0;
1119 }
1120
1121
roaming_consortium_anqp_match(const struct wpabuf * anqp,const u8 * rc_id,size_t rc_len)1122 static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
1123 const u8 *rc_id, size_t rc_len)
1124 {
1125 const u8 *pos, *end;
1126 u8 len;
1127
1128 if (anqp == NULL)
1129 return 0;
1130
1131 pos = wpabuf_head(anqp);
1132 end = pos + wpabuf_len(anqp);
1133
1134 /* Set of <OI Length, OI> duples */
1135 while (pos < end) {
1136 len = *pos++;
1137 if (len > end - pos)
1138 break;
1139 if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
1140 return 1;
1141 pos += len;
1142 }
1143
1144 return 0;
1145 }
1146
1147
roaming_consortium_match(const u8 * ie,const struct wpabuf * anqp,const u8 * rc_id,size_t rc_len)1148 static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
1149 const u8 *rc_id, size_t rc_len)
1150 {
1151 return roaming_consortium_element_match(ie, rc_id, rc_len) ||
1152 roaming_consortium_anqp_match(anqp, rc_id, rc_len);
1153 }
1154
1155
cred_roaming_consortiums_match(const u8 * ie,const struct wpabuf * anqp,const struct wpa_cred * cred)1156 static int cred_roaming_consortiums_match(const u8 *ie,
1157 const struct wpabuf *anqp,
1158 const struct wpa_cred *cred)
1159 {
1160 unsigned int i;
1161
1162 for (i = 0; i < cred->num_roaming_consortiums; i++) {
1163 if (roaming_consortium_match(ie, anqp,
1164 cred->roaming_consortiums[i],
1165 cred->roaming_consortiums_len[i]))
1166 return 1;
1167 }
1168
1169 return 0;
1170 }
1171
1172
cred_no_required_oi_match(struct wpa_cred * cred,struct wpa_bss * bss)1173 static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss)
1174 {
1175 const u8 *ie;
1176
1177 if (cred->required_roaming_consortium_len == 0)
1178 return 0;
1179
1180 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1181
1182 if (ie == NULL &&
1183 (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
1184 return 1;
1185
1186 return !roaming_consortium_match(ie,
1187 bss->anqp ?
1188 bss->anqp->roaming_consortium : NULL,
1189 cred->required_roaming_consortium,
1190 cred->required_roaming_consortium_len);
1191 }
1192
1193
cred_excluded_ssid(struct wpa_cred * cred,struct wpa_bss * bss)1194 static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
1195 {
1196 size_t i;
1197
1198 if (!cred->excluded_ssid)
1199 return 0;
1200
1201 for (i = 0; i < cred->num_excluded_ssid; i++) {
1202 struct excluded_ssid *e = &cred->excluded_ssid[i];
1203 if (bss->ssid_len == e->ssid_len &&
1204 os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
1205 return 1;
1206 }
1207
1208 return 0;
1209 }
1210
1211
cred_below_min_backhaul(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss)1212 static int cred_below_min_backhaul(struct wpa_supplicant *wpa_s,
1213 struct wpa_cred *cred, struct wpa_bss *bss)
1214 {
1215 #ifdef CONFIG_HS20
1216 int res;
1217 unsigned int dl_bandwidth, ul_bandwidth;
1218 const u8 *wan;
1219 u8 wan_info, dl_load, ul_load;
1220 u16 lmd;
1221 u32 ul_speed, dl_speed;
1222
1223 if (!cred->min_dl_bandwidth_home &&
1224 !cred->min_ul_bandwidth_home &&
1225 !cred->min_dl_bandwidth_roaming &&
1226 !cred->min_ul_bandwidth_roaming)
1227 return 0; /* No bandwidth constraint specified */
1228
1229 if (bss->anqp == NULL || bss->anqp->hs20_wan_metrics == NULL)
1230 return 0; /* No WAN Metrics known - ignore constraint */
1231
1232 wan = wpabuf_head(bss->anqp->hs20_wan_metrics);
1233 wan_info = wan[0];
1234 if (wan_info & BIT(3))
1235 return 1; /* WAN link at capacity */
1236 lmd = WPA_GET_LE16(wan + 11);
1237 if (lmd == 0)
1238 return 0; /* Downlink/Uplink Load was not measured */
1239 dl_speed = WPA_GET_LE32(wan + 1);
1240 ul_speed = WPA_GET_LE32(wan + 5);
1241 dl_load = wan[9];
1242 ul_load = wan[10];
1243
1244 if (dl_speed >= 0xffffff)
1245 dl_bandwidth = dl_speed / 255 * (255 - dl_load);
1246 else
1247 dl_bandwidth = dl_speed * (255 - dl_load) / 255;
1248
1249 if (ul_speed >= 0xffffff)
1250 ul_bandwidth = ul_speed / 255 * (255 - ul_load);
1251 else
1252 ul_bandwidth = ul_speed * (255 - ul_load) / 255;
1253
1254 res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1255 bss->anqp->domain_name : NULL);
1256 if (res > 0) {
1257 if (cred->min_dl_bandwidth_home > dl_bandwidth)
1258 return 1;
1259 if (cred->min_ul_bandwidth_home > ul_bandwidth)
1260 return 1;
1261 } else {
1262 if (cred->min_dl_bandwidth_roaming > dl_bandwidth)
1263 return 1;
1264 if (cred->min_ul_bandwidth_roaming > ul_bandwidth)
1265 return 1;
1266 }
1267 #endif /* CONFIG_HS20 */
1268
1269 return 0;
1270 }
1271
1272
cred_over_max_bss_load(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss)1273 static int cred_over_max_bss_load(struct wpa_supplicant *wpa_s,
1274 struct wpa_cred *cred, struct wpa_bss *bss)
1275 {
1276 const u8 *ie;
1277 int res;
1278
1279 if (!cred->max_bss_load)
1280 return 0; /* No BSS Load constraint specified */
1281
1282 ie = wpa_bss_get_ie(bss, WLAN_EID_BSS_LOAD);
1283 if (ie == NULL || ie[1] < 3)
1284 return 0; /* No BSS Load advertised */
1285
1286 res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1287 bss->anqp->domain_name : NULL);
1288 if (res <= 0)
1289 return 0; /* Not a home network */
1290
1291 return ie[4] > cred->max_bss_load;
1292 }
1293
1294
1295 #ifdef CONFIG_HS20
1296
has_proto_match(const u8 * pos,const u8 * end,u8 proto)1297 static int has_proto_match(const u8 *pos, const u8 *end, u8 proto)
1298 {
1299 while (end - pos >= 4) {
1300 if (pos[0] == proto && pos[3] == 1 /* Open */)
1301 return 1;
1302 pos += 4;
1303 }
1304
1305 return 0;
1306 }
1307
1308
has_proto_port_match(const u8 * pos,const u8 * end,u8 proto,u16 port)1309 static int has_proto_port_match(const u8 *pos, const u8 *end, u8 proto,
1310 u16 port)
1311 {
1312 while (end - pos >= 4) {
1313 if (pos[0] == proto && WPA_GET_LE16(&pos[1]) == port &&
1314 pos[3] == 1 /* Open */)
1315 return 1;
1316 pos += 4;
1317 }
1318
1319 return 0;
1320 }
1321
1322 #endif /* CONFIG_HS20 */
1323
1324
cred_conn_capab_missing(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss)1325 static int cred_conn_capab_missing(struct wpa_supplicant *wpa_s,
1326 struct wpa_cred *cred, struct wpa_bss *bss)
1327 {
1328 #ifdef CONFIG_HS20
1329 int res;
1330 const u8 *capab, *end;
1331 unsigned int i, j;
1332 int *ports;
1333
1334 if (!cred->num_req_conn_capab)
1335 return 0; /* No connection capability constraint specified */
1336
1337 if (bss->anqp == NULL || bss->anqp->hs20_connection_capability == NULL)
1338 return 0; /* No Connection Capability known - ignore constraint
1339 */
1340
1341 res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
1342 bss->anqp->domain_name : NULL);
1343 if (res > 0)
1344 return 0; /* No constraint in home network */
1345
1346 capab = wpabuf_head(bss->anqp->hs20_connection_capability);
1347 end = capab + wpabuf_len(bss->anqp->hs20_connection_capability);
1348
1349 for (i = 0; i < cred->num_req_conn_capab; i++) {
1350 ports = cred->req_conn_capab_port[i];
1351 if (!ports) {
1352 if (!has_proto_match(capab, end,
1353 cred->req_conn_capab_proto[i]))
1354 return 1;
1355 } else {
1356 for (j = 0; ports[j] > -1; j++) {
1357 if (!has_proto_port_match(
1358 capab, end,
1359 cred->req_conn_capab_proto[i],
1360 ports[j]))
1361 return 1;
1362 }
1363 }
1364 }
1365 #endif /* CONFIG_HS20 */
1366
1367 return 0;
1368 }
1369
1370
interworking_credentials_available_roaming_consortium(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,int ignore_bw,int * excluded)1371 static struct wpa_cred * interworking_credentials_available_roaming_consortium(
1372 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
1373 int *excluded)
1374 {
1375 struct wpa_cred *cred, *selected = NULL;
1376 const u8 *ie;
1377 const struct wpabuf *anqp;
1378 int is_excluded = 0;
1379
1380 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1381 anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL;
1382
1383 if (!ie && !anqp)
1384 return NULL;
1385
1386 if (wpa_s->conf->cred == NULL)
1387 return NULL;
1388
1389 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1390 if (cred->roaming_consortium_len == 0 &&
1391 cred->num_roaming_consortiums == 0)
1392 continue;
1393
1394 if (!cred->eap_method)
1395 continue;
1396
1397 if ((cred->roaming_consortium_len == 0 ||
1398 !roaming_consortium_match(ie, anqp,
1399 cred->roaming_consortium,
1400 cred->roaming_consortium_len)) &&
1401 !cred_roaming_consortiums_match(ie, anqp, cred) &&
1402 (cred->required_roaming_consortium_len == 0 ||
1403 !roaming_consortium_match(
1404 ie, anqp, cred->required_roaming_consortium,
