1 /*
2 * wpa_supplicant - SME
3 * Copyright (c) 2009-2024, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/eloop.h"
13 #include "utils/ext_password.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/ieee802_11_common.h"
16 #include "common/ocv.h"
17 #include "eapol_supp/eapol_supp_sm.h"
18 #include "common/wpa_common.h"
19 #include "common/sae.h"
20 #include "common/dpp.h"
21 #include "rsn_supp/wpa.h"
22 #include "rsn_supp/pmksa_cache.h"
23 #include "config.h"
24 #include "wpa_supplicant_i.h"
25 #include "driver_i.h"
26 #include "wpas_glue.h"
27 #include "wps_supplicant.h"
28 #include "p2p_supplicant.h"
29 #include "notify.h"
30 #include "bss.h"
31 #include "bssid_ignore.h"
32 #include "scan.h"
33 #include "sme.h"
34 #include "hs20_supplicant.h"
35
36 #define SME_AUTH_TIMEOUT 5
37 #define SME_ASSOC_TIMEOUT 5
38
39 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
40 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
41 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
42 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
43
44
45 #ifdef CONFIG_SAE
46
index_within_array(const int * array,int idx)47 static int index_within_array(const int *array, int idx)
48 {
49 int i;
50 for (i = 0; i < idx; i++) {
51 if (array[i] <= 0)
52 return 0;
53 }
54 return 1;
55 }
56
57
sme_set_sae_group(struct wpa_supplicant * wpa_s,bool external)58 static int sme_set_sae_group(struct wpa_supplicant *wpa_s, bool external)
59 {
60 int *groups = wpa_s->conf->sae_groups;
61 int default_groups[] = { 19, 20, 21, 0 };
62
63 if (!groups || groups[0] <= 0)
64 groups = default_groups;
65
66 /* Configuration may have changed, so validate current index */
67 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
68 return -1;
69
70 for (;;) {
71 int group = groups[wpa_s->sme.sae_group_index];
72 if (group <= 0)
73 break;
74 if (!int_array_includes(wpa_s->sme.sae_rejected_groups,
75 group) &&
76 sae_set_group(&wpa_s->sme.sae, group) == 0) {
77 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
78 wpa_s->sme.sae.group);
79 wpa_s->sme.sae.akmp = external ?
80 wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
81 return 0;
82 }
83 wpa_s->sme.sae_group_index++;
84 }
85
86 return -1;
87 }
88
89
sme_auth_build_sae_commit(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,const u8 * bssid,const u8 * mld_addr,int external,int reuse,int * ret_use_pt,bool * ret_use_pk)90 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
91 struct wpa_ssid *ssid,
92 const u8 *bssid,
93 const u8 *mld_addr,
94 int external,
95 int reuse, int *ret_use_pt,
96 bool *ret_use_pk)
97 {
98 struct wpabuf *buf;
99 size_t len;
100 char *password = NULL;
101 struct wpa_bss *bss;
102 int use_pt = 0;
103 bool use_pk = false;
104 u8 rsnxe_capa = 0;
105 int key_mgmt = external ? wpa_s->sme.ext_auth_key_mgmt :
106 wpa_s->key_mgmt;
107 const u8 *addr = mld_addr ? mld_addr : bssid;
108
109 if (ret_use_pt)
110 *ret_use_pt = 0;
111 if (ret_use_pk)
112 *ret_use_pk = false;
113
114 #ifdef CONFIG_TESTING_OPTIONS
115 if (wpa_s->sae_commit_override) {
116 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
117 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
118 if (!buf)
119 goto fail;
120 if (!external) {
121 wpabuf_put_le16(buf, 1); /* Transaction seq# */
122 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
123 }
124 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
125 return buf;
126 }
127 #endif /* CONFIG_TESTING_OPTIONS */
128
129 if (ssid->sae_password) {
130 password = os_strdup(ssid->sae_password);
131 if (!password) {
132 wpa_dbg(wpa_s, MSG_INFO,
133 "SAE: Failed to allocate password");
134 goto fail;
135 }
136 }
137 if (!password && ssid->passphrase) {
138 password = os_strdup(ssid->passphrase);
139 if (!password) {
140 wpa_dbg(wpa_s, MSG_INFO,
141 "SAE: Failed to allocate password");
142 goto fail;
143 }
144 }
145 if (!password && ssid->ext_psk) {
146 struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
147 ssid->ext_psk);
148
149 if (!pw) {
150 wpa_msg(wpa_s, MSG_INFO,
151 "SAE: No password found from external storage");
152 goto fail;
153 }
154
155 password = os_malloc(wpabuf_len(pw) + 1);
156 if (!password) {
157 wpa_dbg(wpa_s, MSG_INFO,
158 "SAE: Failed to allocate password");
159 goto fail;
160 }
161 os_memcpy(password, wpabuf_head(pw), wpabuf_len(pw));
162 password[wpabuf_len(pw)] = '\0';
163 ext_password_free(pw);
164 }
165 if (!password) {
166 wpa_printf(MSG_DEBUG, "SAE: No password available");
167 goto fail;
168 }
169
170 if (reuse && wpa_s->sme.sae.tmp &&
171 ether_addr_equal(addr, wpa_s->sme.sae.tmp->bssid)) {
172 wpa_printf(MSG_DEBUG,
173 "SAE: Reuse previously generated PWE on a retry with the same AP");
174 use_pt = wpa_s->sme.sae.h2e;
175 use_pk = wpa_s->sme.sae.pk;
176 goto reuse_data;
177 }
178 if (sme_set_sae_group(wpa_s, external) < 0) {
179 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
180 goto fail;
181 }
182
183 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
184 if (!bss) {
185 wpa_printf(MSG_DEBUG,
186 "SAE: BSS not available, update scan result to get BSS");
187 wpa_supplicant_update_scan_results(wpa_s, bssid);
188 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
189 }
190 if (bss) {
191 const u8 *rsnxe;
192
193 rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
194 if (rsnxe && rsnxe[0] == WLAN_EID_VENDOR_SPECIFIC &&
195 rsnxe[1] >= 1 + 4)
196 rsnxe_capa = rsnxe[2 + 4];
197 else if (rsnxe && rsnxe[1] >= 1)
198 rsnxe_capa = rsnxe[2];
199 }
200
201 if (ssid->sae_password_id &&
202 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
203 use_pt = 1;
204 if (wpa_key_mgmt_sae_ext_key(key_mgmt) &&
205 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
206 use_pt = 1;
207 if (bss && is_6ghz_freq(bss->freq) &&
208 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
209 use_pt = 1;
210 #ifdef CONFIG_SAE_PK
211 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
212 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
213 ((ssid->sae_password &&
214 sae_pk_valid_password(ssid->sae_password)) ||
215 (!ssid->sae_password && ssid->passphrase &&
216 sae_pk_valid_password(ssid->passphrase)))) {
217 use_pt = 1;
218 use_pk = true;
219 }
220
221 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
222 wpa_printf(MSG_DEBUG,
223 "SAE: Cannot use PK with the selected AP");
224 goto fail;
225 }
226 #endif /* CONFIG_SAE_PK */
227
228 if (use_pt || wpa_s->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
229 wpa_s->conf->sae_pwe == SAE_PWE_BOTH) {
230 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
231
232 if ((wpa_s->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
233 ssid->sae_password_id ||
234 wpa_key_mgmt_sae_ext_key(key_mgmt)) &&
235 wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK &&
236 !use_pt) {
237 wpa_printf(MSG_DEBUG,
238 "SAE: Cannot use H2E with the selected AP");
239 goto fail;
240 }
241 }
242
243 if (use_pt && !ssid->pt)
244 wpa_s_setup_sae_pt(wpa_s->conf, ssid, true);
245 if (use_pt &&
246 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
247 wpa_s->own_addr, addr,
248 wpa_s->sme.sae_rejected_groups, NULL) < 0)
249 goto fail;
250 if (!use_pt &&
251 sae_prepare_commit(wpa_s->own_addr, addr,
252 (u8 *) password, os_strlen(password),
253 &wpa_s->sme.sae) < 0) {
254 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
255 goto fail;
256 }
257 if (wpa_s->sme.sae.tmp) {
258 os_memcpy(wpa_s->sme.sae.tmp->bssid, addr, ETH_ALEN);
259 if (use_pt && use_pk)
260 wpa_s->sme.sae.pk = 1;
261 #ifdef CONFIG_SAE_PK
262 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
263 ETH_ALEN);
264 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, addr, ETH_ALEN);
265 sae_pk_set_password(&wpa_s->sme.sae, password);
266 #endif /* CONFIG_SAE_PK */
267 }
268
269 reuse_data:
270 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
271 if (ssid->sae_password_id)
272 len += 4 + os_strlen(ssid->sae_password_id);
273 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
274 if (buf == NULL)
275 goto fail;
276 if (!external) {
277 wpabuf_put_le16(buf, 1); /* Transaction seq# */
278 if (use_pk)
279 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
280 else if (use_pt)
281 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
282 else
283 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
284 }
285 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
286 ssid->sae_password_id) < 0) {
287 wpabuf_free(buf);
288 goto fail;
289 }
290 if (ret_use_pt)
291 *ret_use_pt = use_pt;
292 if (ret_use_pk)
293 *ret_use_pk = use_pk;
294
295 str_clear_free(password);
296 return buf;
297
298 fail:
299 str_clear_free(password);
300 return NULL;
301 }
302
303
sme_auth_build_sae_confirm(struct wpa_supplicant * wpa_s,int external)304 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
305 int external)
306 {
307 struct wpabuf *buf;
308
309 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
310 if (buf == NULL)
311 return NULL;
312
313 if (!external) {
314 wpabuf_put_le16(buf, 2); /* Transaction seq# */
315 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
316 }
317 sae_write_confirm(&wpa_s->sme.sae, buf);
318
319 return buf;
320 }
321
322 #endif /* CONFIG_SAE */
323
324
325 /**
326 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
327 * @wpa_s: Pointer to wpa_supplicant data
328 * @bss: Pointer to the bss which is the target of authentication attempt
329 */
sme_auth_handle_rrm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)330 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
331 struct wpa_bss *bss)
332 {
333 const u8 rrm_ie_len = 5;
334 u8 *pos;
335 const u8 *rrm_ie;
336
337 wpa_s->rrm.rrm_used = 0;
338
339 wpa_printf(MSG_DEBUG,
340 "RRM: Determining whether RRM can be used - device support: 0x%x",
341 wpa_s->drv_rrm_flags);
342
343 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
344 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
345 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
346 return;
347 }
348
349 if (!((wpa_s->drv_rrm_flags &
350 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
351 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
352 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
353 wpa_printf(MSG_DEBUG,
354 "RRM: Insufficient RRM support in driver - do not use RRM");
355 return;
356 }
357
358 if (sizeof(wpa_s->sme.assoc_req_ie) <
359 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
360 wpa_printf(MSG_INFO,
361 "RRM: Unable to use RRM, no room for RRM IE");
362 return;
363 }
364
365 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
366 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
367 os_memset(pos, 0, 2 + rrm_ie_len);
368 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
369 *pos++ = rrm_ie_len;
370
371 /* Set supported capabilities flags */
372 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
373 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
374
375 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
376 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
377 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
378
379 if (wpa_s->lci)
380 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
381
382 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
383 wpa_s->rrm.rrm_used = 1;
384 }
385
386
wpas_ml_handle_removed_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)387 static void wpas_ml_handle_removed_links(struct wpa_supplicant *wpa_s,
388 struct wpa_bss *bss)
389 {
390 u16 removed_links = wpa_bss_parse_reconf_ml_element(wpa_s, bss);
391
392 wpa_s->valid_links &= ~removed_links;
393 }
394
395
396 #ifdef CONFIG_TESTING_OPTIONS
wpas_ml_connect_pref(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)397 static struct wpa_bss * wpas_ml_connect_pref(struct wpa_supplicant *wpa_s,
398 struct wpa_bss *bss,
399 struct wpa_ssid *ssid)
400 {
401 unsigned int low, high, i;
402
403 wpa_printf(MSG_DEBUG,
404 "MLD: valid_links=%d, band_pref=%u, bssid_pref=" MACSTR,
405 wpa_s->valid_links,
406 wpa_s->conf->mld_connect_band_pref,
407 MAC2STR(wpa_s->conf->mld_connect_bssid_pref));
408
409 /* Check if there are more than one link */
410 if (!(wpa_s->valid_links & (wpa_s->valid_links - 1)))
411 return bss;
412
413 if (!is_zero_ether_addr(wpa_s->conf->mld_connect_bssid_pref)) {
414 for_each_link(wpa_s->valid_links, i) {
415 if (wpa_s->mlo_assoc_link_id == i)
416 continue;
417
418 if (ether_addr_equal(
419 wpa_s->links[i].bssid,
420 wpa_s->conf->mld_connect_bssid_pref))
421 goto found;
422 }
423 }
424
425 if (wpa_s->conf->mld_connect_band_pref == MLD_CONNECT_BAND_PREF_AUTO)
426 return bss;
427
428 switch (wpa_s->conf->mld_connect_band_pref) {
429 case MLD_CONNECT_BAND_PREF_2GHZ:
430 low = 2412;
431 high = 2472;
432 break;
433 case MLD_CONNECT_BAND_PREF_5GHZ:
434 low = 5180;
435 high = 5985;
436 break;
437 case MLD_CONNECT_BAND_PREF_6GHZ:
438 low = 5955;
439 high = 7125;
440 break;
441 default:
442 return bss;
443 }
444
445 for_each_link(wpa_s->valid_links, i) {
446 if (wpa_s->mlo_assoc_link_id == i)
447 continue;
448
449 if (wpa_s->links[i].freq >= low && wpa_s->links[i].freq <= high)
450 goto found;
451 }
452
453 found:
454 if (i == MAX_NUM_MLD_LINKS) {
455 wpa_printf(MSG_DEBUG, "MLD: No match for connect/band pref");
456 return bss;
457 }
458
459 wpa_printf(MSG_DEBUG,
460 "MLD: Change BSS for connect: " MACSTR " -> " MACSTR,
461 MAC2STR(wpa_s->links[wpa_s->mlo_assoc_link_id].bssid),
462 MAC2STR(wpa_s->links[i].bssid));
463
464 /* Get the BSS entry and do the switch */
465 if (ssid && ssid->ssid_len)
466 bss = wpa_bss_get(wpa_s, wpa_s->links[i].bssid, ssid->ssid,
467 ssid->ssid_len);
468 else
469 bss = wpa_bss_get_bssid(wpa_s, wpa_s->links[i].bssid);
470 wpa_s->mlo_assoc_link_id = i;
471
472 return bss;
473 }
474 #endif /* CONFIG_TESTING_OPTIONS */
475
476
wpas_sme_ml_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data,int ie_offset)477 static int wpas_sme_ml_auth(struct wpa_supplicant *wpa_s,
478 union wpa_event_data *data,
479 int ie_offset)
480 {
481 struct ieee802_11_elems elems;
482 const u8 *mld_addr;
483 u16 status_code = data->auth.status_code;
484
485 if (!wpa_s->valid_links)
486 return 0;
487
488 if (ieee802_11_parse_elems(data->auth.ies + ie_offset,
489 data->auth.ies_len - ie_offset,
490 &elems, 0) == ParseFailed) {
491 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
492 return -1;
493 }
494
495 if (!elems.basic_mle || !elems.basic_mle_len) {
496 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
497 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
498 status_code == WLAN_STATUS_SUCCESS ||
499 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
500 status_code == WLAN_STATUS_SAE_PK)
501 return -1;
502 /* Accept missing Multi-Link element in failed authentication
503 * cases. */
504 return 0;
505 }
506
507 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
508 if (!mld_addr)
509 return -1;
510
511 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
512
513 if (!ether_addr_equal(wpa_s->ap_mld_addr, mld_addr)) {
514 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
515 MACSTR ")", MAC2STR(wpa_s->ap_mld_addr));
516 return -1;
517 }
518
519 return 0;
520 }
521
522
wpas_sme_set_mlo_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)523 static void wpas_sme_set_mlo_links(struct wpa_supplicant *wpa_s,
524 struct wpa_bss *bss, struct wpa_ssid *ssid)
525 {
526 u8 i;
527
528 wpa_s->valid_links = 0;
529 wpa_s->mlo_assoc_link_id = bss->mld_link_id;
530
531 for_each_link(bss->valid_links, i) {
532 const u8 *bssid = bss->mld_links[i].bssid;
533
534 wpa_s->valid_links |= BIT(i);
535 os_memcpy(wpa_s->links[i].bssid, bssid, ETH_ALEN);
536 wpa_s->links[i].freq = bss->mld_links[i].freq;
537 wpa_s->links[i].disabled = bss->mld_links[i].disabled;
538
539 if (bss->mld_link_id == i)
540 wpa_s->links[i].bss = bss;
541 else if (ssid && ssid->ssid_len)
542 wpa_s->links[i].bss = wpa_bss_get(wpa_s, bssid,
543 ssid->ssid,
544 ssid->ssid_len);
545 else
546 wpa_s->links[i].bss = wpa_bss_get_bssid(wpa_s, bssid);
547 }
548 }
549
550
