1 /*
2 * wpa_supplicant - SME
3 * Copyright (c) 2009-2024, Jouni Malinen <[email protected]>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/eloop.h"
13 #include "utils/ext_password.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/ieee802_11_common.h"
16 #include "common/ocv.h"
17 #include "eapol_supp/eapol_supp_sm.h"
18 #include "common/wpa_common.h"
19 #include "common/sae.h"
20 #include "common/dpp.h"
21 #include "rsn_supp/wpa.h"
22 #include "rsn_supp/pmksa_cache.h"
23 #include "config.h"
24 #include "wpa_supplicant_i.h"
25 #include "driver_i.h"
26 #include "wpas_glue.h"
27 #include "wps_supplicant.h"
28 #include "p2p_supplicant.h"
29 #include "notify.h"
30 #include "bss.h"
31 #include "bssid_ignore.h"
32 #include "scan.h"
33 #include "sme.h"
34 #include "hs20_supplicant.h"
35
36 #define SME_AUTH_TIMEOUT 5
37 #define SME_ASSOC_TIMEOUT 5
38
39 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
40 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
41 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
42 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
43
44
45 #ifdef CONFIG_SAE
46
index_within_array(const int * array,int idx)47 static int index_within_array(const int *array, int idx)
48 {
49 int i;
50 for (i = 0; i < idx; i++) {
51 if (array[i] <= 0)
52 return 0;
53 }
54 return 1;
55 }
56
57
sme_set_sae_group(struct wpa_supplicant * wpa_s,bool external)58 static int sme_set_sae_group(struct wpa_supplicant *wpa_s, bool external)
59 {
60 int *groups = wpa_s->conf->sae_groups;
61 int default_groups[] = { 19, 20, 21, 0 };
62
63 if (!groups || groups[0] <= 0)
64 groups = default_groups;
65
66 /* Configuration may have changed, so validate current index */
67 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
68 return -1;
69
70 for (;;) {
71 int group = groups[wpa_s->sme.sae_group_index];
72 if (group <= 0)
73 break;
74 if (!int_array_includes(wpa_s->sme.sae_rejected_groups,
75 group) &&
76 sae_set_group(&wpa_s->sme.sae, group) == 0) {
77 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
78 wpa_s->sme.sae.group);
79 wpa_s->sme.sae.akmp = external ?
80 wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
81 return 0;
82 }
83 wpa_s->sme.sae_group_index++;
84 }
85
86 return -1;
87 }
88
89
sme_auth_build_sae_commit(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,const u8 * bssid,const u8 * mld_addr,int external,int reuse,int * ret_use_pt,bool * ret_use_pk)90 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
91 struct wpa_ssid *ssid,
92 const u8 *bssid,
93 const u8 *mld_addr,
94 int external,
95 int reuse, int *ret_use_pt,
96 bool *ret_use_pk)
97 {
98 struct wpabuf *buf;
99 size_t len;
100 char *password = NULL;
101 struct wpa_bss *bss;
102 int use_pt = 0;
103 bool use_pk = false;
104 u8 rsnxe_capa = 0;
105 int key_mgmt = external ? wpa_s->sme.ext_auth_key_mgmt :
106 wpa_s->key_mgmt;
107 const u8 *addr = mld_addr ? mld_addr : bssid;
108
109 if (ret_use_pt)
110 *ret_use_pt = 0;
111 if (ret_use_pk)
112 *ret_use_pk = false;
113
114 #ifdef CONFIG_TESTING_OPTIONS
115 if (wpa_s->sae_commit_override) {
116 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
117 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
118 if (!buf)
119 goto fail;
120 if (!external) {
121 wpabuf_put_le16(buf, 1); /* Transaction seq# */
122 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
123 }
124 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
125 return buf;
126 }
127 #endif /* CONFIG_TESTING_OPTIONS */
128
129 if (ssid->sae_password) {
130 password = os_strdup(ssid->sae_password);
131 if (!password) {
132 wpa_dbg(wpa_s, MSG_INFO,
133 "SAE: Failed to allocate password");
134 goto fail;
135 }
136 }
137 if (!password && ssid->passphrase) {
138 password = os_strdup(ssid->passphrase);
139 if (!password) {
140 wpa_dbg(wpa_s, MSG_INFO,
141 "SAE: Failed to allocate password");
142 goto fail;
143 }
144 }
145 if (!password && ssid->ext_psk) {
146 struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
147 ssid->ext_psk);
148
149 if (!pw) {
150 wpa_msg(wpa_s, MSG_INFO,
151 "SAE: No password found from external storage");
152 goto fail;
153 }
154
155 password = os_malloc(wpabuf_len(pw) + 1);
156 if (!password) {
157 wpa_dbg(wpa_s, MSG_INFO,
158 "SAE: Failed to allocate password");
159 goto fail;
160 }
161 os_memcpy(password, wpabuf_head(pw), wpabuf_len(pw));
162 password[wpabuf_len(pw)] = '\0';
163 ext_password_free(pw);
164 }
165 if (!password) {
166 wpa_printf(MSG_DEBUG, "SAE: No password available");
167 goto fail;
168 }
169
170 if (reuse && wpa_s->sme.sae.tmp &&
171 ether_addr_equal(addr, wpa_s->sme.sae.tmp->bssid)) {
172 wpa_printf(MSG_DEBUG,
173 "SAE: Reuse previously generated PWE on a retry with the same AP");
174 use_pt = wpa_s->sme.sae.h2e;
175 use_pk = wpa_s->sme.sae.pk;
176 goto reuse_data;
177 }
178 if (sme_set_sae_group(wpa_s, external) < 0) {
179 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
180 goto fail;
181 }
182
183 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
184 if (!bss) {
185 wpa_printf(MSG_DEBUG,
186 "SAE: BSS not available, update scan result to get BSS");
187 wpa_supplicant_update_scan_results(wpa_s, bssid);
188 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
189 }
190 if (bss) {
191 const u8 *rsnxe;
192
193 rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
194 if (rsnxe && rsnxe[0] == WLAN_EID_VENDOR_SPECIFIC &&
195 rsnxe[1] >= 1 + 4)
196 rsnxe_capa = rsnxe[2 + 4];
197 else if (rsnxe && rsnxe[1] >= 1)
198 rsnxe_capa = rsnxe[2];
199 }
200
201 if (ssid->sae_password_id &&
202 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
203 use_pt = 1;
204 if (wpa_key_mgmt_sae_ext_key(key_mgmt) &&
205 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
206 use_pt = 1;
207 if (bss && is_6ghz_freq(bss->freq) &&
208 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
209 use_pt = 1;
210 #ifdef CONFIG_SAE_PK
211 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
212 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
213 ((ssid->sae_password &&
214 sae_pk_valid_password(ssid->sae_password)) ||
215 (!ssid->sae_password && ssid->passphrase &&
216 sae_pk_valid_password(ssid->passphrase)))) {
217 use_pt = 1;
218 use_pk = true;
219 }
220
221 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
222 wpa_printf(MSG_DEBUG,
223 "SAE: Cannot use PK with the selected AP");
224 goto fail;
225 }
226 #endif /* CONFIG_SAE_PK */
227
228 if (use_pt || wpa_s->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
229 wpa_s->conf->sae_pwe == SAE_PWE_BOTH) {
230 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
231
232 if ((wpa_s->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
233 ssid->sae_password_id ||
234 wpa_key_mgmt_sae_ext_key(key_mgmt)) &&
235 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK &&
236 !use_pt) {
237 wpa_printf(MSG_DEBUG,
238 "SAE: Cannot use H2E with the selected AP");
239 goto fail;
240 }
241 }
242
243 if (use_pt && !ssid->pt)
244 wpa_s_setup_sae_pt(wpa_s->conf, ssid, true);
245 if (use_pt &&
246 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
247 wpa_s->own_addr, addr,
248 wpa_s->sme.sae_rejected_groups, NULL) < 0)
249 goto fail;
250 if (!use_pt &&
251 sae_prepare_commit(wpa_s->own_addr, addr,
252 (u8 *) password, os_strlen(password),
253 &wpa_s->sme.sae) < 0) {
254 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
255 goto fail;
256 }
257 if (wpa_s->sme.sae.tmp) {
258 os_memcpy(wpa_s->sme.sae.tmp->bssid, addr, ETH_ALEN);
259 if (use_pt && use_pk)
260 wpa_s->sme.sae.pk = 1;
261 #ifdef CONFIG_SAE_PK
262 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
263 ETH_ALEN);
264 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, addr, ETH_ALEN);
265 sae_pk_set_password(&wpa_s->sme.sae, password);
266 #endif /* CONFIG_SAE_PK */
267 }
268
269 reuse_data:
270 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
271 if (ssid->sae_password_id)
272 len += 4 + os_strlen(ssid->sae_password_id);
273 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
274 if (buf == NULL)
275 goto fail;
276 if (!external) {
277 wpabuf_put_le16(buf, 1); /* Transaction seq# */
278 if (use_pk)
279 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
280 else if (use_pt)
281 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
282 else
283 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
284 }
285 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
286 ssid->sae_password_id) < 0) {
287 wpabuf_free(buf);
288 goto fail;
289 }
290 if (ret_use_pt)
291 *ret_use_pt = use_pt;
292 if (ret_use_pk)
293 *ret_use_pk = use_pk;
294
295 str_clear_free(password);
296 return buf;
297
298 fail:
299 str_clear_free(password);
300 return NULL;
301 }
302
303
sme_auth_build_sae_confirm(struct wpa_supplicant * wpa_s,int external)304 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
305 int external)
306 {
307 struct wpabuf *buf;
308
309 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
310 if (buf == NULL)
311 return NULL;
312
313 if (!external) {
314 wpabuf_put_le16(buf, 2); /* Transaction seq# */
315 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
316 }
317 sae_write_confirm(&wpa_s->sme.sae, buf);
318
319 return buf;
320 }
321
322 #endif /* CONFIG_SAE */
323
324
325 /**
326 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
327 * @wpa_s: Pointer to wpa_supplicant data
328 * @bss: Pointer to the bss which is the target of authentication attempt
329 */
sme_auth_handle_rrm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)330 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
331 struct wpa_bss *bss)
332 {
333 const u8 rrm_ie_len = 5;
334 u8 *pos;
335 const u8 *rrm_ie;
336
337 wpa_s->rrm.rrm_used = 0;
338
339 wpa_printf(MSG_DEBUG,
340 "RRM: Determining whether RRM can be used - device support: 0x%x",
341 wpa_s->drv_rrm_flags);
342
343 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
344 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
345 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
346 return;
347 }
348
349 if (!((wpa_s->drv_rrm_flags &
350 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
351 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
352 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
353 wpa_printf(MSG_DEBUG,
354 "RRM: Insufficient RRM support in driver - do not use RRM");
355 return;
356 }
357
358 if (sizeof(wpa_s->sme.assoc_req_ie) <
359 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
360 wpa_printf(MSG_INFO,
361 "RRM: Unable to use RRM, no room for RRM IE");
362 return;
363 }
364
365 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
366 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
367 os_memset(pos, 0, 2 + rrm_ie_len);
368 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
369 *pos++ = rrm_ie_len;
370
371 /* Set supported capabilities flags */
372 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
373 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
374
375 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
376 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
377 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
378
379 if (wpa_s->lci)
380 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
381
382 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
383 wpa_s->rrm.rrm_used = 1;
384 }
385
386
wpas_ml_handle_removed_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)387 static void wpas_ml_handle_removed_links(struct wpa_supplicant *wpa_s,
388 struct wpa_bss *bss)
389 {
390 u16 removed_links = wpa_bss_parse_reconf_ml_element(wpa_s, bss);
391
392 wpa_s->valid_links &= ~removed_links;
393 }
394
395
396 #ifdef CONFIG_TESTING_OPTIONS
wpas_ml_connect_pref(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)397 static struct wpa_bss * wpas_ml_connect_pref(struct wpa_supplicant *wpa_s,
398 struct wpa_bss *bss,
399 struct wpa_ssid *ssid)
400 {
401 unsigned int low, high, i;
402
403 wpa_printf(MSG_DEBUG,
404 "MLD: valid_links=%d, band_pref=%u, bssid_pref=" MACSTR,
405 wpa_s->valid_links,
406 wpa_s->conf->mld_connect_band_pref,
407 MAC2STR(wpa_s->conf->mld_connect_bssid_pref));
408
409 /* Check if there are more than one link */
410 if (!(wpa_s->valid_links & (wpa_s->valid_links - 1)))
411 return bss;
412
413 if (!is_zero_ether_addr(wpa_s->conf->mld_connect_bssid_pref)) {
414 for_each_link(wpa_s->valid_links, i) {
415 if (wpa_s->mlo_assoc_link_id == i)
416 continue;
417
418 if (ether_addr_equal(
419 wpa_s->links[i].bssid,
420 wpa_s->conf->mld_connect_bssid_pref))
421 goto found;
422 }
423 }
424
425 if (wpa_s->conf->mld_connect_band_pref == MLD_CONNECT_BAND_PREF_AUTO)
426 return bss;
427
428 switch (wpa_s->conf->mld_connect_band_pref) {
429 case MLD_CONNECT_BAND_PREF_2GHZ:
430 low = 2412;
431 high = 2472;
432 break;
433 case MLD_CONNECT_BAND_PREF_5GHZ:
434 low = 5180;
435 high = 5985;
436 break;
437 case MLD_CONNECT_BAND_PREF_6GHZ:
438 low = 5955;
439 high = 7125;
440 break;
441 default:
442 return bss;
443 }
444
445 for_each_link(wpa_s->valid_links, i) {
446 if (wpa_s->mlo_assoc_link_id == i)
447 continue;
448
449 if (wpa_s->links[i].freq >= low && wpa_s->links[i].freq <= high)
450 goto found;
451 }
452
453 found:
454 if (i == MAX_NUM_MLD_LINKS) {
455 wpa_printf(MSG_DEBUG, "MLD: No match for connect/band pref");
456 return bss;
457 }
458
459 wpa_printf(MSG_DEBUG,
460 "MLD: Change BSS for connect: " MACSTR " -> " MACSTR,
461 MAC2STR(wpa_s->links[wpa_s->mlo_assoc_link_id].bssid),
462 MAC2STR(wpa_s->links[i].bssid));
463
464 /* Get the BSS entry and do the switch */
465 if (ssid && ssid->ssid_len)
466 bss = wpa_bss_get(wpa_s, wpa_s->links[i].bssid, ssid->ssid,
467 ssid->ssid_len);
468 else
469 bss = wpa_bss_get_bssid(wpa_s, wpa_s->links[i].bssid);
470 wpa_s->mlo_assoc_link_id = i;
471
472 return bss;
473 }
474 #endif /* CONFIG_TESTING_OPTIONS */
475
476
wpas_sme_ml_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data,int ie_offset)477 static int wpas_sme_ml_auth(struct wpa_supplicant *wpa_s,
478 union wpa_event_data *data,
479 int ie_offset)
480 {
481 struct ieee802_11_elems elems;
482 const u8 *mld_addr;
483 u16 status_code = data->auth.status_code;
484
485 if (!wpa_s->valid_links)
486 return 0;
487
488 if (ieee802_11_parse_elems(data->auth.ies + ie_offset,
489 data->auth.ies_len - ie_offset,
490 &elems, 0) == ParseFailed) {
491 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
492 return -1;
493 }
494
495 if (!elems.basic_mle || !elems.basic_mle_len) {
496 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
497 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
498 status_code == WLAN_STATUS_SUCCESS ||
499 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
500 status_code == WLAN_STATUS_SAE_PK)
501 return -1;
502 /* Accept missing Multi-Link element in failed authentication
503 * cases. */
504 return 0;
505 }
506
507 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
508 if (!mld_addr)
509 return -1;
510
511 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
512
513 if (!ether_addr_equal(wpa_s->ap_mld_addr, mld_addr)) {
514 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
515 MACSTR ")", MAC2STR(wpa_s->ap_mld_addr));
516 return -1;
517 }
518
519 return 0;
520 }
521
522
wpas_sme_set_mlo_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)523 static void wpas_sme_set_mlo_links(struct wpa_supplicant *wpa_s,
524 struct wpa_bss *bss, struct wpa_ssid *ssid)
525 {
526 u8 i;
527
528 wpa_s->valid_links = 0;
529 wpa_s->mlo_assoc_link_id = bss->mld_link_id;
530
531 for_each_link(bss->valid_links, i) {
532 const u8 *bssid = bss->mld_links[i].bssid;
533
534 wpa_s->valid_links |= BIT(i);
535 os_memcpy(wpa_s->links[i].bssid, bssid, ETH_ALEN);
536 wpa_s->links[i].freq = bss->mld_links[i].freq;
537 wpa_s->links[i].disabled = bss->mld_links[i].disabled;
538
539 if (bss->mld_link_id == i)
540 wpa_s->links[i].bss = bss;
541 else if (ssid && ssid->ssid_len)
542 wpa_s->links[i].bss = wpa_bss_get(wpa_s, bssid,
543 ssid->ssid,
544 ssid->ssid_len);
545 else
546 wpa_s->links[i].bss = wpa_bss_get_bssid(wpa_s, bssid);
547 }
548 }
549
550
sme_send_authentication(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,int start)551 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
