1 /*
2 * wpa_supplicant - MBO
3 *
4 * Copyright(c) 2015 Intel Deutschland GmbH
5 * Contact Information:
6 * Intel Linux Wireless <ilw@linux.intel.com>
7 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
8 *
9 * This software may be distributed under the terms of the BSD license.
10 * See README for more details.
11 */
12
13 #include "utils/includes.h"
14
15 #include "utils/common.h"
16 #include "common/ieee802_11_defs.h"
17 #include "rsn_supp/wpa.h"
18 #include "wpa_supplicant_i.h"
19 #include "bss.h"
20 #include "scan.h"
21 #include "ieee802_11_common.h"
22
23 #ifdef ESP_SUPPLICANT
24 #include "esp_timer.h"
25 #include "esp_mbo.h"
26
27 extern struct wpa_supplicant g_wpa_supp;
28
29 #endif
30
31 /* type + length + oui + oui type */
32 #define MBO_IE_HEADER 6
33
34 #ifndef ESP_SUPPLICANT
wpas_mbo_validate_non_pref_chan(u8 oper_class,u8 chan,u8 reason)35 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
36 {
37 if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
38 return -1;
39
40 /* Only checking the validity of the channel and oper_class */
41 if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
42 return -1;
43
44 return 0;
45 }
46 #endif
47
mbo_attr_from_mbo_ie(const u8 * mbo_ie,enum mbo_attr_id attr)48 const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
49 {
50 const u8 *mbo;
51 u8 ie_len = mbo_ie[1];
52
53 if (ie_len < MBO_IE_HEADER - 2)
54 return NULL;
55 mbo = mbo_ie + MBO_IE_HEADER;
56
57 return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
58 }
59
60
mbo_get_attr_from_ies(const u8 * ies,size_t ies_len,enum mbo_attr_id attr)61 const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
62 enum mbo_attr_id attr)
63 {
64 const u8 *mbo_ie;
65
66 mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
67 if (!mbo_ie)
68 return NULL;
69
70 return mbo_attr_from_mbo_ie(mbo_ie, attr);
71 }
72
73
wpas_mbo_get_bss_attr(struct wpa_bss * bss,enum mbo_attr_id attr)74 const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
75 {
76 const u8 *mbo, *end;
77
78 if (!bss)
79 return NULL;
80
81 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
82 if (!mbo)
83 return NULL;
84
85 end = mbo + 2 + mbo[1];
86 mbo += MBO_IE_HEADER;
87
88 return get_ie(mbo, end - mbo, attr);
89 }
90
91
wpas_mbo_check_pmf(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)92 void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss
93 #ifndef ESP_SUPPLICANT
94 , struct wpa_ssid *ssid
95 #endif
96 )
97 {
98 const u8 *rsne, *mbo, *oce;
99 struct wpa_ie_data ie;
100
101 wpa_s->disable_mbo_oce = 0;
102 if (!bss)
103 return;
104 mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND);
105 oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND);
106 if (!mbo && !oce)
107 return;
108 if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
109 return; /* STA-CFON is not required to enable PMF */
110 rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
111 if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
112 return; /* AP is not using RSN */
113
114 if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
115 wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
116 #ifdef ESP_SUPPLICANT
117 if (!esp_wifi_sta_pmf_enabled())
118 #else
119 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
120 #endif
121 wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
122 if (wpa_s->disable_mbo_oce)
123 wpa_printf(MSG_INFO,
124 "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
125 }
126
wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)127 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
128 struct wpabuf *mbo,
129 u8 start, u8 end)
130 {
131 u8 i;
132
133 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
134
135 for (i = start; i < end; i++)
136 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
137
138 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
139 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
140 }
141
142
wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf * mbo,size_t size)143 static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
144 {
145 wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