sme_send_authentication(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,int start)551 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
552 struct wpa_bss *bss, struct wpa_ssid *ssid,
553 int start)
554 {
555 struct wpa_driver_auth_params params;
556 struct wpa_ssid *old_ssid;
557 #ifdef CONFIG_IEEE80211R
558 const u8 *ie;
559 #endif /* CONFIG_IEEE80211R */
560 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
561 const u8 *md = NULL;
562 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
563 int bssid_changed;
564 struct wpabuf *resp = NULL;
565 u8 ext_capab[18];
566 int ext_capab_len;
567 int skip_auth;
568 u8 *wpa_ie;
569 size_t wpa_ie_len;
570 #ifdef CONFIG_MBO
571 const u8 *mbo_ie;
572 #endif /* CONFIG_MBO */
573 int omit_rsnxe = 0;
574
575 if (bss == NULL) {
576 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
577 "the network");
578 wpas_connect_work_done(wpa_s);
579 return;
580 }
581
582 os_memset(¶ms, 0, sizeof(params));
583
584 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
585 !wpa_bss_parse_basic_ml_element(wpa_s, bss, wpa_s->ap_mld_addr,
586 NULL, ssid, NULL) &&
587 bss->valid_links) {
588 wpa_printf(MSG_DEBUG, "MLD: In authentication");
589 wpas_sme_set_mlo_links(wpa_s, bss, ssid);
590
591 #ifdef CONFIG_TESTING_OPTIONS
592 bss = wpas_ml_connect_pref(wpa_s, bss, ssid);
593
594 if (wpa_s->conf->mld_force_single_link) {
595 wpa_printf(MSG_DEBUG, "MLD: Force single link");
596 wpa_s->valid_links = BIT(wpa_s->mlo_assoc_link_id);
597 }
598 #endif /* CONFIG_TESTING_OPTIONS */
599 params.mld = true;
600 params.mld_link_id = wpa_s->mlo_assoc_link_id;
601 params.ap_mld_addr = wpa_s->ap_mld_addr;
602 wpas_ml_handle_removed_links(wpa_s, bss);
603 }
604
605 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
606 wpa_s->reassoc_same_bss;
607 wpa_s->current_bss = bss;
608
609 wpa_s->reassociate = 0;
610
611 params.freq = bss->freq;
612 params.bssid = bss->bssid;
613 params.ssid = bss->ssid;
614 params.ssid_len = bss->ssid_len;
615 params.p2p = ssid->p2p_group;
616
617 if (wpa_s->sme.ssid_len != params.ssid_len ||
618 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
619 wpa_s->sme.prev_bssid_set = 0;
620
621 wpa_s->sme.freq = params.freq;
622 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
623 wpa_s->sme.ssid_len = params.ssid_len;
624
625 params.auth_alg = WPA_AUTH_ALG_OPEN;
626 #ifdef IEEE8021X_EAPOL
627 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
628 if (ssid->leap) {
629 if (ssid->non_leap == 0)
630 params.auth_alg = WPA_AUTH_ALG_LEAP;
631 else
632 params.auth_alg |= WPA_AUTH_ALG_LEAP;
633 }
634 }
635 #endif /* IEEE8021X_EAPOL */
636 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
637 params.auth_alg);
638 if (ssid->auth_alg) {
639 params.auth_alg = ssid->auth_alg;
640 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
641 "0x%x", params.auth_alg);
642 }
643 #ifdef CONFIG_SAE
644 wpa_s->sme.sae_pmksa_caching = 0;
645 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
646 const u8 *rsn;
647 struct wpa_ie_data ied;
648
649 rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
650 if (!rsn) {
651 wpa_dbg(wpa_s, MSG_DEBUG,
652 "SAE enabled, but target BSS does not advertise RSN");
653 #ifdef CONFIG_DPP
654 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
655 (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
656 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
657 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
658 #endif /* CONFIG_DPP */
659 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
660 wpa_key_mgmt_sae(ied.key_mgmt)) {
661 if (wpas_is_sae_avoided(wpa_s, ssid, &ied)) {
662 wpa_dbg(wpa_s, MSG_DEBUG,
663 "SAE enabled, but disallowing SAE auth_alg without PMF");
664 } else {
665 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
666 params.auth_alg = WPA_AUTH_ALG_SAE;
667 }
668 } else {
669 wpa_dbg(wpa_s, MSG_DEBUG,
670 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
671 }
672 }
673 #endif /* CONFIG_SAE */
674
675 #ifdef CONFIG_WEP
676 {
677 int i;
678
679 for (i = 0; i < NUM_WEP_KEYS; i++) {
680 if (ssid->wep_key_len[i])
681 params.wep_key[i] = ssid->wep_key[i];
682 params.wep_key_len[i] = ssid->wep_key_len[i];
683 }
684 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
685 }
686 #endif /* CONFIG_WEP */
687
688 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
689 wpa_bss_get_rsne(wpa_s, bss, ssid, false)) &&
690 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
691 int try_opportunistic;
692 const u8 *cache_id = NULL;
693
694 try_opportunistic = (ssid->proactive_key_caching < 0 ?
695 wpa_s->conf->okc :
696 ssid->proactive_key_caching) &&
697 (ssid->proto & WPA_PROTO_RSN);
698 #ifdef CONFIG_FILS
699 if (wpa_key_mgmt_fils(ssid->key_mgmt))
700 cache_id = wpa_bss_get_fils_cache_id(bss);
701 #endif /* CONFIG_FILS */
702 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
703 params.mld ? params.ap_mld_addr :
704 bss->bssid,
705 wpa_s->current_ssid,
706 try_opportunistic, cache_id,
707 0, false) == 0)
708 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
709 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
710 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
711 wpa_s->sme.assoc_req_ie,
712 &wpa_s->sme.assoc_req_ie_len,
713 false)) {
714 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
715 "key management and encryption suites");
716 wpas_connect_work_done(wpa_s);
717 return;
718 }
719 #ifdef CONFIG_HS20
720 } else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
721 (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
722 /* No PMKSA caching, but otherwise similar to RSN/WPA */
723 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
724 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
725 wpa_s->sme.assoc_req_ie,
726 &wpa_s->sme.assoc_req_ie_len,
727 false)) {
728 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
729 "key management and encryption suites");
730 wpas_connect_work_done(wpa_s);
731 return;
732 }
733 #endif /* CONFIG_HS20 */
734 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
735 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
736 /*
737 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
738 * use non-WPA since the scan results did not indicate that the
739 * AP is using WPA or WPA2.
740 */
741 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
742 wpa_s->sme.assoc_req_ie_len = 0;
743 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
744 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
745 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
746 wpa_s->sme.assoc_req_ie,
747 &wpa_s->sme.assoc_req_ie_len,
748 false)) {
749 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
750 "key management and encryption suites (no "
751 "scan results)");
752 wpas_connect_work_done(wpa_s);
753 return;
754 }
755 #ifdef CONFIG_WPS
756 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
757 struct wpabuf *wps_ie;
758 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
759 if (wps_ie && wpabuf_len(wps_ie) <=
760 sizeof(wpa_s->sme.assoc_req_ie)) {
761 wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
762 os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
763 wpa_s->sme.assoc_req_ie_len);
764 } else
765 wpa_s->sme.assoc_req_ie_len = 0;
766 wpabuf_free(wps_ie);
767 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
768 #endif /* CONFIG_WPS */
769 } else {
770 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
771 wpa_s->sme.assoc_req_ie_len = 0;
772 }
773
774 /* In case the WPA vendor IE is used, it should be placed after all the
775 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
776 * defined in the standard. Store the WPA IE so it can later be
777 * inserted at the correct location.
778 */
779 wpa_ie = NULL;
780 wpa_ie_len = 0;
781 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
782 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
783 wpa_s->sme.assoc_req_ie_len);
784 if (wpa_ie) {
785 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
786
787 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
788 wpa_s->sme.assoc_req_ie_len = 0;
789 } else {
790 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
791 wpas_connect_work_done(wpa_s);
792 return;
793 }
794 }
795
796 #ifdef CONFIG_IEEE80211R
797 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
798 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
799 md = ie + 2;
800 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
801 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
802 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
803 md = NULL;
804 if (md) {
805 /* Prepare for the next transition */
806 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
807 }
808
809 if (md) {
810 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
811 md[0], md[1]);
812
813 omit_rsnxe = !wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
814 if (wpa_s->sme.assoc_req_ie_len + 5 <
815 sizeof(wpa_s->sme.assoc_req_ie)) {
816 struct rsn_mdie *mdie;
817 u8 *pos = wpa_s->sme.assoc_req_ie +
818 wpa_s->sme.assoc_req_ie_len;
819 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
820 *pos++ = sizeof(*mdie);
821 mdie = (struct rsn_mdie *) pos;
822 os_memcpy(mdie->mobility_domain, md,
823 MOBILITY_DOMAIN_ID_LEN);
824 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
825 wpa_s->sme.assoc_req_ie_len += 5;
826 }
827
828 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
829 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
830 wpa_sm_has_ft_keys(wpa_s->wpa, md)) {
831 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
832 "over-the-air");
833 params.auth_alg = WPA_AUTH_ALG_FT;
834 params.ie = wpa_s->sme.ft_ies;
835 params.ie_len = wpa_s->sme.ft_ies_len;
836 }
837 }
838 #endif /* CONFIG_IEEE80211R */
839
840 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
841 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
842 const u8 *rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
843 struct wpa_ie_data _ie;
844 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
845 _ie.capabilities &
846 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
847 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
848 "MFP: require MFP");
849 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
850 }
851 }
852
853 #ifdef CONFIG_P2P
854 if (wpa_s->global->p2p) {
855 u8 *pos;
856 size_t len;
857 int res;
858 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
859 len = sizeof(wpa_s->sme.assoc_req_ie) -
860 wpa_s->sme.assoc_req_ie_len;
861 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
862 ssid->p2p_group);
863 if (res >= 0)
864 wpa_s->sme.assoc_req_ie_len += res;
865 }
866 #endif /* CONFIG_P2P */
867
868 #ifdef CONFIG_FST
869 if (wpa_s->fst_ies) {
870 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
871
872 if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
873 sizeof(wpa_s->sme.assoc_req_ie)) {
874 os_memcpy(wpa_s->sme.assoc_req_ie +
875 wpa_s->sme.assoc_req_ie_len,
876 wpabuf_head(wpa_s->fst_ies),
877 fst_ies_len);
878 wpa_s->sme.assoc_req_ie_len += fst_ies_len;
879 }
880 }
881 #endif /* CONFIG_FST */
882
883 sme_auth_handle_rrm(wpa_s, bss);
884
885 #ifndef CONFIG_NO_RRM
886 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
887 wpa_s, ssid, bss,
888 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
889 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
890 #endif /* CONFIG_NO_RRM */
891
892 if (params.p2p)
893 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
894 else
895 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
896
897 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
898 sizeof(ext_capab), bss);
899 if (ext_capab_len > 0) {
900 u8 *pos = wpa_s->sme.assoc_req_ie;
901 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
902 pos += 2 + pos[1];
903 os_memmove(pos + ext_capab_len, pos,
904 wpa_s->sme.assoc_req_ie_len -
905 (pos - wpa_s->sme.assoc_req_ie));
906 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
907 os_memcpy(pos, ext_capab, ext_capab_len);
908 }
909
910 if (ssid->max_idle && wpa_s->sme.assoc_req_ie_len + 5 <=
911 sizeof(wpa_s->sme.assoc_req_ie)) {
912 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
913
914 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
915 *pos++ = 3;
916 WPA_PUT_LE16(pos, ssid->max_idle);
917 pos += 2;
918 *pos = 0; /* Idle Options */
919 wpa_s->sme.assoc_req_ie_len += 5;
920 }
921
922 #ifdef CONFIG_TESTING_OPTIONS
923 if (wpa_s->rsnxe_override_assoc &&
924 wpabuf_len(wpa_s->rsnxe_override_assoc) <=
925 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
926 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
927 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
928 wpabuf_head(wpa_s->rsnxe_override_assoc),
929 wpabuf_len(wpa_s->rsnxe_override_assoc));
930 wpa_s->sme.assoc_req_ie_len +=
931 wpabuf_len(wpa_s->rsnxe_override_assoc);
932 } else
933 #endif /* CONFIG_TESTING_OPTIONS */
934 if (wpa_s->rsnxe_len > 0 &&
935 wpa_s->rsnxe_len <=
936 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
937 !omit_rsnxe) {
938 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
939 wpa_s->rsnxe, wpa_s->rsnxe_len);
940 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
941 }
942
943 #ifdef CONFIG_HS20
944 if (is_hs20_network(wpa_s, ssid, bss)) {
945 struct wpabuf *hs20;
946
947 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
948 if (hs20) {
949 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
950 size_t len;
951
952 wpas_hs20_add_indication(hs20, pps_mo_id,
953 get_hs20_version(bss));
954 wpas_hs20_add_roam_cons_sel(hs20, ssid);
955 len = sizeof(wpa_s->sme.assoc_req_ie) -
956 wpa_s->sme.assoc_req_ie_len;
957 if (wpabuf_len(hs20) <= len) {
958 os_memcpy(wpa_s->sme.assoc_req_ie +
959 wpa_s->sme.assoc_req_ie_len,
960 wpabuf_head(hs20), wpabuf_len(hs20));
961 wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
962 }
963 wpabuf_free(hs20);
964 }
965 }
966 #endif /* CONFIG_HS20 */
967
968 if (wpa_ie) {
969 size_t len;
970
971 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
972
973 len = sizeof(wpa_s->sme.assoc_req_ie) -
974 wpa_s->sme.assoc_req_ie_len;
975
976 if (len > wpa_ie_len) {
977 os_memcpy(wpa_s->sme.assoc_req_ie +
978 wpa_s->sme.assoc_req_ie_len,
979 wpa_ie, wpa_ie_len);
980 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
981 } else {
982 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
983 }
984
985 os_free(wpa_ie);
986 }
987
988 if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
989 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
990 size_t len;
991
992 len = sizeof(wpa_s->sme.assoc_req_ie) -
993 wpa_s->sme.assoc_req_ie_len;
994 if (wpabuf_len(buf) <= len) {
995 os_memcpy(wpa_s->sme.assoc_req_ie +
996 wpa_s->sme.assoc_req_ie_len,
997 wpabuf_head(buf), wpabuf_len(buf));
998 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
999 }
1000 }
1001
1002 #ifdef CONFIG_MBO
1003 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
1004 if (!wpa_s->disable_mbo_oce && mbo_ie) {
1005 int len;
1006
1007 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
1008 wpa_s->sme.assoc_req_ie_len,
1009 sizeof(wpa_s->sme.assoc_req_ie) -
1010 wpa_s->sme.assoc_req_ie_len,
1011 !!mbo_attr_from_mbo_ie(mbo_ie,
1012 OCE_ATTR_ID_CAPA_IND));
1013 if (len >= 0)
1014 wpa_s->sme.assoc_req_ie_len += len;
1015 }
1016 #endif /* CONFIG_MBO */
1017
1018 #ifdef CONFIG_SAE
1019 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
1020 pmksa_cache_set_current(wpa_s->wpa, NULL,
1021 params.mld ? params.ap_mld_addr :
1022 bss->bssid,
1023 ssid, 0,
1024 NULL,
1025 wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
1026 wpa_s->key_mgmt :
1027 (int) WPA_KEY_MGMT_SAE, false) == 0) {
1028 wpa_dbg(wpa_s, MSG_DEBUG,
1029 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
1030 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1031 params.auth_alg = WPA_AUTH_ALG_OPEN;
1032 wpa_s->sme.sae_pmksa_caching = 1;
1033 }
1034
1035 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
1036 if (start)
1037 resp = sme_auth_build_sae_commit(wpa_s, ssid,
1038 bss->bssid,
1039 params.mld ?
