1 /*
2 * Generic advertisement service (GAS) server
3 * Copyright (c) 2011-2014, Qualcomm Atheros, Inc.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/gas.h"
14 #include "utils/eloop.h"
15 #include "hostapd.h"
16 #include "ap_config.h"
17 #include "ap_drv_ops.h"
18 #include "sta_info.h"
19 #include "gas_serv.h"
20
21
convert_to_protected_dual(struct wpabuf * msg)22 static void convert_to_protected_dual(struct wpabuf *msg)
23 {
24 u8 *categ = wpabuf_mhead_u8(msg);
25 *categ = WLAN_ACTION_PROTECTED_DUAL;
26 }
27
28
29 static struct gas_dialog_info *
gas_dialog_create(struct hostapd_data * hapd,const u8 * addr,u8 dialog_token)30 gas_dialog_create(struct hostapd_data *hapd, const u8 *addr, u8 dialog_token)
31 {
32 struct sta_info *sta;
33 struct gas_dialog_info *dia = NULL;
34 int i, j;
35
36 sta = ap_get_sta(hapd, addr);
37 if (!sta) {
38 /*
39 * We need a STA entry to be able to maintain state for
40 * the GAS query.
41 */
42 wpa_printf(MSG_DEBUG, "ANQP: Add a temporary STA entry for "
43 "GAS query");
44 sta = ap_sta_add(hapd, addr);
45 if (!sta) {
46 wpa_printf(MSG_DEBUG, "Failed to add STA " MACSTR
47 " for GAS query", MAC2STR(addr));
48 return NULL;
49 }
50 sta->flags |= WLAN_STA_GAS;
51 /*
52 * The default inactivity is 300 seconds. We don't need
53 * it to be that long.
54 */
55 ap_sta_session_timeout(hapd, sta, 5);
56 } else {
57 ap_sta_replenish_timeout(hapd, sta, 5);
58 }
59
60 if (sta->gas_dialog == NULL) {
61 sta->gas_dialog = os_calloc(GAS_DIALOG_MAX,
62 sizeof(struct gas_dialog_info));
63 if (sta->gas_dialog == NULL)
64 return NULL;
65 }
66
67 for (i = sta->gas_dialog_next, j = 0; j < GAS_DIALOG_MAX; i++, j++) {
68 if (i == GAS_DIALOG_MAX)
69 i = 0;
70 if (sta->gas_dialog[i].valid)
71 continue;
72 dia = &sta->gas_dialog[i];
73 dia->valid = 1;
74 dia->dialog_token = dialog_token;
75 sta->gas_dialog_next = (++i == GAS_DIALOG_MAX) ? 0 : i;
76 return dia;
77 }
78
79 wpa_msg(hapd->msg_ctx, MSG_ERROR, "ANQP: Could not create dialog for "
80 MACSTR " dialog_token %u. Consider increasing "
81 "GAS_DIALOG_MAX.", MAC2STR(addr), dialog_token);
82
83 return NULL;
84 }
85
86
87 struct gas_dialog_info *
gas_serv_dialog_find(struct hostapd_data * hapd,const u8 * addr,u8 dialog_token)88 gas_serv_dialog_find(struct hostapd_data *hapd, const u8 *addr,
89 u8 dialog_token)
90 {
91 struct sta_info *sta;
92 int i;
93
94 sta = ap_get_sta(hapd, addr);
95 if (!sta) {
96 wpa_printf(MSG_DEBUG, "ANQP: could not find STA " MACSTR,
97 MAC2STR(addr));
98 return NULL;
99 }
100 for (i = 0; sta->gas_dialog && i < GAS_DIALOG_MAX; i++) {
101 if (sta->gas_dialog[i].dialog_token != dialog_token ||
102 !sta->gas_dialog[i].valid)
103 continue;
104 return &sta->gas_dialog[i];
105 }
106 wpa_printf(MSG_DEBUG, "ANQP: Could not find dialog for "
107 MACSTR " dialog_token %u", MAC2STR(addr), dialog_token);
108 return NULL;
109 }
110
111
gas_serv_dialog_clear(struct gas_dialog_info * dia)112 void gas_serv_dialog_clear(struct gas_dialog_info *dia)
113 {
114 wpabuf_free(dia->sd_resp);
115 os_memset(dia, 0, sizeof(*dia));
116 }
117
118
gas_serv_free_dialogs(struct hostapd_data * hapd,const u8 * sta_addr)119 static void gas_serv_free_dialogs(struct hostapd_data *hapd,
120 const u8 *sta_addr)
121 {
122 struct sta_info *sta;
123 int i;
124
125 sta = ap_get_sta(hapd, sta_addr);
126 if (sta == NULL || sta->gas_dialog == NULL)
127 return;
128
129 for (i = 0; i < GAS_DIALOG_MAX; i++) {
130 if (sta->gas_dialog[i].valid)
131 return;
132 }
133
134 os_free(sta->gas_dialog);
135 sta->gas_dialog = NULL;
136 }
137
138
139 #ifdef CONFIG_HS20
anqp_add_hs_capab_list(struct hostapd_data * hapd,struct wpabuf * buf)140 static void anqp_add_hs_capab_list(struct hostapd_data *hapd,
141 struct wpabuf *buf)
142 {
143 u8 *len;
144
145 len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
146 wpabuf_put_be24(buf, OUI_WFA);
147 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
148 wpabuf_put_u8(buf, HS20_STYPE_CAPABILITY_LIST);
149 wpabuf_put_u8(buf, 0); /* Reserved */
150 wpabuf_put_u8(buf, HS20_STYPE_CAPABILITY_LIST);
151 if (hapd->conf->hs20_oper_friendly_name)
152 wpabuf_put_u8(buf, HS20_STYPE_OPERATOR_FRIENDLY_NAME);
153 if (hapd->conf->hs20_wan_metrics)
154 wpabuf_put_u8(buf, HS20_STYPE_WAN_METRICS);
155 if (hapd->conf->hs20_connection_capability)
156 wpabuf_put_u8(buf, HS20_STYPE_CONNECTION_CAPABILITY);
157 if (hapd->conf->nai_realm_data)
158 wpabuf_put_u8(buf, HS20_STYPE_NAI_HOME_REALM_QUERY);
159 if (hapd->conf->hs20_operating_class)
160 wpabuf_put_u8(buf, HS20_STYPE_OPERATING_CLASS);
161 if (hapd->conf->hs20_osu_providers_count)
162 wpabuf_put_u8(buf, HS20_STYPE_OSU_PROVIDERS_LIST);
163 if (hapd->conf->hs20_icons_count)
164 wpabuf_put_u8(buf, HS20_STYPE_ICON_REQUEST);
165 gas_anqp_set_element_len(buf, len);
166 }
167 #endif /* CONFIG_HS20 */
168
169
anqp_add_capab_list(struct hostapd_data * hapd,struct wpabuf * buf)170 static void anqp_add_capab_list(struct hostapd_data *hapd,
171 struct wpabuf *buf)
172 {
173 u8 *len;
174
175 len = gas_anqp_add_element(buf, ANQP_CAPABILITY_LIST);
176 wpabuf_put_le16(buf, ANQP_CAPABILITY_LIST);
