Home | History | Annotate | Download | only in wpa_supplicant
      1 /*
      2  * WPA Supplicant
      3  * Copyright (c) 2003-2019, Jouni Malinen <j (at) w1.fi>
      4  *
      5  * This software may be distributed under the terms of the BSD license.
      6  * See README for more details.
      7  *
      8  * This file implements functions for registering and unregistering
      9  * %wpa_supplicant interfaces. In addition, this file contains number of
     10  * functions for managing network connections.
     11  */
     12 
     13 #include "includes.h"
     14 #ifdef CONFIG_MATCH_IFACE
     15 #include <net/if.h>
     16 #include <fnmatch.h>
     17 #endif /* CONFIG_MATCH_IFACE */
     18 
     19 #include "common.h"
     20 #include "crypto/random.h"
     21 #include "crypto/sha1.h"
     22 #include "eapol_supp/eapol_supp_sm.h"
     23 #include "eap_peer/eap.h"
     24 #include "eap_peer/eap_proxy.h"
     25 #include "eap_server/eap_methods.h"
     26 #include "rsn_supp/wpa.h"
     27 #include "eloop.h"
     28 #include "config.h"
     29 #include "utils/ext_password.h"
     30 #include "l2_packet/l2_packet.h"
     31 #include "wpa_supplicant_i.h"
     32 #include "driver_i.h"
     33 #include "ctrl_iface.h"
     34 #include "pcsc_funcs.h"
     35 #include "common/version.h"
     36 #include "rsn_supp/preauth.h"
     37 #include "rsn_supp/pmksa_cache.h"
     38 #include "common/wpa_ctrl.h"
     39 #include "common/ieee802_11_defs.h"
     40 #include "common/hw_features_common.h"
     41 #include "common/gas_server.h"
     42 #include "common/dpp.h"
     43 #include "p2p/p2p.h"
     44 #include "fst/fst.h"
     45 #include "blacklist.h"
     46 #include "wpas_glue.h"
     47 #include "wps_supplicant.h"
     48 #include "ibss_rsn.h"
     49 #include "sme.h"
     50 #include "gas_query.h"
     51 #include "ap.h"
     52 #include "p2p_supplicant.h"
     53 #include "wifi_display.h"
     54 #include "notify.h"
     55 #include "bgscan.h"
     56 #include "autoscan.h"
     57 #include "bss.h"
     58 #include "scan.h"
     59 #include "offchannel.h"
     60 #include "hs20_supplicant.h"
     61 #include "wnm_sta.h"
     62 #include "wpas_kay.h"
     63 #include "mesh.h"
     64 #include "dpp_supplicant.h"
     65 #ifdef CONFIG_MESH
     66 #include "ap/ap_config.h"
     67 #include "ap/hostapd.h"
     68 #endif /* CONFIG_MESH */
     69 
     70 const char *const wpa_supplicant_version =
     71 "wpa_supplicant v" VERSION_STR "\n"
     72 "Copyright (c) 2003-2019, Jouni Malinen <j (at) w1.fi> and contributors";
     73 
     74 const char *const wpa_supplicant_license =
     75 "This software may be distributed under the terms of the BSD license.\n"
     76 "See README for more details.\n"
     77 #ifdef EAP_TLS_OPENSSL
     78 "\nThis product includes software developed by the OpenSSL Project\n"
     79 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
     80 #endif /* EAP_TLS_OPENSSL */
     81 ;
     82 
     83 #ifndef CONFIG_NO_STDOUT_DEBUG
     84 /* Long text divided into parts in order to fit in C89 strings size limits. */
     85 const char *const wpa_supplicant_full_license1 =
     86 "";
     87 const char *const wpa_supplicant_full_license2 =
     88 "This software may be distributed under the terms of the BSD license.\n"
     89 "\n"
     90 "Redistribution and use in source and binary forms, with or without\n"
     91 "modification, are permitted provided that the following conditions are\n"
     92 "met:\n"
     93 "\n";
     94 const char *const wpa_supplicant_full_license3 =
     95 "1. Redistributions of source code must retain the above copyright\n"
     96 "   notice, this list of conditions and the following disclaimer.\n"
     97 "\n"
     98 "2. Redistributions in binary form must reproduce the above copyright\n"
     99 "   notice, this list of conditions and the following disclaimer in the\n"
    100 "   documentation and/or other materials provided with the distribution.\n"
    101 "\n";
    102 const char *const wpa_supplicant_full_license4 =
    103 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
    104 "   names of its contributors may be used to endorse or promote products\n"
    105 "   derived from this software without specific prior written permission.\n"
    106 "\n"
    107 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
    108 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
    109 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
    110 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
    111 const char *const wpa_supplicant_full_license5 =
    112 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
    113 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
    114 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
    115 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
    116 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
    117 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
    118 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
    119 "\n";
    120 #endif /* CONFIG_NO_STDOUT_DEBUG */
    121 
    122 
    123 static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx);
    124 #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
    125 static void wpas_update_fils_connect_params(struct wpa_supplicant *wpa_s);
    126 #endif /* CONFIG_FILS && IEEE8021X_EAPOL */
    127 
    128 
    129 /* Configure default/group WEP keys for static WEP */
    130 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
    131 {
    132 	int i, set = 0;
    133 
    134 	for (i = 0; i < NUM_WEP_KEYS; i++) {
    135 		if (ssid->wep_key_len[i] == 0)
    136 			continue;
    137 
    138 		set = 1;
    139 		wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
    140 				i, i == ssid->wep_tx_keyidx, NULL, 0,
    141 				ssid->wep_key[i], ssid->wep_key_len[i]);
    142 	}
    143 
    144 	return set;
    145 }
    146 
    147 
    148 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
    149 				    struct wpa_ssid *ssid)
    150 {
    151 	u8 key[32];
    152 	size_t keylen;
    153 	enum wpa_alg alg;
    154 	u8 seq[6] = { 0 };
    155 	int ret;
    156 
    157 	/* IBSS/WPA-None uses only one key (Group) for both receiving and
    158 	 * sending unicast and multicast packets. */
    159 
    160 	if (ssid->mode != WPAS_MODE_IBSS) {
    161 		wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
    162 			"IBSS/ad-hoc) for WPA-None", ssid->mode);
    163 		return -1;
    164 	}
    165 
    166 	if (!ssid->psk_set) {
    167 		wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
    168 			"WPA-None");
    169 		return -1;
    170 	}
    171 
    172 	switch (wpa_s->group_cipher) {
    173 	case WPA_CIPHER_CCMP:
    174 		os_memcpy(key, ssid->psk, 16);
    175 		keylen = 16;
    176 		alg = WPA_ALG_CCMP;
    177 		break;
    178 	case WPA_CIPHER_GCMP:
    179 		os_memcpy(key, ssid->psk, 16);
    180 		keylen = 16;
    181 		alg = WPA_ALG_GCMP;
    182 		break;
    183 	case WPA_CIPHER_TKIP:
    184 		/* WPA-None uses the same Michael MIC key for both TX and RX */
    185 		os_memcpy(key, ssid->psk, 16 + 8);
    186 		os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
    187 		keylen = 32;
    188 		alg = WPA_ALG_TKIP;
    189 		break;
    190 	default:
    191 		wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
    192 			"WPA-None", wpa_s->group_cipher);
    193 		return -1;
    194 	}
    195 
    196 	/* TODO: should actually remember the previously used seq#, both for TX
    197 	 * and RX from each STA.. */
    198 
    199 	ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
    200 	os_memset(key, 0, sizeof(key));
    201 	return ret;
    202 }
    203 
    204 
    205 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
    206 {
    207 	struct wpa_supplicant *wpa_s = eloop_ctx;
    208 	const u8 *bssid = wpa_s->bssid;
    209 	if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
    210 	    (wpa_s->wpa_state == WPA_AUTHENTICATING ||
    211 	     wpa_s->wpa_state == WPA_ASSOCIATING))
    212 		bssid = wpa_s->pending_bssid;
    213 	wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
    214 		MAC2STR(bssid));
    215 	wpa_blacklist_add(wpa_s, bssid);
    216 	wpa_sm_notify_disassoc(wpa_s->wpa);
    217 	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
    218 	wpa_s->reassociate = 1;
    219 	wpas_notify_auth_timeout(wpa_s);
    220 
    221 	/*
    222 	 * If we timed out, the AP or the local radio may be busy.
    223 	 * So, wait a second until scanning again.
    224 	 */
    225 	wpa_supplicant_req_scan(wpa_s, 1, 0);
    226 }
    227 
    228 
    229 /**
    230  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
    231  * @wpa_s: Pointer to wpa_supplicant data
    232  * @sec: Number of seconds after which to time out authentication
    233  * @usec: Number of microseconds after which to time out authentication
    234  *
    235  * This function is used to schedule a timeout for the current authentication
    236  * attempt.
    237  */
    238 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
    239 				     int sec, int usec)
    240 {
    241 	if (wpa_s->conf->ap_scan == 0 &&
    242 	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
    243 		return;
    244 
    245 	wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
    246 		"%d usec", sec, usec);
    247 	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
    248 	wpa_s->last_auth_timeout_sec = sec;
    249 	eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
    250 }
    251 
    252 
    253 /*
    254  * wpas_auth_timeout_restart - Restart and change timeout for authentication
    255  * @wpa_s: Pointer to wpa_supplicant data
    256  * @sec_diff: difference in seconds applied to original timeout value
    257  */
    258 void wpas_auth_timeout_restart(struct wpa_supplicant *wpa_s, int sec_diff)
    259 {
    260 	int new_sec = wpa_s->last_auth_timeout_sec + sec_diff;
    261 
    262 	if (eloop_is_timeout_registered(wpa_supplicant_timeout, wpa_s, NULL)) {
    263 		wpa_dbg(wpa_s, MSG_DEBUG,
    264 			"Authentication timeout restart: %d sec", new_sec);
    265 		eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
    266 		eloop_register_timeout(new_sec, 0, wpa_supplicant_timeout,
    267 				       wpa_s, NULL);
    268 	}
    269 }
    270 
    271 
    272 /**
    273  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
    274  * @wpa_s: Pointer to wpa_supplicant data
    275  *
    276  * This function is used to cancel authentication timeout scheduled with
    277  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
    278  * been completed.
    279  */
    280 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
    281 {
    282 	wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
    283 	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
    284 	wpa_blacklist_del(wpa_s, wpa_s->bssid);
    285 	os_free(wpa_s->last_con_fail_realm);
    286 	wpa_s->last_con_fail_realm = NULL;
    287 	wpa_s->last_con_fail_realm_len = 0;
    288 }
    289 
    290 
    291 /**
    292  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
    293  * @wpa_s: Pointer to wpa_supplicant data
    294  *
    295  * This function is used to configure EAPOL state machine based on the selected
    296  * authentication mode.
    297  */
    298 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
    299 {
    300 #ifdef IEEE8021X_EAPOL
    301 	struct eapol_config eapol_conf;
    302 	struct wpa_ssid *ssid = wpa_s->current_ssid;
    303 
    304 #ifdef CONFIG_IBSS_RSN
    305 	if (ssid->mode == WPAS_MODE_IBSS &&
    306 	    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
    307 	    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
    308 		/*
    309 		 * RSN IBSS authentication is per-STA and we can disable the
    310 		 * per-BSSID EAPOL authentication.
    311 		 */
    312 		eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
    313 		eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
    314 		eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
    315 		return;
    316 	}
    317 #endif /* CONFIG_IBSS_RSN */
    318 
    319 	eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
    320 	eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
    321 
    322 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
    323 	    wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
    324 		eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
    325 	else
    326 		eapol_sm_notify_portControl(wpa_s->eapol, Auto);
    327 
    328 	os_memset(&eapol_conf, 0, sizeof(eapol_conf));
    329 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
    330 		eapol_conf.accept_802_1x_keys = 1;
    331 		eapol_conf.required_keys = 0;
    332 		if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
    333 			eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
    334 		}
    335 		if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
    336 			eapol_conf.required_keys |=
    337 				EAPOL_REQUIRE_KEY_BROADCAST;
    338 		}
    339 
    340 		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
    341 			eapol_conf.required_keys = 0;
    342 	}
    343 	eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
    344 	eapol_conf.workaround = ssid->eap_workaround;
    345 	eapol_conf.eap_disabled =
    346 		!wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
    347 		wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
    348 		wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
    349 	eapol_conf.external_sim = wpa_s->conf->external_sim;
    350 
    351 #ifdef CONFIG_WPS
    352 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
    353 		eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
    354 		if (wpa_s->current_bss) {
    355 			struct wpabuf *ie;
    356 			ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
    357 							 WPS_IE_VENDOR_TYPE);
    358 			if (ie) {
    359 				if (wps_is_20(ie))
    360 					eapol_conf.wps |=
    361 						EAPOL_PEER_IS_WPS20_AP;
    362 				wpabuf_free(ie);
    363 			}
    364 		}
    365 	}
    366 #endif /* CONFIG_WPS */
    367 
    368 	eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
    369 
    370 #ifdef CONFIG_MACSEC
    371 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE && ssid->mka_psk_set)
    372 		ieee802_1x_create_preshared_mka(wpa_s, ssid);
    373 	else
    374 		ieee802_1x_alloc_kay_sm(wpa_s, ssid);
    375 #endif /* CONFIG_MACSEC */
    376 #endif /* IEEE8021X_EAPOL */
    377 }
    378 
    379 
    380 /**
    381  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
    382  * @wpa_s: Pointer to wpa_supplicant data
    383  * @ssid: Configuration data for the network
    384  *
    385  * This function is used to configure WPA state machine and related parameters
    386  * to a mode where WPA is not enabled. This is called as part of the
    387  * authentication configuration when the selected network does not use WPA.
    388  */
    389 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
    390 				       struct wpa_ssid *ssid)
    391 {
    392 	int i;
    393 
    394 	if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
    395 		wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
    396 	else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
    397 		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
    398 	else
    399 		wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
    400 	wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
    401 	wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
    402 	wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
    403 	wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
    404 	wpa_s->group_cipher = WPA_CIPHER_NONE;
    405 	wpa_s->mgmt_group_cipher = 0;
    406 
    407 	for (i = 0; i < NUM_WEP_KEYS; i++) {
    408 		if (ssid->wep_key_len[i] > 5) {
    409 			wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
    410 			wpa_s->group_cipher = WPA_CIPHER_WEP104;
    411 			break;
    412 		} else if (ssid->wep_key_len[i] > 0) {
    413 			wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
    414 			wpa_s->group_cipher = WPA_CIPHER_WEP40;
    415 			break;
    416 		}
    417 	}
    418 
    419 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
    420 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
    421 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
    422 			 wpa_s->pairwise_cipher);
    423 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
    424 #ifdef CONFIG_IEEE80211W
    425 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
    426 			 wpa_s->mgmt_group_cipher);
    427 #endif /* CONFIG_IEEE80211W */
    428 
    429 	pmksa_cache_clear_current(wpa_s->wpa);
    430 }
    431 
    432 
    433 void free_hw_features(struct wpa_supplicant *wpa_s)
    434 {
    435 	int i;
    436 	if (wpa_s->hw.modes == NULL)
    437 		return;
    438 
    439 	for (i = 0; i < wpa_s->hw.num_modes; i++) {
    440 		os_free(wpa_s->hw.modes[i].channels);
    441 		os_free(wpa_s->hw.modes[i].rates);
    442 	}
    443 
    444 	os_free(wpa_s->hw.modes);
    445 	wpa_s->hw.modes = NULL;
    446 }
    447 
    448 
    449 void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
    450 {
    451 	struct wpa_bss_tmp_disallowed *bss, *prev;
    452 
    453 	dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
    454 			      struct wpa_bss_tmp_disallowed, list) {
    455 		eloop_cancel_timeout(wpa_bss_tmp_disallow_timeout, wpa_s, bss);
    456 		dl_list_del(&bss->list);
    457 		os_free(bss);
    458 	}
    459 }
    460 
    461 
    462 void wpas_flush_fils_hlp_req(struct wpa_supplicant *wpa_s)
    463 {
    464 	struct fils_hlp_req *req;
    465 
    466 	while ((req = dl_list_first(&wpa_s->fils_hlp_req, struct fils_hlp_req,
    467 				    list)) != NULL) {
    468 		dl_list_del(&req->list);
    469 		wpabuf_free(req->pkt);
    470 		os_free(req);
    471 	}
    472 }
    473 
    474 
    475 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
    476 {
    477 	int i;
    478 
    479 	bgscan_deinit(wpa_s);
    480 	autoscan_deinit(wpa_s);
    481 	scard_deinit(wpa_s->scard);
    482 	wpa_s->scard = NULL;
    483 	wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
    484 	eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
    485 	l2_packet_deinit(wpa_s->l2);
    486 	wpa_s->l2 = NULL;
    487 	if (wpa_s->l2_br) {
    488 		l2_packet_deinit(wpa_s->l2_br);
    489 		wpa_s->l2_br = NULL;
    490 	}
    491 #ifdef CONFIG_TESTING_OPTIONS
    492 	l2_packet_deinit(wpa_s->l2_test);
    493 	wpa_s->l2_test = NULL;
    494 	os_free(wpa_s->get_pref_freq_list_override);
    495 	wpa_s->get_pref_freq_list_override = NULL;
    496 	wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
    497 	wpa_s->last_assoc_req_wpa_ie = NULL;
    498 #endif /* CONFIG_TESTING_OPTIONS */
    499 
    500 	if (wpa_s->conf != NULL) {
    501 		struct wpa_ssid *ssid;
    502 		for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
    503 			wpas_notify_network_removed(wpa_s, ssid);
    504 	}
    505 
    506 	os_free(wpa_s->confname);
    507 	wpa_s->confname = NULL;
    508 
    509 	os_free(wpa_s->confanother);
    510 	wpa_s->confanother = NULL;
    511 
    512 	os_free(wpa_s->last_con_fail_realm);
    513 	wpa_s->last_con_fail_realm = NULL;
    514 	wpa_s->last_con_fail_realm_len = 0;
    515 
    516 	wpa_sm_set_eapol(wpa_s->wpa, NULL);
    517 	eapol_sm_deinit(wpa_s->eapol);
    518 	wpa_s->eapol = NULL;
    519 
    520 	rsn_preauth_deinit(wpa_s->wpa);
    521 
    522 #ifdef CONFIG_TDLS
    523 	wpa_tdls_deinit(wpa_s->wpa);
    524 #endif /* CONFIG_TDLS */
    525 
    526 	wmm_ac_clear_saved_tspecs(wpa_s);
    527 	pmksa_candidate_free(wpa_s->wpa);
    528 	wpa_sm_deinit(wpa_s->wpa);
    529 	wpa_s->wpa = NULL;
    530 	wpa_blacklist_clear(wpa_s);
    531 
    532 	wpa_bss_deinit(wpa_s);
    533 
    534 	wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
    535 	wpa_supplicant_cancel_scan(wpa_s);
    536 	wpa_supplicant_cancel_auth_timeout(wpa_s);
    537 	eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
    538 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
    539 	eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
    540 			     wpa_s, NULL);
    541 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
    542 
    543 	eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
    544 
    545 	wpas_wps_deinit(wpa_s);
    546 
    547 	wpabuf_free(wpa_s->pending_eapol_rx);
    548 	wpa_s->pending_eapol_rx = NULL;
    549 
    550 #ifdef CONFIG_IBSS_RSN
    551 	ibss_rsn_deinit(wpa_s->ibss_rsn);
    552 	wpa_s->ibss_rsn = NULL;
    553 #endif /* CONFIG_IBSS_RSN */
    554 
    555 	sme_deinit(wpa_s);
    556 
    557 #ifdef CONFIG_AP
    558 	wpa_supplicant_ap_deinit(wpa_s);
    559 #endif /* CONFIG_AP */
    560 
    561 	wpas_p2p_deinit(wpa_s);
    562 
    563 #ifdef CONFIG_OFFCHANNEL
    564 	offchannel_deinit(wpa_s);
    565 #endif /* CONFIG_OFFCHANNEL */
    566 
    567 	wpa_supplicant_cancel_sched_scan(wpa_s);
    568 
    569 	os_free(wpa_s->next_scan_freqs);
    570 	wpa_s->next_scan_freqs = NULL;
    571 
    572 	os_free(wpa_s->manual_scan_freqs);
    573 	wpa_s->manual_scan_freqs = NULL;
    574 	os_free(wpa_s->select_network_scan_freqs);
    575 	wpa_s->select_network_scan_freqs = NULL;
    576 
    577 	os_free(wpa_s->manual_sched_scan_freqs);
    578 	wpa_s->manual_sched_scan_freqs = NULL;
    579 
    580 	wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
    581 
    582 	/*
    583 	 * Need to remove any pending gas-query radio work before the
    584 	 * gas_query_deinit() call because gas_query::work has not yet been set
    585 	 * for works that have not been started. gas_query_free() will be unable
    586 	 * to cancel such pending radio works and once the pending gas-query
    587 	 * radio work eventually gets removed, the deinit notification call to
    588 	 * gas_query_start_cb() would result in dereferencing freed memory.
    589 	 */
    590 	if (wpa_s->radio)
    591 		radio_remove_works(wpa_s, "gas-query", 0);
    592 	gas_query_deinit(wpa_s->gas);
    593 	wpa_s->gas = NULL;
    594 	gas_server_deinit(wpa_s->gas_server);
    595 	wpa_s->gas_server = NULL;
    596 
    597 	free_hw_features(wpa_s);
    598 
    599 	ieee802_1x_dealloc_kay_sm(wpa_s);
    600 
    601 	os_free(wpa_s->bssid_filter);
    602 	wpa_s->bssid_filter = NULL;
    603 
    604 	os_free(wpa_s->disallow_aps_bssid);
    605 	wpa_s->disallow_aps_bssid = NULL;
    606 	os_free(wpa_s->disallow_aps_ssid);
    607 	wpa_s->disallow_aps_ssid = NULL;
    608 
    609 	wnm_bss_keep_alive_deinit(wpa_s);
    610 #ifdef CONFIG_WNM
    611 	wnm_deallocate_memory(wpa_s);
    612 #endif /* CONFIG_WNM */
    613 
    614 	ext_password_deinit(wpa_s->ext_pw);
    615 	wpa_s->ext_pw = NULL;
    616 
    617 	wpabuf_free(wpa_s->last_gas_resp);
    618 	wpa_s->last_gas_resp = NULL;
    619 	wpabuf_free(wpa_s->prev_gas_resp);
    620 	wpa_s->prev_gas_resp = NULL;
    621 
    622 	os_free(wpa_s->last_scan_res);
    623 	wpa_s->last_scan_res = NULL;
    624 
    625 #ifdef CONFIG_HS20
    626 	if (wpa_s->drv_priv)
    627 		wpa_drv_configure_frame_filters(wpa_s, 0);
    628 	hs20_deinit(wpa_s);
    629 #endif /* CONFIG_HS20 */
    630 
    631 	for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
    632 		wpabuf_free(wpa_s->vendor_elem[i]);
    633 		wpa_s->vendor_elem[i] = NULL;
    634 	}
    635 
    636 	wmm_ac_notify_disassoc(wpa_s);
    637 
    638 	wpa_s->sched_scan_plans_num = 0;
    639 	os_free(wpa_s->sched_scan_plans);
    640 	wpa_s->sched_scan_plans = NULL;
    641 
    642 #ifdef CONFIG_MBO
    643 	wpa_s->non_pref_chan_num = 0;
    644 	os_free(wpa_s->non_pref_chan);
    645 	wpa_s->non_pref_chan = NULL;
    646 #endif /* CONFIG_MBO */
    647 
    648 	free_bss_tmp_disallowed(wpa_s);
    649 
    650 	wpabuf_free(wpa_s->lci);
    651 	wpa_s->lci = NULL;
    652 	wpas_clear_beacon_rep_data(wpa_s);
    653 
    654 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
    655 #ifdef CONFIG_MESH
    656 	{
    657 		struct external_pmksa_cache *entry;
    658 
    659 		while ((entry = dl_list_last(&wpa_s->mesh_external_pmksa_cache,
    660 					     struct external_pmksa_cache,
    661 					     list)) != NULL) {
    662 			dl_list_del(&entry->list);
    663 			os_free(entry->pmksa_cache);
    664 			os_free(entry);
    665 		}
    666 	}
    667 #endif /* CONFIG_MESH */
    668 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
    669 
    670 	wpas_flush_fils_hlp_req(wpa_s);
    671 
    672 	wpabuf_free(wpa_s->ric_ies);
    673 	wpa_s->ric_ies = NULL;
    674 
    675 #ifdef CONFIG_DPP
    676 	wpas_dpp_deinit(wpa_s);
    677 	dpp_global_deinit(wpa_s->dpp);
    678 	wpa_s->dpp = NULL;
    679 #endif /* CONFIG_DPP */
    680 }
    681 
    682 
    683 /**
    684  * wpa_clear_keys - Clear keys configured for the driver
    685  * @wpa_s: Pointer to wpa_supplicant data
    686  * @addr: Previously used BSSID or %NULL if not available
    687  *
    688  * This function clears the encryption keys that has been previously configured
    689  * for the driver.
    690  */
    691 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
    692 {
    693 	int i, max;
    694 
    695 #ifdef CONFIG_IEEE80211W
    696 	max = 6;
    697 #else /* CONFIG_IEEE80211W */
    698 	max = 4;
    699 #endif /* CONFIG_IEEE80211W */
    700 
    701 	/* MLME-DELETEKEYS.request */
    702 	for (i = 0; i < max; i++) {
    703 		if (wpa_s->keys_cleared & BIT(i))
    704 			continue;
    705 		wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
    706 				NULL, 0);
    707 	}
    708 	if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
    709 	    !is_zero_ether_addr(addr)) {
    710 		wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
    711 				0);
    712 		/* MLME-SETPROTECTION.request(None) */
    713 		wpa_drv_mlme_setprotection(
    714 			wpa_s, addr,
    715 			MLME_SETPROTECTION_PROTECT_TYPE_NONE,
    716 			MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
    717 	}
    718 	wpa_s->keys_cleared = (u32) -1;
    719 }
    720 
    721 
    722 /**
    723  * wpa_supplicant_state_txt - Get the connection state name as a text string
    724  * @state: State (wpa_state; WPA_*)
    725  * Returns: The state name as a printable text string
    726  */
    727 const char * wpa_supplicant_state_txt(enum wpa_states state)
    728 {
    729 	switch (state) {
    730 	case WPA_DISCONNECTED:
    731 		return "DISCONNECTED";
    732 	case WPA_INACTIVE:
    733 		return "INACTIVE";
    734 	case WPA_INTERFACE_DISABLED:
    735 		return "INTERFACE_DISABLED";
    736 	case WPA_SCANNING:
    737 		return "SCANNING";
    738 	case WPA_AUTHENTICATING:
    739 		return "AUTHENTICATING";
    740 	case WPA_ASSOCIATING:
    741 		return "ASSOCIATING";
    742 	case WPA_ASSOCIATED:
    743 		return "ASSOCIATED";
    744 	case WPA_4WAY_HANDSHAKE:
    745 		return "4WAY_HANDSHAKE";
    746 	case WPA_GROUP_HANDSHAKE:
    747 		return "GROUP_HANDSHAKE";
    748 	case WPA_COMPLETED:
    749 		return "COMPLETED";
    750 	default:
    751 		return "UNKNOWN";
    752 	}
    753 }
    754 
    755 
    756 #ifdef CONFIG_BGSCAN
    757 
    758 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
    759 {
    760 	const char *name;
    761 
    762 	if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
    763 		name = wpa_s->current_ssid->bgscan;
    764 	else
    765 		name = wpa_s->conf->bgscan;
    766 	if (name == NULL || name[0] == '\0')
    767 		return;
    768 	if (wpas_driver_bss_selection(wpa_s))
    769 		return;
    770 	if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
    771 		return;
    772 #ifdef CONFIG_P2P
    773 	if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
    774 		return;
    775 #endif /* CONFIG_P2P */
    776 
    777 	bgscan_deinit(wpa_s);
    778 	if (wpa_s->current_ssid) {
    779 		if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
    780 			wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
    781 				"bgscan");
    782 			/*
    783 			 * Live without bgscan; it is only used as a roaming
    784 			 * optimization, so the initial connection is not
    785 			 * affected.
    786 			 */
    787 		} else {
    788 			struct wpa_scan_results *scan_res;
    789 			wpa_s->bgscan_ssid = wpa_s->current_ssid;
    790 			scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
    791 								   0);
    792 			if (scan_res) {
    793 				bgscan_notify_scan(wpa_s, scan_res);
    794 				wpa_scan_results_free(scan_res);
    795 			}
    796 		}
    797 	} else
    798 		wpa_s->bgscan_ssid = NULL;
    799 }
    800 
    801 
    802 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
    803 {
    804 	if (wpa_s->bgscan_ssid != NULL) {
    805 		bgscan_deinit(wpa_s);
    806 		wpa_s->bgscan_ssid = NULL;
    807 	}
    808 }
    809 
    810 #endif /* CONFIG_BGSCAN */
    811 
    812 
    813 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
    814 {
    815 	if (autoscan_init(wpa_s, 0))
    816 		wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
    817 }
    818 
    819 
    820 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
    821 {
    822 	autoscan_deinit(wpa_s);
    823 }
    824 
    825 
    826 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
    827 {
    828 	if (wpa_s->wpa_state == WPA_DISCONNECTED ||
    829 	    wpa_s->wpa_state == WPA_SCANNING) {
    830 		autoscan_deinit(wpa_s);
    831 		wpa_supplicant_start_autoscan(wpa_s);
    832 	}
    833 }
    834 
    835 
    836 /**
    837  * wpa_supplicant_set_state - Set current connection state
    838  * @wpa_s: Pointer to wpa_supplicant data
    839  * @state: The new connection state
    840  *
    841  * This function is called whenever the connection state changes, e.g.,
    842  * association is completed for WPA/WPA2 4-Way Handshake is started.