1040 params.ap_mld_addr :
1041 NULL, 0,
1042 start == 2, NULL,
1043 NULL);
1044 else
1045 resp = sme_auth_build_sae_confirm(wpa_s, 0);
1046 if (resp == NULL) {
1047 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1048 return;
1049 }
1050 params.auth_data = wpabuf_head(resp);
1051 params.auth_data_len = wpabuf_len(resp);
1052 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
1053 }
1054 #endif /* CONFIG_SAE */
1055
1056 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1057 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1058 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1059 if (bssid_changed)
1060 wpas_notify_bssid_changed(wpa_s);
1061
1062 old_ssid = wpa_s->current_ssid;
1063 wpa_s->current_ssid = ssid;
1064 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
1065 wpa_sm_set_ssid(wpa_s->wpa, bss->ssid, bss->ssid_len);
1066 wpa_supplicant_initiate_eapol(wpa_s);
1067
1068 #ifdef CONFIG_FILS
1069 /* TODO: FILS operations can in some cases be done between different
1070 * network_ctx (i.e., same credentials can be used with multiple
1071 * networks). */
1072 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
1073 wpa_key_mgmt_fils(ssid->key_mgmt)) {
1074 const u8 *indic;
1075 u16 fils_info;
1076 const u8 *realm, *username, *rrk;
1077 size_t realm_len, username_len, rrk_len;
1078 u16 next_seq_num;
1079
1080 /*
1081 * Check FILS Indication element (FILS Information field) bits
1082 * indicating supported authentication algorithms against local
1083 * configuration (ssid->fils_dh_group). Try to use FILS
1084 * authentication only if the AP supports the combination in the
1085 * network profile. */
1086 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
1087 if (!indic || indic[1] < 2) {
1088 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1089 " does not include FILS Indication element - cannot use FILS authentication with it",
1090 MAC2STR(bss->bssid));
1091 goto no_fils;
1092 }
1093
1094 fils_info = WPA_GET_LE16(indic + 2);
1095 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
1096 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1097 " does not support FILS SK without PFS - cannot use FILS authentication with it",
1098 MAC2STR(bss->bssid));
1099 goto no_fils;
1100 }
1101 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
1102 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1103 " does not support FILS SK with PFS - cannot use FILS authentication with it",
1104 MAC2STR(bss->bssid));
1105 goto no_fils;
1106 }
1107
1108 if (wpa_s->last_con_fail_realm &&
1109 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
1110 &username, &username_len,
1111 &realm, &realm_len, &next_seq_num,
1112 &rrk, &rrk_len) == 0 &&
1113 realm && realm_len == wpa_s->last_con_fail_realm_len &&
1114 os_memcmp(realm, wpa_s->last_con_fail_realm,
1115 realm_len) == 0) {
1116 wpa_printf(MSG_DEBUG,
1117 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
1118 goto no_fils;
1119 }
1120
1121 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
1122 params.mld ? params.ap_mld_addr :
1123 bss->bssid,
1124 ssid, 0,
1125 wpa_bss_get_fils_cache_id(bss),
1126 0, false) == 0)
1127 wpa_printf(MSG_DEBUG,
1128 "SME: Try to use FILS with PMKSA caching");
1129 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
1130 if (resp) {
1131 int auth_alg;
1132
1133 if (ssid->fils_dh_group)
1134 wpa_printf(MSG_DEBUG,
1135 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
1136 ssid->fils_dh_group);
1137 else
1138 wpa_printf(MSG_DEBUG,
1139 "SME: Try to use FILS SK authentication without PFS");
1140 auth_alg = ssid->fils_dh_group ?
1141 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
1142 params.auth_alg = auth_alg;
1143 params.auth_data = wpabuf_head(resp);
1144 params.auth_data_len = wpabuf_len(resp);
1145 wpa_s->sme.auth_alg = auth_alg;
1146 }
1147 }
1148 no_fils:
1149 #endif /* CONFIG_FILS */
1150
1151 wpa_supplicant_cancel_sched_scan(wpa_s);
1152 wpa_supplicant_cancel_scan(wpa_s);
1153
1154 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
1155 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
1156 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
1157
1158 eapol_sm_notify_portValid(wpa_s->eapol, false);
1159 wpa_clear_keys(wpa_s, bss->bssid);
1160 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1161 if (old_ssid != wpa_s->current_ssid)
1162 wpas_notify_network_changed(wpa_s);
1163
1164 #ifdef CONFIG_HS20
1165 hs20_configure_frame_filters(wpa_s);
1166 #endif /* CONFIG_HS20 */
1167
1168 #ifdef CONFIG_P2P
1169 /*
1170 * If multi-channel concurrency is not supported, check for any
1171 * frequency conflict. In case of any frequency conflict, remove the
1172 * least prioritized connection.
1173 */
1174 if (wpa_s->num_multichan_concurrent < 2) {
1175 int freq, num;
1176 num = get_shared_radio_freqs(wpa_s, &freq, 1, false);
1177 if (num > 0 && freq > 0 && freq != params.freq) {
1178 wpa_printf(MSG_DEBUG,
1179 "Conflicting frequency found (%d != %d)",
1180 freq, params.freq);
1181 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
1182 params.freq,
1183 ssid) < 0) {
1184 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1185 wpa_supplicant_mark_disassoc(wpa_s);
1186 wpabuf_free(resp);
1187 wpas_connect_work_done(wpa_s);
1188 return;
1189 }
1190 }
1191 }
1192 #endif /* CONFIG_P2P */
1193
1194 if (skip_auth) {
1195 wpa_msg(wpa_s, MSG_DEBUG,
1196 "SME: Skip authentication step on reassoc-to-same-BSS");
1197 wpabuf_free(resp);
1198 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
1199 return;
1200 }
1201
1202
1203 wpa_s->sme.auth_alg = params.auth_alg;
1204 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) {
1205 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
1206 "driver failed");
1207 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1208 wpa_supplicant_mark_disassoc(wpa_s);
1209 wpabuf_free(resp);
1210 wpas_connect_work_done(wpa_s);
1211 return;
1212 }
1213
1214 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
1215 NULL);
1216
1217 /*
1218 * Association will be started based on the authentication event from
1219 * the driver.
1220 */
1221
1222 wpabuf_free(resp);
1223 }
1224
1225
sme_auth_start_cb(struct wpa_radio_work * work,int deinit)1226 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
1227 {
1228 struct wpa_connect_work *cwork = work->ctx;
1229 struct wpa_supplicant *wpa_s = work->wpa_s;
1230
1231 wpa_s->roam_in_progress = false;
1232 #ifdef CONFIG_WNM
1233 wpa_s->bss_trans_mgmt_in_progress = false;
1234 #endif /* CONFIG_WNM */
1235
1236 if (deinit) {
1237 if (work->started)
1238 wpa_s->connect_work = NULL;
1239
1240 wpas_connect_work_free(cwork);
1241 return;
1242 }
1243
1244 wpa_s->connect_work = work;
1245
1246 if (cwork->bss_removed ||
1247 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
1248 wpas_network_disabled(wpa_s, cwork->ssid)) {
1249 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
1250 wpas_connect_work_done(wpa_s);
1251 return;
1252 }
1253
1254 /* Starting new connection, so clear the possibly used WPA IE from the
1255 * previous association. */
1256 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1257 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
1258 wpa_s->rsnxe_len = 0;
1259
1260 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
1261 wpas_notify_auth_changed(wpa_s);
1262 }
1263
1264
sme_authenticate(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)1265 void sme_authenticate(struct wpa_supplicant *wpa_s,
1266 struct wpa_bss *bss, struct wpa_ssid *ssid)
1267 {
1268 struct wpa_connect_work *cwork;
1269
1270 if (bss == NULL || ssid == NULL)
1271 return;
1272 if (wpa_s->connect_work) {
1273 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
1274 return;
1275 }
1276
1277 if (wpa_s->roam_in_progress) {
1278 wpa_dbg(wpa_s, MSG_DEBUG,
1279 "SME: Reject sme_authenticate() in favor of explicit roam request");
1280 return;
1281 }
1282 #ifdef CONFIG_WNM
1283 if (wpa_s->bss_trans_mgmt_in_progress) {
1284 wpa_dbg(wpa_s, MSG_DEBUG,
1285 "SME: Reject sme_authenticate() in favor of BSS transition management request");
1286 return;
1287 }
1288 #endif /* CONFIG_WNM */
1289 if (radio_work_pending(wpa_s, "sme-connect")) {
1290 /*
1291 * The previous sme-connect work might no longer be valid due to
1292 * the fact that the BSS list was updated. In addition, it makes
1293 * sense to adhere to the 'newer' decision.
1294 */
1295 wpa_dbg(wpa_s, MSG_DEBUG,
1296 "SME: Remove previous pending sme-connect");
1297 radio_remove_works(wpa_s, "sme-connect", 0);
1298 }
1299
1300 wpas_abort_ongoing_scan(wpa_s);
1301
1302 cwork = os_zalloc(sizeof(*cwork));
1303 if (cwork == NULL)
1304 return;
1305 cwork->bss = bss;
1306 cwork->ssid = ssid;
1307 cwork->sme = 1;
1308
1309 #ifdef CONFIG_SAE
1310 wpa_s->sme.sae.state = SAE_NOTHING;
1311 wpa_s->sme.sae.send_confirm = 0;
1312 wpa_s->sme.sae_group_index = 0;
1313 #endif /* CONFIG_SAE */
1314
1315 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
1316 sme_auth_start_cb, cwork) < 0)
1317 wpas_connect_work_free(cwork);
1318 }
1319
1320
1321 #ifdef CONFIG_SAE
1322
1323 #define WPA_AUTH_FRAME_ML_IE_LEN (6 + ETH_ALEN)
1324
wpa_auth_ml_ie(struct wpabuf * buf,const u8 * mld_addr)1325 static void wpa_auth_ml_ie(struct wpabuf *buf, const u8 *mld_addr)
1326 {
1327
1328 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1329 wpabuf_put_u8(buf, 4 + ETH_ALEN);
1330 wpabuf_put_u8(buf, WLAN_EID_EXT_MULTI_LINK);
1331
1332 /* Basic Multi-Link element Control field */
1333 wpabuf_put_u8(buf, 0x0);
1334 wpabuf_put_u8(buf, 0x0);
1335
1336 /* Common Info */
1337 wpabuf_put_u8(buf, 0x7); /* length = Length field + MLD MAC address */
1338 wpabuf_put_data(buf, mld_addr, ETH_ALEN);
1339 }
1340
1341
sme_external_auth_build_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,u16 auth_transaction,u16 seq_num,u16 status_code,const u8 * mld_addr)1342 static int sme_external_auth_build_buf(struct wpabuf *buf,
1343 struct wpabuf *params,
1344 const u8 *sa, const u8 *da,
1345 u16 auth_transaction, u16 seq_num,
1346 u16 status_code, const u8 *mld_addr)
1347 {
1348 struct ieee80211_mgmt *resp;
1349
1350 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
1351 u.auth.variable));
1352
1353 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
1354 (WLAN_FC_STYPE_AUTH << 4));
1355 os_memcpy(resp->da, da, ETH_ALEN);
1356 os_memcpy(resp->sa, sa, ETH_ALEN);
1357 os_memcpy(resp->bssid, da, ETH_ALEN);
1358 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
1359 resp->seq_ctrl = host_to_le16(seq_num << 4);
1360 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
1361 resp->u.auth.status_code = host_to_le16(status_code);
1362 if (params)
1363 wpabuf_put_buf(buf, params);
1364
1365 if (mld_addr)
1366 wpa_auth_ml_ie(buf, mld_addr);
1367
1368 return 0;
1369 }
1370
1371
sme_external_auth_send_sae_commit(struct wpa_supplicant * wpa_s,const u8 * bssid,struct wpa_ssid * ssid)1372 static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
1373 const u8 *bssid,
1374 struct wpa_ssid *ssid)
1375 {
1376 struct wpabuf *resp, *buf;
1377 int use_pt;
1378 bool use_pk;
1379 u16 status;
1380
1381 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid,
1382 wpa_s->sme.ext_ml_auth ?
1383 wpa_s->sme.ext_auth_ap_mld_addr : NULL,
1384 1, 0, &use_pt, &use_pk);
1385 if (!resp) {
1386 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
1387 return -1;
1388 }
1389
1390 wpa_s->sme.sae.state = SAE_COMMITTED;
1391 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp) +
1392 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1393 0));
1394 if (!buf) {
1395 wpabuf_free(resp);
1396 return -1;
1397 }
1398
1399 wpa_s->sme.seq_num++;
1400 if (use_pk)
1401 status = WLAN_STATUS_SAE_PK;
1402 else if (use_pt)
1403 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
1404 else
1405 status = WLAN_STATUS_SUCCESS;
1406 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1407 wpa_s->sme.ext_ml_auth ?
1408 wpa_s->sme.ext_auth_ap_mld_addr : bssid, 1,
1409 wpa_s->sme.seq_num, status,
1410 wpa_s->sme.ext_ml_auth ?
