1 /*
2 * WPA Supplicant - Scanning
3 * Copyright (c) 2003-2019, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/wpa_ctrl.h"
15 #include "config.h"
16 #include "wpa_supplicant_i.h"
17 #include "driver_i.h"
18 #include "wps_supplicant.h"
19 #include "p2p_supplicant.h"
20 #include "p2p/p2p.h"
21 #include "hs20_supplicant.h"
22 #include "notify.h"
23 #include "bss.h"
24 #include "scan.h"
25 #include "mesh.h"
26
27
wpa_supplicant_gen_assoc_event(struct wpa_supplicant * wpa_s)28 static void wpa_supplicant_gen_assoc_event(struct wpa_supplicant *wpa_s)
29 {
30 struct wpa_ssid *ssid;
31 union wpa_event_data data;
32
33 ssid = wpa_supplicant_get_ssid(wpa_s);
34 if (ssid == NULL)
35 return;
36
37 if (wpa_s->current_ssid == NULL) {
38 wpa_s->current_ssid = ssid;
39 wpas_notify_network_changed(wpa_s);
40 }
41 wpa_supplicant_initiate_eapol(wpa_s);
42 wpa_dbg(wpa_s, MSG_DEBUG, "Already associated with a configured "
43 "network - generating associated event");
44 os_memset(&data, 0, sizeof(data));
45 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
46 }
47
48
49 #ifdef CONFIG_WPS
wpas_wps_in_use(struct wpa_supplicant * wpa_s,enum wps_request_type * req_type)50 static int wpas_wps_in_use(struct wpa_supplicant *wpa_s,
51 enum wps_request_type *req_type)
52 {
53 struct wpa_ssid *ssid;
54 int wps = 0;
55
56 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
57 if (!(ssid->key_mgmt & WPA_KEY_MGMT_WPS))
58 continue;
59
60 wps = 1;
61 *req_type = wpas_wps_get_req_type(ssid);
62 if (ssid->eap.phase1 && os_strstr(ssid->eap.phase1, "pbc=1"))
63 return 2;
64 }
65
66 #ifdef CONFIG_P2P
67 if (!wpa_s->global->p2p_disabled && wpa_s->global->p2p &&
68 !wpa_s->conf->p2p_disabled) {
69 wpa_s->wps->dev.p2p = 1;
70 if (!wps) {
71 wps = 1;
72 *req_type = WPS_REQ_ENROLLEE_INFO;
73 }
74 }
75 #endif /* CONFIG_P2P */
76
77 return wps;
78 }
79 #endif /* CONFIG_WPS */
80
81
wpa_setup_mac_addr_rand_params(struct wpa_driver_scan_params * params,const u8 * mac_addr)82 static int wpa_setup_mac_addr_rand_params(struct wpa_driver_scan_params *params,
83 const u8 *mac_addr)
84 {
85 u8 *tmp;
86
87 if (params->mac_addr) {
88 params->mac_addr_mask = NULL;
89 os_free(params->mac_addr);
90 params->mac_addr = NULL;
91 }
92
93 params->mac_addr_rand = 1;
94
95 if (!mac_addr)
96 return 0;
97
98 tmp = os_malloc(2 * ETH_ALEN);
99 if (!tmp)
100 return -1;
101
102 os_memcpy(tmp, mac_addr, 2 * ETH_ALEN);
103 params->mac_addr = tmp;
104 params->mac_addr_mask = tmp + ETH_ALEN;
105 return 0;
106 }
107
108
109 /**
110 * wpa_supplicant_enabled_networks - Check whether there are enabled networks
111 * @wpa_s: Pointer to wpa_supplicant data
112 * Returns: 0 if no networks are enabled, >0 if networks are enabled
113 *
114 * This function is used to figure out whether any networks (or Interworking
115 * with enabled credentials and auto_interworking) are present in the current
116 * configuration.
117 */
wpa_supplicant_enabled_networks(struct wpa_supplicant * wpa_s)118 int wpa_supplicant_enabled_networks(struct wpa_supplicant *wpa_s)
119 {
120 struct wpa_ssid *ssid = wpa_s->conf->ssid;
121 int count = 0, disabled = 0;
122
123 if (wpa_s->p2p_mgmt)
124 return 0; /* no normal network profiles on p2p_mgmt interface */
125
126 while (ssid) {
127 if (!wpas_network_disabled(wpa_s, ssid))
128 count++;
129 else
130 disabled++;
131 ssid = ssid->next;
132 }
133 if (wpa_s->conf->cred && wpa_s->conf->interworking &&
134 wpa_s->conf->auto_interworking)
135 count++;
136 if (count == 0 && disabled > 0) {
137 wpa_dbg(wpa_s, MSG_DEBUG, "No enabled networks (%d disabled "
138 "networks)", disabled);
139 }
140 return count;
141 }
142
143
wpa_supplicant_assoc_try(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid)144 static void wpa_supplicant_assoc_try(struct wpa_supplicant *wpa_s,
145 struct wpa_ssid *ssid)
146 {
147 int min_temp_disabled = 0;
148
149 while (ssid) {
150 if (!wpas_network_disabled(wpa_s, ssid)) {
151 int temp_disabled = wpas_temp_disabled(wpa_s, ssid);
152
153 if (temp_disabled <= 0)
154 break;
155
156 if (!min_temp_disabled ||
157 temp_disabled < min_temp_disabled)
158 min_temp_disabled = temp_disabled;
159 }
160 ssid = ssid->next;
161 }
162
163 /* ap_scan=2 mode - try to associate with each SSID. */
164 if (ssid == NULL) {
165 wpa_dbg(wpa_s, MSG_DEBUG, "wpa_supplicant_assoc_try: Reached "
166 "end of scan list - go back to beginning");
167 wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
168 wpa_supplicant_req_scan(wpa_s, min_temp_disabled, 0);
169 return;
170 }
171 if (ssid->next) {
172 /* Continue from the next SSID on the next attempt. */
173 wpa_s->prev_scan_ssid = ssid;
174 } else {
175 /* Start from the beginning of the SSID list. */
176 wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
177 }
178 wpa_supplicant_associate(wpa_s, NULL, ssid);
179 }
180
181
wpas_trigger_scan_cb(struct wpa_radio_work * work,int deinit)182 static void wpas_trigger_scan_cb(struct wpa_radio_work *work, int deinit)
183 {
184 struct wpa_supplicant *wpa_s = work->wpa_s;
185 struct wpa_driver_scan_params *params = work->ctx;
186 int ret;
187
188 if (deinit) {
189 if (!work->started) {
190 wpa_scan_free_params(params);
191 return;
192 }
193 wpa_supplicant_notify_scanning(wpa_s, 0);
194 wpas_notify_scan_done(wpa_s, 0);
195 wpa_s->scan_work = NULL;
196 return;
197 }
198
199 if ((wpa_s->mac_addr_rand_enable & MAC_ADDR_RAND_SCAN) &&
200 wpa_s->wpa_state <= WPA_SCANNING)
201 wpa_setup_mac_addr_rand_params(params, wpa_s->mac_addr_scan);
202
203 if (wpas_update_random_addr_disassoc(wpa_s) < 0) {
204 wpa_msg(wpa_s, MSG_INFO,
205 "Failed to assign random MAC address for a scan");
206 wpa_scan_free_params(params);
207 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCAN_FAILED "ret=-1");
208 radio_work_done(work);
209 return;
210 }
211
212 wpa_supplicant_notify_scanning(wpa_s, 1);
213
214 if (wpa_s->clear_driver_scan_cache) {
215 wpa_printf(MSG_DEBUG,
216 "Request driver to clear scan cache due to local BSS flush");
217 params->only_new_results = 1;
218 }
219 ret = wpa_drv_scan(wpa_s, params);
220 /*
221 * Store the obtained vendor scan cookie (if any) in wpa_s context.
222 * The current design is to allow only one scan request on each
223 * interface, hence having this scan cookie stored in wpa_s context is
224 * fine for now.
225 *
226 * Revisit this logic if concurrent scan operations per interface
227 * is supported.
228 */
229 if (ret == 0)
230 wpa_s->curr_scan_cookie = params->scan_cookie;
231 wpa_scan_free_params(params);
232 work->ctx = NULL;
233 if (ret) {
234 int retry = wpa_s->last_scan_req != MANUAL_SCAN_REQ &&
235 !wpa_s->beacon_rep_data.token;
236
237 if (wpa_s->disconnected)
238 retry = 0;
239
240 /* do not retry if operation is not supported */
241 if (ret == -EOPNOTSUPP)
242 retry = 0;
243
244 wpa_supplicant_notify_scanning(wpa_s, 0);
245 wpas_notify_scan_done(wpa_s, 0);
246 if (wpa_s->wpa_state == WPA_SCANNING)
247 wpa_supplicant_set_state(wpa_s,
248 wpa_s->scan_prev_wpa_state);
249 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCAN_FAILED "ret=%d%s",
250 ret, retry ? " retry=1" : "");
251 radio_work_done(work);
252
253 if (retry) {
254 /* Restore scan_req since we will try to scan again */
255 wpa_s->scan_req = wpa_s->last_scan_req;
256 wpa_supplicant_req_scan(wpa_s, 1, 0);
257 } else if (wpa_s->scan_res_handler) {
258 /* Clear the scan_res_handler */
259 wpa_s->scan_res_handler = NULL;
260 }
261
262 if (wpa_s->beacon_rep_data.token)
263 wpas_rrm_refuse_request(wpa_s);
264
265 return;
266 }
267
268 os_get_reltime(&wpa_s->scan_trigger_time);
269 wpa_s->scan_runs++;
270 wpa_s->normal_scans++;
271 wpa_s->own_scan_requested = 1;
272 wpa_s->clear_driver_scan_cache = 0;
273 wpa_s->scan_work = work;
274 }
275
276
277 /**
278 * wpa_supplicant_trigger_scan - Request driver to start a scan
279 * @wpa_s: Pointer to wpa_supplicant data
280 * @params: Scan parameters
281 * Returns: 0 on success, -1 on failure
282 */
wpa_supplicant_trigger_scan(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)283 int wpa_supplicant_trigger_scan(struct wpa_supplicant *wpa_s,
284 struct wpa_driver_scan_params *params)
285 {
286 struct wpa_driver_scan_params *ctx;
287
288 if (wpa_s->scan_work) {
289 wpa_dbg(wpa_s, MSG_INFO, "Reject scan trigger since one is already pending");
290 return -1;
291 }
292
293 ctx = wpa_scan_clone_params(params);
294 if (!ctx ||
295 radio_add_work(wpa_s, 0, "scan", 0, wpas_trigger_scan_cb, ctx) < 0)
296 {
297 wpa_scan_free_params(ctx);
298 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCAN_FAILED "ret=-1");
299 return -1;
300 }
301
302 return 0;
303 }
304
305
306 static void
wpa_supplicant_delayed_sched_scan_timeout(void * eloop_ctx,void * timeout_ctx)307 wpa_supplicant_delayed_sched_scan_timeout(void *eloop_ctx, void *timeout_ctx)
308 {
309 struct wpa_supplicant *wpa_s = eloop_ctx;
310
311 wpa_dbg(wpa_s, MSG_DEBUG, "Starting delayed sched scan");
312
313 if (wpa_supplicant_req_sched_scan(wpa_s))
314 wpa_supplicant_req_scan(wpa_s, 0, 0);
315 }
316
317
318 static void
wpa_supplicant_sched_scan_timeout(void * eloop_ctx,void * timeout_ctx)319 wpa_supplicant_sched_scan_timeout(void *eloop_ctx, void *timeout_ctx)
320 {
321 struct wpa_supplicant *wpa_s = eloop_ctx;
322
323 wpa_dbg(wpa_s, MSG_DEBUG, "Sched scan timeout - stopping it");
324
325 wpa_s->sched_scan_timed_out = 1;
326 wpa_supplicant_cancel_sched_scan(wpa_s);
327 }
328
329
330 static int
wpa_supplicant_start_sched_scan(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)331 wpa_supplicant_start_sched_scan(struct wpa_supplicant *wpa_s,
332 struct wpa_driver_scan_params *params)
333 {
334 int ret;
335
336 wpa_supplicant_notify_scanning(wpa_s, 1);
337 ret = wpa_drv_sched_scan(wpa_s, params);
338 if (ret)
339 wpa_supplicant_notify_scanning(wpa_s, 0);
340 else
341 wpa_s->sched_scanning = 1;
342
343 return ret;
344 }
345
346
wpa_supplicant_stop_sched_scan(struct wpa_supplicant * wpa_s)347 static int wpa_supplicant_stop_sched_scan(struct wpa_supplicant *wpa_s)
348 {
349 int ret;
350
351 ret = wpa_drv_stop_sched_scan(wpa_s);
352 if (ret) {
353 wpa_dbg(wpa_s, MSG_DEBUG, "stopping sched_scan failed!");
354 /* TODO: what to do if stopping fails? */
355 return -1;
356 }
357
358 return ret;
359 }
360
361
362 static struct wpa_driver_scan_filter *
wpa_supplicant_build_filter_ssids(struct wpa_config * conf,size_t * num_ssids)363 wpa_supplicant_build_filter_ssids(struct wpa_config *conf, size_t *num_ssids)
364 {
365 struct wpa_driver_scan_filter *ssids;
366 struct wpa_ssid *ssid;
367 size_t count;
368
369 *num_ssids = 0;
370 if (!conf->filter_ssids)
371 return NULL;
372
373 for (count = 0, ssid = conf->ssid; ssid; ssid = ssid->next) {
374 if (ssid->ssid && ssid->ssid_len)
375 count++;
376 }
377 if (count == 0)
378 return NULL;
379 ssids = os_calloc(count, sizeof(struct wpa_driver_scan_filter));
380 if (ssids == NULL)
381 return NULL;
382
383 for (ssid = conf->ssid; ssid; ssid = ssid->next) {
384 if (!ssid->ssid || !ssid->ssid_len)
385 continue;
386 os_memcpy(ssids[*num_ssids].ssid, ssid->ssid, ssid->ssid_len);
387 ssids[*num_ssids].ssid_len = ssid->ssid_len;
388 (*num_ssids)++;
389 }
390
391 return ssids;
392 }
393
394
wpa_supplicant_optimize_freqs(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)395 static void wpa_supplicant_optimize_freqs(
396 struct wpa_supplicant *wpa_s, struct wpa_driver_scan_params *params)
397 {
398 #ifdef CONFIG_P2P
399 if (params->freqs == NULL && wpa_s->p2p_in_provisioning &&
400 wpa_s->go_params) {
401 /* Optimize provisioning state scan based on GO information */
402 if (wpa_s->p2p_in_provisioning < 5 &&
403 wpa_s->go_params->freq > 0) {
404 wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Scan only GO "
405 "preferred frequency %d MHz",
406 wpa_s->go_params->freq);
407 params->freqs = os_calloc(2, sizeof(int));
408 if (params->freqs)
409 params->freqs[0] = wpa_s->go_params->freq;
410 } else if (wpa_s->p2p_in_provisioning < 8 &&
411 wpa_s->go_params->freq_list[0]) {
412 wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Scan only common "
413 "channels");
414 int_array_concat(¶ms->freqs,
415 wpa_s->go_params->freq_list);
416 if (params->freqs)
417 int_array_sort_unique(params->freqs);
418 }
419 wpa_s->p2p_in_provisioning++;
420 }
421
422 if (params->freqs == NULL && wpa_s->p2p_in_invitation) {
423 /*
424 * Optimize scan based on GO information during persistent
425 * group reinvocation
426 */
427 if (wpa_s->p2p_in_invitation < 5 &&
428 wpa_s->p2p_invite_go_freq > 0) {
429 wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Scan only GO preferred frequency %d MHz during invitation",
430 wpa_s->p2p_invite_go_freq);
431 params->freqs = os_calloc(2, sizeof(int));
432 if (params->freqs)
433 params->freqs[0] = wpa_s->p2p_invite_go_freq;
434 }
435 wpa_s->p2p_in_invitation++;
436 if (wpa_s->p2p_in_invitation > 20) {
437 /*
438 * This should not really happen since the variable is
439 * cleared on group removal, but if it does happen, make
440 * sure we do not get stuck in special invitation scan
441 * mode.