146 wpabuf_put_u8(mbo, size); /* Length */
147 }
148
149
wpas_mbo_non_pref_chan_attr(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)150 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
151 struct wpabuf *mbo, u8 start, u8 end)
152 {
153 size_t size = end - start + 3;
154
155 if (size + 2 > wpabuf_tailroom(mbo))
156 return;
157
158 wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
159 wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
160 }
161
162
wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf * mbo,u8 len)163 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
164 {
165 wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
166 wpabuf_put_u8(mbo, len); /* Length */
167 wpabuf_put_be24(mbo, OUI_WFA);
168 wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
169 }
170
171
wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)172 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
173 struct wpabuf *mbo, u8 start,
174 u8 end)
175 {
176 size_t size = end - start + 7;
177
178 if (size + 2 > wpabuf_tailroom(mbo))
179 return;
180
181 wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
182 wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
183 }
184
185
wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,int subelement)186 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
187 struct wpabuf *mbo, int subelement)
188 {
189 u8 i, start = 0;
190 struct wpa_mbo_non_pref_channel *start_pref;
191
192 if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
193 if (subelement)
194 wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
195 else
196 wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
197 return;
198 }
199 start_pref = &wpa_s->non_pref_chan[0];
200
201 for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
202 struct wpa_mbo_non_pref_channel *non_pref = NULL;
203
204 if (i < wpa_s->non_pref_chan_num)
205 non_pref = &wpa_s->non_pref_chan[i];
206 if (!non_pref ||
207 non_pref->oper_class != start_pref->oper_class ||
208 non_pref->reason != start_pref->reason ||
209 non_pref->preference != start_pref->preference) {
210 if (subelement)
211 wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
212 start, i);
213 else
214 wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
215 i);
216
217 if (!non_pref)
218 return;
219
220 start = i;
221 start_pref = non_pref;
222 }
223 }
224 }
225
wpas_mbo_ie(struct wpa_supplicant * wpa_s,u8 * buf,size_t len,int add_oce_capa)226 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len,
227 int add_oce_capa)
228 {
229 struct wpabuf *mbo;
230 int res;
231
232 if (len < MBO_IE_HEADER + 3 + 7 +
233 ((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
234 return 0;
235
236 /* Leave room for the MBO IE header */
237 mbo = wpabuf_alloc(len - MBO_IE_HEADER);
238 if (!mbo)
239 return 0;
240
241 /* Add non-preferred channels attribute */
242 wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
243
244 /*
245 * Send cellular capabilities attribute even if AP does not advertise
246 * cellular capabilities.
247 */
248 wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
249 wpabuf_put_u8(mbo, 1);
250 #ifdef ESP_SUPPLICANT
251 wpabuf_put_u8(mbo, MBO_CELL_CAPA_NOT_SUPPORTED);
252 #else
253 wpabuf_put_u8(mbo, wpa_s->mbo_cell_capa);
254 #endif
255
256 /* Add OCE capability indication attribute if OCE is enabled */
257 if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
258 wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
259 wpabuf_put_u8(mbo, 1);
260 wpabuf_put_u8(mbo, OCE_RELEASE);
261 }
262
263 res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
264 if (!res)
265 wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");
266
267 wpabuf_free(mbo);
268 return res;
269 }
270
271
wpas_mbo_send_wnm_notification(struct wpa_supplicant * wpa_s,const u8 * data,size_t len)272 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
273 const u8 *data, size_t len)
274 {
275 struct wpabuf *buf;
276 int res;
277
278 /*
279 * Send WNM-Notification Request frame only in case of a change in
280 * non-preferred channels list during association, if the AP supports
281 * MBO.