177 if (hapd->conf->venue_name)
178 wpabuf_put_le16(buf, ANQP_VENUE_NAME);
179 if (hapd->conf->network_auth_type)
180 wpabuf_put_le16(buf, ANQP_NETWORK_AUTH_TYPE);
181 if (hapd->conf->roaming_consortium)
182 wpabuf_put_le16(buf, ANQP_ROAMING_CONSORTIUM);
183 if (hapd->conf->ipaddr_type_configured)
184 wpabuf_put_le16(buf, ANQP_IP_ADDR_TYPE_AVAILABILITY);
185 if (hapd->conf->nai_realm_data)
186 wpabuf_put_le16(buf, ANQP_NAI_REALM);
187 if (hapd->conf->anqp_3gpp_cell_net)
188 wpabuf_put_le16(buf, ANQP_3GPP_CELLULAR_NETWORK);
189 if (hapd->conf->domain_name)
190 wpabuf_put_le16(buf, ANQP_DOMAIN_NAME);
191 #ifdef CONFIG_HS20
192 anqp_add_hs_capab_list(hapd, buf);
193 #endif /* CONFIG_HS20 */
194 gas_anqp_set_element_len(buf, len);
195 }
196
197
anqp_add_venue_name(struct hostapd_data * hapd,struct wpabuf * buf)198 static void anqp_add_venue_name(struct hostapd_data *hapd, struct wpabuf *buf)
199 {
200 if (hapd->conf->venue_name) {
201 u8 *len;
202 unsigned int i;
203 len = gas_anqp_add_element(buf, ANQP_VENUE_NAME);
204 wpabuf_put_u8(buf, hapd->conf->venue_group);
205 wpabuf_put_u8(buf, hapd->conf->venue_type);
206 for (i = 0; i < hapd->conf->venue_name_count; i++) {
207 struct hostapd_lang_string *vn;
208 vn = &hapd->conf->venue_name[i];
209 wpabuf_put_u8(buf, 3 + vn->name_len);
210 wpabuf_put_data(buf, vn->lang, 3);
211 wpabuf_put_data(buf, vn->name, vn->name_len);
212 }
213 gas_anqp_set_element_len(buf, len);
214 }
215 }
216
217
anqp_add_network_auth_type(struct hostapd_data * hapd,struct wpabuf * buf)218 static void anqp_add_network_auth_type(struct hostapd_data *hapd,
219 struct wpabuf *buf)
220 {
221 if (hapd->conf->network_auth_type) {
222 wpabuf_put_le16(buf, ANQP_NETWORK_AUTH_TYPE);
223 wpabuf_put_le16(buf, hapd->conf->network_auth_type_len);
224 wpabuf_put_data(buf, hapd->conf->network_auth_type,
225 hapd->conf->network_auth_type_len);
226 }
227 }
228
229
anqp_add_roaming_consortium(struct hostapd_data * hapd,struct wpabuf * buf)230 static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
231 struct wpabuf *buf)
232 {
233 unsigned int i;
234 u8 *len;
235
236 len = gas_anqp_add_element(buf, ANQP_ROAMING_CONSORTIUM);
237 for (i = 0; i < hapd->conf->roaming_consortium_count; i++) {
238 struct hostapd_roaming_consortium *rc;
239 rc = &hapd->conf->roaming_consortium[i];
240 wpabuf_put_u8(buf, rc->len);
241 wpabuf_put_data(buf, rc->oi, rc->len);
242 }
243 gas_anqp_set_element_len(buf, len);
244 }
245
246
anqp_add_ip_addr_type_availability(struct hostapd_data * hapd,struct wpabuf * buf)247 static void anqp_add_ip_addr_type_availability(struct hostapd_data *hapd,
248 struct wpabuf *buf)
249 {
250 if (hapd->conf->ipaddr_type_configured) {
251 wpabuf_put_le16(buf, ANQP_IP_ADDR_TYPE_AVAILABILITY);
252 wpabuf_put_le16(buf, 1);
253 wpabuf_put_u8(buf, hapd->conf->ipaddr_type_availability);
254 }
255 }
256
257
anqp_add_nai_realm_eap(struct wpabuf * buf,struct hostapd_nai_realm_data * realm)258 static void anqp_add_nai_realm_eap(struct wpabuf *buf,
259 struct hostapd_nai_realm_data *realm)
260 {
261 unsigned int i, j;
262
263 wpabuf_put_u8(buf, realm->eap_method_count);
264
265 for (i = 0; i < realm->eap_method_count; i++) {
266 struct hostapd_nai_realm_eap *eap = &realm->eap_method[i];
267 wpabuf_put_u8(buf, 2 + (3 * eap->num_auths));
268 wpabuf_put_u8(buf, eap->eap_method);
269 wpabuf_put_u8(buf, eap->num_auths);
270 for (j = 0; j < eap->num_auths; j++) {
271 wpabuf_put_u8(buf, eap->auth_id[j]);
272 wpabuf_put_u8(buf, 1);
273 wpabuf_put_u8(buf, eap->auth_val[j]);
274 }
275 }
276 }
277
278
anqp_add_nai_realm_data(struct wpabuf * buf,struct hostapd_nai_realm_data * realm,unsigned int realm_idx)279 static void anqp_add_nai_realm_data(struct wpabuf *buf,
280 struct hostapd_nai_realm_data *realm,
281 unsigned int realm_idx)
282 {
283 u8 *realm_data_len;
284
285 wpa_printf(MSG_DEBUG, "realm=%s, len=%d", realm->realm[realm_idx],
286 (int) os_strlen(realm->realm[realm_idx]));
287 realm_data_len = wpabuf_put(buf, 2);
288 wpabuf_put_u8(buf, realm->encoding);
289 wpabuf_put_u8(buf, os_strlen(realm->realm[realm_idx]));
290 wpabuf_put_str(buf, realm->realm[realm_idx]);
291 anqp_add_nai_realm_eap(buf, realm);
292 gas_anqp_set_element_len(buf, realm_data_len);
293 }
294
295
hs20_add_nai_home_realm_matches(struct hostapd_data * hapd,struct wpabuf * buf,const u8 * home_realm,size_t home_realm_len)296 static int hs20_add_nai_home_realm_matches(struct hostapd_data *hapd,
297 struct wpabuf *buf,
298 const u8 *home_realm,
299 size_t home_realm_len)
300 {
301 unsigned int i, j, k;
302 u8 num_realms, num_matching = 0, encoding, realm_len, *realm_list_len;
303 struct hostapd_nai_realm_data *realm;
304 const u8 *pos, *realm_name, *end;
305 struct {
306 unsigned int realm_data_idx;
307 unsigned int realm_idx;
308 } matches[10];
309
310 pos = home_realm;
311 end = pos + home_realm_len;
312 if (pos + 1 > end) {
313 wpa_hexdump(MSG_DEBUG, "Too short NAI Home Realm Query",
314 home_realm, home_realm_len);
315 return -1;
316 }
317 num_realms = *pos++;
318
319 for (i = 0; i < num_realms && num_matching < 10; i++) {