442 */
443 wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Clear p2p_in_invitation");
444 wpa_s->p2p_in_invitation = 0;
445 }
446 }
447 #endif /* CONFIG_P2P */
448
449 #ifdef CONFIG_WPS
450 if (params->freqs == NULL && wpa_s->after_wps && wpa_s->wps_freq) {
451 /*
452 * Optimize post-provisioning scan based on channel used
453 * during provisioning.
454 */
455 wpa_dbg(wpa_s, MSG_DEBUG, "WPS: Scan only frequency %u MHz "
456 "that was used during provisioning", wpa_s->wps_freq);
457 params->freqs = os_calloc(2, sizeof(int));
458 if (params->freqs)
459 params->freqs[0] = wpa_s->wps_freq;
460 wpa_s->after_wps--;
461 } else if (wpa_s->after_wps)
462 wpa_s->after_wps--;
463
464 if (params->freqs == NULL && wpa_s->known_wps_freq && wpa_s->wps_freq)
465 {
466 /* Optimize provisioning scan based on already known channel */
467 wpa_dbg(wpa_s, MSG_DEBUG, "WPS: Scan only frequency %u MHz",
468 wpa_s->wps_freq);
469 params->freqs = os_calloc(2, sizeof(int));
470 if (params->freqs)
471 params->freqs[0] = wpa_s->wps_freq;
472 wpa_s->known_wps_freq = 0; /* only do this once */
473 }
474 #endif /* CONFIG_WPS */
475 }
476
477
478 #ifdef CONFIG_INTERWORKING
wpas_add_interworking_elements(struct wpa_supplicant * wpa_s,struct wpabuf * buf)479 static void wpas_add_interworking_elements(struct wpa_supplicant *wpa_s,
480 struct wpabuf *buf)
481 {
482 wpabuf_put_u8(buf, WLAN_EID_INTERWORKING);
483 wpabuf_put_u8(buf, is_zero_ether_addr(wpa_s->conf->hessid) ? 1 :
484 1 + ETH_ALEN);
485 wpabuf_put_u8(buf, wpa_s->conf->access_network_type);
486 /* No Venue Info */
487 if (!is_zero_ether_addr(wpa_s->conf->hessid))
488 wpabuf_put_data(buf, wpa_s->conf->hessid, ETH_ALEN);
489 }
490 #endif /* CONFIG_INTERWORKING */
491
492
493 #ifdef CONFIG_MBO
wpas_fils_req_param_add_max_channel(struct wpa_supplicant * wpa_s,struct wpabuf ** ie)494 static void wpas_fils_req_param_add_max_channel(struct wpa_supplicant *wpa_s,
495 struct wpabuf **ie)
496 {
497 if (wpabuf_resize(ie, 5)) {
498 wpa_printf(MSG_DEBUG,
499 "Failed to allocate space for FILS Request Parameters element");
500 return;
501 }
502
503 /* FILS Request Parameters element */
504 wpabuf_put_u8(*ie, WLAN_EID_EXTENSION);
505 wpabuf_put_u8(*ie, 3); /* FILS Request attribute length */
506 wpabuf_put_u8(*ie, WLAN_EID_EXT_FILS_REQ_PARAMS);
507 /* Parameter control bitmap */
508 wpabuf_put_u8(*ie, 0);
509 /* Max Channel Time field - contains the value of MaxChannelTime
510 * parameter of the MLME-SCAN.request primitive represented in units of
511 * TUs, as an unsigned integer. A Max Channel Time field value of 255
512 * is used to indicate any duration of more than 254 TUs, or an
513 * unspecified or unknown duration. (IEEE Std 802.11ai-2016, 9.4.2.178)
514 */
515 wpabuf_put_u8(*ie, 255);
516 }
517 #endif /* CONFIG_MBO */
518
519
wpa_supplicant_set_default_scan_ies(struct wpa_supplicant * wpa_s)520 void wpa_supplicant_set_default_scan_ies(struct wpa_supplicant *wpa_s)
521 {
522 struct wpabuf *default_ies = NULL;
523 u8 ext_capab[18];
524 int ext_capab_len, frame_id;
525 enum wpa_driver_if_type type = WPA_IF_STATION;
526
527 #ifdef CONFIG_P2P
528 if (wpa_s->p2p_group_interface == P2P_GROUP_INTERFACE_CLIENT)
529 type = WPA_IF_P2P_CLIENT;
530 #endif /* CONFIG_P2P */
531
532 wpa_drv_get_ext_capa(wpa_s, type);
533
534 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
535 sizeof(ext_capab));
536 if (ext_capab_len > 0 &&
537 wpabuf_resize(&default_ies, ext_capab_len) == 0)
538 wpabuf_put_data(default_ies, ext_capab, ext_capab_len);
539
540 #ifdef CONFIG_MBO
541 if (wpa_s->enable_oce & OCE_STA)
542 wpas_fils_req_param_add_max_channel(wpa_s, &default_ies);
543 /* Send MBO and OCE capabilities */
544 if (wpabuf_resize(&default_ies, 12) == 0)
545 wpas_mbo_scan_ie(wpa_s, default_ies);
546 #endif /* CONFIG_MBO */
547
548 if (type == WPA_IF_P2P_CLIENT)
549 frame_id = VENDOR_ELEM_PROBE_REQ_P2P;
550 else
551 frame_id = VENDOR_ELEM_PROBE_REQ;
552
553 if (wpa_s->vendor_elem[frame_id]) {
554 size_t len;
555
556 len = wpabuf_len(wpa_s->vendor_elem[frame_id]);
557 if (len > 0 && wpabuf_resize(&default_ies, len) == 0)
558 wpabuf_put_buf(default_ies,
559 wpa_s->vendor_elem[frame_id]);
560 }
561
562 if (default_ies)
563 wpa_drv_set_default_scan_ies(wpa_s, wpabuf_head(default_ies),
564 wpabuf_len(default_ies));
565 wpabuf_free(default_ies);
566 }
567
568
wpa_supplicant_extra_ies(struct wpa_supplicant * wpa_s)569 static struct wpabuf * wpa_supplicant_extra_ies(struct wpa_supplicant *wpa_s)
570 {
571 struct wpabuf *extra_ie = NULL;
572 u8 ext_capab[18];
573 int ext_capab_len;
574 #ifdef CONFIG_WPS
575 int wps = 0;
576 enum wps_request_type req_type = WPS_REQ_ENROLLEE_INFO;
577 #endif /* CONFIG_WPS */
578
579 #ifdef CONFIG_P2P
580 if (wpa_s->p2p_group_interface == P2P_GROUP_INTERFACE_CLIENT)
581 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
582 else
583 #endif /* CONFIG_P2P */
584 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
585
586 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
587 sizeof(ext_capab));
588 if (ext_capab_len > 0 &&
589 wpabuf_resize(&extra_ie, ext_capab_len) == 0)
590 wpabuf_put_data(extra_ie, ext_capab, ext_capab_len);
591
592 #ifdef CONFIG_INTERWORKING
593 if (wpa_s->conf->interworking &&
594 wpabuf_resize(&extra_ie, 100) == 0)
595 wpas_add_interworking_elements(wpa_s, extra_ie);
596 #endif /* CONFIG_INTERWORKING */
597
598 #ifdef CONFIG_MBO
599 if (wpa_s->enable_oce & OCE_STA)
600 wpas_fils_req_param_add_max_channel(wpa_s, &extra_ie);
601 #endif /* CONFIG_MBO */
602
603 #ifdef CONFIG_WPS
604 wps = wpas_wps_in_use(wpa_s, &req_type);
605
606 if (wps) {
607 struct wpabuf *wps_ie;
608 wps_ie = wps_build_probe_req_ie(wps == 2 ? DEV_PW_PUSHBUTTON :
609 DEV_PW_DEFAULT,
610 &wpa_s->wps->dev,
611 wpa_s->wps->uuid, req_type,
612 0, NULL);
613 if (wps_ie) {
614 if (wpabuf_resize(&extra_ie, wpabuf_len(wps_ie)) == 0)
615 wpabuf_put_buf(extra_ie, wps_ie);
616 wpabuf_free(wps_ie);
617 }
618 }
619
620 #ifdef CONFIG_P2P
621 if (wps) {
622 size_t ielen = p2p_scan_ie_buf_len(wpa_s->global->p2p);
623 if (wpabuf_resize(&extra_ie, ielen) == 0)
624 wpas_p2p_scan_ie(wpa_s, extra_ie);
625 }
626 #endif /* CONFIG_P2P */
627
628 wpa_supplicant_mesh_add_scan_ie(wpa_s, &extra_ie);
629
630 #endif /* CONFIG_WPS */
631
632 #ifdef CONFIG_HS20
633 if (wpa_s->conf->hs20 && wpabuf_resize(&extra_ie, 9) == 0)
634 wpas_hs20_add_indication(extra_ie, -1, 0);
635 #endif /* CONFIG_HS20 */
636
637 #ifdef CONFIG_FST
638 if (wpa_s->fst_ies &&
639 wpabuf_resize(&extra_ie, wpabuf_len(wpa_s->fst_ies)) == 0)
640 wpabuf_put_buf(extra_ie, wpa_s->fst_ies);
641 #endif /* CONFIG_FST */
642
643 #ifdef CONFIG_MBO
644 /* Send MBO and OCE capabilities */
645 if (wpabuf_resize(&extra_ie, 12) == 0)
646 wpas_mbo_scan_ie(wpa_s, extra_ie);
647 #endif /* CONFIG_MBO */
648
649 if (wpa_s->vendor_elem[VENDOR_ELEM_PROBE_REQ]) {
650 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_PROBE_REQ];
651
652 if (wpabuf_resize(&extra_ie, wpabuf_len(buf)) == 0)
653 wpabuf_put_buf(extra_ie, buf);
654 }
655
656 return extra_ie;
657 }
658
659
660 #ifdef CONFIG_P2P
661
662 /*
663 * Check whether there are any enabled networks or credentials that could be
664 * used for a non-P2P connection.
665 */
non_p2p_network_enabled(struct wpa_supplicant * wpa_s)666 static int non_p2p_network_enabled(struct wpa_supplicant *wpa_s)
667 {
668 struct wpa_ssid *ssid;
669
670 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
671 if (wpas_network_disabled(wpa_s, ssid))
672 continue;
673 if (!ssid->p2p_group)
674 return 1;
675 }
676
677 if (wpa_s->conf->cred && wpa_s->conf->interworking &&
678 wpa_s->conf->auto_interworking)
679 return 1;
680
681 return 0;
682 }
683
684 #endif /* CONFIG_P2P */
685
686
wpa_add_scan_freqs_list(struct wpa_supplicant * wpa_s,enum hostapd_hw_mode band,struct wpa_driver_scan_params * params,bool is_6ghz)687 int wpa_add_scan_freqs_list(struct wpa_supplicant *wpa_s,
688 enum hostapd_hw_mode band,
689 struct wpa_driver_scan_params *params, bool is_6ghz)
690 {
691 /* Include only supported channels for the specified band */
692 struct hostapd_hw_modes *mode;
693 int num_chans = 0;
694 int *freqs, i;
695
696 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, band, is_6ghz);
697 if (!mode)
698 return -1;
699
700 if (params->freqs) {
701 while (params->freqs[num_chans])
702 num_chans++;
703 }
704
705 freqs = os_realloc(params->freqs,
706 (num_chans + mode->num_channels + 1) * sizeof(int));
707 if (!freqs)
708 return -1;
709
710 params->freqs = freqs;
711 for (i = 0; i < mode->num_channels; i++) {
712 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
713 continue;
714 params->freqs[num_chans++] = mode->channels[i].freq;
715 }
716 params->freqs[num_chans] = 0;
717
718 return 0;
719 }
720
721
wpa_setband_scan_freqs(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)722 static void wpa_setband_scan_freqs(struct wpa_supplicant *wpa_s,
723 struct wpa_driver_scan_params *params)
724 {
725 if (wpa_s->hw.modes == NULL)
726 return; /* unknown what channels the driver supports */
727 if (params->freqs)
728 return; /* already using a limited channel set */
729
730 if (wpa_s->setband_mask & WPA_SETBAND_5G)
731 wpa_add_scan_freqs_list(wpa_s, HOSTAPD_MODE_IEEE80211A, params,
732 0);
733 if (wpa_s->setband_mask & WPA_SETBAND_2G)
734 wpa_add_scan_freqs_list(wpa_s, HOSTAPD_MODE_IEEE80211G, params,
735 0);
736 if (wpa_s->setband_mask & WPA_SETBAND_6G)
737 wpa_add_scan_freqs_list(wpa_s, HOSTAPD_MODE_IEEE80211A, params,
738 1);
739 }
740
741
wpa_add_scan_ssid(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params,size_t max_ssids,const u8 * ssid,size_t ssid_len)742 static void wpa_add_scan_ssid(struct wpa_supplicant *wpa_s,
743 struct wpa_driver_scan_params *params,
744 size_t max_ssids, const u8 *ssid, size_t ssid_len)
745 {
746 unsigned int j;
747
748 for (j = 0; j < params->num_ssids; j++) {
749 if (params->ssids[j].ssid_len == ssid_len &&
750 params->ssids[j].ssid &&
751 os_memcmp(params->ssids[j].ssid, ssid, ssid_len) == 0)
752 return; /* already in the list */
753 }
754
755 if (params->num_ssids + 1 > max_ssids) {
756 wpa_printf(MSG_DEBUG, "Over max scan SSIDs for manual request");
757 return;
758 }
759
760 wpa_printf(MSG_DEBUG, "Scan SSID (manual request): %s",
761 wpa_ssid_txt(ssid, ssid_len));
762
763 params->ssids[params->num_ssids].ssid = ssid;
764 params->ssids[params->num_ssids].ssid_len = ssid_len;
765 params->num_ssids++;
766 }
767
768
wpa_add_owe_scan_ssid(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params,struct wpa_ssid * ssid,size_t max_ssids)769 static void wpa_add_owe_scan_ssid(struct wpa_supplicant *wpa_s,
770 struct wpa_driver_scan_params *params,
771 struct wpa_ssid *ssid, size_t max_ssids)
772 {
773 #ifdef CONFIG_OWE
774 struct wpa_bss *bss;
775
776 if (!(ssid->key_mgmt & WPA_KEY_MGMT_OWE))
777 return;
778
779 wpa_printf(MSG_DEBUG, "OWE: Look for transition mode AP. ssid=%s",
780 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
781
782 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
783 const u8 *owe, *pos, *end;
784 const u8 *owe_ssid;
785 size_t owe_ssid_len;
786
787 if (bss->ssid_len != ssid->ssid_len ||
788 os_memcmp(bss->ssid, ssid->ssid, ssid->ssid_len) != 0)
789 continue;
790
791 owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
792 if (!owe || owe[1] < 4)
793 continue;
794
795 pos = owe + 6;
796 end = owe + 2 + owe[1];
797
798 /* Must include BSSID and ssid_len */
799 if (end - pos < ETH_ALEN + 1)
800 return;
801
802 /* Skip BSSID */
803 pos += ETH_ALEN;
804 owe_ssid_len = *pos++;
805 owe_ssid = pos;
806
807 if ((size_t) (end - pos) < owe_ssid_len ||
808 owe_ssid_len > SSID_MAX_LEN)
809 return;
810
811 wpa_printf(MSG_DEBUG,
812 "OWE: scan_ssids: transition mode OWE ssid=%s",
813 wpa_ssid_txt(owe_ssid, owe_ssid_len));
814
815 wpa_add_scan_ssid(wpa_s, params, max_ssids,
816 owe_ssid, owe_ssid_len);
817 return;
818 }
819 #endif /* CONFIG_OWE */
820 }
821
822
wpa_set_scan_ssids(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params,size_t max_ssids)823 static void wpa_set_scan_ssids(struct wpa_supplicant *wpa_s,
824 struct wpa_driver_scan_params *params,
825 size_t max_ssids)
826 {
827 unsigned int i;
828 struct wpa_ssid *ssid;
829
830 /*
831 * For devices with max_ssids greater than 1, leave the last slot empty
832 * for adding the wildcard scan entry.