1411 wpa_s->own_addr : NULL);
1412 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1413 wpabuf_free(resp);
1414 wpabuf_free(buf);
1415
1416 return 0;
1417 }
1418
1419
sme_send_external_auth_status(struct wpa_supplicant * wpa_s,u16 status)1420 static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
1421 u16 status)
1422 {
1423 struct external_auth params;
1424
1425 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1426 os_memset(¶ms, 0, sizeof(params));
1427 params.status = status;
1428 params.ssid = wpa_s->sme.ext_auth_ssid;
1429 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
1430 params.bssid = wpa_s->sme.ext_auth_bssid;
1431 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
1432 params.pmkid = wpa_s->sme.sae.pmkid;
1433 wpa_drv_send_external_auth_status(wpa_s, ¶ms);
1434 }
1435
1436
sme_handle_external_auth_start(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1437 static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
1438 union wpa_event_data *data)
1439 {
1440 struct wpa_ssid *ssid;
1441 size_t ssid_str_len = data->external_auth.ssid_len;
1442 const u8 *ssid_str = data->external_auth.ssid;
1443
1444 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1445 /* Get the SSID conf from the ssid string obtained */
1446 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1447 if (!wpas_network_disabled(wpa_s, ssid) &&
1448 ssid_str_len == ssid->ssid_len &&
1449 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
1450 wpa_key_mgmt_sae(ssid->key_mgmt)) {
1451 /* Make sure PT is derived */
1452 wpa_s_setup_sae_pt(wpa_s->conf, ssid, false);
1453 wpa_s->sme.ext_auth_wpa_ssid = ssid;
1454 break;
1455 }
1456 }
1457 if (!ssid ||
1458 sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
1459 ssid) < 0)
1460 return -1;
1461
1462 return 0;
1463 }
1464
1465
sme_external_auth_send_sae_confirm(struct wpa_supplicant * wpa_s,const u8 * da)1466 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1467 const u8 *da)
1468 {
1469 struct wpabuf *resp, *buf;
1470
1471 resp = sme_auth_build_sae_confirm(wpa_s, 1);
1472 if (!resp) {
1473 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1474 return;
1475 }
1476
1477 wpa_s->sme.sae.state = SAE_CONFIRMED;
1478 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp) +
1479 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1480 0));
1481 if (!buf) {
1482 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1483 wpabuf_free(resp);
1484 return;
1485 }
1486 wpa_s->sme.seq_num++;
1487 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1488 da, 2, wpa_s->sme.seq_num,
1489 WLAN_STATUS_SUCCESS,
1490 wpa_s->sme.ext_ml_auth ?
1491 wpa_s->own_addr : NULL);
1492
1493 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1494 wpabuf_free(resp);
1495 wpabuf_free(buf);
1496 }
1497
1498
is_sae_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)1499 static bool is_sae_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
1500 {
1501 /* suite is supposed to be the selector value in host byte order with
1502 * the OUI in three most significant octets. However, the initial
1503 * implementation swapped that byte order and did not work with drivers
1504 * that followed the expected byte order. Keep a workaround here to
1505 * match that initial implementation so that already deployed use cases
1506 * remain functional. */
1507 if (RSN_SELECTOR_GET(&suite) == RSN_AUTH_KEY_MGMT_SAE) {
1508 /* Old drivers which follow initial implementation send SAE AKM
1509 * for both SAE and FT-SAE connections. In that case, determine
1510 * the actual AKM from wpa_s->key_mgmt. */
1511 wpa_s->sme.ext_auth_key_mgmt = wpa_s->key_mgmt;
1512 return true;
1513 }
1514
1515 if (suite == RSN_AUTH_KEY_MGMT_SAE)
1516 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
1517 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE)
1518 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE;
1519 else if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1520 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
1521 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1522 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1523 else
1524 return false;
1525
1526 return true;
1527 }
1528
1529
sme_external_auth_trigger(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1530 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1531 union wpa_event_data *data)
1532 {
1533 if (!is_sae_key_mgmt_suite(wpa_s, data->external_auth.key_mgmt_suite))
1534 return;
1535
1536 if (data->external_auth.action == EXT_AUTH_START) {
1537 if (!data->external_auth.bssid || !data->external_auth.ssid)
1538 return;
1539 os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
1540 ETH_ALEN);
1541 os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
1542 data->external_auth.ssid_len);
1543 wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
1544 if (data->external_auth.mld_addr) {
1545 wpa_s->sme.ext_ml_auth = true;
1546 os_memcpy(wpa_s->sme.ext_auth_ap_mld_addr,
1547 data->external_auth.mld_addr, ETH_ALEN);
1548 } else {
1549 wpa_s->sme.ext_ml_auth = false;
1550 }
1551 wpa_s->sme.seq_num = 0;
1552 wpa_s->sme.sae.state = SAE_NOTHING;
1553 wpa_s->sme.sae.send_confirm = 0;
1554 wpa_s->sme.sae_group_index = 0;
1555 if (sme_handle_external_auth_start(wpa_s, data) < 0)
1556 sme_send_external_auth_status(wpa_s,
1557 WLAN_STATUS_UNSPECIFIED_FAILURE);
1558 } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1559 /* Report failure to driver for the wrong trigger */
1560 sme_send_external_auth_status(wpa_s,
1561 WLAN_STATUS_UNSPECIFIED_FAILURE);
1562 }
1563 }
1564
1565
sme_sae_is_group_enabled(struct wpa_supplicant * wpa_s,int group)1566 static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
1567 {
1568 int *groups = wpa_s->conf->sae_groups;
1569 int default_groups[] = { 19, 20, 21, 0 };
1570 int i;
1571
1572 if (!groups)
1573 groups = default_groups;
1574
1575 for (i = 0; groups[i] > 0; i++) {
1576 if (groups[i] == group)
1577 return 1;
1578 }
1579
1580 return 0;
1581 }
1582
1583
sme_check_sae_rejected_groups(struct wpa_supplicant * wpa_s,const struct wpabuf * groups)1584 static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
1585 const struct wpabuf *groups)
1586 {
1587 size_t i, count, len;
1588 const u8 *pos;
1589
1590 if (!groups)
1591 return 0;
1592
1593 pos = wpabuf_head(groups);
1594 len = wpabuf_len(groups);
1595 if (len & 1) {
1596 wpa_printf(MSG_DEBUG,
1597 "SAE: Invalid length of the Rejected Groups element payload: %zu",
1598 len);
1599 return 1;
1600 }
1601 count = len / 2;
1602 for (i = 0; i < count; i++) {
1603 int enabled;
1604 u16 group;
1605
1606 group = WPA_GET_LE16(pos);
1607 pos += 2;
1608 enabled = sme_sae_is_group_enabled(wpa_s, group);
1609 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
1610 group, enabled ? "enabled" : "disabled");
1611 if (enabled)
1612 return 1;
1613 }
1614
1615 return 0;
1616 }
1617
1618
sme_external_ml_auth(struct wpa_supplicant * wpa_s,const u8 * data,size_t len,int ie_offset,u16 status_code)1619 static int sme_external_ml_auth(struct wpa_supplicant *wpa_s,
1620 const u8 *data, size_t len, int ie_offset,
1621 u16 status_code)
1622 {
1623 struct ieee802_11_elems elems;
1624 const u8 *mld_addr;
1625
1626 if (ieee802_11_parse_elems(data + ie_offset, len - ie_offset,
1627 &elems, 0) == ParseFailed) {
1628 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
1629 return -1;
1630 }
1631
1632 if (!elems.basic_mle || !elems.basic_mle_len) {
1633 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
1634 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
1635 status_code == WLAN_STATUS_SUCCESS ||
1636 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1637 status_code == WLAN_STATUS_SAE_PK)
1638 return -1;
1639 /* Accept missing Multi-Link element in failed authentication
1640 * cases. */
1641 return 0;
1642 }
1643
1644 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
1645 if (!mld_addr) {
1646 wpa_printf(MSG_DEBUG, "MLD: No MLD address in ML element");
1647 return -1;
1648 }
1649
1650 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
1651
1652 if (!ether_addr_equal(wpa_s->sme.ext_auth_ap_mld_addr, mld_addr)) {
1653 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
1654 MACSTR ")",
1655 MAC2STR(wpa_s->sme.ext_auth_ap_mld_addr));
1656 return -1;
1657 }
1658
1659 return 0;
1660 }
1661
1662
sme_sae_auth(struct wpa_supplicant * wpa_s,u16 auth_transaction,u16 status_code,const u8 * data,size_t len,int external,const u8 * sa,int * ie_offset)1663 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
1664 u16 status_code, const u8 *data, size_t len,
1665 int external, const u8 *sa, int *ie_offset)
1666 {
1667 int *groups;
1668
1669 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1670 "status code %u", auth_transaction, status_code);
1671
1672 if (auth_transaction == 1 &&
1673 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1674 wpa_s->sme.sae.state == SAE_COMMITTED &&
1675 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1676 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1677 int default_groups[] = { 19, 20, 21, 0 };
1678 u16 group;
1679 const u8 *token_pos;
1680 size_t token_len;
1681 int h2e = 0;
1682
1683 groups = wpa_s->conf->sae_groups;
1684 if (!groups || groups[0] <= 0)
1685 groups = default_groups;
1686
1687 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
1688 data, len);
1689 if (len < sizeof(le16)) {
1690 wpa_dbg(wpa_s, MSG_DEBUG,
1691 "SME: Too short SAE anti-clogging token request");
1692 return -1;
1693 }
1694 group = WPA_GET_LE16(data);
1695 wpa_dbg(wpa_s, MSG_DEBUG,
1696 "SME: SAE anti-clogging token requested (group %u)",
1697 group);
1698 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1699 WLAN_STATUS_SUCCESS) {
1700 wpa_dbg(wpa_s, MSG_ERROR,
1701 "SME: SAE group %u of anti-clogging request is invalid",
1702 group);
1703 return -1;
1704 }
1705 wpabuf_free(wpa_s->sme.sae_token);
1706 token_pos = data + sizeof(le16);
1707 token_len = len - sizeof(le16);
1708 h2e = wpa_s->sme.sae.h2e;
1709 if (h2e) {
1710 u8 id, elen, extid;
1711
1712 if (token_len < 3) {
1713 wpa_dbg(wpa_s, MSG_DEBUG,
1714 "SME: Too short SAE anti-clogging token container");
1715 return -1;
1716 }
1717 id = *token_pos++;
1718 elen = *token_pos++;
1719 extid = *token_pos++;
1720 if (id != WLAN_EID_EXTENSION ||
1721 elen == 0 || elen > token_len - 2 ||
1722 extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
1723 wpa_dbg(wpa_s, MSG_DEBUG,
1724 "SME: Invalid SAE anti-clogging token container header");
1725 return -1;
1726 }
1727 token_len = elen - 1;
1728 }
1729
1730 *ie_offset = token_pos + token_len - data;
1731
1732 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
1733 if (!wpa_s->sme.sae_token) {
1734 wpa_dbg(wpa_s, MSG_ERROR,
1735 "SME: Failed to allocate SAE token");
1736 return -1;
1737 }
1738
1739 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
1740 wpa_s->sme.sae_token);
1741 if (!external) {
1742 sme_send_authentication(wpa_s, wpa_s->current_bss,
1743 wpa_s->current_ssid, 2);
1744 } else {
1745 if (wpa_s->sme.ext_ml_auth &&
1746 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1747 status_code))
1748 return -1;
1749
1750 sme_external_auth_send_sae_commit(
1751 wpa_s, wpa_s->sme.ext_auth_bssid,
1752 wpa_s->sme.ext_auth_wpa_ssid);
1753 }
1754 return 0;
1755 }
1756
1757 if (auth_transaction == 1 &&
1758 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1759 wpa_s->sme.sae.state == SAE_COMMITTED &&
1760 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1761 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1762 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
1763 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
1764 wpa_s->sme.sae.group);
1765 wpa_s->sme.sae_group_index++;
1766 if (sme_set_sae_group(wpa_s, external) < 0)
1767 return -1; /* no other groups enabled */
1768 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
1769 if (!external) {
1770 sme_send_authentication(wpa_s, wpa_s->current_bss,
1771 wpa_s->current_ssid, 1);
1772 } else {
1773 if (wpa_s->sme.ext_ml_auth &&
1774 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1775 status_code))
1776 return -1;
1777
1778 sme_external_auth_send_sae_commit(
1779 wpa_s, wpa_s->sme.ext_auth_bssid,
1780 wpa_s->sme.ext_auth_wpa_ssid);
1781 }
1782 return 0;
1783 }
1784
1785 if (auth_transaction == 1 &&
1786 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1787 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1788
1789 wpa_msg(wpa_s, MSG_INFO,
1790 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1791 MAC2STR(bssid));
1792 return -1;
1793 }
1794
1795 if (status_code != WLAN_STATUS_SUCCESS &&
1796 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
1797 status_code != WLAN_STATUS_SAE_PK) {
1798 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1799
1800 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1801 " auth_type=%u auth_transaction=%u status_code=%u",
1802 MAC2STR(bssid), WLAN_AUTH_SAE,
1803 auth_transaction, status_code);
1804 return -2;
1805 }
1806
1807 if (auth_transaction == 1) {
1808 u16 res;
1809
1810 groups = wpa_s->conf->sae_groups;
1811
1812 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
1813 if ((external && !wpa_s->sme.ext_auth_wpa_ssid) ||
1814 (!external &&
1815 (!wpa_s->current_bss || !wpa_s->current_ssid)))
1816 return -1;
1817 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
1818 wpa_printf(MSG_DEBUG,
1819 "SAE: Ignore commit message while waiting for confirm");
1820 return 0;
1821 }
1822 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
1823 wpa_printf(MSG_DEBUG,
1824 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
1825 return -1;
1826 }
1827 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
1828 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
1829 wpa_printf(MSG_DEBUG,
1830 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
1831 return -1;
1832 }
1833 if (!wpa_s->sme.sae.pk &&
1834 status_code == WLAN_STATUS_SAE_PK) {
1835 wpa_printf(MSG_DEBUG,
1836 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
1837 return -1;
1838 }
1839
1840 if (groups && groups[0] <= 0)
1841 groups = NULL;
1842 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
1843 groups, status_code ==
1844 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1845 status_code == WLAN_STATUS_SAE_PK,
1846 ie_offset);
1847 if (res == SAE_SILENTLY_DISCARD) {
1848 wpa_printf(MSG_DEBUG,
1849 "SAE: Drop commit message due to reflection attack");
1850 return 0;
1851 }
1852 if (res != WLAN_STATUS_SUCCESS)
1853 return -1;
1854
1855 if (wpa_s->sme.sae.tmp &&
1856 sme_check_sae_rejected_groups(
1857 wpa_s,
1858 wpa_s->sme.sae.tmp->peer_rejected_groups))
1859 return -1;
1860
1861 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1862 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1863 "commit");
1864 return -1;
1865 }
1866
1867 wpabuf_free(wpa_s->sme.sae_token);
1868 wpa_s->sme.sae_token = NULL;
1869 if (!external) {
1870 sme_send_authentication(wpa_s, wpa_s->current_bss,
1871 wpa_s->current_ssid, 0);
1872 } else {
1873 if (wpa_s->sme.ext_ml_auth &&
1874 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1875 status_code))
1876 return -1;
1877
1878 sme_external_auth_send_sae_confirm(wpa_s, sa);
1879 }
1880 return 0;
1881 } else if (auth_transaction == 2) {
1882 if (status_code != WLAN_STATUS_SUCCESS)
1883 return -1;
1884 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
1885 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
1886 return -1;
1887 if (sae_check_confirm(&wpa_s->sme.sae, data, len,
1888 ie_offset) < 0)
1889 return -1;
1890 if (external && wpa_s->sme.ext_ml_auth &&
1891 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1892 status_code))
1893 return -1;
1894
1895 wpa_s->sme.sae.state = SAE_ACCEPTED;
1896 sae_clear_temp_data(&wpa_s->sme.sae);
1897 wpa_s_clear_sae_rejected(wpa_s);
1898
1899 if (external) {
1900 /* Report success to driver */
1901 sme_send_external_auth_status(wpa_s,
1902 WLAN_STATUS_SUCCESS);
1903 }
1904
1905 return 1;
1906 }
1907
1908 return -1;
1909 }
1910
1911
sme_sae_set_pmk(struct wpa_supplicant * wpa_s,const u8 * bssid)1912 static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
1913 {
1914 wpa_printf(MSG_DEBUG,
1915 "SME: SAE completed - setting PMK for 4-way handshake");
1916 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, wpa_s->sme.sae.pmk_len,
1917 wpa_s->sme.sae.pmkid, bssid);
1918 if (wpa_s->conf->sae_pmkid_in_assoc) {
1919 /* Update the own RSNE contents now that we have set the PMK
1920 * and added a PMKSA cache entry based on the successfully
1921 * completed SAE exchange. In practice, this will add the PMKID
1922 * into RSNE. */
1923 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
1924 sizeof(wpa_s->sme.assoc_req_ie)) {
1925 wpa_msg(wpa_s, MSG_WARNING,
1926 "RSN: Not enough room for inserting own PMKID into RSNE");
1927 return -1;
1928 }
1929 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
1930 &wpa_s->sme.assoc_req_ie_len,
1931 wpa_s->sme.sae.pmkid, true) < 0)
1932 return -1;
1933 wpa_hexdump(MSG_DEBUG,
1934 "SME: Updated Association Request IEs",
1935 wpa_s->sme.assoc_req_ie,
1936 wpa_s->sme.assoc_req_ie_len);
1937 }
1938
1939 return 0;
1940 }
1941
1942
sme_external_auth_mgmt_rx(struct wpa_supplicant * wpa_s,const u8 * auth_frame,size_t len)1943 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1944 const u8 *auth_frame, size_t len)
1945 {
1946 const struct ieee80211_mgmt *header;
1947 size_t auth_length;
1948
1949 header = (const struct ieee80211_mgmt *) auth_frame;
1950 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1951
1952 if (len < auth_length) {
1953 /* Notify failure to the driver */
1954 sme_send_external_auth_status(wpa_s,
1955 WLAN_STATUS_UNSPECIFIED_FAILURE);
1956 return;
1957 }
1958
1959 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
1960 int res;
1961 int ie_offset = 0;
1962
1963 res = sme_sae_auth(
1964 wpa_s, le_to_host16(header->u.auth.auth_transaction),
1965 le_to_host16(header->u.auth.status_code),
1966 header->u.auth.variable,
1967 len - auth_length, 1, header->sa, &ie_offset);
1968 if (res < 0) {
1969 /* Notify failure to the driver */
1970 sme_send_external_auth_status(
1971 wpa_s,
1972 res == -2 ?