1405 cred->required_roaming_consortium_len)))
1406 continue;
1407
1408 if (cred_no_required_oi_match(cred, bss))
1409 continue;
1410 if (!ignore_bw && cred_below_min_backhaul(wpa_s, cred, bss))
1411 continue;
1412 if (!ignore_bw && cred_over_max_bss_load(wpa_s, cred, bss))
1413 continue;
1414 if (!ignore_bw && cred_conn_capab_missing(wpa_s, cred, bss))
1415 continue;
1416 if (cred_excluded_ssid(cred, bss)) {
1417 if (excluded == NULL)
1418 continue;
1419 if (selected == NULL) {
1420 selected = cred;
1421 is_excluded = 1;
1422 }
1423 } else {
1424 if (selected == NULL || is_excluded ||
1425 cred_prio_cmp(selected, cred) < 0) {
1426 selected = cred;
1427 is_excluded = 0;
1428 }
1429 }
1430 }
1431
1432 if (excluded)
1433 *excluded = is_excluded;
1434
1435 return selected;
1436 }
1437
1438
interworking_set_eap_params(struct wpa_ssid * ssid,struct wpa_cred * cred,int ttls)1439 static int interworking_set_eap_params(struct wpa_ssid *ssid,
1440 struct wpa_cred *cred, int ttls)
1441 {
1442 if (cred->eap_method) {
1443 ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
1444 cred->eap_method->method == EAP_TYPE_TTLS;
1445
1446 os_free(ssid->eap.eap_methods);
1447 ssid->eap.eap_methods =
1448 os_malloc(sizeof(struct eap_method_type) * 2);
1449 if (ssid->eap.eap_methods == NULL)
1450 return -1;
1451 os_memcpy(ssid->eap.eap_methods, cred->eap_method,
1452 sizeof(*cred->eap_method));
1453 ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
1454 ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
1455 }
1456
1457 if (ttls && cred->username && cred->username[0]) {
1458 const char *pos;
1459 char *anon;
1460 /* Use anonymous NAI in Phase 1 */
1461 pos = os_strchr(cred->username, '@');
1462 if (pos) {
1463 size_t buflen = 9 + os_strlen(pos) + 1;
1464 anon = os_malloc(buflen);
1465 if (anon == NULL)
1466 return -1;
1467 os_snprintf(anon, buflen, "anonymous%s", pos);
1468 } else if (cred->realm) {
1469 size_t buflen = 10 + os_strlen(cred->realm) + 1;
1470 anon = os_malloc(buflen);
1471 if (anon == NULL)
1472 return -1;
1473 os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
1474 } else {
1475 anon = os_strdup("anonymous");
1476 if (anon == NULL)
1477 return -1;
1478 }
1479 if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
1480 0) {
1481 os_free(anon);
1482 return -1;
1483 }
1484 os_free(anon);
1485 }
1486
1487 if (!ttls && cred->username && cred->username[0] && cred->realm &&
1488 !os_strchr(cred->username, '@')) {
1489 char *id;
1490 size_t buflen;
1491 int res;
1492
1493 buflen = os_strlen(cred->username) + 1 +
1494 os_strlen(cred->realm) + 1;
1495
1496 id = os_malloc(buflen);
1497 if (!id)
1498 return -1;
1499 os_snprintf(id, buflen, "%s@%s", cred->username, cred->realm);
1500 res = wpa_config_set_quoted(ssid, "identity", id);
1501 os_free(id);
1502 if (res < 0)
1503 return -1;
1504 } else if (cred->username && cred->username[0] &&
1505 wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
1506 return -1;
1507
1508 if (cred->password && cred->password[0]) {
1509 if (cred->ext_password &&
1510 wpa_config_set(ssid, "password", cred->password, 0) < 0)
1511 return -1;
1512 if (!cred->ext_password &&
1513 wpa_config_set_quoted(ssid, "password", cred->password) <
1514 0)
1515 return -1;
1516 }
1517
1518 if (cred->client_cert && cred->client_cert[0] &&
1519 wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
1520 return -1;
1521
1522 #ifdef ANDROID
1523 if (cred->private_key &&
1524 os_strncmp(cred->private_key, "keystore://", 11) == 0) {
1525 /* Use OpenSSL engine configuration for Android keystore */
1526 if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
1527 wpa_config_set_quoted(ssid, "key_id",
1528 cred->private_key + 11) < 0 ||
1529 wpa_config_set(ssid, "engine", "1", 0) < 0)
1530 return -1;
1531 } else
1532 #endif /* ANDROID */
1533 if (cred->private_key && cred->private_key[0] &&
1534 wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
1535 return -1;
1536
1537 if (cred->private_key_passwd && cred->private_key_passwd[0] &&
1538 wpa_config_set_quoted(ssid, "private_key_passwd",
1539 cred->private_key_passwd) < 0)
1540 return -1;
1541
1542 if (cred->phase1) {
1543 os_free(ssid->eap.phase1);
1544 ssid->eap.phase1 = os_strdup(cred->phase1);
1545 }
1546 if (cred->phase2) {
1547 os_free(ssid->eap.phase2);
1548 ssid->eap.phase2 = os_strdup(cred->phase2);
1549 }
1550
1551 if (cred->ca_cert && cred->ca_cert[0] &&
1552 wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
1553 return -1;
1554
1555 if (cred->domain_suffix_match && cred->domain_suffix_match[0] &&
1556 wpa_config_set_quoted(ssid, "domain_suffix_match",
1557 cred->domain_suffix_match) < 0)
1558 return -1;
1559
1560 ssid->eap.cert.ocsp = cred->ocsp;
1561
1562 return 0;
1563 }
1564
1565
interworking_connect_roaming_consortium(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss,int only_add)1566 static int interworking_connect_roaming_consortium(
1567 struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
1568 struct wpa_bss *bss, int only_add)
1569 {
1570 struct wpa_ssid *ssid;
1571 const u8 *ie;
1572 const struct wpabuf *anqp;
1573 unsigned int i;
1574
1575 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
1576 " based on roaming consortium match", MAC2STR(bss->bssid));
1577
1578 if (already_connected(wpa_s, cred, bss)) {
1579 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1580 MAC2STR(bss->bssid));
1581 return wpa_s->current_ssid->id;
1582 }
1583
1584 remove_duplicate_network(wpa_s, cred, bss);
1585
1586 ssid = wpa_config_add_network(wpa_s->conf);
1587 if (ssid == NULL)
1588 return -1;
1589 ssid->parent_cred = cred;
1590 wpas_notify_network_added(wpa_s, ssid);
1591 wpa_config_set_network_defaults(ssid);
1592 ssid->priority = cred->priority;
1593 ssid->temporary = 1;
1594 ssid->ssid = os_zalloc(bss->ssid_len + 1);
1595 if (ssid->ssid == NULL)
1596 goto fail;
1597 os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1598 ssid->ssid_len = bss->ssid_len;
1599
1600 if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1601 goto fail;
1602
1603 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1604 anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL;
1605 for (i = 0; (ie || anqp) && i < cred->num_roaming_consortiums; i++) {
1606 if (!roaming_consortium_match(
1607 ie, anqp, cred->roaming_consortiums[i],
1608 cred->roaming_consortiums_len[i]))
1609 continue;
1610
1611 ssid->roaming_consortium_selection =
1612 os_malloc(cred->roaming_consortiums_len[i]);
1613 if (!ssid->roaming_consortium_selection)
1614 goto fail;
1615 os_memcpy(ssid->roaming_consortium_selection,
1616 cred->roaming_consortiums[i],
1617 cred->roaming_consortiums_len[i]);
1618 ssid->roaming_consortium_selection_len =
1619 cred->roaming_consortiums_len[i];
1620 break;
1621 }
1622
1623 if (cred->eap_method == NULL) {
1624 wpa_msg(wpa_s, MSG_DEBUG,
1625 "Interworking: No EAP method set for credential using roaming consortium");
1626 goto fail;
1627 }
1628
1629 if (interworking_set_eap_params(
1630 ssid, cred,
1631 cred->eap_method->vendor == EAP_VENDOR_IETF &&
1632 cred->eap_method->method == EAP_TYPE_TTLS) < 0)
1633 goto fail;
1634
1635 wpa_s->next_ssid = ssid;
1636 wpa_config_update_prio_list(wpa_s->conf);
1637 if (!only_add)
1638 interworking_reconnect(wpa_s);
1639
1640 return ssid->id;
1641
1642 fail:
1643 wpas_notify_network_removed(wpa_s, ssid);
1644 wpa_config_remove_network(wpa_s->conf, ssid->id);
1645 return -1;
1646 }
1647
1648
interworking_connect(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,int only_add)1649 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
1650 int only_add)
1651 {
1652 struct wpa_cred *cred, *cred_rc, *cred_3gpp;
1653 struct wpa_ssid *ssid;
1654 struct nai_realm *realm;
1655 struct nai_realm_eap *eap = NULL;
1656 u16 count, i;
1657 char buf[100];
1658 int excluded = 0, *excl = &excluded;
1659 const char *name;
1660
1661 if (wpa_s->conf->cred == NULL || bss == NULL)
1662 return -1;
1663 if (disallowed_bssid(wpa_s, bss->bssid) ||
1664 disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
1665 wpa_msg(wpa_s, MSG_DEBUG,
1666 "Interworking: Reject connection to disallowed BSS "
1667 MACSTR, MAC2STR(bss->bssid));
1668 return -1;
1669 }
1670
1671 wpa_printf(MSG_DEBUG, "Interworking: Considering BSS " MACSTR
1672 " for connection",
1673 MAC2STR(bss->bssid));
1674
1675 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
1676 /*
1677 * We currently support only HS 2.0 networks and those are
1678 * required to use WPA2-Enterprise.