833 */
834 max_ssids = max_ssids > 1 ? max_ssids - 1 : max_ssids;
835
836 for (i = 0; i < wpa_s->scan_id_count; i++) {
837 ssid = wpa_config_get_network(wpa_s->conf, wpa_s->scan_id[i]);
838 if (!ssid)
839 continue;
840 if (ssid->scan_ssid)
841 wpa_add_scan_ssid(wpa_s, params, max_ssids,
842 ssid->ssid, ssid->ssid_len);
843 /*
844 * Also add the SSID of the OWE BSS, to allow discovery of
845 * transition mode APs more quickly.
846 */
847 wpa_add_owe_scan_ssid(wpa_s, params, ssid, max_ssids);
848 }
849
850 wpa_s->scan_id_count = 0;
851 }
852
853
wpa_set_ssids_from_scan_req(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params,size_t max_ssids)854 static int wpa_set_ssids_from_scan_req(struct wpa_supplicant *wpa_s,
855 struct wpa_driver_scan_params *params,
856 size_t max_ssids)
857 {
858 unsigned int i;
859
860 if (wpa_s->ssids_from_scan_req == NULL ||
861 wpa_s->num_ssids_from_scan_req == 0)
862 return 0;
863
864 if (wpa_s->num_ssids_from_scan_req > max_ssids) {
865 wpa_s->num_ssids_from_scan_req = max_ssids;
866 wpa_printf(MSG_DEBUG, "Over max scan SSIDs from scan req: %u",
867 (unsigned int) max_ssids);
868 }
869
870 for (i = 0; i < wpa_s->num_ssids_from_scan_req; i++) {
871 params->ssids[i].ssid = wpa_s->ssids_from_scan_req[i].ssid;
872 params->ssids[i].ssid_len =
873 wpa_s->ssids_from_scan_req[i].ssid_len;
874 wpa_hexdump_ascii(MSG_DEBUG, "specific SSID",
875 params->ssids[i].ssid,
876 params->ssids[i].ssid_len);
877 }
878
879 params->num_ssids = wpa_s->num_ssids_from_scan_req;
880 wpa_s->num_ssids_from_scan_req = 0;
881 return 1;
882 }
883
884
wpa_supplicant_scan(void * eloop_ctx,void * timeout_ctx)885 static void wpa_supplicant_scan(void *eloop_ctx, void *timeout_ctx)
886 {
887 struct wpa_supplicant *wpa_s = eloop_ctx;
888 struct wpa_ssid *ssid;
889 int ret, p2p_in_prog;
890 struct wpabuf *extra_ie = NULL;
891 struct wpa_driver_scan_params params;
892 struct wpa_driver_scan_params *scan_params;
893 size_t max_ssids;
894 int connect_without_scan = 0;
895
896 wpa_s->ignore_post_flush_scan_res = 0;
897
898 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
899 wpa_dbg(wpa_s, MSG_DEBUG, "Skip scan - interface disabled");
900 return;
901 }
902
903 if (wpa_s->disconnected && wpa_s->scan_req == NORMAL_SCAN_REQ) {
904 wpa_dbg(wpa_s, MSG_DEBUG, "Disconnected - do not scan");
905 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
906 return;
907 }
908
909 if (wpa_s->scanning) {
910 /*
911 * If we are already in scanning state, we shall reschedule the
912 * the incoming scan request.
913 */
914 wpa_dbg(wpa_s, MSG_DEBUG, "Already scanning - Reschedule the incoming scan req");
915 wpa_supplicant_req_scan(wpa_s, 1, 0);
916 return;
917 }
918
919 if (!wpa_supplicant_enabled_networks(wpa_s) &&
920 wpa_s->scan_req == NORMAL_SCAN_REQ) {
921 wpa_dbg(wpa_s, MSG_DEBUG, "No enabled networks - do not scan");
922 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
923 return;
924 }
925
926 if (wpa_s->conf->ap_scan != 0 &&
927 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)) {
928 wpa_dbg(wpa_s, MSG_DEBUG, "Using wired authentication - "
929 "overriding ap_scan configuration");
930 wpa_s->conf->ap_scan = 0;
931 wpas_notify_ap_scan_changed(wpa_s);
932 }
933
934 if (wpa_s->conf->ap_scan == 0) {
935 wpa_supplicant_gen_assoc_event(wpa_s);
936 return;
937 }
938
939 ssid = NULL;
940 if (wpa_s->scan_req != MANUAL_SCAN_REQ &&
941 wpa_s->connect_without_scan) {
942 connect_without_scan = 1;
943 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
944 if (ssid == wpa_s->connect_without_scan)
945 break;
946 }
947 }
948
949 p2p_in_prog = wpas_p2p_in_progress(wpa_s);
950 if (p2p_in_prog && p2p_in_prog != 2 &&
951 (!ssid ||
952 (ssid->mode != WPAS_MODE_AP && ssid->mode != WPAS_MODE_P2P_GO))) {
953 wpa_dbg(wpa_s, MSG_DEBUG, "Delay station mode scan while P2P operation is in progress");
954 wpa_supplicant_req_scan(wpa_s, 5, 0);
955 return;
956 }
957
958 /*
959 * Don't cancel the scan based on ongoing PNO; defer it. Some scans are
960 * used for changing modes inside wpa_supplicant (roaming,
961 * auto-reconnect, etc). Discarding the scan might hurt these processes.
962 * The normal use case for PNO is to suspend the host immediately after
963 * starting PNO, so the periodic 100 ms attempts to run the scan do not
964 * normally happen in practice multiple times, i.e., this is simply
965 * restarting scanning once the host is woken up and PNO stopped.
966 */
967 if (wpa_s->pno || wpa_s->pno_sched_pending) {
968 wpa_dbg(wpa_s, MSG_DEBUG, "Defer scan - PNO is in progress");
969 wpa_supplicant_req_scan(wpa_s, 0, 100000);
970 return;
971 }
972
973 if (wpa_s->conf->ap_scan == 2)
974 max_ssids = 1;
975 else {
976 max_ssids = wpa_s->max_scan_ssids;
977 if (max_ssids > WPAS_MAX_SCAN_SSIDS)
978 max_ssids = WPAS_MAX_SCAN_SSIDS;
979 }
980
981 wpa_s->last_scan_req = wpa_s->scan_req;
982 wpa_s->scan_req = NORMAL_SCAN_REQ;
983
984 if (connect_without_scan) {
985 wpa_s->connect_without_scan = NULL;
986 if (ssid) {
987 wpa_printf(MSG_DEBUG, "Start a pre-selected network "
988 "without scan step");
989 wpa_supplicant_associate(wpa_s, NULL, ssid);
990 return;
991 }
992 }
993
994 os_memset(¶ms, 0, sizeof(params));
995
996 wpa_s->scan_prev_wpa_state = wpa_s->wpa_state;
997 if (wpa_s->wpa_state == WPA_DISCONNECTED ||
998 wpa_s->wpa_state == WPA_INACTIVE)
999 wpa_supplicant_set_state(wpa_s, WPA_SCANNING);
1000
1001 /*
1002 * If autoscan has set its own scanning parameters
1003 */
1004 if (wpa_s->autoscan_params != NULL) {
1005 scan_params = wpa_s->autoscan_params;
1006 goto scan;
1007 }
1008
1009 if (wpa_s->last_scan_req == MANUAL_SCAN_REQ &&
1010 wpa_set_ssids_from_scan_req(wpa_s, ¶ms, max_ssids)) {
1011 wpa_printf(MSG_DEBUG, "Use specific SSIDs from SCAN command");
1012 goto ssid_list_set;
1013 }
1014
1015 #ifdef CONFIG_P2P
1016 #ifdef ANDROID
1017 if (wpa_s->global->p2p_go_found_external_scan &&
1018 (wpa_s->p2p_group_interface == P2P_GROUP_INTERFACE_CLIENT) &&
1019 (wpa_s->global->p2p_group_formation == wpa_s)) {
1020 wpa_dbg(wpa_s, MSG_DEBUG,
1021 "Try to fast associate since GO is found in external scan");
1022 wpa_s->global->p2p_go_found_external_scan = 0;
1023 if (wpa_supplicant_fast_associate(wpa_s) >= 0) {
1024 return;
1025 }
1026 }
1027 #endif
1028
1029 if ((wpa_s->p2p_in_provisioning || wpa_s->show_group_started) &&
1030 wpa_s->go_params && !wpa_s->conf->passive_scan) {
1031 wpa_printf(MSG_DEBUG, "P2P: Use specific SSID for scan during P2P group formation (p2p_in_provisioning=%d show_group_started=%d)",
1032 wpa_s->p2p_in_provisioning,
1033 wpa_s->show_group_started);
1034 params.ssids[0].ssid = wpa_s->go_params->ssid;
1035 params.ssids[0].ssid_len = wpa_s->go_params->ssid_len;
1036 params.num_ssids = 1;
1037 goto ssid_list_set;
1038 }
1039
1040 if (wpa_s->p2p_in_invitation) {
1041 if (wpa_s->current_ssid) {
1042 wpa_printf(MSG_DEBUG, "P2P: Use specific SSID for scan during invitation");
1043 params.ssids[0].ssid = wpa_s->current_ssid->ssid;
1044 params.ssids[0].ssid_len =
1045 wpa_s->current_ssid->ssid_len;
1046 params.num_ssids = 1;
1047 } else {
1048 wpa_printf(MSG_DEBUG, "P2P: No specific SSID known for scan during invitation");
1049 }
1050 goto ssid_list_set;
1051 }
1052 #endif /* CONFIG_P2P */
1053
1054 /* Find the starting point from which to continue scanning */
1055 ssid = wpa_s->conf->ssid;
1056 if (wpa_s->prev_scan_ssid != WILDCARD_SSID_SCAN) {
1057 while (ssid) {
1058 if (ssid == wpa_s->prev_scan_ssid) {
1059 ssid = ssid->next;
1060 break;
1061 }
1062 ssid = ssid->next;
1063 }
1064 }
1065
1066 if (wpa_s->last_scan_req != MANUAL_SCAN_REQ &&
1067 #ifdef CONFIG_AP
1068 !wpa_s->ap_iface &&
1069 #endif /* CONFIG_AP */
1070 wpa_s->conf->ap_scan == 2) {
1071 wpa_s->connect_without_scan = NULL;
1072 wpa_s->prev_scan_wildcard = 0;
1073 wpa_supplicant_assoc_try(wpa_s, ssid);
1074 return;
1075 } else if (wpa_s->conf->ap_scan == 2) {
1076 /*
1077 * User-initiated scan request in ap_scan == 2; scan with
1078 * wildcard SSID.
1079 */
1080 ssid = NULL;
1081 } else if (wpa_s->reattach && wpa_s->current_ssid != NULL) {
1082 /*
1083 * Perform single-channel single-SSID scan for
1084 * reassociate-to-same-BSS operation.
1085 */
1086 /* Setup SSID */
1087 ssid = wpa_s->current_ssid;
1088 wpa_hexdump_ascii(MSG_DEBUG, "Scan SSID",
1089 ssid->ssid, ssid->ssid_len);
1090 params.ssids[0].ssid = ssid->ssid;
1091 params.ssids[0].ssid_len = ssid->ssid_len;
1092 params.num_ssids = 1;
1093
1094 /*
1095 * Allocate memory for frequency array, allocate one extra
1096 * slot for the zero-terminator.
1097 */
1098 params.freqs = os_malloc(sizeof(int) * 2);
1099 if (params.freqs) {
1100 params.freqs[0] = wpa_s->assoc_freq;
1101 params.freqs[1] = 0;
1102 }
1103
1104 /*
1105 * Reset the reattach flag so that we fall back to full scan if
1106 * this scan fails.
1107 */
1108 wpa_s->reattach = 0;
1109 } else {
1110 struct wpa_ssid *start = ssid, *tssid;
1111 int freqs_set = 0;
1112 if (ssid == NULL && max_ssids > 1)
1113 ssid = wpa_s->conf->ssid;
1114 while (ssid) {
1115 if (!wpas_network_disabled(wpa_s, ssid) &&
1116 ssid->scan_ssid) {
1117 wpa_hexdump_ascii(MSG_DEBUG, "Scan SSID",
1118 ssid->ssid, ssid->ssid_len);
1119 params.ssids[params.num_ssids].ssid =
1120 ssid->ssid;
1121 params.ssids[params.num_ssids].ssid_len =
1122 ssid->ssid_len;
1123 params.num_ssids++;
1124 if (params.num_ssids + 1 >= max_ssids)
1125 break;
1126 }
1127
1128 if (!wpas_network_disabled(wpa_s, ssid)) {
1129 /*
1130 * Also add the SSID of the OWE BSS, to allow
1131 * discovery of transition mode APs more
1132 * quickly.
1133 */
1134 wpa_add_owe_scan_ssid(wpa_s, ¶ms, ssid,
1135 max_ssids);
1136 }
1137
1138 ssid = ssid->next;
1139 if (ssid == start)
1140 break;
1141 if (ssid == NULL && max_ssids > 1 &&
1142 start != wpa_s->conf->ssid)
1143 ssid = wpa_s->conf->ssid;
1144 }
1145
1146 if (wpa_s->scan_id_count &&
1147 wpa_s->last_scan_req == MANUAL_SCAN_REQ)
1148 wpa_set_scan_ssids(wpa_s, ¶ms, max_ssids);
1149
1150 for (tssid = wpa_s->conf->ssid;
1151 wpa_s->last_scan_req != MANUAL_SCAN_REQ && tssid;
1152 tssid = tssid->next) {
1153 if (wpas_network_disabled(wpa_s, tssid))
1154 continue;
1155 if (((params.freqs || !freqs_set) &&
1156 tssid->scan_freq) &&
1157 int_array_len(params.freqs) < 100) {
1158 int_array_concat(¶ms.freqs,
1159 tssid->scan_freq);
1160 } else {
1161 os_free(params.freqs);
1162 params.freqs = NULL;
1163 }
1164 freqs_set = 1;
1165 }
1166 int_array_sort_unique(params.freqs);
1167 }
1168
1169 if (ssid && max_ssids == 1) {
1170 /*
1171 * If the driver is limited to 1 SSID at a time interleave
1172 * wildcard SSID scans with specific SSID scans to avoid
1173 * waiting a long time for a wildcard scan.