320 if (pos + 2 > end) {
321 wpa_hexdump(MSG_DEBUG,
322 "Truncated NAI Home Realm Query",
323 home_realm, home_realm_len);
324 return -1;
325 }
326 encoding = *pos++;
327 realm_len = *pos++;
328 if (pos + realm_len > end) {
329 wpa_hexdump(MSG_DEBUG,
330 "Truncated NAI Home Realm Query",
331 home_realm, home_realm_len);
332 return -1;
333 }
334 realm_name = pos;
335 for (j = 0; j < hapd->conf->nai_realm_count &&
336 num_matching < 10; j++) {
337 const u8 *rpos, *rend;
338 realm = &hapd->conf->nai_realm_data[j];
339 if (encoding != realm->encoding)
340 continue;
341
342 rpos = realm_name;
343 while (rpos < realm_name + realm_len &&
344 num_matching < 10) {
345 for (rend = rpos;
346 rend < realm_name + realm_len; rend++) {
347 if (*rend == ';')
348 break;
349 }
350 for (k = 0; k < MAX_NAI_REALMS &&
351 realm->realm[k] &&
352 num_matching < 10; k++) {
353 if ((int) os_strlen(realm->realm[k]) !=
354 rend - rpos ||
355 os_strncmp((char *) rpos,
356 realm->realm[k],
357 rend - rpos) != 0)
358 continue;
359 matches[num_matching].realm_data_idx =
360 j;
361 matches[num_matching].realm_idx = k;
362 num_matching++;
363 }
364 rpos = rend + 1;
365 }
366 }
367 pos += realm_len;
368 }
369
370 realm_list_len = gas_anqp_add_element(buf, ANQP_NAI_REALM);
371 wpabuf_put_le16(buf, num_matching);
372
373 /*
374 * There are two ways to format. 1. each realm in a NAI Realm Data unit
375 * 2. all realms that share the same EAP methods in a NAI Realm Data
376 * unit. The first format is likely to be bigger in size than the
377 * second, but may be easier to parse and process by the receiver.
378 */
379 for (i = 0; i < num_matching; i++) {
380 wpa_printf(MSG_DEBUG, "realm_idx %d, realm_data_idx %d",
381 matches[i].realm_data_idx, matches[i].realm_idx);
382 realm = &hapd->conf->nai_realm_data[matches[i].realm_data_idx];
383 anqp_add_nai_realm_data(buf, realm, matches[i].realm_idx);
384 }
385 gas_anqp_set_element_len(buf, realm_list_len);
386 return 0;
387 }
388
389
anqp_add_nai_realm(struct hostapd_data * hapd,struct wpabuf * buf,const u8 * home_realm,size_t home_realm_len,int nai_realm,int nai_home_realm)390 static void anqp_add_nai_realm(struct hostapd_data *hapd, struct wpabuf *buf,
391 const u8 *home_realm, size_t home_realm_len,
392 int nai_realm, int nai_home_realm)
393 {
394 if (nai_realm && hapd->conf->nai_realm_data) {
395 u8 *len;
396 unsigned int i, j;
397 len = gas_anqp_add_element(buf, ANQP_NAI_REALM);
398 wpabuf_put_le16(buf, hapd->conf->nai_realm_count);
399 for (i = 0; i < hapd->conf->nai_realm_count; i++) {
400 u8 *realm_data_len, *realm_len;
401 struct hostapd_nai_realm_data *realm;
402
403 realm = &hapd->conf->nai_realm_data[i];
404 realm_data_len = wpabuf_put(buf, 2);
405 wpabuf_put_u8(buf, realm->encoding);
406 realm_len = wpabuf_put(buf, 1);
407 for (j = 0; realm->realm[j]; j++) {
408 if (j > 0)
409 wpabuf_put_u8(buf, ';');
410 wpabuf_put_str(buf, realm->realm[j]);
411 }
412 *realm_len = (u8 *) wpabuf_put(buf, 0) - realm_len - 1;
413 anqp_add_nai_realm_eap(buf, realm);
414 gas_anqp_set_element_len(buf, realm_data_len);
415 }
416 gas_anqp_set_element_len(buf, len);
417 } else if (nai_home_realm && hapd->conf->nai_realm_data && home_realm) {
418 hs20_add_nai_home_realm_matches(hapd, buf, home_realm,
419 home_realm_len);
420 }
421 }
422
423
anqp_add_3gpp_cellular_network(struct hostapd_data * hapd,struct wpabuf * buf)424 static void anqp_add_3gpp_cellular_network(struct hostapd_data *hapd,
425 struct wpabuf *buf)
426 {
427 if (hapd->conf->anqp_3gpp_cell_net) {
428 wpabuf_put_le16(buf, ANQP_3GPP_CELLULAR_NETWORK);
429 wpabuf_put_le16(buf,
430 hapd->conf->anqp_3gpp_cell_net_len);
431 wpabuf_put_data(buf, hapd->conf->anqp_3gpp_cell_net,
432 hapd->conf->anqp_3gpp_cell_net_len);
433 }
434 }
435
436
anqp_add_domain_name(struct hostapd_data * hapd,struct wpabuf * buf)437 static void anqp_add_domain_name(struct hostapd_data *hapd, struct wpabuf *buf)
438 {
439 if (hapd->conf->domain_name) {
440 wpabuf_put_le16(buf, ANQP_DOMAIN_NAME);
441 wpabuf_put_le16(buf, hapd->conf->domain_name_len);
442 wpabuf_put_data(buf, hapd->conf->domain_name,
443 hapd->conf->domain_name_len);
444 }
445 }
446
447
448 #ifdef CONFIG_HS20
449
anqp_add_operator_friendly_name(struct hostapd_data * hapd,struct wpabuf * buf)450 static void anqp_add_operator_friendly_name(struct hostapd_data *hapd,
451 struct wpabuf *buf)
452 {
453 if (hapd->conf->hs20_oper_friendly_name) {
454 u8 *len;
455 unsigned int i;
456 len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
457 wpabuf_put_be24(buf, OUI_WFA);
458 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
459 wpabuf_put_u8(buf, HS20_STYPE_OPERATOR_FRIENDLY_NAME);
460 wpabuf_put_u8(buf, 0); /* Reserved */
461 for (i = 0; i < hapd->conf->hs20_oper_friendly_name_count; i++)
462 {
463 struct hostapd_lang_string *vn;
464 vn = &hapd->conf->hs20_oper_friendly_name[i];
465 wpabuf_put_u8(buf, 3 + vn->name_len);
466 wpabuf_put_data(buf, vn->lang, 3);
467 wpabuf_put_data(buf, vn->name, vn->name_len);
468 }
469 gas_anqp_set_element_len(buf, len);
470 }
471 }
472
473