1679 */
1680 wpa_msg(wpa_s, MSG_DEBUG,
1681 "Interworking: Network does not use RSN");
1682 return -1;
1683 }
1684
1685 cred_rc = interworking_credentials_available_roaming_consortium(
1686 wpa_s, bss, 0, excl);
1687 if (cred_rc) {
1688 wpa_msg(wpa_s, MSG_DEBUG,
1689 "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d",
1690 cred_rc->priority, cred_rc->sp_priority);
1691 if (excl && !(*excl))
1692 excl = NULL;
1693 }
1694
1695 cred = interworking_credentials_available_realm(wpa_s, bss, 0, excl);
1696 if (cred) {
1697 wpa_msg(wpa_s, MSG_DEBUG,
1698 "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d",
1699 cred->priority, cred->sp_priority);
1700 if (excl && !(*excl))
1701 excl = NULL;
1702 }
1703
1704 cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss, 0,
1705 excl);
1706 if (cred_3gpp) {
1707 wpa_msg(wpa_s, MSG_DEBUG,
1708 "Interworking: Highest 3GPP matching credential priority %d sp_priority %d",
1709 cred_3gpp->priority, cred_3gpp->sp_priority);
1710 if (excl && !(*excl))
1711 excl = NULL;
1712 }
1713
1714 if (!cred_rc && !cred && !cred_3gpp) {
1715 wpa_msg(wpa_s, MSG_DEBUG,
1716 "Interworking: No full credential matches - consider options without BW(etc.) limits");
1717 cred_rc = interworking_credentials_available_roaming_consortium(
1718 wpa_s, bss, 1, excl);
1719 if (cred_rc) {
1720 wpa_msg(wpa_s, MSG_DEBUG,
1721 "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d (ignore BW)",
1722 cred_rc->priority, cred_rc->sp_priority);
1723 if (excl && !(*excl))
1724 excl = NULL;
1725 }
1726
1727 cred = interworking_credentials_available_realm(wpa_s, bss, 1,
1728 excl);
1729 if (cred) {
1730 wpa_msg(wpa_s, MSG_DEBUG,
1731 "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d (ignore BW)",
1732 cred->priority, cred->sp_priority);
1733 if (excl && !(*excl))
1734 excl = NULL;
1735 }
1736
1737 cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss,
1738 1, excl);
1739 if (cred_3gpp) {
1740 wpa_msg(wpa_s, MSG_DEBUG,
1741 "Interworking: Highest 3GPP matching credential priority %d sp_priority %d (ignore BW)",
1742 cred_3gpp->priority, cred_3gpp->sp_priority);
1743 if (excl && !(*excl))
1744 excl = NULL;
1745 }
1746 }
1747
1748 if (cred_rc &&
1749 (cred == NULL || cred_prio_cmp(cred_rc, cred) >= 0) &&
1750 (cred_3gpp == NULL || cred_prio_cmp(cred_rc, cred_3gpp) >= 0))
1751 return interworking_connect_roaming_consortium(wpa_s, cred_rc,
1752 bss, only_add);
1753
1754 if (cred_3gpp &&
1755 (cred == NULL || cred_prio_cmp(cred_3gpp, cred) >= 0)) {
1756 return interworking_connect_3gpp(wpa_s, cred_3gpp, bss,
1757 only_add);
1758 }
1759
1760 if (cred == NULL) {
1761 wpa_msg(wpa_s, MSG_DEBUG,
1762 "Interworking: No matching credentials found for "
1763 MACSTR, MAC2STR(bss->bssid));
1764 return -1;
1765 }
1766
1767 realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
1768 &count);
1769 if (realm == NULL) {
1770 wpa_msg(wpa_s, MSG_DEBUG,
1771 "Interworking: Could not parse NAI Realm list from "
1772 MACSTR, MAC2STR(bss->bssid));
1773 return -1;
1774 }
1775
1776 for (i = 0; i < count; i++) {
1777 if (!nai_realm_match(&realm[i], cred->realm))
1778 continue;
1779 eap = nai_realm_find_eap(wpa_s, cred, &realm[i]);
1780 if (eap)
1781 break;
1782 }
1783
1784 if (!eap) {
1785 wpa_msg(wpa_s, MSG_DEBUG,
1786 "Interworking: No matching credentials and EAP method found for "
1787 MACSTR, MAC2STR(bss->bssid));
1788 nai_realm_free(realm, count);
1789 return -1;
1790 }
1791
1792 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR,
1793 MAC2STR(bss->bssid));
1794
1795 if (already_connected(wpa_s, cred, bss)) {
1796 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1797 MAC2STR(bss->bssid));
1798 nai_realm_free(realm, count);
1799 return 0;
1800 }
1801
1802 remove_duplicate_network(wpa_s, cred, bss);
1803
1804 ssid = wpa_config_add_network(wpa_s->conf);
1805 if (ssid == NULL) {
1806 nai_realm_free(realm, count);
1807 return -1;
1808 }
1809 ssid->parent_cred = cred;
1810 wpas_notify_network_added(wpa_s, ssid);
1811 wpa_config_set_network_defaults(ssid);
1812 ssid->priority = cred->priority;
1813 ssid->temporary = 1;
1814 ssid->ssid = os_zalloc(bss->ssid_len + 1);
1815 if (ssid->ssid == NULL)
1816 goto fail;
1817 os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
1818 ssid->ssid_len = bss->ssid_len;
1819
1820 if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1821 goto fail;
1822
1823 if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
1824 eap->method), 0) < 0)
1825 goto fail;
1826
1827 switch (eap->method) {
1828 case EAP_TYPE_TTLS:
1829 if (eap->inner_method) {
1830 name = eap_get_name(EAP_VENDOR_IETF, eap->inner_method);
1831 if (!name)
1832 goto fail;
1833 os_snprintf(buf, sizeof(buf), "\"autheap=%s\"", name);
1834 if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1835 goto fail;
1836 break;
1837 }
1838 switch (eap->inner_non_eap) {
1839 case NAI_REALM_INNER_NON_EAP_PAP:
1840 if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
1841 0)
1842 goto fail;
1843 break;
1844 case NAI_REALM_INNER_NON_EAP_CHAP:
1845 if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
1846 < 0)
1847 goto fail;
1848 break;
1849 case NAI_REALM_INNER_NON_EAP_MSCHAP:
1850 if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
1851 0) < 0)
1852 goto fail;
1853 break;
1854 case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
1855 if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1856 0) < 0)
1857 goto fail;
1858 break;
1859 default:
1860 /* EAP params were not set - assume TTLS/MSCHAPv2 */
1861 if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1862 0) < 0)
1863 goto fail;
1864 break;
1865 }
1866 break;
1867 case EAP_TYPE_PEAP:
1868 case EAP_TYPE_FAST:
1869 if (wpa_config_set(ssid, "phase1", "\"fast_provisioning=2\"",
1870 0) < 0)
1871 goto fail;
1872 if (wpa_config_set(ssid, "pac_file",
1873 "\"blob://pac_interworking\"", 0) < 0)
1874 goto fail;
1875 name = eap_get_name(EAP_VENDOR_IETF,
1876 eap->inner_method ? eap->inner_method :
1877 EAP_TYPE_MSCHAPV2);
1878 if (name == NULL)
1879 goto fail;
1880 os_snprintf(buf, sizeof(buf), "\"auth=%s\"", name);
1881 if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1882 goto fail;
1883 break;
1884 case EAP_TYPE_TLS:
1885 break;
1886 }
1887
1888 if (interworking_set_eap_params(ssid, cred,
1889 eap->method == EAP_TYPE_TTLS) < 0)
1890 goto fail;
1891
1892 nai_realm_free(realm, count);
1893
1894 wpa_s->next_ssid = ssid;
1895 wpa_config_update_prio_list(wpa_s->conf);
1896 if (!only_add)
1897 interworking_reconnect(wpa_s);
1898
1899 return ssid->id;
1900
1901 fail:
1902 wpas_notify_network_removed(wpa_s, ssid);
1903 wpa_config_remove_network(wpa_s->conf, ssid->id);
1904 nai_realm_free(realm, count);
1905 return -1;
1906 }
1907
1908
1909 #ifdef PCSC_FUNCS
interworking_pcsc_read_imsi(struct wpa_supplicant * wpa_s)1910 static int interworking_pcsc_read_imsi(struct wpa_supplicant *wpa_s)
1911 {
1912 size_t len;
1913
1914 if (wpa_s->imsi[0] && wpa_s->mnc_len)
1915 return 0;
1916
1917 len = sizeof(wpa_s->imsi) - 1;
1918 if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
1919 scard_deinit(wpa_s->scard);
1920 wpa_s->scard = NULL;
1921 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
1922 return -1;
1923 }
1924 wpa_s->imsi[len] = '\0';
1925 wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
1926 wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
1927 wpa_s->imsi, wpa_s->mnc_len);
1928
1929 return 0;
1930 }
1931 #endif /* PCSC_FUNCS */
1932
1933
interworking_credentials_available_3gpp(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,int ignore_bw,int * excluded)1934 static struct wpa_cred * interworking_credentials_available_3gpp(
1935 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
1936 int *excluded)
1937 {
1938 struct wpa_cred *selected = NULL;
1939 #ifdef INTERWORKING_3GPP
1940 struct wpa_cred *cred;
1941 int ret;
1942 int is_excluded = 0;
1943
1944 if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL) {
1945 wpa_msg(wpa_s, MSG_DEBUG,
1946 "interworking-avail-3gpp: not avail, anqp: %p anqp_3gpp: %p",
1947 bss->anqp, bss->anqp ? bss->anqp->anqp_3gpp : NULL);
1948 return NULL;
1949 }
1950