1973 le_to_host16(header->u.auth.status_code) :
1974 WLAN_STATUS_UNSPECIFIED_FAILURE);
1975 return;
1976 }
1977 if (res != 1)
1978 return;
1979
1980 if (sme_sae_set_pmk(wpa_s,
1981 wpa_s->sme.ext_ml_auth ?
1982 wpa_s->sme.ext_auth_ap_mld_addr :
1983 wpa_s->sme.ext_auth_bssid) < 0)
1984 return;
1985 }
1986 }
1987
1988 #endif /* CONFIG_SAE */
1989
1990
sme_event_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1991 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
1992 {
1993 struct wpa_ssid *ssid = wpa_s->current_ssid;
1994 int ie_offset = 0;
1995
1996 if (ssid == NULL) {
1997 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
1998 "when network is not selected");
1999 return;
2000 }
2001
2002 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
2003 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2004 "when not in authenticating state");
2005 return;
2006 }
2007
2008 if (!ether_addr_equal(wpa_s->pending_bssid, data->auth.peer) &&
2009 !(wpa_s->valid_links &&
2010 ether_addr_equal(wpa_s->ap_mld_addr, data->auth.peer))) {
2011 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
2012 "unexpected peer " MACSTR,
2013 MAC2STR(data->auth.peer));
2014 return;
2015 }
2016
2017 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
2018 " auth_type=%d auth_transaction=%d status_code=%d",
2019 MAC2STR(data->auth.peer), data->auth.auth_type,
2020 data->auth.auth_transaction, data->auth.status_code);
2021 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
2022 data->auth.ies, data->auth.ies_len);
2023
2024 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2025
2026 #ifdef CONFIG_SAE
2027 if (data->auth.auth_type == WLAN_AUTH_SAE) {
2028 const u8 *addr = wpa_s->pending_bssid;
2029 int res;
2030
2031 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
2032 data->auth.status_code, data->auth.ies,
2033 data->auth.ies_len, 0, data->auth.peer,
2034 &ie_offset);
2035 if (res < 0) {
2036 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2037 NULL);
2038 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2039
2040 if (wpa_s->sme.sae_rejected_groups &&
2041 ssid->disabled_until.sec) {
2042 wpa_printf(MSG_DEBUG,
2043 "SME: Clear SAE state with rejected groups due to continuous failures");
2044 wpa_s_clear_sae_rejected(wpa_s);
2045 }
2046 }
2047 if (res != 1)
2048 return;
2049
2050 if (wpa_s->valid_links)
2051 addr = wpa_s->ap_mld_addr;
2052
2053 if (sme_sae_set_pmk(wpa_s, addr) < 0)
2054 return;
2055 }
2056 #endif /* CONFIG_SAE */
2057
2058 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
2059 char *ie_txt = NULL;
2060
2061 if (data->auth.ies && data->auth.ies_len) {
2062 size_t buflen = 2 * data->auth.ies_len + 1;
2063 ie_txt = os_malloc(buflen);
2064 if (ie_txt) {
2065 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
2066 data->auth.ies_len);
2067 }
2068 }
2069 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
2070 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
2071 MAC2STR(data->auth.peer), data->auth.auth_type,
2072 data->auth.auth_transaction, data->auth.status_code,
2073 ie_txt ? " ie=" : "",
2074 ie_txt ? ie_txt : "");
2075 os_free(ie_txt);
2076
2077 #ifdef CONFIG_FILS
2078 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
2079 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
2080 fils_connection_failure(wpa_s);
2081 #endif /* CONFIG_FILS */
2082
2083 if (data->auth.status_code !=
2084 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
2085 wpa_s->sme.auth_alg == data->auth.auth_type ||
2086 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
2087 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2088 NULL);
2089 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2090 return;
2091 }
2092
2093 wpas_connect_work_done(wpa_s);
2094
2095 switch (data->auth.auth_type) {
2096 case WLAN_AUTH_OPEN:
2097 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
2098
2099 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
2100 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2101 wpa_s->current_ssid);
2102 return;
2103
2104 case WLAN_AUTH_SHARED_KEY:
2105 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
2106
2107 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
2108 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2109 wpa_s->current_ssid);
2110 return;
2111
2112 default:
2113 return;
2114 }
2115 }
2116
2117 #ifdef CONFIG_IEEE80211R
2118 if (data->auth.auth_type == WLAN_AUTH_FT) {
2119 const u8 *ric_ies = NULL;
2120 size_t ric_ies_len = 0;
2121
2122 if (wpa_s->ric_ies) {
2123 ric_ies = wpabuf_head(wpa_s->ric_ies);
2124 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
2125 }
2126 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
2127 data->auth.ies_len, 0,
2128 data->auth.peer,
2129 ric_ies, ric_ies_len) < 0) {
2130 wpa_dbg(wpa_s, MSG_DEBUG,
2131 "SME: FT Authentication response processing failed");
2132 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2133 MACSTR
2134 " reason=%d locally_generated=1",
2135 MAC2STR(wpa_s->pending_bssid),
2136 WLAN_REASON_DEAUTH_LEAVING);
2137 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2138 NULL);
2139 wpa_supplicant_mark_disassoc(wpa_s);
2140 return;
2141 }
2142 }
2143 #endif /* CONFIG_IEEE80211R */
2144
2145 #ifdef CONFIG_FILS
2146 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
2147 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
2148 u16 expect_auth_type;
2149
2150 expect_auth_type = wpa_s->sme.auth_alg ==
2151 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
2152 WLAN_AUTH_FILS_SK;
2153 if (data->auth.auth_type != expect_auth_type) {
2154 wpa_dbg(wpa_s, MSG_DEBUG,
2155 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
2156 data->auth.auth_type, expect_auth_type);
2157 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2158 MACSTR
2159 " reason=%d locally_generated=1",
2160 MAC2STR(wpa_s->pending_bssid),
2161 WLAN_REASON_DEAUTH_LEAVING);
2162 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2163 NULL);
2164 wpa_supplicant_mark_disassoc(wpa_s);
2165 return;
2166 }
2167
2168 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
2169 data->auth.ies, data->auth.ies_len) < 0) {
2170 wpa_dbg(wpa_s, MSG_DEBUG,
2171 "SME: FILS Authentication response processing failed");
2172 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2173 MACSTR
2174 " reason=%d locally_generated=1",
2175 MAC2STR(wpa_s->pending_bssid),
2176 WLAN_REASON_DEAUTH_LEAVING);
2177 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2178 NULL);
2179 wpa_supplicant_mark_disassoc(wpa_s);
2180 return;
2181 }
2182 }
2183 #endif /* CONFIG_FILS */
2184
2185 /* TODO: Support additional auth_type values as well */
2186 if ((data->auth.auth_type == WLAN_AUTH_OPEN ||
2187 data->auth.auth_type == WLAN_AUTH_SAE) &&
2188 wpas_sme_ml_auth(wpa_s, data, ie_offset) < 0) {
2189 wpa_dbg(wpa_s, MSG_DEBUG,
2190 "MLD: Failed to parse ML Authentication frame");
2191 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
2192 " reason=%d locally_generated=1",
2193 MAC2STR(wpa_s->pending_bssid),
2194 WLAN_REASON_DEAUTH_LEAVING);
2195 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2196 wpa_supplicant_deauthenticate(wpa_s,
2197 WLAN_REASON_DEAUTH_LEAVING);
2198 wpa_printf(MSG_DEBUG,
2199 "MLD: Authentication - clearing MLD state");
2200 wpas_reset_mlo_info(wpa_s);
2201 return;
2202 }
2203
2204 sme_associate(wpa_s, ssid->mode, data->auth.peer,
2205 data->auth.auth_type);
2206 }
2207
2208
2209 #ifdef CONFIG_IEEE80211R
remove_ie(u8 * buf,size_t * len,u8 eid)2210 static void remove_ie(u8 *buf, size_t *len, u8 eid)
2211 {
2212 u8 *pos, *next, *end;
2213
2214 pos = (u8 *) get_ie(buf, *len, eid);
2215 if (pos) {
2216 next = pos + 2 + pos[1];
2217 end = buf + *len;
2218 *len -= 2 + pos[1];
2219 os_memmove(pos, next, end - next);
2220 }
2221 }
2222 #endif /* CONFIG_IEEE80211R */
2223
2224
sme_associate(struct wpa_supplicant * wpa_s,enum wpas_mode mode,const u8 * bssid,u16 auth_type)2225 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
2226 const u8 *bssid, u16 auth_type)
2227 {
2228 struct wpa_driver_associate_params params;
2229 struct ieee802_11_elems elems;
2230 struct wpa_ssid *ssid = wpa_s->current_ssid;
2231 #ifdef CONFIG_FILS
2232 u8 nonces[2 * FILS_NONCE_LEN];
2233 #endif /* CONFIG_FILS */
2234 #ifdef CONFIG_HT_OVERRIDES
2235 struct ieee80211_ht_capabilities htcaps;
2236 struct ieee80211_ht_capabilities htcaps_mask;
2237 #endif /* CONFIG_HT_OVERRIDES */
2238 #ifdef CONFIG_VHT_OVERRIDES
2239 struct ieee80211_vht_capabilities vhtcaps;
2240 struct ieee80211_vht_capabilities vhtcaps_mask;
2241 #endif /* CONFIG_VHT_OVERRIDES */
2242
2243 os_memset(¶ms, 0, sizeof(params));
2244
2245 /* Save auth type, in case we need to retry after comeback timer. */
2246 wpa_s->sme.assoc_auth_type = auth_type;
2247
2248 #ifdef CONFIG_FILS
2249 if (auth_type == WLAN_AUTH_FILS_SK ||
2250 auth_type == WLAN_AUTH_FILS_SK_PFS) {
2251 struct wpabuf *buf;
2252 const u8 *snonce, *anonce;
2253 const unsigned int max_hlp = 20;
2254 struct wpabuf *hlp[max_hlp];
2255 unsigned int i, num_hlp = 0;
2256 struct fils_hlp_req *req;
2257
2258 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
2259 list) {
2260 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
2261 wpabuf_len(req->pkt));
2262 if (!hlp[num_hlp])
2263 break;
2264 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
2265 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
2266 ETH_ALEN);
2267 wpabuf_put_data(hlp[num_hlp],
2268 "\xaa\xaa\x03\x00\x00\x00", 6);
2269 wpabuf_put_buf(hlp[num_hlp], req->pkt);
2270 num_hlp++;
2271 if (num_hlp >= max_hlp)
2272 break;
2273 }
2274
2275 buf = fils_build_assoc_req(wpa_s->wpa, ¶ms.fils_kek,
2276 ¶ms.fils_kek_len, &snonce,
2277 &anonce,
2278 (const struct wpabuf **) hlp,
2279 num_hlp);
2280 for (i = 0; i < num_hlp; i++)
2281 wpabuf_free(hlp[i]);
2282 if (!buf)
2283 return;
2284 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
2285 wpa_s->sme.assoc_req_ie,
2286 wpa_s->sme.assoc_req_ie_len);
2287 #ifdef CONFIG_IEEE80211R
2288 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
2289 /* Remove RSNE and MDE to allow them to be overridden
2290 * with FILS+FT specific values from
2291 * fils_build_assoc_req(). */
2292 remove_ie(wpa_s->sme.assoc_req_ie,
2293 &wpa_s->sme.assoc_req_ie_len,
2294 WLAN_EID_RSN);
2295 wpa_hexdump(MSG_DEBUG,
2296 "FILS: assoc_req after RSNE removal",
2297 wpa_s->sme.assoc_req_ie,
2298 wpa_s->sme.assoc_req_ie_len);
2299 remove_ie(wpa_s->sme.assoc_req_ie,
2300 &wpa_s->sme.assoc_req_ie_len,
2301 WLAN_EID_MOBILITY_DOMAIN);
2302 wpa_hexdump(MSG_DEBUG,
2303 "FILS: assoc_req after MDE removal",
2304 wpa_s->sme.assoc_req_ie,
2305 wpa_s->sme.assoc_req_ie_len);
2306 }
2307 #endif /* CONFIG_IEEE80211R */
2308 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
2309 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
2310 sizeof(wpa_s->sme.assoc_req_ie)) {
2311 wpa_printf(MSG_ERROR,
2312 "FILS: Not enough buffer room for own AssocReq elements");
2313 wpabuf_free(buf);
2314 return;
2315 }
2316 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2317 wpabuf_head(buf), wpabuf_len(buf));
2318 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
2319 wpabuf_free(buf);
2320 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
2321 wpa_s->sme.assoc_req_ie,
2322 wpa_s->sme.assoc_req_ie_len);
2323
2324 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
2325 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
2326 params.fils_nonces = nonces;
2327 params.fils_nonces_len = sizeof(nonces);
2328 }
2329 #endif /* CONFIG_FILS */
2330
2331 #ifdef CONFIG_OWE
2332 #ifdef CONFIG_TESTING_OPTIONS
2333 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
2334 WLAN_EID_EXT_OWE_DH_PARAM)) {
2335 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
2336 } else
2337 #endif /* CONFIG_TESTING_OPTIONS */
2338 if (auth_type == WLAN_AUTH_OPEN &&
2339 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
2340 struct wpabuf *owe_ie;
2341 u16 group;
2342
2343 if (ssid && ssid->owe_group) {
2344 group = ssid->owe_group;
2345 } else if (wpa_s->assoc_status_code ==
2346 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
2347 if (wpa_s->last_owe_group == 19)
2348 group = 20;
2349 else if (wpa_s->last_owe_group == 20)
2350 group = 21;
2351 else
2352 group = OWE_DH_GROUP;
2353 } else {
2354 group = OWE_DH_GROUP;
2355 }
2356
2357 wpa_s->last_owe_group = group;
2358 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
2359 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
2360 if (!owe_ie) {
2361 wpa_printf(MSG_ERROR,
2362 "OWE: Failed to build IE for Association Request frame");
2363 return;
2364 }
2365 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
2366 sizeof(wpa_s->sme.assoc_req_ie)) {
2367 wpa_printf(MSG_ERROR,
2368 "OWE: Not enough buffer room for own Association Request frame elements");
2369 wpabuf_free(owe_ie);
2370 return;
2371 }
2372 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2373 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
2374 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
2375 wpabuf_free(owe_ie);
2376 }
2377 #endif /* CONFIG_OWE */
2378
2379 #ifdef CONFIG_DPP2
2380 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
2381 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
2382 !ssid->dpp_pfs_fallback) {
2383 struct rsn_pmksa_cache_entry *pmksa;
2384
2385 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2386 if (!pmksa || !pmksa->dpp_pfs)
2387 goto pfs_fail;
2388
2389 dpp_pfs_free(wpa_s->dpp_pfs);
2390 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