1174 */
1175 if (!wpa_s->prev_scan_wildcard) {
1176 params.ssids[0].ssid = NULL;
1177 params.ssids[0].ssid_len = 0;
1178 wpa_s->prev_scan_wildcard = 1;
1179 wpa_dbg(wpa_s, MSG_DEBUG, "Starting AP scan for "
1180 "wildcard SSID (Interleave with specific)");
1181 } else {
1182 wpa_s->prev_scan_ssid = ssid;
1183 wpa_s->prev_scan_wildcard = 0;
1184 wpa_dbg(wpa_s, MSG_DEBUG,
1185 "Starting AP scan for specific SSID: %s",
1186 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1187 }
1188 } else if (ssid) {
1189 /* max_ssids > 1 */
1190
1191 wpa_s->prev_scan_ssid = ssid;
1192 wpa_dbg(wpa_s, MSG_DEBUG, "Include wildcard SSID in "
1193 "the scan request");
1194 params.num_ssids++;
1195 } else if (wpa_s->last_scan_req == MANUAL_SCAN_REQ &&
1196 wpa_s->manual_scan_passive && params.num_ssids == 0) {
1197 wpa_dbg(wpa_s, MSG_DEBUG, "Use passive scan based on manual request");
1198 } else if (wpa_s->conf->passive_scan) {
1199 wpa_dbg(wpa_s, MSG_DEBUG,
1200 "Use passive scan based on configuration");
1201 } else {
1202 wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
1203 params.num_ssids++;
1204 wpa_dbg(wpa_s, MSG_DEBUG, "Starting AP scan for wildcard "
1205 "SSID");
1206 }
1207
1208 ssid_list_set:
1209 wpa_supplicant_optimize_freqs(wpa_s, ¶ms);
1210 extra_ie = wpa_supplicant_extra_ies(wpa_s);
1211
1212 if (wpa_s->last_scan_req == MANUAL_SCAN_REQ &&
1213 wpa_s->manual_scan_only_new) {
1214 wpa_printf(MSG_DEBUG,
1215 "Request driver to clear scan cache due to manual only_new=1 scan");
1216 params.only_new_results = 1;
1217 }
1218
1219 if (wpa_s->last_scan_req == MANUAL_SCAN_REQ && params.freqs == NULL &&
1220 wpa_s->manual_scan_freqs) {
1221 wpa_dbg(wpa_s, MSG_DEBUG, "Limit manual scan to specified channels");
1222 params.freqs = wpa_s->manual_scan_freqs;
1223 wpa_s->manual_scan_freqs = NULL;
1224 }
1225
1226 if (params.freqs == NULL && wpa_s->select_network_scan_freqs) {
1227 wpa_dbg(wpa_s, MSG_DEBUG,
1228 "Limit select_network scan to specified channels");
1229 params.freqs = wpa_s->select_network_scan_freqs;
1230 wpa_s->select_network_scan_freqs = NULL;
1231 }
1232
1233 if (params.freqs == NULL && wpa_s->next_scan_freqs) {
1234 wpa_dbg(wpa_s, MSG_DEBUG, "Optimize scan based on previously "
1235 "generated frequency list");
1236 params.freqs = wpa_s->next_scan_freqs;
1237 } else
1238 os_free(wpa_s->next_scan_freqs);
1239 wpa_s->next_scan_freqs = NULL;
1240 wpa_setband_scan_freqs(wpa_s, ¶ms);
1241
1242 /* See if user specified frequencies. If so, scan only those. */
1243 if (wpa_s->last_scan_req == INITIAL_SCAN_REQ &&
1244 wpa_s->conf->initial_freq_list && !params.freqs) {
1245 wpa_dbg(wpa_s, MSG_DEBUG,
1246 "Optimize scan based on conf->initial_freq_list");
1247 int_array_concat(¶ms.freqs, wpa_s->conf->initial_freq_list);
1248 } else if (wpa_s->conf->freq_list && !params.freqs) {
1249 wpa_dbg(wpa_s, MSG_DEBUG,
1250 "Optimize scan based on conf->freq_list");
1251 int_array_concat(¶ms.freqs, wpa_s->conf->freq_list);
1252 }
1253
1254 /* Use current associated channel? */
1255 if (wpa_s->conf->scan_cur_freq && !params.freqs) {
1256 unsigned int num = wpa_s->num_multichan_concurrent;
1257
1258 params.freqs = os_calloc(num + 1, sizeof(int));
1259 if (params.freqs) {
1260 num = get_shared_radio_freqs(wpa_s, params.freqs, num);
1261 if (num > 0) {
1262 wpa_dbg(wpa_s, MSG_DEBUG, "Scan only the "
1263 "current operating channels since "
1264 "scan_cur_freq is enabled");
1265 } else {
1266 os_free(params.freqs);
1267 params.freqs = NULL;
1268 }
1269 }
1270 }
1271
1272 #ifdef CONFIG_MBO
1273 if (wpa_s->enable_oce & OCE_STA)
1274 params.oce_scan = 1;
1275 #endif /* CONFIG_MBO */
1276
1277 params.filter_ssids = wpa_supplicant_build_filter_ssids(
1278 wpa_s->conf, ¶ms.num_filter_ssids);
1279 if (extra_ie) {
1280 params.extra_ies = wpabuf_head(extra_ie);
1281 params.extra_ies_len = wpabuf_len(extra_ie);
1282 }
1283
1284 #ifdef CONFIG_P2P
1285 if (wpa_s->p2p_in_provisioning || wpa_s->p2p_in_invitation ||
1286 (wpa_s->show_group_started && wpa_s->go_params)) {
1287 /*
1288 * The interface may not yet be in P2P mode, so we have to
1289 * explicitly request P2P probe to disable CCK rates.
1290 */
1291 params.p2p_probe = 1;
1292 }
1293 #endif /* CONFIG_P2P */
1294
1295 if ((wpa_s->mac_addr_rand_enable & MAC_ADDR_RAND_SCAN) &&
1296 wpa_s->wpa_state <= WPA_SCANNING)
1297 wpa_setup_mac_addr_rand_params(¶ms, wpa_s->mac_addr_scan);
1298
1299 if (!is_zero_ether_addr(wpa_s->next_scan_bssid)) {
1300 struct wpa_bss *bss;
1301
1302 params.bssid = wpa_s->next_scan_bssid;
1303 bss = wpa_bss_get_bssid_latest(wpa_s, params.bssid);
1304 if (!wpa_s->next_scan_bssid_wildcard_ssid &&
1305 bss && bss->ssid_len && params.num_ssids == 1 &&
1306 params.ssids[0].ssid_len == 0) {
1307 params.ssids[0].ssid = bss->ssid;
1308 params.ssids[0].ssid_len = bss->ssid_len;
1309 wpa_dbg(wpa_s, MSG_DEBUG,
1310 "Scan a previously specified BSSID " MACSTR
1311 " and SSID %s",
1312 MAC2STR(params.bssid),
1313 wpa_ssid_txt(bss->ssid, bss->ssid_len));
1314 } else {
1315 wpa_dbg(wpa_s, MSG_DEBUG,
1316 "Scan a previously specified BSSID " MACSTR,
1317 MAC2STR(params.bssid));
1318 }
1319 }
1320
1321 scan_params = ¶ms;
1322
1323 scan:
1324 #ifdef CONFIG_P2P
1325 /*
1326 * If the driver does not support multi-channel concurrency and a
1327 * virtual interface that shares the same radio with the wpa_s interface
1328 * is operating there may not be need to scan other channels apart from
1329 * the current operating channel on the other virtual interface. Filter
1330 * out other channels in case we are trying to find a connection for a
1331 * station interface when we are not configured to prefer station
1332 * connection and a concurrent operation is already in process.
1333 */
1334 if (wpa_s->scan_for_connection &&
1335 wpa_s->last_scan_req == NORMAL_SCAN_REQ &&
1336 !scan_params->freqs && !params.freqs &&
1337 wpas_is_p2p_prioritized(wpa_s) &&
1338 wpa_s->p2p_group_interface == NOT_P2P_GROUP_INTERFACE &&
1339 non_p2p_network_enabled(wpa_s)) {
1340 unsigned int num = wpa_s->num_multichan_concurrent;
1341
1342 params.freqs = os_calloc(num + 1, sizeof(int));
1343 if (params.freqs) {
1344 num = get_shared_radio_freqs(wpa_s, params.freqs, num);
1345 if (num > 0 && num == wpa_s->num_multichan_concurrent) {
1346 wpa_dbg(wpa_s, MSG_DEBUG, "Scan only the current operating channels since all channels are already used");
1347 } else {
1348 os_free(params.freqs);
1349 params.freqs = NULL;
1350 }
1351 }
1352 }
1353 #endif /* CONFIG_P2P */
1354
1355 ret = wpa_supplicant_trigger_scan(wpa_s, scan_params);
1356
1357 if (ret && wpa_s->last_scan_req == MANUAL_SCAN_REQ && params.freqs &&
1358 !wpa_s->manual_scan_freqs) {
1359 /* Restore manual_scan_freqs for the next attempt */
1360 wpa_s->manual_scan_freqs = params.freqs;
1361 params.freqs = NULL;
1362 }
1363
1364 wpabuf_free(extra_ie);
1365 os_free(params.freqs);
1366 os_free(params.filter_ssids);
1367 os_free(params.mac_addr);
1368
1369 if (ret) {
1370 wpa_msg(wpa_s, MSG_WARNING, "Failed to initiate AP scan");
1371 if (wpa_s->scan_prev_wpa_state != wpa_s->wpa_state)
1372 wpa_supplicant_set_state(wpa_s,
1373 wpa_s->scan_prev_wpa_state);
1374 /* Restore scan_req since we will try to scan again */
1375 wpa_s->scan_req = wpa_s->last_scan_req;
1376 wpa_supplicant_req_scan(wpa_s, 1, 0);
1377 } else {
1378 wpa_s->scan_for_connection = 0;
1379 #ifdef CONFIG_INTERWORKING
1380 wpa_s->interworking_fast_assoc_tried = 0;
1381 #endif /* CONFIG_INTERWORKING */
1382 wpa_s->next_scan_bssid_wildcard_ssid = 0;
1383 if (params.bssid)
1384 os_memset(wpa_s->next_scan_bssid, 0, ETH_ALEN);
1385 }
1386 }
1387
1388
wpa_supplicant_update_scan_int(struct wpa_supplicant * wpa_s,int sec)1389 void wpa_supplicant_update_scan_int(struct wpa_supplicant *wpa_s, int sec)
1390 {
1391 struct os_reltime remaining, new_int;
1392 int cancelled;
1393
1394 cancelled = eloop_cancel_timeout_one(wpa_supplicant_scan, wpa_s, NULL,
1395 &remaining);
1396
1397 new_int.sec = sec;
1398 new_int.usec = 0;
1399 if (cancelled && os_reltime_before(&remaining, &new_int)) {
1400 new_int.sec = remaining.sec;
1401 new_int.usec = remaining.usec;
1402 }
1403
1404 if (cancelled) {
1405 eloop_register_timeout(new_int.sec, new_int.usec,
1406 wpa_supplicant_scan, wpa_s, NULL);
1407 }
1408 wpa_s->scan_interval = sec;
1409 }
1410
1411
1412 /**
1413 * wpa_supplicant_req_scan - Schedule a scan for neighboring access points
1414 * @wpa_s: Pointer to wpa_supplicant data
1415 * @sec: Number of seconds after which to scan
1416 * @usec: Number of microseconds after which to scan
1417 *
1418 * This function is used to schedule a scan for neighboring access points after
1419 * the specified time.
1420 */
wpa_supplicant_req_scan(struct wpa_supplicant * wpa_s,int sec,int usec)1421 void wpa_supplicant_req_scan(struct wpa_supplicant *wpa_s, int sec, int usec)
1422 {
1423 int res;
1424
1425 if (wpa_s->p2p_mgmt) {
1426 wpa_dbg(wpa_s, MSG_DEBUG,
1427 "Ignore scan request (%d.%06d sec) on p2p_mgmt interface",
1428 sec, usec);
1429 return;
1430 }
1431
1432 res = eloop_deplete_timeout(sec, usec, wpa_supplicant_scan, wpa_s,
1433 NULL);
1434 if (res == 1) {
1435 wpa_dbg(wpa_s, MSG_DEBUG, "Rescheduling scan request: %d.%06d sec",
1436 sec, usec);
1437 } else if (res == 0) {
1438 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore new scan request for %d.%06d sec since an earlier request is scheduled to trigger sooner",
1439 sec, usec);
1440 } else {
1441 wpa_dbg(wpa_s, MSG_DEBUG, "Setting scan request: %d.%06d sec",
1442 sec, usec);
1443 eloop_register_timeout(sec, usec, wpa_supplicant_scan, wpa_s, NULL);
1444 }
1445 }
1446
1447
1448 /**
1449 * wpa_supplicant_delayed_sched_scan - Request a delayed scheduled scan
1450 * @wpa_s: Pointer to wpa_supplicant data
1451 * @sec: Number of seconds after which to scan
1452 * @usec: Number of microseconds after which to scan
1453 * Returns: 0 on success or -1 otherwise
1454 *
1455 * This function is used to schedule periodic scans for neighboring
1456 * access points after the specified time.
1457 */
wpa_supplicant_delayed_sched_scan(struct wpa_supplicant * wpa_s,int sec,int usec)1458 int wpa_supplicant_delayed_sched_scan(struct wpa_supplicant *wpa_s,
1459 int sec, int usec)
1460 {
1461 if (!wpa_s->sched_scan_supported)
1462 return -1;
1463
1464 eloop_register_timeout(sec, usec,
1465 wpa_supplicant_delayed_sched_scan_timeout,
1466 wpa_s, NULL);
1467
1468 return 0;
1469 }
1470
1471
1472 static void
wpa_scan_set_relative_rssi_params(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)1473 wpa_scan_set_relative_rssi_params(struct wpa_supplicant *wpa_s,
1474 struct wpa_driver_scan_params *params)
1475 {
1476 if (wpa_s->wpa_state != WPA_COMPLETED ||
1477 !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SCHED_SCAN_RELATIVE_RSSI) ||
1478 wpa_s->srp.relative_rssi_set == 0)
1479 return;
1480
1481 params->relative_rssi_set = 1;
1482 params->relative_rssi = wpa_s->srp.relative_rssi;
1483
1484 if (wpa_s->srp.relative_adjust_rssi == 0)
1485 return;
1486
1487 params->relative_adjust_band = wpa_s->srp.relative_adjust_band;
1488 params->relative_adjust_rssi = wpa_s->srp.relative_adjust_rssi;
1489 }
1490
1491
1492 /**
1493 * wpa_supplicant_req_sched_scan - Start a periodic scheduled scan
1494 * @wpa_s: Pointer to wpa_supplicant data
1495 * Returns: 0 is sched_scan was started or -1 otherwise
1496 *
1497 * This function is used to schedule periodic scans for neighboring
1498 * access points repeating the scan continuously.
1499 */
wpa_supplicant_req_sched_scan(struct wpa_supplicant * wpa_s)1500 int wpa_supplicant_req_sched_scan(struct wpa_supplicant *wpa_s)
1501 {
1502 struct wpa_driver_scan_params params;
1503 struct wpa_driver_scan_params *scan_params;
1504 enum wpa_states prev_state;
1505 struct wpa_ssid *ssid = NULL;
1506 struct wpabuf *extra_ie = NULL;
1507 int ret;
1508 unsigned int max_sched_scan_ssids;
1509 int wildcard = 0;
1510 int need_ssids;
1511 struct sched_scan_plan scan_plan;
1512
1513 if (!wpa_s->sched_scan_supported)
1514 return -1;
1515
1516 if (wpa_s->max_sched_scan_ssids > WPAS_MAX_SCAN_SSIDS)
1517 max_sched_scan_ssids = WPAS_MAX_SCAN_SSIDS;
1518 else
1519 max_sched_scan_ssids = wpa_s->max_sched_scan_ssids;
1520 if (max_sched_scan_ssids < 1 || wpa_s->conf->disable_scan_offload)
1521 return -1;
1522
1523 wpa_s->sched_scan_stop_req = 0;
1524
1525 if (wpa_s->sched_scanning) {
1526 wpa_dbg(wpa_s, MSG_DEBUG, "Already sched scanning");
1527 return 0;
1528 }
1529
1530 need_ssids = 0;
1531 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1532 if (!wpas_network_disabled(wpa_s, ssid) && !ssid->scan_ssid) {
1533 /* Use wildcard SSID to find this network */
1534 wildcard = 1;
1535 } else if (!wpas_network_disabled(wpa_s, ssid) &&
1536 ssid->ssid_len)
1537 need_ssids++;
1538
1539 #ifdef CONFIG_WPS
1540 if (!wpas_network_disabled(wpa_s, ssid) &&
1541 ssid->key_mgmt == WPA_KEY_MGMT_WPS) {
1542 /*
1543 * Normal scan is more reliable and faster for WPS
1544 * operations and since these are for short periods of
1545 * time, the benefit of trying to use sched_scan would
1546 * be limited.
1547 */
1548 wpa_dbg(wpa_s, MSG_DEBUG, "Use normal scan instead of "
1549 "sched_scan for WPS");
1550 return -1;
1551 }
1552 #endif /* CONFIG_WPS */
1553 }
1554 if (wildcard)
1555 need_ssids++;
1556
1557 if (wpa_s->normal_scans < 3 &&
1558 (need_ssids <= wpa_s->max_scan_ssids ||
1559 wpa_s->max_scan_ssids >= (int) max_sched_scan_ssids)) {
1560 /*
1561 * When normal scan can speed up operations, use that for the
1562 * first operations before starting the sched_scan to allow
1563 * user space sleep more. We do this only if the normal scan
1564 * has functionality that is suitable for this or if the
1565 * sched_scan does not have better support for multiple SSIDs.