1951 #ifdef CONFIG_EAP_PROXY
1952 if (!wpa_s->imsi[0]) {
1953 size_t len;
1954 wpa_msg(wpa_s, MSG_DEBUG,
1955 "Interworking: IMSI not available - try to read again through eap_proxy");
1956 wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, -1,
1957 wpa_s->imsi,
1958 &len);
1959 if (wpa_s->mnc_len > 0) {
1960 wpa_s->imsi[len] = '\0';
1961 wpa_msg(wpa_s, MSG_DEBUG,
1962 "eap_proxy: IMSI %s (MNC length %d)",
1963 wpa_s->imsi, wpa_s->mnc_len);
1964 } else {
1965 wpa_msg(wpa_s, MSG_DEBUG,
1966 "eap_proxy: IMSI not available");
1967 }
1968 }
1969 #endif /* CONFIG_EAP_PROXY */
1970
1971 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1972 char *sep;
1973 const char *imsi;
1974 int mnc_len;
1975 char imsi_buf[16];
1976 size_t msin_len;
1977
1978 #ifdef PCSC_FUNCS
1979 if (cred->pcsc && wpa_s->scard) {
1980 if (interworking_pcsc_read_imsi(wpa_s) < 0)
1981 continue;
1982 imsi = wpa_s->imsi;
1983 mnc_len = wpa_s->mnc_len;
1984 goto compare;
1985 }
1986 #endif /* PCSC_FUNCS */
1987 #ifdef CONFIG_EAP_PROXY
1988 if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
1989 imsi = wpa_s->imsi;
1990 mnc_len = wpa_s->mnc_len;
1991 goto compare;
1992 }
1993 #endif /* CONFIG_EAP_PROXY */
1994
1995 if (cred->imsi == NULL || !cred->imsi[0] ||
1996 (!wpa_s->conf->external_sim &&
1997 (cred->milenage == NULL || !cred->milenage[0])))
1998 continue;
1999
2000 sep = os_strchr(cred->imsi, '-');
2001 if (sep == NULL ||
2002 (sep - cred->imsi != 5 && sep - cred->imsi != 6))
2003 continue;
2004 mnc_len = sep - cred->imsi - 3;
2005 os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len);
2006 sep++;
2007 msin_len = os_strlen(cred->imsi);
2008 if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1)
2009 msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1;
2010 os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len);
2011 imsi_buf[3 + mnc_len + msin_len] = '\0';
2012 imsi = imsi_buf;
2013
2014 #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
2015 compare:
2016 #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
2017 wpa_msg(wpa_s, MSG_DEBUG,
2018 "Interworking: Parsing 3GPP info from " MACSTR,
2019 MAC2STR(bss->bssid));
2020 ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
2021 wpa_msg(wpa_s, MSG_DEBUG, "PLMN match %sfound",
2022 ret ? "" : "not ");
2023 if (ret) {
2024 if (cred_no_required_oi_match(cred, bss))
2025 continue;
2026 if (!ignore_bw &&
2027 cred_below_min_backhaul(wpa_s, cred, bss))
2028 continue;
2029 if (!ignore_bw &&
2030 cred_over_max_bss_load(wpa_s, cred, bss))
2031 continue;
2032 if (!ignore_bw &&
2033 cred_conn_capab_missing(wpa_s, cred, bss))
2034 continue;
2035 if (cred_excluded_ssid(cred, bss)) {
2036 if (excluded == NULL)
2037 continue;
2038 if (selected == NULL) {
2039 selected = cred;
2040 is_excluded = 1;
2041 }
2042 } else {
2043 if (selected == NULL || is_excluded ||
2044 cred_prio_cmp(selected, cred) < 0) {
2045 selected = cred;
2046 is_excluded = 0;
2047 }
2048 }
2049 }
2050 }
2051
2052 if (excluded)
2053 *excluded = is_excluded;
2054 #endif /* INTERWORKING_3GPP */
2055 return selected;
2056 }
2057
2058
interworking_credentials_available_realm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,int ignore_bw,int * excluded)2059 static struct wpa_cred * interworking_credentials_available_realm(
2060 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
2061 int *excluded)
2062 {
2063 struct wpa_cred *cred, *selected = NULL;
2064 struct nai_realm *realm;
2065 u16 count, i;
2066 int is_excluded = 0;
2067
2068 if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
2069 return NULL;
2070
2071 if (wpa_s->conf->cred == NULL)
2072 return NULL;
2073
2074 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
2075 MACSTR, MAC2STR(bss->bssid));
2076 realm = nai_realm_parse(bss->anqp->nai_realm, &count);
2077 if (realm == NULL) {
2078 wpa_msg(wpa_s, MSG_DEBUG,
2079 "Interworking: Could not parse NAI Realm list from "
2080 MACSTR, MAC2STR(bss->bssid));
2081 return NULL;
2082 }
2083
2084 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2085 if (cred->realm == NULL)
2086 continue;
2087
2088 for (i = 0; i < count; i++) {
2089 if (!nai_realm_match(&realm[i], cred->realm))
2090 continue;
2091 if (nai_realm_find_eap(wpa_s, cred, &realm[i])) {
2092 if (cred_no_required_oi_match(cred, bss))
2093 continue;
2094 if (!ignore_bw &&
2095 cred_below_min_backhaul(wpa_s, cred, bss))
2096 continue;
2097 if (!ignore_bw &&
2098 cred_over_max_bss_load(wpa_s, cred, bss))
2099 continue;
2100 if (!ignore_bw &&
2101 cred_conn_capab_missing(wpa_s, cred, bss))
2102 continue;
2103 if (cred_excluded_ssid(cred, bss)) {
2104 if (excluded == NULL)
2105 continue;
2106 if (selected == NULL) {
2107 selected = cred;
2108 is_excluded = 1;
2109 }
2110 } else {
2111 if (selected == NULL || is_excluded ||
2112 cred_prio_cmp(selected, cred) < 0)
2113 {
2114 selected = cred;
2115 is_excluded = 0;
2116 }
2117 }
2118 break;
2119 } else {
2120 wpa_msg(wpa_s, MSG_DEBUG,
2121 "Interworking: realm-find-eap returned false");
2122 }
2123 }
2124 }
2125
2126 nai_realm_free(realm, count);
2127
2128 if (excluded)
2129 *excluded = is_excluded;
2130
2131 return selected;
2132 }
2133
2134
interworking_credentials_available_helper(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,int ignore_bw,int * excluded)2135 static struct wpa_cred * interworking_credentials_available_helper(
2136 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
2137 int *excluded)
2138 {
2139 struct wpa_cred *cred, *cred2;
2140 int excluded1, excluded2 = 0;
2141
2142 if (disallowed_bssid(wpa_s, bss->bssid) ||
2143 disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
2144 wpa_printf(MSG_DEBUG, "Interworking: Ignore disallowed BSS "
2145 MACSTR, MAC2STR(bss->bssid));
2146 return NULL;
2147 }
2148
2149 cred = interworking_credentials_available_realm(wpa_s, bss, ignore_bw,
2150 &excluded1);
2151 cred2 = interworking_credentials_available_3gpp(wpa_s, bss, ignore_bw,
2152 &excluded2);
2153 if (cred && cred2 &&
2154 (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
2155 cred = cred2;
2156 excluded1 = excluded2;
2157 }
2158 if (!cred) {
2159 cred = cred2;
2160 excluded1 = excluded2;
2161 }
2162
2163 cred2 = interworking_credentials_available_roaming_consortium(
2164 wpa_s, bss, ignore_bw, &excluded2);
2165 if (cred && cred2 &&
2166 (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
2167 cred = cred2;
2168 excluded1 = excluded2;
2169 }
2170 if (!cred) {
2171 cred = cred2;
2172 excluded1 = excluded2;
2173 }
2174
2175 if (excluded)
2176 *excluded = excluded1;
2177 return cred;
2178 }
2179
2180
interworking_credentials_available(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,int * excluded)2181 static struct wpa_cred * interworking_credentials_available(
2182 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int *excluded)
2183 {
2184 struct wpa_cred *cred;
2185
2186 if (excluded)
2187 *excluded = 0;
2188 cred = interworking_credentials_available_helper(wpa_s, bss, 0,
2189 excluded);
2190 if (cred)
2191 return cred;
2192 return interworking_credentials_available_helper(wpa_s, bss, 1,
2193 excluded);
2194 }
2195
2196
domain_name_list_contains(struct wpabuf * domain_names,const char * domain,int exact_match)2197 int domain_name_list_contains(struct wpabuf *domain_names,
2198 const char *domain, int exact_match)
2199 {
2200 const u8 *pos, *end;
2201 size_t len;
2202
2203 len = os_strlen(domain);
2204 pos = wpabuf_head(domain_names);
2205 end = pos + wpabuf_len(domain_names);
2206
2207 while (end - pos > 1) {
2208 u8 elen;
2209
2210 elen = *pos++;
2211 if (elen > end - pos)
2212 break;
2213
2214 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
2215 pos, elen);
2216 if (elen == len &&
2217 os_strncasecmp(domain, (const char *) pos, len) == 0)
2218 return 1;
2219 if (!exact_match && elen > len && pos[elen - len - 1] == '.') {
2220 const char *ap = (const char *) pos;
2221 int offset = elen - len;
2222
2223 if (os_strncasecmp(domain, ap + offset, len) == 0)
2224 return 1;
2225 }
2226
2227 pos += elen;
2228 }
2229
2230 return 0;
2231 }
2232
2233