2391 ssid->dpp_netaccesskey_len);
2392 if (!wpa_s->dpp_pfs) {
2393 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
2394 /* Try to continue without PFS */
2395 goto pfs_fail;
2396 }
2397 if (wpa_s->sme.assoc_req_ie_len +
2398 wpabuf_len(wpa_s->dpp_pfs->ie) >
2399 sizeof(wpa_s->sme.assoc_req_ie)) {
2400 wpa_printf(MSG_ERROR,
2401 "DPP: Not enough buffer room for own Association Request frame elements");
2402 dpp_pfs_free(wpa_s->dpp_pfs);
2403 wpa_s->dpp_pfs = NULL;
2404 goto pfs_fail;
2405 }
2406 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2407 wpabuf_head(wpa_s->dpp_pfs->ie),
2408 wpabuf_len(wpa_s->dpp_pfs->ie));
2409 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
2410 }
2411 pfs_fail:
2412 #endif /* CONFIG_DPP2 */
2413
2414 #ifndef CONFIG_NO_ROBUST_AV
2415 wpa_s->mscs_setup_done = false;
2416 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
2417 wpa_s->robust_av.valid_config) {
2418 struct wpabuf *mscs_ie;
2419 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
2420
2421 buf_len = 3 + /* MSCS descriptor IE header */
2422 1 + /* Request type */
2423 2 + /* User priority control */
2424 4 + /* Stream timeout */
2425 3 + /* TCLAS Mask IE header */
2426 wpa_s->robust_av.frame_classifier_len;
2427 mscs_ie = wpabuf_alloc(buf_len);
2428 if (!mscs_ie) {
2429 wpa_printf(MSG_INFO,
2430 "MSCS: Failed to allocate MSCS IE");
2431 goto mscs_fail;
2432 }
2433
2434 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
2435 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
2436 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
2437 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
2438 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
2439 mscs_ie_len = wpabuf_len(mscs_ie);
2440 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
2441 wpabuf_head(mscs_ie), mscs_ie_len);
2442 *wpa_ie_len += mscs_ie_len;
2443 }
2444
2445 wpabuf_free(mscs_ie);
2446 }
2447 mscs_fail:
2448 #endif /* CONFIG_NO_ROBUST_AV */
2449
2450 if (ssid && ssid->multi_ap_backhaul_sta) {
2451 size_t multi_ap_ie_len;
2452 struct multi_ap_params multi_ap = { 0 };
2453
2454 multi_ap.capability = MULTI_AP_BACKHAUL_STA;
2455 multi_ap.profile = ssid->multi_ap_profile;
2456
2457 multi_ap_ie_len = add_multi_ap_ie(
2458 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2459 sizeof(wpa_s->sme.assoc_req_ie) -
2460 wpa_s->sme.assoc_req_ie_len,
2461 &multi_ap);
2462 if (multi_ap_ie_len == 0) {
2463 wpa_printf(MSG_ERROR,
2464 "Multi-AP: Failed to build Multi-AP IE");
2465 return;
2466 }
2467 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
2468 }
2469
2470 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE_SUPPORT,
2471 wpas_rsn_overriding(wpa_s, ssid));
2472 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2473 RSN_OVERRIDE_NOT_USED);
2474 if (wpas_rsn_overriding(wpa_s, ssid) &&
2475 wpas_ap_supports_rsn_overriding(wpa_s, wpa_s->current_bss) &&
2476 wpa_s->sme.assoc_req_ie_len + 2 + 4 <=
2477 sizeof(wpa_s->sme.assoc_req_ie)) {
2478 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
2479 const u8 *ie;
2480 enum rsn_selection_variant variant = RSN_SELECTION_RSNE;
2481
2482 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2483 RSN_OVERRIDE_RSNE);
2484 ie = wpa_bss_get_rsne(wpa_s, wpa_s->current_bss, ssid,
2485 wpa_s->valid_links);
2486 if (ie && ie[0] == WLAN_EID_VENDOR_SPECIFIC && ie[1] >= 4) {
2487 u32 type;
2488
2489 type = WPA_GET_BE32(&ie[2]);
2490 if (type == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
2491 variant = RSN_SELECTION_RSNE_OVERRIDE;
2492 wpa_sm_set_param(wpa_s->wpa,
2493 WPA_PARAM_RSN_OVERRIDE,
2494 RSN_OVERRIDE_RSNE_OVERRIDE);
2495 } else if (type == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
2496 variant = RSN_SELECTION_RSNE_OVERRIDE_2;
2497 wpa_sm_set_param(wpa_s->wpa,
2498 WPA_PARAM_RSN_OVERRIDE,
2499 RSN_OVERRIDE_RSNE_OVERRIDE_2);
2500 }
2501 }
2502
2503 /* Indicate which RSNE variant was used */
2504 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
2505 *pos++ = 4 + 1;
2506 WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);
2507 pos += 4;
2508 *pos = variant;
2509 wpa_s->sme.assoc_req_ie_len += 2 + 4 + 1;
2510 }
2511
2512 params.bssid = bssid;
2513 params.ssid = wpa_s->sme.ssid;
2514 params.ssid_len = wpa_s->sme.ssid_len;
2515 params.freq.freq = wpa_s->sme.freq;
2516 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
2517 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
2518 wpa_s->sme.assoc_req_ie : NULL;
2519 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2520 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
2521 params.wpa_ie, params.wpa_ie_len);
2522 params.pairwise_suite = wpa_s->pairwise_cipher;
2523 params.group_suite = wpa_s->group_cipher;
2524 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
2525 params.key_mgmt_suite = wpa_s->key_mgmt;
2526 params.wpa_proto = wpa_s->wpa_proto;
2527 #ifdef CONFIG_HT_OVERRIDES
2528 os_memset(&htcaps, 0, sizeof(htcaps));
2529 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2530 params.htcaps = (u8 *) &htcaps;
2531 params.htcaps_mask = (u8 *) &htcaps_mask;
2532 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, ¶ms);
2533 #endif /* CONFIG_HT_OVERRIDES */
2534 #ifdef CONFIG_VHT_OVERRIDES
2535 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2536 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2537 params.vhtcaps = &vhtcaps;
2538 params.vhtcaps_mask = &vhtcaps_mask;
2539 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, ¶ms);
2540 #endif /* CONFIG_VHT_OVERRIDES */
2541 #ifdef CONFIG_HE_OVERRIDES
2542 wpa_supplicant_apply_he_overrides(wpa_s, ssid, ¶ms);
2543 #endif /* CONFIG_HE_OVERRIDES */
2544 wpa_supplicant_apply_eht_overrides(wpa_s, ssid, ¶ms);
2545 #ifdef CONFIG_IEEE80211R
2546 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
2547 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
2548 WLAN_EID_RIC_DATA)) {
2549 /* There seems to be a pretty inconvenient bug in the Linux
2550 * kernel IE splitting functionality when RIC is used. For now,
2551 * skip correct behavior in IE construction here (i.e., drop the
2552 * additional non-FT-specific IEs) to avoid kernel issues. This
2553 * is fine since RIC is used only for testing purposes in the
2554 * current implementation. */
2555 wpa_printf(MSG_INFO,
2556 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
2557 params.wpa_ie = wpa_s->sme.ft_ies;
2558 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
2559 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
2560 const u8 *rm_en, *pos, *end;
2561 size_t rm_en_len = 0;
2562 u8 *rm_en_dup = NULL, *wpos;
2563
2564 /* Remove RSNE, MDE, FTE to allow them to be overridden with
2565 * FT specific values */
2566 remove_ie(wpa_s->sme.assoc_req_ie,
2567 &wpa_s->sme.assoc_req_ie_len,
2568 WLAN_EID_RSN);
2569 remove_ie(wpa_s->sme.assoc_req_ie,
2570 &wpa_s->sme.assoc_req_ie_len,
2571 WLAN_EID_MOBILITY_DOMAIN);
2572 remove_ie(wpa_s->sme.assoc_req_ie,
2573 &wpa_s->sme.assoc_req_ie_len,
2574 WLAN_EID_FAST_BSS_TRANSITION);
2575 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
2576 wpa_s->sme.assoc_req_ie_len,
2577 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2578 if (rm_en) {
2579 /* Need to remove RM Enabled Capabilities element as
2580 * well temporarily, so that it can be placed between
2581 * RSNE and MDE. */
2582 rm_en_len = 2 + rm_en[1];
2583 rm_en_dup = os_memdup(rm_en, rm_en_len);
2584 remove_ie(wpa_s->sme.assoc_req_ie,
2585 &wpa_s->sme.assoc_req_ie_len,
2586 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2587 }
2588 wpa_hexdump(MSG_DEBUG,
2589 "SME: Association Request IEs after FT IE removal",
2590 wpa_s->sme.assoc_req_ie,
2591 wpa_s->sme.assoc_req_ie_len);
2592 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
2593 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
2594 wpa_printf(MSG_ERROR,
2595 "SME: Not enough buffer room for FT IEs in Association Request frame");
2596 os_free(rm_en_dup);
2597 return;
2598 }
2599
2600 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
2601 rm_en_len,
2602 wpa_s->sme.assoc_req_ie,
2603 wpa_s->sme.assoc_req_ie_len);
2604 pos = wpa_s->sme.ft_ies;
2605 end = pos + wpa_s->sme.ft_ies_len;
2606 wpos = wpa_s->sme.assoc_req_ie;
2607 if (*pos == WLAN_EID_RSN) {
2608 os_memcpy(wpos, pos, 2 + pos[1]);
2609 wpos += 2 + pos[1];
2610 pos += 2 + pos[1];
2611 }
2612 if (rm_en_dup) {
2613 os_memcpy(wpos, rm_en_dup, rm_en_len);
2614 wpos += rm_en_len;
2615 os_free(rm_en_dup);
2616 }
2617 os_memcpy(wpos, pos, end - pos);
2618 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
2619 rm_en_len;
2620 params.wpa_ie = wpa_s->sme.assoc_req_ie;
2621 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2622 wpa_hexdump(MSG_DEBUG,
2623 "SME: Association Request IEs after FT override",
2624 params.wpa_ie, params.wpa_ie_len);
2625 }
2626 #endif /* CONFIG_IEEE80211R */
2627 params.mode = mode;
2628 params.mgmt_frame_protection = wpa_s->sme.mfp;
2629 params.rrm_used = wpa_s->rrm.rrm_used;
2630 if (wpa_s->sme.prev_bssid_set)
2631 params.prev_bssid = wpa_s->sme.prev_bssid;
2632
2633 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2634 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
2635 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
2636 params.freq.freq);
2637
2638 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2639
2640 if (params.wpa_ie == NULL ||
2641 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
2642 < 0) {
2643 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
2644 os_memset(&elems, 0, sizeof(elems));
2645 }
2646 if (elems.rsn_ie) {
2647 params.wpa_proto = WPA_PROTO_RSN;
2648 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
2649 elems.rsn_ie_len + 2);
2650 } else if (elems.wpa_ie) {
2651 params.wpa_proto = WPA_PROTO_WPA;
2652 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
2653 elems.wpa_ie_len + 2);
2654 } else if (elems.osen) {
2655 params.wpa_proto = WPA_PROTO_OSEN;
2656 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
2657 elems.osen_len + 2);
2658 } else
2659 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2660 if (elems.rsnxe)
2661 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
2662 elems.rsnxe_len + 2);
2663 else
2664 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
2665 if (ssid && ssid->p2p_group)
2666 params.p2p = 1;
2667
2668 if (wpa_s->p2pdev->set_sta_uapsd)
2669 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2670 else
2671 params.uapsd = -1;
2672
2673 params.bss_max_idle_period = CONFIG_BSS_MAX_IDLE_TIME;
2674 if (wpa_s->valid_links) {
2675 unsigned int i;
2676
2677 wpa_printf(MSG_DEBUG,
2678 "MLD: In association. assoc_link_id=%u, valid_links=0x%x",
2679 wpa_s->mlo_assoc_link_id, wpa_s->valid_links);
2680
2681 params.mld_params.mld_addr = wpa_s->ap_mld_addr;
2682 params.mld_params.valid_links = wpa_s->valid_links;
2683 params.mld_params.assoc_link_id = wpa_s->mlo_assoc_link_id;
2684 for_each_link(wpa_s->valid_links, i) {
2685 params.mld_params.mld_links[i].bssid =
2686 wpa_s->links[i].bssid;
2687 params.mld_params.mld_links[i].freq =
2688 wpa_s->links[i].freq;
2689 params.mld_params.mld_links[i].disabled =
2690 wpa_s->links[i].disabled;
2691
2692 wpa_printf(MSG_DEBUG,
2693 "MLD: id=%u, freq=%d, disabled=%u, " MACSTR,
2694 i, wpa_s->links[i].freq,
2695 wpa_s->links[i].disabled,
2696 MAC2STR(wpa_s->links[i].bssid));
2697 }
2698 }
2699
2700 if (wpa_drv_associate(wpa_s, ¶ms) < 0) {
2701 unsigned int n_failed_links = 0;
2702 int i;
2703
2704 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
2705 "driver failed");
2706
2707 /* Prepare list of failed links for error report */
2708 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
2709 if (!(wpa_s->valid_links & BIT(i)) ||
2710 wpa_s->mlo_assoc_link_id == i ||
2711 !params.mld_params.mld_links[i].error)
2712 continue;
2713
2714 wpa_bssid_ignore_add(wpa_s, wpa_s->links[i].bssid);
2715 n_failed_links++;
2716 }
2717
2718 if (n_failed_links) {
2719 /* Deauth and connect (possibly to the same AP MLD) */
2720 wpa_drv_deauthenticate(wpa_s, wpa_s->ap_mld_addr,
2721 WLAN_REASON_DEAUTH_LEAVING);
2722 wpas_connect_work_done(wpa_s);
2723 wpa_supplicant_mark_disassoc(wpa_s);
2724 wpas_request_connection(wpa_s);
2725 } else {
2726 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2727 NULL);
2728 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2729 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2730 }
2731 return;
2732 }
2733
2734 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
2735 NULL);
2736
2737 #ifdef CONFIG_TESTING_OPTIONS
2738 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
2739 wpa_s->last_assoc_req_wpa_ie = NULL;
2740 if (params.wpa_ie)
2741 wpa_s->last_assoc_req_wpa_ie =
2742 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
2743 #endif /* CONFIG_TESTING_OPTIONS */
2744 }
2745
2746
sme_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)2747 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2748 const u8 *ies, size_t ies_len)
2749 {
2750 if (md == NULL || ies == NULL) {
2751 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
2752 os_free(wpa_s->sme.ft_ies);
2753 wpa_s->sme.ft_ies = NULL;
2754 wpa_s->sme.ft_ies_len = 0;
2755 wpa_s->sme.ft_used = 0;
2756 return 0;
2757 }
2758
2759 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
2760 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
2761 os_free(wpa_s->sme.ft_ies);
2762 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
2763 if (wpa_s->sme.ft_ies == NULL)
2764 return -1;
2765 wpa_s->sme.ft_ies_len = ies_len;
2766 return 0;
2767 }
2768
2769
