1 /*
2 * wpa_supplicant - SME
3 * Copyright (c) 2009-2014, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/ieee802_11_common.h"
15 #include "common/ocv.h"
16 #include "common/hw_features_common.h"
17 #include "eapol_supp/eapol_supp_sm.h"
18 #include "common/wpa_common.h"
19 #include "common/sae.h"
20 #include "common/dpp.h"
21 #include "rsn_supp/wpa.h"
22 #include "rsn_supp/pmksa_cache.h"
23 #include "config.h"
24 #include "wpa_supplicant_i.h"
25 #include "driver_i.h"
26 #include "wpas_glue.h"
27 #include "wps_supplicant.h"
28 #include "p2p_supplicant.h"
29 #include "notify.h"
30 #include "bss.h"
31 #include "scan.h"
32 #include "sme.h"
33 #include "hs20_supplicant.h"
34
35 #define SME_AUTH_TIMEOUT 5
36 #define SME_ASSOC_TIMEOUT 5
37
38 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
39 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
40 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
41 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
42
43
44 #ifdef CONFIG_SAE
45
index_within_array(const int * array,int idx)46 static int index_within_array(const int *array, int idx)
47 {
48 int i;
49 for (i = 0; i < idx; i++) {
50 if (array[i] <= 0)
51 return 0;
52 }
53 return 1;
54 }
55
56
sme_set_sae_group(struct wpa_supplicant * wpa_s)57 static int sme_set_sae_group(struct wpa_supplicant *wpa_s)
58 {
59 int *groups = wpa_s->conf->sae_groups;
60 int default_groups[] = { 19, 20, 21, 0 };
61
62 if (!groups || groups[0] <= 0)
63 groups = default_groups;
64
65 /* Configuration may have changed, so validate current index */
66 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
67 return -1;
68
69 for (;;) {
70 int group = groups[wpa_s->sme.sae_group_index];
71 if (group <= 0)
72 break;
73 if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
74 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
75 wpa_s->sme.sae.group);
76 return 0;
77 }
78 wpa_s->sme.sae_group_index++;
79 }
80
81 return -1;
82 }
83
84
sme_auth_build_sae_commit(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,const u8 * bssid,int external,int reuse,int * ret_use_pt,bool * ret_use_pk)85 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
86 struct wpa_ssid *ssid,
87 const u8 *bssid, int external,
88 int reuse, int *ret_use_pt,
89 bool *ret_use_pk)
90 {
91 struct wpabuf *buf;
92 size_t len;
93 const char *password;
94 struct wpa_bss *bss;
95 int use_pt = 0;
96 bool use_pk = false;
97 u8 rsnxe_capa = 0;
98
99 if (ret_use_pt)
100 *ret_use_pt = 0;
101 if (ret_use_pk)
102 *ret_use_pk = false;
103
104 #ifdef CONFIG_TESTING_OPTIONS
105 if (wpa_s->sae_commit_override) {
106 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
107 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
108 if (!buf)
109 return NULL;
110 if (!external) {
111 wpabuf_put_le16(buf, 1); /* Transaction seq# */
112 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
113 }
114 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
115 return buf;
116 }
117 #endif /* CONFIG_TESTING_OPTIONS */
118
119 password = ssid->sae_password;
120 if (!password)
121 password = ssid->passphrase;
122 if (!password) {
123 wpa_printf(MSG_DEBUG, "SAE: No password available");
124 return NULL;
125 }
126
127 if (reuse && wpa_s->sme.sae.tmp &&
128 os_memcmp(bssid, wpa_s->sme.sae.tmp->bssid, ETH_ALEN) == 0) {
129 wpa_printf(MSG_DEBUG,
130 "SAE: Reuse previously generated PWE on a retry with the same AP");
131 use_pt = wpa_s->sme.sae.h2e;
132 use_pk = wpa_s->sme.sae.pk;
133 goto reuse_data;
134 }
135 if (sme_set_sae_group(wpa_s) < 0) {
136 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
137 return NULL;
138 }
139
140 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
141 if (bss) {
142 const u8 *rsnxe;
143
144 rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
145 if (rsnxe && rsnxe[1] >= 1)
146 rsnxe_capa = rsnxe[2];
147 }
148
149 if (ssid->sae_password_id && wpa_s->conf->sae_pwe != 3)
150 use_pt = 1;
151 #ifdef CONFIG_SAE_PK
152 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
153 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
154 ((ssid->sae_password &&
155 sae_pk_valid_password(ssid->sae_password)) ||
156 (!ssid->sae_password && ssid->passphrase &&
157 sae_pk_valid_password(ssid->passphrase)))) {
158 use_pt = 1;
159 use_pk = true;
160 }
161
162 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
163 wpa_printf(MSG_DEBUG,
164 "SAE: Cannot use PK with the selected AP");
165 return NULL;
166 }
167 #endif /* CONFIG_SAE_PK */
168
169 if (use_pt || wpa_s->conf->sae_pwe == 1 || wpa_s->conf->sae_pwe == 2) {
170 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
171
172 if ((wpa_s->conf->sae_pwe == 1 || ssid->sae_password_id) &&
173 wpa_s->conf->sae_pwe != 3 &&
174 !use_pt) {
175 wpa_printf(MSG_DEBUG,
176 "SAE: Cannot use H2E with the selected AP");
177 return NULL;
178 }
179 }
180
181 if (use_pt &&
182 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
183 wpa_s->own_addr, bssid,
184 wpa_s->sme.sae_rejected_groups, NULL) < 0)
185 return NULL;
186 if (!use_pt &&
187 sae_prepare_commit(wpa_s->own_addr, bssid,
188 (u8 *) password, os_strlen(password),
189 ssid->sae_password_id,
190 &wpa_s->sme.sae) < 0) {
191 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
192 return NULL;
193 }
194 if (wpa_s->sme.sae.tmp) {
195 os_memcpy(wpa_s->sme.sae.tmp->bssid, bssid, ETH_ALEN);
196 if (use_pt && use_pk)
197 wpa_s->sme.sae.pk = 1;
198 #ifdef CONFIG_SAE_PK
199 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
200 ETH_ALEN);
201 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, bssid, ETH_ALEN);
202 sae_pk_set_password(&wpa_s->sme.sae, password);
203 #endif /* CONFIG_SAE_PK */
204 }
205
206 reuse_data:
207 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
208 if (ssid->sae_password_id)
209 len += 4 + os_strlen(ssid->sae_password_id);
210 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
211 if (buf == NULL)
212 return NULL;
213 if (!external) {
214 wpabuf_put_le16(buf, 1); /* Transaction seq# */
215 if (use_pk)
216 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
217 else if (use_pt)
218 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
219 else
220 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
221 }
222 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
223 ssid->sae_password_id) < 0) {
224 wpabuf_free(buf);
225 return NULL;
226 }
227 if (ret_use_pt)
228 *ret_use_pt = use_pt;
229 if (ret_use_pk)
230 *ret_use_pk = use_pk;
231
232 return buf;
233 }
234
235
sme_auth_build_sae_confirm(struct wpa_supplicant * wpa_s,int external)236 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
237 int external)
238 {
239 struct wpabuf *buf;
240
241 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
242 if (buf == NULL)
243 return NULL;
244
245 if (!external) {
246 wpabuf_put_le16(buf, 2); /* Transaction seq# */
247 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
248 }
249 sae_write_confirm(&wpa_s->sme.sae, buf);
250
251 return buf;
252 }
253
254 #endif /* CONFIG_SAE */
255
256
257 /**
258 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
259 * @wpa_s: Pointer to wpa_supplicant data
260 * @bss: Pointer to the bss which is the target of authentication attempt
261 */
sme_auth_handle_rrm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)262 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
263 struct wpa_bss *bss)
264 {
265 const u8 rrm_ie_len = 5;
266 u8 *pos;
267 const u8 *rrm_ie;
268
269 wpa_s->rrm.rrm_used = 0;
270
271 wpa_printf(MSG_DEBUG,
272 "RRM: Determining whether RRM can be used - device support: 0x%x",
273 wpa_s->drv_rrm_flags);
274
275 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
276 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
277 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
278 return;
279 }
280
281 if (!((wpa_s->drv_rrm_flags &
282 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
283 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
284 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
285 wpa_printf(MSG_DEBUG,
286 "RRM: Insufficient RRM support in driver - do not use RRM");
287 return;
288 }
289
290 if (sizeof(wpa_s->sme.assoc_req_ie) <
291 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
292 wpa_printf(MSG_INFO,
293 "RRM: Unable to use RRM, no room for RRM IE");
294 return;
295 }
296
297 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
298 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
299 os_memset(pos, 0, 2 + rrm_ie_len);
300 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
301 *pos++ = rrm_ie_len;
302
303 /* Set supported capabilities flags */
304 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
305 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
306
307 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
308 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
309 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
310
311 if (wpa_s->lci)
312 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
313
314 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
315 wpa_s->rrm.rrm_used = 1;
316 }
317
318
sme_send_authentication(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,int start)319 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
320 struct wpa_bss *bss, struct wpa_ssid *ssid,
321 int start)
322 {
323 struct wpa_driver_auth_params params;
324 struct wpa_ssid *old_ssid;
325 #ifdef CONFIG_IEEE80211R
326 const u8 *ie;
327 #endif /* CONFIG_IEEE80211R */
328 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
329 const u8 *md = NULL;
330 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
331 int bssid_changed;
332 struct wpabuf *resp = NULL;
333 u8 ext_capab[18];
334 int ext_capab_len;
335 int skip_auth;
336 u8 *wpa_ie;
337 size_t wpa_ie_len;
338 #ifdef CONFIG_MBO
339 const u8 *mbo_ie;
340 #endif /* CONFIG_MBO */
341 int omit_rsnxe = 0;
342
343 if (bss == NULL) {
344 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
345 "the network");
346 wpas_connect_work_done(wpa_s);
347 return;
348 }
349
350 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
351 wpa_s->reassoc_same_bss;
352 wpa_s->current_bss = bss;
353
354 os_memset(¶ms, 0, sizeof(params));
355 wpa_s->reassociate = 0;
356
357 params.freq = bss->freq;
358 params.bssid = bss->bssid;
359 params.ssid = bss->ssid;
360 params.ssid_len = bss->ssid_len;
361 params.p2p = ssid->p2p_group;
362
363 if (wpa_s->sme.ssid_len != params.ssid_len ||
364 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
365 wpa_s->sme.prev_bssid_set = 0;
366
367 wpa_s->sme.freq = params.freq;
368 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
369 wpa_s->sme.ssid_len = params.ssid_len;
370
371 params.auth_alg = WPA_AUTH_ALG_OPEN;
372 #ifdef IEEE8021X_EAPOL
373 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
374 if (ssid->leap) {
375 if (ssid->non_leap == 0)
376 params.auth_alg = WPA_AUTH_ALG_LEAP;
377 else
378 params.auth_alg |= WPA_AUTH_ALG_LEAP;
379 }
380 }
381 #endif /* IEEE8021X_EAPOL */
382 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
383 params.auth_alg);
384 if (ssid->auth_alg) {
385 params.auth_alg = ssid->auth_alg;
386 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
387 "0x%x", params.auth_alg);
388 }
389 #ifdef CONFIG_SAE
390 wpa_s->sme.sae_pmksa_caching = 0;
391 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
392 const u8 *rsn;
393 struct wpa_ie_data ied;
394
395 rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
396 if (!rsn) {
397 wpa_dbg(wpa_s, MSG_DEBUG,
398 "SAE enabled, but target BSS does not advertise RSN");
399 #ifdef CONFIG_DPP
400 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
401 (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
402 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
403 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
404 #endif /* CONFIG_DPP */
405 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
406 wpa_key_mgmt_sae(ied.key_mgmt)) {
407 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
408 params.auth_alg = WPA_AUTH_ALG_SAE;
409 } else {
410 wpa_dbg(wpa_s, MSG_DEBUG,
411 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
412 }
413 }
414 #endif /* CONFIG_SAE */
415
416 #ifdef CONFIG_WEP
417 {
418 int i;
419
420 for (i = 0; i < NUM_WEP_KEYS; i++) {
421 if (ssid->wep_key_len[i])
422 params.wep_key[i] = ssid->wep_key[i];
423 params.wep_key_len[i] = ssid->wep_key_len[i];
424 }
425 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
426 }
427 #endif /* CONFIG_WEP */
428
429 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
430 wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
431 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
432 int try_opportunistic;
433 const u8 *cache_id = NULL;
434
435 try_opportunistic = (ssid->proactive_key_caching < 0 ?