interworking_home_sp_cred(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpabuf * domain_names)2234 int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
2235 struct wpa_cred *cred,
2236 struct wpabuf *domain_names)
2237 {
2238 size_t i;
2239 int ret = -1;
2240 #ifdef INTERWORKING_3GPP
2241 char nai[100], *realm;
2242
2243 char *imsi = NULL;
2244 int mnc_len = 0;
2245 if (cred->imsi)
2246 imsi = cred->imsi;
2247 #ifdef PCSC_FUNCS
2248 else if (cred->pcsc && wpa_s->scard) {
2249 if (interworking_pcsc_read_imsi(wpa_s) < 0)
2250 return -1;
2251 imsi = wpa_s->imsi;
2252 mnc_len = wpa_s->mnc_len;
2253 }
2254 #endif /* PCSC_FUNCS */
2255 #ifdef CONFIG_EAP_PROXY
2256 else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
2257 imsi = wpa_s->imsi;
2258 mnc_len = wpa_s->mnc_len;
2259 }
2260 #endif /* CONFIG_EAP_PROXY */
2261 if (domain_names &&
2262 imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
2263 realm = os_strchr(nai, '@');
2264 if (realm)
2265 realm++;
2266 wpa_msg(wpa_s, MSG_DEBUG,
2267 "Interworking: Search for match with SIM/USIM domain %s",
2268 realm ? realm : "[NULL]");
2269 if (realm &&
2270 domain_name_list_contains(domain_names, realm, 1))
2271 return 1;
2272 if (realm)
2273 ret = 0;
2274 }
2275 #endif /* INTERWORKING_3GPP */
2276
2277 if (domain_names == NULL || cred->domain == NULL)
2278 return ret;
2279
2280 for (i = 0; i < cred->num_domain; i++) {
2281 wpa_msg(wpa_s, MSG_DEBUG,
2282 "Interworking: Search for match with home SP FQDN %s",
2283 cred->domain[i]);
2284 if (domain_name_list_contains(domain_names, cred->domain[i], 1))
2285 return 1;
2286 }
2287
2288 return 0;
2289 }
2290
2291
interworking_home_sp(struct wpa_supplicant * wpa_s,struct wpabuf * domain_names)2292 static int interworking_home_sp(struct wpa_supplicant *wpa_s,
2293 struct wpabuf *domain_names)
2294 {
2295 struct wpa_cred *cred;
2296
2297 if (domain_names == NULL || wpa_s->conf->cred == NULL)
2298 return -1;
2299
2300 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2301 int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
2302 if (res)
2303 return res;
2304 }
2305
2306 return 0;
2307 }
2308
2309
interworking_find_network_match(struct wpa_supplicant * wpa_s)2310 static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
2311 {
2312 struct wpa_bss *bss;
2313 struct wpa_ssid *ssid;
2314
2315 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2316 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
2317 if (wpas_network_disabled(wpa_s, ssid) ||
2318 ssid->mode != WPAS_MODE_INFRA)
2319 continue;
2320 if (ssid->ssid_len != bss->ssid_len ||
2321 os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
2322 0)
2323 continue;
2324 /*
2325 * TODO: Consider more accurate matching of security
2326 * configuration similarly to what is done in events.c
2327 */
2328 return 1;
2329 }
2330 }
2331
2332 return 0;
2333 }
2334
2335
roaming_partner_match(struct wpa_supplicant * wpa_s,struct roaming_partner * partner,struct wpabuf * domain_names)2336 static int roaming_partner_match(struct wpa_supplicant *wpa_s,
2337 struct roaming_partner *partner,
2338 struct wpabuf *domain_names)
2339 {
2340 wpa_printf(MSG_DEBUG, "Interworking: Comparing roaming_partner info fqdn='%s' exact_match=%d priority=%u country='%s'",
2341 partner->fqdn, partner->exact_match, partner->priority,
2342 partner->country);
2343 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: Domain names",
2344 wpabuf_head(domain_names),
2345 wpabuf_len(domain_names));
2346 if (!domain_name_list_contains(domain_names, partner->fqdn,
2347 partner->exact_match))
2348 return 0;
2349 /* TODO: match Country */
2350 return 1;
2351 }
2352
2353
roaming_prio(struct wpa_supplicant * wpa_s,struct wpa_cred * cred,struct wpa_bss * bss)2354 static u8 roaming_prio(struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
2355 struct wpa_bss *bss)
2356 {
2357 size_t i;
2358
2359 if (bss->anqp == NULL || bss->anqp->domain_name == NULL) {
2360 wpa_printf(MSG_DEBUG, "Interworking: No ANQP domain name info -> use default roaming partner priority 128");
2361 return 128; /* cannot check preference with domain name */
2362 }
2363
2364 if (interworking_home_sp_cred(wpa_s, cred, bss->anqp->domain_name) > 0)
2365 {
2366 wpa_printf(MSG_DEBUG, "Interworking: Determined to be home SP -> use maximum preference 0 as roaming partner priority");
2367 return 0; /* max preference for home SP network */
2368 }
2369
2370 for (i = 0; i < cred->num_roaming_partner; i++) {
2371 if (roaming_partner_match(wpa_s, &cred->roaming_partner[i],
2372 bss->anqp->domain_name)) {
2373 wpa_printf(MSG_DEBUG, "Interworking: Roaming partner preference match - priority %u",
2374 cred->roaming_partner[i].priority);
2375 return cred->roaming_partner[i].priority;
2376 }
2377 }
2378
2379 wpa_printf(MSG_DEBUG, "Interworking: No roaming partner preference match - use default roaming partner priority 128");
2380 return 128;
2381 }
2382
2383
pick_best_roaming_partner(struct wpa_supplicant * wpa_s,struct wpa_bss * selected,struct wpa_cred * cred)2384 static struct wpa_bss * pick_best_roaming_partner(struct wpa_supplicant *wpa_s,
2385 struct wpa_bss *selected,
2386 struct wpa_cred *cred)
2387 {
2388 struct wpa_bss *bss;
2389 u8 best_prio, prio;
2390 struct wpa_cred *cred2;
2391
2392 /*
2393 * Check if any other BSS is operated by a more preferred roaming
2394 * partner.
2395 */
2396
2397 best_prio = roaming_prio(wpa_s, cred, selected);
2398 wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for selected BSS "
2399 MACSTR " (cred=%d)", best_prio, MAC2STR(selected->bssid),
2400 cred->id);
2401
2402 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2403 if (bss == selected)
2404 continue;
2405 cred2 = interworking_credentials_available(wpa_s, bss, NULL);
2406 if (!cred2)
2407 continue;
2408 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN))
2409 continue;
2410 prio = roaming_prio(wpa_s, cred2, bss);
2411 wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for BSS "
2412 MACSTR " (cred=%d)", prio, MAC2STR(bss->bssid),
2413 cred2->id);
2414 if (prio < best_prio) {
2415 int bh1, bh2, load1, load2, conn1, conn2;
2416 bh1 = cred_below_min_backhaul(wpa_s, cred, selected);
2417 load1 = cred_over_max_bss_load(wpa_s, cred, selected);
2418 conn1 = cred_conn_capab_missing(wpa_s, cred, selected);
2419 bh2 = cred_below_min_backhaul(wpa_s, cred2, bss);
2420 load2 = cred_over_max_bss_load(wpa_s, cred2, bss);
2421 conn2 = cred_conn_capab_missing(wpa_s, cred2, bss);
2422 wpa_printf(MSG_DEBUG, "Interworking: old: %d %d %d new: %d %d %d",
2423 bh1, load1, conn1, bh2, load2, conn2);
2424 if (bh1 || load1 || conn1 || !(bh2 || load2 || conn2)) {
2425 wpa_printf(MSG_DEBUG, "Interworking: Better roaming partner " MACSTR " selected", MAC2STR(bss->bssid));
2426 best_prio = prio;
2427 selected = bss;
2428 }
2429 }
2430 }
2431
2432 return selected;
2433 }
2434
2435
interworking_select_network(struct wpa_supplicant * wpa_s)2436 static void interworking_select_network(struct wpa_supplicant *wpa_s)
2437 {
2438 struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
2439 struct wpa_bss *selected2 = NULL, *selected2_home = NULL;
2440 unsigned int count = 0;
2441 const char *type;
2442 int res;
2443 struct wpa_cred *cred, *selected_cred = NULL;
2444 struct wpa_cred *selected_home_cred = NULL;
2445 struct wpa_cred *selected2_cred = NULL;
2446 struct wpa_cred *selected2_home_cred = NULL;
2447
2448 wpa_s->network_select = 0;
2449
2450 wpa_printf(MSG_DEBUG, "Interworking: Select network (auto_select=%d)",
2451 wpa_s->auto_select);
2452 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2453 int excluded = 0;
2454 int bh, bss_load, conn_capab;
2455 cred = interworking_credentials_available(wpa_s, bss,
2456 &excluded);
2457 if (!cred)
2458 continue;
2459
2460 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
2461 /*
2462 * We currently support only HS 2.0 networks and those
2463 * are required to use WPA2-Enterprise.
2464 */
2465 wpa_msg(wpa_s, MSG_DEBUG,
2466 "Interworking: Credential match with " MACSTR
2467 " but network does not use RSN",
2468 MAC2STR(bss->bssid));
2469 continue;
2470 }
2471 if (!excluded)
2472 count++;
2473 res = interworking_home_sp(wpa_s, bss->anqp ?