    843  */
    844 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
    845 			      enum wpa_states state)
    846 {
    847 	enum wpa_states old_state = wpa_s->wpa_state;
    848 
    849 	wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
    850 		wpa_supplicant_state_txt(wpa_s->wpa_state),
    851 		wpa_supplicant_state_txt(state));
    852 
    853 	if (state == WPA_COMPLETED &&
    854 	    os_reltime_initialized(&wpa_s->roam_start)) {
    855 		os_reltime_age(&wpa_s->roam_start, &wpa_s->roam_time);
    856 		wpa_s->roam_start.sec = 0;
    857 		wpa_s->roam_start.usec = 0;
    858 		wpas_notify_auth_changed(wpa_s);
    859 		wpas_notify_roam_time(wpa_s);
    860 		wpas_notify_roam_complete(wpa_s);
    861 	} else if (state == WPA_DISCONNECTED &&
    862 		   os_reltime_initialized(&wpa_s->roam_start)) {
    863 		wpa_s->roam_start.sec = 0;
    864 		wpa_s->roam_start.usec = 0;
    865 		wpa_s->roam_time.sec = 0;
    866 		wpa_s->roam_time.usec = 0;
    867 		wpas_notify_roam_complete(wpa_s);
    868 	}
    869 
    870 	if (state == WPA_INTERFACE_DISABLED) {
    871 		/* Assure normal scan when interface is restored */
    872 		wpa_s->normal_scans = 0;
    873 	}
    874 
    875 	if (state == WPA_COMPLETED) {
    876 		wpas_connect_work_done(wpa_s);
    877 		/* Reinitialize normal_scan counter */
    878 		wpa_s->normal_scans = 0;
    879 	}
    880 
    881 #ifdef CONFIG_P2P
    882 	/*
    883 	 * P2PS client has to reply to Probe Request frames received on the
    884 	 * group operating channel. Enable Probe Request frame reporting for
    885 	 * P2P connected client in case p2p_cli_probe configuration property is
    886 	 * set to 1.
    887 	 */
    888 	if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
    889 	    wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
    890 	    wpa_s->current_ssid->p2p_group) {
    891 		if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
    892 			wpa_dbg(wpa_s, MSG_DEBUG,
    893 				"P2P: Enable CLI Probe Request RX reporting");
    894 			wpa_s->p2p_cli_probe =
    895 				wpa_drv_probe_req_report(wpa_s, 1) >= 0;
    896 		} else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
    897 			wpa_dbg(wpa_s, MSG_DEBUG,
    898 				"P2P: Disable CLI Probe Request RX reporting");
    899 			wpa_s->p2p_cli_probe = 0;
    900 			wpa_drv_probe_req_report(wpa_s, 0);
    901 		}
    902 	}
    903 #endif /* CONFIG_P2P */
    904 
    905 	if (state != WPA_SCANNING)
    906 		wpa_supplicant_notify_scanning(wpa_s, 0);
    907 
    908 	if (state == WPA_COMPLETED && wpa_s->new_connection) {
    909 		struct wpa_ssid *ssid = wpa_s->current_ssid;
    910 		int fils_hlp_sent = 0;
    911 
    912 #ifdef CONFIG_SME
    913 		if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
    914 		    wpa_auth_alg_fils(wpa_s->sme.auth_alg))
    915 			fils_hlp_sent = 1;
    916 #endif /* CONFIG_SME */
    917 		if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
    918 		    wpa_auth_alg_fils(wpa_s->auth_alg))
    919 			fils_hlp_sent = 1;
    920 
    921 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
    922 		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
    923 			MACSTR " completed [id=%d id_str=%s%s]",
    924 			MAC2STR(wpa_s->bssid),
    925 			ssid ? ssid->id : -1,
    926 			ssid && ssid->id_str ? ssid->id_str : "",
    927 			fils_hlp_sent ? " FILS_HLP_SENT" : "");
    928 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
    929 		wpas_clear_temp_disabled(wpa_s, ssid, 1);
    930 		wpa_blacklist_clear(wpa_s);
    931 		wpa_s->extra_blacklist_count = 0;
    932 		wpa_s->new_connection = 0;
    933 		wpa_drv_set_operstate(wpa_s, 1);
    934 #ifndef IEEE8021X_EAPOL
    935 		wpa_drv_set_supp_port(wpa_s, 1);
    936 #endif /* IEEE8021X_EAPOL */
    937 		wpa_s->after_wps = 0;
    938 		wpa_s->known_wps_freq = 0;
    939 		wpas_p2p_completed(wpa_s);
    940 
    941 		sme_sched_obss_scan(wpa_s, 1);
    942 
    943 #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
    944 		if (!fils_hlp_sent && ssid && ssid->eap.erp)
    945 			wpas_update_fils_connect_params(wpa_s);
    946 #endif /* CONFIG_FILS && IEEE8021X_EAPOL */
    947 	} else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
    948 		   state == WPA_ASSOCIATED) {
    949 		wpa_s->new_connection = 1;
    950 		wpa_drv_set_operstate(wpa_s, 0);
    951 #ifndef IEEE8021X_EAPOL
    952 		wpa_drv_set_supp_port(wpa_s, 0);
    953 #endif /* IEEE8021X_EAPOL */
    954 		sme_sched_obss_scan(wpa_s, 0);
    955 	}
    956 	wpa_s->wpa_state = state;
    957 
    958 #ifdef CONFIG_BGSCAN
    959 	if (state == WPA_COMPLETED)
    960 		wpa_supplicant_start_bgscan(wpa_s);
    961 	else if (state < WPA_ASSOCIATED)
    962 		wpa_supplicant_stop_bgscan(wpa_s);
    963 #endif /* CONFIG_BGSCAN */
    964 
    965 	if (state > WPA_SCANNING)
    966 		wpa_supplicant_stop_autoscan(wpa_s);
    967 
    968 	if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
    969 		wpa_supplicant_start_autoscan(wpa_s);
    970 
    971 	if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
    972 		wmm_ac_notify_disassoc(wpa_s);
    973 
    974 	if (wpa_s->wpa_state != old_state) {
    975 		wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
    976 
    977 		/*
    978 		 * Notify the P2P Device interface about a state change in one
    979 		 * of the interfaces.
    980 		 */
    981 		wpas_p2p_indicate_state_change(wpa_s);
    982 
    983 		if (wpa_s->wpa_state == WPA_COMPLETED ||
    984 		    old_state == WPA_COMPLETED)
    985 			wpas_notify_auth_changed(wpa_s);
    986 	}
    987 }
    988 
    989 
    990 void wpa_supplicant_terminate_proc(struct wpa_global *global)
    991 {
    992 	int pending = 0;
    993 #ifdef CONFIG_WPS
    994 	struct wpa_supplicant *wpa_s = global->ifaces;
    995 	while (wpa_s) {
    996 		struct wpa_supplicant *next = wpa_s->next;
    997 		if (wpas_wps_terminate_pending(wpa_s) == 1)
    998 			pending = 1;
    999 #ifdef CONFIG_P2P
   1000 		if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
   1001 		    (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
   1002 			wpas_p2p_disconnect(wpa_s);
   1003 #endif /* CONFIG_P2P */
   1004 		wpa_s = next;
   1005 	}
   1006 #endif /* CONFIG_WPS */
   1007 	if (pending)
   1008 		return;
   1009 	eloop_terminate();
   1010 }
   1011 
   1012 
   1013 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
   1014 {
   1015 	struct wpa_global *global = signal_ctx;
   1016 	wpa_supplicant_terminate_proc(global);
   1017 }
   1018 
   1019 
   1020 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
   1021 {
   1022 	enum wpa_states old_state = wpa_s->wpa_state;
   1023 
   1024 	wpa_s->pairwise_cipher = 0;
   1025 	wpa_s->group_cipher = 0;
   1026 	wpa_s->mgmt_group_cipher = 0;
   1027 	wpa_s->key_mgmt = 0;
   1028 	if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
   1029 		wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
   1030 
   1031 	if (wpa_s->wpa_state != old_state)
   1032 		wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
   1033 }
   1034 
   1035 
   1036 /**
   1037  * wpa_supplicant_reload_configuration - Reload configuration data
   1038  * @wpa_s: Pointer to wpa_supplicant data
   1039  * Returns: 0 on success or -1 if configuration parsing failed
   1040  *
   1041  * This function can be used to request that the configuration data is reloaded
   1042  * (e.g., after configuration file change). This function is reloading
   1043  * configuration only for one interface, so this may need to be called multiple
   1044  * times if %wpa_supplicant is controlling multiple interfaces and all
   1045  * interfaces need reconfiguration.
   1046  */
   1047 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
   1048 {
   1049 	struct wpa_config *conf;
   1050 	int reconf_ctrl;
   1051 	int old_ap_scan;
   1052 
   1053 	if (wpa_s->confname == NULL)
   1054 		return -1;
   1055 	conf = wpa_config_read(wpa_s->confname, NULL);
   1056 	if (conf == NULL) {
   1057 		wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
   1058 			"file '%s' - exiting", wpa_s->confname);
   1059 		return -1;
   1060 	}
   1061 	if (wpa_s->confanother &&
   1062 	    !wpa_config_read(wpa_s->confanother, conf)) {
   1063 		wpa_msg(wpa_s, MSG_ERROR,
   1064 			"Failed to parse the configuration file '%s' - exiting",
   1065 			wpa_s->confanother);
   1066 		return -1;
   1067 	}
   1068 
   1069 	conf->changed_parameters = (unsigned int) -1;
   1070 
   1071 	reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
   1072 		|| (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
   1073 		    os_strcmp(conf->ctrl_interface,
   1074 			      wpa_s->conf->ctrl_interface) != 0);
   1075 
   1076 	if (reconf_ctrl && wpa_s->ctrl_iface) {
   1077 		wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
   1078 		wpa_s->ctrl_iface = NULL;
   1079 	}
   1080 
   1081 	eapol_sm_invalidate_cached_session(wpa_s->eapol);
   1082 	if (wpa_s->current_ssid) {
   1083 		if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
   1084 			wpa_s->own_disconnect_req = 1;
   1085 		wpa_supplicant_deauthenticate(wpa_s,
   1086 					      WLAN_REASON_DEAUTH_LEAVING);
   1087 	}
   1088 
   1089 	/*
   1090 	 * TODO: should notify EAPOL SM about changes in opensc_engine_path,
   1091 	 * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
   1092 	 */
   1093 	if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
   1094 	    wpa_s->key_mgmt == WPA_KEY_MGMT_OWE ||
   1095 	    wpa_s->key_mgmt == WPA_KEY_MGMT_DPP) {
   1096 		/*
   1097 		 * Clear forced success to clear EAP state for next
   1098 		 * authentication.
   1099 		 */
   1100 		eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
   1101 	}
   1102 	eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
   1103 	wpa_sm_set_config(wpa_s->wpa, NULL);
   1104 	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
   1105 	wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
   1106 	rsn_preauth_deinit(wpa_s->wpa);
   1107 
   1108 	old_ap_scan = wpa_s->conf->ap_scan;
   1109 	wpa_config_free(wpa_s->conf);
   1110 	wpa_s->conf = conf;
   1111 	if (old_ap_scan != wpa_s->conf->ap_scan)
   1112 		wpas_notify_ap_scan_changed(wpa_s);
   1113 
   1114 	if (reconf_ctrl)
   1115 		wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
   1116 
   1117 	wpa_supplicant_update_config(wpa_s);
   1118 
   1119 	wpa_supplicant_clear_status(wpa_s);
   1120 	if (wpa_supplicant_enabled_networks(wpa_s)) {
   1121 		wpa_s->reassociate = 1;
   1122 		wpa_supplicant_req_scan(wpa_s, 0, 0);
   1123 	}
   1124 	wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
   1125 	return 0;
   1126 }
   1127 
   1128 
   1129 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
   1130 {
   1131 	struct wpa_global *global = signal_ctx;
   1132 	struct wpa_supplicant *wpa_s;
   1133 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
   1134 		wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
   1135 			sig);
   1136 		if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
   1137 			wpa_supplicant_terminate_proc(global);
   1138 		}
   1139 	}
   1140 
   1141 	if (wpa_debug_reopen_file() < 0) {
   1142 		/* Ignore errors since we cannot really do much to fix this */
   1143 		wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
   1144 	}
   1145 }
   1146 
   1147 
   1148 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
   1149 					 struct wpa_ssid *ssid,
   1150 					 struct wpa_ie_data *ie)
   1151 {
   1152 	int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
   1153 	if (ret) {
   1154 		if (ret == -2) {
   1155 			wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
   1156 				"from association info");
   1157 		}
   1158 		return -1;
   1159 	}
   1160 
   1161 	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
   1162 		"cipher suites");
   1163 	if (!(ie->group_cipher & ssid->group_cipher)) {
   1164 		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
   1165 			"cipher 0x%x (mask 0x%x) - reject",
   1166 			ie->group_cipher, ssid->group_cipher);
   1167 		return -1;
   1168 	}
   1169 	if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
   1170 		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
   1171 			"cipher 0x%x (mask 0x%x) - reject",
   1172 			ie->pairwise_cipher, ssid->pairwise_cipher);
   1173 		return -1;
   1174 	}
   1175 	if (!(ie->key_mgmt & ssid->key_mgmt)) {
   1176 		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
   1177 			"management 0x%x (mask 0x%x) - reject",
   1178 			ie->key_mgmt, ssid->key_mgmt);
   1179 		return -1;
   1180 	}
   1181 
   1182 #ifdef CONFIG_IEEE80211W
   1183 	if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
   1184 	    wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
   1185 		wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
   1186 			"that does not support management frame protection - "
   1187 			"reject");
   1188 		return -1;
   1189 	}
   1190 #endif /* CONFIG_IEEE80211W */
   1191 
   1192 	return 0;
   1193 }
   1194 
   1195 
   1196 static int matching_ciphers(struct wpa_ssid *ssid, struct wpa_ie_data *ie,
   1197 			    int freq)
   1198 {
   1199 	if (!ie->has_group)
   1200 		ie->group_cipher = wpa_default_rsn_cipher(freq);
   1201 	if (!ie->has_pairwise)
   1202 		ie->pairwise_cipher = wpa_default_rsn_cipher(freq);
   1203 	return (ie->group_cipher & ssid->group_cipher) &&
   1204 		(ie->pairwise_cipher & ssid->pairwise_cipher);
   1205 }
   1206 
   1207 
   1208 /**
   1209  * wpa_supplicant_set_suites - Set authentication and encryption parameters
   1210  * @wpa_s: Pointer to wpa_supplicant data
   1211  * @bss: Scan results for the selected BSS, or %NULL if not available
   1212  * @ssid: Configuration data for the selected network
   1213  * @wpa_ie: Buffer for the WPA/RSN IE
   1214  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
   1215  * used buffer length in case the functions returns success.
   1216  * Returns: 0 on success or -1 on failure
   1217  *
   1218  * This function is used to configure authentication and encryption parameters
   1219  * based on the network configuration and scan result for the selected BSS (if
   1220  * available).
   1221  */
   1222 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
   1223 			      struct wpa_bss *bss, struct wpa_ssid *ssid,
   1224 			      u8 *wpa_ie, size_t *wpa_ie_len)
   1225 {
   1226 	struct wpa_ie_data ie;
   1227 	int sel, proto;
   1228 	const u8 *bss_wpa, *bss_rsn, *bss_osen;
   1229 
   1230 	if (bss) {
   1231 		bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
   1232 		bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
   1233 		bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
   1234 	} else
   1235 		bss_wpa = bss_rsn = bss_osen = NULL;
   1236 
   1237 	if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
   1238 	    wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
   1239 	    matching_ciphers(ssid, &ie, bss->freq) &&
   1240 	    (ie.key_mgmt & ssid->key_mgmt)) {
   1241 		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
   1242 		proto = WPA_PROTO_RSN;
   1243 	} else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
   1244 		   wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
   1245 		   (ie.group_cipher & ssid->group_cipher) &&
   1246 		   (ie.pairwise_cipher & ssid->pairwise_cipher) &&
   1247 		   (ie.key_mgmt & ssid->key_mgmt)) {
   1248 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
   1249 		proto = WPA_PROTO_WPA;
   1250 #ifdef CONFIG_HS20
   1251 	} else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN) &&
   1252 		   wpa_parse_wpa_ie(bss_osen, 2 + bss_osen[1], &ie) == 0 &&
   1253 		   (ie.group_cipher & ssid->group_cipher) &&
   1254 		   (ie.pairwise_cipher & ssid->pairwise_cipher) &&
   1255 		   (ie.key_mgmt & ssid->key_mgmt)) {
   1256 		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
   1257 		proto = WPA_PROTO_OSEN;
   1258 	} else if (bss_rsn && (ssid->proto & WPA_PROTO_OSEN) &&
   1259 	    wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
   1260 	    (ie.group_cipher & ssid->group_cipher) &&
   1261 	    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
   1262 	    (ie.key_mgmt & ssid->key_mgmt)) {
   1263 		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using OSEN (within RSN)");
   1264 		proto = WPA_PROTO_RSN;
   1265 #endif /* CONFIG_HS20 */
   1266 	} else if (bss) {
   1267 		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
   1268 		wpa_dbg(wpa_s, MSG_DEBUG,
   1269 			"WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
   1270 			ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
   1271 			ssid->key_mgmt);
   1272 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
   1273 			MAC2STR(bss->bssid),
   1274 			wpa_ssid_txt(bss->ssid, bss->ssid_len),
   1275 			bss_wpa ? " WPA" : "",
   1276 			bss_rsn ? " RSN" : "",
   1277 			bss_osen ? " OSEN" : "");
   1278 		if (bss_rsn) {
   1279 			wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
   1280 			if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
   1281 				wpa_dbg(wpa_s, MSG_DEBUG,
   1282 					"Could not parse RSN element");
   1283 			} else {
   1284 				wpa_dbg(wpa_s, MSG_DEBUG,
   1285 					"RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
   1286 					ie.pairwise_cipher, ie.group_cipher,
   1287 					ie.key_mgmt);
   1288 			}
   1289 		}
   1290 		if (bss_wpa) {
   1291 			wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
   1292 			if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
   1293 				wpa_dbg(wpa_s, MSG_DEBUG,
   1294 					"Could not parse WPA element");
   1295 			} else {
   1296 				wpa_dbg(wpa_s, MSG_DEBUG,
   1297 					"WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
   1298 					ie.pairwise_cipher, ie.group_cipher,
   1299 					ie.key_mgmt);
   1300 			}
   1301 		}
   1302 		return -1;
   1303 	} else {
   1304 		if (ssid->proto & WPA_PROTO_OSEN)
   1305 			proto = WPA_PROTO_OSEN;
   1306 		else if (ssid->proto & WPA_PROTO_RSN)
   1307 			proto = WPA_PROTO_RSN;
   1308 		else
   1309 			proto = WPA_PROTO_WPA;
   1310 		if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
   1311 			os_memset(&ie, 0, sizeof(ie));
   1312 			ie.group_cipher = ssid->group_cipher;
   1313 			ie.pairwise_cipher = ssid->pairwise_cipher;
   1314 			ie.key_mgmt = ssid->key_mgmt;
   1315 #ifdef CONFIG_IEEE80211W
   1316 			ie.mgmt_group_cipher = 0;
   1317 			if (ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
   1318 				if (ssid->group_mgmt_cipher &
   1319 				    WPA_CIPHER_BIP_GMAC_256)
   1320 					ie.mgmt_group_cipher =
   1321 						WPA_CIPHER_BIP_GMAC_256;
   1322 				else if (ssid->group_mgmt_cipher &
   1323 					 WPA_CIPHER_BIP_CMAC_256)
   1324 					ie.mgmt_group_cipher =
   1325 						WPA_CIPHER_BIP_CMAC_256;
   1326 				else if (ssid->group_mgmt_cipher &
   1327 					 WPA_CIPHER_BIP_GMAC_128)
   1328 					ie.mgmt_group_cipher =
   1329 						WPA_CIPHER_BIP_GMAC_128;
   1330 				else
   1331 					ie.mgmt_group_cipher =
   1332 						WPA_CIPHER_AES_128_CMAC;
   1333 			}
   1334 #endif /* CONFIG_IEEE80211W */
   1335 #ifdef CONFIG_OWE
   1336 			if ((ssid->key_mgmt & WPA_KEY_MGMT_OWE) &&
   1337 			    !ssid->owe_only &&
   1338 			    !bss_wpa && !bss_rsn && !bss_osen) {
   1339 				wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
   1340 				wpa_s->wpa_proto = 0;
   1341 				*wpa_ie_len = 0;
   1342 				return 0;
   1343 			}
   1344 #endif /* CONFIG_OWE */
   1345 			wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
   1346 				"based on configuration");
   1347 		} else
   1348 			proto = ie.proto;
   1349 	}
   1350 
   1351 	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
   1352 		"pairwise %d key_mgmt %d proto %d",
   1353 		ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
   1354 #ifdef CONFIG_IEEE80211W
   1355 	if (ssid->ieee80211w) {
   1356 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
   1357 			ie.mgmt_group_cipher);
   1358 	}
   1359 #endif /* CONFIG_IEEE80211W */
   1360 
   1361 	wpa_s->wpa_proto = proto;
   1362 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
   1363 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
   1364 			 !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
   1365 
   1366 	if (bss || !wpa_s->ap_ies_from_associnfo) {
   1367 		if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
   1368 					 bss_wpa ? 2 + bss_wpa[1] : 0) ||
   1369 		    wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
   1370 					 bss_rsn ? 2 + bss_rsn[1] : 0))
   1371 			return -1;
   1372 	}
   1373 
   1374 #ifdef CONFIG_NO_WPA
   1375 	wpa_s->group_cipher = WPA_CIPHER_NONE;
   1376 	wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
   1377 #else /* CONFIG_NO_WPA */
   1378 	sel = ie.group_cipher & ssid->group_cipher;
   1379 	wpa_dbg(wpa_s, MSG_DEBUG,
   1380 		"WPA: AP group 0x%x network profile group 0x%x; available group 0x%x",
   1381 		ie.group_cipher, ssid->group_cipher, sel);
   1382 	wpa_s->group_cipher = wpa_pick_group_cipher(sel);
   1383 	if (wpa_s->group_cipher < 0) {
   1384 		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
   1385 			"cipher");
   1386 		return -1;
   1387 	}
   1388 	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
   1389 		wpa_cipher_txt(wpa_s->group_cipher));
   1390 
   1391 	sel = ie.pairwise_cipher & ssid->pairwise_cipher;
   1392 	wpa_dbg(wpa_s, MSG_DEBUG,
   1393 		"WPA: AP pairwise 0x%x network profile pairwise 0x%x; available pairwise 0x%x",
   1394 		ie.pairwise_cipher, ssid->pairwise_cipher, sel);
   1395 	wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
   1396 	if (wpa_s->pairwise_cipher < 0) {
   1397 		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
   1398 			"cipher");
   1399 		return -1;
   1400 	}
   1401 	wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
   1402 		wpa_cipher_txt(wpa_s->pairwise_cipher));
   1403 #endif /* CONFIG_NO_WPA */
   1404 
   1405 	sel = ie.key_mgmt & ssid->key_mgmt;
   1406 	wpa_dbg(wpa_s, MSG_DEBUG,
   1407 		"WPA: AP key_mgmt 0x%x network profile key_mgmt 0x%x; available key_mgmt 0x%x",
   1408 		ie.key_mgmt, ssid->key_mgmt, sel);
   1409 #ifdef CONFIG_SAE
   1410 	if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
   1411 		sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
   1412 #endif /* CONFIG_SAE */
   1413 	if (0) {
   1414 #ifdef CONFIG_IEEE80211R
   1415 #ifdef CONFIG_SHA384
   1416 	} else if (sel & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) {
   1417 		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
   1418 		wpa_dbg(wpa_s, MSG_DEBUG,
   1419 			"WPA: using KEY_MGMT FT/802.1X-SHA384");
   1420 		if (pmksa_cache_get_current(wpa_s->wpa)) {
   1421 			/* PMKSA caching with FT is not fully functional, so
   1422 			 * disable the case for now. */
   1423 			wpa_dbg(wpa_s, MSG_DEBUG,
   1424 				"WPA: Disable PMKSA caching for FT/802.1X connection");
   1425 			pmksa_cache_clear_current(wpa_s->wpa);
   1426 		}
   1427 #endif /* CONFIG_SHA384 */
   1428 #endif /* CONFIG_IEEE80211R */
   1429 #ifdef CONFIG_SUITEB192
   1430 	} else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
   1431 		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
   1432 		wpa_dbg(wpa_s, MSG_DEBUG,
   1433 			"WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
   1434 #endif /* CONFIG_SUITEB192 */
   1435 #ifdef CONFIG_SUITEB
   1436 	} else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
   1437 		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
   1438 		wpa_dbg(wpa_s, MSG_DEBUG,
   1439 			"WPA: using KEY_MGMT 802.1X with Suite B");
   1440 #endif /* CONFIG_SUITEB */
   1441 #ifdef CONFIG_FILS
   1442 #ifdef CONFIG_IEEE80211R
   1443 	} else if (sel & WPA_KEY_MGMT_FT_FILS_SHA384) {
   1444 		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA384;
   1445 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT-FILS-SHA384");
   1446 	} else if (sel & WPA_KEY_MGMT_FT_FILS_SHA256) {
   1447 		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA256;
   1448 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT-FILS-SHA256");
   1449 #endif /* CONFIG_IEEE80211R */
   1450 	} else if (sel & WPA_KEY_MGMT_FILS_SHA384) {
   1451 		wpa_s->key_mgmt = WPA_KEY_MGMT_FILS_SHA384;
   1452 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FILS-SHA384");
   1453 	} else if (sel & WPA_KEY_MGMT_FILS_SHA256) {
   1454 		wpa_s->key_mgmt = WPA_KEY_MGMT_FILS_SHA256;
   1455 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FILS-SHA256");
   1456 #endif /* CONFIG_FILS */
   1457 #ifdef CONFIG_IEEE80211R
   1458 	} else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
   1459 		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
   1460 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
   1461 		if (pmksa_cache_get_current(wpa_s->wpa)) {
   1462 			/* PMKSA caching with FT is not fully functional, so
   1463 			 * disable the case for now. */
   1464 			wpa_dbg(wpa_s, MSG_DEBUG,
   1465 				"WPA: Disable PMKSA caching for FT/802.1X connection");
   1466 			pmksa_cache_clear_current(wpa_s->wpa);
   1467 		}
   1468 #endif /* CONFIG_IEEE80211R */
   1469 #ifdef CONFIG_DPP
   1470 	} else if (sel & WPA_KEY_MGMT_DPP) {
   1471 		wpa_s->key_mgmt = WPA_KEY_MGMT_DPP;
   1472 		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT DPP");
   1473 #endif /* CONFIG_DPP */
   1474 #ifdef CONFIG_SAE
   1475 	} else if (sel & WPA_KEY_MGMT_FT_SAE) {
   1476 		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
   1477 		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
   1478 	} else if (sel & WPA_KEY_MGMT_SAE) {
   1479 		wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
   1480 		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
   1481 #endif /* CONFIG_SAE */
   1482 #ifdef CONFIG_IEEE80211R
   1483 	} else if (sel & WPA_KEY_MGMT_FT_PSK) {
   1484 		wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
   1485 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
   1486 #endif /* CONFIG_IEEE80211R */
   1487 #ifdef CONFIG_IEEE80211W
   1488 	} else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
   1489 		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
   1490 		wpa_dbg(wpa_s, MSG_DEBUG,
   1491 			"WPA: using KEY_MGMT 802.1X with SHA256");
   1492 	} else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
   1493 		wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
   1494 		wpa_dbg(wpa_s, MSG_DEBUG,
   1495 			"WPA: using KEY_MGMT PSK with SHA256");
   1496 #endif /* CONFIG_IEEE80211W */
   1497 	} else if (sel & WPA_KEY_MGMT_IEEE8021X) {
   1498 		wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
   1499 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
   1500 	} else if (sel & WPA_KEY_MGMT_PSK) {
   1501 		wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
   1502 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
   1503 	} else if (sel & WPA_KEY_MGMT_WPA_NONE) {
   1504 		wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
   1505 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
   1506 #ifdef CONFIG_HS20
   1507 	} else if (sel & WPA_KEY_MGMT_OSEN) {
   1508 		wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
   1509 		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
   1510 #endif /* CONFIG_HS20 */
   1511 #ifdef CONFIG_OWE
   1512 	} else if (sel & WPA_KEY_MGMT_OWE) {
   1513 		wpa_s->key_mgmt = WPA_KEY_MGMT_OWE;
   1514 		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT OWE");
   1515 #endif /* CONFIG_OWE */
   1516 	} else {
   1517 		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
   1518 			"authenticated key management type");
   1519 		return -1;
   1520 	}
   1521 
   1522 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
   1523 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
   1524 			 wpa_s->pairwise_cipher);
   1525 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
   1526 
   1527 #ifdef CONFIG_IEEE80211W
   1528 	sel = ie.mgmt_group_cipher;
   1529 	if (ssid->group_mgmt_cipher)
   1530 		sel &= ssid->group_mgmt_cipher;
   1531 	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
   1532 	    !(ie.capabilities & WPA_CAPABILITY_MFPC))
   1533 		sel = 0;
   1534 	wpa_dbg(wpa_s, MSG_DEBUG,
   1535 		"WPA: AP mgmt_group_cipher 0x%x network profile mgmt_group_cipher 0x%x; available mgmt_group_cipher 0x%x",
   1536 		ie.mgmt_group_cipher, ssid->group_mgmt_cipher, sel);
   1537 	if (sel & WPA_CIPHER_AES_128_CMAC) {
   1538 		wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
   1539 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
   1540 			"AES-128-CMAC");
   1541 	} else if (sel & WPA_CIPHER_BIP_GMAC_128) {
   1542 		wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
   1543 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
   1544 			"BIP-GMAC-128");
   1545 	} else if (sel & WPA_CIPHER_BIP_GMAC_256) {
   1546 		wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
   1547 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
   1548 			"BIP-GMAC-256");
   1549 	} else if (sel & WPA_CIPHER_BIP_CMAC_256) {
   1550 		wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
   1551 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
   1552 			"BIP-CMAC-256");
   1553 	} else {
   1554 		wpa_s->mgmt_group_cipher = 0;
   1555 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
   1556 	}
   1557 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
   1558 			 wpa_s->mgmt_group_cipher);
   1559 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
   1560 			 wpas_get_ssid_pmf(wpa_s, ssid));
   1561 #endif /* CONFIG_IEEE80211W */
   1562 #ifdef CONFIG_OCV
   1563 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_OCV, ssid->ocv);
   1564 #endif /* CONFIG_OCV */
   1565 
   1566 	if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
   1567 		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
   1568 		return -1;
   1569 	}
   1570 
   1571 	if (0) {
   1572 #ifdef CONFIG_DPP
   1573 	} else if (wpa_s->key_mgmt == WPA_KEY_MGMT_DPP) {
   1574 		/* Use PMK from DPP network introduction (PMKSA entry) */
   1575 		wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
   1576 #endif /* CONFIG_DPP */
   1577 	} else if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
   1578 		int psk_set = 0;
   1579 		int sae_only;
   1580 
   1581 		sae_only = (ssid->key_mgmt & (WPA_KEY_MGMT_PSK |
   1582 					      WPA_KEY_MGMT_FT_PSK |
   1583 					      WPA_KEY_MGMT_PSK_SHA256)) == 0;
   1584 
   1585 		if (ssid->psk_set && !sae_only) {
   1586 			wpa_hexdump_key(MSG_MSGDUMP, "PSK (set in config)",
   1587 					ssid->psk, PMK_LEN);
   1588 			wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
   1589 				       NULL);
   1590 			psk_set = 1;
   1591 		}
   1592 
   1593 		if (wpa_key_mgmt_sae(ssid->key_mgmt) &&
   1594 		    (ssid->sae_password || ssid->passphrase))
   1595 			psk_set = 1;
   1596 
   1597 #ifndef CONFIG_NO_PBKDF2
   1598 		if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
   1599 		    ssid->passphrase && !sae_only) {
   1600 			u8 psk[PMK_LEN];