552 struct wpa_bss *bss, struct wpa_ssid *ssid,
553 int start)
554 {
555 struct wpa_driver_auth_params params;
556 struct wpa_ssid *old_ssid;
557 #ifdef CONFIG_IEEE80211R
558 const u8 *ie;
559 #endif /* CONFIG_IEEE80211R */
560 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
561 const u8 *md = NULL;
562 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
563 int bssid_changed;
564 struct wpabuf *resp = NULL;
565 u8 ext_capab[18];
566 int ext_capab_len;
567 int skip_auth;
568 u8 *wpa_ie;
569 size_t wpa_ie_len;
570 #ifdef CONFIG_MBO
571 const u8 *mbo_ie;
572 #endif /* CONFIG_MBO */
573 int omit_rsnxe = 0;
574
575 if (bss == NULL) {
576 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
577 "the network");
578 wpas_connect_work_done(wpa_s);
579 return;
580 }
581
582 os_memset(¶ms, 0, sizeof(params));
583
584 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
585 !wpa_bss_parse_basic_ml_element(wpa_s, bss, wpa_s->ap_mld_addr,
586 NULL, ssid, NULL) &&
587 bss->valid_links) {
588 wpa_printf(MSG_DEBUG, "MLD: In authentication");
589 wpas_sme_set_mlo_links(wpa_s, bss, ssid);
590
591 #ifdef CONFIG_TESTING_OPTIONS
592 bss = wpas_ml_connect_pref(wpa_s, bss, ssid);
593
594 if (wpa_s->conf->mld_force_single_link) {
595 wpa_printf(MSG_DEBUG, "MLD: Force single link");
596 wpa_s->valid_links = BIT(wpa_s->mlo_assoc_link_id);
597 }
598 #endif /* CONFIG_TESTING_OPTIONS */
599 params.mld = true;
600 params.mld_link_id = wpa_s->mlo_assoc_link_id;
601 params.ap_mld_addr = wpa_s->ap_mld_addr;
602 wpas_ml_handle_removed_links(wpa_s, bss);
603 }
604
605 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
606 wpa_s->reassoc_same_bss;
607 wpa_s->current_bss = bss;
608
609 wpa_s->reassociate = 0;
610
611 params.freq = bss->freq;
612 params.bssid = bss->bssid;
613 params.ssid = bss->ssid;
614 params.ssid_len = bss->ssid_len;
615 params.p2p = ssid->p2p_group;
616
617 if (wpa_s->sme.ssid_len != params.ssid_len ||
618 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
619 wpa_s->sme.prev_bssid_set = 0;
620
621 wpa_s->sme.freq = params.freq;
622 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
623 wpa_s->sme.ssid_len = params.ssid_len;
624
625 params.auth_alg = WPA_AUTH_ALG_OPEN;
626 #ifdef IEEE8021X_EAPOL
627 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
628 if (ssid->leap) {
629 if (ssid->non_leap == 0)
630 params.auth_alg = WPA_AUTH_ALG_LEAP;
631 else
632 params.auth_alg |= WPA_AUTH_ALG_LEAP;
633 }
634 }
635 #endif /* IEEE8021X_EAPOL */
636 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
637 params.auth_alg);
638 if (ssid->auth_alg) {
639 params.auth_alg = ssid->auth_alg;
640 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
641 "0x%x", params.auth_alg);
642 }
643 #ifdef CONFIG_SAE
644 wpa_s->sme.sae_pmksa_caching = 0;
645 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
646 const u8 *rsn;
647 struct wpa_ie_data ied;
648
649 rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
650 if (!rsn) {
651 wpa_dbg(wpa_s, MSG_DEBUG,
652 "SAE enabled, but target BSS does not advertise RSN");
653 #ifdef CONFIG_DPP
654 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
655 (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
656 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
657 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
658 #endif /* CONFIG_DPP */
659 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
660 wpa_key_mgmt_sae(ied.key_mgmt)) {
661 if (wpas_is_sae_avoided(wpa_s, ssid, &ied)) {
662 wpa_dbg(wpa_s, MSG_DEBUG,
663 "SAE enabled, but disallowing SAE auth_alg without PMF");
664 } else {
665 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
666 params.auth_alg = WPA_AUTH_ALG_SAE;
667 }
668 } else {
669 wpa_dbg(wpa_s, MSG_DEBUG,
670 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
671 }
672 }
673 #endif /* CONFIG_SAE */
674
675 #ifdef CONFIG_WEP
676 {
677 int i;
678
679 for (i = 0; i < NUM_WEP_KEYS; i++) {
680 if (ssid->wep_key_len[i])
681 params.wep_key[i] = ssid->wep_key[i];
682 params.wep_key_len[i] = ssid->wep_key_len[i];
683 }
684 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
685 }
686 #endif /* CONFIG_WEP */
687
688 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
689 wpa_bss_get_rsne(wpa_s, bss, ssid, false)) &&
690 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
691 int try_opportunistic;
692 const u8 *cache_id = NULL;
693
694 try_opportunistic = (ssid->proactive_key_caching < 0 ?
695 wpa_s->conf->okc :
696 ssid->proactive_key_caching) &&
697 (ssid->proto & WPA_PROTO_RSN);
698 #ifdef CONFIG_FILS
699 if (wpa_key_mgmt_fils(ssid->key_mgmt))
700 cache_id = wpa_bss_get_fils_cache_id(bss);
701 #endif /* CONFIG_FILS */
702 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
703 params.mld ? params.ap_mld_addr :
704 bss->bssid,
705 wpa_s->current_ssid,
706 try_opportunistic, cache_id,
707 0, false) == 0)
708 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
709 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
710 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
711 wpa_s->sme.assoc_req_ie,
712 &wpa_s->sme.assoc_req_ie_len,
713 false)) {
714 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
715 "key management and encryption suites");
716 wpas_connect_work_done(wpa_s);
717 return;
718 }
719 #ifdef CONFIG_HS20
720 } else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
721 (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
722 /* No PMKSA caching, but otherwise similar to RSN/WPA */
723 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
724 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
725 wpa_s->sme.assoc_req_ie,
726 &wpa_s->sme.assoc_req_ie_len,
727 false)) {
728 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
729 "key management and encryption suites");
730 wpas_connect_work_done(wpa_s);
731 return;
732 }
733 #endif /* CONFIG_HS20 */
734 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
735 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
736 /*
737 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
738 * use non-WPA since the scan results did not indicate that the
739 * AP is using WPA or WPA2.
740 */
741 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
742 wpa_s->sme.assoc_req_ie_len = 0;
743 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
744 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
745 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
746 wpa_s->sme.assoc_req_ie,
747 &wpa_s->sme.assoc_req_ie_len,
748 false)) {
749 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
750 "key management and encryption suites (no "
751 "scan results)");
752 wpas_connect_work_done(wpa_s);
753 return;
754 }
755 #ifdef CONFIG_WPS
756 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
757 struct wpabuf *wps_ie;
758 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
759 if (wps_ie && wpabuf_len(wps_ie) <=
760 sizeof(wpa_s->sme.assoc_req_ie)) {
761 wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
762 os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
763 wpa_s->sme.assoc_req_ie_len);
764 } else
765 wpa_s->sme.assoc_req_ie_len = 0;
766 wpabuf_free(wps_ie);
767 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
768 #endif /* CONFIG_WPS */
769 } else {
770 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
771 wpa_s->sme.assoc_req_ie_len = 0;
772 }
773
774 /* In case the WPA vendor IE is used, it should be placed after all the
775 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
776 * defined in the standard. Store the WPA IE so it can later be
777 * inserted at the correct location.
778 */
779 wpa_ie = NULL;
780 wpa_ie_len = 0;
781 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
782 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
783 wpa_s->sme.assoc_req_ie_len);
784 if (wpa_ie) {
785 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
786
787 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
788 wpa_s->sme.assoc_req_ie_len = 0;
789 } else {
790 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
791 wpas_connect_work_done(wpa_s);
792 return;
793 }
794 }
795
796 #ifdef CONFIG_IEEE80211R
797 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
798 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
799 md = ie + 2;
800 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
801 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
802 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
803 md = NULL;
804 if (md) {
805 /* Prepare for the next transition */
806 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
807 }
808
809 if (md) {
810 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
811 md[0], md[1]);
812
813 omit_rsnxe = !wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
814 if (wpa_s->sme.assoc_req_ie_len + 5 <
815 sizeof(wpa_s->sme.assoc_req_ie)) {
816 struct rsn_mdie *mdie;
817 u8 *pos = wpa_s->sme.assoc_req_ie +
818 wpa_s->sme.assoc_req_ie_len;
819 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
820 *pos++ = sizeof(*mdie);
821 mdie = (struct rsn_mdie *) pos;
822 os_memcpy(mdie->mobility_domain, md,
823 MOBILITY_DOMAIN_ID_LEN);
824 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
825 wpa_s->sme.assoc_req_ie_len += 5;
826 }
827
828 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
829 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
830 wpa_sm_has_ft_keys(wpa_s->wpa, md)) {
831 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
832 "over-the-air");
833 params.auth_alg = WPA_AUTH_ALG_FT;
834 params.ie = wpa_s->sme.ft_ies;
835 params.ie_len = wpa_s->sme.ft_ies_len;
836 }
837 }
838 #endif /* CONFIG_IEEE80211R */
839
840 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
841 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
842 const u8 *rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
843 struct wpa_ie_data _ie;
844 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
845 _ie.capabilities &
846 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
847 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
848 "MFP: require MFP");
849 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
850 }
851 }
852
853 #ifdef CONFIG_P2P
854 if (wpa_s->global->p2p) {
855 u8 *pos;
856 size_t len;
857 int res;
858 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
859 len = sizeof(wpa_s->sme.assoc_req_ie) -
860 wpa_s->sme.assoc_req_ie_len;
861 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
862 ssid->p2p_group);
863 if (res >= 0)
864 wpa_s->sme.assoc_req_ie_len += res;
865 }
866 #endif /* CONFIG_P2P */
867
868 #ifdef CONFIG_FST
869 if (wpa_s->fst_ies) {
870 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
871
872 if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
873 sizeof(wpa_s->sme.assoc_req_ie)) {
874 os_memcpy(wpa_s->sme.assoc_req_ie +
875 wpa_s->sme.assoc_req_ie_len,
876 wpabuf_head(wpa_s->fst_ies),
877 fst_ies_len);
878 wpa_s->sme.assoc_req_ie_len += fst_ies_len;
879 }
880 }
881 #endif /* CONFIG_FST */
882
883 sme_auth_handle_rrm(wpa_s, bss);
884
885 #ifndef CONFIG_NO_RRM
886 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
887 wpa_s, ssid, bss,
888 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
889 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
890 #endif /* CONFIG_NO_RRM */
891
892 if (params.p2p)
893 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
894 else
895 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
896
897 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
898 sizeof(ext_capab), bss);
899 if (ext_capab_len > 0) {
900 u8 *pos = wpa_s->sme.assoc_req_ie;
901 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
902 pos += 2 + pos[1];
903 os_memmove(pos + ext_capab_len, pos,
904 wpa_s->sme.assoc_req_ie_len -
905 (pos - wpa_s->sme.assoc_req_ie));
906 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
907 os_memcpy(pos, ext_capab, ext_capab_len);
908 }
909
910 if (ssid->max_idle && wpa_s->sme.assoc_req_ie_len + 5 <=
911 sizeof(wpa_s->sme.assoc_req_ie)) {
912 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
913
914 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
915 *pos++ = 3;
916 WPA_PUT_LE16(pos, ssid->max_idle);
917 pos += 2;
918 *pos = 0; /* Idle Options */
919 wpa_s->sme.assoc_req_ie_len += 5;
920 }
921
922 #ifdef CONFIG_TESTING_OPTIONS
923 if (wpa_s->rsnxe_override_assoc &&
924 wpabuf_len(wpa_s->rsnxe_override_assoc) <=
925 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
926 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
927 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
928 wpabuf_head(wpa_s->rsnxe_override_assoc),
929 wpabuf_len(wpa_s->rsnxe_override_assoc));
930 wpa_s->sme.assoc_req_ie_len +=
931 wpabuf_len(wpa_s->rsnxe_override_assoc);
932 } else
933 #endif /* CONFIG_TESTING_OPTIONS */
934 if (wpa_s->rsnxe_len > 0 &&
935 wpa_s->rsnxe_len <=
936 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
937 !omit_rsnxe) {
938 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
939 wpa_s->rsnxe, wpa_s->rsnxe_len);
940 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
941 }
942
943 #ifdef CONFIG_HS20
944 if (is_hs20_network(wpa_s, ssid, bss)
945 #ifndef ANDROID /* Android does not use the native HS 2.0 config */
946 && is_hs20_config(wpa_s)
947 #endif /* ANDROID */
948 ) {
949 struct wpabuf *hs20;
950
951 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
952 if (hs20) {
953 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
954 size_t len;
955
956 wpas_hs20_add_indication(hs20, pps_mo_id,
957 get_hs20_version(bss));
958 wpas_hs20_add_roam_cons_sel(hs20, ssid);
959 len = sizeof(wpa_s->sme.assoc_req_ie) -
960 wpa_s->sme.assoc_req_ie_len;
961 if (wpabuf_len(hs20) <= len) {
962 os_memcpy(wpa_s->sme.assoc_req_ie +
963 wpa_s->sme.assoc_req_ie_len,
964 wpabuf_head(hs20), wpabuf_len(hs20));
965 wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
966 }
967 wpabuf_free(hs20);
968 }
969 }
970 #endif /* CONFIG_HS20 */
971
972 if (wpa_ie) {
973 size_t len;
974
975 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
976
977 len = sizeof(wpa_s->sme.assoc_req_ie) -
978 wpa_s->sme.assoc_req_ie_len;
979
980 if (len > wpa_ie_len) {
981 os_memcpy(wpa_s->sme.assoc_req_ie +
982 wpa_s->sme.assoc_req_ie_len,
983 wpa_ie, wpa_ie_len);
984 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
985 } else {
986 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
987 }
988
989 os_free(wpa_ie);
990 }
991
992 if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
993 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
994 size_t len;
995
996 len = sizeof(wpa_s->sme.assoc_req_ie) -
997 wpa_s->sme.assoc_req_ie_len;
998 if (wpabuf_len(buf) <= len) {
999 os_memcpy(wpa_s->sme.assoc_req_ie +
1000 wpa_s->sme.assoc_req_ie_len,
1001 wpabuf_head(buf), wpabuf_len(buf));
1002 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
1003 }
1004 }
1005
1006 #ifdef CONFIG_MBO
1007 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
1008 if (!wpa_s->disable_mbo_oce && mbo_ie) {
1009 int len;
1010
1011 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
1012 wpa_s->sme.assoc_req_ie_len,
1013 sizeof(wpa_s->sme.assoc_req_ie) -
1014 wpa_s->sme.assoc_req_ie_len,
1015 !!mbo_attr_from_mbo_ie(mbo_ie,
1016 OCE_ATTR_ID_CAPA_IND));
1017 if (len >= 0)
1018 wpa_s->sme.assoc_req_ie_len += len;
1019 }
1020 #endif /* CONFIG_MBO */
1021
1022 #ifdef CONFIG_SAE
1023 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
1024 pmksa_cache_set_current(wpa_s->wpa, NULL,
1025 params.mld ? params.ap_mld_addr :
1026 bss->bssid,
1027 ssid, 0,
1028 NULL,
1029 wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
1030 wpa_s->key_mgmt :
1031 (int) WPA_KEY_MGMT_SAE, false) == 0) {
1032 wpa_dbg(wpa_s, MSG_DEBUG,
1033 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
1034 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1035 params.auth_alg = WPA_AUTH_ALG_OPEN;
1036 wpa_s->sme.sae_pmksa_caching = 1;
1037 }
1038
1039 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
1040 if (start)
1041 resp = sme_auth_build_sae_commit(wpa_s, ssid,
1042 bss->bssid,
1043 params.mld ?