436 wpa_s->conf->okc :
437 ssid->proactive_key_caching) &&
438 (ssid->proto & WPA_PROTO_RSN);
439 #ifdef CONFIG_FILS
440 if (wpa_key_mgmt_fils(ssid->key_mgmt))
441 cache_id = wpa_bss_get_fils_cache_id(bss);
442 #endif /* CONFIG_FILS */
443 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
444 wpa_s->current_ssid,
445 try_opportunistic, cache_id,
446 0) == 0)
447 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
448 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
449 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
450 wpa_s->sme.assoc_req_ie,
451 &wpa_s->sme.assoc_req_ie_len)) {
452 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
453 "key management and encryption suites");
454 wpas_connect_work_done(wpa_s);
455 return;
456 }
457 #ifdef CONFIG_HS20
458 } else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
459 (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
460 /* No PMKSA caching, but otherwise similar to RSN/WPA */
461 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
462 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
463 wpa_s->sme.assoc_req_ie,
464 &wpa_s->sme.assoc_req_ie_len)) {
465 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
466 "key management and encryption suites");
467 wpas_connect_work_done(wpa_s);
468 return;
469 }
470 #endif /* CONFIG_HS20 */
471 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
472 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
473 /*
474 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
475 * use non-WPA since the scan results did not indicate that the
476 * AP is using WPA or WPA2.
477 */
478 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
479 wpa_s->sme.assoc_req_ie_len = 0;
480 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
481 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
482 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
483 wpa_s->sme.assoc_req_ie,
484 &wpa_s->sme.assoc_req_ie_len)) {
485 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
486 "key management and encryption suites (no "
487 "scan results)");
488 wpas_connect_work_done(wpa_s);
489 return;
490 }
491 #ifdef CONFIG_WPS
492 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
493 struct wpabuf *wps_ie;
494 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
495 if (wps_ie && wpabuf_len(wps_ie) <=
496 sizeof(wpa_s->sme.assoc_req_ie)) {
497 wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
498 os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
499 wpa_s->sme.assoc_req_ie_len);
500 } else
501 wpa_s->sme.assoc_req_ie_len = 0;
502 wpabuf_free(wps_ie);
503 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
504 #endif /* CONFIG_WPS */
505 } else {
506 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
507 wpa_s->sme.assoc_req_ie_len = 0;
508 }
509
510 /* In case the WPA vendor IE is used, it should be placed after all the
511 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
512 * defined in the standard. Store the WPA IE so it can later be
513 * inserted at the correct location.
514 */
515 wpa_ie = NULL;
516 wpa_ie_len = 0;
517 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
518 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
519 wpa_s->sme.assoc_req_ie_len);
520 if (wpa_ie) {
521 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
522
523 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
524 wpa_s->sme.assoc_req_ie_len = 0;
525 } else {
526 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
527 wpas_connect_work_done(wpa_s);
528 return;
529 }
530 }
531
532 #ifdef CONFIG_IEEE80211R
533 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
534 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
535 md = ie + 2;
536 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
537 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
538 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
539 md = NULL;
540 if (md) {
541 /* Prepare for the next transition */
542 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
543 }
544
545 if (md) {
546 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
547 md[0], md[1]);
548
549 omit_rsnxe = !wpa_bss_get_ie(bss, WLAN_EID_RSNX);
550 if (wpa_s->sme.assoc_req_ie_len + 5 <
551 sizeof(wpa_s->sme.assoc_req_ie)) {
552 struct rsn_mdie *mdie;
553 u8 *pos = wpa_s->sme.assoc_req_ie +
554 wpa_s->sme.assoc_req_ie_len;
555 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
556 *pos++ = sizeof(*mdie);
557 mdie = (struct rsn_mdie *) pos;
558 os_memcpy(mdie->mobility_domain, md,
559 MOBILITY_DOMAIN_ID_LEN);
560 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
561 wpa_s->sme.assoc_req_ie_len += 5;
562 }
563
564 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
565 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
566 wpa_sm_has_ptk(wpa_s->wpa)) {
567 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
568 "over-the-air");
569 params.auth_alg = WPA_AUTH_ALG_FT;
570 params.ie = wpa_s->sme.ft_ies;
571 params.ie_len = wpa_s->sme.ft_ies_len;
572 }
573 }
574 #endif /* CONFIG_IEEE80211R */
575
576 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
577 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
578 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
579 struct wpa_ie_data _ie;
580 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
581 _ie.capabilities &
582 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
583 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
584 "MFP: require MFP");
585 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
586 }
587 }
588
589 #ifdef CONFIG_P2P
590 if (wpa_s->global->p2p) {
591 u8 *pos;
592 size_t len;
593 int res;
594 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
595 len = sizeof(wpa_s->sme.assoc_req_ie) -
596 wpa_s->sme.assoc_req_ie_len;
597 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
598 ssid->p2p_group);
599 if (res >= 0)
600 wpa_s->sme.assoc_req_ie_len += res;
601 }
602 #endif /* CONFIG_P2P */
603
604 #ifdef CONFIG_FST
605 if (wpa_s->fst_ies) {
606 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
607
608 if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
609 sizeof(wpa_s->sme.assoc_req_ie)) {
610 os_memcpy(wpa_s->sme.assoc_req_ie +
611 wpa_s->sme.assoc_req_ie_len,
612 wpabuf_head(wpa_s->fst_ies),
613 fst_ies_len);
614 wpa_s->sme.assoc_req_ie_len += fst_ies_len;
615 }
616 }
617 #endif /* CONFIG_FST */
618
619 sme_auth_handle_rrm(wpa_s, bss);
620
621 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
622 wpa_s, ssid, bss,
623 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
624 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
625
626 if (params.p2p)
627 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
628 else
629 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
630
631 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
632 sizeof(ext_capab));
633 if (ext_capab_len > 0) {
634 u8 *pos = wpa_s->sme.assoc_req_ie;
635 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
636 pos += 2 + pos[1];
637 os_memmove(pos + ext_capab_len, pos,
638 wpa_s->sme.assoc_req_ie_len -
639 (pos - wpa_s->sme.assoc_req_ie));
640 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
641 os_memcpy(pos, ext_capab, ext_capab_len);
642 }
643
644 #ifdef CONFIG_TESTING_OPTIONS
645 if (wpa_s->rsnxe_override_assoc &&
646 wpabuf_len(wpa_s->rsnxe_override_assoc) <=
647 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
648 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
649 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
650 wpabuf_head(wpa_s->rsnxe_override_assoc),
651 wpabuf_len(wpa_s->rsnxe_override_assoc));
652 wpa_s->sme.assoc_req_ie_len +=
653 wpabuf_len(wpa_s->rsnxe_override_assoc);
654 } else
655 #endif /* CONFIG_TESTING_OPTIONS */
656 if (wpa_s->rsnxe_len > 0 &&
657 wpa_s->rsnxe_len <=
658 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
659 !omit_rsnxe) {
660 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
661 wpa_s->rsnxe, wpa_s->rsnxe_len);
662 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
663 }
664
665 #ifdef CONFIG_HS20
666 if (is_hs20_config(wpa_s) && is_hs20_network(wpa_s, ssid, bss)) {
667 struct wpabuf *hs20;
668
669 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
670 if (hs20) {
671 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
672 size_t len;
673
674 wpas_hs20_add_indication(hs20, pps_mo_id,
675 get_hs20_version(bss));
676 wpas_hs20_add_roam_cons_sel(hs20, ssid);
677 len = sizeof(wpa_s->sme.assoc_req_ie) -
678 wpa_s->sme.assoc_req_ie_len;
679 if (wpabuf_len(hs20) <= len) {
680 os_memcpy(wpa_s->sme.assoc_req_ie +
681 wpa_s->sme.assoc_req_ie_len,
682 wpabuf_head(hs20), wpabuf_len(hs20));
683 wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
684 }
685 wpabuf_free(hs20);
686 }
687 }
688 #endif /* CONFIG_HS20 */
689
690 if (wpa_ie) {
691 size_t len;
692
693 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
694
695 len = sizeof(wpa_s->sme.assoc_req_ie) -
696 wpa_s->sme.assoc_req_ie_len;
697
698 if (len > wpa_ie_len) {
699 os_memcpy(wpa_s->sme.assoc_req_ie +
700 wpa_s->sme.assoc_req_ie_len,
701 wpa_ie, wpa_ie_len);
702 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
703 } else {
704 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
705 }
706
707 os_free(wpa_ie);
708 }
709
710 if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
711 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
712 size_t len;
713
714 len = sizeof(wpa_s->sme.assoc_req_ie) -
715 wpa_s->sme.assoc_req_ie_len;
716 if (wpabuf_len(buf) <= len) {
717 os_memcpy(wpa_s->sme.assoc_req_ie +
718 wpa_s->sme.assoc_req_ie_len,
719 wpabuf_head(buf), wpabuf_len(buf));
720 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
721 }
722 }
723
724 #ifdef CONFIG_MBO
725 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
726 if (!wpa_s->disable_mbo_oce && mbo_ie) {
727 int len;
728
729 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
730 wpa_s->sme.assoc_req_ie_len,
731 sizeof(wpa_s->sme.assoc_req_ie) -
732 wpa_s->sme.assoc_req_ie_len,
733 !!mbo_attr_from_mbo_ie(mbo_ie,
734 OCE_ATTR_ID_CAPA_IND));
735 if (len >= 0)
736 wpa_s->sme.assoc_req_ie_len += len;
737 }
738 #endif /* CONFIG_MBO */
739
740 #ifdef CONFIG_SAE
741 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
742 pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid, ssid, 0,
743 NULL,
744 wpa_s->key_mgmt == WPA_KEY_MGMT_FT_SAE ?