anqp_add_wan_metrics(struct hostapd_data * hapd,struct wpabuf * buf)474 static void anqp_add_wan_metrics(struct hostapd_data *hapd,
475 struct wpabuf *buf)
476 {
477 if (hapd->conf->hs20_wan_metrics) {
478 u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
479 wpabuf_put_be24(buf, OUI_WFA);
480 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
481 wpabuf_put_u8(buf, HS20_STYPE_WAN_METRICS);
482 wpabuf_put_u8(buf, 0); /* Reserved */
483 wpabuf_put_data(buf, hapd->conf->hs20_wan_metrics, 13);
484 gas_anqp_set_element_len(buf, len);
485 }
486 }
487
488
anqp_add_connection_capability(struct hostapd_data * hapd,struct wpabuf * buf)489 static void anqp_add_connection_capability(struct hostapd_data *hapd,
490 struct wpabuf *buf)
491 {
492 if (hapd->conf->hs20_connection_capability) {
493 u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
494 wpabuf_put_be24(buf, OUI_WFA);
495 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
496 wpabuf_put_u8(buf, HS20_STYPE_CONNECTION_CAPABILITY);
497 wpabuf_put_u8(buf, 0); /* Reserved */
498 wpabuf_put_data(buf, hapd->conf->hs20_connection_capability,
499 hapd->conf->hs20_connection_capability_len);
500 gas_anqp_set_element_len(buf, len);
501 }
502 }
503
504
anqp_add_operating_class(struct hostapd_data * hapd,struct wpabuf * buf)505 static void anqp_add_operating_class(struct hostapd_data *hapd,
506 struct wpabuf *buf)
507 {
508 if (hapd->conf->hs20_operating_class) {
509 u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
510 wpabuf_put_be24(buf, OUI_WFA);
511 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
512 wpabuf_put_u8(buf, HS20_STYPE_OPERATING_CLASS);
513 wpabuf_put_u8(buf, 0); /* Reserved */
514 wpabuf_put_data(buf, hapd->conf->hs20_operating_class,
515 hapd->conf->hs20_operating_class_len);
516 gas_anqp_set_element_len(buf, len);
517 }
518 }
519
520
anqp_add_osu_provider(struct wpabuf * buf,struct hostapd_bss_config * bss,struct hs20_osu_provider * p)521 static void anqp_add_osu_provider(struct wpabuf *buf,
522 struct hostapd_bss_config *bss,
523 struct hs20_osu_provider *p)
524 {
525 u8 *len, *len2, *count;
526 unsigned int i;
527
528 len = wpabuf_put(buf, 2); /* OSU Provider Length to be filled */
529
530 /* OSU Friendly Name Duples */
531 len2 = wpabuf_put(buf, 2);
532 for (i = 0; i < p->friendly_name_count; i++) {
533 struct hostapd_lang_string *s = &p->friendly_name[i];
534 wpabuf_put_u8(buf, 3 + s->name_len);
535 wpabuf_put_data(buf, s->lang, 3);
536 wpabuf_put_data(buf, s->name, s->name_len);
537 }
538 WPA_PUT_LE16(len2, (u8 *) wpabuf_put(buf, 0) - len2 - 2);
539
540 /* OSU Server URI */
541 if (p->server_uri) {
542 wpabuf_put_u8(buf, os_strlen(p->server_uri));
543 wpabuf_put_str(buf, p->server_uri);
544 } else
545 wpabuf_put_u8(buf, 0);
546
547 /* OSU Method List */
548 count = wpabuf_put(buf, 1);
549 for (i = 0; p->method_list[i] >= 0; i++)
550 wpabuf_put_u8(buf, p->method_list[i]);
551 *count = i;
552
553 /* Icons Available */
554 len2 = wpabuf_put(buf, 2);
555 for (i = 0; i < p->icons_count; i++) {
556 size_t j;
557 struct hs20_icon *icon = NULL;
558
559 for (j = 0; j < bss->hs20_icons_count && !icon; j++) {
560 if (os_strcmp(p->icons[i], bss->hs20_icons[j].name) ==
561 0)
562 icon = &bss->hs20_icons[j];
563 }
564 if (!icon)
565 continue; /* icon info not found */
566
567 wpabuf_put_le16(buf, icon->width);
568 wpabuf_put_le16(buf, icon->height);
569 wpabuf_put_data(buf, icon->language, 3);
570 wpabuf_put_u8(buf, os_strlen(icon->type));
571 wpabuf_put_str(buf, icon->type);
572 wpabuf_put_u8(buf, os_strlen(icon->name));
573 wpabuf_put_str(buf, icon->name);
574 }
575 WPA_PUT_LE16(len2, (u8 *) wpabuf_put(buf, 0) - len2 - 2);
576
577 /* OSU_NAI */
578 if (p->osu_nai) {
579 wpabuf_put_u8(buf, os_strlen(p->osu_nai));
580 wpabuf_put_str(buf, p->osu_nai);
581 } else
582 wpabuf_put_u8(buf, 0);
583
584 /* OSU Service Description Duples */
585 len2 = wpabuf_put(buf, 2);
586 for (i = 0; i < p->service_desc_count; i++) {
587 struct hostapd_lang_string *s = &p->service_desc[i];
588 wpabuf_put_u8(buf, 3 + s->name_len);
589 wpabuf_put_data(buf, s->lang, 3);
590 wpabuf_put_data(buf, s->name, s->name_len);
591 }
592 WPA_PUT_LE16(len2, (u8 *) wpabuf_put(buf, 0) - len2 - 2);
593
594 WPA_PUT_LE16(len, (u8 *) wpabuf_put(buf, 0) - len - 2);
595 }
596
597
anqp_add_osu_providers_list(struct hostapd_data * hapd,struct wpabuf * buf)598 static void anqp_add_osu_providers_list(struct hostapd_data *hapd,
599 struct wpabuf *buf)
600 {
601 if (hapd->conf->hs20_osu_providers_count) {
602 size_t i;
603 u8 *len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
604 wpabuf_put_be24(buf, OUI_WFA);
605 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
606 wpabuf_put_u8(buf, HS20_STYPE_OSU_PROVIDERS_LIST);
607 wpabuf_put_u8(buf, 0); /* Reserved */
608
609 /* OSU SSID */
610 wpabuf_put_u8(buf, hapd->conf->osu_ssid_len);
611 wpabuf_put_data(buf, hapd->conf->osu_ssid,
612 hapd->conf->osu_ssid_len);
613
614 /* Number of OSU Providers */
615 wpabuf_put_u8(buf, hapd->conf->hs20_osu_providers_count);
616
617 for (i = 0; i < hapd->conf->hs20_osu_providers_count; i++) {