1044 params.ap_mld_addr :
1045 NULL, 0,
1046 start == 2, NULL,
1047 NULL);
1048 else
1049 resp = sme_auth_build_sae_confirm(wpa_s, 0);
1050 if (resp == NULL) {
1051 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1052 return;
1053 }
1054 params.auth_data = wpabuf_head(resp);
1055 params.auth_data_len = wpabuf_len(resp);
1056 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
1057 }
1058 #endif /* CONFIG_SAE */
1059
1060 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1061 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1062 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1063 if (bssid_changed)
1064 wpas_notify_bssid_changed(wpa_s);
1065
1066 old_ssid = wpa_s->current_ssid;
1067 wpa_s->current_ssid = ssid;
1068 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
1069 wpa_sm_set_ssid(wpa_s->wpa, bss->ssid, bss->ssid_len);
1070 wpa_supplicant_initiate_eapol(wpa_s);
1071
1072 #ifdef CONFIG_FILS
1073 /* TODO: FILS operations can in some cases be done between different
1074 * network_ctx (i.e., same credentials can be used with multiple
1075 * networks). */
1076 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
1077 wpa_key_mgmt_fils(ssid->key_mgmt)) {
1078 const u8 *indic;
1079 u16 fils_info;
1080 const u8 *realm, *username, *rrk;
1081 size_t realm_len, username_len, rrk_len;
1082 u16 next_seq_num;
1083
1084 /*
1085 * Check FILS Indication element (FILS Information field) bits
1086 * indicating supported authentication algorithms against local
1087 * configuration (ssid->fils_dh_group). Try to use FILS
1088 * authentication only if the AP supports the combination in the
1089 * network profile. */
1090 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
1091 if (!indic || indic[1] < 2) {
1092 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1093 " does not include FILS Indication element - cannot use FILS authentication with it",
1094 MAC2STR(bss->bssid));
1095 goto no_fils;
1096 }
1097
1098 fils_info = WPA_GET_LE16(indic + 2);
1099 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
1100 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1101 " does not support FILS SK without PFS - cannot use FILS authentication with it",
1102 MAC2STR(bss->bssid));
1103 goto no_fils;
1104 }
1105 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
1106 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1107 " does not support FILS SK with PFS - cannot use FILS authentication with it",
1108 MAC2STR(bss->bssid));
1109 goto no_fils;
1110 }
1111
1112 if (wpa_s->last_con_fail_realm &&
1113 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
1114 &username, &username_len,
1115 &realm, &realm_len, &next_seq_num,
1116 &rrk, &rrk_len) == 0 &&
1117 realm && realm_len == wpa_s->last_con_fail_realm_len &&
1118 os_memcmp(realm, wpa_s->last_con_fail_realm,
1119 realm_len) == 0) {
1120 wpa_printf(MSG_DEBUG,
1121 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
1122 goto no_fils;
1123 }
1124
1125 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
1126 params.mld ? params.ap_mld_addr :
1127 bss->bssid,
1128 ssid, 0,
1129 wpa_bss_get_fils_cache_id(bss),
1130 0, false) == 0)
1131 wpa_printf(MSG_DEBUG,
1132 "SME: Try to use FILS with PMKSA caching");
1133 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
1134 if (resp) {
1135 int auth_alg;
1136
1137 if (ssid->fils_dh_group)
1138 wpa_printf(MSG_DEBUG,
1139 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
1140 ssid->fils_dh_group);
1141 else
1142 wpa_printf(MSG_DEBUG,
1143 "SME: Try to use FILS SK authentication without PFS");
1144 auth_alg = ssid->fils_dh_group ?
1145 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
1146 params.auth_alg = auth_alg;
1147 params.auth_data = wpabuf_head(resp);
1148 params.auth_data_len = wpabuf_len(resp);
1149 wpa_s->sme.auth_alg = auth_alg;
1150 }
1151 }
1152 no_fils:
1153 #endif /* CONFIG_FILS */
1154
1155 wpa_supplicant_cancel_sched_scan(wpa_s);
1156 wpa_supplicant_cancel_scan(wpa_s);
1157
1158 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
1159 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
1160 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
1161
1162 eapol_sm_notify_portValid(wpa_s->eapol, false);
1163 wpa_clear_keys(wpa_s, bss->bssid);
1164 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1165 if (old_ssid != wpa_s->current_ssid)
1166 wpas_notify_network_changed(wpa_s);
1167
1168 #ifdef CONFIG_HS20
1169 hs20_configure_frame_filters(wpa_s);
1170 #endif /* CONFIG_HS20 */
1171
1172 #ifdef CONFIG_P2P
1173 /*
1174 * If multi-channel concurrency is not supported, check for any
1175 * frequency conflict. In case of any frequency conflict, remove the
1176 * least prioritized connection.
1177 */
1178 if (wpa_s->num_multichan_concurrent < 2) {
1179 int freq, num;
1180 num = get_shared_radio_freqs(wpa_s, &freq, 1, false);
1181 if (num > 0 && freq > 0 && freq != params.freq) {
1182 wpa_printf(MSG_DEBUG,
1183 "Conflicting frequency found (%d != %d)",
1184 freq, params.freq);
1185 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
1186 params.freq,
1187 ssid) < 0) {
1188 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1189 wpa_supplicant_mark_disassoc(wpa_s);
1190 wpabuf_free(resp);
1191 wpas_connect_work_done(wpa_s);
1192 return;
1193 }
1194 }
1195 }
1196 #endif /* CONFIG_P2P */
1197
1198 if (skip_auth) {
1199 wpa_msg(wpa_s, MSG_DEBUG,
1200 "SME: Skip authentication step on reassoc-to-same-BSS");
1201 wpabuf_free(resp);
1202 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
1203 return;
1204 }
1205
1206
1207 wpa_s->sme.auth_alg = params.auth_alg;
1208 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) {
1209 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
1210 "driver failed");
1211 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1212 wpa_supplicant_mark_disassoc(wpa_s);
1213 wpabuf_free(resp);
1214 wpas_connect_work_done(wpa_s);
1215 return;
1216 }
1217
1218 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
1219 NULL);
1220
1221 /*
1222 * Association will be started based on the authentication event from
1223 * the driver.
1224 */
1225
1226 wpabuf_free(resp);
1227 }
1228
1229
sme_auth_start_cb(struct wpa_radio_work * work,int deinit)1230 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
1231 {
1232 struct wpa_connect_work *cwork = work->ctx;
1233 struct wpa_supplicant *wpa_s = work->wpa_s;
1234
1235 wpa_s->roam_in_progress = false;
1236 #ifdef CONFIG_WNM
1237 wpa_s->bss_trans_mgmt_in_progress = false;
1238 #endif /* CONFIG_WNM */
1239
1240 if (deinit) {
1241 if (work->started)
1242 wpa_s->connect_work = NULL;
1243
1244 wpas_connect_work_free(cwork);
1245 return;
1246 }
1247
1248 wpa_s->connect_work = work;
1249
1250 if (cwork->bss_removed ||
1251 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
1252 wpas_network_disabled(wpa_s, cwork->ssid)) {
1253 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
1254 wpas_connect_work_done(wpa_s);
1255 return;
1256 }
1257
1258 /* Starting new connection, so clear the possibly used WPA IE from the
1259 * previous association. */
1260 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1261 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
1262 wpa_s->rsnxe_len = 0;
1263
1264 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
1265 wpas_notify_auth_changed(wpa_s);
1266 }
1267
1268
sme_authenticate(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)1269 void sme_authenticate(struct wpa_supplicant *wpa_s,
1270 struct wpa_bss *bss, struct wpa_ssid *ssid)
1271 {
1272 struct wpa_connect_work *cwork;
1273
1274 if (bss == NULL || ssid == NULL)
1275 return;
1276 if (wpa_s->connect_work) {
1277 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
1278 return;
1279 }
1280
1281 if (wpa_s->roam_in_progress) {
1282 wpa_dbg(wpa_s, MSG_DEBUG,
1283 "SME: Reject sme_authenticate() in favor of explicit roam request");
1284 return;
1285 }
1286 #ifdef CONFIG_WNM
1287 if (wpa_s->bss_trans_mgmt_in_progress) {
1288 wpa_dbg(wpa_s, MSG_DEBUG,
1289 "SME: Reject sme_authenticate() in favor of BSS transition management request");
1290 return;
1291 }
1292 #endif /* CONFIG_WNM */
1293 if (radio_work_pending(wpa_s, "sme-connect")) {
1294 /*
1295 * The previous sme-connect work might no longer be valid due to
1296 * the fact that the BSS list was updated. In addition, it makes
1297 * sense to adhere to the 'newer' decision.
1298 */
1299 wpa_dbg(wpa_s, MSG_DEBUG,
1300 "SME: Remove previous pending sme-connect");
1301 radio_remove_works(wpa_s, "sme-connect", 0);
1302 }
1303
1304 wpas_abort_ongoing_scan(wpa_s);
1305
1306 cwork = os_zalloc(sizeof(*cwork));
1307 if (cwork == NULL)
1308 return;
1309 cwork->bss = bss;
1310 cwork->ssid = ssid;
1311 cwork->sme = 1;
1312
1313 #ifdef CONFIG_SAE
1314 wpa_s->sme.sae.state = SAE_NOTHING;
1315 wpa_s->sme.sae.send_confirm = 0;
1316 wpa_s->sme.sae_group_index = 0;
1317 #endif /* CONFIG_SAE */
1318
1319 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
1320 sme_auth_start_cb, cwork) < 0)
1321 wpas_connect_work_free(cwork);
1322 }
1323
1324
1325 #ifdef CONFIG_SAE
1326
1327 #define WPA_AUTH_FRAME_ML_IE_LEN (6 + ETH_ALEN)
1328
wpa_auth_ml_ie(struct wpabuf * buf,const u8 * mld_addr)1329 static void wpa_auth_ml_ie(struct wpabuf *buf, const u8 *mld_addr)
1330 {
1331
1332 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1333 wpabuf_put_u8(buf, 4 + ETH_ALEN);
1334 wpabuf_put_u8(buf, WLAN_EID_EXT_MULTI_LINK);
1335
1336 /* Basic Multi-Link element Control field */
1337 wpabuf_put_u8(buf, 0x0);
1338 wpabuf_put_u8(buf, 0x0);
1339
1340 /* Common Info */
1341 wpabuf_put_u8(buf, 0x7); /* length = Length field + MLD MAC address */
1342 wpabuf_put_data(buf, mld_addr, ETH_ALEN);
1343 }
1344
1345
sme_external_auth_build_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,u16 auth_transaction,u16 seq_num,u16 status_code,const u8 * mld_addr)1346 static int sme_external_auth_build_buf(struct wpabuf *buf,
1347 struct wpabuf *params,
1348 const u8 *sa, const u8 *da,
1349 u16 auth_transaction, u16 seq_num,
1350 u16 status_code, const u8 *mld_addr)
1351 {
1352 struct ieee80211_mgmt *resp;
1353
1354 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
1355 u.auth.variable));
1356
1357 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
1358 (WLAN_FC_STYPE_AUTH << 4));
1359 os_memcpy(resp->da, da, ETH_ALEN);
1360 os_memcpy(resp->sa, sa, ETH_ALEN);
1361 os_memcpy(resp->bssid, da, ETH_ALEN);
1362 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
1363 resp->seq_ctrl = host_to_le16(seq_num << 4);
1364 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
1365 resp->u.auth.status_code = host_to_le16(status_code);
1366 if (params)
1367 wpabuf_put_buf(buf, params);
1368
1369 if (mld_addr)
1370 wpa_auth_ml_ie(buf, mld_addr);
1371
1372 return 0;
1373 }
1374
1375
sme_external_auth_send_sae_commit(struct wpa_supplicant * wpa_s,const u8 * bssid,struct wpa_ssid * ssid)1376 static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
1377 const u8 *bssid,
1378 struct wpa_ssid *ssid)
1379 {
1380 struct wpabuf *resp, *buf;
1381 int use_pt;
1382 bool use_pk;
1383 u16 status;
1384
1385 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid,
1386 wpa_s->sme.ext_ml_auth ?
1387 wpa_s->sme.ext_auth_ap_mld_addr : NULL,
1388 1, 0, &use_pt, &use_pk);
1389 if (!resp) {
1390 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
1391 return -1;
1392 }
1393
1394 wpa_s->sme.sae.state = SAE_COMMITTED;
1395 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp) +
1396 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1397 0));
1398 if (!buf) {
1399 wpabuf_free(resp);
1400 return -1;
1401 }
1402
1403 wpa_s->sme.seq_num++;
1404 if (use_pk)
1405 status = WLAN_STATUS_SAE_PK;
1406 else if (use_pt)
1407 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
1408 else
1409 status = WLAN_STATUS_SUCCESS;
1410 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1411 wpa_s->sme.ext_ml_auth ?
1412 wpa_s->sme.ext_auth_ap_mld_addr : bssid, 1,
1413 wpa_s->sme.seq_num, status,
1414 wpa_s->sme.ext_ml_auth ?