282 */
283 if (!wpa_s->current_bss ||
284 !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
285 return;
286
287 buf = wpabuf_alloc(4 + len);
288 if (!buf)
289 return;
290
291 wpabuf_put_u8(buf, WLAN_ACTION_WNM);
292 wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
293 wpa_s->mbo_wnm_token++;
294 if (wpa_s->mbo_wnm_token == 0)
295 wpa_s->mbo_wnm_token++;
296 wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
297 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
298
299 wpabuf_put_data(buf, data, len);
300
301 res = wpa_drv_send_action(wpa_s, 0, 0,
302 wpabuf_head(buf), wpabuf_len(buf), 0);
303 if (res < 0)
304 wpa_printf(MSG_DEBUG,
305 "Failed to send WNM-Notification Request frame with non-preferred channel list");
306
307 wpabuf_free(buf);
308 }
309
310
wpas_mbo_non_pref_chan_changed(struct wpa_supplicant * wpa_s)311 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
312 {
313 struct wpabuf *buf;
314
315 buf = wpabuf_alloc(512);
316 if (!buf)
317 return;
318
319 wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
320 wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
321 wpabuf_len(buf));
322 wpabuf_free(buf);
323 }
324
325
326 #ifndef ESP_SUPPLICANT
wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel * a,struct wpa_mbo_non_pref_channel * b)327 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
328 struct wpa_mbo_non_pref_channel *b)
329 {
330 return a->oper_class == b->oper_class && a->chan == b->chan;
331 }
332
333 /*
334 * wpa_non_pref_chan_cmp - Compare two channels for sorting
335 *
336 * In MBO IE non-preferred channel subelement we can put many channels in an
337 * attribute if they are in the same operating class and have the same
338 * preference and reason. To make it easy for the functions that build
339 * the IE attributes and WNM Request subelements, save the channels sorted
340 * by their oper_class and reason.
341 */
wpa_non_pref_chan_cmp(const void * _a,const void * _b)342 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
343 {
344 const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
345
346 if (a->oper_class != b->oper_class)
347 return (int) a->oper_class - (int) b->oper_class;
348 if (a->reason != b->reason)
349 return (int) a->reason - (int) b->reason;
350 return (int) a->preference - (int) b->preference;
351 }
352
353
wpas_mbo_update_non_pref_chan(struct wpa_supplicant * wpa_s,const char * non_pref_chan)354 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
355 const char *non_pref_chan)
356 {
357 char *cmd, *token, *context = NULL;
358 struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
359 size_t num = 0, size = 0;
360 unsigned i;
361
362 wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
363 non_pref_chan ? non_pref_chan : "N/A");
364
365 /*
366 * The shortest channel configuration is 7 characters - 3 colons and
367 * 4 values.
368 */
369 if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
370 goto update;
371
372 cmd = os_strdup(non_pref_chan);
373 if (!cmd)
374 return -1;
375
376 while ((token = str_token(cmd, " ", &context))) {
377 struct wpa_mbo_non_pref_channel *chan;
378 int ret;
379 unsigned int _oper_class;
380 unsigned int _chan;
381 unsigned int _preference;
382 unsigned int _reason;
383
384 if (num == size) {
385 size = size ? size * 2 : 1;
386 tmp_chans = os_realloc_array(chans, size,
387 sizeof(*chans));
388 if (!tmp_chans) {
389 wpa_printf(MSG_ERROR,
390 "Couldn't reallocate non_pref_chan");
391 goto fail;
392 }
393 chans = tmp_chans;
394 }
395
396 chan = &chans[num];
397
398 ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
399 &_chan, &_preference, &_reason);
400 if (ret != 4 ||
401 _oper_class > 255 || _chan > 255 ||
402 _preference > 255 || _reason > 65535 ) {
403 wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
404 token);
405 goto fail;
406 }
407 chan->oper_class = _oper_class;
408 chan->chan = _chan;
409 chan->preference = _preference;
410 chan->reason = _reason;
411
412 if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
413 chan->chan, chan->reason)) {
414 wpa_printf(MSG_ERROR,
415 "Invalid non_pref_chan: oper class %d chan %d reason %d",
416 chan->oper_class, chan->chan, chan->reason);
417 goto fail;
418 }
419
420 for (i = 0; i < num; i++)
421 if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
422 break;
423 if (i != num) {
424 wpa_printf(MSG_ERROR,
425 "oper class %d chan %d is duplicated",
426 chan->oper_class, chan->chan);
427 goto fail;
428 }
429
430 num++;
431 }
432
433 os_free(cmd);
434
435 if (chans) {
436 qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
437 wpa_non_pref_chan_cmp);
438 }
439
440 update:
441 os_free(wpa_s->non_pref_chan);
442 wpa_s->non_pref_chan = chans;
443 wpa_s->non_pref_chan_num = num;
444 wpas_mbo_non_pref_chan_changed(wpa_s);
445
446 return 0;
447
448 fail:
449 os_free(chans);
450 os_free(cmd);
451 return -1;
452 }
453 #else
wpas_mbo_update_non_pref_chan(struct wpa_supplicant * wpa_s,struct non_pref_chan_s * non_pref_chan)454 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
455 struct non_pref_chan_s *non_pref_chan)
456 {
457 struct wpa_mbo_non_pref_channel *chans = NULL;
458 /*
459 * The shortest channel configuration is 7 characters - 3 colons and
460 * 4 values.