618 anqp_add_osu_provider(
619 buf, hapd->conf,
620 &hapd->conf->hs20_osu_providers[i]);
621 }
622
623 gas_anqp_set_element_len(buf, len);
624 }
625 }
626
627
anqp_add_icon_binary_file(struct hostapd_data * hapd,struct wpabuf * buf,const u8 * name,size_t name_len)628 static void anqp_add_icon_binary_file(struct hostapd_data *hapd,
629 struct wpabuf *buf,
630 const u8 *name, size_t name_len)
631 {
632 struct hs20_icon *icon;
633 size_t i;
634 u8 *len;
635
636 wpa_hexdump_ascii(MSG_DEBUG, "HS 2.0: Requested Icon Filename",
637 name, name_len);
638 for (i = 0; i < hapd->conf->hs20_icons_count; i++) {
639 icon = &hapd->conf->hs20_icons[i];
640 if (name_len == os_strlen(icon->name) &&
641 os_memcmp(name, icon->name, name_len) == 0)
642 break;
643 }
644
645 if (i < hapd->conf->hs20_icons_count)
646 icon = &hapd->conf->hs20_icons[i];
647 else
648 icon = NULL;
649
650 len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
651 wpabuf_put_be24(buf, OUI_WFA);
652 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
653 wpabuf_put_u8(buf, HS20_STYPE_ICON_BINARY_FILE);
654 wpabuf_put_u8(buf, 0); /* Reserved */
655
656 if (icon) {
657 char *data;
658 size_t data_len;
659
660 data = os_readfile(icon->file, &data_len);
661 if (data == NULL || data_len > 65535) {
662 wpabuf_put_u8(buf, 2); /* Download Status:
663 * Unspecified file error */
664 wpabuf_put_u8(buf, 0);
665 wpabuf_put_le16(buf, 0);
666 } else {
667 wpabuf_put_u8(buf, 0); /* Download Status: Success */
668 wpabuf_put_u8(buf, os_strlen(icon->type));
669 wpabuf_put_str(buf, icon->type);
670 wpabuf_put_le16(buf, data_len);
671 wpabuf_put_data(buf, data, data_len);
672 }
673 os_free(data);
674 } else {
675 wpabuf_put_u8(buf, 1); /* Download Status: File not found */
676 wpabuf_put_u8(buf, 0);
677 wpabuf_put_le16(buf, 0);
678 }
679
680 gas_anqp_set_element_len(buf, len);
681 }
682
683 #endif /* CONFIG_HS20 */
684
685
686 static struct wpabuf *
gas_serv_build_gas_resp_payload(struct hostapd_data * hapd,unsigned int request,const u8 * home_realm,size_t home_realm_len,const u8 * icon_name,size_t icon_name_len)687 gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
688 unsigned int request,
689 const u8 *home_realm, size_t home_realm_len,
690 const u8 *icon_name, size_t icon_name_len)
691 {
692 struct wpabuf *buf;
693 size_t len;
694
695 len = 1400;
696 if (request & (ANQP_REQ_NAI_REALM | ANQP_REQ_NAI_HOME_REALM))
697 len += 1000;
698 if (request & ANQP_REQ_ICON_REQUEST)
699 len += 65536;
700
701 buf = wpabuf_alloc(len);
702 if (buf == NULL)
703 return NULL;
704
705 if (request & ANQP_REQ_CAPABILITY_LIST)
706 anqp_add_capab_list(hapd, buf);
707 if (request & ANQP_REQ_VENUE_NAME)
708 anqp_add_venue_name(hapd, buf);
709 if (request & ANQP_REQ_NETWORK_AUTH_TYPE)
710 anqp_add_network_auth_type(hapd, buf);
711 if (request & ANQP_REQ_ROAMING_CONSORTIUM)
712 anqp_add_roaming_consortium(hapd, buf);
713 if (request & ANQP_REQ_IP_ADDR_TYPE_AVAILABILITY)
714 anqp_add_ip_addr_type_availability(hapd, buf);
715 if (request & (ANQP_REQ_NAI_REALM | ANQP_REQ_NAI_HOME_REALM))
716 anqp_add_nai_realm(hapd, buf, home_realm, home_realm_len,
717 request & ANQP_REQ_NAI_REALM,
718 request & ANQP_REQ_NAI_HOME_REALM);
719 if (request & ANQP_REQ_3GPP_CELLULAR_NETWORK)
720 anqp_add_3gpp_cellular_network(hapd, buf);
721 if (request & ANQP_REQ_DOMAIN_NAME)
722 anqp_add_domain_name(hapd, buf);
723
724 #ifdef CONFIG_HS20
725 if (request & ANQP_REQ_HS_CAPABILITY_LIST)
726 anqp_add_hs_capab_list(hapd, buf);
727 if (request & ANQP_REQ_OPERATOR_FRIENDLY_NAME)
728 anqp_add_operator_friendly_name(hapd, buf);
729 if (request & ANQP_REQ_WAN_METRICS)
730 anqp_add_wan_metrics(hapd, buf);
731 if (request & ANQP_REQ_CONNECTION_CAPABILITY)
732 anqp_add_connection_capability(hapd, buf);
733 if (request & ANQP_REQ_OPERATING_CLASS)
734 anqp_add_operating_class(hapd, buf);
735 if (request & ANQP_REQ_OSU_PROVIDERS_LIST)
736 anqp_add_osu_providers_list(hapd, buf);
737 if (request & ANQP_REQ_ICON_REQUEST)
738 anqp_add_icon_binary_file(hapd, buf, icon_name, icon_name_len);
739 #endif /* CONFIG_HS20 */
740
741 return buf;
742 }
743
744
745 struct anqp_query_info {
746 unsigned int request;
747 const u8 *home_realm_query;
748 size_t home_realm_query_len;
749 const u8 *icon_name;
750 size_t icon_name_len;
751 int p2p_sd;
752 };
753
754
set_anqp_req(unsigned int bit,const char * name,int local,struct anqp_query_info * qi)755 static void set_anqp_req(unsigned int bit, const char *name, int local,
756 struct anqp_query_info *qi)
757 {
758 qi->request |= bit;
759 if (local) {
760 wpa_printf(MSG_DEBUG, "ANQP: %s (local)", name);
761 } else {
762 wpa_printf(MSG_DEBUG, "ANQP: %s not available", name);
763 }
764 }
765
766
rx_anqp_query_list_id(struct hostapd_data * hapd,u16 info_id,struct anqp_query_info * qi)767 static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
768 struct anqp_query_info *qi)
769 {
770 switch (info_id) {
771 case ANQP_CAPABILITY_LIST:
772 set_anqp_req(ANQP_REQ_CAPABILITY_LIST, "Capability List", 1,
773 qi);
774 break;
775 case ANQP_VENUE_NAME:
776 set_anqp_req(ANQP_REQ_VENUE_NAME, "Venue Name",
777 hapd->conf->venue_name != NULL, qi);
778 break;
779 case ANQP_NETWORK_AUTH_TYPE:
780 set_anqp_req(ANQP_REQ_NETWORK_AUTH_TYPE, "Network Auth Type",
781 hapd->conf->network_auth_type != NULL, qi);
782 break;
783 case ANQP_ROAMING_CONSORTIUM:
784 set_anqp_req(ANQP_REQ_ROAMING_CONSORTIUM, "Roaming Consortium",
785 hapd->conf->roaming_consortium != NULL, qi);
786 break;
787 case ANQP_IP_ADDR_TYPE_AVAILABILITY:
788 set_anqp_req(ANQP_REQ_IP_ADDR_TYPE_AVAILABILITY,
789 "IP Addr Type Availability",
790 hapd->conf->ipaddr_type_configured, qi);
791 break;
792 case ANQP_NAI_REALM:
793 set_anqp_req(ANQP_REQ_NAI_REALM, "NAI Realm",
794 hapd->conf->nai_realm_data != NULL, qi);
795 break;
796 case ANQP_3GPP_CELLULAR_NETWORK:
797 set_anqp_req(ANQP_REQ_3GPP_CELLULAR_NETWORK,
798 "3GPP Cellular Network",
799 hapd->conf->anqp_3gpp_cell_net != NULL, qi);
800 break;
801 case ANQP_DOMAIN_NAME:
802 set_anqp_req(ANQP_REQ_DOMAIN_NAME, "Domain Name",
803 hapd->conf->domain_name != NULL, qi);
804 break;
805 default:
806 wpa_printf(MSG_DEBUG, "ANQP: Unsupported Info Id %u",
807 info_id);
808 break;
809 }
810 }
811
812
rx_anqp_query_list(struct hostapd_data * hapd,const u8 * pos,const u8 * end,struct anqp_query_info * qi)813 static void rx_anqp_query_list(struct hostapd_data *hapd,
814 const u8 *pos, const u8 *end,
815 struct anqp_query_info *qi)
816 {
817 wpa_printf(MSG_DEBUG, "ANQP: %u Info IDs requested in Query list",
818 (unsigned int) (end - pos) / 2);
819
820 while (pos + 2 <= end) {
821 rx_anqp_query_list_id(hapd, WPA_GET_LE16(pos), qi);
822 pos += 2;
823 }
824 }
825
826
827 #ifdef CONFIG_HS20
828
rx_anqp_hs_query_list(struct hostapd_data * hapd,u8 subtype,struct anqp_query_info * qi)829 static void rx_anqp_hs_query_list(struct hostapd_data *hapd, u8 subtype,
830 struct anqp_query_info *qi)
831 {
832 switch (subtype) {
833 case HS20_STYPE_CAPABILITY_LIST:
834 set_anqp_req(ANQP_REQ_HS_CAPABILITY_LIST, "HS Capability List",
835 1, qi);
836 break;
837 case HS20_STYPE_OPERATOR_FRIENDLY_NAME:
838 set_anqp_req(ANQP_REQ_OPERATOR_FRIENDLY_NAME,
839 "Operator Friendly Name",
840 hapd->conf->hs20_oper_friendly_name != NULL, qi);
841 break;
842 case HS20_STYPE_WAN_METRICS:
843 set_anqp_req(ANQP_REQ_WAN_METRICS, "WAN Metrics",
844 hapd->conf->hs20_wan_metrics != NULL, qi);
845 break;
846 case HS20_STYPE_CONNECTION_CAPABILITY:
847 set_anqp_req(ANQP_REQ_CONNECTION_CAPABILITY,
848 "Connection Capability",
849 hapd->conf->hs20_connection_capability != NULL,
850 qi);
851 break;
852 case HS20_STYPE_OPERATING_CLASS:
853 set_anqp_req(ANQP_REQ_OPERATING_CLASS, "Operating Class",
854 hapd->conf->hs20_operating_class != NULL, qi);
855 break;
856 case HS20_STYPE_OSU_PROVIDERS_LIST:
857 set_anqp_req(ANQP_REQ_OSU_PROVIDERS_LIST, "OSU Providers list",
858 hapd->conf->hs20_osu_providers_count, qi);
859 break;
860 default:
861 wpa_printf(MSG_DEBUG, "ANQP: Unsupported HS 2.0 subtype %u",
862 subtype);
863 break;
864 }
865 }
866
867
rx_anqp_hs_nai_home_realm(struct hostapd_data * hapd,const u8 * pos,const u8 * end,struct anqp_query_info * qi)868 static void rx_anqp_hs_nai_home_realm(struct hostapd_data *hapd,
869 const u8 *pos, const u8 *end,
870 struct anqp_query_info *qi)
871 {
872 qi->request |= ANQP_REQ_NAI_HOME_REALM;
873 qi->home_realm_query = pos;
874 qi->home_realm_query_len = end - pos;
875 if (hapd->conf->nai_realm_data != NULL) {
876 wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 NAI Home Realm Query "
877 "(local)");
878 } else {
879 wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 NAI Home Realm Query not "
880 "available");
881 }
882 }
883
884
rx_anqp_hs_icon_request(struct hostapd_data * hapd,const u8 * pos,const u8 * end,struct anqp_query_info * qi)885 static void rx_anqp_hs_icon_request(struct hostapd_data *hapd,
886 const u8 *pos, const u8 *end,
887 struct anqp_query_info *qi)
888 {
889 qi->request |= ANQP_REQ_ICON_REQUEST;
890 qi->icon_name = pos;
891 qi->icon_name_len = end - pos;
892 if (hapd->conf->hs20_icons_count) {
893 wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 Icon Request Query "
894 "(local)");
895 } else {
896 wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 Icon Request Query not "
897 "available");
898 }
899 }
900
901
rx_anqp_vendor_specific(struct hostapd_data * hapd,const u8 * pos,const u8 * end,struct anqp_query_info * qi)902 static void rx_anqp_vendor_specific(struct hostapd_data *hapd,
903 const u8 *pos, const u8 *end,
904 struct anqp_query_info *qi)
905 {
906 u32 oui;
907 u8 subtype;
908
909 if (pos + 4 > end) {
910 wpa_printf(MSG_DEBUG, "ANQP: Too short vendor specific ANQP "
911 "Query element");
912 return;
913 }
914
915 oui = WPA_GET_BE24(pos);
916 pos += 3;
917 if (oui != OUI_WFA) {
918 wpa_printf(MSG_DEBUG, "ANQP: Unsupported vendor OUI %06x",
919 oui);
920 return;
921 }
922
923 #ifdef CONFIG_P2P
924 if (*pos == P2P_OUI_TYPE) {
925 /*
926 * This is for P2P SD and will be taken care of by the P2P
927 * implementation. This query needs to be ignored in the generic
928 * GAS server to avoid duplicated response.