1415 wpa_s->own_addr : NULL);
1416 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1417 wpabuf_free(resp);
1418 wpabuf_free(buf);
1419
1420 return 0;
1421 }
1422
1423
sme_send_external_auth_status(struct wpa_supplicant * wpa_s,u16 status)1424 static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
1425 u16 status)
1426 {
1427 struct external_auth params;
1428
1429 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1430 os_memset(¶ms, 0, sizeof(params));
1431 params.status = status;
1432 params.ssid = wpa_s->sme.ext_auth_ssid;
1433 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
1434 params.bssid = wpa_s->sme.ext_auth_bssid;
1435 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
1436 params.pmkid = wpa_s->sme.sae.pmkid;
1437 wpa_drv_send_external_auth_status(wpa_s, ¶ms);
1438 }
1439
1440
sme_handle_external_auth_start(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1441 static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
1442 union wpa_event_data *data)
1443 {
1444 struct wpa_ssid *ssid;
1445 size_t ssid_str_len = data->external_auth.ssid_len;
1446 const u8 *ssid_str = data->external_auth.ssid;
1447
1448 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1449 /* Get the SSID conf from the ssid string obtained */
1450 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1451 if (!wpas_network_disabled(wpa_s, ssid) &&
1452 ssid_str_len == ssid->ssid_len &&
1453 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
1454 wpa_key_mgmt_sae(ssid->key_mgmt)) {
1455 /* Make sure PT is derived */
1456 wpa_s_setup_sae_pt(wpa_s->conf, ssid, false);
1457 wpa_s->sme.ext_auth_wpa_ssid = ssid;
1458 break;
1459 }
1460 }
1461 if (!ssid ||
1462 sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
1463 ssid) < 0)
1464 return -1;
1465
1466 return 0;
1467 }
1468
1469
sme_external_auth_send_sae_confirm(struct wpa_supplicant * wpa_s,const u8 * da)1470 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1471 const u8 *da)
1472 {
1473 struct wpabuf *resp, *buf;
1474
1475 resp = sme_auth_build_sae_confirm(wpa_s, 1);
1476 if (!resp) {
1477 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1478 return;
1479 }
1480
1481 wpa_s->sme.sae.state = SAE_CONFIRMED;
1482 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp) +
1483 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1484 0));
1485 if (!buf) {
1486 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1487 wpabuf_free(resp);
1488 return;
1489 }
1490 wpa_s->sme.seq_num++;
1491 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1492 da, 2, wpa_s->sme.seq_num,
1493 WLAN_STATUS_SUCCESS,
1494 wpa_s->sme.ext_ml_auth ?
1495 wpa_s->own_addr : NULL);
1496
1497 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1498 wpabuf_free(resp);
1499 wpabuf_free(buf);
1500 }
1501
1502
is_sae_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)1503 static bool is_sae_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
1504 {
1505 /* suite is supposed to be the selector value in host byte order with
1506 * the OUI in three most significant octets. However, the initial
1507 * implementation swapped that byte order and did not work with drivers
1508 * that followed the expected byte order. Keep a workaround here to
1509 * match that initial implementation so that already deployed use cases
1510 * remain functional. */
1511 if (RSN_SELECTOR_GET(&suite) == RSN_AUTH_KEY_MGMT_SAE) {
1512 /* Old drivers which follow initial implementation send SAE AKM
1513 * for both SAE and FT-SAE connections. In that case, determine
1514 * the actual AKM from wpa_s->key_mgmt. */
1515 wpa_s->sme.ext_auth_key_mgmt = wpa_s->key_mgmt;
1516 return true;
1517 }
1518
1519 if (suite == RSN_AUTH_KEY_MGMT_SAE)
1520 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
1521 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE)
1522 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE;
1523 else if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1524 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
1525 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1526 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1527 else
1528 return false;
1529
1530 return true;
1531 }
1532
1533
sme_external_auth_trigger(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1534 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1535 union wpa_event_data *data)
1536 {
1537 if (!is_sae_key_mgmt_suite(wpa_s, data->external_auth.key_mgmt_suite))
1538 return;
1539
1540 if (data->external_auth.action == EXT_AUTH_START) {
1541 if (!data->external_auth.bssid || !data->external_auth.ssid)
1542 return;
1543 os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
1544 ETH_ALEN);
1545 os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
1546 data->external_auth.ssid_len);
1547 wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
1548 if (data->external_auth.mld_addr) {
1549 wpa_s->sme.ext_ml_auth = true;
1550 os_memcpy(wpa_s->sme.ext_auth_ap_mld_addr,
1551 data->external_auth.mld_addr, ETH_ALEN);
1552 } else {
1553 wpa_s->sme.ext_ml_auth = false;
1554 }
1555 wpa_s->sme.seq_num = 0;
1556 wpa_s->sme.sae.state = SAE_NOTHING;
1557 wpa_s->sme.sae.send_confirm = 0;
1558 wpa_s->sme.sae_group_index = 0;
1559 if (sme_handle_external_auth_start(wpa_s, data) < 0)
1560 sme_send_external_auth_status(wpa_s,
1561 WLAN_STATUS_UNSPECIFIED_FAILURE);
1562 } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1563 /* Report failure to driver for the wrong trigger */
1564 sme_send_external_auth_status(wpa_s,
1565 WLAN_STATUS_UNSPECIFIED_FAILURE);
1566 }
1567 }
1568
1569
sme_sae_is_group_enabled(struct wpa_supplicant * wpa_s,int group)1570 static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
1571 {
1572 int *groups = wpa_s->conf->sae_groups;
1573 int default_groups[] = { 19, 20, 21, 0 };
1574 int i;
1575
1576 if (!groups)
1577 groups = default_groups;
1578
1579 for (i = 0; groups[i] > 0; i++) {
1580 if (groups[i] == group)
1581 return 1;
1582 }
1583
1584 return 0;
1585 }
1586
1587
sme_check_sae_rejected_groups(struct wpa_supplicant * wpa_s,const struct wpabuf * groups)1588 static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
1589 const struct wpabuf *groups)
1590 {
1591 size_t i, count, len;
1592 const u8 *pos;
1593
1594 if (!groups)
1595 return 0;
1596
1597 pos = wpabuf_head(groups);
1598 len = wpabuf_len(groups);
1599 if (len & 1) {
1600 wpa_printf(MSG_DEBUG,
1601 "SAE: Invalid length of the Rejected Groups element payload: %zu",
1602 len);
1603 return 1;
1604 }
1605 count = len / 2;
1606 for (i = 0; i < count; i++) {
1607 int enabled;
1608 u16 group;
1609
1610 group = WPA_GET_LE16(pos);
1611 pos += 2;
1612 enabled = sme_sae_is_group_enabled(wpa_s, group);
1613 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
1614 group, enabled ? "enabled" : "disabled");
1615 if (enabled)
1616 return 1;
1617 }
1618
1619 return 0;
1620 }
1621
1622
sme_external_ml_auth(struct wpa_supplicant * wpa_s,const u8 * data,size_t len,int ie_offset,u16 status_code)1623 static int sme_external_ml_auth(struct wpa_supplicant *wpa_s,
1624 const u8 *data, size_t len, int ie_offset,
1625 u16 status_code)
1626 {
1627 struct ieee802_11_elems elems;
1628 const u8 *mld_addr;
1629
1630 if (ieee802_11_parse_elems(data + ie_offset, len - ie_offset,
1631 &elems, 0) == ParseFailed) {
1632 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
1633 return -1;
1634 }
1635
1636 if (!elems.basic_mle || !elems.basic_mle_len) {
1637 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
1638 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
1639 status_code == WLAN_STATUS_SUCCESS ||
1640 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1641 status_code == WLAN_STATUS_SAE_PK)
1642 return -1;
1643 /* Accept missing Multi-Link element in failed authentication
1644 * cases. */
1645 return 0;
1646 }
1647
1648 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
1649 if (!mld_addr) {
1650 wpa_printf(MSG_DEBUG, "MLD: No MLD address in ML element");
1651 return -1;
1652 }
1653
1654 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
1655
1656 if (!ether_addr_equal(wpa_s->sme.ext_auth_ap_mld_addr, mld_addr)) {
1657 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
1658 MACSTR ")",
1659 MAC2STR(wpa_s->sme.ext_auth_ap_mld_addr));
1660 return -1;
1661 }
1662
1663 return 0;
1664 }
1665
1666
sme_sae_auth(struct wpa_supplicant * wpa_s,u16 auth_transaction,u16 status_code,const u8 * data,size_t len,int external,const u8 * sa,int * ie_offset)1667 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
1668 u16 status_code, const u8 *data, size_t len,
1669 int external, const u8 *sa, int *ie_offset)
1670 {
1671 int *groups;
1672
1673 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1674 "status code %u", auth_transaction, status_code);
1675
1676 if (auth_transaction == 1 &&
1677 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1678 wpa_s->sme.sae.state == SAE_COMMITTED &&
1679 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1680 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1681 int default_groups[] = { 19, 20, 21, 0 };
1682 u16 group;
1683 const u8 *token_pos;
1684 size_t token_len;
1685 int h2e = 0;
1686
1687 groups = wpa_s->conf->sae_groups;
1688 if (!groups || groups[0] <= 0)
1689 groups = default_groups;
1690
1691 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
1692 data, len);
1693 if (len < sizeof(le16)) {
1694 wpa_dbg(wpa_s, MSG_DEBUG,
1695 "SME: Too short SAE anti-clogging token request");
1696 return -1;
1697 }
1698 group = WPA_GET_LE16(data);
1699 wpa_dbg(wpa_s, MSG_DEBUG,
1700 "SME: SAE anti-clogging token requested (group %u)",
1701 group);
1702 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1703 WLAN_STATUS_SUCCESS) {
1704 wpa_dbg(wpa_s, MSG_ERROR,
1705 "SME: SAE group %u of anti-clogging request is invalid",
1706 group);
1707 return -1;
1708 }
1709 wpabuf_free(wpa_s->sme.sae_token);
1710 token_pos = data + sizeof(le16);
1711 token_len = len - sizeof(le16);
1712 h2e = wpa_s->sme.sae.h2e;
1713 if (h2e) {
1714 u8 id, elen, extid;
1715
1716 if (token_len < 3) {
1717 wpa_dbg(wpa_s, MSG_DEBUG,
1718 "SME: Too short SAE anti-clogging token container");
1719 return -1;
1720 }
1721 id = *token_pos++;
1722 elen = *token_pos++;
1723 extid = *token_pos++;
1724 if (id != WLAN_EID_EXTENSION ||
1725 elen == 0 || elen > token_len - 2 ||
1726 extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
1727 wpa_dbg(wpa_s, MSG_DEBUG,
1728 "SME: Invalid SAE anti-clogging token container header");
1729 return -1;
1730 }
1731 token_len = elen - 1;
1732 }
1733
1734 *ie_offset = token_pos + token_len - data;
1735
1736 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
1737 if (!wpa_s->sme.sae_token) {
1738 wpa_dbg(wpa_s, MSG_ERROR,
1739 "SME: Failed to allocate SAE token");
1740 return -1;
1741 }
1742
1743 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
1744 wpa_s->sme.sae_token);
1745 if (!external) {
1746 sme_send_authentication(wpa_s, wpa_s->current_bss,
1747 wpa_s->current_ssid, 2);
1748 } else {
1749 if (wpa_s->sme.ext_ml_auth &&
1750 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1751 status_code))
1752 return -1;
1753
1754 sme_external_auth_send_sae_commit(
1755 wpa_s, wpa_s->sme.ext_auth_bssid,
1756 wpa_s->sme.ext_auth_wpa_ssid);
1757 }
1758 return 0;
1759 }
1760
1761 if (auth_transaction == 1 &&
1762 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1763 wpa_s->sme.sae.state == SAE_COMMITTED &&
1764 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1765 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1766 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
1767 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
1768 wpa_s->sme.sae.group);
1769 wpa_s->sme.sae_group_index++;
1770 if (sme_set_sae_group(wpa_s, external) < 0)
1771 return -1; /* no other groups enabled */
1772 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
1773 if (!external) {
1774 sme_send_authentication(wpa_s, wpa_s->current_bss,
1775 wpa_s->current_ssid, 1);
1776 } else {
1777 if (wpa_s->sme.ext_ml_auth &&
1778 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1779 status_code))
1780 return -1;
1781
1782 sme_external_auth_send_sae_commit(
1783 wpa_s, wpa_s->sme.ext_auth_bssid,
1784 wpa_s->sme.ext_auth_wpa_ssid);
1785 }
1786 return 0;
1787 }
1788
1789 if (auth_transaction == 1 &&
1790 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1791 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1792
1793 wpa_msg(wpa_s, MSG_INFO,
1794 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1795 MAC2STR(bssid));
1796 return -1;
1797 }
1798
1799 if (status_code != WLAN_STATUS_SUCCESS &&
1800 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
1801 status_code != WLAN_STATUS_SAE_PK) {
1802 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1803
1804 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1805 " auth_type=%u auth_transaction=%u status_code=%u",
1806 MAC2STR(bssid), WLAN_AUTH_SAE,
1807 auth_transaction, status_code);
1808 return -2;
1809 }
1810
1811 if (auth_transaction == 1) {
1812 u16 res;
1813
1814 groups = wpa_s->conf->sae_groups;
1815
1816 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
1817 if ((external && !wpa_s->sme.ext_auth_wpa_ssid) ||
1818 (!external &&
1819 (!wpa_s->current_bss || !wpa_s->current_ssid)))
1820 return -1;
1821 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
1822 wpa_printf(MSG_DEBUG,
1823 "SAE: Ignore commit message while waiting for confirm");
1824 return 0;
1825 }
1826 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
1827 wpa_printf(MSG_DEBUG,
1828 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
1829 return -1;
1830 }
1831 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
1832 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
1833 wpa_printf(MSG_DEBUG,
1834 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
1835 return -1;
1836 }
1837 if (!wpa_s->sme.sae.pk &&
1838 status_code == WLAN_STATUS_SAE_PK) {
1839 wpa_printf(MSG_DEBUG,
1840 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
1841 return -1;
1842 }
1843
1844 if (groups && groups[0] <= 0)
1845 groups = NULL;
1846 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
1847 groups, status_code ==
1848 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1849 status_code == WLAN_STATUS_SAE_PK,
1850 ie_offset);
1851 if (res == SAE_SILENTLY_DISCARD) {
1852 wpa_printf(MSG_DEBUG,
1853 "SAE: Drop commit message due to reflection attack");
1854 return 0;
1855 }
1856 if (res != WLAN_STATUS_SUCCESS)
1857 return -1;
1858
1859 if (wpa_s->sme.sae.tmp &&
1860 sme_check_sae_rejected_groups(
1861 wpa_s,
1862 wpa_s->sme.sae.tmp->peer_rejected_groups))
1863 return -1;
1864
1865 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1866 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1867 "commit");
1868 return -1;
1869 }
1870
1871 wpabuf_free(wpa_s->sme.sae_token);
1872 wpa_s->sme.sae_token = NULL;
1873 if (!external) {
1874 sme_send_authentication(wpa_s, wpa_s->current_bss,
1875 wpa_s->current_ssid, 0);
1876 } else {
1877 if (wpa_s->sme.ext_ml_auth &&
1878 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1879 status_code))
1880 return -1;
1881
1882 sme_external_auth_send_sae_confirm(wpa_s, sa);
1883 }
1884 return 0;
1885 } else if (auth_transaction == 2) {
1886 if (status_code != WLAN_STATUS_SUCCESS)
1887 return -1;
1888 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
1889 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
1890 return -1;
1891 if (sae_check_confirm(&wpa_s->sme.sae, data, len,
1892 ie_offset) < 0)
1893 return -1;
1894 if (external && wpa_s->sme.ext_ml_auth &&
1895 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1896 status_code))
1897 return -1;
1898
1899 wpa_s->sme.sae.state = SAE_ACCEPTED;
1900 sae_clear_temp_data(&wpa_s->sme.sae);
1901 wpa_s_clear_sae_rejected(wpa_s);
1902
1903 if (external) {
1904 /* Report success to driver */
1905 sme_send_external_auth_status(wpa_s,
1906 WLAN_STATUS_SUCCESS);
1907 }
1908
1909 return 1;
1910 }
1911
1912 return -1;
1913 }
1914
1915
sme_sae_set_pmk(struct wpa_supplicant * wpa_s,const u8 * bssid)1916 static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
1917 {
1918 wpa_printf(MSG_DEBUG,
1919 "SME: SAE completed - setting PMK for 4-way handshake");
1920 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, wpa_s->sme.sae.pmk_len,
1921 wpa_s->sme.sae.pmkid, bssid);
1922 if (wpa_s->conf->sae_pmkid_in_assoc) {
1923 /* Update the own RSNE contents now that we have set the PMK
1924 * and added a PMKSA cache entry based on the successfully
1925 * completed SAE exchange. In practice, this will add the PMKID
1926 * into RSNE. */
1927 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
1928 sizeof(wpa_s->sme.assoc_req_ie)) {
1929 wpa_msg(wpa_s, MSG_WARNING,
1930 "RSN: Not enough room for inserting own PMKID into RSNE");
1931 return -1;
1932 }
1933 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
1934 &wpa_s->sme.assoc_req_ie_len,
1935 wpa_s->sme.sae.pmkid, true) < 0)
1936 return -1;
1937 wpa_hexdump(MSG_DEBUG,
1938 "SME: Updated Association Request IEs",
1939 wpa_s->sme.assoc_req_ie,
1940 wpa_s->sme.assoc_req_ie_len);
1941 }
1942
1943 return 0;
1944 }
1945
1946
sme_external_auth_mgmt_rx(struct wpa_supplicant * wpa_s,const u8 * auth_frame,size_t len)1947 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1948 const u8 *auth_frame, size_t len)
1949 {
1950 const struct ieee80211_mgmt *header;
1951 size_t auth_length;
1952
1953 header = (const struct ieee80211_mgmt *) auth_frame;
1954 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1955
1956 if (len < auth_length) {
1957 /* Notify failure to the driver */
1958 sme_send_external_auth_status(wpa_s,
1959 WLAN_STATUS_UNSPECIFIED_FAILURE);
1960 return;
1961 }
1962
1963 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
1964 int res;
1965 int ie_offset = 0;
1966
1967 res = sme_sae_auth(
1968 wpa_s, le_to_host16(header->u.auth.auth_transaction),
1969 le_to_host16(header->u.auth.status_code),
1970 header->u.auth.variable,
1971 len - auth_length, 1, header->sa, &ie_offset);
1972 if (res < 0) {
1973 /* Notify failure to the driver */
1974 sme_send_external_auth_status(
1975 wpa_s,
1976 res == -2 ?