1566 */
1567 wpa_dbg(wpa_s, MSG_DEBUG, "Use normal scan instead of "
1568 "sched_scan for initial scans (normal_scans=%d)",
1569 wpa_s->normal_scans);
1570 return -1;
1571 }
1572
1573 os_memset(¶ms, 0, sizeof(params));
1574
1575 /* If we can't allocate space for the filters, we just don't filter */
1576 params.filter_ssids = os_calloc(wpa_s->max_match_sets,
1577 sizeof(struct wpa_driver_scan_filter));
1578
1579 prev_state = wpa_s->wpa_state;
1580 if (wpa_s->wpa_state == WPA_DISCONNECTED ||
1581 wpa_s->wpa_state == WPA_INACTIVE)
1582 wpa_supplicant_set_state(wpa_s, WPA_SCANNING);
1583
1584 if (wpa_s->autoscan_params != NULL) {
1585 scan_params = wpa_s->autoscan_params;
1586 goto scan;
1587 }
1588
1589 /* Find the starting point from which to continue scanning */
1590 ssid = wpa_s->conf->ssid;
1591 if (wpa_s->prev_sched_ssid) {
1592 while (ssid) {
1593 if (ssid == wpa_s->prev_sched_ssid) {
1594 ssid = ssid->next;
1595 break;
1596 }
1597 ssid = ssid->next;
1598 }
1599 }
1600
1601 if (!ssid || !wpa_s->prev_sched_ssid) {
1602 wpa_dbg(wpa_s, MSG_DEBUG, "Beginning of SSID list");
1603 wpa_s->sched_scan_timeout = max_sched_scan_ssids * 2;
1604 wpa_s->first_sched_scan = 1;
1605 ssid = wpa_s->conf->ssid;
1606 wpa_s->prev_sched_ssid = ssid;
1607 }
1608
1609 if (wildcard) {
1610 wpa_dbg(wpa_s, MSG_DEBUG, "Add wildcard SSID to sched_scan");
1611 params.num_ssids++;
1612 }
1613
1614 while (ssid) {
1615 if (wpas_network_disabled(wpa_s, ssid))
1616 goto next;
1617
1618 if (params.num_filter_ssids < wpa_s->max_match_sets &&
1619 params.filter_ssids && ssid->ssid && ssid->ssid_len) {
1620 wpa_dbg(wpa_s, MSG_DEBUG, "add to filter ssid: %s",
1621 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1622 os_memcpy(params.filter_ssids[params.num_filter_ssids].ssid,
1623 ssid->ssid, ssid->ssid_len);
1624 params.filter_ssids[params.num_filter_ssids].ssid_len =
1625 ssid->ssid_len;
1626 params.num_filter_ssids++;
1627 } else if (params.filter_ssids && ssid->ssid && ssid->ssid_len)
1628 {
1629 wpa_dbg(wpa_s, MSG_DEBUG, "Not enough room for SSID "
1630 "filter for sched_scan - drop filter");
1631 os_free(params.filter_ssids);
1632 params.filter_ssids = NULL;
1633 params.num_filter_ssids = 0;
1634 }
1635
1636 if (ssid->scan_ssid && ssid->ssid && ssid->ssid_len) {
1637 if (params.num_ssids == max_sched_scan_ssids)
1638 break; /* only room for broadcast SSID */
1639 wpa_dbg(wpa_s, MSG_DEBUG,
1640 "add to active scan ssid: %s",
1641 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1642 params.ssids[params.num_ssids].ssid =
1643 ssid->ssid;
1644 params.ssids[params.num_ssids].ssid_len =
1645 ssid->ssid_len;
1646 params.num_ssids++;
1647 if (params.num_ssids >= max_sched_scan_ssids) {
1648 wpa_s->prev_sched_ssid = ssid;
1649 do {
1650 ssid = ssid->next;
1651 } while (ssid &&
1652 (wpas_network_disabled(wpa_s, ssid) ||
1653 !ssid->scan_ssid));
1654 break;
1655 }
1656 }
1657
1658 next:
1659 wpa_s->prev_sched_ssid = ssid;
1660 ssid = ssid->next;
1661 }
1662
1663 if (params.num_filter_ssids == 0) {
1664 os_free(params.filter_ssids);
1665 params.filter_ssids = NULL;
1666 }
1667
1668 extra_ie = wpa_supplicant_extra_ies(wpa_s);
1669 if (extra_ie) {
1670 params.extra_ies = wpabuf_head(extra_ie);
1671 params.extra_ies_len = wpabuf_len(extra_ie);
1672 }
1673
1674 if (wpa_s->conf->filter_rssi)
1675 params.filter_rssi = wpa_s->conf->filter_rssi;
1676
1677 /* See if user specified frequencies. If so, scan only those. */
1678 if (wpa_s->conf->freq_list && !params.freqs) {
1679 wpa_dbg(wpa_s, MSG_DEBUG,
1680 "Optimize scan based on conf->freq_list");
1681 int_array_concat(¶ms.freqs, wpa_s->conf->freq_list);
1682 }
1683
1684 #ifdef CONFIG_MBO
1685 if (wpa_s->enable_oce & OCE_STA)
1686 params.oce_scan = 1;
1687 #endif /* CONFIG_MBO */
1688
1689 scan_params = ¶ms;
1690
1691 scan:
1692 wpa_s->sched_scan_timed_out = 0;
1693
1694 /*
1695 * We cannot support multiple scan plans if the scan request includes
1696 * too many SSID's, so in this case use only the last scan plan and make
1697 * it run infinitely. It will be stopped by the timeout.
1698 */
1699 if (wpa_s->sched_scan_plans_num == 1 ||
1700 (wpa_s->sched_scan_plans_num && !ssid && wpa_s->first_sched_scan)) {
1701 params.sched_scan_plans = wpa_s->sched_scan_plans;
1702 params.sched_scan_plans_num = wpa_s->sched_scan_plans_num;
1703 } else if (wpa_s->sched_scan_plans_num > 1) {
1704 wpa_dbg(wpa_s, MSG_DEBUG,
1705 "Too many SSIDs. Default to using single scheduled_scan plan");
1706 params.sched_scan_plans =
1707 &wpa_s->sched_scan_plans[wpa_s->sched_scan_plans_num -
1708 1];
1709 params.sched_scan_plans_num = 1;
1710 } else {
1711 if (wpa_s->conf->sched_scan_interval)
1712 scan_plan.interval = wpa_s->conf->sched_scan_interval;
1713 else
1714 scan_plan.interval = 10;
1715
1716 if (scan_plan.interval > wpa_s->max_sched_scan_plan_interval) {
1717 wpa_printf(MSG_WARNING,
1718 "Scan interval too long(%u), use the maximum allowed(%u)",
1719 scan_plan.interval,
1720 wpa_s->max_sched_scan_plan_interval);
1721 scan_plan.interval =
1722 wpa_s->max_sched_scan_plan_interval;
1723 }
1724
1725 scan_plan.iterations = 0;
1726 params.sched_scan_plans = &scan_plan;
1727 params.sched_scan_plans_num = 1;
1728 }
1729
1730 params.sched_scan_start_delay = wpa_s->conf->sched_scan_start_delay;
1731
1732 if (ssid || !wpa_s->first_sched_scan) {
1733 wpa_dbg(wpa_s, MSG_DEBUG,
1734 "Starting sched scan after %u seconds: interval %u timeout %d",
1735 params.sched_scan_start_delay,
1736 params.sched_scan_plans[0].interval,
1737 wpa_s->sched_scan_timeout);
1738 } else {
1739 wpa_dbg(wpa_s, MSG_DEBUG,
1740 "Starting sched scan after %u seconds (no timeout)",
1741 params.sched_scan_start_delay);
1742 }
1743
1744 wpa_setband_scan_freqs(wpa_s, scan_params);
1745
1746 if ((wpa_s->mac_addr_rand_enable & MAC_ADDR_RAND_SCHED_SCAN) &&
1747 wpa_s->wpa_state <= WPA_SCANNING)
1748 wpa_setup_mac_addr_rand_params(¶ms,
1749 wpa_s->mac_addr_sched_scan);
1750
1751 wpa_scan_set_relative_rssi_params(wpa_s, scan_params);
1752
1753 ret = wpa_supplicant_start_sched_scan(wpa_s, scan_params);
1754 wpabuf_free(extra_ie);
1755 os_free(params.filter_ssids);
1756 os_free(params.mac_addr);
1757 if (ret) {
1758 wpa_msg(wpa_s, MSG_WARNING, "Failed to initiate sched scan");
1759 if (prev_state != wpa_s->wpa_state)
1760 wpa_supplicant_set_state(wpa_s, prev_state);
1761 return ret;
1762 }
1763
1764 /* If we have more SSIDs to scan, add a timeout so we scan them too */
1765 if (ssid || !wpa_s->first_sched_scan) {
1766 wpa_s->sched_scan_timed_out = 0;
1767 eloop_register_timeout(wpa_s->sched_scan_timeout, 0,
1768 wpa_supplicant_sched_scan_timeout,
1769 wpa_s, NULL);
1770 wpa_s->first_sched_scan = 0;
1771 wpa_s->sched_scan_timeout /= 2;
1772 params.sched_scan_plans[0].interval *= 2;
1773 if ((unsigned int) wpa_s->sched_scan_timeout <
1774 params.sched_scan_plans[0].interval ||
1775 params.sched_scan_plans[0].interval >
1776 wpa_s->max_sched_scan_plan_interval) {
1777 params.sched_scan_plans[0].interval = 10;
1778 wpa_s->sched_scan_timeout = max_sched_scan_ssids * 2;
1779 }
1780 }
1781
1782 /* If there is no more ssids, start next time from the beginning */
1783 if (!ssid)
1784 wpa_s->prev_sched_ssid = NULL;
1785
1786 return 0;
1787 }
1788
1789
1790 /**
1791 * wpa_supplicant_cancel_scan - Cancel a scheduled scan request
1792 * @wpa_s: Pointer to wpa_supplicant data
1793 *
1794 * This function is used to cancel a scan request scheduled with
1795 * wpa_supplicant_req_scan().
1796 */
wpa_supplicant_cancel_scan(struct wpa_supplicant * wpa_s)1797 void wpa_supplicant_cancel_scan(struct wpa_supplicant *wpa_s)
1798 {
1799 wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling scan request");
1800 eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
1801 }
1802
1803
1804 /**
1805 * wpa_supplicant_cancel_delayed_sched_scan - Stop a delayed scheduled scan
1806 * @wpa_s: Pointer to wpa_supplicant data
1807 *
1808 * This function is used to stop a delayed scheduled scan.
1809 */
wpa_supplicant_cancel_delayed_sched_scan(struct wpa_supplicant * wpa_s)1810 void wpa_supplicant_cancel_delayed_sched_scan(struct wpa_supplicant *wpa_s)
1811 {
1812 if (!wpa_s->sched_scan_supported)
1813 return;
1814
1815 wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling delayed sched scan");
1816 eloop_cancel_timeout(wpa_supplicant_delayed_sched_scan_timeout,
1817 wpa_s, NULL);
1818 }
1819
1820
1821 /**
1822 * wpa_supplicant_cancel_sched_scan - Stop running scheduled scans
1823 * @wpa_s: Pointer to wpa_supplicant data
1824 *
1825 * This function is used to stop a periodic scheduled scan.
1826 */
wpa_supplicant_cancel_sched_scan(struct wpa_supplicant * wpa_s)1827 void wpa_supplicant_cancel_sched_scan(struct wpa_supplicant *wpa_s)
1828 {
1829 if (!wpa_s->sched_scanning)
1830 return;
1831
1832 if (wpa_s->sched_scanning)
1833 wpa_s->sched_scan_stop_req = 1;
1834
1835 wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling sched scan");
1836 eloop_cancel_timeout(wpa_supplicant_sched_scan_timeout, wpa_s, NULL);
1837 wpa_supplicant_stop_sched_scan(wpa_s);
1838 }
1839
1840
1841 /**
1842 * wpa_supplicant_notify_scanning - Indicate possible scan state change
1843 * @wpa_s: Pointer to wpa_supplicant data
1844 * @scanning: Whether scanning is currently in progress
1845 *
1846 * This function is to generate scanning notifycations. It is called whenever
1847 * there may have been a change in scanning (scan started, completed, stopped).
1848 * wpas_notify_scanning() is called whenever the scanning state changed from the
1849 * previously notified state.
1850 */
wpa_supplicant_notify_scanning(struct wpa_supplicant * wpa_s,int scanning)1851 void wpa_supplicant_notify_scanning(struct wpa_supplicant *wpa_s,
1852 int scanning)
1853 {
1854 if (wpa_s->scanning != scanning) {
1855 wpa_s->scanning = scanning;
1856 wpas_notify_scanning(wpa_s);
1857 }
1858 }
1859
1860
wpa_scan_get_max_rate(const struct wpa_scan_res * res)1861 static int wpa_scan_get_max_rate(const struct wpa_scan_res *res)
1862 {
1863 int rate = 0;
1864 const u8 *ie;
1865 int i;
1866
1867 ie = wpa_scan_get_ie(res, WLAN_EID_SUPP_RATES);
1868 for (i = 0; ie && i < ie[1]; i++) {
1869 if ((ie[i + 2] & 0x7f) > rate)
1870 rate = ie[i + 2] & 0x7f;
1871 }
1872
1873 ie = wpa_scan_get_ie(res, WLAN_EID_EXT_SUPP_RATES);
1874 for (i = 0; ie && i < ie[1]; i++) {
1875 if ((ie[i + 2] & 0x7f) > rate)
1876 rate = ie[i + 2] & 0x7f;
1877 }
1878
1879 return rate;
1880 }
1881
1882
1883 /**
1884 * wpa_scan_get_ie - Fetch a specified information element from a scan result
1885 * @res: Scan result entry
1886 * @ie: Information element identitifier (WLAN_EID_*)
1887 * Returns: Pointer to the information element (id field) or %NULL if not found
1888 *
1889 * This function returns the first matching information element in the scan
1890 * result.
1891 */
wpa_scan_get_ie(const struct wpa_scan_res * res,u8 ie)1892 const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
1893 {
1894 size_t ie_len = res->ie_len;
1895
1896 /* Use the Beacon frame IEs if res->ie_len is not available */
1897 if (!ie_len)
1898 ie_len = res->beacon_ie_len;
1899
1900 return get_ie((const u8 *) (res + 1), ie_len, ie);
1901 }
1902
1903
1904 /**
1905 * wpa_scan_get_vendor_ie - Fetch vendor information element from a scan result
1906 * @res: Scan result entry
1907 * @vendor_type: Vendor type (four octets starting the IE payload)
1908 * Returns: Pointer to the information element (id field) or %NULL if not found
1909 *
1910 * This function returns the first matching information element in the scan
1911 * result.
1912 */
wpa_scan_get_vendor_ie(const struct wpa_scan_res * res,u32 vendor_type)1913 const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res,
1914 u32 vendor_type)
1915 {
1916 const u8 *ies;
1917 const struct element *elem;
1918
1919 ies = (const u8 *) (res + 1);
1920
1921 for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies, res->ie_len) {
1922 if (elem->datalen >= 4 &&
1923 vendor_type == WPA_GET_BE32(elem->data))
1924 return &elem->id;
1925 }
1926
1927 return NULL;
1928 }
1929
1930
1931 /**
1932 * wpa_scan_get_vendor_ie_beacon - Fetch vendor information from a scan result
1933 * @res: Scan result entry
1934 * @vendor_type: Vendor type (four octets starting the IE payload)
1935 * Returns: Pointer to the information element (id field) or %NULL if not found
1936 *
1937 * This function returns the first matching information element in the scan
1938 * result.
1939 *
1940 * This function is like wpa_scan_get_vendor_ie(), but uses IE buffer only
1941 * from Beacon frames instead of either Beacon or Probe Response frames.
1942 */
wpa_scan_get_vendor_ie_beacon(const struct wpa_scan_res * res,u32 vendor_type)1943 const u8 * wpa_scan_get_vendor_ie_beacon(const struct wpa_scan_res *res,
1944 u32 vendor_type)
1945 {
1946 const u8 *ies;
1947 const struct element *elem;
1948
1949 if (res->beacon_ie_len == 0)
1950 return NULL;
1951
1952 ies = (const u8 *) (res + 1);
1953 ies += res->ie_len;
1954
1955 for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies,
1956 res->beacon_ie_len) {
1957 if (elem->datalen >= 4 &&
1958 vendor_type == WPA_GET_BE32(elem->data))
1959 return &elem->id;
1960 }
1961
1962 return NULL;
1963 }
1964
1965
1966 /**
1967 * wpa_scan_get_vendor_ie_multi - Fetch vendor IE data from a scan result
1968 * @res: Scan result entry
1969 * @vendor_type: Vendor type (four octets starting the IE payload)
1970 * Returns: Pointer to the information element payload or %NULL if not found
1971 *
1972 * This function returns concatenated payload of possibly fragmented vendor
1973 * specific information elements in the scan result. The caller is responsible
1974 * for freeing the returned buffer.