461 */
462 if (!non_pref_chan)
463 goto update;
464
465
466 chans = os_malloc(sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num);
467 os_memcpy(chans, non_pref_chan->chan, sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num);
468
469 update:
470 os_free(wpa_s->non_pref_chan);
471 wpa_s->non_pref_chan = chans;
472 if (non_pref_chan)
473 wpa_s->non_pref_chan_num = non_pref_chan->non_pref_chan_num;
474 else
475 wpa_s->non_pref_chan_num = 0;
476 wpas_mbo_non_pref_chan_changed(wpa_s);
477
478 return 0;
479 }
480
481 #endif
482
wpas_mbo_scan_ie(struct wpa_supplicant * wpa_s,struct wpabuf * ie)483 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
484 {
485 u8 *len;
486
487 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
488 len = wpabuf_put(ie, 1);
489
490 wpabuf_put_be24(ie, OUI_WFA);
491 wpabuf_put_u8(ie, MBO_OUI_TYPE);
492
493 wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
494 wpabuf_put_u8(ie, 1);
495 #ifdef ESP_SUPPLICANT
496 wpabuf_put_u8(ie, MBO_CELL_CAPA_NOT_SUPPORTED);
497 #else
498 wpabuf_put_u8(ie, wpa_s->mbo_cell_capa);
499 #endif
500 if (wpa_s->enable_oce & OCE_STA) {
501 wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
502 wpabuf_put_u8(ie, 1);
503 wpabuf_put_u8(ie, OCE_RELEASE);
504 }
505 *len = (u8 *) wpabuf_put(ie, 0) - len - 1;
506 }
507
508 #ifdef ESP_SUPPLICANT
509
510 static struct
wpas_get_disallowed_bss(struct wpa_supplicant * wpa_s,const u8 * bssid)511 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
512 const u8 *bssid)
513 {
514 struct wpa_bss_tmp_disallowed *bss;
515
516 dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
517 struct wpa_bss_tmp_disallowed, list) {
518 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
519 return bss;
520 }
521
522 return NULL;
523 }
524
wpa_bss_tmp_disallow_timeout(void * timeout_ctx)525 static void wpa_bss_tmp_disallow_timeout(void *timeout_ctx)
526 {
527 struct wpa_supplicant *wpa_s = &g_wpa_supp;
528 struct wpa_bss_tmp_disallowed *tmp, *bss = timeout_ctx;
529
530 /* Make sure the bss is not already freed */
531 dl_list_for_each(tmp, &wpa_s->bss_tmp_disallowed,
532 struct wpa_bss_tmp_disallowed, list) {
533 if (bss == tmp) {
534 dl_list_del(&tmp->list);
535 esp_timer_stop(bss->blacklist_timer);
536 esp_timer_delete(bss->blacklist_timer);
537 os_free(tmp);
538 break;
539 }
540 }
541 }
542
wpa_bss_tmp_disallow(struct wpa_supplicant * wpa_s,const u8 * bssid,unsigned int sec,int rssi_threshold)543 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
544 unsigned int sec, int rssi_threshold)
545 {
546 struct wpa_bss_tmp_disallowed *bss;
547
548 bss = wpas_get_disallowed_bss(wpa_s, bssid);
549 if (bss) {
550 esp_timer_stop(bss->blacklist_timer);
551 goto finish;
552 }
553
554 bss = os_malloc(sizeof(*bss));
555 if (!bss) {
556 wpa_printf(MSG_DEBUG,
557 "Failed to allocate memory for temp disallow BSS");
558 return;
559 }
560
561 esp_timer_create_args_t blacklist_timer_create = {
562 .callback = &wpa_bss_tmp_disallow_timeout,
563 .arg = bss,
564 .dispatch_method = ESP_TIMER_TASK,
565 .name = "blacklist_timeout_timer"
566 };
567 if (esp_timer_create(&blacklist_timer_create, &(bss->blacklist_timer)) != ESP_OK) {
568 os_free(bss);
569 return;
570 }
571