sme_deauth(struct wpa_supplicant * wpa_s,const u8 ** link_bssids)2770 static void sme_deauth(struct wpa_supplicant *wpa_s, const u8 **link_bssids)
2771 {
2772 int bssid_changed;
2773 const u8 *bssid;
2774
2775 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2776
2777 if (wpa_s->valid_links)
2778 bssid = wpa_s->ap_mld_addr;
2779 else
2780 bssid = wpa_s->pending_bssid;
2781
2782 if (wpa_drv_deauthenticate(wpa_s, bssid,
2783 WLAN_REASON_DEAUTH_LEAVING) < 0) {
2784 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
2785 "failed");
2786 }
2787 wpa_s->sme.prev_bssid_set = 0;
2788
2789 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, link_bssids);
2790 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2791 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2792 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2793 if (bssid_changed)
2794 wpas_notify_bssid_changed(wpa_s);
2795 }
2796
2797
sme_assoc_comeback_timer(void * eloop_ctx,void * timeout_ctx)2798 static void sme_assoc_comeback_timer(void *eloop_ctx, void *timeout_ctx)
2799 {
2800 struct wpa_supplicant *wpa_s = eloop_ctx;
2801
2802 if (!wpa_s->current_bss || !wpa_s->current_ssid) {
2803 wpa_msg(wpa_s, MSG_DEBUG,
2804 "SME: Comeback timeout expired; SSID/BSSID cleared; ignoring");
2805 return;
2806 }
2807
2808 wpa_msg(wpa_s, MSG_DEBUG,
2809 "SME: Comeback timeout expired; retry associating with "
2810 MACSTR "; mode=%d auth_type=%u",
2811 MAC2STR(wpa_s->current_bss->bssid),
2812 wpa_s->current_ssid->mode,
2813 wpa_s->sme.assoc_auth_type);
2814
2815 /* Authentication state was completed already; just try association
2816 * again. */
2817 sme_associate(wpa_s, wpa_s->current_ssid->mode,
2818 wpa_s->current_bss->bssid,
2819 wpa_s->sme.assoc_auth_type);
2820 }
2821
2822
sme_try_assoc_comeback(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2823 static bool sme_try_assoc_comeback(struct wpa_supplicant *wpa_s,
2824 union wpa_event_data *data)
2825 {
2826 struct ieee802_11_elems elems;
2827 u32 timeout_interval;
2828 unsigned long comeback_usec;
2829 u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
2830
2831 #ifdef CONFIG_TESTING_OPTIONS
2832 if (wpa_s->test_assoc_comeback_type != -1)
2833 type = wpa_s->test_assoc_comeback_type;
2834 #endif /* CONFIG_TESTING_OPTIONS */
2835
2836 if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
2837 data->assoc_reject.resp_ies_len,
2838 &elems, 0) == ParseFailed) {
2839 wpa_msg(wpa_s, MSG_INFO,
2840 "SME: Temporary assoc reject: failed to parse (Re)Association Response frame elements");
2841 return false;
2842 }
2843
2844 if (!elems.timeout_int) {
2845 wpa_msg(wpa_s, MSG_INFO,
2846 "SME: Temporary assoc reject: missing timeout interval IE");
2847 return false;
2848 }
2849
2850 if (elems.timeout_int[0] != type) {
2851 wpa_msg(wpa_s, MSG_INFO,
2852 "SME: Temporary assoc reject: missing association comeback time");
2853 return false;
2854 }
2855
2856 timeout_interval = WPA_GET_LE32(&elems.timeout_int[1]);
2857 if (timeout_interval > 60000) {
2858 /* This is unprotected information and there is no point in
2859 * getting stuck waiting for very long duration based on it */
2860 wpa_msg(wpa_s, MSG_DEBUG,
2861 "SME: Ignore overly long association comeback interval: %u TUs",
2862 timeout_interval);
2863 return false;
2864 }
2865 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association comeback interval: %u TUs",
2866 timeout_interval);
2867
2868 comeback_usec = timeout_interval * 1024;
2869 eloop_register_timeout(comeback_usec / 1000000, comeback_usec % 1000000,
2870 sme_assoc_comeback_timer, wpa_s, NULL);
2871 return true;
2872 }
2873
2874
sme_event_assoc_reject(struct wpa_supplicant * wpa_s,union wpa_event_data * data,const u8 ** link_bssids)2875 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
2876 union wpa_event_data *data,
2877 const u8 **link_bssids)
2878 {
2879 const u8 *bssid;
2880
2881 if (wpa_s->valid_links)
2882 bssid = wpa_s->ap_mld_addr;
2883 else
2884 bssid = wpa_s->pending_bssid;
2885
2886 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
2887 "status code %d", MAC2STR(wpa_s->pending_bssid),
2888 data->assoc_reject.status_code);
2889
2890 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2891 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
2892
2893 /* Authentication phase has been completed at this point. Check whether
2894 * the AP rejected association temporarily due to still holding a
2895 * security associationis with us (MFP). If so, we must wait for the
2896 * AP's association comeback timeout period before associating again. */
2897 if (data->assoc_reject.status_code ==
2898 WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
2899 wpa_msg(wpa_s, MSG_DEBUG,
2900 "SME: Temporary association reject from BSS " MACSTR,
2901 MAC2STR(bssid));
2902 if (sme_try_assoc_comeback(wpa_s, data)) {
2903 /* Break out early; comeback error is not a failure. */
2904 return;
2905 }
2906 }
2907
2908 #ifdef CONFIG_SAE
2909 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
2910 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
2911 wpa_dbg(wpa_s, MSG_DEBUG,
2912 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
2913 wpa_sm_aborted_cached(wpa_s->wpa);
2914 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
2915 if (wpa_s->current_bss) {
2916 struct wpa_bss *bss = wpa_s->current_bss;
2917 struct wpa_ssid *ssid = wpa_s->current_ssid;
2918
2919 wpa_drv_deauthenticate(wpa_s, bssid,
2920 WLAN_REASON_DEAUTH_LEAVING);
2921 wpas_connect_work_done(wpa_s);
2922 wpa_supplicant_mark_disassoc(wpa_s);
2923 wpa_supplicant_connect(wpa_s, bss, ssid);
2924 return;
2925 }
2926 }
2927 #endif /* CONFIG_SAE */
2928
2929 #ifdef CONFIG_DPP
2930 if (wpa_s->current_ssid &&
2931 wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_DPP &&
2932 !data->assoc_reject.timed_out &&
2933 data->assoc_reject.status_code == WLAN_STATUS_INVALID_PMKID) {
2934 struct rsn_pmksa_cache_entry *pmksa;
2935
2936 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2937 if (pmksa) {
2938 wpa_dbg(wpa_s, MSG_DEBUG,
2939 "DPP: Drop PMKSA cache entry for the BSS due to invalid PMKID report");
2940 wpa_sm_pmksa_cache_remove(wpa_s->wpa, pmksa);
2941 }
2942 wpa_sm_aborted_cached(wpa_s->wpa);
2943 if (wpa_s->current_bss) {
2944 struct wpa_bss *bss = wpa_s->current_bss;
2945 struct wpa_ssid *ssid = wpa_s->current_ssid;
2946
2947 wpa_dbg(wpa_s, MSG_DEBUG,
2948 "DPP: Try network introduction again");
2949 wpas_connect_work_done(wpa_s);
2950 wpa_supplicant_mark_disassoc(wpa_s);
2951 wpa_supplicant_connect(wpa_s, bss, ssid);
2952 return;
2953 }
2954 }
2955 #endif /* CONFIG_DPP */
2956
2957 /*
2958 * For now, unconditionally terminate the previous authentication. In
2959 * theory, this should not be needed, but mac80211 gets quite confused
2960 * if the authentication is left pending.. Some roaming cases might
2961 * benefit from using the previous authentication, so this could be
2962 * optimized in the future.
2963 */
2964 sme_deauth(wpa_s, link_bssids);
2965 }
2966
2967
sme_event_auth_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2968 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
2969 union wpa_event_data *data)
2970 {
2971 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
2972 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2973 wpa_supplicant_mark_disassoc(wpa_s);
2974 }
2975
2976
sme_event_assoc_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2977 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
2978 union wpa_event_data *data)
2979 {
2980 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
2981 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2982 wpa_supplicant_mark_disassoc(wpa_s);
2983 }
2984
2985
sme_event_disassoc(struct wpa_supplicant * wpa_s,struct disassoc_info * info)2986 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
2987 struct disassoc_info *info)
2988 {
2989 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
2990 if (wpa_s->sme.prev_bssid_set) {
2991 /*
2992 * cfg80211/mac80211 can get into somewhat confused state if
2993 * the AP only disassociates us and leaves us in authenticated
2994 * state. For now, force the state to be cleared to avoid
2995 * confusing errors if we try to associate with the AP again.
2996 */
2997 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
2998 "driver state");
2999 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
3000 WLAN_REASON_DEAUTH_LEAVING);
3001 }
3002 }
3003
3004
sme_auth_timer(void * eloop_ctx,void * timeout_ctx)3005 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
3006 {
3007 struct wpa_supplicant *wpa_s = eloop_ctx;
3008 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
3009 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
3010 sme_deauth(wpa_s, NULL);
3011 }
3012 }
3013
3014
sme_assoc_timer(void * eloop_ctx,void * timeout_ctx)3015 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
3016 {
3017 struct wpa_supplicant *wpa_s = eloop_ctx;
3018 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
3019 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
3020 sme_deauth(wpa_s, NULL);
3021 }
3022 }
3023
3024
sme_state_changed(struct wpa_supplicant * wpa_s)3025 void sme_state_changed(struct wpa_supplicant *wpa_s)
3026 {
3027 /* Make sure timers are cleaned up appropriately. */
3028 if (wpa_s->wpa_state != WPA_ASSOCIATING) {
3029 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3030 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3031 }
3032 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
3033 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3034 }
3035
3036
sme_clear_on_disassoc(struct wpa_supplicant * wpa_s)3037 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
3038 {
3039 wpa_s->sme.prev_bssid_set = 0;
3040 #ifdef CONFIG_SAE
3041 wpabuf_free(wpa_s->sme.sae_token);
3042 wpa_s->sme.sae_token = NULL;
3043 sae_clear_data(&wpa_s->sme.sae);
3044 #endif /* CONFIG_SAE */
3045 #ifdef CONFIG_IEEE80211R
3046 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
3047 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
3048 #endif /* CONFIG_IEEE80211R */
3049 sme_stop_sa_query(wpa_s);
3050 }
3051
3052
sme_deinit(struct wpa_supplicant * wpa_s)3053 void sme_deinit(struct wpa_supplicant *wpa_s)
3054 {
3055 sme_clear_on_disassoc(wpa_s);
3056 #ifdef CONFIG_SAE
3057 os_free(wpa_s->sme.sae_rejected_groups);
3058 wpa_s->sme.sae_rejected_groups = NULL;
3059 #endif /* CONFIG_SAE */
3060
3061 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3062 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3063 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3064 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3065 }
3066
3067
sme_send_2040_bss_coex(struct wpa_supplicant * wpa_s,const u8 * chan_list,u8 num_channels,u8 num_intol)3068 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
3069 const u8 *chan_list, u8 num_channels,
3070 u8 num_intol)
3071 {
3072 struct ieee80211_2040_bss_coex_ie *bc_ie;
3073 struct ieee80211_2040_intol_chan_report *ic_report;
3074 struct wpabuf *buf;
3075
3076 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
3077 " (num_channels=%u num_intol=%u)",
3078 MAC2STR(wpa_s->bssid), num_channels, num_intol);
3079 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
3080 chan_list, num_channels);
3081
3082 buf = wpabuf_alloc(2 + /* action.category + action_code */
3083 sizeof(struct ieee80211_2040_bss_coex_ie) +
3084 sizeof(struct ieee80211_2040_intol_chan_report) +
3085 num_channels);
3086 if (buf == NULL)
3087 return;
3088
3089 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
3090 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
3091
3092 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
3093 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
3094 bc_ie->length = 1;
3095 if (num_intol)
3096 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
3097
3098 if (num_channels > 0) {
3099 ic_report = wpabuf_put(buf, sizeof(*ic_report));
3100 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
3101 ic_report->length = num_channels + 1;
3102 ic_report->op_class = 0;
3103 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
3104 num_channels);
3105 }
3106
3107 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3108 wpa_s->own_addr, wpa_s->bssid,
3109 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
3110 wpa_msg(wpa_s, MSG_INFO,
3111 "SME: Failed to send 20/40 BSS Coexistence frame");
3112 }
3113
3114 wpabuf_free(buf);
3115 }
3116
3117
sme_proc_obss_scan(struct wpa_supplicant * wpa_s)3118 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
3119 {
3120 struct wpa_bss *bss;
3121 const u8 *ie;
3122 u16 ht_cap;
3123 u8 chan_list[P2P_MAX_CHANNELS], channel;
3124 u8 num_channels = 0, num_intol = 0, i;
3125
3126 if (!wpa_s->sme.sched_obss_scan)
3127 return 0;
3128
3129 wpa_s->sme.sched_obss_scan = 0;
3130 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
3131 return 1;
3132
3133 /*
3134 * Check whether AP uses regulatory triplet or channel triplet in
3135 * country info. Right now the operating class of the BSS channel
3136 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
3137 * based on the assumption that operating class triplet is not used in
3138 * beacon frame. If the First Channel Number/Operating Extension
3139 * Identifier octet has a positive integer value of 201 or greater,
3140 * then its operating class triplet.
3141 *
3142 * TODO: If Supported Operating Classes element is present in beacon
3143 * frame, have to lookup operating class in Annex E and fill them in
3144 * 2040 coex frame.