745 WPA_KEY_MGMT_FT_SAE :
746 WPA_KEY_MGMT_SAE) == 0) {
747 wpa_dbg(wpa_s, MSG_DEBUG,
748 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
749 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
750 params.auth_alg = WPA_AUTH_ALG_OPEN;
751 wpa_s->sme.sae_pmksa_caching = 1;
752 }
753
754 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
755 if (start)
756 resp = sme_auth_build_sae_commit(wpa_s, ssid,
757 bss->bssid, 0,
758 start == 2, NULL,
759 NULL);
760 else
761 resp = sme_auth_build_sae_confirm(wpa_s, 0);
762 if (resp == NULL) {
763 wpas_connection_failed(wpa_s, bss->bssid);
764 return;
765 }
766 params.auth_data = wpabuf_head(resp);
767 params.auth_data_len = wpabuf_len(resp);
768 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
769 }
770 #endif /* CONFIG_SAE */
771
772 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
773 os_memset(wpa_s->bssid, 0, ETH_ALEN);
774 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
775 if (bssid_changed)
776 wpas_notify_bssid_changed(wpa_s);
777
778 old_ssid = wpa_s->current_ssid;
779 wpa_s->current_ssid = ssid;
780 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
781 wpa_supplicant_initiate_eapol(wpa_s);
782
783 #ifdef CONFIG_FILS
784 /* TODO: FILS operations can in some cases be done between different
785 * network_ctx (i.e., same credentials can be used with multiple
786 * networks). */
787 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
788 wpa_key_mgmt_fils(ssid->key_mgmt)) {
789 const u8 *indic;
790 u16 fils_info;
791 const u8 *realm, *username, *rrk;
792 size_t realm_len, username_len, rrk_len;
793 u16 next_seq_num;
794
795 /*
796 * Check FILS Indication element (FILS Information field) bits
797 * indicating supported authentication algorithms against local
798 * configuration (ssid->fils_dh_group). Try to use FILS
799 * authentication only if the AP supports the combination in the
800 * network profile. */
801 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
802 if (!indic || indic[1] < 2) {
803 wpa_printf(MSG_DEBUG, "SME: " MACSTR
804 " does not include FILS Indication element - cannot use FILS authentication with it",
805 MAC2STR(bss->bssid));
806 goto no_fils;
807 }
808
809 fils_info = WPA_GET_LE16(indic + 2);
810 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
811 wpa_printf(MSG_DEBUG, "SME: " MACSTR
812 " does not support FILS SK without PFS - cannot use FILS authentication with it",
813 MAC2STR(bss->bssid));
814 goto no_fils;
815 }
816 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
817 wpa_printf(MSG_DEBUG, "SME: " MACSTR
818 " does not support FILS SK with PFS - cannot use FILS authentication with it",
819 MAC2STR(bss->bssid));
820 goto no_fils;
821 }
822
823 if (wpa_s->last_con_fail_realm &&
824 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
825 &username, &username_len,
826 &realm, &realm_len, &next_seq_num,
827 &rrk, &rrk_len) == 0 &&
828 realm && realm_len == wpa_s->last_con_fail_realm_len &&
829 os_memcmp(realm, wpa_s->last_con_fail_realm,
830 realm_len) == 0) {
831 wpa_printf(MSG_DEBUG,
832 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
833 goto no_fils;
834 }
835
836 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
837 ssid, 0,
838 wpa_bss_get_fils_cache_id(bss),
839 0) == 0)
840 wpa_printf(MSG_DEBUG,
841 "SME: Try to use FILS with PMKSA caching");
842 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
843 if (resp) {
844 int auth_alg;
845
846 if (ssid->fils_dh_group)
847 wpa_printf(MSG_DEBUG,
848 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
849 ssid->fils_dh_group);
850 else
851 wpa_printf(MSG_DEBUG,
852 "SME: Try to use FILS SK authentication without PFS");
853 auth_alg = ssid->fils_dh_group ?
854 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
855 params.auth_alg = auth_alg;
856 params.auth_data = wpabuf_head(resp);
857 params.auth_data_len = wpabuf_len(resp);
858 wpa_s->sme.auth_alg = auth_alg;
859 }
860 }
861 no_fils:
862 #endif /* CONFIG_FILS */
863
864 wpa_supplicant_cancel_sched_scan(wpa_s);
865 wpa_supplicant_cancel_scan(wpa_s);
866
867 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
868 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
869 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
870
871 eapol_sm_notify_portValid(wpa_s->eapol, false);
872 wpa_clear_keys(wpa_s, bss->bssid);
873 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
874 if (old_ssid != wpa_s->current_ssid)
875 wpas_notify_network_changed(wpa_s);
876
877 #ifdef CONFIG_HS20
878 hs20_configure_frame_filters(wpa_s);
879 #endif /* CONFIG_HS20 */
880
881 #ifdef CONFIG_P2P
882 /*
883 * If multi-channel concurrency is not supported, check for any
884 * frequency conflict. In case of any frequency conflict, remove the
885 * least prioritized connection.
886 */
887 if (wpa_s->num_multichan_concurrent < 2) {
888 int freq, num;
889 num = get_shared_radio_freqs(wpa_s, &freq, 1);
890 if (num > 0 && freq > 0 && freq != params.freq) {
891 wpa_printf(MSG_DEBUG,
892 "Conflicting frequency found (%d != %d)",
893 freq, params.freq);
894 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
895 params.freq,
896 ssid) < 0) {
897 wpas_connection_failed(wpa_s, bss->bssid);
898 wpa_supplicant_mark_disassoc(wpa_s);
899 wpabuf_free(resp);
900 wpas_connect_work_done(wpa_s);
901 return;
902 }
903 }
904 }
905 #endif /* CONFIG_P2P */
906
907 if (skip_auth) {
908 wpa_msg(wpa_s, MSG_DEBUG,
909 "SME: Skip authentication step on reassoc-to-same-BSS");
910 wpabuf_free(resp);
911 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
912 return;
913 }
914
915
916 wpa_s->sme.auth_alg = params.auth_alg;
917 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) {
918 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
919 "driver failed");
920 wpas_connection_failed(wpa_s, bss->bssid);
921 wpa_supplicant_mark_disassoc(wpa_s);
922 wpabuf_free(resp);
923 wpas_connect_work_done(wpa_s);
924 return;
925 }
926
927 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
928 NULL);
929
930 /*
931 * Association will be started based on the authentication event from
932 * the driver.
933 */
934
935 wpabuf_free(resp);
936 }
937
938
sme_auth_start_cb(struct wpa_radio_work * work,int deinit)939 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
940 {
941 struct wpa_connect_work *cwork = work->ctx;
942 struct wpa_supplicant *wpa_s = work->wpa_s;
943
944 if (deinit) {
945 if (work->started)
946 wpa_s->connect_work = NULL;
947
948 wpas_connect_work_free(cwork);
949 return;
950 }
951
952 wpa_s->connect_work = work;
953
954 if (cwork->bss_removed ||
955 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
956 wpas_network_disabled(wpa_s, cwork->ssid)) {
957 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
958 wpas_connect_work_done(wpa_s);
959 return;
960 }
961
962 /* Starting new connection, so clear the possibly used WPA IE from the
963 * previous association. */
964 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
965 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
966 wpa_s->rsnxe_len = 0;
967
968 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
969 }
970
971
sme_authenticate(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)972 void sme_authenticate(struct wpa_supplicant *wpa_s,
973 struct wpa_bss *bss, struct wpa_ssid *ssid)
974 {
975 struct wpa_connect_work *cwork;
976
977 if (bss == NULL || ssid == NULL)
978 return;
979 if (wpa_s->connect_work) {
980 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
981 return;
982 }
983
984 if (radio_work_pending(wpa_s, "sme-connect")) {
985 /*
986 * The previous sme-connect work might no longer be valid due to
987 * the fact that the BSS list was updated. In addition, it makes
988 * sense to adhere to the 'newer' decision.
989 */
990 wpa_dbg(wpa_s, MSG_DEBUG,
991 "SME: Remove previous pending sme-connect");
992 radio_remove_works(wpa_s, "sme-connect", 0);
993 }
994
995 wpas_abort_ongoing_scan(wpa_s);
996
997 cwork = os_zalloc(sizeof(*cwork));
998 if (cwork == NULL)
999 return;
1000 cwork->bss = bss;
1001 cwork->ssid = ssid;
1002 cwork->sme = 1;
1003
1004 #ifdef CONFIG_SAE
1005 wpa_s->sme.sae.state = SAE_NOTHING;
1006 wpa_s->sme.sae.send_confirm = 0;
1007 wpa_s->sme.sae_group_index = 0;
1008 #endif /* CONFIG_SAE */
1009
1010 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
1011 sme_auth_start_cb, cwork) < 0)
1012 wpas_connect_work_free(cwork);
1013 }
1014
1015
1016 #ifdef CONFIG_SAE
1017
sme_external_auth_build_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,u16 auth_transaction,u16 seq_num,u16 status_code)1018 static int sme_external_auth_build_buf(struct wpabuf *buf,
1019 struct wpabuf *params,
1020 const u8 *sa, const u8 *da,
1021 u16 auth_transaction, u16 seq_num,
1022 u16 status_code)
1023 {
1024 struct ieee80211_mgmt *resp;
1025
1026 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
1027 u.auth.variable));
1028
1029 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
1030 (WLAN_FC_STYPE_AUTH << 4));
1031 os_memcpy(resp->da, da, ETH_ALEN);
1032 os_memcpy(resp->sa, sa, ETH_ALEN);
1033 os_memcpy(resp->bssid, da, ETH_ALEN);
1034 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
1035 resp->seq_ctrl = host_to_le16(seq_num << 4);
1036 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
1037 resp->u.auth.status_code = host_to_le16(status_code);
1038 if (params)
1039 wpabuf_put_buf(buf, params);
1040
1041 return 0;
1042 }
1043
1044
sme_external_auth_send_sae_commit(struct wpa_supplicant * wpa_s,const u8 * bssid,struct wpa_ssid * ssid)1045 static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
1046 const u8 *bssid,
1047 struct wpa_ssid *ssid)
1048 {
1049 struct wpabuf *resp, *buf;
1050 int use_pt;
1051 bool use_pk;
1052 u16 status;
1053
1054 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid, 1, 0, &use_pt,
1055 &use_pk);
1056 if (!resp) {
1057 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
1058 return -1;
1059 }
1060
1061 wpa_s->sme.sae.state = SAE_COMMITTED;
1062 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp));
1063 if (!buf) {
1064 wpabuf_free(resp);
1065 return -1;
1066 }
1067
1068 wpa_s->sme.seq_num++;
1069 if (use_pk)
1070 status = WLAN_STATUS_SAE_PK;
1071 else if (use_pt)
1072 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
1073 else
1074 status = WLAN_STATUS_SUCCESS;
1075 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1076 bssid, 1, wpa_s->sme.seq_num, status);
1077 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1078 wpabuf_free(resp);
1079 wpabuf_free(buf);
1080
1081 return 0;
1082 }
1083
1084
sme_send_external_auth_status(struct wpa_supplicant * wpa_s,u16 status)1085 static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
1086 u16 status)
1087 {
1088 struct external_auth params;
1089
1090 os_memset(¶ms, 0, sizeof(params));
1091 params.status = status;
1092 params.ssid = wpa_s->sme.ext_auth_ssid;
1093 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
1094 params.bssid = wpa_s->sme.ext_auth_bssid;
1095 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
1096 params.pmkid = wpa_s->sme.sae.pmkid;
1097 wpa_drv_send_external_auth_status(wpa_s, ¶ms);
1098 }
1099
1100
sme_handle_external_auth_start(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1101 static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
1102 union wpa_event_data *data)
1103 {
1104 struct wpa_ssid *ssid;
1105 size_t ssid_str_len = data->external_auth.ssid_len;
1106 const u8 *ssid_str = data->external_auth.ssid;
1107
1108 /* Get the SSID conf from the ssid string obtained */
1109 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1110 if (!wpas_network_disabled(wpa_s, ssid) &&
1111 ssid_str_len == ssid->ssid_len &&
1112 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
1113 (ssid->key_mgmt & (WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE)))
1114 break;
1115 }
1116 if (!ssid ||
1117 sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
1118 ssid) < 0)
1119 return -1;
1120
1121 return 0;