929 */
930 wpa_printf(MSG_DEBUG,
931 "ANQP: Ignore WFA vendor type %u (P2P SD) in generic GAS server",
932 *pos);
933 qi->p2p_sd = 1;
934 return;
935 }
936 #endif /* CONFIG_P2P */
937
938 if (*pos != HS20_ANQP_OUI_TYPE) {
939 wpa_printf(MSG_DEBUG, "ANQP: Unsupported WFA vendor type %u",
940 *pos);
941 return;
942 }
943 pos++;
944
945 if (pos + 1 >= end)
946 return;
947
948 subtype = *pos++;
949 pos++; /* Reserved */
950 switch (subtype) {
951 case HS20_STYPE_QUERY_LIST:
952 wpa_printf(MSG_DEBUG, "ANQP: HS 2.0 Query List");
953 while (pos < end) {
954 rx_anqp_hs_query_list(hapd, *pos, qi);
955 pos++;
956 }
957 break;
958 case HS20_STYPE_NAI_HOME_REALM_QUERY:
959 rx_anqp_hs_nai_home_realm(hapd, pos, end, qi);
960 break;
961 case HS20_STYPE_ICON_REQUEST:
962 rx_anqp_hs_icon_request(hapd, pos, end, qi);
963 break;
964 default:
965 wpa_printf(MSG_DEBUG, "ANQP: Unsupported HS 2.0 query subtype "
966 "%u", subtype);
967 break;
968 }
969 }
970
971 #endif /* CONFIG_HS20 */
972
973
gas_serv_req_local_processing(struct hostapd_data * hapd,const u8 * sa,u8 dialog_token,struct anqp_query_info * qi,int prot)974 static void gas_serv_req_local_processing(struct hostapd_data *hapd,
975 const u8 *sa, u8 dialog_token,
976 struct anqp_query_info *qi, int prot)
977 {
978 struct wpabuf *buf, *tx_buf;
979
980 buf = gas_serv_build_gas_resp_payload(hapd, qi->request,
981 qi->home_realm_query,
982 qi->home_realm_query_len,
983 qi->icon_name, qi->icon_name_len);
984 wpa_hexdump_buf(MSG_MSGDUMP, "ANQP: Locally generated ANQP responses",
985 buf);
986 if (!buf)
987 return;
988 #ifdef CONFIG_P2P
989 if (wpabuf_len(buf) == 0 && qi->p2p_sd) {
990 wpa_printf(MSG_DEBUG,
991 "ANQP: Do not send response to P2P SD from generic GAS service (P2P SD implementation will process this)");
992 wpabuf_free(buf);
993 return;
994 }
995 #endif /* CONFIG_P2P */
996
997 if (wpabuf_len(buf) > hapd->gas_frag_limit ||
998 hapd->conf->gas_comeback_delay) {
999 struct gas_dialog_info *di;
1000 u16 comeback_delay = 1;
1001
1002 if (hapd->conf->gas_comeback_delay) {
1003 /* Testing - allow overriding of the delay value */
1004 comeback_delay = hapd->conf->gas_comeback_delay;
1005 }
1006
1007 wpa_printf(MSG_DEBUG, "ANQP: Too long response to fit in "
1008 "initial response - use GAS comeback");
1009 di = gas_dialog_create(hapd, sa, dialog_token);
1010 if (!di) {
1011 wpa_printf(MSG_INFO, "ANQP: Could not create dialog "
1012 "for " MACSTR " (dialog token %u)",
1013 MAC2STR(sa), dialog_token);
1014 wpabuf_free(buf);
1015 tx_buf = gas_anqp_build_initial_resp_buf(
1016 dialog_token, WLAN_STATUS_UNSPECIFIED_FAILURE,
1017 0, NULL);
1018 } else {
1019 di->prot = prot;
1020 di->sd_resp = buf;
1021 di->sd_resp_pos = 0;
1022 tx_buf = gas_anqp_build_initial_resp_buf(
1023 dialog_token, WLAN_STATUS_SUCCESS,
1024 comeback_delay, NULL);
1025 }
1026 } else {
1027 wpa_printf(MSG_DEBUG, "ANQP: Initial response (no comeback)");
1028 tx_buf = gas_anqp_build_initial_resp_buf(
1029 dialog_token, WLAN_STATUS_SUCCESS, 0, buf);
1030 wpabuf_free(buf);
1031 }
1032 if (!tx_buf)
1033 return;
1034 if (prot)
1035 convert_to_protected_dual(tx_buf);
1036 hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa,
1037 wpabuf_head(tx_buf), wpabuf_len(tx_buf));
1038 wpabuf_free(tx_buf);
1039 }
1040
1041
gas_serv_rx_gas_initial_req(struct hostapd_data * hapd,const u8 * sa,const u8 * data,size_t len,int prot)1042 static void gas_serv_rx_gas_initial_req(struct hostapd_data *hapd,
1043 const u8 *sa,
1044 const u8 *data, size_t len, int prot)
1045 {
1046 const u8 *pos = data;
1047 const u8 *end = data + len;
1048 const u8 *next;
1049 u8 dialog_token;
1050 u16 slen;
1051 struct anqp_query_info qi;
1052 const u8 *adv_proto;
1053
1054 if (len < 1 + 2)
1055 return;
1056
1057 os_memset(&qi, 0, sizeof(qi));
1058
1059 dialog_token = *pos++;
1060 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1061 "GAS: GAS Initial Request from " MACSTR " (dialog token %u) ",
1062 MAC2STR(sa), dialog_token);
1063
1064 if (*pos != WLAN_EID_ADV_PROTO) {
1065 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1066 "GAS: Unexpected IE in GAS Initial Request: %u", *pos);
1067 return;
1068 }
1069 adv_proto = pos++;
1070
1071 slen = *pos++;
1072 next = pos + slen;
1073 if (next > end || slen < 2) {
1074 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1075 "GAS: Invalid IE in GAS Initial Request");
1076 return;
1077 }
1078 pos++; /* skip QueryRespLenLimit and PAME-BI */
1079
1080 if (*pos != ACCESS_NETWORK_QUERY_PROTOCOL) {
1081 struct wpabuf *buf;
1082 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1083 "GAS: Unsupported GAS advertisement protocol id %u",
1084 *pos);
1085 if (sa[0] & 0x01)
1086 return; /* Invalid source address - drop silently */
1087 buf = gas_build_initial_resp(
1088 dialog_token, WLAN_STATUS_GAS_ADV_PROTO_NOT_SUPPORTED,
1089 0, 2 + slen + 2);
1090 if (buf == NULL)
1091 return;
1092 wpabuf_put_data(buf, adv_proto, 2 + slen);
1093 wpabuf_put_le16(buf, 0); /* Query Response Length */
1094 if (prot)
1095 convert_to_protected_dual(buf);
1096 hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa,
1097 wpabuf_head(buf), wpabuf_len(buf));
1098 wpabuf_free(buf);
1099 return;
1100 }
1101
1102 pos = next;
1103 /* Query Request */
1104 if (pos + 2 > end)
1105 return;
1106 slen = WPA_GET_LE16(pos);
1107 pos += 2;
1108 if (pos + slen > end)
1109 return;