   1601 		        pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
   1602 				    4096, psk, PMK_LEN);
   1603 		        wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
   1604 					psk, PMK_LEN);
   1605 			wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
   1606 			psk_set = 1;
   1607 			os_memset(psk, 0, sizeof(psk));
   1608 		}
   1609 #endif /* CONFIG_NO_PBKDF2 */
   1610 #ifdef CONFIG_EXT_PASSWORD
   1611 		if (ssid->ext_psk && !sae_only) {
   1612 			struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
   1613 							     ssid->ext_psk);
   1614 			char pw_str[64 + 1];
   1615 			u8 psk[PMK_LEN];
   1616 
   1617 			if (pw == NULL) {
   1618 				wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
   1619 					"found from external storage");
   1620 				return -1;
   1621 			}
   1622 
   1623 			if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
   1624 				wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
   1625 					"PSK length %d in external storage",
   1626 					(int) wpabuf_len(pw));
   1627 				ext_password_free(pw);
   1628 				return -1;
   1629 			}
   1630 
   1631 			os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
   1632 			pw_str[wpabuf_len(pw)] = '\0';
   1633 
   1634 #ifndef CONFIG_NO_PBKDF2
   1635 			if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
   1636 			{
   1637 				pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
   1638 					    4096, psk, PMK_LEN);
   1639 				os_memset(pw_str, 0, sizeof(pw_str));
   1640 				wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
   1641 						"external passphrase)",
   1642 						psk, PMK_LEN);
   1643 				wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
   1644 					       NULL);
   1645 				psk_set = 1;
   1646 				os_memset(psk, 0, sizeof(psk));
   1647 			} else
   1648 #endif /* CONFIG_NO_PBKDF2 */
   1649 			if (wpabuf_len(pw) == 2 * PMK_LEN) {
   1650 				if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
   1651 					wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
   1652 						"Invalid PSK hex string");
   1653 					os_memset(pw_str, 0, sizeof(pw_str));
   1654 					ext_password_free(pw);
   1655 					return -1;
   1656 				}
   1657 				wpa_hexdump_key(MSG_MSGDUMP,
   1658 						"PSK (from external PSK)",
   1659 						psk, PMK_LEN);
   1660 				wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
   1661 					       NULL);
   1662 				psk_set = 1;
   1663 				os_memset(psk, 0, sizeof(psk));
   1664 			} else {
   1665 				wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
   1666 					"PSK available");
   1667 				os_memset(pw_str, 0, sizeof(pw_str));
   1668 				ext_password_free(pw);
   1669 				return -1;
   1670 			}
   1671 
   1672 			os_memset(pw_str, 0, sizeof(pw_str));
   1673 			ext_password_free(pw);
   1674 		}
   1675 #endif /* CONFIG_EXT_PASSWORD */
   1676 
   1677 		if (!psk_set) {
   1678 			wpa_msg(wpa_s, MSG_INFO,
   1679 				"No PSK available for association");
   1680 			wpas_auth_failed(wpa_s, "NO_PSK_AVAILABLE");
   1681 			return -1;
   1682 		}
   1683 #ifdef CONFIG_OWE
   1684 	} else if (wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
   1685 		/* OWE Diffie-Hellman exchange in (Re)Association
   1686 		 * Request/Response frames set the PMK, so do not override it
   1687 		 * here. */
   1688 #endif /* CONFIG_OWE */
   1689 	} else
   1690 		wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
   1691 
   1692 	return 0;
   1693 }
   1694 
   1695 
   1696 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
   1697 {
   1698 	*pos = 0x00;
   1699 
   1700 	switch (idx) {
   1701 	case 0: /* Bits 0-7 */
   1702 		break;
   1703 	case 1: /* Bits 8-15 */
   1704 		if (wpa_s->conf->coloc_intf_reporting) {
   1705 			/* Bit 13 - Collocated Interference Reporting */
   1706 			*pos |= 0x20;
   1707 		}
   1708 		break;
   1709 	case 2: /* Bits 16-23 */
   1710 #ifdef CONFIG_WNM
   1711 		*pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
   1712 		*pos |= 0x08; /* Bit 19 - BSS Transition */
   1713 #endif /* CONFIG_WNM */
   1714 		break;
   1715 	case 3: /* Bits 24-31 */
   1716 #ifdef CONFIG_WNM
   1717 		*pos |= 0x02; /* Bit 25 - SSID List */
   1718 #endif /* CONFIG_WNM */
   1719 #ifdef CONFIG_INTERWORKING
   1720 		if (wpa_s->conf->interworking)
   1721 			*pos |= 0x80; /* Bit 31 - Interworking */
   1722 #endif /* CONFIG_INTERWORKING */
   1723 		break;
   1724 	case 4: /* Bits 32-39 */
   1725 #ifdef CONFIG_INTERWORKING
   1726 		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_QOS_MAPPING)
   1727 			*pos |= 0x01; /* Bit 32 - QoS Map */
   1728 #endif /* CONFIG_INTERWORKING */
   1729 		break;
   1730 	case 5: /* Bits 40-47 */
   1731 #ifdef CONFIG_HS20
   1732 		if (wpa_s->conf->hs20)
   1733 			*pos |= 0x40; /* Bit 46 - WNM-Notification */
   1734 #endif /* CONFIG_HS20 */
   1735 #ifdef CONFIG_MBO
   1736 		*pos |= 0x40; /* Bit 46 - WNM-Notification */
   1737 #endif /* CONFIG_MBO */
   1738 		break;
   1739 	case 6: /* Bits 48-55 */
   1740 		break;
   1741 	case 7: /* Bits 56-63 */
   1742 		break;
   1743 	case 8: /* Bits 64-71 */
   1744 		if (wpa_s->conf->ftm_responder)
   1745 			*pos |= 0x40; /* Bit 70 - FTM responder */
   1746 		if (wpa_s->conf->ftm_initiator)
   1747 			*pos |= 0x80; /* Bit 71 - FTM initiator */
   1748 		break;
   1749 	case 9: /* Bits 72-79 */
   1750 #ifdef CONFIG_FILS
   1751 		if (!wpa_s->disable_fils)
   1752 			*pos |= 0x01;
   1753 #endif /* CONFIG_FILS */
   1754 		break;
   1755 	}
   1756 }
   1757 
   1758 
   1759 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
   1760 {
   1761 	u8 *pos = buf;
   1762 	u8 len = 10, i;
   1763 
   1764 	if (len < wpa_s->extended_capa_len)
   1765 		len = wpa_s->extended_capa_len;
   1766 	if (buflen < (size_t) len + 2) {
   1767 		wpa_printf(MSG_INFO,
   1768 			   "Not enough room for building extended capabilities element");
   1769 		return -1;
   1770 	}
   1771 
   1772 	*pos++ = WLAN_EID_EXT_CAPAB;
   1773 	*pos++ = len;
   1774 	for (i = 0; i < len; i++, pos++) {
   1775 		wpas_ext_capab_byte(wpa_s, pos, i);
   1776 
   1777 		if (i < wpa_s->extended_capa_len) {
   1778 			*pos &= ~wpa_s->extended_capa_mask[i];
   1779 			*pos |= wpa_s->extended_capa[i];
   1780 		}
   1781 	}
   1782 
   1783 	while (len > 0 && buf[1 + len] == 0) {
   1784 		len--;
   1785 		buf[1] = len;
   1786 	}
   1787 	if (len == 0)
   1788 		return 0;
   1789 
   1790 	return 2 + len;
   1791 }
   1792 
   1793 
   1794 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
   1795 			  struct wpa_bss *test_bss)
   1796 {
   1797 	struct wpa_bss *bss;
   1798 
   1799 	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
   1800 		if (bss == test_bss)
   1801 			return 1;
   1802 	}
   1803 
   1804 	return 0;
   1805 }
   1806 
   1807 
   1808 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
   1809 			   struct wpa_ssid *test_ssid)
   1810 {
   1811 	struct wpa_ssid *ssid;
   1812 
   1813 	for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
   1814 		if (ssid == test_ssid)
   1815 			return 1;
   1816 	}
   1817 
   1818 	return 0;
   1819 }
   1820 
   1821 
   1822 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
   1823 			struct wpa_ssid *test_ssid)
   1824 {
   1825 	if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
   1826 		return 0;
   1827 
   1828 	return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
   1829 }
   1830 
   1831 
   1832 void wpas_connect_work_free(struct wpa_connect_work *cwork)
   1833 {
   1834 	if (cwork == NULL)
   1835 		return;
   1836 	os_free(cwork);
   1837 }
   1838 
   1839 
   1840 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
   1841 {
   1842 	struct wpa_connect_work *cwork;
   1843 	struct wpa_radio_work *work = wpa_s->connect_work;
   1844 
   1845 	if (!work)
   1846 		return;
   1847 
   1848 	wpa_s->connect_work = NULL;
   1849 	cwork = work->ctx;
   1850 	work->ctx = NULL;
   1851 	wpas_connect_work_free(cwork);
   1852 	radio_work_done(work);
   1853 }
   1854 
   1855 
   1856 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
   1857 {
   1858 	struct os_reltime now;
   1859 	u8 addr[ETH_ALEN];
   1860 
   1861 	os_get_reltime(&now);
   1862 	if (wpa_s->last_mac_addr_style == style &&
   1863 	    wpa_s->last_mac_addr_change.sec != 0 &&
   1864 	    !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
   1865 				wpa_s->conf->rand_addr_lifetime)) {
   1866 		wpa_msg(wpa_s, MSG_DEBUG,
   1867 			"Previously selected random MAC address has not yet expired");
   1868 		return 0;
   1869 	}
   1870 
   1871 	switch (style) {
   1872 	case 1:
   1873 		if (random_mac_addr(addr) < 0)
   1874 			return -1;
   1875 		break;
   1876 	case 2:
   1877 		os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
   1878 		if (random_mac_addr_keep_oui(addr) < 0)
   1879 			return -1;
   1880 		break;
   1881 	default:
   1882 		return -1;
   1883 	}
   1884 
   1885 	if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
   1886 		wpa_msg(wpa_s, MSG_INFO,
   1887 			"Failed to set random MAC address");
   1888 		return -1;
   1889 	}
   1890 
   1891 	os_get_reltime(&wpa_s->last_mac_addr_change);
   1892 	wpa_s->mac_addr_changed = 1;
   1893 	wpa_s->last_mac_addr_style = style;
   1894 
   1895 	if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
   1896 		wpa_msg(wpa_s, MSG_INFO,
   1897 			"Could not update MAC address information");
   1898 		return -1;
   1899 	}
   1900 
   1901 	wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
   1902 		MAC2STR(addr));
   1903 
   1904 	return 0;
   1905 }
   1906 
   1907 
   1908 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
   1909 {
   1910 	if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
   1911 	    !wpa_s->conf->preassoc_mac_addr)
   1912 		return 0;
   1913 
   1914 	return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
   1915 }
   1916 
   1917 
   1918 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
   1919 
   1920 /**
   1921  * wpa_supplicant_associate - Request association
   1922  * @wpa_s: Pointer to wpa_supplicant data
   1923  * @bss: Scan results for the selected BSS, or %NULL if not available
   1924  * @ssid: Configuration data for the selected network
   1925  *
   1926  * This function is used to request %wpa_supplicant to associate with a BSS.
   1927  */
   1928 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
   1929 			      struct wpa_bss *bss, struct wpa_ssid *ssid)
   1930 {
   1931 	struct wpa_connect_work *cwork;
   1932 	int rand_style;
   1933 
   1934 	wpa_s->own_disconnect_req = 0;
   1935 
   1936 	/*
   1937 	 * If we are starting a new connection, any previously pending EAPOL
   1938 	 * RX cannot be valid anymore.
   1939 	 */
   1940 	wpabuf_free(wpa_s->pending_eapol_rx);
   1941 	wpa_s->pending_eapol_rx = NULL;
   1942 
   1943 	if (ssid->mac_addr == -1)
   1944 		rand_style = wpa_s->conf->mac_addr;
   1945 	else
   1946 		rand_style = ssid->mac_addr;
   1947 
   1948 	wmm_ac_clear_saved_tspecs(wpa_s);
   1949 	wpa_s->reassoc_same_bss = 0;
   1950 	wpa_s->reassoc_same_ess = 0;
   1951 #ifdef CONFIG_TESTING_OPTIONS
   1952 	wpa_s->testing_resend_assoc = 0;
   1953 #endif /* CONFIG_TESTING_OPTIONS */
   1954 
   1955 	if (wpa_s->last_ssid == ssid) {
   1956 		wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
   1957 		wpa_s->reassoc_same_ess = 1;
   1958 		if (wpa_s->current_bss && wpa_s->current_bss == bss) {
   1959 			wmm_ac_save_tspecs(wpa_s);
   1960 			wpa_s->reassoc_same_bss = 1;
   1961 		} else if (wpa_s->current_bss && wpa_s->current_bss != bss) {
   1962 			os_get_reltime(&wpa_s->roam_start);
   1963 		}
   1964 	}
   1965 
   1966 	if (rand_style > 0 && !wpa_s->reassoc_same_ess) {
   1967 		if (wpas_update_random_addr(wpa_s, rand_style) < 0)
   1968 			return;
   1969 		wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
   1970 	} else if (rand_style == 0 && wpa_s->mac_addr_changed) {
   1971 		if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
   1972 			wpa_msg(wpa_s, MSG_INFO,
   1973 				"Could not restore permanent MAC address");
   1974 			return;
   1975 		}
   1976 		wpa_s->mac_addr_changed = 0;
   1977 		if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
   1978 			wpa_msg(wpa_s, MSG_INFO,
   1979 				"Could not update MAC address information");
   1980 			return;
   1981 		}
   1982 		wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
   1983 	}
   1984 	wpa_s->last_ssid = ssid;
   1985 
   1986 #ifdef CONFIG_IBSS_RSN
   1987 	ibss_rsn_deinit(wpa_s->ibss_rsn);
   1988 	wpa_s->ibss_rsn = NULL;
   1989 #else /* CONFIG_IBSS_RSN */
   1990 	if (ssid->mode == WPAS_MODE_IBSS &&
   1991 	    !(ssid->key_mgmt & (WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPA_NONE))) {
   1992 		wpa_msg(wpa_s, MSG_INFO,
   1993 			"IBSS RSN not supported in the build");
   1994 		return;
   1995 	}
   1996 #endif /* CONFIG_IBSS_RSN */
   1997 
   1998 	if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
   1999 	    ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
   2000 #ifdef CONFIG_AP
   2001 		if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
   2002 			wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
   2003 				"mode");
   2004 			return;
   2005 		}
   2006 		if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
   2007 			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
   2008 			if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
   2009 				wpas_p2p_ap_setup_failed(wpa_s);
   2010 			return;
   2011 		}
   2012 		wpa_s->current_bss = bss;
   2013 #else /* CONFIG_AP */
   2014 		wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
   2015 			"the build");
   2016 #endif /* CONFIG_AP */
   2017 		return;
   2018 	}
   2019 
   2020 	if (ssid->mode == WPAS_MODE_MESH) {
   2021 #ifdef CONFIG_MESH
   2022 		if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
   2023 			wpa_msg(wpa_s, MSG_INFO,
   2024 				"Driver does not support mesh mode");
   2025 			return;
   2026 		}
   2027 		if (bss)
   2028 			ssid->frequency = bss->freq;
   2029 		if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
   2030 			wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
   2031 			return;
   2032 		}
   2033 		wpa_s->current_bss = bss;
   2034 		wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
   2035 			wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
   2036 			ssid->id);
   2037 		wpas_notify_mesh_group_started(wpa_s, ssid);
   2038 #else /* CONFIG_MESH */
   2039 		wpa_msg(wpa_s, MSG_ERROR,
   2040 			"mesh mode support not included in the build");
   2041 #endif /* CONFIG_MESH */
   2042 		return;
   2043 	}
   2044 
   2045 	/*
   2046 	 * Set WPA state machine configuration to match the selected network now
   2047 	 * so that the information is available before wpas_start_assoc_cb()
   2048 	 * gets called. This is needed at least for RSN pre-authentication where
   2049 	 * candidate APs are added to a list based on scan result processing
   2050 	 * before completion of the first association.
   2051 	 */
   2052 	wpa_supplicant_rsn_supp_set_config(wpa_s, ssid);
   2053 
   2054 #ifdef CONFIG_DPP
   2055 	if (wpas_dpp_check_connect(wpa_s, ssid, bss) != 0)
   2056 		return;
   2057 #endif /* CONFIG_DPP */
   2058 
   2059 #ifdef CONFIG_TDLS
   2060 	if (bss)
   2061 		wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
   2062 				bss->ie_len);
   2063 #endif /* CONFIG_TDLS */
   2064 
   2065 	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
   2066 	    ssid->mode == IEEE80211_MODE_INFRA) {
   2067 		sme_authenticate(wpa_s, bss, ssid);
   2068 		return;
   2069 	}
   2070 
   2071 	if (wpa_s->connect_work) {
   2072 		wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
   2073 		return;
   2074 	}
   2075 
   2076 	if (radio_work_pending(wpa_s, "connect")) {
   2077 		wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
   2078 		return;
   2079 	}
   2080 
   2081 #ifdef CONFIG_SME
   2082 	if (ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) {
   2083 		/* Clear possibly set auth_alg, if any, from last attempt. */
   2084 		wpa_s->sme.auth_alg = WPA_AUTH_ALG_OPEN;
   2085 	}
   2086 #endif /* CONFIG_SME */
   2087 
   2088 	wpas_abort_ongoing_scan(wpa_s);
   2089 
   2090 	cwork = os_zalloc(sizeof(*cwork));
   2091 	if (cwork == NULL)
   2092 		return;
   2093 
   2094 	cwork->bss = bss;
   2095 	cwork->ssid = ssid;
   2096 
   2097 	if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
   2098 			   wpas_start_assoc_cb, cwork) < 0) {
   2099 		os_free(cwork);
   2100 	}
   2101 }
   2102 
   2103 
   2104 static int bss_is_ibss(struct wpa_bss *bss)
   2105 {
   2106 	return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
   2107 		IEEE80211_CAP_IBSS;
   2108 }
   2109 
   2110 
   2111 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
   2112 			    const struct wpa_ssid *ssid)
   2113 {
   2114 	enum hostapd_hw_mode hw_mode;
   2115 	struct hostapd_hw_modes *mode = NULL;
   2116 	u8 channel;
   2117 	int i;
   2118 
   2119 	hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
   2120 	if (hw_mode == NUM_HOSTAPD_MODES)
   2121 		return 0;
   2122 	for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
   2123 		if (wpa_s->hw.modes[i].mode == hw_mode) {
   2124 			mode = &wpa_s->hw.modes[i];
   2125 			break;
   2126 		}
   2127 	}
   2128 
   2129 	if (!mode)
   2130 		return 0;
   2131 
   2132 	return mode->vht_capab != 0;
   2133 }
   2134 
   2135 
   2136 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
   2137 			  const struct wpa_ssid *ssid,
   2138 			  struct hostapd_freq_params *freq)
   2139 {
   2140 	enum hostapd_hw_mode hw_mode;
   2141 	struct hostapd_hw_modes *mode = NULL;
   2142 	int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
   2143 			   184, 192 };
   2144 	int vht80[] = { 36, 52, 100, 116, 132, 149 };
   2145 	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
   2146 	u8 channel;
   2147 	int i, chan_idx, ht40 = -1, res, obss_scan = 1;
   2148 	unsigned int j, k;
   2149 	struct hostapd_freq_params vht_freq;
   2150 	int chwidth, seg0, seg1;
   2151 	u32 vht_caps = 0;
   2152 
   2153 	freq->freq = ssid->frequency;
   2154 
   2155 	for (j = 0; j < wpa_s->last_scan_res_used; j++) {
   2156 		struct wpa_bss *bss = wpa_s->last_scan_res[j];
   2157 
   2158 		if (ssid->mode != WPAS_MODE_IBSS)
   2159 			break;
   2160 
   2161 		/* Don't adjust control freq in case of fixed_freq */
   2162 		if (ssid->fixed_freq)
   2163 			break;
   2164 
   2165 		if (!bss_is_ibss(bss))
   2166 			continue;
   2167 
   2168 		if (ssid->ssid_len == bss->ssid_len &&
   2169 		    os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
   2170 			wpa_printf(MSG_DEBUG,
   2171 				   "IBSS already found in scan results, adjust control freq: %d",
   2172 				   bss->freq);
   2173 			freq->freq = bss->freq;
   2174 			obss_scan = 0;
   2175 			break;
   2176 		}
   2177 	}
   2178 
   2179 	/* For IBSS check HT_IBSS flag */
   2180 	if (ssid->mode == WPAS_MODE_IBSS &&
   2181 	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
   2182 		return;
   2183 
   2184 	if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
   2185 	    wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
   2186 	    wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
   2187 		wpa_printf(MSG_DEBUG,
   2188 			   "IBSS: WEP/TKIP detected, do not try to enable HT");
   2189 		return;
   2190 	}
   2191 
   2192 	hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
   2193 	for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
   2194 		if (wpa_s->hw.modes[i].mode == hw_mode) {
   2195 			mode = &wpa_s->hw.modes[i];
   2196 			break;
   2197 		}
   2198 	}
   2199 
   2200 	if (!mode)
   2201 		return;
   2202 
   2203 #ifdef CONFIG_HT_OVERRIDES
   2204 	if (ssid->disable_ht) {
   2205 		freq->ht_enabled = 0;
   2206 		return;
   2207 	}
   2208 #endif /* CONFIG_HT_OVERRIDES */
   2209 
   2210 	freq->ht_enabled = ht_supported(mode);
   2211 	if (!freq->ht_enabled)
   2212 		return;
   2213 
   2214 	/* Setup higher BW only for 5 GHz */
   2215 	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
   2216 		return;
   2217 
   2218 	for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
   2219 		pri_chan = &mode->channels[chan_idx];
   2220 		if (pri_chan->chan == channel)
   2221 			break;
   2222 		pri_chan = NULL;
   2223 	}
   2224 	if (!pri_chan)
   2225 		return;
   2226 
   2227 	/* Check primary channel flags */
   2228 	if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
   2229 		return;
   2230 
   2231 	freq->channel = pri_chan->chan;
   2232 
   2233 #ifdef CONFIG_HT_OVERRIDES
   2234 	if (ssid->disable_ht40) {
   2235 		if (ssid->disable_vht)
   2236 			return;
   2237 		goto skip_ht40;
   2238 	}
   2239 #endif /* CONFIG_HT_OVERRIDES */
   2240 
   2241 	/* Check/setup HT40+/HT40- */
   2242 	for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
   2243 		if (ht40plus[j] == channel) {
   2244 			ht40 = 1;
   2245 			break;
   2246 		}
   2247 	}
   2248 
   2249 	/* Find secondary channel */
   2250 	for (i = 0; i < mode->num_channels; i++) {
   2251 		sec_chan = &mode->channels[i];
   2252 		if (sec_chan->chan == channel + ht40 * 4)
   2253 			break;
   2254 		sec_chan = NULL;
   2255 	}
   2256 	if (!sec_chan)
   2257 		return;
   2258 
   2259 	/* Check secondary channel flags */
   2260 	if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
   2261 		return;
   2262 
   2263 	if (ht40 == -1) {
   2264 		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
   2265 			return;
   2266 	} else {
   2267 		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
   2268 			return;
   2269 	}
   2270 	freq->sec_channel_offset = ht40;
   2271 
   2272 	if (obss_scan) {
   2273 		struct wpa_scan_results *scan_res;
   2274 
   2275 		scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
   2276 		if (scan_res == NULL) {
   2277 			/* Back to HT20 */
   2278 			freq->sec_channel_offset = 0;
   2279 			return;
   2280 		}
   2281 
   2282 		res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
   2283 				     sec_chan->chan);
   2284 		switch (res) {
   2285 		case 0:
   2286 			/* Back to HT20 */
   2287 			freq->sec_channel_offset = 0;
   2288 			break;
   2289 		case 1:
   2290 			/* Configuration allowed */
   2291 			break;
   2292 		case 2:
   2293 			/* Switch pri/sec channels */
   2294 			freq->freq = hw_get_freq(mode, sec_chan->chan);
   2295 			freq->sec_channel_offset = -freq->sec_channel_offset;
   2296 			freq->channel = sec_chan->chan;
   2297 			break;
   2298 		default:
   2299 			freq->sec_channel_offset = 0;
   2300 			break;
   2301 		}
   2302 
   2303 		wpa_scan_results_free(scan_res);
   2304 	}
   2305 
   2306 #ifdef CONFIG_HT_OVERRIDES
   2307 skip_ht40:
   2308 #endif /* CONFIG_HT_OVERRIDES */
   2309 	wpa_printf(MSG_DEBUG,
   2310 		   "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
   2311 		   freq->channel, freq->sec_channel_offset);
   2312 
   2313 	if (!drv_supports_vht(wpa_s, ssid))
   2314 		return;
   2315 
   2316 	/* For IBSS check VHT_IBSS flag */
   2317 	if (ssid->mode == WPAS_MODE_IBSS &&
   2318 	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
   2319 		return;
   2320 
   2321 	vht_freq = *freq;
   2322 
   2323 #ifdef CONFIG_VHT_OVERRIDES
   2324 	if (ssid->disable_vht) {
   2325 		freq->vht_enabled = 0;
   2326 		return;
   2327 	}
   2328 #endif /* CONFIG_VHT_OVERRIDES */
   2329 
   2330 	vht_freq.vht_enabled = vht_supported(mode);
   2331 	if (!vht_freq.vht_enabled)
   2332 		return;
   2333 
   2334 	/* setup center_freq1, bandwidth */
   2335 	for (j = 0; j < ARRAY_SIZE(vht80); j++) {
   2336 		if (freq->channel >= vht80[j] &&
   2337 		    freq->channel < vht80[j] + 16)
   2338 			break;
   2339 	}
   2340 
   2341 	if (j == ARRAY_SIZE(vht80))
   2342 		return;
   2343 
   2344 	for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
   2345 		struct hostapd_channel_data *chan;
   2346 
   2347 		chan = hw_get_channel_chan(mode, i, NULL);
   2348 		if (!chan)
   2349 			return;
   2350 
   2351 		/* Back to HT configuration if channel not usable */
   2352 		if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
   2353 			return;
   2354 	}
   2355 
   2356 	chwidth = VHT_CHANWIDTH_80MHZ;
   2357 	seg0 = vht80[j] + 6;
   2358 	seg1 = 0;
   2359 
   2360 	if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
   2361 		/* setup center_freq2, bandwidth */
   2362 		for (k = 0; k < ARRAY_SIZE(vht80); k++) {
   2363 			/* Only accept 80 MHz segments separated by a gap */
   2364 			if (j == k || abs(vht80[j] - vht80[k]) == 16)
   2365 				continue;
   2366 			for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
   2367 				struct hostapd_channel_data *chan;
   2368 
   2369 				chan = hw_get_channel_chan(mode, i, NULL);
   2370 				if (!chan)
   2371 					continue;
   2372 
   2373 				if (chan->flag & (HOSTAPD_CHAN_DISABLED |
   2374 						  HOSTAPD_CHAN_NO_IR |
   2375 						  HOSTAPD_CHAN_RADAR))
   2376 					continue;
   2377 
   2378 				/* Found a suitable second segment for 80+80 */
   2379 				chwidth = VHT_CHANWIDTH_80P80MHZ;
   2380 				vht_caps |=
   2381 					VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
   2382 				seg1 = vht80[k] + 6;
   2383 			}
   2384 
   2385 			if (chwidth == VHT_CHANWIDTH_80P80MHZ)
   2386 				break;
   2387 		}
   2388 	} else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_160MHZ) {
   2389 		if (freq->freq == 5180) {
   2390 			chwidth = VHT_CHANWIDTH_160MHZ;
   2391 			vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
   2392 			seg0 = 50;
   2393 		} else if (freq->freq == 5520) {
   2394 			chwidth = VHT_CHANWIDTH_160MHZ;
   2395 			vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
   2396 			seg0 = 114;
   2397 		}
   2398 	} else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_USE_HT) {
   2399 		chwidth = VHT_CHANWIDTH_USE_HT;
   2400 		seg0 = vht80[j] + 2;
   2401 #ifdef CONFIG_HT_OVERRIDES
   2402 		if (ssid->disable_ht40)
   2403 			seg0 = 0;
   2404 #endif /* CONFIG_HT_OVERRIDES */
   2405 	}
   2406 
   2407 	if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
   2408 				    freq->channel, freq->ht_enabled,
   2409 				    vht_freq.vht_enabled,
   2410 				    freq->sec_channel_offset,
   2411 				    chwidth, seg0, seg1, vht_caps) != 0)
   2412 		return;
   2413 
   2414 	*freq = vht_freq;
   2415 
   2416 	wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
   2417 		   freq->center_freq1, freq->center_freq2, freq->bandwidth);
   2418 }
   2419 
   2420 
   2421 #ifdef CONFIG_FILS
   2422 static size_t wpas_add_fils_hlp_req(struct wpa_supplicant *wpa_s, u8 *ie_buf,
   2423 				    size_t ie_buf_len)
   2424 {
   2425 	struct fils_hlp_req *req;
   2426 	size_t rem_len, hdr_len, hlp_len, len, ie_len = 0;
   2427 	const u8 *pos;
   2428 	u8 *buf = ie_buf;
   2429 
   2430 	dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
   2431 			 list) {
   2432 		rem_len = ie_buf_len - ie_len;
   2433 		pos = wpabuf_head(req->pkt);
   2434 		hdr_len = 1 + 2 * ETH_ALEN + 6;
   2435 		hlp_len = wpabuf_len(req->pkt);
   2436 
   2437 		if (rem_len < 2 + hdr_len + hlp_len) {
   2438 			wpa_printf(MSG_ERROR,
   2439 				   "FILS: Cannot fit HLP - rem_len=%lu to_fill=%lu",
   2440 				   (unsigned long) rem_len,
   2441 				   (unsigned long) (2 + hdr_len + hlp_len));
   2442 			break;
   2443 		}
   2444 
   2445 		len = (hdr_len + hlp_len) > 255 ? 255 : hdr_len + hlp_len;
   2446 		/* Element ID */
   2447 		*buf++ = WLAN_EID_EXTENSION;
   2448 		/* Length */
   2449 		*buf++ = len;
   2450 		/* Element ID Extension */
   2451 		*buf++ = WLAN_EID_EXT_FILS_HLP_CONTAINER;
   2452 		/* Destination MAC address */
   2453 		os_memcpy(buf, req->dst, ETH_ALEN);
   2454 		buf += ETH_ALEN;
   2455 		/* Source MAC address */
   2456 		os_memcpy(buf, wpa_s->own_addr, ETH_ALEN);
   2457 		buf += ETH_ALEN;
   2458 		/* LLC/SNAP Header */
   2459 		os_memcpy(buf, "\xaa\xaa\x03\x00\x00\x00", 6);
   2460 		buf += 6;
   2461 		/* HLP Packet */
   2462 		os_memcpy(buf, pos, len - hdr_len);
   2463 		buf += len - hdr_len;
   2464 		pos += len - hdr_len;
   2465 
   2466 		hlp_len -= len - hdr_len;
   2467 		ie_len += 2 + len;
   2468 		rem_len -= 2 + len;
   2469 
   2470 		while (hlp_len) {
   2471 			len = (hlp_len > 255) ? 255 : hlp_len;
   2472 			if (rem_len < 2 + len)
   2473 				break;
   2474 			*buf++ = WLAN_EID_FRAGMENT;
   2475 			*buf++ = len;
   2476 			os_memcpy(buf, pos, len);
   2477 			buf += len;
   2478 			pos += len;
   2479 
   2480 			hlp_len -= len;
   2481 			ie_len += 2 + len;
   2482 			rem_len -= 2 + len;
   2483 		}
   2484 	}
   2485 
   2486 	return ie_len;
   2487 }
   2488 
   2489 
   2490 int wpa_is_fils_supported(struct wpa_supplicant *wpa_s)
   2491 {
   2492 	return (((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
   2493 		 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SUPPORT_FILS)) ||
   2494 		(!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
   2495 		 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_FILS_SK_OFFLOAD)));
   2496 }
   2497 
   2498 
   2499 int wpa_is_fils_sk_pfs_supported(struct wpa_supplicant *wpa_s)
   2500 {
   2501 #ifdef CONFIG_FILS_SK_PFS
   2502 	return (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
   2503 		(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SUPPORT_FILS);
   2504 #else /* CONFIG_FILS_SK_PFS */
   2505 	return 0;
   2506 #endif /* CONFIG_FILS_SK_PFS */
   2507 }
   2508 
   2509 #endif /* CONFIG_FILS */
   2510 
   2511 
   2512 static u8 * wpas_populate_assoc_ies(
   2513 	struct wpa_supplicant *wpa_s,
   2514 	struct wpa_bss *bss, struct wpa_ssid *ssid,
   2515 	struct wpa_driver_associate_params *params,
   2516 	enum wpa_drv_update_connect_params_mask *mask)
   2517 {
   2518 	u8 *wpa_ie;
   2519 	size_t max_wpa_ie_len = 500;
   2520 	size_t wpa_ie_len;
   2521 	int algs = WPA_AUTH_ALG_OPEN;
   2522 #ifdef CONFIG_MBO
   2523 	const u8 *mbo_ie;
   2524 #endif
   2525 #ifdef CONFIG_SAE
   2526 	int sae_pmksa_cached = 0;
   2527 #endif /* CONFIG_SAE */
   2528 #ifdef CONFIG_FILS
   2529 	const u8 *realm, *username, *rrk;
   2530 	size_t realm_len, username_len, rrk_len;
   2531 	u16 next_seq_num;
   2532 	struct fils_hlp_req *req;
   2533 
   2534 	dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
   2535 			 list) {
   2536 		max_wpa_ie_len += 3 + 2 * ETH_ALEN + 6 + wpabuf_len(req->pkt) +
   2537 				  2 + 2 * wpabuf_len(req->pkt) / 255;
   2538 	}
   2539 #endif /* CONFIG_FILS */
   2540 
   2541 	wpa_ie = os_malloc(max_wpa_ie_len);
   2542 	if (!wpa_ie) {
   2543 		wpa_printf(MSG_ERROR,
   2544 			   "Failed to allocate connect IE buffer for %lu bytes",
   2545 			   (unsigned long) max_wpa_ie_len);
   2546 		return NULL;
   2547 	}
   2548 
   2549 	if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
   2550 		    wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
   2551 	    wpa_key_mgmt_wpa(ssid->key_mgmt)) {
   2552 		int try_opportunistic;
   2553 		const u8 *cache_id = NULL;
   2554 
   2555 		try_opportunistic = (ssid->proactive_key_caching < 0 ?