1975 */
wpa_scan_get_vendor_ie_multi(const struct wpa_scan_res * res,u32 vendor_type)1976 struct wpabuf * wpa_scan_get_vendor_ie_multi(const struct wpa_scan_res *res,
1977 u32 vendor_type)
1978 {
1979 struct wpabuf *buf;
1980 const u8 *end, *pos;
1981
1982 buf = wpabuf_alloc(res->ie_len);
1983 if (buf == NULL)
1984 return NULL;
1985
1986 pos = (const u8 *) (res + 1);
1987 end = pos + res->ie_len;
1988
1989 while (end - pos > 1) {
1990 u8 ie, len;
1991
1992 ie = pos[0];
1993 len = pos[1];
1994 if (len > end - pos - 2)
1995 break;
1996 pos += 2;
1997 if (ie == WLAN_EID_VENDOR_SPECIFIC && len >= 4 &&
1998 vendor_type == WPA_GET_BE32(pos))
1999 wpabuf_put_data(buf, pos + 4, len - 4);
2000 pos += len;
2001 }
2002
2003 if (wpabuf_len(buf) == 0) {
2004 wpabuf_free(buf);
2005 buf = NULL;
2006 }
2007
2008 return buf;
2009 }
2010
2011
2012 /* Compare function for sorting scan results. Return >0 if @b is considered
2013 * better. */
wpa_scan_result_compar(const void * a,const void * b)2014 static int wpa_scan_result_compar(const void *a, const void *b)
2015 {
2016 #define MIN(a,b) a < b ? a : b
2017 struct wpa_scan_res **_wa = (void *) a;
2018 struct wpa_scan_res **_wb = (void *) b;
2019 struct wpa_scan_res *wa = *_wa;
2020 struct wpa_scan_res *wb = *_wb;
2021 int wpa_a, wpa_b;
2022 int snr_a, snr_b, snr_a_full, snr_b_full;
2023
2024 /* WPA/WPA2 support preferred */
2025 wpa_a = wpa_scan_get_vendor_ie(wa, WPA_IE_VENDOR_TYPE) != NULL ||
2026 wpa_scan_get_ie(wa, WLAN_EID_RSN) != NULL;
2027 wpa_b = wpa_scan_get_vendor_ie(wb, WPA_IE_VENDOR_TYPE) != NULL ||
2028 wpa_scan_get_ie(wb, WLAN_EID_RSN) != NULL;
2029
2030 if (wpa_b && !wpa_a)
2031 return 1;
2032 if (!wpa_b && wpa_a)
2033 return -1;
2034
2035 /* privacy support preferred */
2036 if ((wa->caps & IEEE80211_CAP_PRIVACY) == 0 &&
2037 (wb->caps & IEEE80211_CAP_PRIVACY))
2038 return 1;
2039 if ((wa->caps & IEEE80211_CAP_PRIVACY) &&
2040 (wb->caps & IEEE80211_CAP_PRIVACY) == 0)
2041 return -1;
2042
2043 if (wa->flags & wb->flags & WPA_SCAN_LEVEL_DBM) {
2044 snr_a_full = wa->snr;
2045 snr_a = MIN(wa->snr, GREAT_SNR);
2046 snr_b_full = wb->snr;
2047 snr_b = MIN(wb->snr, GREAT_SNR);
2048 } else {
2049 /* Level is not in dBm, so we can't calculate
2050 * SNR. Just use raw level (units unknown). */
2051 snr_a = snr_a_full = wa->level;
2052 snr_b = snr_b_full = wb->level;
2053 }
2054
2055 /* if SNR is close, decide by max rate or frequency band */
2056 if (snr_a && snr_b && abs(snr_b - snr_a) < 7) {
2057 if (wa->est_throughput != wb->est_throughput)
2058 return (int) wb->est_throughput -
2059 (int) wa->est_throughput;
2060 }
2061 if ((snr_a && snr_b && abs(snr_b - snr_a) < 5) ||
2062 (wa->qual && wb->qual && abs(wb->qual - wa->qual) < 10)) {
2063 if (IS_5GHZ(wa->freq) ^ IS_5GHZ(wb->freq))
2064 return IS_5GHZ(wa->freq) ? -1 : 1;
2065 }
2066
2067 /* all things being equal, use SNR; if SNRs are
2068 * identical, use quality values since some drivers may only report
2069 * that value and leave the signal level zero */
2070 if (snr_b_full == snr_a_full)
2071 return wb->qual - wa->qual;
2072 return snr_b_full - snr_a_full;
2073 #undef MIN
2074 }
2075
2076
2077 #ifdef CONFIG_WPS
2078 /* Compare function for sorting scan results when searching a WPS AP for
2079 * provisioning. Return >0 if @b is considered better. */
wpa_scan_result_wps_compar(const void * a,const void * b)2080 static int wpa_scan_result_wps_compar(const void *a, const void *b)
2081 {
2082 struct wpa_scan_res **_wa = (void *) a;
2083 struct wpa_scan_res **_wb = (void *) b;
2084 struct wpa_scan_res *wa = *_wa;
2085 struct wpa_scan_res *wb = *_wb;
2086 int uses_wps_a, uses_wps_b;
2087 struct wpabuf *wps_a, *wps_b;
2088 int res;
2089
2090 /* Optimization - check WPS IE existence before allocated memory and
2091 * doing full reassembly. */
2092 uses_wps_a = wpa_scan_get_vendor_ie(wa, WPS_IE_VENDOR_TYPE) != NULL;
2093 uses_wps_b = wpa_scan_get_vendor_ie(wb, WPS_IE_VENDOR_TYPE) != NULL;
2094 if (uses_wps_a && !uses_wps_b)
2095 return -1;
2096 if (!uses_wps_a && uses_wps_b)
2097 return 1;
2098
2099 if (uses_wps_a && uses_wps_b) {
2100 wps_a = wpa_scan_get_vendor_ie_multi(wa, WPS_IE_VENDOR_TYPE);
2101 wps_b = wpa_scan_get_vendor_ie_multi(wb, WPS_IE_VENDOR_TYPE);
2102 res = wps_ap_priority_compar(wps_a, wps_b);
2103 wpabuf_free(wps_a);
2104 wpabuf_free(wps_b);
2105 if (res)
2106 return res;
2107 }
2108
2109 /*
2110 * Do not use current AP security policy as a sorting criteria during
2111 * WPS provisioning step since the AP may get reconfigured at the
2112 * completion of provisioning.
2113 */
2114
2115 /* all things being equal, use signal level; if signal levels are
2116 * identical, use quality values since some drivers may only report
2117 * that value and leave the signal level zero */
2118 if (wb->level == wa->level)
2119 return wb->qual - wa->qual;
2120 return wb->level - wa->level;
2121 }
2122 #endif /* CONFIG_WPS */
2123
2124
dump_scan_res(struct wpa_scan_results * scan_res)2125 static void dump_scan_res(struct wpa_scan_results *scan_res)
2126 {
2127 #ifndef CONFIG_NO_STDOUT_DEBUG
2128 size_t i;
2129
2130 if (scan_res->res == NULL || scan_res->num == 0)
2131 return;
2132
2133 wpa_printf(MSG_EXCESSIVE, "Sorted scan results");
2134
2135 for (i = 0; i < scan_res->num; i++) {
2136 struct wpa_scan_res *r = scan_res->res[i];
2137 u8 *pos;
2138 if (r->flags & WPA_SCAN_LEVEL_DBM) {
2139 int noise_valid = !(r->flags & WPA_SCAN_NOISE_INVALID);
2140
2141 wpa_printf(MSG_EXCESSIVE, MACSTR " freq=%d qual=%d "
2142 "noise=%d%s level=%d snr=%d%s flags=0x%x age=%u est=%u",
2143 MAC2STR(r->bssid), r->freq, r->qual,
2144 r->noise, noise_valid ? "" : "~", r->level,
2145 r->snr, r->snr >= GREAT_SNR ? "*" : "",
2146 r->flags,
2147 r->age, r->est_throughput);
2148 } else {
2149 wpa_printf(MSG_EXCESSIVE, MACSTR " freq=%d qual=%d "
2150 "noise=%d level=%d flags=0x%x age=%u est=%u",
2151 MAC2STR(r->bssid), r->freq, r->qual,
2152 r->noise, r->level, r->flags, r->age,
2153 r->est_throughput);
2154 }
2155 pos = (u8 *) (r + 1);
2156 if (r->ie_len)
2157 wpa_hexdump(MSG_EXCESSIVE, "IEs", pos, r->ie_len);
2158 pos += r->ie_len;
2159 if (r->beacon_ie_len)
2160 wpa_hexdump(MSG_EXCESSIVE, "Beacon IEs",
2161 pos, r->beacon_ie_len);
2162 }
2163 #endif /* CONFIG_NO_STDOUT_DEBUG */
2164 }
2165
2166
2167 /**
2168 * wpa_supplicant_filter_bssid_match - Is the specified BSSID allowed
2169 * @wpa_s: Pointer to wpa_supplicant data
2170 * @bssid: BSSID to check
2171 * Returns: 0 if the BSSID is filtered or 1 if not
2172 *
2173 * This function is used to filter out specific BSSIDs from scan reslts mainly
2174 * for testing purposes (SET bssid_filter ctrl_iface command).
2175 */
wpa_supplicant_filter_bssid_match(struct wpa_supplicant * wpa_s,const u8 * bssid)2176 int wpa_supplicant_filter_bssid_match(struct wpa_supplicant *wpa_s,
2177 const u8 *bssid)
2178 {
2179 size_t i;
2180
2181 if (wpa_s->bssid_filter == NULL)
2182 return 1;
2183
2184 for (i = 0; i < wpa_s->bssid_filter_count; i++) {
2185 if (os_memcmp(wpa_s->bssid_filter + i * ETH_ALEN, bssid,
2186 ETH_ALEN) == 0)
2187 return 1;
2188 }
2189
2190 return 0;
2191 }
2192
2193
filter_scan_res(struct wpa_supplicant * wpa_s,struct wpa_scan_results * res)2194 void filter_scan_res(struct wpa_supplicant *wpa_s,
2195 struct wpa_scan_results *res)
2196 {
2197 size_t i, j;
2198
2199 if (wpa_s->bssid_filter == NULL)
2200 return;
2201
2202 for (i = 0, j = 0; i < res->num; i++) {
2203 if (wpa_supplicant_filter_bssid_match(wpa_s,
2204 res->res[i]->bssid)) {
2205 res->res[j++] = res->res[i];
2206 } else {
2207 os_free(res->res[i]);
2208 res->res[i] = NULL;
2209 }
2210 }
2211
2212 if (res->num != j) {
2213 wpa_printf(MSG_DEBUG, "Filtered out %d scan results",
2214 (int) (res->num - j));
2215 res->num = j;
2216 }
2217 }
2218
2219
scan_snr(struct wpa_scan_res * res)2220 void scan_snr(struct wpa_scan_res *res)
2221 {
2222 if (res->flags & WPA_SCAN_NOISE_INVALID) {
2223 res->noise = IS_5GHZ(res->freq) ?
2224 DEFAULT_NOISE_FLOOR_5GHZ :
2225 DEFAULT_NOISE_FLOOR_2GHZ;
2226 }
2227
2228 if (res->flags & WPA_SCAN_LEVEL_DBM) {
2229 res->snr = res->level - res->noise;
2230 } else {
2231 /* Level is not in dBm, so we can't calculate
2232 * SNR. Just use raw level (units unknown). */
2233 res->snr = res->level;
2234 }
2235 }
2236
2237
2238 /* Minimum SNR required to achieve a certain bitrate. */
2239 struct minsnr_bitrate_entry {
2240 int minsnr;
2241 unsigned int bitrate; /* in Mbps */
2242 };
2243
2244 /* VHT needs to be enabled in order to achieve MCS8 and MCS9 rates. */
2245 static const int vht_mcs = 8;
2246
2247 static const struct minsnr_bitrate_entry vht20_table[] = {
2248 { 0, 0 },
2249 { 2, 6500 }, /* HT20 MCS0 */
2250 { 5, 13000 }, /* HT20 MCS1 */
2251 { 9, 19500 }, /* HT20 MCS2 */
2252 { 11, 26000 }, /* HT20 MCS3 */
2253 { 15, 39000 }, /* HT20 MCS4 */
2254 { 18, 52000 }, /* HT20 MCS5 */
2255 { 20, 58500 }, /* HT20 MCS6 */
2256 { 25, 65000 }, /* HT20 MCS7 */
2257 { 29, 78000 }, /* VHT20 MCS8 */
2258 { -1, 78000 } /* SNR > 29 */
2259 };
2260
2261 static const struct minsnr_bitrate_entry vht40_table[] = {
2262 { 0, 0 },
2263 { 5, 13500 }, /* HT40 MCS0 */
2264 { 8, 27000 }, /* HT40 MCS1 */
2265 { 12, 40500 }, /* HT40 MCS2 */
2266 { 14, 54000 }, /* HT40 MCS3 */
2267 { 18, 81000 }, /* HT40 MCS4 */
2268 { 21, 108000 }, /* HT40 MCS5 */
2269 { 23, 121500 }, /* HT40 MCS6 */
2270 { 28, 135000 }, /* HT40 MCS7 */
2271 { 32, 162000 }, /* VHT40 MCS8 */
2272 { 34, 180000 }, /* VHT40 MCS9 */
2273 { -1, 180000 } /* SNR > 34 */
2274 };
2275
2276 static const struct minsnr_bitrate_entry vht80_table[] = {
2277 { 0, 0 },
2278 { 8, 29300 }, /* VHT80 MCS0 */
2279 { 11, 58500 }, /* VHT80 MCS1 */
2280 { 15, 87800 }, /* VHT80 MCS2 */
2281 { 17, 117000 }, /* VHT80 MCS3 */
2282 { 21, 175500 }, /* VHT80 MCS4 */
2283 { 24, 234000 }, /* VHT80 MCS5 */
2284 { 26, 263300 }, /* VHT80 MCS6 */
2285 { 31, 292500 }, /* VHT80 MCS7 */
2286 { 35, 351000 }, /* VHT80 MCS8 */
2287 { 37, 390000 }, /* VHT80 MCS9 */
2288 { -1, 390000 } /* SNR > 37 */
2289 };
2290
2291
interpolate_rate(int snr,int snr0,int snr1,int rate0,int rate1)2292 static unsigned int interpolate_rate(int snr, int snr0, int snr1,
2293 int rate0, int rate1)
2294 {
2295 return rate0 + (snr - snr0) * (rate1 - rate0) / (snr1 - snr0);
2296 }
2297
2298
max_rate(const struct minsnr_bitrate_entry table[],int snr,bool vht)2299 static unsigned int max_rate(const struct minsnr_bitrate_entry table[],
2300 int snr, bool vht)
2301 {
2302 const struct minsnr_bitrate_entry *prev, *entry = table;
2303
2304 while ((entry->minsnr != -1) &&
2305 (snr >= entry->minsnr) &&
2306 (vht || entry - table <= vht_mcs))
2307 entry++;
2308 if (entry == table)
2309 return entry->bitrate;
2310 prev = entry - 1;
2311 if (entry->minsnr == -1 || (!vht && entry - table > vht_mcs))
2312 return prev->bitrate;
2313 return interpolate_rate(snr, prev->minsnr, entry->minsnr, prev->bitrate,
2314 entry->bitrate);
2315 }
2316
2317
max_ht20_rate(int snr,bool vht)2318 static unsigned int max_ht20_rate(int snr, bool vht)
2319 {
2320 return max_rate(vht20_table, snr, vht);
2321 }
2322
2323
max_ht40_rate(int snr,bool vht)2324 static unsigned int max_ht40_rate(int snr, bool vht)
2325 {
2326 return max_rate(vht40_table, snr, vht);
2327 }
2328
2329
max_vht80_rate(int snr)2330 static unsigned int max_vht80_rate(int snr)
2331 {
2332 return max_rate(vht80_table, snr, 1);
2333 }
2334
2335