572 os_memcpy(bss->bssid, bssid, ETH_ALEN);
573 dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
574
575 finish:
576 esp_timer_start_once(bss->blacklist_timer, (sec + 1) * 1e6);
577 }
578
wpa_is_bss_tmp_disallowed(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)579 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s,
580 struct wpa_bss *bss)
581 {
582 struct wpa_bss_tmp_disallowed *disallowed = NULL, *tmp, *prev;
583
584 dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
585 struct wpa_bss_tmp_disallowed, list) {
586 if (os_memcmp(bss->bssid, tmp->bssid, ETH_ALEN) == 0) {
587 disallowed = tmp;
588 break;
589 }
590 }
591 if (!disallowed)
592 return 0;
593
594 return 1;
595 }
596 #endif
597
wpas_mbo_ie_trans_req(struct wpa_supplicant * wpa_s,const u8 * mbo_ie,size_t len)598 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
599 size_t len)
600 {
601 const u8 *pos, *cell_pref = NULL;
602 u8 id, elen;
603 u16 disallowed_sec = 0;
604
605 if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
606 mbo_ie[3] != MBO_OUI_TYPE)
607 return;
608
609 pos = mbo_ie + 4;
610 len -= 4;
611
612 while (len >= 2) {
613 id = *pos++;
614 elen = *pos++;
615 len -= 2;
616
617 if (elen > len)
618 goto fail;
619
620 switch (id) {
621 case MBO_ATTR_ID_CELL_DATA_PREF:
622 if (elen != 1)
623 goto fail;
624
625 #ifndef ESP_SUPPLICANT
626 if (wpa_s->mbo_cell_capa ==
627 MBO_CELL_CAPA_AVAILABLE)
628 cell_pref = pos;
629 else
630 #endif
631 wpa_printf(MSG_DEBUG,
632 "MBO: Station does not support Cellular data connection");
633 break;
634 case MBO_ATTR_ID_TRANSITION_REASON:
635 if (elen != 1)
636 goto fail;
637
638 wpa_s->wnm_mbo_trans_reason_present = 1;
639 wpa_s->wnm_mbo_transition_reason = *pos;
640 break;
641 case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
642 if (elen != 2)
643 goto fail;
644
645 if (wpa_s->wnm_mode &
646 WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
647 wpa_printf(MSG_DEBUG,
648 "MBO: Unexpected association retry delay, BSS is terminating");
649 goto fail;
650 } else if (wpa_s->wnm_mode &
651 WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
652 disallowed_sec = WPA_GET_LE16(pos);
653 wpa_printf(MSG_DEBUG,
654 "MBO: Association retry delay: %u",
655 disallowed_sec);
656 } else {
657 wpa_printf(MSG_DEBUG,
658 "MBO: Association retry delay attribute not in disassoc imminent mode");
659 }
660
661 break;
662 case MBO_ATTR_ID_AP_CAPA_IND:
663 case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
664 case MBO_ATTR_ID_CELL_DATA_CAPA:
665 case MBO_ATTR_ID_ASSOC_DISALLOW:
666 case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
667 wpa_printf(MSG_DEBUG,
668 "MBO: Attribute %d should not be included in BTM Request frame",
669 id);
670 break;
671 default:
672 wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
673 id);
674 return;
675 }
676
677 pos += elen;
678 len -= elen;
679 }
680
681 if (cell_pref)
682 wpa_printf(MSG_INFO, "preference=%u",
683 *cell_pref);
684
685 if (wpa_s->wnm_mbo_trans_reason_present)
686 wpa_printf(MSG_INFO, "reason=%u",
687 wpa_s->wnm_mbo_transition_reason);
688
689 if (disallowed_sec && wpa_s->current_bss)
690 wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
691 disallowed_sec, 0);
692
693 return;
694 fail:
695 wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
696 id, elen, len);
697 }
698
699
wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant * wpa_s,u8 * pos,size_t len,enum mbo_transition_reject_reason reason)700 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
701 size_t len,
702 enum mbo_transition_reject_reason reason)
703 {
704 u8 reject_attr[3];
705
706 reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
707 reject_attr[1] = 1;
708 reject_attr[2] = reason;
709
710 return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
711 }
712
713
714 #ifndef ESP_SUPPLICANT
wpas_mbo_update_cell_capa(struct wpa_supplicant * wpa_s,u8 mbo_cell_capa)715 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
716 {
717 u8 cell_capa[7];
718
719 if (wpa_s->mbo_cell_capa == mbo_cell_capa) {
720 wpa_printf(MSG_DEBUG,
721 "MBO: Cellular capability already set to %u",
722 mbo_cell_capa);
723 return;
724 }
725
726 wpa_s->mbo_cell_capa = mbo_cell_capa;
727
728 cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
729 cell_capa[1] = 5; /* Length */
730 WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
731 cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
732 cell_capa[6] = mbo_cell_capa;
733
734 wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
735 wpa_supplicant_set_default_scan_ies(wpa_s);
736 }
737
738
mbo_build_anqp_buf(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,u32 mbo_subtypes)739 struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
740 struct wpa_bss *bss, u32 mbo_subtypes)
741 {
742 struct wpabuf *anqp_buf;
743 u8 *len_pos;
744 u8 i;
745
746 if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
747 wpa_printf(MSG_INFO, "MBO: " MACSTR
748 " does not support MBO - cannot request MBO ANQP elements from it",
749 MAC2STR(bss->bssid));
750 return NULL;
751 }
752
753 /* Allocate size for the maximum case - all MBO subtypes are set */
754 anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
755 if (!anqp_buf)
756 return NULL;
757
758 len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
759 wpabuf_put_be24(anqp_buf, OUI_WFA);
760 wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
761
762 wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);
763
764 /* The first valid MBO subtype is 1 */
765 for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
766 if (mbo_subtypes & BIT(i))
767 wpabuf_put_u8(anqp_buf, i);
768 }
769
770 gas_anqp_set_element_len(anqp_buf, len_pos);
771
772 return anqp_buf;
773 }
774
775
mbo_parse_rx_anqp_resp(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,const u8 * sa,const u8 * data,size_t slen)776 void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
777 struct wpa_bss *bss, const u8 *sa,
778 const u8 *data, size_t slen)
779 {
780 const u8 *pos = data;
781 u8 subtype;
782
783 if (slen < 1)
784 return;
785
786 subtype = *pos++;
787 slen--;
788
789 switch (subtype) {
790 case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
791 if (slen < 1)
792 break;
793 wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
794 " cell_conn_pref=%u", MAC2STR(sa), *pos);
795 break;
796 default:
797 wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
798 subtype);
799 break;
800 }
801 }
802 #endif
803