   2556 				     wpa_s->conf->okc :
   2557 				     ssid->proactive_key_caching) &&
   2558 			(ssid->proto & WPA_PROTO_RSN);
   2559 #ifdef CONFIG_FILS
   2560 		if (wpa_key_mgmt_fils(ssid->key_mgmt))
   2561 			cache_id = wpa_bss_get_fils_cache_id(bss);
   2562 #endif /* CONFIG_FILS */
   2563 		if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
   2564 					    ssid, try_opportunistic,
   2565 					    cache_id, 0) == 0) {
   2566 			eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
   2567 #ifdef CONFIG_SAE
   2568 			sae_pmksa_cached = 1;
   2569 #endif /* CONFIG_SAE */
   2570 		}
   2571 		wpa_ie_len = max_wpa_ie_len;
   2572 		if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
   2573 					      wpa_ie, &wpa_ie_len)) {
   2574 			wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
   2575 				"key management and encryption suites");
   2576 			os_free(wpa_ie);
   2577 			return NULL;
   2578 		}
   2579 #ifdef CONFIG_HS20
   2580 	} else if (bss && wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
   2581 		   (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
   2582 		/* No PMKSA caching, but otherwise similar to RSN/WPA */
   2583 		wpa_ie_len = max_wpa_ie_len;
   2584 		if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
   2585 					      wpa_ie, &wpa_ie_len)) {
   2586 			wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
   2587 				"key management and encryption suites");
   2588 			os_free(wpa_ie);
   2589 			return NULL;
   2590 		}
   2591 #endif /* CONFIG_HS20 */
   2592 	} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
   2593 		   wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
   2594 		/*
   2595 		 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
   2596 		 * use non-WPA since the scan results did not indicate that the
   2597 		 * AP is using WPA or WPA2.
   2598 		 */
   2599 		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
   2600 		wpa_ie_len = 0;
   2601 		wpa_s->wpa_proto = 0;
   2602 	} else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
   2603 		wpa_ie_len = max_wpa_ie_len;
   2604 		if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
   2605 					      wpa_ie, &wpa_ie_len)) {
   2606 			wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
   2607 				"key management and encryption suites (no "
   2608 				"scan results)");
   2609 			os_free(wpa_ie);
   2610 			return NULL;
   2611 		}
   2612 #ifdef CONFIG_WPS
   2613 	} else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
   2614 		struct wpabuf *wps_ie;
   2615 		wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
   2616 		if (wps_ie && wpabuf_len(wps_ie) <= max_wpa_ie_len) {
   2617 			wpa_ie_len = wpabuf_len(wps_ie);
   2618 			os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
   2619 		} else
   2620 			wpa_ie_len = 0;
   2621 		wpabuf_free(wps_ie);
   2622 		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
   2623 		if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
   2624 			params->wps = WPS_MODE_PRIVACY;
   2625 		else
   2626 			params->wps = WPS_MODE_OPEN;
   2627 		wpa_s->wpa_proto = 0;
   2628 #endif /* CONFIG_WPS */
   2629 	} else {
   2630 		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
   2631 		wpa_ie_len = 0;
   2632 		wpa_s->wpa_proto = 0;
   2633 	}
   2634 
   2635 #ifdef IEEE8021X_EAPOL
   2636 	if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
   2637 		if (ssid->leap) {
   2638 			if (ssid->non_leap == 0)
   2639 				algs = WPA_AUTH_ALG_LEAP;
   2640 			else
   2641 				algs |= WPA_AUTH_ALG_LEAP;
   2642 		}
   2643 	}
   2644 
   2645 #ifdef CONFIG_FILS
   2646 	/* Clear FILS association */
   2647 	wpa_sm_set_reset_fils_completed(wpa_s->wpa, 0);
   2648 
   2649 	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_FILS_SK_OFFLOAD) &&
   2650 	    ssid->eap.erp && wpa_key_mgmt_fils(wpa_s->key_mgmt) &&
   2651 	    eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap, &username,
   2652 				  &username_len, &realm, &realm_len,
   2653 				  &next_seq_num, &rrk, &rrk_len) == 0 &&
   2654 	    (!wpa_s->last_con_fail_realm ||
   2655 	     wpa_s->last_con_fail_realm_len != realm_len ||
   2656 	     os_memcmp(wpa_s->last_con_fail_realm, realm, realm_len) != 0)) {
   2657 		algs = WPA_AUTH_ALG_FILS;
   2658 		params->fils_erp_username = username;
   2659 		params->fils_erp_username_len = username_len;
   2660 		params->fils_erp_realm = realm;
   2661 		params->fils_erp_realm_len = realm_len;
   2662 		params->fils_erp_next_seq_num = next_seq_num;
   2663 		params->fils_erp_rrk = rrk;
   2664 		params->fils_erp_rrk_len = rrk_len;
   2665 
   2666 		if (mask)
   2667 			*mask |= WPA_DRV_UPDATE_FILS_ERP_INFO;
   2668 	}
   2669 #endif /* CONFIG_FILS */
   2670 #endif /* IEEE8021X_EAPOL */
   2671 #ifdef CONFIG_SAE
   2672 	if (wpa_s->key_mgmt & (WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE))
   2673 		algs = WPA_AUTH_ALG_SAE;
   2674 #endif /* CONFIG_SAE */
   2675 
   2676 	wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
   2677 	if (ssid->auth_alg) {
   2678 		algs = ssid->auth_alg;
   2679 		wpa_dbg(wpa_s, MSG_DEBUG,
   2680 			"Overriding auth_alg selection: 0x%x", algs);
   2681 	}
   2682 
   2683 #ifdef CONFIG_SAE
   2684 	if (sae_pmksa_cached && algs == WPA_AUTH_ALG_SAE) {
   2685 		wpa_dbg(wpa_s, MSG_DEBUG,
   2686 			"SAE: Use WPA_AUTH_ALG_OPEN for PMKSA caching attempt");
   2687 		algs = WPA_AUTH_ALG_OPEN;
   2688 	}
   2689 #endif /* CONFIG_SAE */
   2690 
   2691 #ifdef CONFIG_P2P
   2692 	if (wpa_s->global->p2p) {
   2693 		u8 *pos;
   2694 		size_t len;
   2695 		int res;
   2696 		pos = wpa_ie + wpa_ie_len;
   2697 		len = max_wpa_ie_len - wpa_ie_len;
   2698 		res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
   2699 					    ssid->p2p_group);
   2700 		if (res >= 0)
   2701 			wpa_ie_len += res;
   2702 	}
   2703 
   2704 	wpa_s->cross_connect_disallowed = 0;
   2705 	if (bss) {
   2706 		struct wpabuf *p2p;
   2707 		p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
   2708 		if (p2p) {
   2709 			wpa_s->cross_connect_disallowed =
   2710 				p2p_get_cross_connect_disallowed(p2p);
   2711 			wpabuf_free(p2p);
   2712 			wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
   2713 				"connection",
   2714 				wpa_s->cross_connect_disallowed ?
   2715 				"disallows" : "allows");
   2716 		}
   2717 	}
   2718 
   2719 	os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
   2720 #endif /* CONFIG_P2P */
   2721 
   2722 	if (bss) {
   2723 		wpa_ie_len += wpas_supp_op_class_ie(wpa_s, ssid, bss->freq,
   2724 						    wpa_ie + wpa_ie_len,
   2725 						    max_wpa_ie_len -
   2726 						    wpa_ie_len);
   2727 	}
   2728 
   2729 	/*
   2730 	 * Workaround: Add Extended Capabilities element only if the AP
   2731 	 * included this element in Beacon/Probe Response frames. Some older
   2732 	 * APs seem to have interoperability issues if this element is
   2733 	 * included, so while the standard may require us to include the
   2734 	 * element in all cases, it is justifiable to skip it to avoid
   2735 	 * interoperability issues.
   2736 	 */
   2737 	if (ssid->p2p_group)
   2738 		wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
   2739 	else
   2740 		wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
   2741 
   2742 	if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
   2743 		u8 ext_capab[18];
   2744 		int ext_capab_len;
   2745 		ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
   2746 						     sizeof(ext_capab));
   2747 		if (ext_capab_len > 0 &&
   2748 		    wpa_ie_len + ext_capab_len <= max_wpa_ie_len) {
   2749 			u8 *pos = wpa_ie;
   2750 			if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
   2751 				pos += 2 + pos[1];
   2752 			os_memmove(pos + ext_capab_len, pos,
   2753 				   wpa_ie_len - (pos - wpa_ie));
   2754 			wpa_ie_len += ext_capab_len;
   2755 			os_memcpy(pos, ext_capab, ext_capab_len);
   2756 		}
   2757 	}
   2758 
   2759 #ifdef CONFIG_HS20
   2760 	if (is_hs20_network(wpa_s, ssid, bss)) {
   2761 		struct wpabuf *hs20;
   2762 
   2763 		hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
   2764 		if (hs20) {
   2765 			int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
   2766 			size_t len;
   2767 
   2768 			wpas_hs20_add_indication(hs20, pps_mo_id,
   2769 						 get_hs20_version(bss));
   2770 			wpas_hs20_add_roam_cons_sel(hs20, ssid);
   2771 			len = max_wpa_ie_len - wpa_ie_len;
   2772 			if (wpabuf_len(hs20) <= len) {
   2773 				os_memcpy(wpa_ie + wpa_ie_len,
   2774 					  wpabuf_head(hs20), wpabuf_len(hs20));
   2775 				wpa_ie_len += wpabuf_len(hs20);
   2776 			}
   2777 			wpabuf_free(hs20);
   2778 
   2779 			hs20_configure_frame_filters(wpa_s);
   2780 		}
   2781 	}
   2782 #endif /* CONFIG_HS20 */
   2783 
   2784 	if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
   2785 		struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
   2786 		size_t len;
   2787 
   2788 		len = max_wpa_ie_len - wpa_ie_len;
   2789 		if (wpabuf_len(buf) <= len) {
   2790 			os_memcpy(wpa_ie + wpa_ie_len,
   2791 				  wpabuf_head(buf), wpabuf_len(buf));
   2792 			wpa_ie_len += wpabuf_len(buf);
   2793 		}
   2794 	}
   2795 
   2796 #ifdef CONFIG_FST
   2797 	if (wpa_s->fst_ies) {
   2798 		int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
   2799 
   2800 		if (wpa_ie_len + fst_ies_len <= max_wpa_ie_len) {
   2801 			os_memcpy(wpa_ie + wpa_ie_len,
   2802 				  wpabuf_head(wpa_s->fst_ies), fst_ies_len);
   2803 			wpa_ie_len += fst_ies_len;
   2804 		}
   2805 	}
   2806 #endif /* CONFIG_FST */
   2807 
   2808 #ifdef CONFIG_MBO
   2809 	mbo_ie = bss ? wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE) : NULL;
   2810 	if (mbo_ie) {
   2811 		int len;
   2812 
   2813 		len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
   2814 				  max_wpa_ie_len - wpa_ie_len,
   2815 				  !!mbo_attr_from_mbo_ie(mbo_ie,
   2816 							 OCE_ATTR_ID_CAPA_IND));
   2817 		if (len >= 0)
   2818 			wpa_ie_len += len;
   2819 	}
   2820 #endif /* CONFIG_MBO */
   2821 
   2822 #ifdef CONFIG_FILS
   2823 	if (algs == WPA_AUTH_ALG_FILS) {
   2824 		size_t len;
   2825 
   2826 		len = wpas_add_fils_hlp_req(wpa_s, wpa_ie + wpa_ie_len,
   2827 					    max_wpa_ie_len - wpa_ie_len);
   2828 		wpa_ie_len += len;
   2829 	}
   2830 #endif /* CONFIG_FILS */
   2831 
   2832 #ifdef CONFIG_OWE
   2833 #ifdef CONFIG_TESTING_OPTIONS
   2834 	if (get_ie_ext(wpa_ie, wpa_ie_len, WLAN_EID_EXT_OWE_DH_PARAM)) {
   2835 		wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
   2836 	} else
   2837 #endif /* CONFIG_TESTING_OPTIONS */
   2838 	if (algs == WPA_AUTH_ALG_OPEN &&
   2839 	    ssid->key_mgmt == WPA_KEY_MGMT_OWE) {
   2840 		struct wpabuf *owe_ie;
   2841 		u16 group;
   2842 
   2843 		if (ssid->owe_group) {
   2844 			group = ssid->owe_group;
   2845 		} else if (wpa_s->assoc_status_code ==
   2846 			   WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
   2847 			if (wpa_s->last_owe_group == 19)
   2848 				group = 20;
   2849 			else if (wpa_s->last_owe_group == 20)
   2850 				group = 21;
   2851 			else
   2852 				group = OWE_DH_GROUP;
   2853 		} else {
   2854 			group = OWE_DH_GROUP;
   2855 		}
   2856 
   2857 		wpa_s->last_owe_group = group;
   2858 		wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
   2859 		owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
   2860 		if (owe_ie &&
   2861 		    wpabuf_len(owe_ie) <= max_wpa_ie_len - wpa_ie_len) {
   2862 			os_memcpy(wpa_ie + wpa_ie_len,
   2863 				  wpabuf_head(owe_ie), wpabuf_len(owe_ie));
   2864 			wpa_ie_len += wpabuf_len(owe_ie);
   2865 		}
   2866 		wpabuf_free(owe_ie);
   2867 	}
   2868 #endif /* CONFIG_OWE */
   2869 
   2870 #ifdef CONFIG_DPP2
   2871 	if (wpa_sm_get_key_mgmt(wpa_s->wpa) == WPA_KEY_MGMT_DPP &&
   2872 	    ssid->dpp_netaccesskey) {
   2873 		dpp_pfs_free(wpa_s->dpp_pfs);
   2874 		wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
   2875 					      ssid->dpp_netaccesskey_len);
   2876 		if (!wpa_s->dpp_pfs) {
   2877 			wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
   2878 			/* Try to continue without PFS */
   2879 			goto pfs_fail;
   2880 		}
   2881 		if (wpabuf_len(wpa_s->dpp_pfs->ie) <=
   2882 		    max_wpa_ie_len - wpa_ie_len) {
   2883 			os_memcpy(wpa_ie + wpa_ie_len,
   2884 				  wpabuf_head(wpa_s->dpp_pfs->ie),
   2885 				  wpabuf_len(wpa_s->dpp_pfs->ie));
   2886 			wpa_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
   2887 		}
   2888 	}
   2889 pfs_fail:
   2890 #endif /* CONFIG_DPP2 */
   2891 
   2892 #ifdef CONFIG_IEEE80211R
   2893 	/*
   2894 	 * Add MDIE under these conditions: the network profile allows FT,
   2895 	 * the AP supports FT, and the mobility domain ID matches.
   2896 	 */
   2897 	if (bss && wpa_key_mgmt_ft(wpa_sm_get_key_mgmt(wpa_s->wpa))) {
   2898 		const u8 *mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
   2899 
   2900 		if (mdie && mdie[1] >= MOBILITY_DOMAIN_ID_LEN) {
   2901 			size_t len = 0;
   2902 			const u8 *md = mdie + 2;
   2903 			const u8 *wpa_md = wpa_sm_get_ft_md(wpa_s->wpa);
   2904 
   2905 			if (os_memcmp(md, wpa_md,
   2906 				      MOBILITY_DOMAIN_ID_LEN) == 0) {
   2907 				/* Add mobility domain IE */
   2908 				len = wpa_ft_add_mdie(
   2909 					wpa_s->wpa, wpa_ie + wpa_ie_len,
   2910 					max_wpa_ie_len - wpa_ie_len, mdie);
   2911 				wpa_ie_len += len;
   2912 			}
   2913 #ifdef CONFIG_SME
   2914 			if (len > 0 && wpa_s->sme.ft_used &&
   2915 			    wpa_sm_has_ptk(wpa_s->wpa)) {
   2916 				wpa_dbg(wpa_s, MSG_DEBUG,
   2917 					"SME: Trying to use FT over-the-air");
   2918 				algs |= WPA_AUTH_ALG_FT;
   2919 			}
   2920 #endif /* CONFIG_SME */
   2921 		}
   2922 	}
   2923 #endif /* CONFIG_IEEE80211R */
   2924 
   2925 	if (ssid->multi_ap_backhaul_sta) {
   2926 		size_t multi_ap_ie_len;
   2927 
   2928 		multi_ap_ie_len = add_multi_ap_ie(wpa_ie + wpa_ie_len,
   2929 						  max_wpa_ie_len - wpa_ie_len,
   2930 						  MULTI_AP_BACKHAUL_STA);
   2931 		if (multi_ap_ie_len == 0) {
   2932 			wpa_printf(MSG_ERROR,
   2933 				   "Multi-AP: Failed to build Multi-AP IE");
   2934 			os_free(wpa_ie);
   2935 			return NULL;
   2936 		}
   2937 		wpa_ie_len += multi_ap_ie_len;
   2938 	}
   2939 
   2940 	params->wpa_ie = wpa_ie;
   2941 	params->wpa_ie_len = wpa_ie_len;
   2942 	params->auth_alg = algs;
   2943 	if (mask)
   2944 		*mask |= WPA_DRV_UPDATE_ASSOC_IES | WPA_DRV_UPDATE_AUTH_TYPE;
   2945 
   2946 	return wpa_ie;
   2947 }
   2948 
   2949 
   2950 #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
   2951 static void wpas_update_fils_connect_params(struct wpa_supplicant *wpa_s)
   2952 {
   2953 	struct wpa_driver_associate_params params;
   2954 	enum wpa_drv_update_connect_params_mask mask = 0;
   2955 	u8 *wpa_ie;
   2956 
   2957 	if (wpa_s->auth_alg != WPA_AUTH_ALG_OPEN)
   2958 		return; /* nothing to do */
   2959 
   2960 	os_memset(&params, 0, sizeof(params));
   2961 	wpa_ie = wpas_populate_assoc_ies(wpa_s, wpa_s->current_bss,
   2962 					 wpa_s->current_ssid, &params, &mask);
   2963 	if (!wpa_ie)
   2964 		return;
   2965 
   2966 	if (params.auth_alg != WPA_AUTH_ALG_FILS) {
   2967 		os_free(wpa_ie);
   2968 		return;
   2969 	}
   2970 
   2971 	wpa_s->auth_alg = params.auth_alg;
   2972 	wpa_drv_update_connect_params(wpa_s, &params, mask);
   2973 	os_free(wpa_ie);
   2974 }
   2975 #endif /* CONFIG_FILS && IEEE8021X_EAPOL */
   2976 
   2977 
   2978 #ifdef CONFIG_MBO
   2979 void wpas_update_mbo_connect_params(struct wpa_supplicant *wpa_s)
   2980 {
   2981 	struct wpa_driver_associate_params params;
   2982 	u8 *wpa_ie;
   2983 
   2984 	/*
   2985 	 * Update MBO connect params only in case of change of MBO attributes
   2986 	 * when connected, if the AP support MBO.
   2987 	 */
   2988 
   2989 	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid ||
   2990 	    !wpa_s->current_bss ||
   2991 	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
   2992 		return;
   2993 
   2994 	os_memset(&params, 0, sizeof(params));
   2995 	wpa_ie = wpas_populate_assoc_ies(wpa_s, wpa_s->current_bss,
   2996 					 wpa_s->current_ssid, &params, NULL);
   2997 	if (!wpa_ie)
   2998 		return;
   2999 
   3000 	wpa_drv_update_connect_params(wpa_s, &params, WPA_DRV_UPDATE_ASSOC_IES);
   3001 	os_free(wpa_ie);
   3002 }
   3003 #endif /* CONFIG_MBO */
   3004 
   3005 
   3006 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
   3007 {
   3008 	struct wpa_connect_work *cwork = work->ctx;
   3009 	struct wpa_bss *bss = cwork->bss;
   3010 	struct wpa_ssid *ssid = cwork->ssid;
   3011 	struct wpa_supplicant *wpa_s = work->wpa_s;
   3012 	u8 *wpa_ie;
   3013 	int use_crypt, ret, i, bssid_changed;
   3014 	unsigned int cipher_pairwise, cipher_group, cipher_group_mgmt;
   3015 	struct wpa_driver_associate_params params;
   3016 	int wep_keys_set = 0;
   3017 	int assoc_failed = 0;
   3018 	struct wpa_ssid *old_ssid;
   3019 	u8 prev_bssid[ETH_ALEN];
   3020 #ifdef CONFIG_HT_OVERRIDES
   3021 	struct ieee80211_ht_capabilities htcaps;
   3022 	struct ieee80211_ht_capabilities htcaps_mask;
   3023 #endif /* CONFIG_HT_OVERRIDES */
   3024 #ifdef CONFIG_VHT_OVERRIDES
   3025        struct ieee80211_vht_capabilities vhtcaps;
   3026        struct ieee80211_vht_capabilities vhtcaps_mask;
   3027 #endif /* CONFIG_VHT_OVERRIDES */
   3028 
   3029 	if (deinit) {
   3030 		if (work->started) {
   3031 			wpa_s->connect_work = NULL;
   3032 
   3033 			/* cancel possible auth. timeout */
   3034 			eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
   3035 					     NULL);
   3036 		}
   3037 		wpas_connect_work_free(cwork);
   3038 		return;
   3039 	}
   3040 
   3041 	wpa_s->connect_work = work;
   3042 
   3043 	if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
   3044 	    wpas_network_disabled(wpa_s, ssid)) {
   3045 		wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
   3046 		wpas_connect_work_done(wpa_s);
   3047 		return;
   3048 	}
   3049 
   3050 	os_memcpy(prev_bssid, wpa_s->bssid, ETH_ALEN);
   3051 	os_memset(&params, 0, sizeof(params));
   3052 	wpa_s->reassociate = 0;
   3053 	wpa_s->eap_expected_failure = 0;
   3054 	if (bss &&
   3055 	    (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
   3056 #ifdef CONFIG_IEEE80211R
   3057 		const u8 *ie, *md = NULL;
   3058 #endif /* CONFIG_IEEE80211R */
   3059 		wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
   3060 			" (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
   3061 			wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
   3062 		bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
   3063 		os_memset(wpa_s->bssid, 0, ETH_ALEN);
   3064 		os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
   3065 		if (bssid_changed)
   3066 			wpas_notify_bssid_changed(wpa_s);
   3067 #ifdef CONFIG_IEEE80211R
   3068 		ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
   3069 		if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
   3070 			md = ie + 2;
   3071 		wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
   3072 		if (md) {
   3073 			/* Prepare for the next transition */
   3074 			wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
   3075 		}
   3076 #endif /* CONFIG_IEEE80211R */
   3077 #ifdef CONFIG_WPS
   3078 	} else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
   3079 		   wpa_s->conf->ap_scan == 2 &&
   3080 		   (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
   3081 		/* Use ap_scan==1 style network selection to find the network
   3082 		 */
   3083 		wpas_connect_work_done(wpa_s);
   3084 		wpa_s->scan_req = MANUAL_SCAN_REQ;
   3085 		wpa_s->reassociate = 1;
   3086 		wpa_supplicant_req_scan(wpa_s, 0, 0);
   3087 		return;
   3088 #endif /* CONFIG_WPS */
   3089 	} else {
   3090 		wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
   3091 			wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
   3092 		if (bss)
   3093 			os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
   3094 		else
   3095 			os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
   3096 	}
   3097 	if (!wpa_s->pno)
   3098 		wpa_supplicant_cancel_sched_scan(wpa_s);
   3099 
   3100 	wpa_supplicant_cancel_scan(wpa_s);
   3101 
   3102 	/* Starting new association, so clear the possibly used WPA IE from the
   3103 	 * previous association. */
   3104 	wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
   3105 
   3106 	wpa_ie = wpas_populate_assoc_ies(wpa_s, bss, ssid, &params, NULL);
   3107 	if (!wpa_ie) {
   3108 		wpas_connect_work_done(wpa_s);
   3109 		return;
   3110 	}
   3111 
   3112 	wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
   3113 	use_crypt = 1;
   3114 	cipher_pairwise = wpa_s->pairwise_cipher;
   3115 	cipher_group = wpa_s->group_cipher;
   3116 	cipher_group_mgmt = wpa_s->mgmt_group_cipher;
   3117 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
   3118 	    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
   3119 		if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
   3120 			use_crypt = 0;
   3121 		if (wpa_set_wep_keys(wpa_s, ssid)) {
   3122 			use_crypt = 1;
   3123 			wep_keys_set = 1;
   3124 		}
   3125 	}
   3126 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
   3127 		use_crypt = 0;
   3128 
   3129 #ifdef IEEE8021X_EAPOL
   3130 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
   3131 		if ((ssid->eapol_flags &
   3132 		     (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
   3133 		      EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
   3134 		    !wep_keys_set) {
   3135 			use_crypt = 0;
   3136 		} else {
   3137 			/* Assume that dynamic WEP-104 keys will be used and
   3138 			 * set cipher suites in order for drivers to expect
   3139 			 * encryption. */
   3140 			cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
   3141 		}
   3142 	}
   3143 #endif /* IEEE8021X_EAPOL */
   3144 
   3145 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
   3146 		/* Set the key before (and later after) association */
   3147 		wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
   3148 	}
   3149 
   3150 	wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
   3151 	if (bss) {
   3152 		params.ssid = bss->ssid;
   3153 		params.ssid_len = bss->ssid_len;
   3154 		if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set ||
   3155 		    wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
   3156 			wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
   3157 				   MACSTR " freq=%u MHz based on scan results "
   3158 				   "(bssid_set=%d wps=%d)",
   3159 				   MAC2STR(bss->bssid), bss->freq,
   3160 				   ssid->bssid_set,
   3161 				   wpa_s->key_mgmt == WPA_KEY_MGMT_WPS);
   3162 			params.bssid = bss->bssid;
   3163 			params.freq.freq = bss->freq;
   3164 		}
   3165 		params.bssid_hint = bss->bssid;
   3166 		params.freq_hint = bss->freq;
   3167 		params.pbss = bss_is_pbss(bss);
   3168 	} else {
   3169 		if (ssid->bssid_hint_set)
   3170 			params.bssid_hint = ssid->bssid_hint;
   3171 
   3172 		params.ssid = ssid->ssid;
   3173 		params.ssid_len = ssid->ssid_len;
   3174 		params.pbss = (ssid->pbss != 2) ? ssid->pbss : 0;
   3175 	}
   3176 
   3177 	if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
   3178 	    wpa_s->conf->ap_scan == 2) {
   3179 		params.bssid = ssid->bssid;
   3180 		params.fixed_bssid = 1;
   3181 	}
   3182 
   3183 	/* Initial frequency for IBSS/mesh */
   3184 	if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
   3185 	    ssid->frequency > 0 && params.freq.freq == 0)
   3186 		ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
   3187 
   3188 	if (ssid->mode == WPAS_MODE_IBSS) {
   3189 		params.fixed_freq = ssid->fixed_freq;
   3190 		if (ssid->beacon_int)
   3191 			params.beacon_int = ssid->beacon_int;
   3192 		else
   3193 			params.beacon_int = wpa_s->conf->beacon_int;
   3194 	}
   3195 
   3196 	params.pairwise_suite = cipher_pairwise;
   3197 	params.group_suite = cipher_group;
   3198 	params.mgmt_group_suite = cipher_group_mgmt;
   3199 	params.key_mgmt_suite = wpa_s->key_mgmt;
   3200 	params.wpa_proto = wpa_s->wpa_proto;
   3201 	wpa_s->auth_alg = params.auth_alg;
   3202 	params.mode = ssid->mode;
   3203 	params.bg_scan_period = ssid->bg_scan_period;
   3204 	for (i = 0; i < NUM_WEP_KEYS; i++) {
   3205 		if (ssid->wep_key_len[i])
   3206 			params.wep_key[i] = ssid->wep_key[i];
   3207 		params.wep_key_len[i] = ssid->wep_key_len[i];
   3208 	}
   3209 	params.wep_tx_keyidx = ssid->wep_tx_keyidx;
   3210 
   3211 	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
   3212 	    (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
   3213 	     params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
   3214 		params.passphrase = ssid->passphrase;
   3215 		if (ssid->psk_set)
   3216 			params.psk = ssid->psk;
   3217 	}
   3218 
   3219 	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
   3220 	    (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
   3221 	     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
   3222 	     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
   3223 	     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192))
   3224 		params.req_key_mgmt_offload = 1;
   3225 
   3226 	if (wpa_s->conf->key_mgmt_offload) {
   3227 		if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
   3228 		    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
   3229 		    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
   3230 		    params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
   3231 			params.req_key_mgmt_offload =
   3232 				ssid->proactive_key_caching < 0 ?