wpas_get_est_tpt(const struct wpa_supplicant * wpa_s,const u8 * ies,size_t ies_len,int rate,int snr)2336 unsigned int wpas_get_est_tpt(const struct wpa_supplicant *wpa_s,
2337 const u8 *ies, size_t ies_len, int rate,
2338 int snr)
2339 {
2340 enum local_hw_capab capab = wpa_s->hw_capab;
2341 unsigned int est, tmp;
2342 const u8 *ie;
2343
2344 /* Limit based on estimated SNR */
2345 if (rate > 1 * 2 && snr < 1)
2346 rate = 1 * 2;
2347 else if (rate > 2 * 2 && snr < 4)
2348 rate = 2 * 2;
2349 else if (rate > 6 * 2 && snr < 5)
2350 rate = 6 * 2;
2351 else if (rate > 9 * 2 && snr < 6)
2352 rate = 9 * 2;
2353 else if (rate > 12 * 2 && snr < 7)
2354 rate = 12 * 2;
2355 else if (rate > 12 * 2 && snr < 8)
2356 rate = 14 * 2;
2357 else if (rate > 12 * 2 && snr < 9)
2358 rate = 16 * 2;
2359 else if (rate > 18 * 2 && snr < 10)
2360 rate = 18 * 2;
2361 else if (rate > 24 * 2 && snr < 11)
2362 rate = 24 * 2;
2363 else if (rate > 24 * 2 && snr < 12)
2364 rate = 27 * 2;
2365 else if (rate > 24 * 2 && snr < 13)
2366 rate = 30 * 2;
2367 else if (rate > 24 * 2 && snr < 14)
2368 rate = 33 * 2;
2369 else if (rate > 36 * 2 && snr < 15)
2370 rate = 36 * 2;
2371 else if (rate > 36 * 2 && snr < 16)
2372 rate = 39 * 2;
2373 else if (rate > 36 * 2 && snr < 17)
2374 rate = 42 * 2;
2375 else if (rate > 36 * 2 && snr < 18)
2376 rate = 45 * 2;
2377 else if (rate > 48 * 2 && snr < 19)
2378 rate = 48 * 2;
2379 else if (rate > 48 * 2 && snr < 20)
2380 rate = 51 * 2;
2381 else if (rate > 54 * 2 && snr < 21)
2382 rate = 54 * 2;
2383 est = rate * 500;
2384
2385 if (capab == CAPAB_HT || capab == CAPAB_HT40 || capab == CAPAB_VHT) {
2386 ie = get_ie(ies, ies_len, WLAN_EID_HT_CAP);
2387 if (ie) {
2388 tmp = max_ht20_rate(snr, false);
2389 if (tmp > est)
2390 est = tmp;
2391 }
2392 }
2393
2394 if (capab == CAPAB_HT40 || capab == CAPAB_VHT) {
2395 ie = get_ie(ies, ies_len, WLAN_EID_HT_OPERATION);
2396 if (ie && ie[1] >= 2 &&
2397 (ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK)) {
2398 tmp = max_ht40_rate(snr, false);
2399 if (tmp > est)
2400 est = tmp;
2401 }
2402 }
2403
2404 if (capab == CAPAB_VHT) {
2405 /* Use +1 to assume VHT is always faster than HT */
2406 ie = get_ie(ies, ies_len, WLAN_EID_VHT_CAP);
2407 if (ie) {
2408 tmp = max_ht20_rate(snr, true) + 1;
2409 if (tmp > est)
2410 est = tmp;
2411
2412 ie = get_ie(ies, ies_len, WLAN_EID_HT_OPERATION);
2413 if (ie && ie[1] >= 2 &&
2414 (ie[3] &
2415 HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK)) {
2416 tmp = max_ht40_rate(snr, true) + 1;
2417 if (tmp > est)
2418 est = tmp;
2419 }
2420
2421 ie = get_ie(ies, ies_len, WLAN_EID_VHT_OPERATION);
2422 if (ie && ie[1] >= 1 &&
2423 (ie[2] & VHT_OPMODE_CHANNEL_WIDTH_MASK)) {
2424 tmp = max_vht80_rate(snr) + 1;
2425 if (tmp > est)
2426 est = tmp;
2427 }
2428 }
2429 }
2430
2431 return est;
2432 }
2433
2434
scan_est_throughput(struct wpa_supplicant * wpa_s,struct wpa_scan_res * res)2435 void scan_est_throughput(struct wpa_supplicant *wpa_s,
2436 struct wpa_scan_res *res)
2437 {
2438 int rate; /* max legacy rate in 500 kb/s units */
2439 int snr = res->snr;
2440 const u8 *ies = (const void *) (res + 1);
2441 size_t ie_len = res->ie_len;
2442
2443 if (res->est_throughput)
2444 return;
2445
2446 /* Get maximum legacy rate */
2447 rate = wpa_scan_get_max_rate(res);
2448
2449 if (!ie_len)
2450 ie_len = res->beacon_ie_len;
2451 res->est_throughput =
2452 wpas_get_est_tpt(wpa_s, ies, ie_len, rate, snr);
2453
2454 /* TODO: channel utilization and AP load (e.g., from AP Beacon) */
2455 }
2456
2457
2458 /**
2459 * wpa_supplicant_get_scan_results - Get scan results
2460 * @wpa_s: Pointer to wpa_supplicant data
2461 * @info: Information about what was scanned or %NULL if not available
2462 * @new_scan: Whether a new scan was performed
2463 * Returns: Scan results, %NULL on failure
2464 *
2465 * This function request the current scan results from the driver and updates
2466 * the local BSS list wpa_s->bss. The caller is responsible for freeing the
2467 * results with wpa_scan_results_free().
2468 */
2469 struct wpa_scan_results *
wpa_supplicant_get_scan_results(struct wpa_supplicant * wpa_s,struct scan_info * info,int new_scan)2470 wpa_supplicant_get_scan_results(struct wpa_supplicant *wpa_s,
2471 struct scan_info *info, int new_scan)
2472 {
2473 struct wpa_scan_results *scan_res;
2474 size_t i;
2475 int (*compar)(const void *, const void *) = wpa_scan_result_compar;
2476
2477 scan_res = wpa_drv_get_scan_results2(wpa_s);
2478 if (scan_res == NULL) {
2479 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to get scan results");
2480 return NULL;
2481 }
2482 if (scan_res->fetch_time.sec == 0) {
2483 /*
2484 * Make sure we have a valid timestamp if the driver wrapper
2485 * does not set this.
2486 */
2487 os_get_reltime(&scan_res->fetch_time);
2488 }
2489 filter_scan_res(wpa_s, scan_res);
2490
2491 for (i = 0; i < scan_res->num; i++) {
2492 struct wpa_scan_res *scan_res_item = scan_res->res[i];
2493
2494 scan_snr(scan_res_item);
2495 scan_est_throughput(wpa_s, scan_res_item);
2496 }
2497
2498 #ifdef CONFIG_WPS
2499 if (wpas_wps_searching(wpa_s)) {
2500 wpa_dbg(wpa_s, MSG_DEBUG, "WPS: Order scan results with WPS "
2501 "provisioning rules");
2502 compar = wpa_scan_result_wps_compar;
2503 }
2504 #endif /* CONFIG_WPS */
2505
2506 if (scan_res->res) {
2507 qsort(scan_res->res, scan_res->num,
2508 sizeof(struct wpa_scan_res *), compar);
2509 }
2510 dump_scan_res(scan_res);
2511
2512 if (wpa_s->ignore_post_flush_scan_res) {
2513 /* FLUSH command aborted an ongoing scan and these are the
2514 * results from the aborted scan. Do not process the results to
2515 * maintain flushed state. */
2516 wpa_dbg(wpa_s, MSG_DEBUG,
2517 "Do not update BSS table based on pending post-FLUSH scan results");
2518 wpa_s->ignore_post_flush_scan_res = 0;
2519 return scan_res;
2520 }
2521
2522 wpa_bss_update_start(wpa_s);
2523 for (i = 0; i < scan_res->num; i++)
2524 wpa_bss_update_scan_res(wpa_s, scan_res->res[i],
2525 &scan_res->fetch_time);
2526 wpa_bss_update_end(wpa_s, info, new_scan);
2527
2528 return scan_res;
2529 }
2530
2531
2532 /**
2533 * wpa_supplicant_update_scan_results - Update scan results from the driver
2534 * @wpa_s: Pointer to wpa_supplicant data
2535 * Returns: 0 on success, -1 on failure
2536 *
2537 * This function updates the BSS table within wpa_supplicant based on the
2538 * currently available scan results from the driver without requesting a new
2539 * scan. This is used in cases where the driver indicates an association
2540 * (including roaming within ESS) and wpa_supplicant does not yet have the
2541 * needed information to complete the connection (e.g., to perform validation
2542 * steps in 4-way handshake).
2543 */
wpa_supplicant_update_scan_results(struct wpa_supplicant * wpa_s)2544 int wpa_supplicant_update_scan_results(struct wpa_supplicant *wpa_s)
2545 {
2546 struct wpa_scan_results *scan_res;
2547 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
2548 if (scan_res == NULL)
2549 return -1;
2550 wpa_scan_results_free(scan_res);
2551
2552 return 0;
2553 }
2554
2555
2556 /**
2557 * scan_only_handler - Reports scan results
2558 */
scan_only_handler(struct wpa_supplicant * wpa_s,struct wpa_scan_results * scan_res)2559 void scan_only_handler(struct wpa_supplicant *wpa_s,
2560 struct wpa_scan_results *scan_res)
2561 {
2562 wpa_dbg(wpa_s, MSG_DEBUG, "Scan-only results received");
2563 if (wpa_s->last_scan_req == MANUAL_SCAN_REQ &&
2564 wpa_s->manual_scan_use_id && wpa_s->own_scan_running) {
2565 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS "id=%u",
2566 wpa_s->manual_scan_id);
2567 wpa_s->manual_scan_use_id = 0;
2568 } else {
2569 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
2570 }
2571 wpas_notify_scan_results(wpa_s);
2572 wpas_notify_scan_done(wpa_s, 1);
2573 if (wpa_s->scan_work) {
2574 struct wpa_radio_work *work = wpa_s->scan_work;
2575 wpa_s->scan_work = NULL;
2576 radio_work_done(work);
2577 }
2578
2579 if (wpa_s->wpa_state == WPA_SCANNING)
2580 wpa_supplicant_set_state(wpa_s, wpa_s->scan_prev_wpa_state);
2581 }
2582
2583
wpas_scan_scheduled(struct wpa_supplicant * wpa_s)2584 int wpas_scan_scheduled(struct wpa_supplicant *wpa_s)
2585 {
2586 return eloop_is_timeout_registered(wpa_supplicant_scan, wpa_s, NULL);
2587 }
2588
2589
2590 struct wpa_driver_scan_params *
wpa_scan_clone_params(const struct wpa_driver_scan_params * src)2591 wpa_scan_clone_params(const struct wpa_driver_scan_params *src)
2592 {
2593 struct wpa_driver_scan_params *params;
2594 size_t i;
2595 u8 *n;
2596
2597 params = os_zalloc(sizeof(*params));
2598 if (params == NULL)
2599 return NULL;
2600
2601 for (i = 0; i < src->num_ssids; i++) {
2602 if (src->ssids[i].ssid) {
2603 n = os_memdup(src->ssids[i].ssid,
2604 src->ssids[i].ssid_len);
2605 if (n == NULL)
2606 goto failed;
2607 params->ssids[i].ssid = n;
2608 params->ssids[i].ssid_len = src->ssids[i].ssid_len;
2609 }
2610 }
2611 params->num_ssids = src->num_ssids;
2612
2613 if (src->extra_ies) {
2614 n = os_memdup(src->extra_ies, src->extra_ies_len);
2615 if (n == NULL)
2616 goto failed;
2617 params->extra_ies = n;
2618 params->extra_ies_len = src->extra_ies_len;
2619 }
2620
2621 if (src->freqs) {
2622 int len = int_array_len(src->freqs);
2623 params->freqs = os_memdup(src->freqs, (len + 1) * sizeof(int));
2624 if (params->freqs == NULL)
2625 goto failed;
2626 }
2627
2628 if (src->filter_ssids) {
2629 params->filter_ssids = os_memdup(src->filter_ssids,
2630 sizeof(*params->filter_ssids) *
2631 src->num_filter_ssids);
2632 if (params->filter_ssids == NULL)
2633 goto failed;
2634 params->num_filter_ssids = src->num_filter_ssids;
2635 }
2636
2637 params->filter_rssi = src->filter_rssi;
2638 params->p2p_probe = src->p2p_probe;
2639 params->only_new_results = src->only_new_results;
2640 params->low_priority = src->low_priority;
2641 params->duration = src->duration;
2642 params->duration_mandatory = src->duration_mandatory;
2643 params->oce_scan = src->oce_scan;
2644
2645 if (src->sched_scan_plans_num > 0) {
2646 params->sched_scan_plans =
2647 os_memdup(src->sched_scan_plans,
2648 sizeof(*src->sched_scan_plans) *
2649 src->sched_scan_plans_num);
2650 if (!params->sched_scan_plans)
2651 goto failed;
2652
2653 params->sched_scan_plans_num = src->sched_scan_plans_num;
2654 }
2655
2656 if (src->mac_addr_rand &&
2657 wpa_setup_mac_addr_rand_params(params, src->mac_addr))
2658 goto failed;
2659
2660 if (src->bssid) {
2661 u8 *bssid;
2662
2663 bssid = os_memdup(src->bssid, ETH_ALEN);
2664 if (!bssid)
2665 goto failed;
2666 params->bssid = bssid;
2667 }
2668
2669 params->relative_rssi_set = src->relative_rssi_set;
2670 params->relative_rssi = src->relative_rssi;
2671 params->relative_adjust_band = src->relative_adjust_band;
2672 params->relative_adjust_rssi = src->relative_adjust_rssi;
2673 return params;
2674
2675 failed:
2676 wpa_scan_free_params(params);
2677 return NULL;
2678 }
2679
2680
wpa_scan_free_params(struct wpa_driver_scan_params * params)2681 void wpa_scan_free_params(struct wpa_driver_scan_params *params)
2682 {
2683 size_t i;
2684
2685 if (params == NULL)
2686 return;
2687
2688 for (i = 0; i < params->num_ssids; i++)
2689 os_free((u8 *) params->ssids[i].ssid);
2690 os_free((u8 *) params->extra_ies);
2691 os_free(params->freqs);
2692 os_free(params->filter_ssids);
2693 os_free(params->sched_scan_plans);
2694
2695 /*
2696 * Note: params->mac_addr_mask points to same memory allocation and
2697 * must not be freed separately.