1977 le_to_host16(header->u.auth.status_code) :
1978 WLAN_STATUS_UNSPECIFIED_FAILURE);
1979 return;
1980 }
1981 if (res != 1)
1982 return;
1983
1984 if (sme_sae_set_pmk(wpa_s,
1985 wpa_s->sme.ext_ml_auth ?
1986 wpa_s->sme.ext_auth_ap_mld_addr :
1987 wpa_s->sme.ext_auth_bssid) < 0)
1988 return;
1989 }
1990 }
1991
1992 #endif /* CONFIG_SAE */
1993
1994
sme_event_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1995 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
1996 {
1997 struct wpa_ssid *ssid = wpa_s->current_ssid;
1998 int ie_offset = 0;
1999
2000 if (ssid == NULL) {
2001 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2002 "when network is not selected");
2003 return;
2004 }
2005
2006 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
2007 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2008 "when not in authenticating state");
2009 return;
2010 }
2011
2012 if (!ether_addr_equal(wpa_s->pending_bssid, data->auth.peer) &&
2013 !(wpa_s->valid_links &&
2014 ether_addr_equal(wpa_s->ap_mld_addr, data->auth.peer))) {
2015 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
2016 "unexpected peer " MACSTR,
2017 MAC2STR(data->auth.peer));
2018 return;
2019 }
2020
2021 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
2022 " auth_type=%d auth_transaction=%d status_code=%d",
2023 MAC2STR(data->auth.peer), data->auth.auth_type,
2024 data->auth.auth_transaction, data->auth.status_code);
2025 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
2026 data->auth.ies, data->auth.ies_len);
2027
2028 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2029
2030 #ifdef CONFIG_SAE
2031 if (data->auth.auth_type == WLAN_AUTH_SAE) {
2032 const u8 *addr = wpa_s->pending_bssid;
2033 int res;
2034
2035 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
2036 data->auth.status_code, data->auth.ies,
2037 data->auth.ies_len, 0, data->auth.peer,
2038 &ie_offset);
2039 if (res < 0) {
2040 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2041 NULL);
2042 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2043
2044 if (wpa_s->sme.sae_rejected_groups &&
2045 ssid->disabled_until.sec) {
2046 wpa_printf(MSG_DEBUG,
2047 "SME: Clear SAE state with rejected groups due to continuous failures");
2048 wpa_s_clear_sae_rejected(wpa_s);
2049 }
2050 }
2051 if (res != 1)
2052 return;
2053
2054 if (wpa_s->valid_links)
2055 addr = wpa_s->ap_mld_addr;
2056
2057 if (sme_sae_set_pmk(wpa_s, addr) < 0)
2058 return;
2059 }
2060 #endif /* CONFIG_SAE */
2061
2062 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
2063 char *ie_txt = NULL;
2064
2065 if (data->auth.ies && data->auth.ies_len) {
2066 size_t buflen = 2 * data->auth.ies_len + 1;
2067 ie_txt = os_malloc(buflen);
2068 if (ie_txt) {
2069 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
2070 data->auth.ies_len);
2071 }
2072 }
2073 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
2074 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
2075 MAC2STR(data->auth.peer), data->auth.auth_type,
2076 data->auth.auth_transaction, data->auth.status_code,
2077 ie_txt ? " ie=" : "",
2078 ie_txt ? ie_txt : "");
2079 os_free(ie_txt);
2080
2081 #ifdef CONFIG_FILS
2082 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
2083 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
2084 fils_connection_failure(wpa_s);
2085 #endif /* CONFIG_FILS */
2086
2087 if (data->auth.status_code !=
2088 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
2089 wpa_s->sme.auth_alg == data->auth.auth_type ||
2090 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
2091 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2092 NULL);
2093 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2094 return;
2095 }
2096
2097 wpas_connect_work_done(wpa_s);
2098
2099 switch (data->auth.auth_type) {
2100 case WLAN_AUTH_OPEN:
2101 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
2102
2103 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
2104 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2105 wpa_s->current_ssid);
2106 return;
2107
2108 case WLAN_AUTH_SHARED_KEY:
2109 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
2110
2111 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
2112 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2113 wpa_s->current_ssid);
2114 return;
2115
2116 default:
2117 return;
2118 }
2119 }
2120
2121 #ifdef CONFIG_IEEE80211R
2122 if (data->auth.auth_type == WLAN_AUTH_FT) {
2123 const u8 *ric_ies = NULL;
2124 size_t ric_ies_len = 0;
2125
2126 if (wpa_s->ric_ies) {
2127 ric_ies = wpabuf_head(wpa_s->ric_ies);
2128 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
2129 }
2130 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
2131 data->auth.ies_len, 0,
2132 data->auth.peer,
2133 ric_ies, ric_ies_len) < 0) {
2134 wpa_dbg(wpa_s, MSG_DEBUG,
2135 "SME: FT Authentication response processing failed");
2136 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2137 MACSTR
2138 " reason=%d locally_generated=1",
2139 MAC2STR(wpa_s->pending_bssid),
2140 WLAN_REASON_DEAUTH_LEAVING);
2141 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2142 NULL);
2143 wpa_supplicant_mark_disassoc(wpa_s);
2144 return;
2145 }
2146 }
2147 #endif /* CONFIG_IEEE80211R */
2148
2149 #ifdef CONFIG_FILS
2150 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
2151 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
2152 u16 expect_auth_type;
2153
2154 expect_auth_type = wpa_s->sme.auth_alg ==
2155 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
2156 WLAN_AUTH_FILS_SK;
2157 if (data->auth.auth_type != expect_auth_type) {
2158 wpa_dbg(wpa_s, MSG_DEBUG,
2159 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
2160 data->auth.auth_type, expect_auth_type);
2161 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2162 MACSTR
2163 " reason=%d locally_generated=1",
2164 MAC2STR(wpa_s->pending_bssid),
2165 WLAN_REASON_DEAUTH_LEAVING);
2166 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2167 NULL);
2168 wpa_supplicant_mark_disassoc(wpa_s);
2169 return;
2170 }
2171
2172 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
2173 data->auth.ies, data->auth.ies_len) < 0) {
2174 wpa_dbg(wpa_s, MSG_DEBUG,
2175 "SME: FILS Authentication response processing failed");
2176 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2177 MACSTR
2178 " reason=%d locally_generated=1",
2179 MAC2STR(wpa_s->pending_bssid),
2180 WLAN_REASON_DEAUTH_LEAVING);
2181 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2182 NULL);
2183 wpa_supplicant_mark_disassoc(wpa_s);
2184 return;
2185 }
2186 }
2187 #endif /* CONFIG_FILS */
2188
2189 /* TODO: Support additional auth_type values as well */
2190 if ((data->auth.auth_type == WLAN_AUTH_OPEN ||
2191 data->auth.auth_type == WLAN_AUTH_SAE) &&
2192 wpas_sme_ml_auth(wpa_s, data, ie_offset) < 0) {
2193 wpa_dbg(wpa_s, MSG_DEBUG,
2194 "MLD: Failed to parse ML Authentication frame");
2195 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
2196 " reason=%d locally_generated=1",
2197 MAC2STR(wpa_s->pending_bssid),
2198 WLAN_REASON_DEAUTH_LEAVING);
2199 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2200 wpa_supplicant_deauthenticate(wpa_s,
2201 WLAN_REASON_DEAUTH_LEAVING);
2202 wpa_printf(MSG_DEBUG,
2203 "MLD: Authentication - clearing MLD state");
2204 wpas_reset_mlo_info(wpa_s);
2205 return;
2206 }
2207
2208 sme_associate(wpa_s, ssid->mode, data->auth.peer,
2209 data->auth.auth_type);
2210 }
2211
2212
2213 #ifdef CONFIG_IEEE80211R
remove_ie(u8 * buf,size_t * len,u8 eid)2214 static void remove_ie(u8 *buf, size_t *len, u8 eid)
2215 {
2216 u8 *pos, *next, *end;
2217
2218 pos = (u8 *) get_ie(buf, *len, eid);
2219 if (pos) {
2220 next = pos + 2 + pos[1];
2221 end = buf + *len;
2222 *len -= 2 + pos[1];
2223 os_memmove(pos, next, end - next);
2224 }
2225 }
2226 #endif /* CONFIG_IEEE80211R */
2227
2228
sme_associate(struct wpa_supplicant * wpa_s,enum wpas_mode mode,const u8 * bssid,u16 auth_type)2229 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
2230 const u8 *bssid, u16 auth_type)
2231 {
2232 struct wpa_driver_associate_params params;
2233 struct ieee802_11_elems elems;
2234 struct wpa_ssid *ssid = wpa_s->current_ssid;
2235 #ifdef CONFIG_FILS
2236 u8 nonces[2 * FILS_NONCE_LEN];
2237 #endif /* CONFIG_FILS */
2238 #ifdef CONFIG_HT_OVERRIDES
2239 struct ieee80211_ht_capabilities htcaps;
2240 struct ieee80211_ht_capabilities htcaps_mask;
2241 #endif /* CONFIG_HT_OVERRIDES */
2242 #ifdef CONFIG_VHT_OVERRIDES
2243 struct ieee80211_vht_capabilities vhtcaps;
2244 struct ieee80211_vht_capabilities vhtcaps_mask;
2245 #endif /* CONFIG_VHT_OVERRIDES */
2246
2247 os_memset(¶ms, 0, sizeof(params));
2248
2249 /* Save auth type, in case we need to retry after comeback timer. */
2250 wpa_s->sme.assoc_auth_type = auth_type;
2251
2252 #ifdef CONFIG_FILS
2253 if (auth_type == WLAN_AUTH_FILS_SK ||
2254 auth_type == WLAN_AUTH_FILS_SK_PFS) {
2255 struct wpabuf *buf;
2256 const u8 *snonce, *anonce;
2257 const unsigned int max_hlp = 20;
2258 struct wpabuf *hlp[max_hlp];
2259 unsigned int i, num_hlp = 0;
2260 struct fils_hlp_req *req;
2261
2262 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
2263 list) {
2264 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
2265 wpabuf_len(req->pkt));
2266 if (!hlp[num_hlp])
2267 break;
2268 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
2269 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
2270 ETH_ALEN);
2271 wpabuf_put_data(hlp[num_hlp],
2272 "\xaa\xaa\x03\x00\x00\x00", 6);
2273 wpabuf_put_buf(hlp[num_hlp], req->pkt);
2274 num_hlp++;
2275 if (num_hlp >= max_hlp)
2276 break;
2277 }
2278
2279 buf = fils_build_assoc_req(wpa_s->wpa, ¶ms.fils_kek,
2280 ¶ms.fils_kek_len, &snonce,
2281 &anonce,
2282 (const struct wpabuf **) hlp,
2283 num_hlp);
2284 for (i = 0; i < num_hlp; i++)
2285 wpabuf_free(hlp[i]);
2286 if (!buf)
2287 return;
2288 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
2289 wpa_s->sme.assoc_req_ie,
2290 wpa_s->sme.assoc_req_ie_len);
2291 #ifdef CONFIG_IEEE80211R
2292 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
2293 /* Remove RSNE and MDE to allow them to be overridden
2294 * with FILS+FT specific values from
2295 * fils_build_assoc_req(). */
2296 remove_ie(wpa_s->sme.assoc_req_ie,
2297 &wpa_s->sme.assoc_req_ie_len,
2298 WLAN_EID_RSN);
2299 wpa_hexdump(MSG_DEBUG,
2300 "FILS: assoc_req after RSNE removal",
2301 wpa_s->sme.assoc_req_ie,
2302 wpa_s->sme.assoc_req_ie_len);
2303 remove_ie(wpa_s->sme.assoc_req_ie,
2304 &wpa_s->sme.assoc_req_ie_len,
2305 WLAN_EID_MOBILITY_DOMAIN);
2306 wpa_hexdump(MSG_DEBUG,
2307 "FILS: assoc_req after MDE removal",
2308 wpa_s->sme.assoc_req_ie,
2309 wpa_s->sme.assoc_req_ie_len);
2310 }
2311 #endif /* CONFIG_IEEE80211R */
2312 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
2313 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
2314 sizeof(wpa_s->sme.assoc_req_ie)) {
2315 wpa_printf(MSG_ERROR,
2316 "FILS: Not enough buffer room for own AssocReq elements");
2317 wpabuf_free(buf);
2318 return;
2319 }
2320 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2321 wpabuf_head(buf), wpabuf_len(buf));
2322 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
2323 wpabuf_free(buf);
2324 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
2325 wpa_s->sme.assoc_req_ie,
2326 wpa_s->sme.assoc_req_ie_len);
2327
2328 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
2329 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
2330 params.fils_nonces = nonces;
2331 params.fils_nonces_len = sizeof(nonces);
2332 }
2333 #endif /* CONFIG_FILS */
2334
2335 #ifdef CONFIG_OWE
2336 #ifdef CONFIG_TESTING_OPTIONS
2337 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
2338 WLAN_EID_EXT_OWE_DH_PARAM)) {
2339 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
2340 } else
2341 #endif /* CONFIG_TESTING_OPTIONS */
2342 if (auth_type == WLAN_AUTH_OPEN &&
2343 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
2344 struct wpabuf *owe_ie;
2345 u16 group;
2346
2347 if (ssid && ssid->owe_group) {
2348 group = ssid->owe_group;
2349 } else if (wpa_s->assoc_status_code ==
2350 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
2351 if (wpa_s->last_owe_group == 19)
2352 group = 20;
2353 else if (wpa_s->last_owe_group == 20)
2354 group = 21;
2355 else
2356 group = OWE_DH_GROUP;
2357 } else {
2358 group = OWE_DH_GROUP;
2359 }
2360
2361 wpa_s->last_owe_group = group;
2362 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
2363 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
2364 if (!owe_ie) {
2365 wpa_printf(MSG_ERROR,
2366 "OWE: Failed to build IE for Association Request frame");
2367 return;
2368 }
2369 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
2370 sizeof(wpa_s->sme.assoc_req_ie)) {
2371 wpa_printf(MSG_ERROR,
2372 "OWE: Not enough buffer room for own Association Request frame elements");
2373 wpabuf_free(owe_ie);
2374 return;
2375 }
2376 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2377 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
2378 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
2379 wpabuf_free(owe_ie);
2380 }
2381 #endif /* CONFIG_OWE */
2382
2383 #ifdef CONFIG_DPP2
2384 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
2385 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
2386 !ssid->dpp_pfs_fallback) {
2387 struct rsn_pmksa_cache_entry *pmksa;
2388
2389 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2390 if (!pmksa || !pmksa->dpp_pfs)
2391 goto pfs_fail;
2392
2393 dpp_pfs_free(wpa_s->dpp_pfs);
2394 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