   3233 				wpa_s->conf->okc : ssid->proactive_key_caching;
   3234 		else
   3235 			params.req_key_mgmt_offload = 1;
   3236 
   3237 		if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
   3238 		     params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
   3239 		     params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
   3240 		    ssid->psk_set)
   3241 			params.psk = ssid->psk;
   3242 	}
   3243 
   3244 	params.drop_unencrypted = use_crypt;
   3245 
   3246 #ifdef CONFIG_IEEE80211W
   3247 	params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
   3248 	if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
   3249 		const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
   3250 		struct wpa_ie_data ie;
   3251 		if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
   3252 		    ie.capabilities &
   3253 		    (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
   3254 			wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
   3255 				"MFP: require MFP");
   3256 			params.mgmt_frame_protection =
   3257 				MGMT_FRAME_PROTECTION_REQUIRED;
   3258 #ifdef CONFIG_OWE
   3259 		} else if (!rsn && (ssid->key_mgmt & WPA_KEY_MGMT_OWE) &&
   3260 			   !ssid->owe_only) {
   3261 			params.mgmt_frame_protection = NO_MGMT_FRAME_PROTECTION;
   3262 #endif /* CONFIG_OWE */
   3263 		}
   3264 	}
   3265 #endif /* CONFIG_IEEE80211W */
   3266 
   3267 	params.p2p = ssid->p2p_group;
   3268 
   3269 	if (wpa_s->p2pdev->set_sta_uapsd)
   3270 		params.uapsd = wpa_s->p2pdev->sta_uapsd;
   3271 	else
   3272 		params.uapsd = -1;
   3273 
   3274 #ifdef CONFIG_HT_OVERRIDES
   3275 	os_memset(&htcaps, 0, sizeof(htcaps));
   3276 	os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
   3277 	params.htcaps = (u8 *) &htcaps;
   3278 	params.htcaps_mask = (u8 *) &htcaps_mask;
   3279 	wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
   3280 #endif /* CONFIG_HT_OVERRIDES */
   3281 #ifdef CONFIG_VHT_OVERRIDES
   3282 	os_memset(&vhtcaps, 0, sizeof(vhtcaps));
   3283 	os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
   3284 	params.vhtcaps = &vhtcaps;
   3285 	params.vhtcaps_mask = &vhtcaps_mask;
   3286 	wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
   3287 #endif /* CONFIG_VHT_OVERRIDES */
   3288 
   3289 #ifdef CONFIG_P2P
   3290 	/*
   3291 	 * If multi-channel concurrency is not supported, check for any
   3292 	 * frequency conflict. In case of any frequency conflict, remove the
   3293 	 * least prioritized connection.
   3294 	 */
   3295 	if (wpa_s->num_multichan_concurrent < 2) {
   3296 		int freq, num;
   3297 		num = get_shared_radio_freqs(wpa_s, &freq, 1);
   3298 		if (num > 0 && freq > 0 && freq != params.freq.freq) {
   3299 			wpa_printf(MSG_DEBUG,
   3300 				   "Assoc conflicting freq found (%d != %d)",
   3301 				   freq, params.freq.freq);
   3302 			if (wpas_p2p_handle_frequency_conflicts(
   3303 				    wpa_s, params.freq.freq, ssid) < 0) {
   3304 				wpas_connect_work_done(wpa_s);
   3305 				os_free(wpa_ie);
   3306 				return;
   3307 			}
   3308 		}
   3309 	}
   3310 #endif /* CONFIG_P2P */
   3311 
   3312 	if (wpa_s->reassoc_same_ess && !is_zero_ether_addr(prev_bssid) &&
   3313 	    wpa_s->current_ssid)
   3314 		params.prev_bssid = prev_bssid;
   3315 
   3316 	ret = wpa_drv_associate(wpa_s, &params);
   3317 	os_free(wpa_ie);
   3318 	if (ret < 0) {
   3319 		wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
   3320 			"failed");
   3321 		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
   3322 			/*
   3323 			 * The driver is known to mean what is saying, so we
   3324 			 * can stop right here; the association will not
   3325 			 * succeed.
   3326 			 */
   3327 			wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
   3328 			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
   3329 			os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
   3330 			return;
   3331 		}
   3332 		/* try to continue anyway; new association will be tried again
   3333 		 * after timeout */
   3334 		assoc_failed = 1;
   3335 	}
   3336 
   3337 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
   3338 		/* Set the key after the association just in case association
   3339 		 * cleared the previously configured key. */
   3340 		wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
   3341 		/* No need to timeout authentication since there is no key
   3342 		 * management. */
   3343 		wpa_supplicant_cancel_auth_timeout(wpa_s);
   3344 		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
   3345 #ifdef CONFIG_IBSS_RSN
   3346 	} else if (ssid->mode == WPAS_MODE_IBSS &&
   3347 		   wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
   3348 		   wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
   3349 		/*
   3350 		 * RSN IBSS authentication is per-STA and we can disable the
   3351 		 * per-BSSID authentication.
   3352 		 */
   3353 		wpa_supplicant_cancel_auth_timeout(wpa_s);
   3354 #endif /* CONFIG_IBSS_RSN */
   3355 	} else {
   3356 		/* Timeout for IEEE 802.11 authentication and association */
   3357 		int timeout = 60;
   3358 
   3359 		if (assoc_failed) {
   3360 			/* give IBSS a bit more time */
   3361 			timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
   3362 		} else if (wpa_s->conf->ap_scan == 1) {
   3363 			/* give IBSS a bit more time */
   3364 			timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
   3365 		}
   3366 		wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
   3367 	}
   3368 
   3369 	if (wep_keys_set &&
   3370 	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
   3371 		/* Set static WEP keys again */
   3372 		wpa_set_wep_keys(wpa_s, ssid);
   3373 	}
   3374 
   3375 	if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
   3376 		/*
   3377 		 * Do not allow EAP session resumption between different
   3378 		 * network configurations.
   3379 		 */
   3380 		eapol_sm_invalidate_cached_session(wpa_s->eapol);
   3381 	}
   3382 	old_ssid = wpa_s->current_ssid;
   3383 	wpa_s->current_ssid = ssid;
   3384 
   3385 	if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
   3386 		wpa_s->current_bss = bss;
   3387 #ifdef CONFIG_HS20
   3388 		hs20_configure_frame_filters(wpa_s);
   3389 #endif /* CONFIG_HS20 */
   3390 	}
   3391 
   3392 	wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
   3393 	wpa_supplicant_initiate_eapol(wpa_s);
   3394 	if (old_ssid != wpa_s->current_ssid)
   3395 		wpas_notify_network_changed(wpa_s);
   3396 }
   3397 
   3398 
   3399 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
   3400 					    const u8 *addr)
   3401 {
   3402 	struct wpa_ssid *old_ssid;
   3403 
   3404 	wpas_connect_work_done(wpa_s);
   3405 	wpa_clear_keys(wpa_s, addr);
   3406 	old_ssid = wpa_s->current_ssid;
   3407 	wpa_supplicant_mark_disassoc(wpa_s);
   3408 	wpa_sm_set_config(wpa_s->wpa, NULL);
   3409 	eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
   3410 	if (old_ssid != wpa_s->current_ssid)
   3411 		wpas_notify_network_changed(wpa_s);
   3412 	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
   3413 }
   3414 
   3415 
   3416 /**
   3417  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
   3418  * @wpa_s: Pointer to wpa_supplicant data
   3419  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
   3420  *
   3421  * This function is used to request %wpa_supplicant to deauthenticate from the
   3422  * current AP.
   3423  */
   3424 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
   3425 				   int reason_code)
   3426 {
   3427 	u8 *addr = NULL;
   3428 	union wpa_event_data event;
   3429 	int zero_addr = 0;
   3430 
   3431 	wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
   3432 		" pending_bssid=" MACSTR " reason=%d state=%s",
   3433 		MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
   3434 		reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
   3435 
   3436 	if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
   3437 	    (wpa_s->wpa_state == WPA_AUTHENTICATING ||
   3438 	     wpa_s->wpa_state == WPA_ASSOCIATING))
   3439 		addr = wpa_s->pending_bssid;
   3440 	else if (!is_zero_ether_addr(wpa_s->bssid))
   3441 		addr = wpa_s->bssid;
   3442 	else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
   3443 		/*
   3444 		 * When using driver-based BSS selection, we may not know the
   3445 		 * BSSID with which we are currently trying to associate. We
   3446 		 * need to notify the driver of this disconnection even in such
   3447 		 * a case, so use the all zeros address here.
   3448 		 */
   3449 		addr = wpa_s->bssid;
   3450 		zero_addr = 1;
   3451 	}
   3452 
   3453 	if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0)
   3454 		wpa_s->enabled_4addr_mode = 0;
   3455 
   3456 #ifdef CONFIG_TDLS
   3457 	wpa_tdls_teardown_peers(wpa_s->wpa);
   3458 #endif /* CONFIG_TDLS */
   3459 
   3460 #ifdef CONFIG_MESH
   3461 	if (wpa_s->ifmsh) {
   3462 		struct mesh_conf *mconf;
   3463 
   3464 		mconf = wpa_s->ifmsh->mconf;
   3465 		wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
   3466 			wpa_s->ifname);
   3467 		wpas_notify_mesh_group_removed(wpa_s, mconf->meshid,
   3468 					       mconf->meshid_len, reason_code);
   3469 		wpa_supplicant_leave_mesh(wpa_s);
   3470 	}
   3471 #endif /* CONFIG_MESH */
   3472 
   3473 	if (addr) {
   3474 		wpa_drv_deauthenticate(wpa_s, addr, reason_code);
   3475 		os_memset(&event, 0, sizeof(event));
   3476 		event.deauth_info.reason_code = (u16) reason_code;
   3477 		event.deauth_info.locally_generated = 1;
   3478 		wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
   3479 		if (zero_addr)
   3480 			addr = NULL;
   3481 	}
   3482 
   3483 	wpa_supplicant_clear_connection(wpa_s, addr);
   3484 }
   3485 
   3486 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
   3487 					      struct wpa_ssid *ssid)
   3488 {
   3489 	if (!ssid || !ssid->disabled || ssid->disabled == 2)
   3490 		return;
   3491 
   3492 	ssid->disabled = 0;
   3493 	ssid->owe_transition_bss_select_count = 0;
   3494 	wpas_clear_temp_disabled(wpa_s, ssid, 1);
   3495 	wpas_notify_network_enabled_changed(wpa_s, ssid);
   3496 
   3497 	/*
   3498 	 * Try to reassociate since there is no current configuration and a new
   3499 	 * network was made available.
   3500 	 */
   3501 	if (!wpa_s->current_ssid && !wpa_s->disconnected)
   3502 		wpa_s->reassociate = 1;
   3503 }
   3504 
   3505 
   3506 /**
   3507  * wpa_supplicant_add_network - Add a new network
   3508  * @wpa_s: wpa_supplicant structure for a network interface
   3509  * Returns: The new network configuration or %NULL if operation failed
   3510  *
   3511  * This function performs the following operations:
   3512  * 1. Adds a new network.
   3513  * 2. Send network addition notification.
   3514  * 3. Marks the network disabled.
   3515  * 4. Set network default parameters.
   3516  */
   3517 struct wpa_ssid * wpa_supplicant_add_network(struct wpa_supplicant *wpa_s)
   3518 {
   3519 	struct wpa_ssid *ssid;
   3520 
   3521 	ssid = wpa_config_add_network(wpa_s->conf);
   3522 	if (!ssid)
   3523 		return NULL;
   3524 	wpas_notify_network_added(wpa_s, ssid);
   3525 	ssid->disabled = 1;
   3526 	wpa_config_set_network_defaults(ssid);
   3527 
   3528 	return ssid;
   3529 }
   3530 
   3531 
   3532 /**
   3533  * wpa_supplicant_remove_network - Remove a configured network based on id
   3534  * @wpa_s: wpa_supplicant structure for a network interface
   3535  * @id: Unique network id to search for
   3536  * Returns: 0 on success, or -1 if the network was not found, -2 if the network
   3537  * could not be removed
   3538  *
   3539  * This function performs the following operations:
   3540  * 1. Removes the network.
   3541  * 2. Send network removal notification.
   3542  * 3. Update internal state machines.
   3543  * 4. Stop any running sched scans.
   3544  */
   3545 int wpa_supplicant_remove_network(struct wpa_supplicant *wpa_s, int id)
   3546 {
   3547 	struct wpa_ssid *ssid;
   3548 	int was_disabled;
   3549 
   3550 	ssid = wpa_config_get_network(wpa_s->conf, id);
   3551 	if (!ssid)
   3552 		return -1;
   3553 	wpas_notify_network_removed(wpa_s, ssid);
   3554 
   3555 	if (wpa_s->last_ssid == ssid)
   3556 		wpa_s->last_ssid = NULL;
   3557 
   3558 	if (ssid == wpa_s->current_ssid || !wpa_s->current_ssid) {
   3559 #ifdef CONFIG_SME
   3560 		wpa_s->sme.prev_bssid_set = 0;
   3561 #endif /* CONFIG_SME */
   3562 		/*
   3563 		 * Invalidate the EAP session cache if the current or
   3564 		 * previously used network is removed.
   3565 		 */
   3566 		eapol_sm_invalidate_cached_session(wpa_s->eapol);
   3567 	}
   3568 
   3569 	if (ssid == wpa_s->current_ssid) {
   3570 		wpa_sm_set_config(wpa_s->wpa, NULL);
   3571 		eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
   3572 
   3573 		if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
   3574 			wpa_s->own_disconnect_req = 1;
   3575 		wpa_supplicant_deauthenticate(wpa_s,
   3576 					      WLAN_REASON_DEAUTH_LEAVING);
   3577 	}
   3578 
   3579 	was_disabled = ssid->disabled;
   3580 
   3581 	if (wpa_config_remove_network(wpa_s->conf, id) < 0)
   3582 		return -2;
   3583 
   3584 	if (!was_disabled && wpa_s->sched_scanning) {
   3585 		wpa_printf(MSG_DEBUG,
   3586 			   "Stop ongoing sched_scan to remove network from filters");
   3587 		wpa_supplicant_cancel_sched_scan(wpa_s);
   3588 		wpa_supplicant_req_scan(wpa_s, 0, 0);
   3589 	}
   3590 
   3591 	return 0;
   3592 }
   3593 
   3594 
   3595 /**
   3596  * wpa_supplicant_enable_network - Mark a configured network as enabled
   3597  * @wpa_s: wpa_supplicant structure for a network interface
   3598  * @ssid: wpa_ssid structure for a configured network or %NULL
   3599  *
   3600  * Enables the specified network or all networks if no network specified.
   3601  */
   3602 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
   3603 				   struct wpa_ssid *ssid)
   3604 {
   3605 	if (ssid == NULL) {
   3606 		for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
   3607 			wpa_supplicant_enable_one_network(wpa_s, ssid);
   3608 	} else
   3609 		wpa_supplicant_enable_one_network(wpa_s, ssid);
   3610 
   3611 	if (wpa_s->reassociate && !wpa_s->disconnected &&
   3612 	    (!wpa_s->current_ssid ||
   3613 	     wpa_s->wpa_state == WPA_DISCONNECTED ||
   3614 	     wpa_s->wpa_state == WPA_SCANNING)) {
   3615 		if (wpa_s->sched_scanning) {
   3616 			wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
   3617 				   "new network to scan filters");
   3618 			wpa_supplicant_cancel_sched_scan(wpa_s);
   3619 		}
   3620 
   3621 		if (wpa_supplicant_fast_associate(wpa_s) != 1) {
   3622 			wpa_s->scan_req = NORMAL_SCAN_REQ;
   3623 			wpa_supplicant_req_scan(wpa_s, 0, 0);
   3624 		}
   3625 	}
   3626 }
   3627 
   3628 
   3629 /**
   3630  * wpa_supplicant_disable_network - Mark a configured network as disabled
   3631  * @wpa_s: wpa_supplicant structure for a network interface
   3632  * @ssid: wpa_ssid structure for a configured network or %NULL
   3633  *
   3634  * Disables the specified network or all networks if no network specified.
   3635  */
   3636 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
   3637 				    struct wpa_ssid *ssid)
   3638 {
   3639 	struct wpa_ssid *other_ssid;
   3640 	int was_disabled;
   3641 
   3642 	if (ssid == NULL) {
   3643 		if (wpa_s->sched_scanning)
   3644 			wpa_supplicant_cancel_sched_scan(wpa_s);
   3645 
   3646 		for (other_ssid = wpa_s->conf->ssid; other_ssid;
   3647 		     other_ssid = other_ssid->next) {
   3648 			was_disabled = other_ssid->disabled;
   3649 			if (was_disabled == 2)
   3650 				continue; /* do not change persistent P2P group
   3651 					   * data */
   3652 
   3653 			other_ssid->disabled = 1;
   3654 
   3655 			if (was_disabled != other_ssid->disabled)
   3656 				wpas_notify_network_enabled_changed(
   3657 					wpa_s, other_ssid);
   3658 		}
   3659 		if (wpa_s->current_ssid) {
   3660 			if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
   3661 				wpa_s->own_disconnect_req = 1;
   3662 			wpa_supplicant_deauthenticate(
   3663 				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
   3664 		}
   3665 	} else if (ssid->disabled != 2) {
   3666 		if (ssid == wpa_s->current_ssid) {
   3667 			if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
   3668 				wpa_s->own_disconnect_req = 1;
   3669 			wpa_supplicant_deauthenticate(
   3670 				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
   3671 		}
   3672 
   3673 		was_disabled = ssid->disabled;
   3674 
   3675 		ssid->disabled = 1;
   3676 
   3677 		if (was_disabled != ssid->disabled) {
   3678 			wpas_notify_network_enabled_changed(wpa_s, ssid);
   3679 			if (wpa_s->sched_scanning) {
   3680 				wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
   3681 					   "to remove network from filters");
   3682 				wpa_supplicant_cancel_sched_scan(wpa_s);
   3683 				wpa_supplicant_req_scan(wpa_s, 0, 0);
   3684 			}
   3685 		}
   3686 	}
   3687 }
   3688 
   3689 
   3690 /**
   3691  * wpa_supplicant_select_network - Attempt association with a network
   3692  * @wpa_s: wpa_supplicant structure for a network interface
   3693  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
   3694  */
   3695 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
   3696 				   struct wpa_ssid *ssid)
   3697 {
   3698 
   3699 	struct wpa_ssid *other_ssid;
   3700 	int disconnected = 0;
   3701 
   3702 	if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
   3703 		if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
   3704 			wpa_s->own_disconnect_req = 1;
   3705 		wpa_supplicant_deauthenticate(
   3706 			wpa_s, WLAN_REASON_DEAUTH_LEAVING);
   3707 		disconnected = 1;
   3708 	}
   3709 
   3710 	if (ssid)
   3711 		wpas_clear_temp_disabled(wpa_s, ssid, 1);
   3712 
   3713 	/*
   3714 	 * Mark all other networks disabled or mark all networks enabled if no
   3715 	 * network specified.
   3716 	 */
   3717 	for (other_ssid = wpa_s->conf->ssid; other_ssid;
   3718 	     other_ssid = other_ssid->next) {
   3719 		int was_disabled = other_ssid->disabled;
   3720 		if (was_disabled == 2)
   3721 			continue; /* do not change persistent P2P group data */
   3722 
   3723 		other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
   3724 		if (was_disabled && !other_ssid->disabled)
   3725 			wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
   3726 
   3727 		if (was_disabled != other_ssid->disabled)
   3728 			wpas_notify_network_enabled_changed(wpa_s, other_ssid);
   3729 	}
   3730 
   3731 	if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
   3732 	    wpa_s->wpa_state >= WPA_AUTHENTICATING) {
   3733 		/* We are already associated with the selected network */
   3734 		wpa_printf(MSG_DEBUG, "Already associated with the "
   3735 			   "selected network - do nothing");
   3736 		return;
   3737 	}
   3738 
   3739 	if (ssid) {
   3740 		wpa_s->current_ssid = ssid;
   3741 		eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
   3742 		wpa_s->connect_without_scan =
   3743 			(ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
   3744 
   3745 		/*
   3746 		 * Don't optimize next scan freqs since a new ESS has been
   3747 		 * selected.
   3748 		 */
   3749 		os_free(wpa_s->next_scan_freqs);
   3750 		wpa_s->next_scan_freqs = NULL;
   3751 	} else {
   3752 		wpa_s->connect_without_scan = NULL;
   3753 	}
   3754 
   3755 	wpa_s->disconnected = 0;
   3756 	wpa_s->reassociate = 1;
   3757 	wpa_s->last_owe_group = 0;
   3758 	if (ssid)
   3759 		ssid->owe_transition_bss_select_count = 0;
   3760 
   3761 	if (wpa_s->connect_without_scan ||
   3762 	    wpa_supplicant_fast_associate(wpa_s) != 1) {
   3763 		wpa_s->scan_req = NORMAL_SCAN_REQ;
   3764 		wpas_scan_reset_sched_scan(wpa_s);
   3765 		wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
   3766 	}
   3767 
   3768 	if (ssid)
   3769 		wpas_notify_network_selected(wpa_s, ssid);
   3770 }
   3771 
   3772 
   3773 /**
   3774  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
   3775  * @wpa_s: wpa_supplicant structure for a network interface
   3776  * @pkcs11_engine_path: PKCS #11 engine path or NULL
   3777  * @pkcs11_module_path: PKCS #11 module path or NULL
   3778  * Returns: 0 on success; -1 on failure
   3779  *
   3780  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
   3781  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
   3782  * module path fails the paths will be reset to the default value (NULL).