2698 */
2699 os_free((u8 *) params->mac_addr);
2700
2701 os_free((u8 *) params->bssid);
2702
2703 os_free(params);
2704 }
2705
2706
wpas_start_pno(struct wpa_supplicant * wpa_s)2707 int wpas_start_pno(struct wpa_supplicant *wpa_s)
2708 {
2709 int ret;
2710 size_t prio, i, num_ssid, num_match_ssid;
2711 struct wpa_ssid *ssid;
2712 struct wpa_driver_scan_params params;
2713 struct sched_scan_plan scan_plan;
2714 unsigned int max_sched_scan_ssids;
2715
2716 if (!wpa_s->sched_scan_supported)
2717 return -1;
2718
2719 if (wpa_s->max_sched_scan_ssids > WPAS_MAX_SCAN_SSIDS)
2720 max_sched_scan_ssids = WPAS_MAX_SCAN_SSIDS;
2721 else
2722 max_sched_scan_ssids = wpa_s->max_sched_scan_ssids;
2723 if (max_sched_scan_ssids < 1)
2724 return -1;
2725
2726 if (wpa_s->pno || wpa_s->pno_sched_pending)
2727 return 0;
2728
2729 if ((wpa_s->wpa_state > WPA_SCANNING) &&
2730 (wpa_s->wpa_state < WPA_COMPLETED)) {
2731 wpa_printf(MSG_ERROR, "PNO: In assoc process");
2732 return -EAGAIN;
2733 }
2734
2735 if (wpa_s->wpa_state == WPA_SCANNING) {
2736 wpa_supplicant_cancel_scan(wpa_s);
2737 if (wpa_s->sched_scanning) {
2738 wpa_printf(MSG_DEBUG, "Schedule PNO on completion of "
2739 "ongoing sched scan");
2740 wpa_supplicant_cancel_sched_scan(wpa_s);
2741 wpa_s->pno_sched_pending = 1;
2742 return 0;
2743 }
2744 }
2745
2746 if (wpa_s->sched_scan_stop_req) {
2747 wpa_printf(MSG_DEBUG,
2748 "Schedule PNO after previous sched scan has stopped");
2749 wpa_s->pno_sched_pending = 1;
2750 return 0;
2751 }
2752
2753 os_memset(¶ms, 0, sizeof(params));
2754
2755 num_ssid = num_match_ssid = 0;
2756 ssid = wpa_s->conf->ssid;
2757 while (ssid) {
2758 if (!wpas_network_disabled(wpa_s, ssid)) {
2759 num_match_ssid++;
2760 if (ssid->scan_ssid)
2761 num_ssid++;
2762 }
2763 ssid = ssid->next;
2764 }
2765
2766 if (num_match_ssid == 0) {
2767 wpa_printf(MSG_DEBUG, "PNO: No configured SSIDs");
2768 return -1;
2769 }
2770
2771 if (num_match_ssid > num_ssid) {
2772 params.num_ssids++; /* wildcard */
2773 num_ssid++;
2774 }
2775
2776 if (num_ssid > max_sched_scan_ssids) {
2777 wpa_printf(MSG_DEBUG, "PNO: Use only the first %u SSIDs from "
2778 "%u", max_sched_scan_ssids, (unsigned int) num_ssid);
2779 num_ssid = max_sched_scan_ssids;
2780 }
2781
2782 if (num_match_ssid > wpa_s->max_match_sets) {
2783 num_match_ssid = wpa_s->max_match_sets;
2784 wpa_dbg(wpa_s, MSG_DEBUG, "PNO: Too many SSIDs to match");
2785 }
2786 params.filter_ssids = os_calloc(num_match_ssid,
2787 sizeof(struct wpa_driver_scan_filter));
2788 if (params.filter_ssids == NULL)
2789 return -1;
2790
2791 i = 0;
2792 prio = 0;
2793 ssid = wpa_s->conf->pssid[prio];
2794 while (ssid) {
2795 if (!wpas_network_disabled(wpa_s, ssid)) {
2796 if (ssid->scan_ssid && params.num_ssids < num_ssid) {
2797 params.ssids[params.num_ssids].ssid =
2798 ssid->ssid;
2799 params.ssids[params.num_ssids].ssid_len =
2800 ssid->ssid_len;
2801 params.num_ssids++;
2802 }
2803 os_memcpy(params.filter_ssids[i].ssid, ssid->ssid,
2804 ssid->ssid_len);
2805 params.filter_ssids[i].ssid_len = ssid->ssid_len;
2806 params.num_filter_ssids++;
2807 i++;
2808 if (i == num_match_ssid)
2809 break;
2810 }
2811 if (ssid->pnext)
2812 ssid = ssid->pnext;
2813 else if (prio + 1 == wpa_s->conf->num_prio)
2814 break;
2815 else
2816 ssid = wpa_s->conf->pssid[++prio];
2817 }
2818
2819 if (wpa_s->conf->filter_rssi)
2820 params.filter_rssi = wpa_s->conf->filter_rssi;
2821
2822 if (wpa_s->sched_scan_plans_num) {
2823 params.sched_scan_plans = wpa_s->sched_scan_plans;
2824 params.sched_scan_plans_num = wpa_s->sched_scan_plans_num;
2825 } else {
2826 /* Set one scan plan that will run infinitely */
2827 if (wpa_s->conf->sched_scan_interval)
2828 scan_plan.interval = wpa_s->conf->sched_scan_interval;
2829 else
2830 scan_plan.interval = 10;
2831
2832 scan_plan.iterations = 0;
2833 params.sched_scan_plans = &scan_plan;
2834 params.sched_scan_plans_num = 1;
2835 }
2836
2837 params.sched_scan_start_delay = wpa_s->conf->sched_scan_start_delay;
2838
2839 if (params.freqs == NULL && wpa_s->manual_sched_scan_freqs) {
2840 wpa_dbg(wpa_s, MSG_DEBUG, "Limit sched scan to specified channels");
2841 params.freqs = wpa_s->manual_sched_scan_freqs;
2842 }
2843
2844 if ((wpa_s->mac_addr_rand_enable & MAC_ADDR_RAND_PNO) &&
2845 wpa_s->wpa_state <= WPA_SCANNING)
2846 wpa_setup_mac_addr_rand_params(¶ms, wpa_s->mac_addr_pno);
2847
2848 wpa_scan_set_relative_rssi_params(wpa_s, ¶ms);
2849
2850 ret = wpa_supplicant_start_sched_scan(wpa_s, ¶ms);
2851 os_free(params.filter_ssids);
2852 os_free(params.mac_addr);
2853 if (ret == 0)
2854 wpa_s->pno = 1;
2855 else
2856 wpa_msg(wpa_s, MSG_ERROR, "Failed to schedule PNO");
2857 return ret;
2858 }
2859
2860
wpas_stop_pno(struct wpa_supplicant * wpa_s)2861 int wpas_stop_pno(struct wpa_supplicant *wpa_s)
2862 {
2863 int ret = 0;
2864
2865 if (!wpa_s->pno)
2866 return 0;
2867
2868 ret = wpa_supplicant_stop_sched_scan(wpa_s);
2869 wpa_s->sched_scan_stop_req = 1;
2870
2871 wpa_s->pno = 0;
2872 wpa_s->pno_sched_pending = 0;
2873
2874 if (wpa_s->wpa_state == WPA_SCANNING)
2875 wpa_supplicant_req_scan(wpa_s, 0, 0);
2876
2877 return ret;
2878 }
2879
2880
wpas_mac_addr_rand_scan_clear(struct wpa_supplicant * wpa_s,unsigned int type)2881 void wpas_mac_addr_rand_scan_clear(struct wpa_supplicant *wpa_s,
2882 unsigned int type)
2883 {
2884 type &= MAC_ADDR_RAND_ALL;
2885 wpa_s->mac_addr_rand_enable &= ~type;
2886
2887 if (type & MAC_ADDR_RAND_SCAN) {
2888 os_free(wpa_s->mac_addr_scan);
2889 wpa_s->mac_addr_scan = NULL;
2890 }
2891
2892 if (type & MAC_ADDR_RAND_SCHED_SCAN) {
2893 os_free(wpa_s->mac_addr_sched_scan);
2894 wpa_s->mac_addr_sched_scan = NULL;
2895 }
2896
2897 if (type & MAC_ADDR_RAND_PNO) {
2898 os_free(wpa_s->mac_addr_pno);
2899 wpa_s->mac_addr_pno = NULL;
2900 }
2901 }
2902
2903
wpas_mac_addr_rand_scan_set(struct wpa_supplicant * wpa_s,unsigned int type,const u8 * addr,const u8 * mask)2904 int wpas_mac_addr_rand_scan_set(struct wpa_supplicant *wpa_s,
2905 unsigned int type, const u8 *addr,
2906 const u8 *mask)
2907 {
2908 u8 *tmp = NULL;
2909
2910 if ((wpa_s->mac_addr_rand_supported & type) != type ) {
2911 wpa_printf(MSG_INFO,
2912 "scan: MAC randomization type %u != supported=%u",
2913 type, wpa_s->mac_addr_rand_supported);
2914 return -1;
2915 }
2916
2917 wpas_mac_addr_rand_scan_clear(wpa_s, type);
2918
2919 if (addr) {
2920 tmp = os_malloc(2 * ETH_ALEN);
2921 if (!tmp)
2922 return -1;
2923 os_memcpy(tmp, addr, ETH_ALEN);
2924 os_memcpy(tmp + ETH_ALEN, mask, ETH_ALEN);
2925 }
2926
2927 if (type == MAC_ADDR_RAND_SCAN) {
2928 wpa_s->mac_addr_scan = tmp;
2929 } else if (type == MAC_ADDR_RAND_SCHED_SCAN) {
2930 wpa_s->mac_addr_sched_scan = tmp;
2931 } else if (type == MAC_ADDR_RAND_PNO) {
2932 wpa_s->mac_addr_pno = tmp;
2933 } else {
2934 wpa_printf(MSG_INFO,
2935 "scan: Invalid MAC randomization type=0x%x",
2936 type);
2937 os_free(tmp);
2938 return -1;
2939 }
2940
2941 wpa_s->mac_addr_rand_enable |= type;
2942 return 0;
2943 }
2944
2945
wpas_mac_addr_rand_scan_get_mask(struct wpa_supplicant * wpa_s,unsigned int type,u8 * mask)2946 int wpas_mac_addr_rand_scan_get_mask(struct wpa_supplicant *wpa_s,
2947 unsigned int type, u8 *mask)
2948 {
2949 const u8 *to_copy;
2950
2951 if ((wpa_s->mac_addr_rand_enable & type) != type)
2952 return -1;
2953
2954 if (type == MAC_ADDR_RAND_SCAN) {
2955 to_copy = wpa_s->mac_addr_scan;
2956 } else if (type == MAC_ADDR_RAND_SCHED_SCAN) {
2957 to_copy = wpa_s->mac_addr_sched_scan;
2958 } else if (type == MAC_ADDR_RAND_PNO) {
2959 to_copy = wpa_s->mac_addr_pno;
2960 } else {
2961 wpa_printf(MSG_DEBUG,
2962 "scan: Invalid MAC randomization type=0x%x",
2963 type);
2964 return -1;
2965 }
2966
2967 os_memcpy(mask, to_copy + ETH_ALEN, ETH_ALEN);
2968 return 0;
2969 }
2970
2971
wpas_abort_ongoing_scan(struct wpa_supplicant * wpa_s)2972 int wpas_abort_ongoing_scan(struct wpa_supplicant *wpa_s)
2973 {
2974 struct wpa_radio_work *work;
2975 struct wpa_radio *radio = wpa_s->radio;
2976
2977 dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
2978 if (work->wpa_s != wpa_s || !work->started ||
2979 (os_strcmp(work->type, "scan") != 0 &&
2980 os_strcmp(work->type, "p2p-scan") != 0))
2981 continue;
2982 wpa_dbg(wpa_s, MSG_DEBUG, "Abort an ongoing scan");
2983 return wpa_drv_abort_scan(wpa_s, wpa_s->curr_scan_cookie);
2984 }
2985
2986 wpa_dbg(wpa_s, MSG_DEBUG, "No ongoing scan/p2p-scan found to abort");
2987 return -1;
2988 }
2989
2990
wpas_sched_scan_plans_set(struct wpa_supplicant * wpa_s,const char * cmd)2991 int wpas_sched_scan_plans_set(struct wpa_supplicant *wpa_s, const char *cmd)
2992 {
2993 struct sched_scan_plan *scan_plans = NULL;
2994 const char *token, *context = NULL;
2995 unsigned int num = 0;
2996
2997 if (!cmd)
2998 return -1;
2999
3000 if (!cmd[0]) {
3001 wpa_printf(MSG_DEBUG, "Clear sched scan plans");
3002 os_free(wpa_s->sched_scan_plans);
3003 wpa_s->sched_scan_plans = NULL;
3004 wpa_s->sched_scan_plans_num = 0;
3005 return 0;
3006 }
3007
3008 while ((token = cstr_token(cmd, " ", &context))) {
3009 int ret;
3010 struct sched_scan_plan *scan_plan, *n;
3011
3012 n = os_realloc_array(scan_plans, num + 1, sizeof(*scan_plans));
3013 if (!n)
3014 goto fail;
3015
3016 scan_plans = n;
3017 scan_plan = &scan_plans[num];
3018 num++;
3019
3020 ret = sscanf(token, "%u:%u", &scan_plan->interval,
3021 &scan_plan->iterations);
3022 if (ret <= 0 || ret > 2 || !scan_plan->interval) {
3023 wpa_printf(MSG_ERROR,
3024 "Invalid sched scan plan input: %s", token);
3025 goto fail;
3026 }
3027
3028 if (scan_plan->interval > wpa_s->max_sched_scan_plan_interval) {
3029 wpa_printf(MSG_WARNING,
3030 "scan plan %u: Scan interval too long(%u), use the maximum allowed(%u)",
3031 num, scan_plan->interval,
3032 wpa_s->max_sched_scan_plan_interval);
3033 scan_plan->interval =
3034 wpa_s->max_sched_scan_plan_interval;
3035 }
3036
3037 if (ret == 1) {
3038 scan_plan->iterations = 0;
3039 break;
3040 }
3041
3042 if (!scan_plan->iterations) {
3043 wpa_printf(MSG_ERROR,
3044 "scan plan %u: Number of iterations cannot be zero",
3045 num);
3046 goto fail;
3047 }
3048
3049 if (scan_plan->iterations >
3050 wpa_s->max_sched_scan_plan_iterations) {
3051 wpa_printf(MSG_WARNING,
3052 "scan plan %u: Too many iterations(%u), use the maximum allowed(%u)",
3053 num, scan_plan->iterations,
3054 wpa_s->max_sched_scan_plan_iterations);
3055 scan_plan->iterations =
3056 wpa_s->max_sched_scan_plan_iterations;
3057 }
3058
3059 wpa_printf(MSG_DEBUG,
3060 "scan plan %u: interval=%u iterations=%u",
3061 num, scan_plan->interval, scan_plan->iterations);
3062 }
3063
3064 if (!scan_plans) {
3065 wpa_printf(MSG_ERROR, "Invalid scan plans entry");
3066 goto fail;
3067 }
3068
3069 if (cstr_token(cmd, " ", &context) || scan_plans[num - 1].iterations) {
3070 wpa_printf(MSG_ERROR,
3071 "All scan plans but the last must specify a number of iterations");
3072 goto fail;
3073 }
3074
3075 wpa_printf(MSG_DEBUG, "scan plan %u (last plan): interval=%u",
3076 num, scan_plans[num - 1].interval);
3077
3078 if (num > wpa_s->max_sched_scan_plans) {
3079 wpa_printf(MSG_WARNING,
3080 "Too many scheduled scan plans (only %u supported)",
3081 wpa_s->max_sched_scan_plans);
3082 wpa_printf(MSG_WARNING,
3083 "Use only the first %u scan plans, and the last one (in infinite loop)",
3084 wpa_s->max_sched_scan_plans - 1);
3085 os_memcpy(&scan_plans[wpa_s->max_sched_scan_plans - 1],
3086 &scan_plans[num - 1], sizeof(*scan_plans));
3087 num = wpa_s->max_sched_scan_plans;
3088 }
3089
3090 os_free(wpa_s->sched_scan_plans);
3091 wpa_s->sched_scan_plans = scan_plans;
3092 wpa_s->sched_scan_plans_num = num;
3093
3094 return 0;
3095
3096 fail:
3097 os_free(scan_plans);
3098 wpa_printf(MSG_ERROR, "invalid scan plans list");
3099 return -1;
3100 }
3101
3102
3103 /**
3104 * wpas_scan_reset_sched_scan - Reset sched_scan state
3105 * @wpa_s: Pointer to wpa_supplicant data
3106 *
3107 * This function is used to cancel a running scheduled scan and to reset an
3108 * internal scan state to continue with a regular scan on the following
3109 * wpa_supplicant_req_scan() calls.
3110 */
wpas_scan_reset_sched_scan(struct wpa_supplicant * wpa_s)3111 void wpas_scan_reset_sched_scan(struct wpa_supplicant *wpa_s)
3112 {
3113 wpa_s->normal_scans = 0;
3114 if (wpa_s->sched_scanning) {
3115 wpa_s->sched_scan_timed_out = 0;
3116 wpa_s->prev_sched_ssid = NULL;
3117 wpa_supplicant_cancel_sched_scan(wpa_s);
3118 }
3119 }
3120
3121
wpas_scan_restart_sched_scan(struct wpa_supplicant * wpa_s)3122 void wpas_scan_restart_sched_scan(struct wpa_supplicant *wpa_s)
3123 {
3124 /* simulate timeout to restart the sched scan */
3125 wpa_s->sched_scan_timed_out = 1;
3126 wpa_s->prev_sched_ssid = NULL;
3127 wpa_supplicant_cancel_sched_scan(wpa_s);
3128 }
3129