1122 }
1123
1124
sme_external_auth_send_sae_confirm(struct wpa_supplicant * wpa_s,const u8 * da)1125 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1126 const u8 *da)
1127 {
1128 struct wpabuf *resp, *buf;
1129
1130 resp = sme_auth_build_sae_confirm(wpa_s, 1);
1131 if (!resp) {
1132 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1133 return;
1134 }
1135
1136 wpa_s->sme.sae.state = SAE_CONFIRMED;
1137 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp));
1138 if (!buf) {
1139 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1140 wpabuf_free(resp);
1141 return;
1142 }
1143 wpa_s->sme.seq_num++;
1144 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1145 da, 2, wpa_s->sme.seq_num,
1146 WLAN_STATUS_SUCCESS);
1147 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1148 wpabuf_free(resp);
1149 wpabuf_free(buf);
1150 }
1151
1152
sme_external_auth_trigger(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1153 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1154 union wpa_event_data *data)
1155 {
1156 if (RSN_SELECTOR_GET(&data->external_auth.key_mgmt_suite) !=
1157 RSN_AUTH_KEY_MGMT_SAE)
1158 return;
1159
1160 if (data->external_auth.action == EXT_AUTH_START) {
1161 if (!data->external_auth.bssid || !data->external_auth.ssid)
1162 return;
1163 os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
1164 ETH_ALEN);
1165 os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
1166 data->external_auth.ssid_len);
1167 wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
1168 wpa_s->sme.seq_num = 0;
1169 wpa_s->sme.sae.state = SAE_NOTHING;
1170 wpa_s->sme.sae.send_confirm = 0;
1171 wpa_s->sme.sae_group_index = 0;
1172 if (sme_handle_external_auth_start(wpa_s, data) < 0)
1173 sme_send_external_auth_status(wpa_s,
1174 WLAN_STATUS_UNSPECIFIED_FAILURE);
1175 } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1176 /* Report failure to driver for the wrong trigger */
1177 sme_send_external_auth_status(wpa_s,
1178 WLAN_STATUS_UNSPECIFIED_FAILURE);
1179 }
1180 }
1181
1182
sme_sae_is_group_enabled(struct wpa_supplicant * wpa_s,int group)1183 static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
1184 {
1185 int *groups = wpa_s->conf->sae_groups;
1186 int default_groups[] = { 19, 20, 21, 0 };
1187 int i;
1188
1189 if (!groups)
1190 groups = default_groups;
1191
1192 for (i = 0; groups[i] > 0; i++) {
1193 if (groups[i] == group)
1194 return 1;
1195 }
1196
1197 return 0;
1198 }
1199
1200
sme_check_sae_rejected_groups(struct wpa_supplicant * wpa_s,const struct wpabuf * groups)1201 static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
1202 const struct wpabuf *groups)
1203 {
1204 size_t i, count;
1205 const u8 *pos;
1206
1207 if (!groups)
1208 return 0;
1209
1210 pos = wpabuf_head(groups);
1211 count = wpabuf_len(groups) / 2;
1212 for (i = 0; i < count; i++) {
1213 int enabled;
1214 u16 group;
1215
1216 group = WPA_GET_LE16(pos);
1217 pos += 2;
1218 enabled = sme_sae_is_group_enabled(wpa_s, group);
1219 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
1220 group, enabled ? "enabled" : "disabled");
1221 if (enabled)
1222 return 1;
1223 }
1224
1225 return 0;
1226 }
1227
1228
sme_sae_auth(struct wpa_supplicant * wpa_s,u16 auth_transaction,u16 status_code,const u8 * data,size_t len,int external,const u8 * sa)1229 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
1230 u16 status_code, const u8 *data, size_t len,
1231 int external, const u8 *sa)
1232 {
1233 int *groups;
1234
1235 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1236 "status code %u", auth_transaction, status_code);
1237
1238 if (auth_transaction == 1 &&
1239 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1240 wpa_s->sme.sae.state == SAE_COMMITTED &&
1241 (external || wpa_s->current_bss) && wpa_s->current_ssid) {
1242 int default_groups[] = { 19, 20, 21, 0 };
1243 u16 group;
1244 const u8 *token_pos;
1245 size_t token_len;
1246 int h2e = 0;
1247
1248 groups = wpa_s->conf->sae_groups;
1249 if (!groups || groups[0] <= 0)
1250 groups = default_groups;
1251
1252 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
1253 data, len);
1254 if (len < sizeof(le16)) {
1255 wpa_dbg(wpa_s, MSG_DEBUG,
1256 "SME: Too short SAE anti-clogging token request");
1257 return -1;
1258 }
1259 group = WPA_GET_LE16(data);
1260 wpa_dbg(wpa_s, MSG_DEBUG,
1261 "SME: SAE anti-clogging token requested (group %u)",
1262 group);
1263 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1264 WLAN_STATUS_SUCCESS) {
1265 wpa_dbg(wpa_s, MSG_ERROR,
1266 "SME: SAE group %u of anti-clogging request is invalid",
1267 group);
1268 return -1;
1269 }
1270 wpabuf_free(wpa_s->sme.sae_token);
1271 token_pos = data + sizeof(le16);
1272 token_len = len - sizeof(le16);
1273 h2e = wpa_s->sme.sae.h2e;
1274 if (h2e) {
1275 if (token_len < 3) {
1276 wpa_dbg(wpa_s, MSG_DEBUG,
1277 "SME: Too short SAE anti-clogging token container");
1278 return -1;
1279 }
1280 if (token_pos[0] != WLAN_EID_EXTENSION ||
1281 token_pos[1] == 0 ||
1282 token_pos[1] > token_len - 2 ||
1283 token_pos[2] != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
1284 wpa_dbg(wpa_s, MSG_DEBUG,
1285 "SME: Invalid SAE anti-clogging token container header");
1286 return -1;
1287 }
1288 token_len = token_pos[1] - 1;
1289 token_pos += 3;
1290 }
1291 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
1292 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
1293 wpa_s->sme.sae_token);
1294 if (!external)
1295 sme_send_authentication(wpa_s, wpa_s->current_bss,
1296 wpa_s->current_ssid, 2);
1297 else
1298 sme_external_auth_send_sae_commit(
1299 wpa_s, wpa_s->sme.ext_auth_bssid,
1300 wpa_s->current_ssid);
1301 return 0;
1302 }
1303
1304 if (auth_transaction == 1 &&
1305 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1306 wpa_s->sme.sae.state == SAE_COMMITTED &&
1307 (external || wpa_s->current_bss) && wpa_s->current_ssid) {
1308 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
1309 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
1310 wpa_s->sme.sae.group);
1311 wpa_s->sme.sae_group_index++;
1312 if (sme_set_sae_group(wpa_s) < 0)
1313 return -1; /* no other groups enabled */
1314 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
1315 if (!external)
1316 sme_send_authentication(wpa_s, wpa_s->current_bss,
1317 wpa_s->current_ssid, 1);
1318 else
1319 sme_external_auth_send_sae_commit(
1320 wpa_s, wpa_s->sme.ext_auth_bssid,
1321 wpa_s->current_ssid);
1322 return 0;
1323 }
1324
1325 if (auth_transaction == 1 &&
1326 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1327 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1328
1329 wpa_msg(wpa_s, MSG_INFO,
1330 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1331 MAC2STR(bssid));
1332 return -1;
1333 }
1334
1335 if (status_code != WLAN_STATUS_SUCCESS &&
1336 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
1337 status_code != WLAN_STATUS_SAE_PK)
1338 return -1;
1339
1340 if (auth_transaction == 1) {
1341 u16 res;
1342
1343 groups = wpa_s->conf->sae_groups;
1344
1345 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
1346 if ((!external && wpa_s->current_bss == NULL) ||
1347 wpa_s->current_ssid == NULL)
1348 return -1;
1349 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
1350 wpa_printf(MSG_DEBUG,
1351 "SAE: Ignore commit message while waiting for confirm");
1352 return 0;
1353 }
1354 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
1355 wpa_printf(MSG_DEBUG,
1356 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
1357 return -1;
1358 }
1359 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
1360 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
1361 wpa_printf(MSG_DEBUG,
1362 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
1363 return -1;
1364 }
1365 if (!wpa_s->sme.sae.pk &&
1366 status_code == WLAN_STATUS_SAE_PK) {
1367 wpa_printf(MSG_DEBUG,
1368 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
1369 return -1;
1370 }
1371
1372 if (groups && groups[0] <= 0)
1373 groups = NULL;
1374 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
1375 groups, status_code ==
1376 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1377 status_code == WLAN_STATUS_SAE_PK);
1378 if (res == SAE_SILENTLY_DISCARD) {
1379 wpa_printf(MSG_DEBUG,
1380 "SAE: Drop commit message due to reflection attack");
1381 return 0;
1382 }
1383 if (res != WLAN_STATUS_SUCCESS)
1384 return -1;
1385
1386 if (wpa_s->sme.sae.tmp &&
1387 sme_check_sae_rejected_groups(
1388 wpa_s,
1389 wpa_s->sme.sae.tmp->peer_rejected_groups))
1390 return -1;
1391
1392 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1393 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1394 "commit");
1395 return -1;
1396 }
1397
1398 wpabuf_free(wpa_s->sme.sae_token);
1399 wpa_s->sme.sae_token = NULL;
1400 if (!external)
1401 sme_send_authentication(wpa_s, wpa_s->current_bss,
1402 wpa_s->current_ssid, 0);
1403 else
1404 sme_external_auth_send_sae_confirm(wpa_s, sa);
1405 return 0;
1406 } else if (auth_transaction == 2) {
1407 if (status_code != WLAN_STATUS_SUCCESS)
1408 return -1;
1409 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
1410 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
1411 return -1;
1412 if (sae_check_confirm(&wpa_s->sme.sae, data, len) < 0)
1413 return -1;
1414 wpa_s->sme.sae.state = SAE_ACCEPTED;
1415 sae_clear_temp_data(&wpa_s->sme.sae);
1416
1417 if (external) {
1418 /* Report success to driver */
1419 sme_send_external_auth_status(wpa_s,
1420 WLAN_STATUS_SUCCESS);
1421 }
1422
1423 return 1;
1424 }
1425
1426 return -1;
1427 }
1428
1429
sme_sae_set_pmk(struct wpa_supplicant * wpa_s,const u8 * bssid)1430 static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
1431 {
1432 wpa_printf(MSG_DEBUG,
1433 "SME: SAE completed - setting PMK for 4-way handshake");
1434 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN,
1435 wpa_s->sme.sae.pmkid, bssid);
1436 if (wpa_s->conf->sae_pmkid_in_assoc) {
1437 /* Update the own RSNE contents now that we have set the PMK
1438 * and added a PMKSA cache entry based on the successfully
1439 * completed SAE exchange. In practice, this will add the PMKID
1440 * into RSNE. */
1441 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
1442 sizeof(wpa_s->sme.assoc_req_ie)) {
1443 wpa_msg(wpa_s, MSG_WARNING,
1444 "RSN: Not enough room for inserting own PMKID into RSNE");
1445 return -1;
1446 }
1447 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
1448 &wpa_s->sme.assoc_req_ie_len,
1449 wpa_s->sme.sae.pmkid) < 0)
1450 return -1;
1451 wpa_hexdump(MSG_DEBUG,
1452 "SME: Updated Association Request IEs",
1453 wpa_s->sme.assoc_req_ie,
1454 wpa_s->sme.assoc_req_ie_len);
1455 }
1456
1457 return 0;
1458 }
1459
1460
sme_external_auth_mgmt_rx(struct wpa_supplicant * wpa_s,const u8 * auth_frame,size_t len)1461 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1462 const u8 *auth_frame, size_t len)
1463 {
1464 const struct ieee80211_mgmt *header;
1465 size_t auth_length;
1466
1467 header = (const struct ieee80211_mgmt *) auth_frame;
1468 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1469
1470 if (len < auth_length) {
1471 /* Notify failure to the driver */
1472 sme_send_external_auth_status(wpa_s,
1473 WLAN_STATUS_UNSPECIFIED_FAILURE);
1474 return;
1475 }
1476
1477 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
1478 int res;
1479
1480 res = sme_sae_auth(
1481 wpa_s, le_to_host16(header->u.auth.auth_transaction),
1482 le_to_host16(header->u.auth.status_code),
1483 header->u.auth.variable,
1484 len - auth_length, 1, header->sa);
1485 if (res < 0) {
1486 /* Notify failure to the driver */
1487 sme_send_external_auth_status(
1488 wpa_s, WLAN_STATUS_UNSPECIFIED_FAILURE);
1489 return;
1490 }
1491 if (res != 1)
1492 return;
1493
1494 if (sme_sae_set_pmk(wpa_s, wpa_s->sme.ext_auth_bssid) < 0)
1495 return;
1496 }
1497 }
1498
1499 #endif /* CONFIG_SAE */
1500
1501
sme_event_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1502 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
1503 {