   3783  */
   3784 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
   3785 					   const char *pkcs11_engine_path,
   3786 					   const char *pkcs11_module_path)
   3787 {
   3788 	char *pkcs11_engine_path_copy = NULL;
   3789 	char *pkcs11_module_path_copy = NULL;
   3790 
   3791 	if (pkcs11_engine_path != NULL) {
   3792 		pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
   3793 		if (pkcs11_engine_path_copy == NULL)
   3794 			return -1;
   3795 	}
   3796 	if (pkcs11_module_path != NULL) {
   3797 		pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
   3798 		if (pkcs11_module_path_copy == NULL) {
   3799 			os_free(pkcs11_engine_path_copy);
   3800 			return -1;
   3801 		}
   3802 	}
   3803 
   3804 	os_free(wpa_s->conf->pkcs11_engine_path);
   3805 	os_free(wpa_s->conf->pkcs11_module_path);
   3806 	wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
   3807 	wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
   3808 
   3809 	wpa_sm_set_eapol(wpa_s->wpa, NULL);
   3810 	eapol_sm_deinit(wpa_s->eapol);
   3811 	wpa_s->eapol = NULL;
   3812 	if (wpa_supplicant_init_eapol(wpa_s)) {
   3813 		/* Error -> Reset paths to the default value (NULL) once. */
   3814 		if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
   3815 			wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
   3816 							       NULL);
   3817 
   3818 		return -1;
   3819 	}
   3820 	wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
   3821 
   3822 	return 0;
   3823 }
   3824 
   3825 
   3826 /**
   3827  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
   3828  * @wpa_s: wpa_supplicant structure for a network interface
   3829  * @ap_scan: AP scan mode
   3830  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
   3831  *
   3832  */
   3833 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
   3834 {
   3835 
   3836 	int old_ap_scan;
   3837 
   3838 	if (ap_scan < 0 || ap_scan > 2)
   3839 		return -1;
   3840 
   3841 	if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
   3842 		wpa_printf(MSG_INFO,
   3843 			   "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
   3844 	}
   3845 
   3846 #ifdef ANDROID
   3847 	if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
   3848 	    wpa_s->wpa_state >= WPA_ASSOCIATING &&
   3849 	    wpa_s->wpa_state < WPA_COMPLETED) {
   3850 		wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
   3851 			   "associating", wpa_s->conf->ap_scan, ap_scan);
   3852 		return 0;
   3853 	}
   3854 #endif /* ANDROID */
   3855 
   3856 	old_ap_scan = wpa_s->conf->ap_scan;
   3857 	wpa_s->conf->ap_scan = ap_scan;
   3858 
   3859 	if (old_ap_scan != wpa_s->conf->ap_scan)
   3860 		wpas_notify_ap_scan_changed(wpa_s);
   3861 
   3862 	return 0;
   3863 }
   3864 
   3865 
   3866 /**
   3867  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
   3868  * @wpa_s: wpa_supplicant structure for a network interface
   3869  * @expire_age: Expiration age in seconds
   3870  * Returns: 0 if succeed or -1 if expire_age has an invalid value
   3871  *
   3872  */
   3873 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
   3874 					  unsigned int bss_expire_age)
   3875 {
   3876 	if (bss_expire_age < 10) {
   3877 		wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
   3878 			bss_expire_age);
   3879 		return -1;
   3880 	}
   3881 	wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
   3882 		bss_expire_age);
   3883 	wpa_s->conf->bss_expiration_age = bss_expire_age;
   3884 
   3885 	return 0;
   3886 }
   3887 
   3888 
   3889 /**
   3890  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
   3891  * @wpa_s: wpa_supplicant structure for a network interface
   3892  * @expire_count: number of scans after which an unseen BSS is reclaimed
   3893  * Returns: 0 if succeed or -1 if expire_count has an invalid value
   3894  *
   3895  */
   3896 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
   3897 					    unsigned int bss_expire_count)
   3898 {
   3899 	if (bss_expire_count < 1) {
   3900 		wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
   3901 			bss_expire_count);
   3902 		return -1;
   3903 	}
   3904 	wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
   3905 		bss_expire_count);
   3906 	wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
   3907 
   3908 	return 0;
   3909 }
   3910 
   3911 
   3912 /**
   3913  * wpa_supplicant_set_scan_interval - Set scan interval
   3914  * @wpa_s: wpa_supplicant structure for a network interface
   3915  * @scan_interval: scan interval in seconds
   3916  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
   3917  *
   3918  */
   3919 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
   3920 				     int scan_interval)
   3921 {
   3922 	if (scan_interval < 0) {
   3923 		wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
   3924 			scan_interval);
   3925 		return -1;
   3926 	}
   3927 	wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
   3928 		scan_interval);
   3929 	wpa_supplicant_update_scan_int(wpa_s, scan_interval);
   3930 
   3931 	return 0;
   3932 }
   3933 
   3934 
   3935 /**
   3936  * wpa_supplicant_set_debug_params - Set global debug params
   3937  * @global: wpa_global structure
   3938  * @debug_level: debug level
   3939  * @debug_timestamp: determines if show timestamp in debug data
   3940  * @debug_show_keys: determines if show keys in debug data
   3941  * Returns: 0 if succeed or -1 if debug_level has wrong value
   3942  */
   3943 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
   3944 				    int debug_timestamp, int debug_show_keys)
   3945 {
   3946 
   3947 	int old_level, old_timestamp, old_show_keys;
   3948 
   3949 	/* check for allowed debuglevels */
   3950 	if (debug_level != MSG_EXCESSIVE &&
   3951 	    debug_level != MSG_MSGDUMP &&
   3952 	    debug_level != MSG_DEBUG &&
   3953 	    debug_level != MSG_INFO &&
   3954 	    debug_level != MSG_WARNING &&
   3955 	    debug_level != MSG_ERROR)
   3956 		return -1;
   3957 
   3958 	old_level = wpa_debug_level;
   3959 	old_timestamp = wpa_debug_timestamp;
   3960 	old_show_keys = wpa_debug_show_keys;
   3961 
   3962 	wpa_debug_level = debug_level;
   3963 	wpa_debug_timestamp = debug_timestamp ? 1 : 0;
   3964 	wpa_debug_show_keys = debug_show_keys ? 1 : 0;
   3965 
   3966 	if (wpa_debug_level != old_level)
   3967 		wpas_notify_debug_level_changed(global);
   3968 	if (wpa_debug_timestamp != old_timestamp)
   3969 		wpas_notify_debug_timestamp_changed(global);
   3970 	if (wpa_debug_show_keys != old_show_keys)
   3971 		wpas_notify_debug_show_keys_changed(global);
   3972 
   3973 	return 0;
   3974 }
   3975 
   3976 
   3977 #ifdef CONFIG_OWE
   3978 static int owe_trans_ssid_match(struct wpa_supplicant *wpa_s, const u8 *bssid,
   3979 				const u8 *entry_ssid, size_t entry_ssid_len)
   3980 {
   3981 	const u8 *owe, *pos, *end;
   3982 	u8 ssid_len;
   3983 	struct wpa_bss *bss;
   3984 
   3985 	/* Check network profile SSID aganst the SSID in the
   3986 	 * OWE Transition Mode element. */
   3987 
   3988 	bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
   3989 	if (!bss)
   3990 		return 0;
   3991 
   3992 	owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
   3993 	if (!owe)
   3994 		return 0;
   3995 
   3996 	pos = owe + 6;
   3997 	end = owe + 2 + owe[1];
   3998 
   3999 	if (end - pos < ETH_ALEN + 1)
   4000 		return 0;
   4001 	pos += ETH_ALEN;
   4002 	ssid_len = *pos++;
   4003 	if (end - pos < ssid_len || ssid_len > SSID_MAX_LEN)
   4004 		return 0;
   4005 
   4006 	return entry_ssid_len == ssid_len &&
   4007 		os_memcmp(pos, entry_ssid, ssid_len) == 0;
   4008 }
   4009 #endif /* CONFIG_OWE */
   4010 
   4011 
   4012 /**
   4013  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
   4014  * @wpa_s: Pointer to wpa_supplicant data
   4015  * Returns: A pointer to the current network structure or %NULL on failure
   4016  */
   4017 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
   4018 {
   4019 	struct wpa_ssid *entry;
   4020 	u8 ssid[SSID_MAX_LEN];
   4021 	int res;
   4022 	size_t ssid_len;
   4023 	u8 bssid[ETH_ALEN];
   4024 	int wired;
   4025 
   4026 	res = wpa_drv_get_ssid(wpa_s, ssid);
   4027 	if (res < 0) {
   4028 		wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
   4029 			"driver");
   4030 		return NULL;
   4031 	}
   4032 	ssid_len = res;
   4033 
   4034 	if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
   4035 		wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
   4036 			"driver");
   4037 		return NULL;
   4038 	}
   4039 
   4040 	wired = wpa_s->conf->ap_scan == 0 &&
   4041 		(wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
   4042 
   4043 	entry = wpa_s->conf->ssid;
   4044 	while (entry) {
   4045 		if (!wpas_network_disabled(wpa_s, entry) &&
   4046 		    ((ssid_len == entry->ssid_len &&
   4047 		      (!entry->ssid ||
   4048 		       os_memcmp(ssid, entry->ssid, ssid_len) == 0)) ||
   4049 		     wired) &&
   4050 		    (!entry->bssid_set ||
   4051 		     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
   4052 			return entry;
   4053 #ifdef CONFIG_WPS
   4054 		if (!wpas_network_disabled(wpa_s, entry) &&
   4055 		    (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
   4056 		    (entry->ssid == NULL || entry->ssid_len == 0) &&
   4057 		    (!entry->bssid_set ||
   4058 		     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
   4059 			return entry;
   4060 #endif /* CONFIG_WPS */
   4061 
   4062 #ifdef CONFIG_OWE
   4063 		if (!wpas_network_disabled(wpa_s, entry) &&
   4064 		    owe_trans_ssid_match(wpa_s, bssid, entry->ssid,
   4065 		    entry->ssid_len) &&
   4066 		    (!entry->bssid_set ||
   4067 		     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
   4068 			return entry;
   4069 #endif /* CONFIG_OWE */
   4070 
   4071 		if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
   4072 		    entry->ssid_len == 0 &&
   4073 		    os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
   4074 			return entry;
   4075 
   4076 		entry = entry->next;
   4077 	}
   4078 
   4079 	return NULL;
   4080 }
   4081 
   4082 
   4083 static int select_driver(struct wpa_supplicant *wpa_s, int i)
   4084 {
   4085 	struct wpa_global *global = wpa_s->global;
   4086 
   4087 	if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
   4088 		global->drv_priv[i] = wpa_drivers[i]->global_init(global);
   4089 		if (global->drv_priv[i] == NULL) {
   4090 			wpa_printf(MSG_ERROR, "Failed to initialize driver "
   4091 				   "'%s'", wpa_drivers[i]->name);
   4092 			return -1;
   4093 		}
   4094 	}
   4095 
   4096 	wpa_s->driver = wpa_drivers[i];
   4097 	wpa_s->global_drv_priv = global->drv_priv[i];
   4098 
   4099 	return 0;
   4100 }
   4101 
   4102 
   4103 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
   4104 				     const char *name)
   4105 {
   4106 	int i;
   4107 	size_t len;
   4108 	const char *pos, *driver = name;
   4109 
   4110 	if (wpa_s == NULL)
   4111 		return -1;
   4112 
   4113 	if (wpa_drivers[0] == NULL) {
   4114 		wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
   4115 			"wpa_supplicant");
   4116 		return -1;
   4117 	}
   4118 
   4119 	if (name == NULL) {
   4120 		/* default to first driver in the list */
   4121 		return select_driver(wpa_s, 0);
   4122 	}
   4123 
   4124 	do {
   4125 		pos = os_strchr(driver, ',');
   4126 		if (pos)
   4127 			len = pos - driver;
   4128 		else
   4129 			len = os_strlen(driver);
   4130 
   4131 		for (i = 0; wpa_drivers[i]; i++) {
   4132 			if (os_strlen(wpa_drivers[i]->name) == len &&
   4133 			    os_strncmp(driver, wpa_drivers[i]->name, len) ==
   4134 			    0) {
   4135 				/* First driver that succeeds wins */
   4136 				if (select_driver(wpa_s, i) == 0)
   4137 					return 0;
   4138 			}
   4139 		}
   4140 
   4141 		driver = pos + 1;
   4142 	} while (pos);
   4143 
   4144 	wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
   4145 	return -1;
   4146 }
   4147 
   4148 
   4149 /**
   4150  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
   4151  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
   4152  *	with struct wpa_driver_ops::init()
   4153  * @src_addr: Source address of the EAPOL frame
   4154  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
   4155  * @len: Length of the EAPOL data
   4156  *
   4157  * This function is called for each received EAPOL frame. Most driver
   4158  * interfaces rely on more generic OS mechanism for receiving frames through
   4159  * l2_packet, but if such a mechanism is not available, the driver wrapper may
   4160  * take care of received EAPOL frames and deliver them to the core supplicant
   4161  * code by calling this function.
   4162  */
   4163 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
   4164 			     const u8 *buf, size_t len)
   4165 {
   4166 	struct wpa_supplicant *wpa_s = ctx;
   4167 
   4168 	wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
   4169 	wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
   4170 
   4171 #ifdef CONFIG_TESTING_OPTIONS
   4172 	if (wpa_s->ignore_auth_resp) {
   4173 		wpa_printf(MSG_INFO, "RX EAPOL - ignore_auth_resp active!");
   4174 		return;
   4175 	}
   4176 #endif /* CONFIG_TESTING_OPTIONS */
   4177 
   4178 	if (wpa_s->wpa_state < WPA_ASSOCIATED ||
   4179 	    (wpa_s->last_eapol_matches_bssid &&
   4180 #ifdef CONFIG_AP
   4181 	     !wpa_s->ap_iface &&
   4182 #endif /* CONFIG_AP */
   4183 	     os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
   4184 		/*
   4185 		 * There is possible race condition between receiving the
   4186 		 * association event and the EAPOL frame since they are coming
   4187 		 * through different paths from the driver. In order to avoid
   4188 		 * issues in trying to process the EAPOL frame before receiving
   4189 		 * association information, lets queue it for processing until
   4190 		 * the association event is received. This may also be needed in
   4191 		 * driver-based roaming case, so also use src_addr != BSSID as a
   4192 		 * trigger if we have previously confirmed that the
   4193 		 * Authenticator uses BSSID as the src_addr (which is not the
   4194 		 * case with wired IEEE 802.1X).
   4195 		 */
   4196 		wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
   4197 			"of received EAPOL frame (state=%s bssid=" MACSTR ")",
   4198 			wpa_supplicant_state_txt(wpa_s->wpa_state),
   4199 			MAC2STR(wpa_s->bssid));
   4200 		wpabuf_free(wpa_s->pending_eapol_rx);
   4201 		wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
   4202 		if (wpa_s->pending_eapol_rx) {
   4203 			os_get_reltime(&wpa_s->pending_eapol_rx_time);
   4204 			os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
   4205 				  ETH_ALEN);
   4206 		}
   4207 		return;
   4208 	}
   4209 
   4210 	wpa_s->last_eapol_matches_bssid =
   4211 		os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
   4212 
   4213 #ifdef CONFIG_AP
   4214 	if (wpa_s->ap_iface) {
   4215 		wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
   4216 		return;
   4217 	}
   4218 #endif /* CONFIG_AP */
   4219 
   4220 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
   4221 		wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
   4222 			"no key management is configured");
   4223 		return;
   4224 	}
   4225 
   4226 	if (wpa_s->eapol_received == 0 &&
   4227 	    (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) ||
   4228 	     !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
   4229 	     wpa_s->wpa_state != WPA_COMPLETED) &&
   4230 	    (wpa_s->current_ssid == NULL ||
   4231 	     wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
   4232 		/* Timeout for completing IEEE 802.1X and WPA authentication */
   4233 		int timeout = 10;
   4234 
   4235 		if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
   4236 		    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
   4237 		    wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
   4238 			/* Use longer timeout for IEEE 802.1X/EAP */
   4239 			timeout = 70;
   4240 		}
   4241 
   4242 #ifdef CONFIG_WPS
   4243 		if (wpa_s->current_ssid && wpa_s->current_bss &&
   4244 		    (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
   4245 		    eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
   4246 			/*
   4247 			 * Use shorter timeout if going through WPS AP iteration
   4248 			 * for PIN config method with an AP that does not
   4249 			 * advertise Selected Registrar.
   4250 			 */
   4251 			struct wpabuf *wps_ie;
   4252 
   4253 			wps_ie = wpa_bss_get_vendor_ie_multi(
   4254 				wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
   4255 			if (wps_ie &&
   4256 			    !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
   4257 				timeout = 10;
   4258 			wpabuf_free(wps_ie);
   4259 		}
   4260 #endif /* CONFIG_WPS */
   4261 
   4262 		wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
   4263 	}
   4264 	wpa_s->eapol_received++;
   4265 
   4266 	if (wpa_s->countermeasures) {
   4267 		wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
   4268 			"EAPOL packet");
   4269 		return;
   4270 	}
   4271 
   4272 #ifdef CONFIG_IBSS_RSN
   4273 	if (wpa_s->current_ssid &&
   4274 	    wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
   4275 		ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
   4276 		return;
   4277 	}
   4278 #endif /* CONFIG_IBSS_RSN */
   4279 
   4280 	/* Source address of the incoming EAPOL frame could be compared to the
   4281 	 * current BSSID. However, it is possible that a centralized
   4282 	 * Authenticator could be using another MAC address than the BSSID of
   4283 	 * an AP, so just allow any address to be used for now. The replies are
   4284 	 * still sent to the current BSSID (if available), though. */
   4285 
   4286 	os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
   4287 	if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
   4288 	    wpa_s->key_mgmt != WPA_KEY_MGMT_OWE &&
   4289 	    wpa_s->key_mgmt != WPA_KEY_MGMT_DPP &&
   4290 	    eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
   4291 		return;
   4292 	wpa_drv_poll(wpa_s);
   4293 	if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK))
   4294 		wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
   4295 	else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
   4296 		/*
   4297 		 * Set portValid = TRUE here since we are going to skip 4-way
   4298 		 * handshake processing which would normally set portValid. We
   4299 		 * need this to allow the EAPOL state machines to be completed
   4300 		 * without going through EAPOL-Key handshake.
   4301 		 */
   4302 		eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
   4303 	}
   4304 }
   4305 
   4306 
   4307 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
   4308 {
   4309 	if ((!wpa_s->p2p_mgmt ||
   4310 	     !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
   4311 	    !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
   4312 		l2_packet_deinit(wpa_s->l2);
   4313 		wpa_s->l2 = l2_packet_init(wpa_s->ifname,
   4314 					   wpa_drv_get_mac_addr(wpa_s),
   4315 					   ETH_P_EAPOL,
   4316 					   wpa_supplicant_rx_eapol, wpa_s, 0);
   4317 		if (wpa_s->l2 == NULL)
   4318 			return -1;
   4319 
   4320 		if (l2_packet_set_packet_filter(wpa_s->l2,
   4321 						L2_PACKET_FILTER_PKTTYPE))
   4322 			wpa_dbg(wpa_s, MSG_DEBUG,
   4323 				"Failed to attach pkt_type filter");
   4324 	} else {
   4325 		const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
   4326 		if (addr)
   4327 			os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
   4328 	}
   4329 
   4330 	if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
   4331 		wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
   4332 		return -1;
   4333 	}
   4334 
   4335 	wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
   4336 
   4337 	return 0;
   4338 }
   4339 
   4340 
   4341 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
   4342 					   const u8 *buf, size_t len)
   4343 {
   4344 	struct wpa_supplicant *wpa_s = ctx;
   4345 	const struct l2_ethhdr *eth;
   4346 
   4347 	if (len < sizeof(*eth))
   4348 		return;
   4349 	eth = (const struct l2_ethhdr *) buf;
   4350 
   4351 	if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
   4352 	    !(eth->h_dest[0] & 0x01)) {
   4353 		wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
   4354 			" (bridge - not for this interface - ignore)",
   4355 			MAC2STR(src_addr), MAC2STR(eth->h_dest));
   4356 		return;
   4357 	}
   4358 
   4359 	wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
   4360 		" (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
   4361 	wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
   4362 				len - sizeof(*eth));
   4363 }
   4364 
   4365 
   4366 /**
   4367  * wpa_supplicant_driver_init - Initialize driver interface parameters
   4368  * @wpa_s: Pointer to wpa_supplicant data
   4369  * Returns: 0 on success, -1 on failure
   4370  *
   4371  * This function is called to initialize driver interface parameters.
   4372  * wpa_drv_init() must have been called before this function to initialize the
   4373  * driver interface.
   4374  */
   4375 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
   4376 {
   4377 	static int interface_count = 0;
   4378 
   4379 	if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
   4380 		return -1;
   4381 
   4382 	wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
   4383 		MAC2STR(wpa_s->own_addr));
   4384 	os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
   4385 	wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
   4386 
   4387 	if (wpa_s->bridge_ifname[0]) {
   4388 		wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
   4389 			"interface '%s'", wpa_s->bridge_ifname);
   4390 		wpa_s->l2_br = l2_packet_init_bridge(
   4391 			wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
   4392 			ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
   4393 		if (wpa_s->l2_br == NULL) {
   4394 			wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
   4395 				"connection for the bridge interface '%s'",
   4396 				wpa_s->bridge_ifname);
   4397 			return -1;
   4398 		}
   4399 	}
   4400 
   4401 	if (wpa_s->conf->ap_scan == 2 &&
   4402 	    os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
   4403 		wpa_printf(MSG_INFO,
   4404 			   "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
   4405 	}
   4406 
   4407 	wpa_clear_keys(wpa_s, NULL);
   4408 
   4409 	/* Make sure that TKIP countermeasures are not left enabled (could
   4410 	 * happen if wpa_supplicant is killed during countermeasures. */
   4411 	wpa_drv_set_countermeasures(wpa_s, 0);
   4412 
   4413 	wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
   4414 	wpa_drv_flush_pmkid(wpa_s);
   4415 
   4416 	wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
   4417 	wpa_s->prev_scan_wildcard = 0;
   4418 
   4419 	if (wpa_supplicant_enabled_networks(wpa_s)) {
   4420 		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
   4421 			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
   4422 			interface_count = 0;
   4423 		}
   4424 #ifndef ANDROID
   4425 		if (!wpa_s->p2p_mgmt &&
   4426 		    wpa_supplicant_delayed_sched_scan(wpa_s,
   4427 						      interface_count % 3,
   4428 						      100000))
   4429 			wpa_supplicant_req_scan(wpa_s, interface_count % 3,
   4430 						100000);
   4431 #endif /* ANDROID */
   4432 		interface_count++;
   4433 	} else
   4434 		wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
   4435 
   4436 	return 0;
   4437 }
   4438 
   4439 
   4440 static int wpa_supplicant_daemon(const char *pid_file)
   4441 {
   4442 	wpa_printf(MSG_DEBUG, "Daemonize..");
   4443 	return os_daemonize(pid_file);
   4444 }
   4445 
   4446 
   4447 static struct wpa_supplicant *
   4448 wpa_supplicant_alloc(struct wpa_supplicant *parent)
   4449 {
   4450 	struct wpa_supplicant *wpa_s;
   4451 
   4452 	wpa_s = os_zalloc(sizeof(*wpa_s));
   4453 	if (wpa_s == NULL)
   4454 		return NULL;
   4455 	wpa_s->scan_req = INITIAL_SCAN_REQ;
   4456 	wpa_s->scan_interval = 5;
   4457 	wpa_s->new_connection = 1;
   4458 	wpa_s->parent = parent ? parent : wpa_s;
   4459 	wpa_s->p2pdev = wpa_s->parent;
   4460 	wpa_s->sched_scanning = 0;
   4461 
   4462 	dl_list_init(&wpa_s->bss_tmp_disallowed);
   4463 	dl_list_init(&wpa_s->fils_hlp_req);
   4464 
   4465 	return wpa_s;
   4466 }
   4467 
   4468 
   4469 #ifdef CONFIG_HT_OVERRIDES
   4470 
   4471 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
   4472 			     struct ieee80211_ht_capabilities *htcaps,
   4473 			     struct ieee80211_ht_capabilities *htcaps_mask,
   4474 			     const char *ht_mcs)
   4475 {
   4476 	/* parse ht_mcs into hex array */
   4477 	int i;
   4478 	const char *tmp = ht_mcs;
   4479 	char *end = NULL;
   4480 
   4481 	/* If ht_mcs is null, do not set anything */
   4482 	if (!ht_mcs)
   4483 		return 0;
   4484 
   4485 	/* This is what we are setting in the kernel */
   4486 	os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
   4487 
   4488 	wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
   4489 
   4490 	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
   4491 		long v;
   4492 
   4493 		errno = 0;
   4494 		v = strtol(tmp, &end, 16);
   4495 
   4496 		if (errno == 0) {
   4497 			wpa_msg(wpa_s, MSG_DEBUG,
   4498 				"htcap value[%i]: %ld end: %p  tmp: %p",
   4499 				i, v, end, tmp);
   4500 			if (end == tmp)
   4501 				break;
   4502 
   4503 			htcaps->supported_mcs_set[i] = v;
   4504 			tmp = end;
   4505 		} else {
   4506 			wpa_msg(wpa_s, MSG_ERROR,
   4507 				"Failed to parse ht-mcs: %s, error: %s\n",
   4508 				ht_mcs, strerror(errno));
   4509 			return -1;
   4510 		}
   4511 	}
   4512 
   4513 	/*
   4514 	 * If we were able to parse any values, then set mask for the MCS set.
   4515 	 */
   4516 	if (i) {
   4517 		os_memset(&htcaps_mask->supported_mcs_set, 0xff,
   4518 			  IEEE80211_HT_MCS_MASK_LEN - 1);
   4519 		/* skip the 3 reserved bits */
   4520 		htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
   4521 			0x1f;
   4522 	}
   4523 
   4524 	return 0;
   4525 }
   4526 
   4527 
   4528 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
   4529 				 struct ieee80211_ht_capabilities *htcaps,
   4530 				 struct ieee80211_ht_capabilities *htcaps_mask,
   4531 				 int disabled)
   4532 {
   4533 	le16 msk;
   4534 
   4535 	if (disabled == -1)
   4536 		return 0;
   4537 
   4538 	wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
   4539 
   4540 	msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
   4541 	htcaps_mask->ht_capabilities_info |= msk;
   4542 	if (disabled)
   4543 		htcaps->ht_capabilities_info &= msk;
   4544 	else
   4545 		htcaps->ht_capabilities_info |= msk;
   4546 
   4547 	return 0;
   4548 }
   4549 
   4550 
   4551 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
   4552 				struct ieee80211_ht_capabilities *htcaps,
   4553 				struct ieee80211_ht_capabilities *htcaps_mask,
   4554 				int factor)
   4555 {
   4556 	if (factor == -1)
   4557 		return 0;
   4558 
   4559 	wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
   4560 
   4561 	if (factor < 0 || factor > 3) {
   4562 		wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
   4563 			"Must be 0-3 or -1", factor);
   4564 		return -EINVAL;
   4565 	}
   4566 
   4567 	htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
   4568 	htcaps->a_mpdu_params &= ~0x3;
   4569 	htcaps->a_mpdu_params |= factor & 0x3;
   4570 
   4571 	return 0;
   4572 }
   4573 
   4574 
   4575 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
   4576 				 struct ieee80211_ht_capabilities *htcaps,
   4577 				 struct ieee80211_ht_capabilities *htcaps_mask,
   4578 				 int density)
   4579 {
   4580 	if (density == -1)
   4581 		return 0;
   4582 
   4583 	wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
   4584 
   4585 	if (density < 0 || density > 7) {
   4586 		wpa_msg(wpa_s, MSG_ERROR,
   4587 			"ampdu_density: %d out of range. Must be 0-7 or -1.",
   4588 			density);
   4589 		return -EINVAL;
   4590 	}
   4591 
   4592 	htcaps_mask->a_mpdu_params |= 0x1C;
   4593 	htcaps->a_mpdu_params &= ~(0x1C);
   4594 	htcaps->a_mpdu_params |= (density << 2) & 0x1C;
   4595 
   4596 	return 0;
   4597 }
   4598 
   4599 
   4600 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
   4601 				struct ieee80211_ht_capabilities *htcaps,
   4602 				struct ieee80211_ht_capabilities *htcaps_mask,
   4603 				int disabled)
   4604 {
   4605 	if (disabled)
   4606 		wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
   4607 
   4608 	set_disable_ht40(htcaps, disabled);
   4609 	set_disable_ht40(htcaps_mask, 0);
   4610 
   4611 	return 0;
   4612 }
   4613 
   4614 
   4615 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
   4616 			       struct ieee80211_ht_capabilities *htcaps,
   4617 			       struct ieee80211_ht_capabilities *htcaps_mask,
   4618 			       int disabled)
   4619 {
   4620 	/* Masking these out disables SGI */
   4621 	le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
   4622 				HT_CAP_INFO_SHORT_GI40MHZ);
   4623 
   4624 	if (disabled)
   4625 		wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
   4626 
   4627 	if (disabled)
   4628 		htcaps->ht_capabilities_info &= ~msk;
   4629 	else
   4630 		htcaps->ht_capabilities_info |= msk;
   4631 
   4632 	htcaps_mask->ht_capabilities_info |= msk;
   4633 
   4634 	return 0;
   4635 }
   4636 
   4637 
   4638 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
   4639 			       struct ieee80211_ht_capabilities *htcaps,
   4640 			       struct ieee80211_ht_capabilities *htcaps_mask,
   4641 			       int disabled)
   4642 {
   4643 	/* Masking these out disables LDPC */
   4644 	le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
   4645 
   4646 	if (disabled)
   4647 		wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
   4648 
   4649 	if (disabled)
   4650 		htcaps->ht_capabilities_info &= ~msk;
   4651 	else
   4652 		htcaps->ht_capabilities_info |= msk;
   4653 
   4654 	htcaps_mask->ht_capabilities_info |= msk;
   4655 
   4656 	return 0;
   4657 }
   4658 
   4659 
   4660 static int wpa_set_tx_stbc(struct wpa_supplicant *wpa_s,
   4661 			   struct ieee80211_ht_capabilities *htcaps,
   4662 			   struct ieee80211_ht_capabilities *htcaps_mask,
   4663 			   int tx_stbc)
   4664 {
   4665 	le16 msk = host_to_le16(HT_CAP_INFO_TX_STBC);
   4666 
   4667 	if (tx_stbc == -1)
   4668 		return 0;
   4669 
   4670 	wpa_msg(wpa_s, MSG_DEBUG, "set_tx_stbc: %d", tx_stbc);
   4671 
   4672 	if (tx_stbc < 0 || tx_stbc > 1) {
   4673 		wpa_msg(wpa_s, MSG_ERROR,
   4674 			"tx_stbc: %d out of range. Must be 0-1 or -1", tx_stbc);
   4675 		return -EINVAL;
   4676 	}
   4677 
   4678 	htcaps_mask->ht_capabilities_info |= msk;
   4679 	htcaps->ht_capabilities_info &= ~msk;
   4680 	htcaps->ht_capabilities_info |= (tx_stbc << 7) & msk;
   4681 
   4682 	return 0;
   4683 }
   4684 
   4685 
   4686 static int wpa_set_rx_stbc(struct wpa_supplicant *wpa_s,
   4687 			   struct ieee80211_ht_capabilities *htcaps,
   4688 			   struct ieee80211_ht_capabilities *htcaps_mask,
   4689 			   int rx_stbc)
   4690 {
   4691 	le16 msk = host_to_le16(HT_CAP_INFO_RX_STBC_MASK);
   4692 
   4693 	if (rx_stbc == -1)
   4694 		return 0;
   4695 
   4696 	wpa_msg(wpa_s, MSG_DEBUG, "set_rx_stbc: %d", rx_stbc);
   4697 
   4698 	if (rx_stbc < 0 || rx_stbc > 3) {
   4699 		wpa_msg(wpa_s, MSG_ERROR,
   4700 			"rx_stbc: %d out of range. Must be 0-3 or -1", rx_stbc);
   4701 		return -EINVAL;
   4702 	}
   4703 
   4704 	htcaps_mask->ht_capabilities_info |= msk;
   4705 	htcaps->ht_capabilities_info &= ~msk;
   4706 	htcaps->ht_capabilities_info |= (rx_stbc << 8) & msk;
   4707 
   4708 	return 0;
   4709 }
   4710 
   4711 
   4712 void wpa_supplicant_apply_ht_overrides(
   4713 	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
   4714 	struct wpa_driver_associate_params *params)
   4715 {
   4716 	struct ieee80211_ht_capabilities *htcaps;
   4717 	struct ieee80211_ht_capabilities *htcaps_mask;
   4718 
   4719 	if (!ssid)
   4720 		return;
   4721 
   4722 	params->disable_ht = ssid->disable_ht;
   4723 	if (!params->htcaps || !params->htcaps_mask)
   4724 		return;
   4725 
   4726 	htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
   4727 	htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
   4728 	wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
   4729 	wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
   4730 			      ssid->disable_max_amsdu);
   4731 	wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
   4732 	wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
   4733 	wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
   4734 	wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
   4735 	wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
   4736 	wpa_set_rx_stbc(wpa_s, htcaps, htcaps_mask, ssid->rx_stbc);
   4737 	wpa_set_tx_stbc(wpa_s, htcaps, htcaps_mask, ssid->tx_stbc);
   4738 
   4739 	if (ssid->ht40_intolerant) {
   4740 		le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
   4741 		htcaps->ht_capabilities_info |= bit;
   4742 		htcaps_mask->ht_capabilities_info |= bit;
   4743 	}
   4744 }
   4745 
   4746 #endif /* CONFIG_HT_OVERRIDES */
   4747 
   4748 
   4749 #ifdef CONFIG_VHT_OVERRIDES
   4750 void wpa_supplicant_apply_vht_overrides(
   4751 	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
   4752 	struct wpa_driver_associate_params *params)
   4753 {
   4754 	struct ieee80211_vht_capabilities *vhtcaps;
   4755 	struct ieee80211_vht_capabilities *vhtcaps_mask;
   4756 
   4757 	if (!ssid)
   4758 		return;
   4759 
   4760 	params->disable_vht = ssid->disable_vht;
   4761 
   4762 	vhtcaps = (void *) params->vhtcaps;
   4763 	vhtcaps_mask = (void *) params->vhtcaps_mask;
   4764 
   4765 	if (!vhtcaps || !vhtcaps_mask)
   4766 		return;
   4767 
   4768 	vhtcaps->vht_capabilities_info = host_to_le32(ssid->vht_capa);
   4769 	vhtcaps_mask->vht_capabilities_info = host_to_le32(ssid->vht_capa_mask);
   4770 
   4771 #ifdef CONFIG_HT_OVERRIDES
   4772 	if (ssid->disable_sgi) {
   4773 		vhtcaps_mask->vht_capabilities_info |= (VHT_CAP_SHORT_GI_80 |
   4774 							VHT_CAP_SHORT_GI_160);
   4775 		vhtcaps->vht_capabilities_info &= ~(VHT_CAP_SHORT_GI_80 |
   4776 						    VHT_CAP_SHORT_GI_160);
   4777 		wpa_msg(wpa_s, MSG_DEBUG,
   4778 			"disable-sgi override specified, vht-caps: 0x%x",
   4779 			vhtcaps->vht_capabilities_info);
   4780 	}
   4781 
   4782 	/* if max ampdu is <= 3, we have to make the HT cap the same */
   4783 	if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
   4784 		int max_ampdu;
   4785 
   4786 		max_ampdu = (ssid->vht_capa &
   4787 			     VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
   4788 			VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
   4789 
   4790 		max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
   4791 		wpa_set_ampdu_factor(wpa_s,
   4792 				     (void *) params->htcaps,
   4793 				     (void *) params->htcaps_mask,
   4794 				     max_ampdu);
   4795 	}
   4796 #endif /* CONFIG_HT_OVERRIDES */
   4797 
   4798 #define OVERRIDE_MCS(i)							\
   4799 	if (ssid->vht_tx_mcs_nss_ ##i >= 0) {				\
   4800 		vhtcaps_mask->vht_supported_mcs_set.tx_map |=		\
   4801 			host_to_le16(3 << 2 * (i - 1));			\
   4802 		vhtcaps->vht_supported_mcs_set.tx_map |=		\
   4803 			host_to_le16(ssid->vht_tx_mcs_nss_ ##i <<	\
   4804 				     2 * (i - 1));			\
   4805 	}								\
   4806 	if (ssid->vht_rx_mcs_nss_ ##i >= 0) {				\
   4807 		vhtcaps_mask->vht_supported_mcs_set.rx_map |=		\
   4808 			host_to_le16(3 << 2 * (i - 1));			\
   4809 		vhtcaps->vht_supported_mcs_set.rx_map |=		\
   4810 			host_to_le16(ssid->vht_rx_mcs_nss_ ##i <<	\
   4811 				     2 * (i - 1));			\
   4812 	}
   4813 
   4814 	OVERRIDE_MCS(1);
   4815 	OVERRIDE_MCS(2);
   4816 	OVERRIDE_MCS(3);
   4817 	OVERRIDE_MCS(4);
   4818 	OVERRIDE_MCS(5);
   4819 	OVERRIDE_MCS(6);
   4820 	OVERRIDE_MCS(7);
   4821 	OVERRIDE_MCS(8);
   4822 }
   4823 #endif /* CONFIG_VHT_OVERRIDES */
   4824 
   4825 
   4826 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
   4827 {
   4828 #ifdef PCSC_FUNCS
   4829 	size_t len;
   4830 
   4831 	if (!wpa_s->conf->pcsc_reader)
   4832 		return 0;
   4833 
   4834 	wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
   4835 	if (!wpa_s->scard)
   4836 		return 1;
   4837 
   4838 	if (wpa_s->conf->pcsc_pin &&
   4839 	    scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
   4840 		scard_deinit(wpa_s->scard);
   4841 		wpa_s->scard = NULL;
   4842 		wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
   4843 		return -1;
   4844 	}
   4845 
   4846 	len = sizeof(wpa_s->imsi) - 1;
   4847 	if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
   4848 		scard_deinit(wpa_s->scard);
   4849 		wpa_s->scard = NULL;
   4850 		wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
   4851 		return -1;
   4852 	}
   4853 	wpa_s->imsi[len] = '\0';
   4854 
   4855 	wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
   4856 
   4857 	wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
   4858 		   wpa_s->imsi, wpa_s->mnc_len);
   4859 
   4860 	wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
   4861 	eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
   4862 #endif /* PCSC_FUNCS */
   4863 
   4864 	return 0;
   4865 }
   4866 
   4867 
   4868 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
   4869 {
   4870 	char *val, *pos;
   4871 
   4872 	ext_password_deinit(wpa_s->ext_pw);
   4873 	wpa_s->ext_pw = NULL;
   4874 	eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
   4875 
   4876 	if (!wpa_s->conf->ext_password_backend)
   4877 		return 0;
   4878 
   4879 	val = os_strdup(wpa_s->conf->ext_password_backend);
   4880 	if (val == NULL)
   4881 		return -1;
   4882 	pos = os_strchr(val, ':');
   4883 	if (pos)
   4884 		*pos++ = '\0';
   4885 
   4886 	wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
   4887 
   4888 	wpa_s->ext_pw = ext_password_init(val, pos);
   4889 	os_free(val);
   4890 	if (wpa_s->ext_pw == NULL) {
   4891 		wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
   4892 		return -1;
   4893 	}
   4894 	eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
   4895 
   4896 	return 0;
   4897 }
   4898 
   4899 
   4900 #ifdef CONFIG_FST
   4901 
   4902 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
   4903 {
   4904 	struct wpa_supplicant *wpa_s = ctx;
   4905 
   4906 	return (is_zero_ether_addr(wpa_s->bssid) ||
   4907 		wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
   4908 }
   4909 
   4910 
   4911 static void wpas_fst_get_channel_info_cb(void *ctx,
   4912 					 enum hostapd_hw_mode *hw_mode,
   4913 					 u8 *channel)
   4914 {
   4915 	struct wpa_supplicant *wpa_s = ctx;
   4916 
   4917 	if (wpa_s->current_bss) {
   4918 		*hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
   4919 						  channel);
   4920 	} else if (wpa_s->hw.num_modes) {
   4921 		*hw_mode = wpa_s->hw.modes[0].mode;
   4922 	} else {
   4923 		WPA_ASSERT(0);
   4924 		*hw_mode = 0;
   4925 	}
   4926 }
   4927 
   4928 
   4929 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
   4930 {
   4931 	struct wpa_supplicant *wpa_s = ctx;
   4932 
   4933 	*modes = wpa_s->hw.modes;
   4934 	return wpa_s->hw.num_modes;
   4935 }
   4936 
   4937 
   4938 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
   4939 {
   4940 	struct wpa_supplicant *wpa_s = ctx;
   4941 
   4942 	wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
   4943 	wpa_s->fst_ies = fst_ies;
   4944 }
   4945 
   4946 
   4947 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
   4948 {
   4949 	struct wpa_supplicant *wpa_s = ctx;
   4950 
   4951 	if (os_memcmp(wpa_s->bssid, da, ETH_ALEN) != 0) {
   4952 		wpa_printf(MSG_INFO, "FST:%s:bssid=" MACSTR " != da=" MACSTR,
   4953 			   __func__, MAC2STR(wpa_s->bssid), MAC2STR(da));
   4954 		return -1;
   4955 	}
   4956 	return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
   4957 				   wpa_s->own_addr, wpa_s->bssid,
   4958 				   wpabuf_head(data), wpabuf_len(data),
   4959 				   0);
   4960 }
   4961 
   4962 
   4963 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
   4964 {
   4965 	struct wpa_supplicant *wpa_s = ctx;
   4966 
   4967 	WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
   4968 	return wpa_s->received_mb_ies;
   4969 }
   4970 
   4971 
   4972 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
   4973 				     const u8 *buf, size_t size)
   4974 {
   4975 	struct wpa_supplicant *wpa_s = ctx;
   4976 	struct mb_ies_info info;
   4977 
   4978 	WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
   4979 
   4980 	if (!mb_ies_info_by_ies(&info, buf, size)) {
   4981 		wpabuf_free(wpa_s->received_mb_ies);
   4982 		wpa_s->received_mb_ies = mb_ies_by_info(&info);
   4983 	}
   4984 }
   4985 
   4986 
   4987 static const u8 * wpas_fst_get_peer_first(void *ctx,
   4988 					  struct fst_get_peer_ctx **get_ctx,
   4989 					  Boolean mb_only)
   4990 {
   4991 	struct wpa_supplicant *wpa_s = ctx;
   4992 
   4993 	*get_ctx = NULL;
   4994 	if (!is_zero_ether_addr(wpa_s->bssid))
   4995 		return (wpa_s->received_mb_ies || !mb_only) ?