3145 */
3146 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
3147 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
3148 return 1;
3149
3150 os_memset(chan_list, 0, sizeof(chan_list));
3151
3152 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
3153 /* Skip other band bss */
3154 enum hostapd_hw_mode mode;
3155 mode = ieee80211_freq_to_chan(bss->freq, &channel);
3156 if (mode != HOSTAPD_MODE_IEEE80211G &&
3157 mode != HOSTAPD_MODE_IEEE80211B)
3158 continue;
3159
3160 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
3161 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
3162 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
3163 " freq=%u chan=%u ht_cap=0x%x",
3164 MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
3165
3166 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
3167 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
3168 num_intol++;
3169
3170 /* Check whether the channel is already considered */
3171 for (i = 0; i < num_channels; i++) {
3172 if (channel == chan_list[i])
3173 break;
3174 }
3175 if (i != num_channels)
3176 continue;
3177
3178 chan_list[num_channels++] = channel;
3179 }
3180 }
3181
3182 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
3183 return 1;
3184 }
3185
3186
wpa_obss_scan_freqs_list(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)3187 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
3188 struct wpa_driver_scan_params *params)
3189 {
3190 /* Include only affected channels */
3191 struct hostapd_hw_modes *mode;
3192 int count, i;
3193 int start, end;
3194
3195 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
3196 HOSTAPD_MODE_IEEE80211G, false);
3197 if (mode == NULL) {
3198 /* No channels supported in this band - use empty list */
3199 params->freqs = os_zalloc(sizeof(int));
3200 return;
3201 }
3202
3203 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
3204 wpa_s->current_bss) {
3205 const u8 *ie;
3206
3207 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
3208 if (ie && ie[1] >= 2) {
3209 u8 o;
3210
3211 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
3212 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
3213 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
3214 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
3215 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
3216 }
3217 }
3218
3219 start = wpa_s->assoc_freq - 10;
3220 end = wpa_s->assoc_freq + 10;
3221 switch (wpa_s->sme.ht_sec_chan) {
3222 case HT_SEC_CHAN_UNKNOWN:
3223 /* HT40+ possible on channels 1..9 */
3224 if (wpa_s->assoc_freq <= 2452)
3225 start -= 20;
3226 /* HT40- possible on channels 5-13 */
3227 if (wpa_s->assoc_freq >= 2432)
3228 end += 20;
3229 break;
3230 case HT_SEC_CHAN_ABOVE:
3231 end += 20;
3232 break;
3233 case HT_SEC_CHAN_BELOW:
3234 start -= 20;
3235 break;
3236 }
3237 wpa_printf(MSG_DEBUG,
3238 "OBSS: assoc_freq %d possible affected range %d-%d",
3239 wpa_s->assoc_freq, start, end);
3240
3241 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
3242 if (params->freqs == NULL)
3243 return;
3244 for (count = 0, i = 0; i < mode->num_channels; i++) {
3245 int freq;
3246
3247 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
3248 continue;
3249 freq = mode->channels[i].freq;
3250 if (freq - 10 >= end || freq + 10 <= start)
3251 continue; /* not affected */
3252 params->freqs[count++] = freq;
3253 }
3254 }
3255
3256
sme_obss_scan_timeout(void * eloop_ctx,void * timeout_ctx)3257 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3258 {
3259 struct wpa_supplicant *wpa_s = eloop_ctx;
3260 struct wpa_driver_scan_params params;
3261
3262 if (!wpa_s->current_bss) {
3263 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
3264 return;
3265 }
3266
3267 os_memset(¶ms, 0, sizeof(params));
3268 wpa_obss_scan_freqs_list(wpa_s, ¶ms);
3269 params.low_priority = 1;
3270 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
3271
3272 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms, true, false))
3273 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
3274 else
3275 wpa_s->sme.sched_obss_scan = 1;
3276 os_free(params.freqs);
3277
3278 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3279 sme_obss_scan_timeout, wpa_s, NULL);
3280 }
3281
3282
sme_sched_obss_scan(struct wpa_supplicant * wpa_s,int enable)3283 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
3284 {
3285 const u8 *ie;
3286 struct wpa_bss *bss = wpa_s->current_bss;
3287 struct wpa_ssid *ssid = wpa_s->current_ssid;
3288 struct hostapd_hw_modes *hw_mode = NULL;
3289 int i;
3290
3291 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3292 wpa_s->sme.sched_obss_scan = 0;
3293 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
3294 if (!enable)
3295 return;
3296
3297 /*
3298 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
3299 * or it expects OBSS scan to be performed by wpa_supplicant.
3300 */
3301 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
3302 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
3303 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
3304 return;
3305
3306 #ifdef CONFIG_HT_OVERRIDES
3307 /* No need for OBSS scan if HT40 is explicitly disabled */
3308 if (ssid->disable_ht40)
3309 return;
3310 #endif /* CONFIG_HT_OVERRIDES */
3311
3312 if (!wpa_s->hw.modes)
3313 return;
3314
3315 /* only HT caps in 11g mode are relevant */
3316 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3317 hw_mode = &wpa_s->hw.modes[i];
3318 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
3319 break;
3320 }
3321
3322 /* Driver does not support HT40 for 11g or doesn't have 11g. */
3323 if (i == wpa_s->hw.num_modes || !hw_mode ||
3324 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3325 return;
3326
3327 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
3328 return; /* Not associated on 2.4 GHz band */
3329
3330 /* Check whether AP supports HT40 */
3331 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
3332 if (!ie || ie[1] < 2 ||
3333 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3334 return; /* AP does not support HT40 */
3335
3336 ie = wpa_bss_get_ie(wpa_s->current_bss,
3337 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
3338 if (!ie || ie[1] < 14)
3339 return; /* AP does not request OBSS scans */
3340
3341 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
3342 if (wpa_s->sme.obss_scan_int < 10) {
3343 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
3344 "replaced with the minimum 10 sec",
3345 wpa_s->sme.obss_scan_int);
3346 wpa_s->sme.obss_scan_int = 10;
3347 }
3348 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
3349 wpa_s->sme.obss_scan_int);
3350 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3351 sme_obss_scan_timeout, wpa_s, NULL);
3352 }
3353
3354
3355 static const unsigned int sa_query_max_timeout = 1000;
3356 static const unsigned int sa_query_retry_timeout = 201;
3357 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
3358
sme_check_sa_query_timeout(struct wpa_supplicant * wpa_s)3359 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
3360 {
3361 u32 tu;
3362 struct os_reltime now, passed;
3363 os_get_reltime(&now);
3364 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
3365 tu = (passed.sec * 1000000 + passed.usec) / 1024;
3366 if (sa_query_max_timeout < tu) {
3367 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
3368 sme_stop_sa_query(wpa_s);
3369 wpa_supplicant_deauthenticate(
3370 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
3371 return 1;
3372 }
3373
3374 return 0;
3375 }
3376
3377
sme_send_sa_query_req(struct wpa_supplicant * wpa_s,const u8 * trans_id)3378 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
3379 const u8 *trans_id)
3380 {
3381 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3382 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3383
3384 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
3385 MACSTR, MAC2STR(wpa_s->bssid));
3386 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
3387 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3388 req[0] = WLAN_ACTION_SA_QUERY;
3389 req[1] = WLAN_SA_QUERY_REQUEST;
3390 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3391
3392 #ifdef CONFIG_OCV
3393 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3394 struct wpa_channel_info ci;
3395
3396 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3397 wpa_printf(MSG_WARNING,
3398 "Failed to get channel info for OCI element in SA Query Request frame");
3399 return;
3400 }
3401
3402 #ifdef CONFIG_TESTING_OPTIONS
3403 if (wpa_s->oci_freq_override_saquery_req) {
3404 wpa_printf(MSG_INFO,
3405 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
3406 ci.frequency,
3407 wpa_s->oci_freq_override_saquery_req);
3408 ci.frequency = wpa_s->oci_freq_override_saquery_req;
3409 }
3410 #endif /* CONFIG_TESTING_OPTIONS */
3411
3412 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
3413 return;
3414
3415 req_len += OCV_OCI_EXTENDED_LEN;
3416 }
3417 #endif /* CONFIG_OCV */
3418
3419 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3420 wpa_s->own_addr, wpa_s->bssid,
3421 req, req_len, 0) < 0)
3422 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
3423 "Request");
3424 }
3425
3426
sme_sa_query_timer(void * eloop_ctx,void * timeout_ctx)3427 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
3428 {
3429 struct wpa_supplicant *wpa_s = eloop_ctx;
3430 unsigned int timeout, sec, usec;
3431 u8 *trans_id, *nbuf;
3432
3433 if (wpa_s->sme.sa_query_count > 0 &&
3434 sme_check_sa_query_timeout(wpa_s))
3435 return;
3436
3437 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
3438 wpa_s->sme.sa_query_count + 1,
3439 WLAN_SA_QUERY_TR_ID_LEN);
3440 if (nbuf == NULL) {
3441 sme_stop_sa_query(wpa_s);
3442 return;
3443 }
3444 if (wpa_s->sme.sa_query_count == 0) {
3445 /* Starting a new SA Query procedure */
3446 os_get_reltime(&wpa_s->sme.sa_query_start);
3447 }
3448 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
3449 wpa_s->sme.sa_query_trans_id = nbuf;
3450 wpa_s->sme.sa_query_count++;
3451
3452 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
3453 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
3454 sme_stop_sa_query(wpa_s);
3455 return;
3456 }
3457
3458 timeout = sa_query_retry_timeout;
3459 sec = ((timeout / 1000) * 1024) / 1000;
3460 usec = (timeout % 1000) * 1024;
3461 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
3462
3463 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
3464 wpa_s->sme.sa_query_count);
3465
3466 sme_send_sa_query_req(wpa_s, trans_id);
3467 }
3468
3469
sme_start_sa_query(struct wpa_supplicant * wpa_s)3470 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
3471 {
3472 sme_sa_query_timer(wpa_s, NULL);
3473 }
3474
3475
sme_stop_sa_query(struct wpa_supplicant * wpa_s)3476 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
3477 {
3478 if (wpa_s->sme.sa_query_trans_id)
3479 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
3480 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
3481 os_free(wpa_s->sme.sa_query_trans_id);
3482 wpa_s->sme.sa_query_trans_id = NULL;
3483 wpa_s->sme.sa_query_count = 0;
3484 }
3485
3486
sme_event_unprot_disconnect(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * da,u16 reason_code)3487 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
3488 const u8 *da, u16 reason_code)
3489 {
3490 struct wpa_ssid *ssid;
3491 struct os_reltime now;
3492
3493 if (wpa_s->wpa_state != WPA_COMPLETED)
3494 return;
3495 ssid = wpa_s->current_ssid;
3496 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
3497 return;
3498 if (!ether_addr_equal(sa, wpa_s->bssid))
3499 return;
3500 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
3501 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
3502 return;
3503 if (wpa_s->sme.sa_query_count > 0)
3504 return;
3505 #ifdef CONFIG_TESTING_OPTIONS
3506 if (wpa_s->disable_sa_query)
3507 return;
3508 #endif /* CONFIG_TESTING_OPTIONS */
3509
3510 os_get_reltime(&now);
3511 if (wpa_s->sme.last_unprot_disconnect.sec &&
3512 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
3513 return; /* limit SA Query procedure frequency */
3514 wpa_s->sme.last_unprot_disconnect = now;
3515
3516 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
3517 "possible AP/STA state mismatch - trigger SA Query");
3518 sme_start_sa_query(wpa_s);
3519 }
3520
3521
sme_event_ch_switch(struct wpa_supplicant * wpa_s)3522 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
3523 {
3524 unsigned int usec;
3525 u32 _rand;
3526
3527 if (wpa_s->wpa_state != WPA_COMPLETED ||
3528 !wpa_sm_ocv_enabled(wpa_s->wpa))
3529 return;
3530
3531 wpa_dbg(wpa_s, MSG_DEBUG,
3532 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
3533 sme_stop_sa_query(wpa_s);
3534
3535 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
3536 _rand = os_random();
3537 usec = _rand % (sa_query_ch_switch_max_delay + 1);
3538 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
3539 }
3540
3541
sme_process_sa_query_request(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3542 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
3543 const u8 *sa, const u8 *data,
3544 size_t len)
3545 {
3546 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3547 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3548
3549 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
3550 MACSTR, MAC2STR(wpa_s->bssid));
3551
3552 resp[0] = WLAN_ACTION_SA_QUERY;
3553 resp[1] = WLAN_SA_QUERY_RESPONSE;
3554 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
3555
3556 #ifdef CONFIG_OCV
3557 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3558 struct wpa_channel_info ci;
3559
3560 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3561 wpa_printf(MSG_WARNING,
3562 "Failed to get channel info for OCI element in SA Query Response frame");
3563 return;
3564 }
3565
3566 #ifdef CONFIG_TESTING_OPTIONS
3567 if (wpa_s->oci_freq_override_saquery_resp) {
3568 wpa_printf(MSG_INFO,
3569 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
3570 ci.frequency,
3571 wpa_s->oci_freq_override_saquery_resp);
3572 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
3573 }
3574 #endif /* CONFIG_TESTING_OPTIONS */
3575
3576 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
3577 return;
3578
3579 resp_len += OCV_OCI_EXTENDED_LEN;
3580 }
3581 #endif /* CONFIG_OCV */
3582
3583 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3584 wpa_s->own_addr, wpa_s->bssid,
3585 resp, resp_len, 0) < 0)
3586 wpa_msg(wpa_s, MSG_INFO,
3587 "SME: Failed to send SA Query Response");
3588 }
3589
3590
sme_process_sa_query_response(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3591 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
3592 const u8 *sa, const u8 *data,
3593 size_t len)
3594 {
3595 int i;
3596
3597 if (!wpa_s->sme.sa_query_trans_id)
3598 return;
3599
3600 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
3601 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3602
3603 if (!ether_addr_equal(sa, wpa_s->bssid))
3604 return;
3605
3606 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
3607 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
3608 i * WLAN_SA_QUERY_TR_ID_LEN,
3609 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
3610 break;
3611 }
3612
3613 if (i >= wpa_s->sme.sa_query_count) {
3614 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
3615 "transaction identifier found");
3616 return;
3617 }
3618
3619 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
3620 "from " MACSTR, MAC2STR(sa));
3621 sme_stop_sa_query(wpa_s);
3622 }
3623
3624
sme_sa_query_rx(struct wpa_supplicant * wpa_s,const u8 * da,const u8 * sa,const u8 * data,size_t len)3625 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
3626 const u8 *data, size_t len)
3627 {
3628 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
3629 return;
3630 if (is_multicast_ether_addr(da)) {
3631 wpa_printf(MSG_DEBUG,
3632 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
3633 MAC2STR(da), MAC2STR(sa));
3634 return;
3635 }
3636
3637 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
3638 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3639
3640 #ifdef CONFIG_OCV
3641 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3642 struct ieee802_11_elems elems;
3643 struct wpa_channel_info ci;
3644
3645 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
3646 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
3647 &elems, 1) == ParseFailed) {
3648 wpa_printf(MSG_DEBUG,
3649 "SA Query: Failed to parse elements");
3650 return;
3651 }
3652
3653 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3654 wpa_printf(MSG_WARNING,
3655 "Failed to get channel info to validate received OCI in SA Query Action frame");
3656 return;
3657 }
3658
3659 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
3660 channel_width_to_int(ci.chanwidth),
3661 ci.seg1_idx) != OCI_SUCCESS) {
3662 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
3663 " frame=saquery%s error=%s",
3664 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
3665 "req" : "resp", ocv_errorstr);
3666 return;
3667 }
3668 }
3669 #endif /* CONFIG_OCV */
3670
3671 if (data[0] == WLAN_SA_QUERY_REQUEST)
3672 sme_process_sa_query_request(wpa_s, sa, data, len);
3673 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
3674 sme_process_sa_query_response(wpa_s, sa, data, len);
3675 }
3676