2474 bss->anqp->domain_name : NULL);
2475 if (res > 0)
2476 type = "home";
2477 else if (res == 0)
2478 type = "roaming";
2479 else
2480 type = "unknown";
2481 bh = cred_below_min_backhaul(wpa_s, cred, bss);
2482 bss_load = cred_over_max_bss_load(wpa_s, cred, bss);
2483 conn_capab = cred_conn_capab_missing(wpa_s, cred, bss);
2484 wpa_msg(wpa_s, MSG_INFO, "%s" MACSTR " type=%s%s%s%s id=%d priority=%d sp_priority=%d",
2485 excluded ? INTERWORKING_EXCLUDED : INTERWORKING_AP,
2486 MAC2STR(bss->bssid), type,
2487 bh ? " below_min_backhaul=1" : "",
2488 bss_load ? " over_max_bss_load=1" : "",
2489 conn_capab ? " conn_capab_missing=1" : "",
2490 cred->id, cred->priority, cred->sp_priority);
2491 if (excluded)
2492 continue;
2493 if (wpa_s->auto_select ||
2494 (wpa_s->conf->auto_interworking &&
2495 wpa_s->auto_network_select)) {
2496 if (bh || bss_load || conn_capab) {
2497 if (selected2_cred == NULL ||
2498 cred_prio_cmp(cred, selected2_cred) > 0) {
2499 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2");
2500 selected2 = bss;
2501 selected2_cred = cred;
2502 }
2503 if (res > 0 &&
2504 (selected2_home_cred == NULL ||
2505 cred_prio_cmp(cred, selected2_home_cred) >
2506 0)) {
2507 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2_home");
2508 selected2_home = bss;
2509 selected2_home_cred = cred;
2510 }
2511 } else {
2512 if (selected_cred == NULL ||
2513 cred_prio_cmp(cred, selected_cred) > 0) {
2514 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected");
2515 selected = bss;
2516 selected_cred = cred;
2517 }
2518 if (res > 0 &&
2519 (selected_home_cred == NULL ||
2520 cred_prio_cmp(cred, selected_home_cred) >
2521 0)) {
2522 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected_home");
2523 selected_home = bss;
2524 selected_home_cred = cred;
2525 }
2526 }
2527 }
2528 }
2529
2530 if (selected_home && selected_home != selected &&
2531 selected_home_cred &&
2532 (selected_cred == NULL ||
2533 cred_prio_cmp(selected_home_cred, selected_cred) >= 0)) {
2534 /* Prefer network operated by the Home SP */
2535 wpa_printf(MSG_DEBUG, "Interworking: Overrode selected with selected_home");
2536 selected = selected_home;
2537 selected_cred = selected_home_cred;
2538 }
2539
2540 if (!selected) {
2541 if (selected2_home) {
2542 wpa_printf(MSG_DEBUG, "Interworking: Use home BSS with BW limit mismatch since no other network could be selected");
2543 selected = selected2_home;
2544 selected_cred = selected2_home_cred;
2545 } else if (selected2) {
2546 wpa_printf(MSG_DEBUG, "Interworking: Use visited BSS with BW limit mismatch since no other network could be selected");
2547 selected = selected2;
2548 selected_cred = selected2_cred;
2549 }
2550 }
2551
2552 if (count == 0) {
2553 /*
2554 * No matching network was found based on configured
2555 * credentials. Check whether any of the enabled network blocks
2556 * have matching APs.
2557 */
2558 if (interworking_find_network_match(wpa_s)) {
2559 wpa_msg(wpa_s, MSG_DEBUG,
2560 "Interworking: Possible BSS match for enabled network configurations");
2561 if (wpa_s->auto_select) {
2562 interworking_reconnect(wpa_s);
2563 return;
2564 }
2565 }
2566
2567 if (wpa_s->auto_network_select) {
2568 wpa_msg(wpa_s, MSG_DEBUG,
2569 "Interworking: Continue scanning after ANQP fetch");
2570 wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
2571 0);
2572 return;
2573 }
2574
2575 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
2576 "with matching credentials found");
2577 if (wpa_s->wpa_state == WPA_SCANNING)
2578 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2579 }
2580
2581 if (selected) {
2582 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR,
2583 MAC2STR(selected->bssid));
2584 selected = pick_best_roaming_partner(wpa_s, selected,
2585 selected_cred);
2586 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR
2587 " (after best roaming partner selection)",
2588 MAC2STR(selected->bssid));
2589 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_SELECTED MACSTR,
2590 MAC2STR(selected->bssid));
2591 interworking_connect(wpa_s, selected, 0);
2592 } else if (wpa_s->wpa_state == WPA_SCANNING)
2593 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2594 }
2595
2596
2597 static struct wpa_bss_anqp *
interworking_match_anqp_info(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)2598 interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
2599 {
2600 struct wpa_bss *other;
2601
2602 if (is_zero_ether_addr(bss->hessid))
2603 return NULL; /* Cannot be in the same homegenous ESS */
2604
2605 dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
2606 if (other == bss)
2607 continue;
2608 if (other->anqp == NULL)
2609 continue;
2610 if (other->anqp->roaming_consortium == NULL &&
2611 other->anqp->nai_realm == NULL &&
2612 other->anqp->anqp_3gpp == NULL &&
2613 other->anqp->domain_name == NULL)
2614 continue;
2615 if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
2616 continue;
2617 if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
2618 continue;
2619 if (bss->ssid_len != other->ssid_len ||
2620 os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
2621 continue;
2622
2623 wpa_msg(wpa_s, MSG_DEBUG,
2624 "Interworking: Share ANQP data with already fetched BSSID "
2625 MACSTR " and " MACSTR,
2626 MAC2STR(other->bssid), MAC2STR(bss->bssid));
2627 other->anqp->users++;
2628 return other->anqp;
2629 }
2630
2631 return NULL;
2632 }
2633
2634
interworking_next_anqp_fetch(struct wpa_supplicant * wpa_s)2635 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
2636 {
2637 struct wpa_bss *bss;
2638 int found = 0;
2639
2640 wpa_printf(MSG_DEBUG, "Interworking: next_anqp_fetch - "
2641 "fetch_anqp_in_progress=%d fetch_osu_icon_in_progress=%d",
2642 wpa_s->fetch_anqp_in_progress,
2643 wpa_s->fetch_osu_icon_in_progress);
2644
2645 if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress) {
2646 wpa_printf(MSG_DEBUG, "Interworking: Stop next-ANQP-fetch");
2647 return;
2648 }
2649
2650 #ifdef CONFIG_HS20
2651 if (wpa_s->fetch_osu_icon_in_progress) {
2652 wpa_printf(MSG_DEBUG, "Interworking: Next icon (in progress)");
2653 hs20_next_osu_icon(wpa_s);
2654 return;
2655 }
2656 #endif /* CONFIG_HS20 */
2657
2658 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
2659 if (!(bss->caps & IEEE80211_CAP_ESS))
2660 continue;
2661 if (!wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_INTERWORKING))
2662 continue; /* AP does not support Interworking */
2663 if (disallowed_bssid(wpa_s, bss->bssid) ||
2664 disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len))
2665 continue; /* Disallowed BSS */
2666
2667 if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
2668 if (bss->anqp == NULL) {
2669 bss->anqp = interworking_match_anqp_info(wpa_s,
2670 bss);
2671 if (bss->anqp) {
2672 /* Shared data already fetched */
2673 continue;
2674 }
2675 bss->anqp = wpa_bss_anqp_alloc();
2676 if (bss->anqp == NULL)
2677 break;
2678 }
2679 found++;
2680 bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
2681 wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
2682 MACSTR " (HESSID " MACSTR ")",
2683 MAC2STR(bss->bssid), MAC2STR(bss->hessid));
2684 interworking_anqp_send_req(wpa_s, bss);
2685 break;
2686 }
2687 }
2688
2689 if (found == 0) {
2690 #ifdef CONFIG_HS20
2691 if (wpa_s->fetch_osu_info) {
2692 if (wpa_s->num_prov_found == 0 &&
2693 wpa_s->fetch_osu_waiting_scan &&
2694 wpa_s->num_osu_scans < 3) {
2695 wpa_printf(MSG_DEBUG, "HS 2.0: No OSU providers seen - try to scan again");
2696 hs20_start_osu_scan(wpa_s);
2697 return;
2698 }
2699 wpa_printf(MSG_DEBUG, "Interworking: Next icon");
2700 hs20_osu_icon_fetch(wpa_s);
2701 return;
2702 }
2703 #endif /* CONFIG_HS20 */
2704 wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
2705 wpa_s->fetch_anqp_in_progress = 0;
2706 if (wpa_s->network_select)
2707 interworking_select_network(wpa_s);
2708 }
2709 }
2710
2711
interworking_start_fetch_anqp(struct wpa_supplicant * wpa_s)2712 void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
2713 {
2714 struct wpa_bss *bss;
2715
2716 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
2717 bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
2718
2719 wpa_s->fetch_anqp_in_progress = 1;
2720
2721 /*
2722 * Start actual ANQP operation from eloop call to make sure the loop
2723 * does not end up using excessive recursion.