1504 struct wpa_ssid *ssid = wpa_s->current_ssid;
1505
1506 if (ssid == NULL) {
1507 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1508 "when network is not selected");
1509 return;
1510 }
1511
1512 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
1513 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1514 "when not in authenticating state");
1515 return;
1516 }
1517
1518 if (os_memcmp(wpa_s->pending_bssid, data->auth.peer, ETH_ALEN) != 0) {
1519 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
1520 "unexpected peer " MACSTR,
1521 MAC2STR(data->auth.peer));
1522 return;
1523 }
1524
1525 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
1526 " auth_type=%d auth_transaction=%d status_code=%d",
1527 MAC2STR(data->auth.peer), data->auth.auth_type,
1528 data->auth.auth_transaction, data->auth.status_code);
1529 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
1530 data->auth.ies, data->auth.ies_len);
1531
1532 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
1533
1534 #ifdef CONFIG_SAE
1535 if (data->auth.auth_type == WLAN_AUTH_SAE) {
1536 int res;
1537 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
1538 data->auth.status_code, data->auth.ies,
1539 data->auth.ies_len, 0, NULL);
1540 if (res < 0) {
1541 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1542 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1543
1544 }
1545 if (res != 1)
1546 return;
1547
1548 if (sme_sae_set_pmk(wpa_s, wpa_s->pending_bssid) < 0)
1549 return;
1550 }
1551 #endif /* CONFIG_SAE */
1552
1553 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
1554 char *ie_txt = NULL;
1555
1556 if (data->auth.ies && data->auth.ies_len) {
1557 size_t buflen = 2 * data->auth.ies_len + 1;
1558 ie_txt = os_malloc(buflen);
1559 if (ie_txt) {
1560 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
1561 data->auth.ies_len);
1562 }
1563 }
1564 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1565 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
1566 MAC2STR(data->auth.peer), data->auth.auth_type,
1567 data->auth.auth_transaction, data->auth.status_code,
1568 ie_txt ? " ie=" : "",
1569 ie_txt ? ie_txt : "");
1570 os_free(ie_txt);
1571
1572 #ifdef CONFIG_FILS
1573 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
1574 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
1575 fils_connection_failure(wpa_s);
1576 #endif /* CONFIG_FILS */
1577
1578 if (data->auth.status_code !=
1579 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
1580 wpa_s->sme.auth_alg == data->auth.auth_type ||
1581 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
1582 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1583 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1584 return;
1585 }
1586
1587 wpas_connect_work_done(wpa_s);
1588
1589 switch (data->auth.auth_type) {
1590 case WLAN_AUTH_OPEN:
1591 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
1592
1593 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
1594 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
1595 wpa_s->current_ssid);
1596 return;
1597
1598 case WLAN_AUTH_SHARED_KEY:
1599 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
1600
1601 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
1602 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
1603 wpa_s->current_ssid);
1604 return;
1605
1606 default:
1607 return;
1608 }
1609 }
1610
1611 #ifdef CONFIG_IEEE80211R
1612 if (data->auth.auth_type == WLAN_AUTH_FT) {
1613 const u8 *ric_ies = NULL;
1614 size_t ric_ies_len = 0;
1615
1616 if (wpa_s->ric_ies) {
1617 ric_ies = wpabuf_head(wpa_s->ric_ies);
1618 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
1619 }
1620 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
1621 data->auth.ies_len, 0,
1622 data->auth.peer,
1623 ric_ies, ric_ies_len) < 0) {
1624 wpa_dbg(wpa_s, MSG_DEBUG,
1625 "SME: FT Authentication response processing failed");
1626 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1627 MACSTR
1628 " reason=%d locally_generated=1",
1629 MAC2STR(wpa_s->pending_bssid),
1630 WLAN_REASON_DEAUTH_LEAVING);
1631 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1632 wpa_supplicant_mark_disassoc(wpa_s);
1633 return;
1634 }
1635 }
1636 #endif /* CONFIG_IEEE80211R */
1637
1638 #ifdef CONFIG_FILS
1639 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
1640 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
1641 u16 expect_auth_type;
1642
1643 expect_auth_type = wpa_s->sme.auth_alg ==
1644 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
1645 WLAN_AUTH_FILS_SK;
1646 if (data->auth.auth_type != expect_auth_type) {
1647 wpa_dbg(wpa_s, MSG_DEBUG,
1648 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
1649 data->auth.auth_type, expect_auth_type);
1650 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1651 MACSTR
1652 " reason=%d locally_generated=1",
1653 MAC2STR(wpa_s->pending_bssid),
1654 WLAN_REASON_DEAUTH_LEAVING);
1655 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1656 wpa_supplicant_mark_disassoc(wpa_s);
1657 return;
1658 }
1659
1660 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
1661 data->auth.ies, data->auth.ies_len) < 0) {
1662 wpa_dbg(wpa_s, MSG_DEBUG,
1663 "SME: FILS Authentication response processing failed");
1664 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
1665 MACSTR
1666 " reason=%d locally_generated=1",
1667 MAC2STR(wpa_s->pending_bssid),
1668 WLAN_REASON_DEAUTH_LEAVING);
1669 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
1670 wpa_supplicant_mark_disassoc(wpa_s);
1671 return;
1672 }
1673 }
1674 #endif /* CONFIG_FILS */
1675
1676 sme_associate(wpa_s, ssid->mode, data->auth.peer,
1677 data->auth.auth_type);
1678 }
1679
1680
1681 #ifdef CONFIG_IEEE80211R
remove_ie(u8 * buf,size_t * len,u8 eid)1682 static void remove_ie(u8 *buf, size_t *len, u8 eid)
1683 {
1684 u8 *pos, *next, *end;
1685
1686 pos = (u8 *) get_ie(buf, *len, eid);
1687 if (pos) {
1688 next = pos + 2 + pos[1];
1689 end = buf + *len;
1690 *len -= 2 + pos[1];
1691 os_memmove(pos, next, end - next);
1692 }
1693 }
1694 #endif /* CONFIG_IEEE80211R */
1695
1696
sme_associate(struct wpa_supplicant * wpa_s,enum wpas_mode mode,const u8 * bssid,u16 auth_type)1697 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
1698 const u8 *bssid, u16 auth_type)
1699 {
1700 struct wpa_driver_associate_params params;
1701 struct ieee802_11_elems elems;
1702 struct wpa_ssid *ssid = wpa_s->current_ssid;
1703 #ifdef CONFIG_FILS
1704 u8 nonces[2 * FILS_NONCE_LEN];
1705 #endif /* CONFIG_FILS */
1706 #ifdef CONFIG_HT_OVERRIDES
1707 struct ieee80211_ht_capabilities htcaps;
1708 struct ieee80211_ht_capabilities htcaps_mask;
1709 #endif /* CONFIG_HT_OVERRIDES */
1710 #ifdef CONFIG_VHT_OVERRIDES
1711 struct ieee80211_vht_capabilities vhtcaps;
1712 struct ieee80211_vht_capabilities vhtcaps_mask;
1713 #endif /* CONFIG_VHT_OVERRIDES */
1714
1715 os_memset(¶ms, 0, sizeof(params));
1716
1717 #ifdef CONFIG_FILS
1718 if (auth_type == WLAN_AUTH_FILS_SK ||
1719 auth_type == WLAN_AUTH_FILS_SK_PFS) {
1720 struct wpabuf *buf;
1721 const u8 *snonce, *anonce;
1722 const unsigned int max_hlp = 20;
1723 struct wpabuf *hlp[max_hlp];
1724 unsigned int i, num_hlp = 0;
1725 struct fils_hlp_req *req;
1726
1727 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
1728 list) {
1729 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
1730 wpabuf_len(req->pkt));
1731 if (!hlp[num_hlp])
1732 break;
1733 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
1734 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
1735 ETH_ALEN);
1736 wpabuf_put_data(hlp[num_hlp],
1737 "\xaa\xaa\x03\x00\x00\x00", 6);
1738 wpabuf_put_buf(hlp[num_hlp], req->pkt);
1739 num_hlp++;
1740 if (num_hlp >= max_hlp)
1741 break;
1742 }
1743
1744 buf = fils_build_assoc_req(wpa_s->wpa, ¶ms.fils_kek,
1745 ¶ms.fils_kek_len, &snonce,
1746 &anonce,
1747 (const struct wpabuf **) hlp,
1748 num_hlp);
1749 for (i = 0; i < num_hlp; i++)
1750 wpabuf_free(hlp[i]);
1751 if (!buf)
1752 return;
1753 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
1754 wpa_s->sme.assoc_req_ie,
1755 wpa_s->sme.assoc_req_ie_len);
1756 #ifdef CONFIG_IEEE80211R
1757 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
1758 /* Remove RSNE and MDE to allow them to be overridden
1759 * with FILS+FT specific values from
1760 * fils_build_assoc_req(). */
1761 remove_ie(wpa_s->sme.assoc_req_ie,
1762 &wpa_s->sme.assoc_req_ie_len,
1763 WLAN_EID_RSN);
1764 wpa_hexdump(MSG_DEBUG,
1765 "FILS: assoc_req after RSNE removal",
1766 wpa_s->sme.assoc_req_ie,
1767 wpa_s->sme.assoc_req_ie_len);
1768 remove_ie(wpa_s->sme.assoc_req_ie,
1769 &wpa_s->sme.assoc_req_ie_len,
1770 WLAN_EID_MOBILITY_DOMAIN);
1771 wpa_hexdump(MSG_DEBUG,
1772 "FILS: assoc_req after MDE removal",
1773 wpa_s->sme.assoc_req_ie,
1774 wpa_s->sme.assoc_req_ie_len);
1775 }
1776 #endif /* CONFIG_IEEE80211R */
1777 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
1778 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
1779 sizeof(wpa_s->sme.assoc_req_ie)) {
1780 wpa_printf(MSG_ERROR,
1781 "FILS: Not enough buffer room for own AssocReq elements");
1782 wpabuf_free(buf);
1783 return;
1784 }
1785 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1786 wpabuf_head(buf), wpabuf_len(buf));
1787 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
1788 wpabuf_free(buf);
1789 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
1790 wpa_s->sme.assoc_req_ie,
1791 wpa_s->sme.assoc_req_ie_len);
1792
1793 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
1794 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
1795 params.fils_nonces = nonces;
1796 params.fils_nonces_len = sizeof(nonces);
1797 }
1798 #endif /* CONFIG_FILS */
1799
1800 #ifdef CONFIG_OWE
1801 #ifdef CONFIG_TESTING_OPTIONS
1802 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
1803 WLAN_EID_EXT_OWE_DH_PARAM)) {
1804 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
1805 } else
1806 #endif /* CONFIG_TESTING_OPTIONS */
1807 if (auth_type == WLAN_AUTH_OPEN &&
1808 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
1809 struct wpabuf *owe_ie;
1810 u16 group;
1811
1812 if (ssid && ssid->owe_group) {
1813 group = ssid->owe_group;
1814 } else if (wpa_s->assoc_status_code ==
1815 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
1816 if (wpa_s->last_owe_group == 19)
1817 group = 20;
1818 else if (wpa_s->last_owe_group == 20)
1819 group = 21;
1820 else
1821 group = OWE_DH_GROUP;
1822 } else {
1823 group = OWE_DH_GROUP;
1824 }
1825
1826 wpa_s->last_owe_group = group;
1827 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
1828 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
1829 if (!owe_ie) {
1830 wpa_printf(MSG_ERROR,
1831 "OWE: Failed to build IE for Association Request frame");
1832 return;
1833 }
1834 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
1835 sizeof(wpa_s->sme.assoc_req_ie)) {
1836 wpa_printf(MSG_ERROR,
1837 "OWE: Not enough buffer room for own Association Request frame elements");
1838 wpabuf_free(owe_ie);
1839 return;
1840 }
1841 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1842 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
1843 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
1844 wpabuf_free(owe_ie);
1845 }
1846 #endif /* CONFIG_OWE */
1847
1848 #ifdef CONFIG_DPP2
1849 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
1850 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
1851 !ssid->dpp_pfs_fallback) {
1852 struct rsn_pmksa_cache_entry *pmksa;
1853
1854 pmksa = pmksa_cache_get_current(wpa_s->wpa);
1855 if (!pmksa || !pmksa->dpp_pfs)
1856 goto pfs_fail;
1857
1858 dpp_pfs_free(wpa_s->dpp_pfs);
1859 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
1860 ssid->dpp_netaccesskey_len);
1861 if (!wpa_s->dpp_pfs) {
1862 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
1863 /* Try to continue without PFS */
1864 goto pfs_fail;
1865 }
1866 if (wpa_s->sme.assoc_req_ie_len +
1867 wpabuf_len(wpa_s->dpp_pfs->ie) >
1868 sizeof(wpa_s->sme.assoc_req_ie)) {