   4996 			wpa_s->bssid : NULL;
   4997 	return NULL;
   4998 }
   4999 
   5000 
   5001 static const u8 * wpas_fst_get_peer_next(void *ctx,
   5002 					 struct fst_get_peer_ctx **get_ctx,
   5003 					 Boolean mb_only)
   5004 {
   5005 	return NULL;
   5006 }
   5007 
   5008 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
   5009 				       struct fst_wpa_obj *iface_obj)
   5010 {
   5011 	iface_obj->ctx              = wpa_s;
   5012 	iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
   5013 	iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
   5014 	iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
   5015 	iface_obj->set_ies          = wpas_fst_set_ies_cb;
   5016 	iface_obj->send_action      = wpas_fst_send_action_cb;
   5017 	iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
   5018 	iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
   5019 	iface_obj->get_peer_first   = wpas_fst_get_peer_first;
   5020 	iface_obj->get_peer_next    = wpas_fst_get_peer_next;
   5021 }
   5022 #endif /* CONFIG_FST */
   5023 
   5024 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
   5025 				    const struct wpa_driver_capa *capa)
   5026 {
   5027 	struct wowlan_triggers *triggers;
   5028 	int ret = 0;
   5029 
   5030 	if (!wpa_s->conf->wowlan_triggers)
   5031 		return 0;
   5032 
   5033 	triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
   5034 	if (triggers) {
   5035 		ret = wpa_drv_wowlan(wpa_s, triggers);
   5036 		os_free(triggers);
   5037 	}
   5038 	return ret;
   5039 }
   5040 
   5041 
   5042 enum wpa_radio_work_band wpas_freq_to_band(int freq)
   5043 {
   5044 	if (freq < 3000)
   5045 		return BAND_2_4_GHZ;
   5046 	if (freq > 50000)
   5047 		return BAND_60_GHZ;
   5048 	return BAND_5_GHZ;
   5049 }
   5050 
   5051 
   5052 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
   5053 {
   5054 	int i;
   5055 	unsigned int band = 0;
   5056 
   5057 	if (freqs) {
   5058 		/* freqs are specified for the radio work */
   5059 		for (i = 0; freqs[i]; i++)
   5060 			band |= wpas_freq_to_band(freqs[i]);
   5061 	} else {
   5062 		/*
   5063 		 * freqs are not specified, implies all
   5064 		 * the supported freqs by HW
   5065 		 */
   5066 		for (i = 0; i < wpa_s->hw.num_modes; i++) {
   5067 			if (wpa_s->hw.modes[i].num_channels != 0) {
   5068 				if (wpa_s->hw.modes[i].mode ==
   5069 				    HOSTAPD_MODE_IEEE80211B ||
   5070 				    wpa_s->hw.modes[i].mode ==
   5071 				    HOSTAPD_MODE_IEEE80211G)
   5072 					band |= BAND_2_4_GHZ;
   5073 				else if (wpa_s->hw.modes[i].mode ==
   5074 					 HOSTAPD_MODE_IEEE80211A)
   5075 					band |= BAND_5_GHZ;
   5076 				else if (wpa_s->hw.modes[i].mode ==
   5077 					 HOSTAPD_MODE_IEEE80211AD)
   5078 					band |= BAND_60_GHZ;
   5079 				else if (wpa_s->hw.modes[i].mode ==
   5080 					 HOSTAPD_MODE_IEEE80211ANY)
   5081 					band = BAND_2_4_GHZ | BAND_5_GHZ |
   5082 						BAND_60_GHZ;
   5083 			}
   5084 		}
   5085 	}
   5086 
   5087 	return band;
   5088 }
   5089 
   5090 
   5091 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
   5092 					      const char *rn)
   5093 {
   5094 	struct wpa_supplicant *iface = wpa_s->global->ifaces;
   5095 	struct wpa_radio *radio;
   5096 
   5097 	while (rn && iface) {
   5098 		radio = iface->radio;
   5099 		if (radio && os_strcmp(rn, radio->name) == 0) {
   5100 			wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
   5101 				   wpa_s->ifname, rn);
   5102 			dl_list_add(&radio->ifaces, &wpa_s->radio_list);
   5103 			return radio;
   5104 		}
   5105 
   5106 		iface = iface->next;
   5107 	}
   5108 
   5109 	wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
   5110 		   wpa_s->ifname, rn ? rn : "N/A");
   5111 	radio = os_zalloc(sizeof(*radio));
   5112 	if (radio == NULL)
   5113 		return NULL;
   5114 
   5115 	if (rn)
   5116 		os_strlcpy(radio->name, rn, sizeof(radio->name));
   5117 	dl_list_init(&radio->ifaces);
   5118 	dl_list_init(&radio->work);
   5119 	dl_list_add(&radio->ifaces, &wpa_s->radio_list);
   5120 
   5121 	return radio;
   5122 }
   5123 
   5124 
   5125 static void radio_work_free(struct wpa_radio_work *work)
   5126 {
   5127 	if (work->wpa_s->scan_work == work) {
   5128 		/* This should not really happen. */
   5129 		wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
   5130 			work->type, work, work->started);
   5131 		work->wpa_s->scan_work = NULL;
   5132 	}
   5133 
   5134 #ifdef CONFIG_P2P
   5135 	if (work->wpa_s->p2p_scan_work == work) {
   5136 		/* This should not really happen. */
   5137 		wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
   5138 			work->type, work, work->started);
   5139 		work->wpa_s->p2p_scan_work = NULL;
   5140 	}
   5141 #endif /* CONFIG_P2P */
   5142 
   5143 	if (work->started) {
   5144 		work->wpa_s->radio->num_active_works--;
   5145 		wpa_dbg(work->wpa_s, MSG_DEBUG,
   5146 			"radio_work_free('%s'@%p): num_active_works --> %u",
   5147 			work->type, work,
   5148 			work->wpa_s->radio->num_active_works);
   5149 	}
   5150 
   5151 	dl_list_del(&work->list);
   5152 	os_free(work);
   5153 }
   5154 
   5155 
   5156 static int radio_work_is_connect(struct wpa_radio_work *work)
   5157 {
   5158 	return os_strcmp(work->type, "sme-connect") == 0 ||
   5159 		os_strcmp(work->type, "connect") == 0;
   5160 }
   5161 
   5162 
   5163 static int radio_work_is_scan(struct wpa_radio_work *work)
   5164 {
   5165 	return os_strcmp(work->type, "scan") == 0 ||
   5166 		os_strcmp(work->type, "p2p-scan") == 0;
   5167 }
   5168 
   5169 
   5170 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
   5171 {
   5172 	struct wpa_radio_work *active_work = NULL;
   5173 	struct wpa_radio_work *tmp;
   5174 
   5175 	/* Get the active work to know the type and band. */
   5176 	dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
   5177 		if (tmp->started) {
   5178 			active_work = tmp;
   5179 			break;
   5180 		}
   5181 	}
   5182 
   5183 	if (!active_work) {
   5184 		/* No active work, start one */
   5185 		radio->num_active_works = 0;
   5186 		dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
   5187 				 list) {
   5188 			if (os_strcmp(tmp->type, "scan") == 0 &&
   5189 			    radio->external_scan_running &&
   5190 			    (((struct wpa_driver_scan_params *)
   5191 			      tmp->ctx)->only_new_results ||
   5192 			     tmp->wpa_s->clear_driver_scan_cache))
   5193 				continue;
   5194 			return tmp;
   5195 		}
   5196 		return NULL;
   5197 	}
   5198 
   5199 	if (radio_work_is_connect(active_work)) {
   5200 		/*
   5201 		 * If the active work is either connect or sme-connect,
   5202 		 * do not parallelize them with other radio works.
   5203 		 */
   5204 		wpa_dbg(active_work->wpa_s, MSG_DEBUG,
   5205 			"Do not parallelize radio work with %s",
   5206 			active_work->type);
   5207 		return NULL;
   5208 	}
   5209 
   5210 	dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
   5211 		if (tmp->started)
   5212 			continue;
   5213 
   5214 		/*
   5215 		 * If connect or sme-connect are enqueued, parallelize only
   5216 		 * those operations ahead of them in the queue.
   5217 		 */
   5218 		if (radio_work_is_connect(tmp))
   5219 			break;
   5220 
   5221 		/* Serialize parallel scan and p2p_scan operations on the same
   5222 		 * interface since the driver_nl80211 mechanism for tracking
   5223 		 * scan cookies does not yet have support for this. */
   5224 		if (active_work->wpa_s == tmp->wpa_s &&
   5225 		    radio_work_is_scan(active_work) &&
   5226 		    radio_work_is_scan(tmp)) {
   5227 			wpa_dbg(active_work->wpa_s, MSG_DEBUG,
   5228 				"Do not start work '%s' when another work '%s' is already scheduled",
   5229 				tmp->type, active_work->type);
   5230 			continue;
   5231 		}
   5232 		/*
   5233 		 * Check that the radio works are distinct and
   5234 		 * on different bands.
   5235 		 */
   5236 		if (os_strcmp(active_work->type, tmp->type) != 0 &&
   5237 		    (active_work->bands != tmp->bands)) {
   5238 			/*
   5239 			 * If a scan has to be scheduled through nl80211 scan
   5240 			 * interface and if an external scan is already running,
   5241 			 * do not schedule the scan since it is likely to get
   5242 			 * rejected by kernel.
   5243 			 */
   5244 			if (os_strcmp(tmp->type, "scan") == 0 &&
   5245 			    radio->external_scan_running &&
   5246 			    (((struct wpa_driver_scan_params *)
   5247 			      tmp->ctx)->only_new_results ||
   5248 			     tmp->wpa_s->clear_driver_scan_cache))
   5249 				continue;
   5250 
   5251 			wpa_dbg(active_work->wpa_s, MSG_DEBUG,
   5252 				"active_work:%s new_work:%s",
   5253 				active_work->type, tmp->type);
   5254 			return tmp;
   5255 		}
   5256 	}
   5257 
   5258 	/* Did not find a radio work to schedule in parallel. */
   5259 	return NULL;
   5260 }
   5261 
   5262 
   5263 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
   5264 {
   5265 	struct wpa_radio *radio = eloop_ctx;
   5266 	struct wpa_radio_work *work;
   5267 	struct os_reltime now, diff;
   5268 	struct wpa_supplicant *wpa_s;
   5269 
   5270 	work = dl_list_first(&radio->work, struct wpa_radio_work, list);
   5271 	if (work == NULL) {
   5272 		radio->num_active_works = 0;
   5273 		return;
   5274 	}
   5275 
   5276 	wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
   5277 			      radio_list);
   5278 
   5279 	if (!(wpa_s &&
   5280 	      wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
   5281 		if (work->started)
   5282 			return; /* already started and still in progress */
   5283 
   5284 		if (wpa_s && wpa_s->radio->external_scan_running) {
   5285 			wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
   5286 			return;
   5287 		}
   5288 	} else {
   5289 		work = NULL;
   5290 		if (radio->num_active_works < MAX_ACTIVE_WORKS) {
   5291 			/* get the work to schedule next */
   5292 			work = radio_work_get_next_work(radio);
   5293 		}
   5294 		if (!work)
   5295 			return;
   5296 	}
   5297 
   5298 	wpa_s = work->wpa_s;
   5299 	os_get_reltime(&now);
   5300 	os_reltime_sub(&now, &work->time, &diff);
   5301 	wpa_dbg(wpa_s, MSG_DEBUG,
   5302 		"Starting radio work '%s'@%p after %ld.%06ld second wait",
   5303 		work->type, work, diff.sec, diff.usec);
   5304 	work->started = 1;
   5305 	work->time = now;
   5306 	radio->num_active_works++;
   5307 
   5308 	work->cb(work, 0);
   5309 
   5310 	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
   5311 	    radio->num_active_works < MAX_ACTIVE_WORKS)
   5312 		radio_work_check_next(wpa_s);
   5313 }
   5314 
   5315 
   5316 /*
   5317  * This function removes both started and pending radio works running on
   5318  * the provided interface's radio.
   5319  * Prior to the removal of the radio work, its callback (cb) is called with
   5320  * deinit set to be 1. Each work's callback is responsible for clearing its
   5321  * internal data and restoring to a correct state.
   5322  * @wpa_s: wpa_supplicant data
   5323  * @type: type of works to be removed
   5324  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
   5325  * this interface's works.
   5326  */
   5327 void radio_remove_works(struct wpa_supplicant *wpa_s,
   5328 			const char *type, int remove_all)
   5329 {
   5330 	struct wpa_radio_work *work, *tmp;
   5331 	struct wpa_radio *radio = wpa_s->radio;
   5332 
   5333 	dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
   5334 			      list) {
   5335 		if (type && os_strcmp(type, work->type) != 0)
   5336 			continue;
   5337 
   5338 		/* skip other ifaces' works */
   5339 		if (!remove_all && work->wpa_s != wpa_s)
   5340 			continue;
   5341 
   5342 		wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
   5343 			work->type, work, work->started ? " (started)" : "");
   5344 		work->cb(work, 1);
   5345 		radio_work_free(work);
   5346 	}
   5347 
   5348 	/* in case we removed the started work */
   5349 	radio_work_check_next(wpa_s);
   5350 }
   5351 
   5352 
   5353 void radio_remove_pending_work(struct wpa_supplicant *wpa_s, void *ctx)
   5354 {
   5355 	struct wpa_radio_work *work;
   5356 	struct wpa_radio *radio = wpa_s->radio;
   5357 
   5358 	dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
   5359 		if (work->ctx != ctx)
   5360 			continue;
   5361 		wpa_dbg(wpa_s, MSG_DEBUG, "Free pending radio work '%s'@%p%s",
   5362 			work->type, work, work->started ? " (started)" : "");
   5363 		radio_work_free(work);
   5364 		break;
   5365 	}
   5366 }
   5367 
   5368 
   5369 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
   5370 {
   5371 	struct wpa_radio *radio = wpa_s->radio;
   5372 
   5373 	if (!radio)
   5374 		return;
   5375 
   5376 	wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
   5377 		   wpa_s->ifname, radio->name);
   5378 	dl_list_del(&wpa_s->radio_list);
   5379 	radio_remove_works(wpa_s, NULL, 0);
   5380 	wpa_s->radio = NULL;
   5381 	if (!dl_list_empty(&radio->ifaces))
   5382 		return; /* Interfaces remain for this radio */
   5383 
   5384 	wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
   5385 	eloop_cancel_timeout(radio_start_next_work, radio, NULL);
   5386 	os_free(radio);
   5387 }
   5388 
   5389 
   5390 void radio_work_check_next(struct wpa_supplicant *wpa_s)
   5391 {
   5392 	struct wpa_radio *radio = wpa_s->radio;
   5393 
   5394 	if (dl_list_empty(&radio->work))
   5395 		return;
   5396 	if (wpa_s->ext_work_in_progress) {
   5397 		wpa_printf(MSG_DEBUG,
   5398 			   "External radio work in progress - delay start of pending item");
   5399 		return;
   5400 	}
   5401 	eloop_cancel_timeout(radio_start_next_work, radio, NULL);
   5402 	eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
   5403 }
   5404 
   5405 
   5406 /**
   5407  * radio_add_work - Add a radio work item
   5408  * @wpa_s: Pointer to wpa_supplicant data
   5409  * @freq: Frequency of the offchannel operation in MHz or 0
   5410  * @type: Unique identifier for each type of work
   5411  * @next: Force as the next work to be executed
   5412  * @cb: Callback function for indicating when radio is available
   5413  * @ctx: Context pointer for the work (work->ctx in cb())
   5414  * Returns: 0 on success, -1 on failure
   5415  *
   5416  * This function is used to request time for an operation that requires
   5417  * exclusive radio control. Once the radio is available, the registered callback
   5418  * function will be called. radio_work_done() must be called once the exclusive
   5419  * radio operation has been completed, so that the radio is freed for other
   5420  * operations. The special case of deinit=1 is used to free the context data
   5421  * during interface removal. That does not allow the callback function to start
   5422  * the radio operation, i.e., it must free any resources allocated for the radio
   5423  * work and return.
   5424  *
   5425  * The @freq parameter can be used to indicate a single channel on which the
   5426  * offchannel operation will occur. This may allow multiple radio work
   5427  * operations to be performed in parallel if they apply for the same channel.
   5428  * Setting this to 0 indicates that the work item may use multiple channels or
   5429  * requires exclusive control of the radio.
   5430  */
   5431 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
   5432 		   const char *type, int next,
   5433 		   void (*cb)(struct wpa_radio_work *work, int deinit),
   5434 		   void *ctx)
   5435 {
   5436 	struct wpa_radio *radio = wpa_s->radio;
   5437 	struct wpa_radio_work *work;
   5438 	int was_empty;
   5439 
   5440 	work = os_zalloc(sizeof(*work));
   5441 	if (work == NULL)
   5442 		return -1;
   5443 	wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
   5444 	os_get_reltime(&work->time);
   5445 	work->freq = freq;
   5446 	work->type = type;
   5447 	work->wpa_s = wpa_s;
   5448 	work->cb = cb;
   5449 	work->ctx = ctx;
   5450 
   5451 	if (freq)
   5452 		work->bands = wpas_freq_to_band(freq);
   5453 	else if (os_strcmp(type, "scan") == 0 ||
   5454 		 os_strcmp(type, "p2p-scan") == 0)
   5455 		work->bands = wpas_get_bands(wpa_s,
   5456 					     ((struct wpa_driver_scan_params *)
   5457 					      ctx)->freqs);
   5458 	else
   5459 		work->bands = wpas_get_bands(wpa_s, NULL);
   5460 
   5461 	was_empty = dl_list_empty(&wpa_s->radio->work);
   5462 	if (next)
   5463 		dl_list_add(&wpa_s->radio->work, &work->list);
   5464 	else
   5465 		dl_list_add_tail(&wpa_s->radio->work, &work->list);
   5466 	if (was_empty) {
   5467 		wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
   5468 		radio_work_check_next(wpa_s);
   5469 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
   5470 		   && radio->num_active_works < MAX_ACTIVE_WORKS) {
   5471 		wpa_dbg(wpa_s, MSG_DEBUG,
   5472 			"Try to schedule a radio work (num_active_works=%u)",
   5473 			radio->num_active_works);
   5474 		radio_work_check_next(wpa_s);
   5475 	}
   5476 
   5477 	return 0;
   5478 }
   5479 
   5480 
   5481 /**
   5482  * radio_work_done - Indicate that a radio work item has been completed
   5483  * @work: Completed work
   5484  *
   5485  * This function is called once the callback function registered with
   5486  * radio_add_work() has completed its work.
   5487  */
   5488 void radio_work_done(struct wpa_radio_work *work)
   5489 {
   5490 	struct wpa_supplicant *wpa_s = work->wpa_s;
   5491 	struct os_reltime now, diff;
   5492 	unsigned int started = work->started;
   5493 
   5494 	os_get_reltime(&now);
   5495 	os_reltime_sub(&now, &work->time, &diff);
   5496 	wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
   5497 		work->type, work, started ? "done" : "canceled",
   5498 		diff.sec, diff.usec);
   5499 	radio_work_free(work);
   5500 	if (started)
   5501 		radio_work_check_next(wpa_s);
   5502 }
   5503 
   5504 
   5505 struct wpa_radio_work *
   5506 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
   5507 {
   5508 	struct wpa_radio_work *work;
   5509 	struct wpa_radio *radio = wpa_s->radio;
   5510 
   5511 	dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
   5512 		if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
   5513 			return work;
   5514 	}
   5515 
   5516 	return NULL;
   5517 }
   5518 
   5519 
   5520 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
   5521 			    const struct wpa_interface *iface)
   5522 {
   5523 	const char *ifname, *driver, *rn;
   5524 
   5525 	driver = iface->driver;
   5526 next_driver:
   5527 	if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
   5528 		return -1;
   5529 
   5530 	wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
   5531 	if (wpa_s->drv_priv == NULL) {
   5532 		const char *pos;
   5533 		pos = driver ? os_strchr(driver, ',') : NULL;
   5534 		if (pos) {
   5535 			wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
   5536 				"driver interface - try next driver wrapper");
   5537 			driver = pos + 1;
   5538 			goto next_driver;
   5539 		}
   5540 		wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
   5541 			"interface");
   5542 		return -1;
   5543 	}
   5544 	if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
   5545 		wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
   5546 			"driver_param '%s'", wpa_s->conf->driver_param);
   5547 		return -1;
   5548 	}
   5549 
   5550 	ifname = wpa_drv_get_ifname(wpa_s);
   5551 	if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
   5552 		wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
   5553 			"interface name with '%s'", ifname);
   5554 		os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
   5555 	}
   5556 
   5557 	rn = wpa_driver_get_radio_name(wpa_s);
   5558 	if (rn && rn[0] == '\0')
   5559 		rn = NULL;
   5560 
   5561 	wpa_s->radio = radio_add_interface(wpa_s, rn);
   5562 	if (wpa_s->radio == NULL)
   5563 		return -1;
   5564 
   5565 	return 0;
   5566 }
   5567 
   5568 
   5569 #ifdef CONFIG_GAS_SERVER
   5570 
   5571 static void wpas_gas_server_tx_status(struct wpa_supplicant *wpa_s,
   5572 				      unsigned int freq, const u8 *dst,
   5573 				      const u8 *src, const u8 *bssid,
   5574 				      const u8 *data, size_t data_len,
   5575 				      enum offchannel_send_action_result result)
   5576 {
   5577 	wpa_printf(MSG_DEBUG, "GAS: TX status: freq=%u dst=" MACSTR
   5578 		   " result=%s",
   5579 		   freq, MAC2STR(dst),
   5580 		   result == OFFCHANNEL_SEND_ACTION_SUCCESS ? "SUCCESS" :
   5581 		   (result == OFFCHANNEL_SEND_ACTION_NO_ACK ? "no-ACK" :
   5582 		    "FAILED"));
   5583 	gas_server_tx_status(wpa_s->gas_server, dst, data, data_len,
   5584 			     result == OFFCHANNEL_SEND_ACTION_SUCCESS);
   5585 }
   5586 
   5587 
   5588 static void wpas_gas_server_tx(void *ctx, int freq, const u8 *da,
   5589 			       struct wpabuf *buf, unsigned int wait_time)
   5590 {
   5591 	struct wpa_supplicant *wpa_s = ctx;
   5592 	const u8 broadcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
   5593 
   5594 	if (wait_time > wpa_s->max_remain_on_chan)
   5595 		wait_time = wpa_s->max_remain_on_chan;
   5596 
   5597 	offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, broadcast,
   5598 			       wpabuf_head(buf), wpabuf_len(buf),
   5599 			       wait_time, wpas_gas_server_tx_status, 0);
   5600 }
   5601 
   5602 #endif /* CONFIG_GAS_SERVER */
   5603 
   5604 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
   5605 				     const struct wpa_interface *iface)
   5606 {
   5607 	struct wpa_driver_capa capa;
   5608 	int capa_res;
   5609 	u8 dfs_domain;
   5610 
   5611 	wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
   5612 		   "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
   5613 		   iface->confname ? iface->confname : "N/A",
   5614 		   iface->driver ? iface->driver : "default",
   5615 		   iface->ctrl_interface ? iface->ctrl_interface : "N/A",
   5616 		   iface->bridge_ifname ? iface->bridge_ifname : "N/A");
   5617 
   5618 	if (iface->confname) {
   5619 #ifdef CONFIG_BACKEND_FILE
   5620 		wpa_s->confname = os_rel2abs_path(iface->confname);
   5621 		if (wpa_s->confname == NULL) {
   5622 			wpa_printf(MSG_ERROR, "Failed to get absolute path "
   5623 				   "for configuration file '%s'.",
   5624 				   iface->confname);
   5625 			return -1;
   5626 		}
   5627 		wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
   5628 			   iface->confname, wpa_s->confname);
   5629 #else /* CONFIG_BACKEND_FILE */
   5630 		wpa_s->confname = os_strdup(iface->confname);
   5631 #endif /* CONFIG_BACKEND_FILE */
   5632 		wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
   5633 		if (wpa_s->conf == NULL) {
   5634 			wpa_printf(MSG_ERROR, "Failed to read or parse "
   5635 				   "configuration '%s'.", wpa_s->confname);
   5636 			return -1;
   5637 		}
   5638 		wpa_s->confanother = os_rel2abs_path(iface->confanother);
   5639 		if (wpa_s->confanother &&
   5640 		    !wpa_config_read(wpa_s->confanother, wpa_s->conf)) {
   5641 			wpa_printf(MSG_ERROR,
   5642 				   "Failed to read or parse configuration '%s'.",
   5643 				   wpa_s->confanother);
   5644 			return -1;
   5645 		}
   5646 
   5647 		/*
   5648 		 * Override ctrl_interface and driver_param if set on command
   5649 		 * line.