2395 ssid->dpp_netaccesskey_len);
2396 if (!wpa_s->dpp_pfs) {
2397 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
2398 /* Try to continue without PFS */
2399 goto pfs_fail;
2400 }
2401 if (wpa_s->sme.assoc_req_ie_len +
2402 wpabuf_len(wpa_s->dpp_pfs->ie) >
2403 sizeof(wpa_s->sme.assoc_req_ie)) {
2404 wpa_printf(MSG_ERROR,
2405 "DPP: Not enough buffer room for own Association Request frame elements");
2406 dpp_pfs_free(wpa_s->dpp_pfs);
2407 wpa_s->dpp_pfs = NULL;
2408 goto pfs_fail;
2409 }
2410 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2411 wpabuf_head(wpa_s->dpp_pfs->ie),
2412 wpabuf_len(wpa_s->dpp_pfs->ie));
2413 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
2414 }
2415 pfs_fail:
2416 #endif /* CONFIG_DPP2 */
2417
2418 #ifndef CONFIG_NO_ROBUST_AV
2419 wpa_s->mscs_setup_done = false;
2420 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
2421 wpa_s->robust_av.valid_config) {
2422 struct wpabuf *mscs_ie;
2423 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
2424
2425 buf_len = 3 + /* MSCS descriptor IE header */
2426 1 + /* Request type */
2427 2 + /* User priority control */
2428 4 + /* Stream timeout */
2429 3 + /* TCLAS Mask IE header */
2430 wpa_s->robust_av.frame_classifier_len;
2431 mscs_ie = wpabuf_alloc(buf_len);
2432 if (!mscs_ie) {
2433 wpa_printf(MSG_INFO,
2434 "MSCS: Failed to allocate MSCS IE");
2435 goto mscs_fail;
2436 }
2437
2438 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
2439 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
2440 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
2441 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
2442 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
2443 mscs_ie_len = wpabuf_len(mscs_ie);
2444 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
2445 wpabuf_head(mscs_ie), mscs_ie_len);
2446 *wpa_ie_len += mscs_ie_len;
2447 }
2448
2449 wpabuf_free(mscs_ie);
2450 }
2451 mscs_fail:
2452 #endif /* CONFIG_NO_ROBUST_AV */
2453
2454 if (ssid && ssid->multi_ap_backhaul_sta) {
2455 size_t multi_ap_ie_len;
2456 struct multi_ap_params multi_ap = { 0 };
2457
2458 multi_ap.capability = MULTI_AP_BACKHAUL_STA;
2459 multi_ap.profile = ssid->multi_ap_profile;
2460
2461 multi_ap_ie_len = add_multi_ap_ie(
2462 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2463 sizeof(wpa_s->sme.assoc_req_ie) -
2464 wpa_s->sme.assoc_req_ie_len,
2465 &multi_ap);
2466 if (multi_ap_ie_len == 0) {
2467 wpa_printf(MSG_ERROR,
2468 "Multi-AP: Failed to build Multi-AP IE");
2469 return;
2470 }
2471 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
2472 }
2473
2474 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE_SUPPORT,
2475 wpas_rsn_overriding(wpa_s));
2476 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2477 RSN_OVERRIDE_NOT_USED);
2478 if (wpas_rsn_overriding(wpa_s) &&
2479 wpas_ap_supports_rsn_overriding(wpa_s, wpa_s->current_bss) &&
2480 wpa_s->sme.assoc_req_ie_len + 2 + 4 <=
2481 sizeof(wpa_s->sme.assoc_req_ie)) {
2482 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
2483 const u8 *ie;
2484 enum rsn_selection_variant variant = RSN_SELECTION_RSNE;
2485
2486 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2487 RSN_OVERRIDE_RSNE);
2488 ie = wpa_bss_get_rsne(wpa_s, wpa_s->current_bss, ssid,
2489 wpa_s->valid_links);
2490 if (ie && ie[0] == WLAN_EID_VENDOR_SPECIFIC && ie[1] >= 4) {
2491 u32 type;
2492
2493 type = WPA_GET_BE32(&ie[2]);
2494 if (type == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
2495 variant = RSN_SELECTION_RSNE_OVERRIDE;
2496 wpa_sm_set_param(wpa_s->wpa,
2497 WPA_PARAM_RSN_OVERRIDE,
2498 RSN_OVERRIDE_RSNE_OVERRIDE);
2499 } else if (type == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
2500 variant = RSN_SELECTION_RSNE_OVERRIDE_2;
2501 wpa_sm_set_param(wpa_s->wpa,
2502 WPA_PARAM_RSN_OVERRIDE,
2503 RSN_OVERRIDE_RSNE_OVERRIDE_2);
2504 }
2505 }
2506
2507 /* Indicate which RSNE variant was used */
2508 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
2509 *pos++ = 4 + 1;
2510 WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);
2511 pos += 4;
2512 *pos = variant;
2513 wpa_s->sme.assoc_req_ie_len += 2 + 4 + 1;
2514 }
2515
2516 params.bssid = bssid;
2517 params.ssid = wpa_s->sme.ssid;
2518 params.ssid_len = wpa_s->sme.ssid_len;
2519 params.freq.freq = wpa_s->sme.freq;
2520 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
2521 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
2522 wpa_s->sme.assoc_req_ie : NULL;
2523 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2524 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
2525 params.wpa_ie, params.wpa_ie_len);
2526 params.pairwise_suite = wpa_s->pairwise_cipher;
2527 params.group_suite = wpa_s->group_cipher;
2528 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
2529 params.key_mgmt_suite = wpa_s->key_mgmt;
2530 params.wpa_proto = wpa_s->wpa_proto;
2531 #ifdef CONFIG_HT_OVERRIDES
2532 os_memset(&htcaps, 0, sizeof(htcaps));
2533 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2534 params.htcaps = (u8 *) &htcaps;
2535 params.htcaps_mask = (u8 *) &htcaps_mask;
2536 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, ¶ms);
2537 #endif /* CONFIG_HT_OVERRIDES */
2538 #ifdef CONFIG_VHT_OVERRIDES
2539 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2540 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2541 params.vhtcaps = &vhtcaps;
2542 params.vhtcaps_mask = &vhtcaps_mask;
2543 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, ¶ms);
2544 #endif /* CONFIG_VHT_OVERRIDES */
2545 #ifdef CONFIG_HE_OVERRIDES
2546 wpa_supplicant_apply_he_overrides(wpa_s, ssid, ¶ms);
2547 #endif /* CONFIG_HE_OVERRIDES */
2548 wpa_supplicant_apply_eht_overrides(wpa_s, ssid, ¶ms);
2549 #ifdef CONFIG_IEEE80211R
2550 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
2551 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
2552 WLAN_EID_RIC_DATA)) {
2553 /* There seems to be a pretty inconvenient bug in the Linux
2554 * kernel IE splitting functionality when RIC is used. For now,
2555 * skip correct behavior in IE construction here (i.e., drop the
2556 * additional non-FT-specific IEs) to avoid kernel issues. This
2557 * is fine since RIC is used only for testing purposes in the
2558 * current implementation. */
2559 wpa_printf(MSG_INFO,
2560 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
2561 params.wpa_ie = wpa_s->sme.ft_ies;
2562 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
2563 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
2564 const u8 *rm_en, *pos, *end;
2565 size_t rm_en_len = 0;
2566 u8 *rm_en_dup = NULL, *wpos;
2567
2568 /* Remove RSNE, MDE, FTE to allow them to be overridden with
2569 * FT specific values */
2570 remove_ie(wpa_s->sme.assoc_req_ie,
2571 &wpa_s->sme.assoc_req_ie_len,
2572 WLAN_EID_RSN);
2573 remove_ie(wpa_s->sme.assoc_req_ie,
2574 &wpa_s->sme.assoc_req_ie_len,
2575 WLAN_EID_MOBILITY_DOMAIN);
2576 remove_ie(wpa_s->sme.assoc_req_ie,
2577 &wpa_s->sme.assoc_req_ie_len,
2578 WLAN_EID_FAST_BSS_TRANSITION);
2579 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
2580 wpa_s->sme.assoc_req_ie_len,
2581 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2582 if (rm_en) {
2583 /* Need to remove RM Enabled Capabilities element as
2584 * well temporarily, so that it can be placed between
2585 * RSNE and MDE. */
2586 rm_en_len = 2 + rm_en[1];
2587 rm_en_dup = os_memdup(rm_en, rm_en_len);
2588 remove_ie(wpa_s->sme.assoc_req_ie,
2589 &wpa_s->sme.assoc_req_ie_len,
2590 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2591 }
2592 wpa_hexdump(MSG_DEBUG,
2593 "SME: Association Request IEs after FT IE removal",
2594 wpa_s->sme.assoc_req_ie,
2595 wpa_s->sme.assoc_req_ie_len);
2596 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
2597 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
2598 wpa_printf(MSG_ERROR,
2599 "SME: Not enough buffer room for FT IEs in Association Request frame");
2600 os_free(rm_en_dup);
2601 return;
2602 }
2603
2604 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
2605 rm_en_len,
2606 wpa_s->sme.assoc_req_ie,
2607 wpa_s->sme.assoc_req_ie_len);
2608 pos = wpa_s->sme.ft_ies;
2609 end = pos + wpa_s->sme.ft_ies_len;
2610 wpos = wpa_s->sme.assoc_req_ie;
2611 if (*pos == WLAN_EID_RSN) {
2612 os_memcpy(wpos, pos, 2 + pos[1]);
2613 wpos += 2 + pos[1];
2614 pos += 2 + pos[1];
2615 }
2616 if (rm_en_dup) {
2617 os_memcpy(wpos, rm_en_dup, rm_en_len);
2618 wpos += rm_en_len;
2619 os_free(rm_en_dup);
2620 }
2621 os_memcpy(wpos, pos, end - pos);
2622 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
2623 rm_en_len;
2624 params.wpa_ie = wpa_s->sme.assoc_req_ie;
2625 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2626 wpa_hexdump(MSG_DEBUG,
2627 "SME: Association Request IEs after FT override",
2628 params.wpa_ie, params.wpa_ie_len);
2629 }
2630 #endif /* CONFIG_IEEE80211R */
2631 params.mode = mode;
2632 params.mgmt_frame_protection = wpa_s->sme.mfp;
2633 params.rrm_used = wpa_s->rrm.rrm_used;
2634 if (wpa_s->sme.prev_bssid_set)
2635 params.prev_bssid = wpa_s->sme.prev_bssid;
2636
2637 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2638 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
2639 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
2640 params.freq.freq);
2641
2642 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2643
2644 if (params.wpa_ie == NULL ||
2645 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
2646 < 0) {
2647 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
2648 os_memset(&elems, 0, sizeof(elems));
2649 }
2650 if (elems.rsn_ie) {
2651 params.wpa_proto = WPA_PROTO_RSN;
2652 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
2653 elems.rsn_ie_len + 2);
2654 } else if (elems.wpa_ie) {
2655 params.wpa_proto = WPA_PROTO_WPA;
2656 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
2657 elems.wpa_ie_len + 2);
2658 } else if (elems.osen) {
2659 params.wpa_proto = WPA_PROTO_OSEN;
2660 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
2661 elems.osen_len + 2);
2662 } else
2663 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2664 if (elems.rsnxe)
2665 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
2666 elems.rsnxe_len + 2);
2667 else
2668 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
2669 if (ssid && ssid->p2p_group)
2670 params.p2p = 1;
2671
2672 if (wpa_s->p2pdev->set_sta_uapsd)
2673 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2674 else
2675 params.uapsd = -1;
2676
2677 if (wpa_s->valid_links) {
2678 unsigned int i;
2679
2680 wpa_printf(MSG_DEBUG,
2681 "MLD: In association. assoc_link_id=%u, valid_links=0x%x",
2682 wpa_s->mlo_assoc_link_id, wpa_s->valid_links);
2683
2684 params.mld_params.mld_addr = wpa_s->ap_mld_addr;
2685 params.mld_params.valid_links = wpa_s->valid_links;
2686 params.mld_params.assoc_link_id = wpa_s->mlo_assoc_link_id;
2687 for_each_link(wpa_s->valid_links, i) {
2688 params.mld_params.mld_links[i].bssid =
2689 wpa_s->links[i].bssid;
2690 params.mld_params.mld_links[i].freq =
2691 wpa_s->links[i].freq;
2692 params.mld_params.mld_links[i].disabled =
2693 wpa_s->links[i].disabled;
2694
2695 wpa_printf(MSG_DEBUG,
2696 "MLD: id=%u, freq=%d, disabled=%u, " MACSTR,
2697 i, wpa_s->links[i].freq,
2698 wpa_s->links[i].disabled,
2699 MAC2STR(wpa_s->links[i].bssid));
2700 }
2701 }
2702
2703 if (wpa_drv_associate(wpa_s, ¶ms) < 0) {
2704 unsigned int n_failed_links = 0;
2705 int i;
2706
2707 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
2708 "driver failed");
2709
2710 /* Prepare list of failed links for error report */
2711 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
2712 if (!(wpa_s->valid_links & BIT(i)) ||
2713 wpa_s->mlo_assoc_link_id == i ||
2714 !params.mld_params.mld_links[i].error)
2715 continue;
2716
2717 wpa_bssid_ignore_add(wpa_s, wpa_s->links[i].bssid);
2718 n_failed_links++;
2719 }
2720
2721 if (n_failed_links) {
2722 /* Deauth and connect (possibly to the same AP MLD) */
2723 wpa_drv_deauthenticate(wpa_s, wpa_s->ap_mld_addr,
2724 WLAN_REASON_DEAUTH_LEAVING);
2725 wpas_connect_work_done(wpa_s);
2726 wpa_supplicant_mark_disassoc(wpa_s);
2727 wpas_request_connection(wpa_s);
2728 } else {
2729 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2730 NULL);
2731 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2732 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2733 }
2734 return;
2735 }
2736
2737 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
2738 NULL);
2739
2740 #ifdef CONFIG_TESTING_OPTIONS
2741 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
2742 wpa_s->last_assoc_req_wpa_ie = NULL;
2743 if (params.wpa_ie)
2744 wpa_s->last_assoc_req_wpa_ie =
2745 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
2746 #endif /* CONFIG_TESTING_OPTIONS */
2747 }
2748
2749
sme_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)2750 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2751 const u8 *ies, size_t ies_len)
2752 {
2753 if (md == NULL || ies == NULL) {
2754 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
2755 os_free(wpa_s->sme.ft_ies);
2756 wpa_s->sme.ft_ies = NULL;
2757 wpa_s->sme.ft_ies_len = 0;
2758 wpa_s->sme.ft_used = 0;
2759 return 0;
2760 }
2761
2762 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
2763 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
2764 os_free(wpa_s->sme.ft_ies);
2765 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
2766 if (wpa_s->sme.ft_ies == NULL)
2767 return -1;
2768 wpa_s->sme.ft_ies_len = ies_len;
2769 return 0;
2770 }
2771
2772