1869 wpa_printf(MSG_ERROR,
1870 "DPP: Not enough buffer room for own Association Request frame elements");
1871 dpp_pfs_free(wpa_s->dpp_pfs);
1872 wpa_s->dpp_pfs = NULL;
1873 goto pfs_fail;
1874 }
1875 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1876 wpabuf_head(wpa_s->dpp_pfs->ie),
1877 wpabuf_len(wpa_s->dpp_pfs->ie));
1878 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
1879 }
1880 pfs_fail:
1881 #endif /* CONFIG_DPP2 */
1882
1883 wpa_s->mscs_setup_done = false;
1884 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
1885 wpa_s->robust_av.valid_config) {
1886 struct wpabuf *mscs_ie;
1887 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
1888
1889 buf_len = 3 + /* MSCS descriptor IE header */
1890 1 + /* Request type */
1891 2 + /* User priority control */
1892 4 + /* Stream timeout */
1893 3 + /* TCLAS Mask IE header */
1894 wpa_s->robust_av.frame_classifier_len;
1895 mscs_ie = wpabuf_alloc(buf_len);
1896 if (!mscs_ie) {
1897 wpa_printf(MSG_INFO,
1898 "MSCS: Failed to allocate MSCS IE");
1899 goto mscs_fail;
1900 }
1901
1902 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
1903 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
1904 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
1905 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
1906 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
1907 mscs_ie_len = wpabuf_len(mscs_ie);
1908 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
1909 wpabuf_head(mscs_ie), mscs_ie_len);
1910 *wpa_ie_len += mscs_ie_len;
1911 }
1912
1913 wpabuf_free(mscs_ie);
1914 }
1915 mscs_fail:
1916
1917 if (ssid && ssid->multi_ap_backhaul_sta) {
1918 size_t multi_ap_ie_len;
1919
1920 multi_ap_ie_len = add_multi_ap_ie(
1921 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1922 sizeof(wpa_s->sme.assoc_req_ie) -
1923 wpa_s->sme.assoc_req_ie_len,
1924 MULTI_AP_BACKHAUL_STA);
1925 if (multi_ap_ie_len == 0) {
1926 wpa_printf(MSG_ERROR,
1927 "Multi-AP: Failed to build Multi-AP IE");
1928 return;
1929 }
1930 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
1931 }
1932
1933 params.bssid = bssid;
1934 params.ssid = wpa_s->sme.ssid;
1935 params.ssid_len = wpa_s->sme.ssid_len;
1936 params.freq.freq = wpa_s->sme.freq;
1937 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
1938 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
1939 wpa_s->sme.assoc_req_ie : NULL;
1940 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
1941 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
1942 params.wpa_ie, params.wpa_ie_len);
1943 params.pairwise_suite = wpa_s->pairwise_cipher;
1944 params.group_suite = wpa_s->group_cipher;
1945 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
1946 params.key_mgmt_suite = wpa_s->key_mgmt;
1947 params.wpa_proto = wpa_s->wpa_proto;
1948 #ifdef CONFIG_HT_OVERRIDES
1949 os_memset(&htcaps, 0, sizeof(htcaps));
1950 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
1951 params.htcaps = (u8 *) &htcaps;
1952 params.htcaps_mask = (u8 *) &htcaps_mask;
1953 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, ¶ms);
1954 #endif /* CONFIG_HT_OVERRIDES */
1955 #ifdef CONFIG_VHT_OVERRIDES
1956 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
1957 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
1958 params.vhtcaps = &vhtcaps;
1959 params.vhtcaps_mask = &vhtcaps_mask;
1960 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, ¶ms);
1961 #endif /* CONFIG_VHT_OVERRIDES */
1962 #ifdef CONFIG_HE_OVERRIDES
1963 wpa_supplicant_apply_he_overrides(wpa_s, ssid, ¶ms);
1964 #endif /* CONFIG_HE_OVERRIDES */
1965 #ifdef CONFIG_IEEE80211R
1966 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
1967 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
1968 WLAN_EID_RIC_DATA)) {
1969 /* There seems to be a pretty inconvenient bug in the Linux
1970 * kernel IE splitting functionality when RIC is used. For now,
1971 * skip correct behavior in IE construction here (i.e., drop the
1972 * additional non-FT-specific IEs) to avoid kernel issues. This
1973 * is fine since RIC is used only for testing purposes in the
1974 * current implementation. */
1975 wpa_printf(MSG_INFO,
1976 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
1977 params.wpa_ie = wpa_s->sme.ft_ies;
1978 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
1979 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
1980 const u8 *rm_en, *pos, *end;
1981 size_t rm_en_len = 0;
1982 u8 *rm_en_dup = NULL, *wpos;
1983
1984 /* Remove RSNE, MDE, FTE to allow them to be overridden with
1985 * FT specific values */
1986 remove_ie(wpa_s->sme.assoc_req_ie,
1987 &wpa_s->sme.assoc_req_ie_len,
1988 WLAN_EID_RSN);
1989 remove_ie(wpa_s->sme.assoc_req_ie,
1990 &wpa_s->sme.assoc_req_ie_len,
1991 WLAN_EID_MOBILITY_DOMAIN);
1992 remove_ie(wpa_s->sme.assoc_req_ie,
1993 &wpa_s->sme.assoc_req_ie_len,
1994 WLAN_EID_FAST_BSS_TRANSITION);
1995 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
1996 wpa_s->sme.assoc_req_ie_len,
1997 WLAN_EID_RRM_ENABLED_CAPABILITIES);
1998 if (rm_en) {
1999 /* Need to remove RM Enabled Capabilities element as
2000 * well temporarily, so that it can be placed between
2001 * RSNE and MDE. */
2002 rm_en_len = 2 + rm_en[1];
2003 rm_en_dup = os_memdup(rm_en, rm_en_len);
2004 remove_ie(wpa_s->sme.assoc_req_ie,
2005 &wpa_s->sme.assoc_req_ie_len,
2006 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2007 }
2008 wpa_hexdump(MSG_DEBUG,
2009 "SME: Association Request IEs after FT IE removal",
2010 wpa_s->sme.assoc_req_ie,
2011 wpa_s->sme.assoc_req_ie_len);
2012 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
2013 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
2014 wpa_printf(MSG_ERROR,
2015 "SME: Not enough buffer room for FT IEs in Association Request frame");
2016 os_free(rm_en_dup);
2017 return;
2018 }
2019
2020 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
2021 rm_en_len,
2022 wpa_s->sme.assoc_req_ie,
2023 wpa_s->sme.assoc_req_ie_len);
2024 pos = wpa_s->sme.ft_ies;
2025 end = pos + wpa_s->sme.ft_ies_len;
2026 wpos = wpa_s->sme.assoc_req_ie;
2027 if (*pos == WLAN_EID_RSN) {
2028 os_memcpy(wpos, pos, 2 + pos[1]);
2029 wpos += 2 + pos[1];
2030 pos += 2 + pos[1];
2031 }
2032 if (rm_en_dup) {
2033 os_memcpy(wpos, rm_en_dup, rm_en_len);
2034 wpos += rm_en_len;
2035 os_free(rm_en_dup);
2036 }
2037 os_memcpy(wpos, pos, end - pos);
2038 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
2039 rm_en_len;
2040 params.wpa_ie = wpa_s->sme.assoc_req_ie;
2041 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2042 wpa_hexdump(MSG_DEBUG,
2043 "SME: Association Request IEs after FT override",
2044 params.wpa_ie, params.wpa_ie_len);
2045 }
2046 #endif /* CONFIG_IEEE80211R */
2047 params.mode = mode;
2048 params.mgmt_frame_protection = wpa_s->sme.mfp;
2049 params.rrm_used = wpa_s->rrm.rrm_used;
2050 if (wpa_s->sme.prev_bssid_set)
2051 params.prev_bssid = wpa_s->sme.prev_bssid;
2052
2053 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2054 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
2055 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
2056 params.freq.freq);
2057
2058 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2059
2060 if (params.wpa_ie == NULL ||
2061 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
2062 < 0) {
2063 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
2064 os_memset(&elems, 0, sizeof(elems));
2065 }
2066 if (elems.rsn_ie) {
2067 params.wpa_proto = WPA_PROTO_RSN;
2068 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
2069 elems.rsn_ie_len + 2);
2070 } else if (elems.wpa_ie) {
2071 params.wpa_proto = WPA_PROTO_WPA;
2072 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
2073 elems.wpa_ie_len + 2);
2074 } else if (elems.osen) {
2075 params.wpa_proto = WPA_PROTO_OSEN;
2076 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
2077 elems.osen_len + 2);
2078 } else
2079 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2080 if (elems.rsnxe)
2081 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
2082 elems.rsnxe_len + 2);
2083 else
2084 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
2085 if (ssid && ssid->p2p_group)
2086 params.p2p = 1;
2087
2088 if (wpa_s->p2pdev->set_sta_uapsd)
2089 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2090 else
2091 params.uapsd = -1;
2092
2093 if (wpa_drv_associate(wpa_s, ¶ms) < 0) {
2094 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
2095 "driver failed");
2096 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2097 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2098 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2099 return;
2100 }
2101
2102 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
2103 NULL);
2104
2105 #ifdef CONFIG_TESTING_OPTIONS
2106 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
2107 wpa_s->last_assoc_req_wpa_ie = NULL;
2108 if (params.wpa_ie)
2109 wpa_s->last_assoc_req_wpa_ie =
2110 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
2111 #endif /* CONFIG_TESTING_OPTIONS */
2112 }
2113
2114
sme_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)2115 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2116 const u8 *ies, size_t ies_len)
2117 {
2118 if (md == NULL || ies == NULL) {
2119 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
2120 os_free(wpa_s->sme.ft_ies);
2121 wpa_s->sme.ft_ies = NULL;
2122 wpa_s->sme.ft_ies_len = 0;
2123 wpa_s->sme.ft_used = 0;
2124 return 0;
2125 }
2126
2127 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
2128 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
2129 os_free(wpa_s->sme.ft_ies);
2130 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
2131 if (wpa_s->sme.ft_ies == NULL)
2132 return -1;
2133 wpa_s->sme.ft_ies_len = ies_len;
2134 return 0;
2135 }
2136
2137
sme_deauth(struct wpa_supplicant * wpa_s)2138 static void sme_deauth(struct wpa_supplicant *wpa_s)
2139 {
2140 int bssid_changed;
2141
2142 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2143
2144 if (wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
2145 WLAN_REASON_DEAUTH_LEAVING) < 0) {
2146 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
2147 "failed");
2148 }
2149 wpa_s->sme.prev_bssid_set = 0;
2150
2151 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2152 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2153 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2154 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2155 if (bssid_changed)
2156 wpas_notify_bssid_changed(wpa_s);
2157 }
2158
2159
sme_event_assoc_reject(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2160 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
2161 union wpa_event_data *data)
2162 {
2163 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
2164 "status code %d", MAC2STR(wpa_s->pending_bssid),
2165 data->assoc_reject.status_code);
2166
2167 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2168
2169 #ifdef CONFIG_SAE
2170 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
2171 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
2172 wpa_dbg(wpa_s, MSG_DEBUG,
2173 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
2174 wpa_sm_aborted_cached(wpa_s->wpa);
2175 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
2176 if (wpa_s->current_bss) {
2177 struct wpa_bss *bss = wpa_s->current_bss;
2178 struct wpa_ssid *ssid = wpa_s->current_ssid;
2179
2180 wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
2181 WLAN_REASON_DEAUTH_LEAVING);
2182 wpas_connect_work_done(wpa_s);
2183 wpa_supplicant_mark_disassoc(wpa_s);
2184 wpa_supplicant_connect(wpa_s, bss, ssid);
2185 return;
2186 }
2187 }
2188 #endif /* CONFIG_SAE */
2189
2190 /*
2191 * For now, unconditionally terminate the previous authentication. In
2192 * theory, this should not be needed, but mac80211 gets quite confused
2193 * if the authentication is left pending.. Some roaming cases might
2194 * benefit from using the previous authentication, so this could be
2195 * optimized in the future.