2724 */
2725 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s, NULL);
2726 }
2727
2728
interworking_fetch_anqp(struct wpa_supplicant * wpa_s)2729 int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
2730 {
2731 if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
2732 return 0;
2733
2734 wpa_s->network_select = 0;
2735 wpa_s->fetch_all_anqp = 1;
2736 wpa_s->fetch_osu_info = 0;
2737
2738 interworking_start_fetch_anqp(wpa_s);
2739
2740 return 0;
2741 }
2742
2743
interworking_stop_fetch_anqp(struct wpa_supplicant * wpa_s)2744 void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
2745 {
2746 if (!wpa_s->fetch_anqp_in_progress)
2747 return;
2748
2749 wpa_s->fetch_anqp_in_progress = 0;
2750 }
2751
2752
anqp_send_req(struct wpa_supplicant * wpa_s,const u8 * dst,int freq,u16 info_ids[],size_t num_ids,u32 subtypes,u32 mbo_subtypes)2753 int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, int freq,
2754 u16 info_ids[], size_t num_ids, u32 subtypes,
2755 u32 mbo_subtypes)
2756 {
2757 struct wpabuf *buf;
2758 struct wpabuf *extra_buf = NULL;
2759 int ret = 0;
2760 struct wpa_bss *bss;
2761 int res;
2762
2763 bss = wpa_bss_get_bssid(wpa_s, dst);
2764 if (!bss && !freq) {
2765 wpa_printf(MSG_WARNING,
2766 "ANQP: Cannot send query without BSS freq info");
2767 return -1;
2768 }
2769
2770 if (bss)
2771 wpa_bss_anqp_unshare_alloc(bss);
2772 if (bss && !freq)
2773 freq = bss->freq;
2774
2775 wpa_msg(wpa_s, MSG_DEBUG,
2776 "ANQP: Query Request to " MACSTR " for %u id(s)",
2777 MAC2STR(dst), (unsigned int) num_ids);
2778
2779 #ifdef CONFIG_HS20
2780 if (subtypes != 0) {
2781 extra_buf = wpabuf_alloc(100);
2782 if (extra_buf == NULL)
2783 return -1;
2784 hs20_put_anqp_req(subtypes, NULL, 0, extra_buf);
2785 }
2786 #endif /* CONFIG_HS20 */
2787
2788 #ifdef CONFIG_MBO
2789 if (mbo_subtypes) {
2790 struct wpabuf *mbo;
2791
2792 if (!bss) {
2793 wpa_printf(MSG_WARNING,
2794 "ANQP: Cannot send MBO query to unknown BSS "
2795 MACSTR, MAC2STR(dst));
2796 wpabuf_free(extra_buf);
2797 return -1;
2798 }
2799
2800 mbo = mbo_build_anqp_buf(wpa_s, bss, mbo_subtypes);
2801 if (mbo) {
2802 if (wpabuf_resize(&extra_buf, wpabuf_len(mbo))) {
2803 wpabuf_free(extra_buf);
2804 wpabuf_free(mbo);
2805 return -1;
2806 }
2807 wpabuf_put_buf(extra_buf, mbo);
2808 wpabuf_free(mbo);
2809 }
2810 }
2811 #endif /* CONFIG_MBO */
2812
2813 buf = anqp_build_req(info_ids, num_ids, extra_buf);
2814 wpabuf_free(extra_buf);
2815 if (buf == NULL)
2816 return -1;
2817
2818 res = gas_query_req(wpa_s->gas, dst, freq, 0, 0, buf, anqp_resp_cb,
2819 wpa_s);
2820 if (res < 0) {
2821 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
2822 wpabuf_free(buf);
2823 ret = -1;
2824 } else {
2825 wpa_msg(wpa_s, MSG_DEBUG,
2826 "ANQP: Query started with dialog token %u", res);
2827 }
2828
2829 return ret;
2830 }
2831
2832
anqp_add_extra(struct wpa_supplicant * wpa_s,struct wpa_bss_anqp * anqp,u16 info_id,const u8 * data,size_t slen,bool protected_response)2833 static void anqp_add_extra(struct wpa_supplicant *wpa_s,
2834 struct wpa_bss_anqp *anqp, u16 info_id,
2835 const u8 *data, size_t slen, bool protected_response)
2836 {
2837 struct wpa_bss_anqp_elem *tmp, *elem = NULL;
2838
2839 if (!anqp)
2840 return;
2841
2842 dl_list_for_each(tmp, &anqp->anqp_elems, struct wpa_bss_anqp_elem,
2843 list) {
2844 if (tmp->infoid == info_id) {
2845 elem = tmp;
2846 break;
2847 }
2848 }
2849
2850 if (!elem) {
2851 elem = os_zalloc(sizeof(*elem));
2852 if (!elem)
2853 return;
2854 elem->infoid = info_id;
2855 dl_list_add(&anqp->anqp_elems, &elem->list);
2856 } else {
2857 wpabuf_free(elem->payload);
2858 }
2859
2860 elem->protected_response = protected_response;
2861 elem->payload = wpabuf_alloc_copy(data, slen);
2862 if (!elem->payload) {
2863 dl_list_del(&elem->list);
2864 os_free(elem);
2865 }
2866 }
2867
2868
interworking_parse_venue_url(struct wpa_supplicant * wpa_s,const u8 * data,size_t len)2869 static void interworking_parse_venue_url(struct wpa_supplicant *wpa_s,
2870 const u8 *data, size_t len)
2871 {
2872 const u8 *pos = data, *end = data + len;
2873 char url[255];
2874
2875 while (end - pos >= 2) {
2876 u8 slen, num;
2877
2878 slen = *pos++;
2879 if (slen < 1 || slen > end - pos) {
2880 wpa_printf(MSG_DEBUG,
2881 "ANQP: Truncated Venue URL Duple field");
2882 return;
2883 }
2884
2885 num = *pos++;
2886 os_memcpy(url, pos, slen - 1);
2887 url[slen - 1] = '\0';
2888 wpa_msg(wpa_s, MSG_INFO, RX_VENUE_URL "%u %s", num, url);
2889 pos += slen - 1;
2890 }
2891 }
2892
2893
interworking_parse_rx_anqp_resp(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,const u8 * sa,u16 info_id,const u8 * data,size_t slen,u8 dialog_token)2894 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
2895 struct wpa_bss *bss, const u8 *sa,
2896 u16 info_id,
2897 const u8 *data, size_t slen,
2898 u8 dialog_token)
2899 {
2900 const u8 *pos = data;
2901 struct wpa_bss_anqp *anqp = NULL;
2902 u8 type;
2903 bool protected_response;
2904
2905 if (bss)
2906 anqp = bss->anqp;
2907
2908 switch (info_id) {
2909 case ANQP_CAPABILITY_LIST:
2910 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2911 " ANQP Capability list", MAC2STR(sa));
2912 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Capability list",
2913 pos, slen);
2914 if (anqp) {
2915 wpabuf_free(anqp->capability_list);
2916 anqp->capability_list = wpabuf_alloc_copy(pos, slen);
2917 }
2918 break;
2919 case ANQP_VENUE_NAME:
2920 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2921 " Venue Name", MAC2STR(sa));
2922 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
2923 if (anqp) {
2924 wpabuf_free(anqp->venue_name);
2925 anqp->venue_name = wpabuf_alloc_copy(pos, slen);
2926 }
2927 break;
2928 case ANQP_NETWORK_AUTH_TYPE:
2929 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2930 " Network Authentication Type information",
2931 MAC2STR(sa));
2932 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
2933 "Type", pos, slen);
2934 if (anqp) {
2935 wpabuf_free(anqp->network_auth_type);
2936 anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
2937 }
2938 break;
2939 case ANQP_ROAMING_CONSORTIUM:
2940 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2941 " Roaming Consortium list", MAC2STR(sa));
2942 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
2943 pos, slen);
2944 if (anqp) {
2945 wpabuf_free(anqp->roaming_consortium);
2946 anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
2947 }
2948 break;
2949 case ANQP_IP_ADDR_TYPE_AVAILABILITY:
2950 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2951 " IP Address Type Availability information",
2952 MAC2STR(sa));
2953 wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
2954 pos, slen);
2955 if (anqp) {
2956 wpabuf_free(anqp->ip_addr_type_availability);
2957 anqp->ip_addr_type_availability =
2958 wpabuf_alloc_copy(pos, slen);
2959 }
2960 break;
2961 case ANQP_NAI_REALM:
2962 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2963 " NAI Realm list", MAC2STR(sa));
2964 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
2965 if (anqp) {
2966 wpabuf_free(anqp->nai_realm);
2967 anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
2968 }
2969 break;
2970 case ANQP_3GPP_CELLULAR_NETWORK:
2971 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2972 " 3GPP Cellular Network information", MAC2STR(sa));
2973 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
2974 pos, slen);
2975 if (anqp) {
2976 wpabuf_free(anqp->anqp_3gpp);
2977 anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
2978 }
2979 break;
2980 case ANQP_DOMAIN_NAME:
2981 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2982 " Domain Name list", MAC2STR(sa));
2983 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
2984 if (anqp) {
2985 wpabuf_free(anqp->domain_name);
2986 anqp->domain_name = wpabuf_alloc_copy(pos, slen);
2987 }
2988 break;
2989 #ifdef CONFIG_FILS
2990 case ANQP_FILS_REALM_INFO:
2991 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR
2992 " FILS Realm Information", MAC2STR(sa));
2993 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: FILS Realm Information",
2994 pos, slen);
2995 if (anqp) {
2996 wpabuf_free(anqp->fils_realm_info);
2997 anqp->fils_realm_info = wpabuf_alloc_copy(pos, slen);
2998 }
2999 break;
3000 #endif /* CONFIG_FILS */
3001 case ANQP_VENUE_URL:
3002 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR " Venue URL",
3003 MAC2STR(sa));