sme_deauth(struct wpa_supplicant * wpa_s,const u8 ** link_bssids)2773 static void sme_deauth(struct wpa_supplicant *wpa_s, const u8 **link_bssids)
2774 {
2775 int bssid_changed;
2776 const u8 *bssid;
2777
2778 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2779
2780 if (wpa_s->valid_links)
2781 bssid = wpa_s->ap_mld_addr;
2782 else
2783 bssid = wpa_s->pending_bssid;
2784
2785 if (wpa_drv_deauthenticate(wpa_s, bssid,
2786 WLAN_REASON_DEAUTH_LEAVING) < 0) {
2787 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
2788 "failed");
2789 }
2790 wpa_s->sme.prev_bssid_set = 0;
2791
2792 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, link_bssids);
2793 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2794 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2795 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2796 if (bssid_changed)
2797 wpas_notify_bssid_changed(wpa_s);
2798 }
2799
2800
sme_assoc_comeback_timer(void * eloop_ctx,void * timeout_ctx)2801 static void sme_assoc_comeback_timer(void *eloop_ctx, void *timeout_ctx)
2802 {
2803 struct wpa_supplicant *wpa_s = eloop_ctx;
2804
2805 if (!wpa_s->current_bss || !wpa_s->current_ssid) {
2806 wpa_msg(wpa_s, MSG_DEBUG,
2807 "SME: Comeback timeout expired; SSID/BSSID cleared; ignoring");
2808 return;
2809 }
2810
2811 wpa_msg(wpa_s, MSG_DEBUG,
2812 "SME: Comeback timeout expired; retry associating with "
2813 MACSTR "; mode=%d auth_type=%u",
2814 MAC2STR(wpa_s->current_bss->bssid),
2815 wpa_s->current_ssid->mode,
2816 wpa_s->sme.assoc_auth_type);
2817
2818 /* Authentication state was completed already; just try association
2819 * again. */
2820 sme_associate(wpa_s, wpa_s->current_ssid->mode,
2821 wpa_s->current_bss->bssid,
2822 wpa_s->sme.assoc_auth_type);
2823 }
2824
2825
sme_try_assoc_comeback(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2826 static bool sme_try_assoc_comeback(struct wpa_supplicant *wpa_s,
2827 union wpa_event_data *data)
2828 {
2829 struct ieee802_11_elems elems;
2830 u32 timeout_interval;
2831 unsigned long comeback_usec;
2832 u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
2833
2834 #ifdef CONFIG_TESTING_OPTIONS
2835 if (wpa_s->test_assoc_comeback_type != -1)
2836 type = wpa_s->test_assoc_comeback_type;
2837 #endif /* CONFIG_TESTING_OPTIONS */
2838
2839 if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
2840 data->assoc_reject.resp_ies_len,
2841 &elems, 0) == ParseFailed) {
2842 wpa_msg(wpa_s, MSG_INFO,
2843 "SME: Temporary assoc reject: failed to parse (Re)Association Response frame elements");
2844 return false;
2845 }
2846
2847 if (!elems.timeout_int) {
2848 wpa_msg(wpa_s, MSG_INFO,
2849 "SME: Temporary assoc reject: missing timeout interval IE");
2850 return false;
2851 }
2852
2853 if (elems.timeout_int[0] != type) {
2854 wpa_msg(wpa_s, MSG_INFO,
2855 "SME: Temporary assoc reject: missing association comeback time");
2856 return false;
2857 }
2858
2859 timeout_interval = WPA_GET_LE32(&elems.timeout_int[1]);
2860 if (timeout_interval > 60000) {
2861 /* This is unprotected information and there is no point in
2862 * getting stuck waiting for very long duration based on it */
2863 wpa_msg(wpa_s, MSG_DEBUG,
2864 "SME: Ignore overly long association comeback interval: %u TUs",
2865 timeout_interval);
2866 return false;
2867 }
2868 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association comeback interval: %u TUs",
2869 timeout_interval);
2870
2871 comeback_usec = timeout_interval * 1024;
2872 eloop_register_timeout(comeback_usec / 1000000, comeback_usec % 1000000,
2873 sme_assoc_comeback_timer, wpa_s, NULL);
2874 return true;
2875 }
2876
2877
sme_event_assoc_reject(struct wpa_supplicant * wpa_s,union wpa_event_data * data,const u8 ** link_bssids)2878 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
2879 union wpa_event_data *data,
2880 const u8 **link_bssids)
2881 {
2882 const u8 *bssid;
2883
2884 if (wpa_s->valid_links)
2885 bssid = wpa_s->ap_mld_addr;
2886 else
2887 bssid = wpa_s->pending_bssid;
2888
2889 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
2890 "status code %d", MAC2STR(wpa_s->pending_bssid),
2891 data->assoc_reject.status_code);
2892
2893 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2894 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
2895
2896 /* Authentication phase has been completed at this point. Check whether
2897 * the AP rejected association temporarily due to still holding a
2898 * security associationis with us (MFP). If so, we must wait for the
2899 * AP's association comeback timeout period before associating again. */
2900 if (data->assoc_reject.status_code ==
2901 WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
2902 wpa_msg(wpa_s, MSG_DEBUG,
2903 "SME: Temporary association reject from BSS " MACSTR,
2904 MAC2STR(bssid));
2905 if (sme_try_assoc_comeback(wpa_s, data)) {
2906 /* Break out early; comeback error is not a failure. */
2907 return;
2908 }
2909 }
2910
2911 #ifdef CONFIG_SAE
2912 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
2913 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
2914 wpa_dbg(wpa_s, MSG_DEBUG,
2915 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
2916 wpa_sm_aborted_cached(wpa_s->wpa);
2917 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
2918 if (wpa_s->current_bss) {
2919 struct wpa_bss *bss = wpa_s->current_bss;
2920 struct wpa_ssid *ssid = wpa_s->current_ssid;
2921
2922 wpa_drv_deauthenticate(wpa_s, bssid,
2923 WLAN_REASON_DEAUTH_LEAVING);
2924 wpas_connect_work_done(wpa_s);
2925 wpa_supplicant_mark_disassoc(wpa_s);
2926 wpa_supplicant_connect(wpa_s, bss, ssid);
2927 return;
2928 }
2929 }
2930 #endif /* CONFIG_SAE */
2931
2932 #ifdef CONFIG_DPP
2933 if (wpa_s->current_ssid &&
2934 wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_DPP &&
2935 !data->assoc_reject.timed_out &&
2936 data->assoc_reject.status_code == WLAN_STATUS_INVALID_PMKID) {
2937 struct rsn_pmksa_cache_entry *pmksa;
2938
2939 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2940 if (pmksa) {
2941 wpa_dbg(wpa_s, MSG_DEBUG,
2942 "DPP: Drop PMKSA cache entry for the BSS due to invalid PMKID report");
2943 wpa_sm_pmksa_cache_remove(wpa_s->wpa, pmksa);
2944 }
2945 wpa_sm_aborted_cached(wpa_s->wpa);
2946 if (wpa_s->current_bss) {
2947 struct wpa_bss *bss = wpa_s->current_bss;
2948 struct wpa_ssid *ssid = wpa_s->current_ssid;
2949
2950 wpa_dbg(wpa_s, MSG_DEBUG,
2951 "DPP: Try network introduction again");
2952 wpas_connect_work_done(wpa_s);
2953 wpa_supplicant_mark_disassoc(wpa_s);
2954 wpa_supplicant_connect(wpa_s, bss, ssid);
2955 return;
2956 }
2957 }
2958 #endif /* CONFIG_DPP */
2959
2960 /*
2961 * For now, unconditionally terminate the previous authentication. In
2962 * theory, this should not be needed, but mac80211 gets quite confused
2963 * if the authentication is left pending.. Some roaming cases might
2964 * benefit from using the previous authentication, so this could be
2965 * optimized in the future.
2966 */
2967 sme_deauth(wpa_s, link_bssids);
2968 }
2969
2970
sme_event_auth_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2971 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
2972 union wpa_event_data *data)
2973 {
2974 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
2975 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2976 wpa_supplicant_mark_disassoc(wpa_s);
2977 }
2978
2979
sme_event_assoc_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2980 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
2981 union wpa_event_data *data)
2982 {
2983 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
2984 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2985 wpa_supplicant_mark_disassoc(wpa_s);
2986 }
2987
2988
sme_event_disassoc(struct wpa_supplicant * wpa_s,struct disassoc_info * info)2989 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
2990 struct disassoc_info *info)
2991 {
2992 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
2993 if (wpa_s->sme.prev_bssid_set) {
2994 /*
2995 * cfg80211/mac80211 can get into somewhat confused state if
2996 * the AP only disassociates us and leaves us in authenticated
2997 * state. For now, force the state to be cleared to avoid
2998 * confusing errors if we try to associate with the AP again.
2999 */
3000 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
3001 "driver state");
3002 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
3003 WLAN_REASON_DEAUTH_LEAVING);
3004 }
3005 }
3006
3007
sme_auth_timer(void * eloop_ctx,void * timeout_ctx)3008 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
3009 {
3010 struct wpa_supplicant *wpa_s = eloop_ctx;
3011 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
3012 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
3013 sme_deauth(wpa_s, NULL);
3014 }
3015 }
3016
3017
sme_assoc_timer(void * eloop_ctx,void * timeout_ctx)3018 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
3019 {
3020 struct wpa_supplicant *wpa_s = eloop_ctx;
3021 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
3022 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
3023 sme_deauth(wpa_s, NULL);
3024 }
3025 }
3026
3027
sme_state_changed(struct wpa_supplicant * wpa_s)3028 void sme_state_changed(struct wpa_supplicant *wpa_s)
3029 {
3030 /* Make sure timers are cleaned up appropriately. */
3031 if (wpa_s->wpa_state != WPA_ASSOCIATING) {
3032 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3033 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3034 }
3035 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
3036 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3037 }
3038
3039
sme_clear_on_disassoc(struct wpa_supplicant * wpa_s)3040 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
3041 {
3042 wpa_s->sme.prev_bssid_set = 0;
3043 #ifdef CONFIG_SAE
3044 wpabuf_free(wpa_s->sme.sae_token);
3045 wpa_s->sme.sae_token = NULL;
3046 sae_clear_data(&wpa_s->sme.sae);
3047 #endif /* CONFIG_SAE */
3048 #ifdef CONFIG_IEEE80211R
3049 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
3050 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
3051 #endif /* CONFIG_IEEE80211R */
3052 sme_stop_sa_query(wpa_s);
3053 }
3054
3055
sme_deinit(struct wpa_supplicant * wpa_s)3056 void sme_deinit(struct wpa_supplicant *wpa_s)
3057 {
3058 sme_clear_on_disassoc(wpa_s);
3059 #ifdef CONFIG_SAE
3060 os_free(wpa_s->sme.sae_rejected_groups);
3061 wpa_s->sme.sae_rejected_groups = NULL;
3062 #endif /* CONFIG_SAE */
3063
3064 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3065 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3066 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3067 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3068 }
3069
3070
sme_send_2040_bss_coex(struct wpa_supplicant * wpa_s,const u8 * chan_list,u8 num_channels,u8 num_intol)3071 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
3072 const u8 *chan_list, u8 num_channels,
3073 u8 num_intol)
3074 {
3075 struct ieee80211_2040_bss_coex_ie *bc_ie;
3076 struct ieee80211_2040_intol_chan_report *ic_report;
3077 struct wpabuf *buf;
3078
3079 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
3080 " (num_channels=%u num_intol=%u)",
3081 MAC2STR(wpa_s->bssid), num_channels, num_intol);
3082 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
3083 chan_list, num_channels);
3084
3085 buf = wpabuf_alloc(2 + /* action.category + action_code */
3086 sizeof(struct ieee80211_2040_bss_coex_ie) +
3087 sizeof(struct ieee80211_2040_intol_chan_report) +
3088 num_channels);
3089 if (buf == NULL)
3090 return;
3091
3092 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
3093 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
3094
3095 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
3096 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
3097 bc_ie->length = 1;
3098 if (num_intol)
3099 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
3100
3101 if (num_channels > 0) {
3102 ic_report = wpabuf_put(buf, sizeof(*ic_report));
3103 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
3104 ic_report->length = num_channels + 1;
3105 ic_report->op_class = 0;
3106 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
3107 num_channels);
3108 }
3109
3110 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3111 wpa_s->own_addr, wpa_s->bssid,
3112 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
3113 wpa_msg(wpa_s, MSG_INFO,
3114 "SME: Failed to send 20/40 BSS Coexistence frame");
3115 }
3116
3117 wpabuf_free(buf);
3118 }
3119
3120
sme_proc_obss_scan(struct wpa_supplicant * wpa_s)3121 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
3122 {
3123 struct wpa_bss *bss;
3124 const u8 *ie;
3125 u16 ht_cap;
3126 u8 chan_list[P2P_MAX_CHANNELS], channel;
3127 u8 num_channels = 0, num_intol = 0, i;
3128
3129 if (!wpa_s->sme.sched_obss_scan)
3130 return 0;
3131
3132 wpa_s->sme.sched_obss_scan = 0;
3133 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
3134 return 1;
3135
3136 /*
3137 * Check whether AP uses regulatory triplet or channel triplet in
3138 * country info. Right now the operating class of the BSS channel
3139 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
3140 * based on the assumption that operating class triplet is not used in
3141 * beacon frame. If the First Channel Number/Operating Extension
3142 * Identifier octet has a positive integer value of 201 or greater,
3143 * then its operating class triplet.
3144 *
3145 * TODO: If Supported Operating Classes element is present in beacon
3146 * frame, have to lookup operating class in Annex E and fill them in
3147 * 2040 coex frame.