2196 */
2197 sme_deauth(wpa_s);
2198 }
2199
2200
sme_event_auth_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2201 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
2202 union wpa_event_data *data)
2203 {
2204 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
2205 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2206 wpa_supplicant_mark_disassoc(wpa_s);
2207 }
2208
2209
sme_event_assoc_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2210 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
2211 union wpa_event_data *data)
2212 {
2213 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
2214 wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2215 wpa_supplicant_mark_disassoc(wpa_s);
2216 }
2217
2218
sme_event_disassoc(struct wpa_supplicant * wpa_s,struct disassoc_info * info)2219 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
2220 struct disassoc_info *info)
2221 {
2222 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
2223 if (wpa_s->sme.prev_bssid_set) {
2224 /*
2225 * cfg80211/mac80211 can get into somewhat confused state if
2226 * the AP only disassociates us and leaves us in authenticated
2227 * state. For now, force the state to be cleared to avoid
2228 * confusing errors if we try to associate with the AP again.
2229 */
2230 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
2231 "driver state");
2232 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
2233 WLAN_REASON_DEAUTH_LEAVING);
2234 }
2235 }
2236
2237
sme_auth_timer(void * eloop_ctx,void * timeout_ctx)2238 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
2239 {
2240 struct wpa_supplicant *wpa_s = eloop_ctx;
2241 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
2242 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
2243 sme_deauth(wpa_s);
2244 }
2245 }
2246
2247
sme_assoc_timer(void * eloop_ctx,void * timeout_ctx)2248 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
2249 {
2250 struct wpa_supplicant *wpa_s = eloop_ctx;
2251 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2252 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
2253 sme_deauth(wpa_s);
2254 }
2255 }
2256
2257
sme_state_changed(struct wpa_supplicant * wpa_s)2258 void sme_state_changed(struct wpa_supplicant *wpa_s)
2259 {
2260 /* Make sure timers are cleaned up appropriately. */
2261 if (wpa_s->wpa_state != WPA_ASSOCIATING)
2262 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2263 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
2264 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2265 }
2266
2267
sme_disassoc_while_authenticating(struct wpa_supplicant * wpa_s,const u8 * prev_pending_bssid)2268 void sme_disassoc_while_authenticating(struct wpa_supplicant *wpa_s,
2269 const u8 *prev_pending_bssid)
2270 {
2271 /*
2272 * mac80211-workaround to force deauth on failed auth cmd,
2273 * requires us to remain in authenticating state to allow the
2274 * second authentication attempt to be continued properly.
2275 */
2276 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Allow pending authentication "
2277 "to proceed after disconnection event");
2278 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
2279 os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
2280
2281 /*
2282 * Re-arm authentication timer in case auth fails for whatever reason.
2283 */
2284 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2285 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
2286 NULL);
2287 }
2288
2289
sme_clear_on_disassoc(struct wpa_supplicant * wpa_s)2290 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
2291 {
2292 wpa_s->sme.prev_bssid_set = 0;
2293 #ifdef CONFIG_SAE
2294 wpabuf_free(wpa_s->sme.sae_token);
2295 wpa_s->sme.sae_token = NULL;
2296 sae_clear_data(&wpa_s->sme.sae);
2297 #endif /* CONFIG_SAE */
2298 #ifdef CONFIG_IEEE80211R
2299 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
2300 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
2301 #endif /* CONFIG_IEEE80211R */
2302 sme_stop_sa_query(wpa_s);
2303 }
2304
2305
sme_deinit(struct wpa_supplicant * wpa_s)2306 void sme_deinit(struct wpa_supplicant *wpa_s)
2307 {
2308 sme_clear_on_disassoc(wpa_s);
2309 #ifdef CONFIG_SAE
2310 os_free(wpa_s->sme.sae_rejected_groups);
2311 wpa_s->sme.sae_rejected_groups = NULL;
2312 #endif /* CONFIG_SAE */
2313
2314 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2315 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2316 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
2317 }
2318
2319
sme_send_2040_bss_coex(struct wpa_supplicant * wpa_s,const u8 * chan_list,u8 num_channels,u8 num_intol)2320 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
2321 const u8 *chan_list, u8 num_channels,
2322 u8 num_intol)
2323 {
2324 struct ieee80211_2040_bss_coex_ie *bc_ie;
2325 struct ieee80211_2040_intol_chan_report *ic_report;
2326 struct wpabuf *buf;
2327
2328 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
2329 " (num_channels=%u num_intol=%u)",
2330 MAC2STR(wpa_s->bssid), num_channels, num_intol);
2331 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
2332 chan_list, num_channels);
2333
2334 buf = wpabuf_alloc(2 + /* action.category + action_code */
2335 sizeof(struct ieee80211_2040_bss_coex_ie) +
2336 sizeof(struct ieee80211_2040_intol_chan_report) +
2337 num_channels);
2338 if (buf == NULL)
2339 return;
2340
2341 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
2342 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
2343
2344 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
2345 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
2346 bc_ie->length = 1;
2347 if (num_intol)
2348 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
2349
2350 if (num_channels > 0) {
2351 ic_report = wpabuf_put(buf, sizeof(*ic_report));
2352 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
2353 ic_report->length = num_channels + 1;
2354 ic_report->op_class = 0;
2355 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
2356 num_channels);
2357 }
2358
2359 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2360 wpa_s->own_addr, wpa_s->bssid,
2361 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
2362 wpa_msg(wpa_s, MSG_INFO,
2363 "SME: Failed to send 20/40 BSS Coexistence frame");
2364 }
2365
2366 wpabuf_free(buf);
2367 }
2368
2369
sme_proc_obss_scan(struct wpa_supplicant * wpa_s,struct wpa_scan_results * scan_res)2370 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s,
2371 struct wpa_scan_results *scan_res)
2372 {
2373 const u8 *ie;
2374 u8 chan_list[P2P_MAX_CHANNELS], channel;
2375 u8 num_channels = 0, num_intol = 0, i;
2376 size_t j;
2377 int pri_freq, sec_freq;
2378
2379 if (!wpa_s->sme.sched_obss_scan)
2380 return 0;
2381
2382 wpa_s->sme.sched_obss_scan = 0;
2383 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
2384 return 1;
2385
2386 /*
2387 * Check whether AP uses regulatory triplet or channel triplet in
2388 * country info. Right now the operating class of the BSS channel
2389 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
2390 * based on the assumption that operating class triplet is not used in
2391 * beacon frame. If the First Channel Number/Operating Extension
2392 * Identifier octet has a positive integer value of 201 or greater,
2393 * then its operating class triplet.
2394 *
2395 * TODO: If Supported Operating Classes element is present in beacon
2396 * frame, have to lookup operating class in Annex E and fill them in
2397 * 2040 coex frame.
2398 */
2399 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
2400 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
2401 return 1;
2402
2403 os_memset(chan_list, 0, sizeof(chan_list));
2404
2405 pri_freq = wpa_s->assoc_freq;
2406
2407 switch (wpa_s->sme.ht_sec_chan) {
2408 case HT_SEC_CHAN_ABOVE:
2409 sec_freq = pri_freq + 20;
2410 break;
2411 case HT_SEC_CHAN_BELOW:
2412 sec_freq = pri_freq - 20;
2413 break;
2414 case HT_SEC_CHAN_UNKNOWN:
2415 default:
2416 wpa_msg(wpa_s, MSG_WARNING,
2417 "Undefined secondary channel: drop OBSS scan results");
2418 return 1;
2419 }
2420
2421 for (j = 0; j < scan_res->num; j++) {
2422 struct wpa_scan_res *bss = scan_res->res[j];
2423 enum hostapd_hw_mode mode;
2424 int res;
2425
2426 /* Skip other band bss */
2427 mode = ieee80211_freq_to_chan(bss->freq, &channel);
2428 if (mode != HOSTAPD_MODE_IEEE80211G &&
2429 mode != HOSTAPD_MODE_IEEE80211B)
2430 continue;
2431
2432 res = check_bss_coex_40mhz(bss, pri_freq, sec_freq);
2433 if (res) {
2434 if (res == 2)
2435 num_intol++;
2436
2437 /* Check whether the channel is already considered */
2438 for (i = 0; i < num_channels; i++) {
2439 if (channel == chan_list[i])
2440 break;
2441 }
2442 if (i != num_channels)
2443 continue;
2444
2445 chan_list[num_channels++] = channel;
2446 }
2447 }
2448
2449 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
2450 return 1;
2451 }
2452
2453
wpa_obss_scan_freqs_list(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)2454 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
2455 struct wpa_driver_scan_params *params)
2456 {
2457 /* Include only affected channels */
2458 struct hostapd_hw_modes *mode;
2459 int count, i;
2460 int start, end;
2461
2462 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
2463 HOSTAPD_MODE_IEEE80211G, false);
2464 if (mode == NULL) {
2465 /* No channels supported in this band - use empty list */
2466 params->freqs = os_zalloc(sizeof(int));
2467 return;
2468 }
2469
2470 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
2471 wpa_s->current_bss) {
2472 const u8 *ie;
2473
2474 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
2475 if (ie && ie[1] >= 2) {
2476 u8 o;
2477
2478 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
2479 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
2480 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
2481 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
2482 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
2483 }
2484 }
2485
2486 start = wpa_s->assoc_freq - 10;
2487 end = wpa_s->assoc_freq + 10;
2488 switch (wpa_s->sme.ht_sec_chan) {
2489 case HT_SEC_CHAN_UNKNOWN:
2490 /* HT40+ possible on channels 1..9 */
2491 if (wpa_s->assoc_freq <= 2452)
2492 start -= 20;
2493 /* HT40- possible on channels 5-13 */
2494 if (wpa_s->assoc_freq >= 2432)
2495 end += 20;
2496 break;
2497 case HT_SEC_CHAN_ABOVE:
2498 end += 20;
2499 break;
2500 case HT_SEC_CHAN_BELOW:
2501 start -= 20;
2502 break;
2503 }
2504 wpa_printf(MSG_DEBUG,
2505 "OBSS: assoc_freq %d possible affected range %d-%d",
2506 wpa_s->assoc_freq, start, end);
2507
2508 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
2509 if (params->freqs == NULL)
2510 return;
2511 for (count = 0, i = 0; i < mode->num_channels; i++) {
2512 int freq;
2513
2514 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
2515 continue;
2516 freq = mode->channels[i].freq;
2517 if (freq - 10 >= end || freq + 10 <= start)
2518 continue; /* not affected */
2519 params->freqs[count++] = freq;
2520 }
2521 }
2522
2523
sme_obss_scan_timeout(void * eloop_ctx,void * timeout_ctx)2524 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
2525 {
2526 struct wpa_supplicant *wpa_s = eloop_ctx;
2527 struct wpa_driver_scan_params params;
2528
2529 if (!wpa_s->current_bss) {
2530 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
2531 return;
2532 }
2533
2534 os_memset(¶ms, 0, sizeof(params));
2535 wpa_obss_scan_freqs_list(wpa_s, ¶ms);
2536 params.low_priority = 1;
2537 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
2538
2539 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms))
2540 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
2541 else
2542 wpa_s->sme.sched_obss_scan = 1;
2543 os_free(params.freqs);
2544
2545 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
2546 sme_obss_scan_timeout, wpa_s, NULL);
2547 }
2548
2549
sme_sched_obss_scan(struct wpa_supplicant * wpa_s,int enable)2550 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
2551 {
2552 const u8 *ie;
2553 struct wpa_bss *bss = wpa_s->current_bss;
2554 struct wpa_ssid *ssid = wpa_s->current_ssid;
2555 struct hostapd_hw_modes *hw_mode = NULL;
2556 int i;
2557
2558 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
2559 wpa_s->sme.sched_obss_scan = 0;
2560 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
2561 if (!enable)
2562 return;
2563
2564 /*
2565 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
2566 * or it expects OBSS scan to be performed by wpa_supplicant.