3004 protected_response = pmf_in_use(wpa_s, sa);
3005 anqp_add_extra(wpa_s, anqp, info_id, pos, slen,
3006 protected_response);
3007
3008 if (!protected_response) {
3009 wpa_printf(MSG_DEBUG,
3010 "ANQP: Ignore Venue URL since PMF was not enabled");
3011 break;
3012 }
3013 interworking_parse_venue_url(wpa_s, pos, slen);
3014 break;
3015 case ANQP_VENDOR_SPECIFIC:
3016 if (slen < 3)
3017 return;
3018
3019 switch (WPA_GET_BE24(pos)) {
3020 case OUI_WFA:
3021 pos += 3;
3022 slen -= 3;
3023
3024 if (slen < 1)
3025 return;
3026 type = *pos++;
3027 slen--;
3028
3029 switch (type) {
3030 #ifdef CONFIG_HS20
3031 case HS20_ANQP_OUI_TYPE:
3032 hs20_parse_rx_hs20_anqp_resp(wpa_s, bss, sa,
3033 pos, slen,
3034 dialog_token);
3035 break;
3036 #endif /* CONFIG_HS20 */
3037 #ifdef CONFIG_MBO
3038 case MBO_ANQP_OUI_TYPE:
3039 mbo_parse_rx_anqp_resp(wpa_s, bss, sa,
3040 pos, slen);
3041 break;
3042 #endif /* CONFIG_MBO */
3043 default:
3044 wpa_msg(wpa_s, MSG_DEBUG,
3045 "ANQP: Unsupported ANQP vendor type %u",
3046 type);
3047 break;
3048 }
3049 break;
3050 default:
3051 wpa_msg(wpa_s, MSG_DEBUG,
3052 "Interworking: Unsupported vendor-specific ANQP OUI %06x",
3053 WPA_GET_BE24(pos));
3054 return;
3055 }
3056 break;
3057 default:
3058 wpa_msg(wpa_s, MSG_DEBUG,
3059 "Interworking: Unsupported ANQP Info ID %u", info_id);
3060 anqp_add_extra(wpa_s, anqp, info_id, data, slen,
3061 pmf_in_use(wpa_s, sa));
3062 break;
3063 }
3064 }
3065
3066
anqp_resp_cb(void * ctx,const u8 * dst,u8 dialog_token,enum gas_query_result result,const struct wpabuf * adv_proto,const struct wpabuf * resp,u16 status_code)3067 void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
3068 enum gas_query_result result,
3069 const struct wpabuf *adv_proto,
3070 const struct wpabuf *resp, u16 status_code)
3071 {
3072 struct wpa_supplicant *wpa_s = ctx;
3073 const u8 *pos;
3074 const u8 *end;
3075 u16 info_id;
3076 u16 slen;
3077 struct wpa_bss *bss = NULL, *tmp;
3078 const char *anqp_result = "SUCCESS";
3079
3080 wpa_printf(MSG_DEBUG, "Interworking: anqp_resp_cb dst=" MACSTR
3081 " dialog_token=%u result=%d status_code=%u",
3082 MAC2STR(dst), dialog_token, result, status_code);
3083 if (result != GAS_QUERY_SUCCESS) {
3084 #ifdef CONFIG_HS20
3085 if (wpa_s->fetch_osu_icon_in_progress)
3086 hs20_icon_fetch_failed(wpa_s);
3087 #endif /* CONFIG_HS20 */
3088 anqp_result = "FAILURE";
3089 goto out;
3090 }
3091
3092 pos = wpabuf_head(adv_proto);
3093 if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
3094 pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
3095 wpa_msg(wpa_s, MSG_DEBUG,
3096 "ANQP: Unexpected Advertisement Protocol in response");
3097 #ifdef CONFIG_HS20
3098 if (wpa_s->fetch_osu_icon_in_progress)
3099 hs20_icon_fetch_failed(wpa_s);
3100 #endif /* CONFIG_HS20 */
3101 anqp_result = "INVALID_FRAME";
3102 goto out;
3103 }
3104
3105 /*
3106 * If possible, select the BSS entry based on which BSS entry was used
3107 * for the request. This can help in cases where multiple BSS entries
3108 * may exist for the same AP.
3109 */
3110 dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
3111 if (tmp == wpa_s->interworking_gas_bss &&
3112 os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
3113 bss = tmp;
3114 break;
3115 }
3116 }
3117 if (bss == NULL)
3118 bss = wpa_bss_get_bssid(wpa_s, dst);
3119
3120 pos = wpabuf_head(resp);
3121 end = pos + wpabuf_len(resp);
3122
3123 while (pos < end) {
3124 unsigned int left = end - pos;
3125
3126 if (left < 4) {
3127 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Invalid element");
3128 anqp_result = "INVALID_FRAME";
3129 goto out_parse_done;
3130 }
3131 info_id = WPA_GET_LE16(pos);
3132 pos += 2;
3133 slen = WPA_GET_LE16(pos);
3134 pos += 2;
3135 left -= 4;
3136 if (left < slen) {
3137 wpa_msg(wpa_s, MSG_DEBUG,
3138 "ANQP: Invalid element length for Info ID %u",
3139 info_id);
3140 anqp_result = "INVALID_FRAME";
3141 goto out_parse_done;
3142 }
3143 interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
3144 slen, dialog_token);
3145 pos += slen;
3146 }
3147
3148 out_parse_done:
3149 #ifdef CONFIG_HS20
3150 hs20_notify_parse_done(wpa_s);
3151 #endif /* CONFIG_HS20 */
3152 out:
3153 wpa_msg(wpa_s, MSG_INFO, ANQP_QUERY_DONE "addr=" MACSTR " result=%s",
3154 MAC2STR(dst), anqp_result);
3155 wpas_notify_anqp_query_done(wpa_s, dst, anqp_result, bss ? bss->anqp : NULL);
3156 }
3157
3158
interworking_scan_res_handler(struct wpa_supplicant * wpa_s,struct wpa_scan_results * scan_res)3159 static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
3160 struct wpa_scan_results *scan_res)
3161 {
3162 wpa_msg(wpa_s, MSG_DEBUG,
3163 "Interworking: Scan results available - start ANQP fetch");
3164 interworking_start_fetch_anqp(wpa_s);
3165 }
3166
3167
interworking_select(struct wpa_supplicant * wpa_s,int auto_select,int * freqs)3168 int interworking_select(struct wpa_supplicant *wpa_s, int auto_select,
3169 int *freqs)
3170 {
3171 interworking_stop_fetch_anqp(wpa_s);
3172 wpa_s->network_select = 1;
3173 wpa_s->auto_network_select = 0;
3174 wpa_s->auto_select = !!auto_select;
3175 wpa_s->fetch_all_anqp = 0;
3176 wpa_s->fetch_osu_info = 0;
3177 wpa_msg(wpa_s, MSG_DEBUG,
3178 "Interworking: Start scan for network selection");
3179 wpa_s->scan_res_handler = interworking_scan_res_handler;
3180 wpa_s->normal_scans = 0;
3181 wpa_s->scan_req = MANUAL_SCAN_REQ;
3182 os_free(wpa_s->manual_scan_freqs);
3183 wpa_s->manual_scan_freqs = freqs;
3184 wpa_s->after_wps = 0;
3185 wpa_s->known_wps_freq = 0;
3186 wpa_supplicant_req_scan(wpa_s, 0, 0);
3187
3188 return 0;
3189 }
3190
3191
gas_resp_cb(void * ctx,const u8 * addr,u8 dialog_token,enum gas_query_result result,const struct wpabuf * adv_proto,const struct wpabuf * resp,u16 status_code)3192 static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
3193 enum gas_query_result result,
3194 const struct wpabuf *adv_proto,
3195 const struct wpabuf *resp, u16 status_code)
3196 {
3197 struct wpa_supplicant *wpa_s = ctx;
3198 struct wpabuf *n;
3199
3200 wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
3201 " dialog_token=%d status_code=%d resp_len=%d",
3202 MAC2STR(addr), dialog_token, status_code,
3203 resp ? (int) wpabuf_len(resp) : -1);
3204 if (!resp)
3205 return;
3206
3207 n = wpabuf_dup(resp);
3208 if (n == NULL)
3209 return;
3210 wpabuf_free(wpa_s->prev_gas_resp);
3211 wpa_s->prev_gas_resp = wpa_s->last_gas_resp;
3212 os_memcpy(wpa_s->prev_gas_addr, wpa_s->last_gas_addr, ETH_ALEN);
3213 wpa_s->prev_gas_dialog_token = wpa_s->last_gas_dialog_token;
3214 wpa_s->last_gas_resp = n;
3215 os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
3216 wpa_s->last_gas_dialog_token = dialog_token;
3217 }
3218
3219
gas_send_request(struct wpa_supplicant * wpa_s,const u8 * dst,const struct wpabuf * adv_proto,const struct wpabuf * query)3220 int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
3221 const struct wpabuf *adv_proto,
3222 const struct wpabuf *query)
3223 {
3224 struct wpabuf *buf;
3225 int ret = 0;
3226 int freq;
3227 struct wpa_bss *bss;
3228 int res;
3229 size_t len;
3230 u8 query_resp_len_limit = 0;
3231
3232 freq = wpa_s->assoc_freq;
3233 bss = wpa_bss_get_bssid(wpa_s, dst);
3234 if (bss)
3235 freq = bss->freq;
3236 if (freq <= 0)
3237 return -1;
3238
3239 wpa_msg(wpa_s, MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
3240 MAC2STR(dst), freq);
3241 wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
3242 wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
3243
3244 len = 3 + wpabuf_len(adv_proto) + 2;
3245 if (query)
3246 len += wpabuf_len(query);
3247 buf = gas_build_initial_req(0, len);
3248 if (buf == NULL)
3249 return -1;
3250
3251 /* Advertisement Protocol IE */
3252 wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
3253 wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
3254 wpabuf_put_u8(buf, query_resp_len_limit & 0x7f);
3255 wpabuf_put_buf(buf, adv_proto);
3256
3257 /* GAS Query */
3258 if (query) {
3259 wpabuf_put_le16(buf, wpabuf_len(query));
3260 wpabuf_put_buf(buf, query);
3261 } else
3262 wpabuf_put_le16(buf, 0);
3263
3264 res = gas_query_req(wpa_s->gas, dst, freq, 0, 0, buf, gas_resp_cb,
3265 wpa_s);
3266 if (res < 0) {
3267 wpa_msg(wpa_s, MSG_DEBUG, "GAS: Failed to send Query Request");
3268 wpabuf_free(buf);
3269 ret = -1;
3270 } else
3271 wpa_msg(wpa_s, MSG_DEBUG,
3272 "GAS: Query started with dialog token %u", res);
3273
3274 return ret;
3275 }
3276