3148 */
3149 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
3150 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
3151 return 1;
3152
3153 os_memset(chan_list, 0, sizeof(chan_list));
3154
3155 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
3156 /* Skip other band bss */
3157 enum hostapd_hw_mode mode;
3158 mode = ieee80211_freq_to_chan(bss->freq, &channel);
3159 if (mode != HOSTAPD_MODE_IEEE80211G &&
3160 mode != HOSTAPD_MODE_IEEE80211B)
3161 continue;
3162
3163 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
3164 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
3165 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
3166 " freq=%u chan=%u ht_cap=0x%x",
3167 MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
3168
3169 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
3170 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
3171 num_intol++;
3172
3173 /* Check whether the channel is already considered */
3174 for (i = 0; i < num_channels; i++) {
3175 if (channel == chan_list[i])
3176 break;
3177 }
3178 if (i != num_channels)
3179 continue;
3180
3181 chan_list[num_channels++] = channel;
3182 }
3183 }
3184
3185 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
3186 return 1;
3187 }
3188
3189
wpa_obss_scan_freqs_list(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)3190 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
3191 struct wpa_driver_scan_params *params)
3192 {
3193 /* Include only affected channels */
3194 struct hostapd_hw_modes *mode;
3195 int count, i;
3196 int start, end;
3197
3198 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
3199 HOSTAPD_MODE_IEEE80211G, false);
3200 if (mode == NULL) {
3201 /* No channels supported in this band - use empty list */
3202 params->freqs = os_zalloc(sizeof(int));
3203 return;
3204 }
3205
3206 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
3207 wpa_s->current_bss) {
3208 const u8 *ie;
3209
3210 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
3211 if (ie && ie[1] >= 2) {
3212 u8 o;
3213
3214 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
3215 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
3216 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
3217 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
3218 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
3219 }
3220 }
3221
3222 start = wpa_s->assoc_freq - 10;
3223 end = wpa_s->assoc_freq + 10;
3224 switch (wpa_s->sme.ht_sec_chan) {
3225 case HT_SEC_CHAN_UNKNOWN:
3226 /* HT40+ possible on channels 1..9 */
3227 if (wpa_s->assoc_freq <= 2452)
3228 start -= 20;
3229 /* HT40- possible on channels 5-13 */
3230 if (wpa_s->assoc_freq >= 2432)
3231 end += 20;
3232 break;
3233 case HT_SEC_CHAN_ABOVE:
3234 end += 20;
3235 break;
3236 case HT_SEC_CHAN_BELOW:
3237 start -= 20;
3238 break;
3239 }
3240 wpa_printf(MSG_DEBUG,
3241 "OBSS: assoc_freq %d possible affected range %d-%d",
3242 wpa_s->assoc_freq, start, end);
3243
3244 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
3245 if (params->freqs == NULL)
3246 return;
3247 for (count = 0, i = 0; i < mode->num_channels; i++) {
3248 int freq;
3249
3250 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
3251 continue;
3252 freq = mode->channels[i].freq;
3253 if (freq - 10 >= end || freq + 10 <= start)
3254 continue; /* not affected */
3255 params->freqs[count++] = freq;
3256 }
3257 }
3258
3259
sme_obss_scan_timeout(void * eloop_ctx,void * timeout_ctx)3260 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3261 {
3262 struct wpa_supplicant *wpa_s = eloop_ctx;
3263 struct wpa_driver_scan_params params;
3264
3265 if (!wpa_s->current_bss) {
3266 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
3267 return;
3268 }
3269
3270 os_memset(¶ms, 0, sizeof(params));
3271 wpa_obss_scan_freqs_list(wpa_s, ¶ms);
3272 params.low_priority = 1;
3273 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
3274
3275 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms, true, false))
3276 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
3277 else
3278 wpa_s->sme.sched_obss_scan = 1;
3279 os_free(params.freqs);
3280
3281 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3282 sme_obss_scan_timeout, wpa_s, NULL);
3283 }
3284
3285
sme_sched_obss_scan(struct wpa_supplicant * wpa_s,int enable)3286 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
3287 {
3288 const u8 *ie;
3289 struct wpa_bss *bss = wpa_s->current_bss;
3290 struct wpa_ssid *ssid = wpa_s->current_ssid;
3291 struct hostapd_hw_modes *hw_mode = NULL;
3292 int i;
3293
3294 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3295 wpa_s->sme.sched_obss_scan = 0;
3296 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
3297 if (!enable)
3298 return;
3299
3300 /*
3301 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
3302 * or it expects OBSS scan to be performed by wpa_supplicant.
3303 */
3304 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
3305 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
3306 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
3307 return;
3308
3309 #ifdef CONFIG_HT_OVERRIDES
3310 /* No need for OBSS scan if HT40 is explicitly disabled */
3311 if (ssid->disable_ht40)
3312 return;
3313 #endif /* CONFIG_HT_OVERRIDES */
3314
3315 if (!wpa_s->hw.modes)
3316 return;
3317
3318 /* only HT caps in 11g mode are relevant */
3319 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3320 hw_mode = &wpa_s->hw.modes[i];
3321 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
3322 break;
3323 }
3324
3325 /* Driver does not support HT40 for 11g or doesn't have 11g. */
3326 if (i == wpa_s->hw.num_modes || !hw_mode ||
3327 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3328 return;
3329
3330 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
3331 return; /* Not associated on 2.4 GHz band */
3332
3333 /* Check whether AP supports HT40 */
3334 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
3335 if (!ie || ie[1] < 2 ||
3336 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3337 return; /* AP does not support HT40 */
3338
3339 ie = wpa_bss_get_ie(wpa_s->current_bss,
3340 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
3341 if (!ie || ie[1] < 14)
3342 return; /* AP does not request OBSS scans */
3343
3344 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
3345 if (wpa_s->sme.obss_scan_int < 10) {
3346 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
3347 "replaced with the minimum 10 sec",
3348 wpa_s->sme.obss_scan_int);
3349 wpa_s->sme.obss_scan_int = 10;
3350 }
3351 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
3352 wpa_s->sme.obss_scan_int);
3353 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3354 sme_obss_scan_timeout, wpa_s, NULL);
3355 }
3356
3357
3358 static const unsigned int sa_query_max_timeout = 1000;
3359 static const unsigned int sa_query_retry_timeout = 201;
3360 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
3361
sme_check_sa_query_timeout(struct wpa_supplicant * wpa_s)3362 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
3363 {
3364 u32 tu;
3365 struct os_reltime now, passed;
3366 os_get_reltime(&now);
3367 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
3368 tu = (passed.sec * 1000000 + passed.usec) / 1024;
3369 if (sa_query_max_timeout < tu) {
3370 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
3371 sme_stop_sa_query(wpa_s);
3372 wpa_supplicant_deauthenticate(
3373 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
3374 return 1;
3375 }
3376
3377 return 0;
3378 }
3379
3380
sme_send_sa_query_req(struct wpa_supplicant * wpa_s,const u8 * trans_id)3381 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
3382 const u8 *trans_id)
3383 {
3384 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3385 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3386
3387 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
3388 MACSTR, MAC2STR(wpa_s->bssid));
3389 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
3390 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3391 req[0] = WLAN_ACTION_SA_QUERY;
3392 req[1] = WLAN_SA_QUERY_REQUEST;
3393 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3394
3395 #ifdef CONFIG_OCV
3396 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3397 struct wpa_channel_info ci;
3398
3399 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3400 wpa_printf(MSG_WARNING,
3401 "Failed to get channel info for OCI element in SA Query Request frame");
3402 return;
3403 }
3404
3405 #ifdef CONFIG_TESTING_OPTIONS
3406 if (wpa_s->oci_freq_override_saquery_req) {
3407 wpa_printf(MSG_INFO,
3408 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
3409 ci.frequency,
3410 wpa_s->oci_freq_override_saquery_req);
3411 ci.frequency = wpa_s->oci_freq_override_saquery_req;
3412 }
3413 #endif /* CONFIG_TESTING_OPTIONS */
3414
3415 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
3416 return;
3417
3418 req_len += OCV_OCI_EXTENDED_LEN;
3419 }
3420 #endif /* CONFIG_OCV */
3421
3422 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3423 wpa_s->own_addr, wpa_s->bssid,
3424 req, req_len, 0) < 0)
3425 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
3426 "Request");
3427 }
3428
3429
sme_sa_query_timer(void * eloop_ctx,void * timeout_ctx)3430 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
3431 {
3432 struct wpa_supplicant *wpa_s = eloop_ctx;
3433 unsigned int timeout, sec, usec;
3434 u8 *trans_id, *nbuf;
3435
3436 if (wpa_s->sme.sa_query_count > 0 &&
3437 sme_check_sa_query_timeout(wpa_s))
3438 return;
3439
3440 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
3441 wpa_s->sme.sa_query_count + 1,
3442 WLAN_SA_QUERY_TR_ID_LEN);
3443 if (nbuf == NULL) {
3444 sme_stop_sa_query(wpa_s);
3445 return;
3446 }
3447 if (wpa_s->sme.sa_query_count == 0) {
3448 /* Starting a new SA Query procedure */
3449 os_get_reltime(&wpa_s->sme.sa_query_start);
3450 }
3451 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
3452 wpa_s->sme.sa_query_trans_id = nbuf;
3453 wpa_s->sme.sa_query_count++;
3454
3455 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
3456 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
3457 sme_stop_sa_query(wpa_s);
3458 return;
3459 }
3460
3461 timeout = sa_query_retry_timeout;
3462 sec = ((timeout / 1000) * 1024) / 1000;
3463 usec = (timeout % 1000) * 1024;
3464 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
3465
3466 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
3467 wpa_s->sme.sa_query_count);
3468
3469 sme_send_sa_query_req(wpa_s, trans_id);
3470 }
3471
3472
sme_start_sa_query(struct wpa_supplicant * wpa_s)3473 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
3474 {
3475 sme_sa_query_timer(wpa_s, NULL);
3476 }
3477
3478
sme_stop_sa_query(struct wpa_supplicant * wpa_s)3479 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
3480 {
3481 if (wpa_s->sme.sa_query_trans_id)
3482 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
3483 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
3484 os_free(wpa_s->sme.sa_query_trans_id);
3485 wpa_s->sme.sa_query_trans_id = NULL;
3486 wpa_s->sme.sa_query_count = 0;
3487 }
3488
3489
sme_event_unprot_disconnect(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * da,u16 reason_code)3490 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
3491 const u8 *da, u16 reason_code)
3492 {
3493 struct wpa_ssid *ssid;
3494 struct os_reltime now;
3495
3496 if (wpa_s->wpa_state != WPA_COMPLETED)
3497 return;
3498 ssid = wpa_s->current_ssid;
3499 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
3500 return;
3501 if (!ether_addr_equal(sa, wpa_s->bssid))
3502 return;
3503 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
3504 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
3505 return;
3506 if (wpa_s->sme.sa_query_count > 0)
3507 return;
3508 #ifdef CONFIG_TESTING_OPTIONS
3509 if (wpa_s->disable_sa_query)
3510 return;
3511 #endif /* CONFIG_TESTING_OPTIONS */
3512
3513 os_get_reltime(&now);
3514 if (wpa_s->sme.last_unprot_disconnect.sec &&
3515 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
3516 return; /* limit SA Query procedure frequency */
3517 wpa_s->sme.last_unprot_disconnect = now;
3518
3519 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
3520 "possible AP/STA state mismatch - trigger SA Query");
3521 sme_start_sa_query(wpa_s);
3522 }
3523
3524
sme_event_ch_switch(struct wpa_supplicant * wpa_s)3525 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
3526 {
3527 unsigned int usec;
3528 u32 _rand;
3529
3530 if (wpa_s->wpa_state != WPA_COMPLETED ||
3531 !wpa_sm_ocv_enabled(wpa_s->wpa))
3532 return;
3533
3534 wpa_dbg(wpa_s, MSG_DEBUG,
3535 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
3536 sme_stop_sa_query(wpa_s);
3537
3538 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
3539 _rand = os_random();
3540 usec = _rand % (sa_query_ch_switch_max_delay + 1);
3541 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
3542 }
3543
3544
sme_process_sa_query_request(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3545 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
3546 const u8 *sa, const u8 *data,
3547 size_t len)
3548 {
3549 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3550 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3551
3552 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
3553 MACSTR, MAC2STR(wpa_s->bssid));
3554
3555 resp[0] = WLAN_ACTION_SA_QUERY;
3556 resp[1] = WLAN_SA_QUERY_RESPONSE;
3557 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
3558
3559 #ifdef CONFIG_OCV
3560 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3561 struct wpa_channel_info ci;
3562
3563 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3564 wpa_printf(MSG_WARNING,
3565 "Failed to get channel info for OCI element in SA Query Response frame");
3566 return;
3567 }
3568
3569 #ifdef CONFIG_TESTING_OPTIONS
3570 if (wpa_s->oci_freq_override_saquery_resp) {
3571 wpa_printf(MSG_INFO,
3572 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
3573 ci.frequency,
3574 wpa_s->oci_freq_override_saquery_resp);
3575 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
3576 }
3577 #endif /* CONFIG_TESTING_OPTIONS */
3578
3579 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
3580 return;
3581
3582 resp_len += OCV_OCI_EXTENDED_LEN;
3583 }
3584 #endif /* CONFIG_OCV */
3585
3586 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3587 wpa_s->own_addr, wpa_s->bssid,
3588 resp, resp_len, 0) < 0)
3589 wpa_msg(wpa_s, MSG_INFO,
3590 "SME: Failed to send SA Query Response");
3591 }
3592
3593
sme_process_sa_query_response(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3594 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
3595 const u8 *sa, const u8 *data,
3596 size_t len)
3597 {
3598 int i;
3599
3600 if (!wpa_s->sme.sa_query_trans_id)
3601 return;
3602
3603 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
3604 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3605
3606 if (!ether_addr_equal(sa, wpa_s->bssid))
3607 return;
3608
3609 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
3610 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
3611 i * WLAN_SA_QUERY_TR_ID_LEN,
3612 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
3613 break;
3614 }
3615
3616 if (i >= wpa_s->sme.sa_query_count) {
3617 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
3618 "transaction identifier found");
3619 return;
3620 }
3621
3622 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
3623 "from " MACSTR, MAC2STR(sa));
3624 sme_stop_sa_query(wpa_s);
3625 }
3626
3627
sme_sa_query_rx(struct wpa_supplicant * wpa_s,const u8 * da,const u8 * sa,const u8 * data,size_t len)3628 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
3629 const u8 *data, size_t len)
3630 {
3631 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
3632 return;
3633 if (is_multicast_ether_addr(da)) {
3634 wpa_printf(MSG_DEBUG,
3635 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
3636 MAC2STR(da), MAC2STR(sa));
3637 return;
3638 }
3639
3640 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
3641 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3642
3643 #ifdef CONFIG_OCV
3644 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3645 struct ieee802_11_elems elems;
3646 struct wpa_channel_info ci;
3647
3648 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
3649 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
3650 &elems, 1) == ParseFailed) {
3651 wpa_printf(MSG_DEBUG,
3652 "SA Query: Failed to parse elements");
3653 return;
3654 }
3655
3656 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3657 wpa_printf(MSG_WARNING,
3658 "Failed to get channel info to validate received OCI in SA Query Action frame");
3659 return;
3660 }
3661
3662 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
3663 channel_width_to_int(ci.chanwidth),
3664 ci.seg1_idx) != OCI_SUCCESS) {
3665 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
3666 " frame=saquery%s error=%s",
3667 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
3668 "req" : "resp", ocv_errorstr);
3669 return;
3670 }
3671 }
3672 #endif /* CONFIG_OCV */
3673
3674 if (data[0] == WLAN_SA_QUERY_REQUEST)
3675 sme_process_sa_query_request(wpa_s, sa, data, len);
3676 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
3677 sme_process_sa_query_response(wpa_s, sa, data, len);
3678 }
3679