2567 */
2568 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
2569 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
2570 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
2571 return;
2572
2573 if (!wpa_s->hw.modes)
2574 return;
2575
2576 /* only HT caps in 11g mode are relevant */
2577 for (i = 0; i < wpa_s->hw.num_modes; i++) {
2578 hw_mode = &wpa_s->hw.modes[i];
2579 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
2580 break;
2581 }
2582
2583 /* Driver does not support HT40 for 11g or doesn't have 11g. */
2584 if (i == wpa_s->hw.num_modes || !hw_mode ||
2585 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2586 return;
2587
2588 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
2589 return; /* Not associated on 2.4 GHz band */
2590
2591 /* Check whether AP supports HT40 */
2592 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
2593 if (!ie || ie[1] < 2 ||
2594 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2595 return; /* AP does not support HT40 */
2596
2597 ie = wpa_bss_get_ie(wpa_s->current_bss,
2598 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
2599 if (!ie || ie[1] < 14)
2600 return; /* AP does not request OBSS scans */
2601
2602 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
2603 if (wpa_s->sme.obss_scan_int < 10) {
2604 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
2605 "replaced with the minimum 10 sec",
2606 wpa_s->sme.obss_scan_int);
2607 wpa_s->sme.obss_scan_int = 10;
2608 }
2609 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
2610 wpa_s->sme.obss_scan_int);
2611 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
2612 sme_obss_scan_timeout, wpa_s, NULL);
2613 }
2614
2615
2616 static const unsigned int sa_query_max_timeout = 1000;
2617 static const unsigned int sa_query_retry_timeout = 201;
2618 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
2619
sme_check_sa_query_timeout(struct wpa_supplicant * wpa_s)2620 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
2621 {
2622 u32 tu;
2623 struct os_reltime now, passed;
2624 os_get_reltime(&now);
2625 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
2626 tu = (passed.sec * 1000000 + passed.usec) / 1024;
2627 if (sa_query_max_timeout < tu) {
2628 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
2629 sme_stop_sa_query(wpa_s);
2630 wpa_supplicant_deauthenticate(
2631 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
2632 return 1;
2633 }
2634
2635 return 0;
2636 }
2637
2638
sme_send_sa_query_req(struct wpa_supplicant * wpa_s,const u8 * trans_id)2639 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
2640 const u8 *trans_id)
2641 {
2642 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
2643 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
2644
2645 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
2646 MACSTR, MAC2STR(wpa_s->bssid));
2647 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
2648 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
2649 req[0] = WLAN_ACTION_SA_QUERY;
2650 req[1] = WLAN_SA_QUERY_REQUEST;
2651 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
2652
2653 #ifdef CONFIG_OCV
2654 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2655 struct wpa_channel_info ci;
2656
2657 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2658 wpa_printf(MSG_WARNING,
2659 "Failed to get channel info for OCI element in SA Query Request frame");
2660 return;
2661 }
2662
2663 #ifdef CONFIG_TESTING_OPTIONS
2664 if (wpa_s->oci_freq_override_saquery_req) {
2665 wpa_printf(MSG_INFO,
2666 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
2667 ci.frequency,
2668 wpa_s->oci_freq_override_saquery_req);
2669 ci.frequency = wpa_s->oci_freq_override_saquery_req;
2670 }
2671 #endif /* CONFIG_TESTING_OPTIONS */
2672
2673 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
2674 return;
2675
2676 req_len += OCV_OCI_EXTENDED_LEN;
2677 }
2678 #endif /* CONFIG_OCV */
2679
2680 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2681 wpa_s->own_addr, wpa_s->bssid,
2682 req, req_len, 0) < 0)
2683 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
2684 "Request");
2685 }
2686
2687
sme_sa_query_timer(void * eloop_ctx,void * timeout_ctx)2688 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
2689 {
2690 struct wpa_supplicant *wpa_s = eloop_ctx;
2691 unsigned int timeout, sec, usec;
2692 u8 *trans_id, *nbuf;
2693
2694 if (wpa_s->sme.sa_query_count > 0 &&
2695 sme_check_sa_query_timeout(wpa_s))
2696 return;
2697
2698 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
2699 wpa_s->sme.sa_query_count + 1,
2700 WLAN_SA_QUERY_TR_ID_LEN);
2701 if (nbuf == NULL) {
2702 sme_stop_sa_query(wpa_s);
2703 return;
2704 }
2705 if (wpa_s->sme.sa_query_count == 0) {
2706 /* Starting a new SA Query procedure */
2707 os_get_reltime(&wpa_s->sme.sa_query_start);
2708 }
2709 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
2710 wpa_s->sme.sa_query_trans_id = nbuf;
2711 wpa_s->sme.sa_query_count++;
2712
2713 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
2714 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
2715 sme_stop_sa_query(wpa_s);
2716 return;
2717 }
2718
2719 timeout = sa_query_retry_timeout;
2720 sec = ((timeout / 1000) * 1024) / 1000;
2721 usec = (timeout % 1000) * 1024;
2722 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
2723
2724 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
2725 wpa_s->sme.sa_query_count);
2726
2727 sme_send_sa_query_req(wpa_s, trans_id);
2728 }
2729
2730
sme_start_sa_query(struct wpa_supplicant * wpa_s)2731 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
2732 {
2733 sme_sa_query_timer(wpa_s, NULL);
2734 }
2735
2736
sme_stop_sa_query(struct wpa_supplicant * wpa_s)2737 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
2738 {
2739 if (wpa_s->sme.sa_query_trans_id)
2740 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
2741 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
2742 os_free(wpa_s->sme.sa_query_trans_id);
2743 wpa_s->sme.sa_query_trans_id = NULL;
2744 wpa_s->sme.sa_query_count = 0;
2745 }
2746
2747
sme_event_unprot_disconnect(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * da,u16 reason_code)2748 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
2749 const u8 *da, u16 reason_code)
2750 {
2751 struct wpa_ssid *ssid;
2752 struct os_reltime now;
2753
2754 if (wpa_s->wpa_state != WPA_COMPLETED)
2755 return;
2756 ssid = wpa_s->current_ssid;
2757 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
2758 return;
2759 if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
2760 return;
2761 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
2762 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
2763 return;
2764 if (wpa_s->sme.sa_query_count > 0)
2765 return;
2766 #ifdef CONFIG_TESTING_OPTIONS
2767 if (wpa_s->disable_sa_query)
2768 return;
2769 #endif /* CONFIG_TESTING_OPTIONS */
2770
2771 os_get_reltime(&now);
2772 if (wpa_s->sme.last_unprot_disconnect.sec &&
2773 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
2774 return; /* limit SA Query procedure frequency */
2775 wpa_s->sme.last_unprot_disconnect = now;
2776
2777 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
2778 "possible AP/STA state mismatch - trigger SA Query");
2779 sme_start_sa_query(wpa_s);
2780 }
2781
2782
sme_event_ch_switch(struct wpa_supplicant * wpa_s)2783 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
2784 {
2785 unsigned int usec;
2786 u32 _rand;
2787
2788 if (wpa_s->wpa_state != WPA_COMPLETED ||
2789 !wpa_sm_ocv_enabled(wpa_s->wpa))
2790 return;
2791
2792 wpa_dbg(wpa_s, MSG_DEBUG,
2793 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
2794 sme_stop_sa_query(wpa_s);
2795
2796 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
2797 _rand = os_random();
2798 usec = _rand % (sa_query_ch_switch_max_delay + 1);
2799 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
2800 }
2801
2802
sme_process_sa_query_request(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)2803 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
2804 const u8 *sa, const u8 *data,
2805 size_t len)
2806 {
2807 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
2808 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
2809
2810 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
2811 MACSTR, MAC2STR(wpa_s->bssid));
2812
2813 resp[0] = WLAN_ACTION_SA_QUERY;
2814 resp[1] = WLAN_SA_QUERY_RESPONSE;
2815 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
2816
2817 #ifdef CONFIG_OCV
2818 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2819 struct wpa_channel_info ci;
2820
2821 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2822 wpa_printf(MSG_WARNING,
2823 "Failed to get channel info for OCI element in SA Query Response frame");
2824 return;
2825 }
2826
2827 #ifdef CONFIG_TESTING_OPTIONS
2828 if (wpa_s->oci_freq_override_saquery_resp) {
2829 wpa_printf(MSG_INFO,
2830 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
2831 ci.frequency,
2832 wpa_s->oci_freq_override_saquery_resp);
2833 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
2834 }
2835 #endif /* CONFIG_TESTING_OPTIONS */
2836
2837 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
2838 return;
2839
2840 resp_len += OCV_OCI_EXTENDED_LEN;
2841 }
2842 #endif /* CONFIG_OCV */
2843
2844 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
2845 wpa_s->own_addr, wpa_s->bssid,
2846 resp, resp_len, 0) < 0)
2847 wpa_msg(wpa_s, MSG_INFO,
2848 "SME: Failed to send SA Query Response");
2849 }
2850
2851
sme_process_sa_query_response(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)2852 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
2853 const u8 *sa, const u8 *data,
2854 size_t len)
2855 {
2856 int i;
2857
2858 if (!wpa_s->sme.sa_query_trans_id)
2859 return;
2860
2861 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
2862 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
2863
2864 if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
2865 return;
2866
2867 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
2868 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
2869 i * WLAN_SA_QUERY_TR_ID_LEN,
2870 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
2871 break;
2872 }
2873
2874 if (i >= wpa_s->sme.sa_query_count) {
2875 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
2876 "transaction identifier found");
2877 return;
2878 }
2879
2880 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
2881 "from " MACSTR, MAC2STR(sa));
2882 sme_stop_sa_query(wpa_s);
2883 }
2884
2885
sme_sa_query_rx(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)2886 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *sa,
2887 const u8 *data, size_t len)
2888 {
2889 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
2890 return;
2891
2892 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
2893 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
2894
2895 #ifdef CONFIG_OCV
2896 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
2897 struct ieee802_11_elems elems;
2898 struct wpa_channel_info ci;
2899
2900 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
2901 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
2902 &elems, 1) == ParseFailed) {
2903 wpa_printf(MSG_DEBUG,
2904 "SA Query: Failed to parse elements");
2905 return;
2906 }
2907
2908 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
2909 wpa_printf(MSG_WARNING,
2910 "Failed to get channel info to validate received OCI in SA Query Action frame");
2911 return;
2912 }
2913
2914 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
2915 channel_width_to_int(ci.chanwidth),
2916 ci.seg1_idx) != OCI_SUCCESS) {
2917 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
2918 " frame=saquery%s error=%s",
2919 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
2920 "req" : "resp", ocv_errorstr);
2921 return;
2922 }
2923 }
2924 #endif /* CONFIG_OCV */
2925
2926 if (data[0] == WLAN_SA_QUERY_REQUEST)
2927 sme_process_sa_query_request(wpa_s, sa, data, len);
2928 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
2929 sme_process_sa_query_response(wpa_s, sa, data, len);
2930 }
2931