1110 end = pos + slen;
1111
1112 /* ANQP Query Request */
1113 while (pos < end) {
1114 u16 info_id, elen;
1115
1116 if (pos + 4 > end)
1117 return;
1118
1119 info_id = WPA_GET_LE16(pos);
1120 pos += 2;
1121 elen = WPA_GET_LE16(pos);
1122 pos += 2;
1123
1124 if (pos + elen > end) {
1125 wpa_printf(MSG_DEBUG, "ANQP: Invalid Query Request");
1126 return;
1127 }
1128
1129 switch (info_id) {
1130 case ANQP_QUERY_LIST:
1131 rx_anqp_query_list(hapd, pos, pos + elen, &qi);
1132 break;
1133 #ifdef CONFIG_HS20
1134 case ANQP_VENDOR_SPECIFIC:
1135 rx_anqp_vendor_specific(hapd, pos, pos + elen, &qi);
1136 break;
1137 #endif /* CONFIG_HS20 */
1138 default:
1139 wpa_printf(MSG_DEBUG, "ANQP: Unsupported Query "
1140 "Request element %u", info_id);
1141 break;
1142 }
1143
1144 pos += elen;
1145 }
1146
1147 gas_serv_req_local_processing(hapd, sa, dialog_token, &qi, prot);
1148 }
1149
1150
gas_serv_rx_gas_comeback_req(struct hostapd_data * hapd,const u8 * sa,const u8 * data,size_t len,int prot)1151 static void gas_serv_rx_gas_comeback_req(struct hostapd_data *hapd,
1152 const u8 *sa,
1153 const u8 *data, size_t len, int prot)
1154 {
1155 struct gas_dialog_info *dialog;
1156 struct wpabuf *buf, *tx_buf;
1157 u8 dialog_token;
1158 size_t frag_len;
1159 int more = 0;
1160
1161 wpa_hexdump(MSG_DEBUG, "GAS: RX GAS Comeback Request", data, len);
1162 if (len < 1)
1163 return;
1164 dialog_token = *data;
1165 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Dialog Token: %u",
1166 dialog_token);
1167
1168 dialog = gas_serv_dialog_find(hapd, sa, dialog_token);
1169 if (!dialog) {
1170 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: No pending SD "
1171 "response fragment for " MACSTR " dialog token %u",
1172 MAC2STR(sa), dialog_token);
1173
1174 if (sa[0] & 0x01)
1175 return; /* Invalid source address - drop silently */
1176 tx_buf = gas_anqp_build_comeback_resp_buf(
1177 dialog_token, WLAN_STATUS_NO_OUTSTANDING_GAS_REQ, 0, 0,
1178 0, NULL);
1179 if (tx_buf == NULL)
1180 return;
1181 goto send_resp;
1182 }
1183
1184 frag_len = wpabuf_len(dialog->sd_resp) - dialog->sd_resp_pos;
1185 if (frag_len > hapd->gas_frag_limit) {
1186 frag_len = hapd->gas_frag_limit;
1187 more = 1;
1188 }
1189 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: resp frag_len %u",
1190 (unsigned int) frag_len);
1191 buf = wpabuf_alloc_copy(wpabuf_head_u8(dialog->sd_resp) +
1192 dialog->sd_resp_pos, frag_len);
1193 if (buf == NULL) {
1194 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Failed to allocate "
1195 "buffer");
1196 gas_serv_dialog_clear(dialog);
1197 return;
1198 }
1199 tx_buf = gas_anqp_build_comeback_resp_buf(dialog_token,
1200 WLAN_STATUS_SUCCESS,
1201 dialog->sd_frag_id,
1202 more, 0, buf);
1203 wpabuf_free(buf);
1204 if (tx_buf == NULL) {
1205 gas_serv_dialog_clear(dialog);
1206 return;
1207 }
1208 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: Tx GAS Comeback Response "
1209 "(frag_id %d more=%d frag_len=%d)",
1210 dialog->sd_frag_id, more, (int) frag_len);
1211 dialog->sd_frag_id++;
1212 dialog->sd_resp_pos += frag_len;
1213
1214 if (more) {
1215 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: %d more bytes remain "
1216 "to be sent",
1217 (int) (wpabuf_len(dialog->sd_resp) -
1218 dialog->sd_resp_pos));
1219 } else {
1220 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "GAS: All fragments of "
1221 "SD response sent");
1222 gas_serv_dialog_clear(dialog);
1223 gas_serv_free_dialogs(hapd, sa);
1224 }
1225
1226 send_resp:
1227 if (prot)
1228 convert_to_protected_dual(tx_buf);
1229 hostapd_drv_send_action(hapd, hapd->iface->freq, 0, sa,
1230 wpabuf_head(tx_buf), wpabuf_len(tx_buf));
1231 wpabuf_free(tx_buf);
1232 }
1233
1234
gas_serv_rx_public_action(void * ctx,const u8 * buf,size_t len,int freq)1235 static void gas_serv_rx_public_action(void *ctx, const u8 *buf, size_t len,
1236 int freq)
1237 {
1238 struct hostapd_data *hapd = ctx;
1239 const struct ieee80211_mgmt *mgmt;
1240 const u8 *sa, *data;
1241 int prot;
1242
1243 mgmt = (const struct ieee80211_mgmt *) buf;
1244 if (len < IEEE80211_HDRLEN + 2)
1245 return;
1246 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
1247 mgmt->u.action.category != WLAN_ACTION_PROTECTED_DUAL)
1248 return;
1249 /*
1250 * Note: Public Action and Protected Dual of Public Action frames share
1251 * the same payload structure, so it is fine to use definitions of
1252 * Public Action frames to process both.
1253 */
1254 prot = mgmt->u.action.category == WLAN_ACTION_PROTECTED_DUAL;
1255 sa = mgmt->sa;
1256 len -= IEEE80211_HDRLEN + 1;
1257 data = buf + IEEE80211_HDRLEN + 1;
1258 switch (data[0]) {
1259 case WLAN_PA_GAS_INITIAL_REQ:
1260 gas_serv_rx_gas_initial_req(hapd, sa, data + 1, len - 1, prot);
1261 break;
1262 case WLAN_PA_GAS_COMEBACK_REQ:
1263 gas_serv_rx_gas_comeback_req(hapd, sa, data + 1, len - 1, prot);
1264 break;
1265 }
1266 }
1267
1268
gas_serv_init(struct hostapd_data * hapd)1269 int gas_serv_init(struct hostapd_data *hapd)
1270 {
1271 hapd->public_action_cb2 = gas_serv_rx_public_action;
1272 hapd->public_action_cb2_ctx = hapd;
1273 hapd->gas_frag_limit = 1400;
1274 if (hapd->conf->gas_frag_limit > 0)
1275 hapd->gas_frag_limit = hapd->conf->gas_frag_limit;
1276 return 0;
1277 }
1278
1279
gas_serv_deinit(struct hostapd_data * hapd)1280 void gas_serv_deinit(struct hostapd_data *hapd)
1281 {
1282 }
1283