   5650 		 */
   5651 		if (iface->ctrl_interface) {
   5652 			os_free(wpa_s->conf->ctrl_interface);
   5653 			wpa_s->conf->ctrl_interface =
   5654 				os_strdup(iface->ctrl_interface);
   5655 		}
   5656 
   5657 		if (iface->driver_param) {
   5658 			os_free(wpa_s->conf->driver_param);
   5659 			wpa_s->conf->driver_param =
   5660 				os_strdup(iface->driver_param);
   5661 		}
   5662 
   5663 		if (iface->p2p_mgmt && !iface->ctrl_interface) {
   5664 			os_free(wpa_s->conf->ctrl_interface);
   5665 			wpa_s->conf->ctrl_interface = NULL;
   5666 		}
   5667 	} else
   5668 		wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
   5669 						     iface->driver_param);
   5670 
   5671 	if (wpa_s->conf == NULL) {
   5672 		wpa_printf(MSG_ERROR, "\nNo configuration found.");
   5673 		return -1;
   5674 	}
   5675 
   5676 	if (iface->ifname == NULL) {
   5677 		wpa_printf(MSG_ERROR, "\nInterface name is required.");
   5678 		return -1;
   5679 	}
   5680 	if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
   5681 		wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
   5682 			   iface->ifname);
   5683 		return -1;
   5684 	}
   5685 	os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
   5686 
   5687 	if (iface->bridge_ifname) {
   5688 		if (os_strlen(iface->bridge_ifname) >=
   5689 		    sizeof(wpa_s->bridge_ifname)) {
   5690 			wpa_printf(MSG_ERROR, "\nToo long bridge interface "
   5691 				   "name '%s'.", iface->bridge_ifname);
   5692 			return -1;
   5693 		}
   5694 		os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
   5695 			   sizeof(wpa_s->bridge_ifname));
   5696 	}
   5697 
   5698 	/* RSNA Supplicant Key Management - INITIALIZE */
   5699 	eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
   5700 	eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
   5701 
   5702 	/* Initialize driver interface and register driver event handler before
   5703 	 * L2 receive handler so that association events are processed before
   5704 	 * EAPOL-Key packets if both become available for the same select()
   5705 	 * call. */
   5706 	if (wpas_init_driver(wpa_s, iface) < 0)
   5707 		return -1;
   5708 
   5709 	if (wpa_supplicant_init_wpa(wpa_s) < 0)
   5710 		return -1;
   5711 
   5712 	wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
   5713 			  wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
   5714 			  NULL);
   5715 	wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
   5716 
   5717 	if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
   5718 	    wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
   5719 			     wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
   5720 		wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
   5721 			"dot11RSNAConfigPMKLifetime");
   5722 		return -1;
   5723 	}
   5724 
   5725 	if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
   5726 	    wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
   5727 			     wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
   5728 		wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
   5729 			"dot11RSNAConfigPMKReauthThreshold");
   5730 		return -1;
   5731 	}
   5732 
   5733 	if (wpa_s->conf->dot11RSNAConfigSATimeout &&
   5734 	    wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
   5735 			     wpa_s->conf->dot11RSNAConfigSATimeout)) {
   5736 		wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
   5737 			"dot11RSNAConfigSATimeout");
   5738 		return -1;
   5739 	}
   5740 
   5741 	wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
   5742 						      &wpa_s->hw.num_modes,
   5743 						      &wpa_s->hw.flags,
   5744 						      &dfs_domain);
   5745 	if (wpa_s->hw.modes) {
   5746 		u16 i;
   5747 
   5748 		for (i = 0; i < wpa_s->hw.num_modes; i++) {
   5749 			if (wpa_s->hw.modes[i].vht_capab) {
   5750 				wpa_s->hw_capab = CAPAB_VHT;
   5751 				break;
   5752 			}
   5753 
   5754 			if (wpa_s->hw.modes[i].ht_capab &
   5755 			    HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
   5756 				wpa_s->hw_capab = CAPAB_HT40;
   5757 			else if (wpa_s->hw.modes[i].ht_capab &&
   5758 				 wpa_s->hw_capab == CAPAB_NO_HT_VHT)
   5759 				wpa_s->hw_capab = CAPAB_HT;
   5760 		}
   5761 	}
   5762 
   5763 	capa_res = wpa_drv_get_capa(wpa_s, &capa);
   5764 	if (capa_res == 0) {
   5765 		wpa_s->drv_capa_known = 1;
   5766 		wpa_s->drv_flags = capa.flags;
   5767 		wpa_s->drv_enc = capa.enc;
   5768 		wpa_s->drv_smps_modes = capa.smps_modes;
   5769 		wpa_s->drv_rrm_flags = capa.rrm_flags;
   5770 		wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
   5771 		wpa_s->max_scan_ssids = capa.max_scan_ssids;
   5772 		wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
   5773 		wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
   5774 		wpa_s->max_sched_scan_plan_interval =
   5775 			capa.max_sched_scan_plan_interval;
   5776 		wpa_s->max_sched_scan_plan_iterations =
   5777 			capa.max_sched_scan_plan_iterations;
   5778 		wpa_s->sched_scan_supported = capa.sched_scan_supported;
   5779 		wpa_s->max_match_sets = capa.max_match_sets;
   5780 		wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
   5781 		wpa_s->max_stations = capa.max_stations;
   5782 		wpa_s->extended_capa = capa.extended_capa;
   5783 		wpa_s->extended_capa_mask = capa.extended_capa_mask;
   5784 		wpa_s->extended_capa_len = capa.extended_capa_len;
   5785 		wpa_s->num_multichan_concurrent =
   5786 			capa.num_multichan_concurrent;
   5787 		wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
   5788 
   5789 		if (capa.mac_addr_rand_scan_supported)
   5790 			wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
   5791 		if (wpa_s->sched_scan_supported &&
   5792 		    capa.mac_addr_rand_sched_scan_supported)
   5793 			wpa_s->mac_addr_rand_supported |=
   5794 				(MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
   5795 
   5796 		wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
   5797 		if (wpa_s->extended_capa &&
   5798 		    wpa_s->extended_capa_len >= 3 &&
   5799 		    wpa_s->extended_capa[2] & 0x40)
   5800 			wpa_s->multi_bss_support = 1;
   5801 	}
   5802 	if (wpa_s->max_remain_on_chan == 0)
   5803 		wpa_s->max_remain_on_chan = 1000;
   5804 
   5805 	/*
   5806 	 * Only take p2p_mgmt parameters when P2P Device is supported.
   5807 	 * Doing it here as it determines whether l2_packet_init() will be done
   5808 	 * during wpa_supplicant_driver_init().
   5809 	 */
   5810 	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
   5811 		wpa_s->p2p_mgmt = iface->p2p_mgmt;
   5812 
   5813 	if (wpa_s->num_multichan_concurrent == 0)
   5814 		wpa_s->num_multichan_concurrent = 1;
   5815 
   5816 	if (wpa_supplicant_driver_init(wpa_s) < 0)
   5817 		return -1;
   5818 
   5819 #ifdef CONFIG_TDLS
   5820 	if (!iface->p2p_mgmt && wpa_tdls_init(wpa_s->wpa))
   5821 		return -1;
   5822 #endif /* CONFIG_TDLS */
   5823 
   5824 	if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
   5825 	    wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
   5826 		wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
   5827 		return -1;
   5828 	}
   5829 
   5830 #ifdef CONFIG_FST
   5831 	if (wpa_s->conf->fst_group_id) {
   5832 		struct fst_iface_cfg cfg;
   5833 		struct fst_wpa_obj iface_obj;
   5834 
   5835 		fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
   5836 		os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
   5837 			   sizeof(cfg.group_id));
   5838 		cfg.priority = wpa_s->conf->fst_priority;
   5839 		cfg.llt = wpa_s->conf->fst_llt;
   5840 
   5841 		wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
   5842 					&iface_obj, &cfg);
   5843 		if (!wpa_s->fst) {
   5844 			wpa_msg(wpa_s, MSG_ERROR,
   5845 				"FST: Cannot attach iface %s to group %s",
   5846 				wpa_s->ifname, cfg.group_id);
   5847 			return -1;
   5848 		}
   5849 	}
   5850 #endif /* CONFIG_FST */
   5851 
   5852 	if (wpas_wps_init(wpa_s))
   5853 		return -1;
   5854 
   5855 #ifdef CONFIG_GAS_SERVER
   5856 	wpa_s->gas_server = gas_server_init(wpa_s, wpas_gas_server_tx);
   5857 	if (!wpa_s->gas_server) {
   5858 		wpa_printf(MSG_ERROR, "Failed to initialize GAS server");
   5859 		return -1;
   5860 	}
   5861 #endif /* CONFIG_GAS_SERVER */
   5862 
   5863 #ifdef CONFIG_DPP
   5864 	if (wpas_dpp_init(wpa_s) < 0)
   5865 		return -1;
   5866 #endif /* CONFIG_DPP */
   5867 
   5868 	if (wpa_supplicant_init_eapol(wpa_s) < 0)
   5869 		return -1;
   5870 	wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
   5871 
   5872 	wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
   5873 	if (wpa_s->ctrl_iface == NULL) {
   5874 		wpa_printf(MSG_ERROR,
   5875 			   "Failed to initialize control interface '%s'.\n"
   5876 			   "You may have another wpa_supplicant process "
   5877 			   "already running or the file was\n"
   5878 			   "left by an unclean termination of wpa_supplicant "
   5879 			   "in which case you will need\n"
   5880 			   "to manually remove this file before starting "
   5881 			   "wpa_supplicant again.\n",
   5882 			   wpa_s->conf->ctrl_interface);
   5883 		return -1;
   5884 	}
   5885 
   5886 	wpa_s->gas = gas_query_init(wpa_s);
   5887 	if (wpa_s->gas == NULL) {
   5888 		wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
   5889 		return -1;
   5890 	}
   5891 
   5892 	if ((!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) ||
   5893 	     wpa_s->p2p_mgmt) &&
   5894 	    wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
   5895 		wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
   5896 		return -1;
   5897 	}
   5898 
   5899 	if (wpa_bss_init(wpa_s) < 0)
   5900 		return -1;
   5901 
   5902 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
   5903 #ifdef CONFIG_MESH
   5904 	dl_list_init(&wpa_s->mesh_external_pmksa_cache);
   5905 #endif /* CONFIG_MESH */
   5906 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
   5907 
   5908 	/*
   5909 	 * Set Wake-on-WLAN triggers, if configured.
   5910 	 * Note: We don't restore/remove the triggers on shutdown (it doesn't
   5911 	 * have effect anyway when the interface is down).
   5912 	 */
   5913 	if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
   5914 		return -1;
   5915 
   5916 #ifdef CONFIG_EAP_PROXY
   5917 {
   5918 	size_t len;
   5919 	wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, -1,
   5920 						     wpa_s->imsi, &len);
   5921 	if (wpa_s->mnc_len > 0) {
   5922 		wpa_s->imsi[len] = '\0';
   5923 		wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
   5924 			   wpa_s->imsi, wpa_s->mnc_len);
   5925 	} else {
   5926 		wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
   5927 	}
   5928 }
   5929 #endif /* CONFIG_EAP_PROXY */
   5930 
   5931 	if (pcsc_reader_init(wpa_s) < 0)
   5932 		return -1;
   5933 
   5934 	if (wpas_init_ext_pw(wpa_s) < 0)
   5935 		return -1;
   5936 
   5937 	wpas_rrm_reset(wpa_s);
   5938 
   5939 	wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
   5940 
   5941 #ifdef CONFIG_HS20
   5942 	hs20_init(wpa_s);
   5943 #endif /* CONFIG_HS20 */
   5944 #ifdef CONFIG_MBO
   5945 	if (wpa_s->conf->oce) {
   5946 		if ((wpa_s->conf->oce & OCE_STA) &&
   5947 		    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OCE_STA))
   5948 			wpa_s->enable_oce = OCE_STA;
   5949 		if ((wpa_s->conf->oce & OCE_STA_CFON) &&
   5950 		    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OCE_STA_CFON)) {
   5951 			/* TODO: Need to add STA-CFON support */
   5952 			wpa_printf(MSG_ERROR,
   5953 				   "OCE STA-CFON feature is not yet supported");
   5954 		}
   5955 	}
   5956 	wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
   5957 #endif /* CONFIG_MBO */
   5958 
   5959 	wpa_supplicant_set_default_scan_ies(wpa_s);
   5960 
   5961 	return 0;
   5962 }
   5963 
   5964 
   5965 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
   5966 					int notify, int terminate)
   5967 {
   5968 	struct wpa_global *global = wpa_s->global;
   5969 	struct wpa_supplicant *iface, *prev;
   5970 
   5971 	if (wpa_s == wpa_s->parent)
   5972 		wpas_p2p_group_remove(wpa_s, "*");
   5973 
   5974 	iface = global->ifaces;
   5975 	while (iface) {
   5976 		if (iface->p2pdev == wpa_s)
   5977 			iface->p2pdev = iface->parent;
   5978 		if (iface == wpa_s || iface->parent != wpa_s) {
   5979 			iface = iface->next;
   5980 			continue;
   5981 		}
   5982 		wpa_printf(MSG_DEBUG,
   5983 			   "Remove remaining child interface %s from parent %s",
   5984 			   iface->ifname, wpa_s->ifname);
   5985 		prev = iface;
   5986 		iface = iface->next;
   5987 		wpa_supplicant_remove_iface(global, prev, terminate);
   5988 	}
   5989 
   5990 	wpa_s->disconnected = 1;
   5991 	if (wpa_s->drv_priv) {
   5992 		wpa_supplicant_deauthenticate(wpa_s,
   5993 					      WLAN_REASON_DEAUTH_LEAVING);
   5994 
   5995 		wpa_drv_set_countermeasures(wpa_s, 0);
   5996 		wpa_clear_keys(wpa_s, NULL);
   5997 	}
   5998 
   5999 	wpa_supplicant_cleanup(wpa_s);
   6000 	wpas_p2p_deinit_iface(wpa_s);
   6001 
   6002 	wpas_ctrl_radio_work_flush(wpa_s);
   6003 	radio_remove_interface(wpa_s);
   6004 
   6005 #ifdef CONFIG_FST
   6006 	if (wpa_s->fst) {
   6007 		fst_detach(wpa_s->fst);
   6008 		wpa_s->fst = NULL;
   6009 	}
   6010 	if (wpa_s->received_mb_ies) {
   6011 		wpabuf_free(wpa_s->received_mb_ies);
   6012 		wpa_s->received_mb_ies = NULL;
   6013 	}
   6014 #endif /* CONFIG_FST */
   6015 
   6016 	if (wpa_s->drv_priv)
   6017 		wpa_drv_deinit(wpa_s);
   6018 
   6019 	if (notify)
   6020 		wpas_notify_iface_removed(wpa_s);
   6021 
   6022 	if (terminate)
   6023 		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
   6024 
   6025 	if (wpa_s->ctrl_iface) {
   6026 		wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
   6027 		wpa_s->ctrl_iface = NULL;
   6028 	}
   6029 
   6030 #ifdef CONFIG_MESH
   6031 	if (wpa_s->ifmsh) {
   6032 		wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
   6033 		wpa_s->ifmsh = NULL;
   6034 	}
   6035 #endif /* CONFIG_MESH */
   6036 
   6037 	if (wpa_s->conf != NULL) {
   6038 		wpa_config_free(wpa_s->conf);
   6039 		wpa_s->conf = NULL;
   6040 	}
   6041 
   6042 	os_free(wpa_s->ssids_from_scan_req);
   6043 
   6044 	os_free(wpa_s);
   6045 }
   6046 
   6047 
   6048 #ifdef CONFIG_MATCH_IFACE
   6049 
   6050 /**
   6051  * wpa_supplicant_match_iface - Match an interface description to a name
   6052  * @global: Pointer to global data from wpa_supplicant_init()
   6053  * @ifname: Name of the interface to match
   6054  * Returns: Pointer to the created interface description or %NULL on failure
   6055  */
   6056 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
   6057 						  const char *ifname)
   6058 {
   6059 	int i;
   6060 	struct wpa_interface *iface, *miface;
   6061 
   6062 	for (i = 0; i < global->params.match_iface_count; i++) {
   6063 		miface = &global->params.match_ifaces[i];
   6064 		if (!miface->ifname ||
   6065 		    fnmatch(miface->ifname, ifname, 0) == 0) {
   6066 			iface = os_zalloc(sizeof(*iface));
   6067 			if (!iface)
   6068 				return NULL;
   6069 			*iface = *miface;
   6070 			iface->ifname = ifname;
   6071 			return iface;
   6072 		}
   6073 	}
   6074 
   6075 	return NULL;
   6076 }
   6077 
   6078 
   6079 /**
   6080  * wpa_supplicant_match_existing - Match existing interfaces
   6081  * @global: Pointer to global data from wpa_supplicant_init()
   6082  * Returns: 0 on success, -1 on failure
   6083  */
   6084 static int wpa_supplicant_match_existing(struct wpa_global *global)
   6085 {
   6086 	struct if_nameindex *ifi, *ifp;
   6087 	struct wpa_supplicant *wpa_s;
   6088 	struct wpa_interface *iface;
   6089 
   6090 	ifp = if_nameindex();
   6091 	if (!ifp) {
   6092 		wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
   6093 		return -1;
   6094 	}
   6095 
   6096 	for (ifi = ifp; ifi->if_name; ifi++) {
   6097 		wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
   6098 		if (wpa_s)
   6099 			continue;
   6100 		iface = wpa_supplicant_match_iface(global, ifi->if_name);
   6101 		if (iface) {
   6102 			wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
   6103 			os_free(iface);
   6104 			if (wpa_s)
   6105 				wpa_s->matched = 1;
   6106 		}
   6107 	}
   6108 
   6109 	if_freenameindex(ifp);
   6110 	return 0;
   6111 }
   6112 
   6113 #endif /* CONFIG_MATCH_IFACE */
   6114 
   6115 
   6116 /**
   6117  * wpa_supplicant_add_iface - Add a new network interface
   6118  * @global: Pointer to global data from wpa_supplicant_init()
   6119  * @iface: Interface configuration options
   6120  * @parent: Parent interface or %NULL to assign new interface as parent
   6121  * Returns: Pointer to the created interface or %NULL on failure
   6122  *
   6123  * This function is used to add new network interfaces for %wpa_supplicant.
   6124  * This can be called before wpa_supplicant_run() to add interfaces before the
   6125  * main event loop has been started. In addition, new interfaces can be added
   6126  * dynamically while %wpa_supplicant is already running. This could happen,
   6127  * e.g., when a hotplug network adapter is inserted.
   6128  */
   6129 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
   6130 						 struct wpa_interface *iface,
   6131 						 struct wpa_supplicant *parent)
   6132 {
   6133 	struct wpa_supplicant *wpa_s;
   6134 	struct wpa_interface t_iface;
   6135 	struct wpa_ssid *ssid;
   6136 
   6137 	if (global == NULL || iface == NULL)
   6138 		return NULL;
   6139 
   6140 	wpa_s = wpa_supplicant_alloc(parent);
   6141 	if (wpa_s == NULL)
   6142 		return NULL;
   6143 
   6144 	wpa_s->global = global;
   6145 
   6146 	t_iface = *iface;
   6147 	if (global->params.override_driver) {
   6148 		wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
   6149 			   "('%s' -> '%s')",
   6150 			   iface->driver, global->params.override_driver);
   6151 		t_iface.driver = global->params.override_driver;
   6152 	}
   6153 	if (global->params.override_ctrl_interface) {
   6154 		wpa_printf(MSG_DEBUG, "Override interface parameter: "
   6155 			   "ctrl_interface ('%s' -> '%s')",
   6156 			   iface->ctrl_interface,
   6157 			   global->params.override_ctrl_interface);
   6158 		t_iface.ctrl_interface =
   6159 			global->params.override_ctrl_interface;
   6160 	}
   6161 	if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
   6162 		wpa_printf(MSG_DEBUG, "Failed to add interface %s",
   6163 			   iface->ifname);
   6164 		wpa_supplicant_deinit_iface(wpa_s, 0, 0);
   6165 		return NULL;
   6166 	}
   6167 
   6168 	/* Notify the control interfaces about new iface */
   6169 	if (wpas_notify_iface_added(wpa_s)) {
   6170 		wpa_supplicant_deinit_iface(wpa_s, 1, 0);
   6171 		return NULL;
   6172 	}
   6173 
   6174 	/* Notify the control interfaces about new networks for non p2p mgmt
   6175 	 * ifaces. */
   6176 	if (iface->p2p_mgmt == 0) {
   6177 		for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
   6178 			wpas_notify_network_added(wpa_s, ssid);
   6179 	}
   6180 
   6181 	wpa_s->next = global->ifaces;
   6182 	global->ifaces = wpa_s;
   6183 
   6184 	wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
   6185 	wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
   6186 
   6187 #ifdef CONFIG_P2P
   6188 	if (wpa_s->global->p2p == NULL &&
   6189 	    !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
   6190 	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
   6191 	    wpas_p2p_add_p2pdev_interface(
   6192 		    wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
   6193 		wpa_printf(MSG_INFO,
   6194 			   "P2P: Failed to enable P2P Device interface");
   6195 		/* Try to continue without. P2P will be disabled. */
   6196 	}
   6197 #endif /* CONFIG_P2P */
   6198 
   6199 	return wpa_s;
   6200 }
   6201 
   6202 
   6203 /**
   6204  * wpa_supplicant_remove_iface - Remove a network interface
   6205  * @global: Pointer to global data from wpa_supplicant_init()
   6206  * @wpa_s: Pointer to the network interface to be removed
   6207  * Returns: 0 if interface was removed, -1 if interface was not found
   6208  *
   6209  * This function can be used to dynamically remove network interfaces from
   6210  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
   6211  * addition, this function is used to remove all remaining interfaces when
   6212  * %wpa_supplicant is terminated.
   6213  */
   6214 int wpa_supplicant_remove_iface(struct wpa_global *global,
   6215 				struct wpa_supplicant *wpa_s,
   6216 				int terminate)
   6217 {
   6218 	struct wpa_supplicant *prev;
   6219 #ifdef CONFIG_MESH
   6220 	unsigned int mesh_if_created = wpa_s->mesh_if_created;
   6221 	char *ifname = NULL;
   6222 	struct wpa_supplicant *parent = wpa_s->parent;
   6223 #endif /* CONFIG_MESH */
   6224 
   6225 	/* Remove interface from the global list of interfaces */
   6226 	prev = global->ifaces;
   6227 	if (prev == wpa_s) {
   6228 		global->ifaces = wpa_s->next;
   6229 	} else {
   6230 		while (prev && prev->next != wpa_s)
   6231 			prev = prev->next;
   6232 		if (prev == NULL)
   6233 			return -1;
   6234 		prev->next = wpa_s->next;
   6235 	}
   6236 
   6237 	wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
   6238 
   6239 #ifdef CONFIG_MESH
   6240 	if (mesh_if_created) {
   6241 		ifname = os_strdup(wpa_s->ifname);
   6242 		if (ifname == NULL) {
   6243 			wpa_dbg(wpa_s, MSG_ERROR,
   6244 				"mesh: Failed to malloc ifname");
   6245 			return -1;
   6246 		}
   6247 	}
   6248 #endif /* CONFIG_MESH */
   6249 
   6250 	if (global->p2p_group_formation == wpa_s)
   6251 		global->p2p_group_formation = NULL;
   6252 	if (global->p2p_invite_group == wpa_s)
   6253 		global->p2p_invite_group = NULL;
   6254 	wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
   6255 
   6256 #ifdef CONFIG_MESH
   6257 	if (mesh_if_created) {
   6258 		wpa_drv_if_remove(parent, WPA_IF_MESH, ifname);
   6259 		os_free(ifname);
   6260 	}
   6261 #endif /* CONFIG_MESH */
   6262 
   6263 	return 0;
   6264 }
   6265 
   6266 
   6267 /**
   6268  * wpa_supplicant_get_eap_mode - Get the current EAP mode
   6269  * @wpa_s: Pointer to the network interface
   6270  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
   6271  */
   6272 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
   6273 {
   6274 	const char *eapol_method;
   6275 
   6276         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
   6277             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
   6278 		return "NO-EAP";
   6279 	}
   6280 
   6281 	eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
   6282 	if (eapol_method == NULL)
   6283 		return "UNKNOWN-EAP";
   6284 
   6285 	return eapol_method;
   6286 }
   6287 
   6288 
   6289 /**
   6290  * wpa_supplicant_get_iface - Get a new network interface
   6291  * @global: Pointer to global data from wpa_supplicant_init()
   6292  * @ifname: Interface name
   6293  * Returns: Pointer to the interface or %NULL if not found
   6294  */
   6295 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
   6296 						 const char *ifname)
   6297 {
   6298 	struct wpa_supplicant *wpa_s;
   6299 
   6300 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
   6301 		if (os_strcmp(wpa_s->ifname, ifname) == 0)
   6302 			return wpa_s;
   6303 	}
   6304 	return NULL;
   6305 }
   6306 
   6307 
   6308 #ifndef CONFIG_NO_WPA_MSG
   6309 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
   6310 {
   6311 	struct wpa_supplicant *wpa_s = ctx;
   6312 	if (wpa_s == NULL)
   6313 		return NULL;
   6314 	return wpa_s->ifname;
   6315 }
   6316 #endif /* CONFIG_NO_WPA_MSG */
   6317 
   6318 
   6319 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
   6320 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
   6321 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
   6322 
   6323 /* Periodic cleanup tasks */
   6324 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
   6325 {
   6326 	struct wpa_global *global = eloop_ctx;
   6327 	struct wpa_supplicant *wpa_s;
   6328 
   6329 	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
   6330 			       wpas_periodic, global, NULL);
   6331 
   6332 #ifdef CONFIG_P2P
   6333 	if (global->p2p)
   6334 		p2p_expire_peers(global->p2p);
   6335 #endif /* CONFIG_P2P */
   6336 
   6337 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
   6338 		wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
   6339 #ifdef CONFIG_AP
   6340 		ap_periodic(wpa_s);
   6341 #endif /* CONFIG_AP */
   6342 	}
   6343 }
   6344 
   6345 
   6346 /**
   6347  * wpa_supplicant_init - Initialize %wpa_supplicant
   6348  * @params: Parameters for %wpa_supplicant
   6349  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
   6350  *
   6351  * This function is used to initialize %wpa_supplicant. After successful
   6352  * initialization, the returned data pointer can be used to add and remove
   6353  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
   6354  */
   6355 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
   6356 {
   6357 	struct wpa_global *global;
   6358 	int ret, i;
   6359 
   6360 	if (params == NULL)
   6361 		return NULL;
   6362 
   6363 #ifdef CONFIG_DRIVER_NDIS
   6364 	{
   6365 		void driver_ndis_init_ops(void);
   6366 		driver_ndis_init_ops();
   6367 	}
   6368 #endif /* CONFIG_DRIVER_NDIS */
   6369 
   6370 #ifndef CONFIG_NO_WPA_MSG
   6371 	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
   6372 #endif /* CONFIG_NO_WPA_MSG */
   6373 
   6374 	if (params->wpa_debug_file_path)
   6375 		wpa_debug_open_file(params->wpa_debug_file_path);
   6376 	else
   6377 		wpa_debug_setup_stdout();
   6378 	if (params->wpa_debug_syslog)
   6379 		wpa_debug_open_syslog();
   6380 	if (params->wpa_debug_tracing) {
   6381 		ret = wpa_debug_open_linux_tracing();
   6382 		if (ret) {
   6383 			wpa_printf(MSG_ERROR,
   6384 				   "Failed to enable trace logging");
   6385 			return NULL;
   6386 		}
   6387 	}
   6388 
   6389 	ret = eap_register_methods();
   6390 	if (ret) {
   6391 		wpa_printf(MSG_ERROR, "Failed to register EAP methods");
   6392 		if (ret == -2)
   6393 			wpa_printf(MSG_ERROR, "Two or more EAP methods used "
   6394 				   "the same EAP type.");
   6395 		return NULL;
   6396 	}
   6397 
   6398 	global = os_zalloc(sizeof(*global));
   6399 	if (global == NULL)
   6400 		return NULL;
   6401 	dl_list_init(&global->p2p_srv_bonjour);
   6402 	dl_list_init(&global->p2p_srv_upnp);
   6403 	global->params.daemonize = params->daemonize;
   6404 	global->params.wait_for_monitor = params->wait_for_monitor;
   6405 	global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
   6406 	if (params->pid_file)
   6407 		global->params.pid_file = os_strdup(params->pid_file);
   6408 	if (params->ctrl_interface)
   6409 		global->params.ctrl_interface =
   6410 			os_strdup(params->ctrl_interface);
   6411 	if (params->ctrl_interface_group)
   6412 		global->params.ctrl_interface_group =
   6413 			os_strdup(params->ctrl_interface_group);
   6414 	if (params->override_driver)
   6415 		global->params.override_driver =
   6416 			os_strdup(params->override_driver);
   6417 	if (params->override_ctrl_interface)
   6418 		global->params.override_ctrl_interface =
   6419 			os_strdup(params->override_ctrl_interface);
   6420 #ifdef CONFIG_MATCH_IFACE
   6421 	global->params.match_iface_count = params->match_iface_count;
   6422 	if (params->match_iface_count) {
   6423 		global->params.match_ifaces =
   6424 			os_calloc(params->match_iface_count,
   6425 				  sizeof(struct wpa_interface));
   6426 		os_memcpy(global->params.match_ifaces,
   6427 			  params->match_ifaces,
   6428 			  params->match_iface_count *
   6429 			  sizeof(struct wpa_interface));
   6430 	}
   6431 #endif /* CONFIG_MATCH_IFACE */
   6432 #ifdef CONFIG_P2P
   6433 	if (params->conf_p2p_dev)
   6434 		global->params.conf_p2p_dev =
   6435 			os_strdup(params->conf_p2p_dev);
   6436 #endif /* CONFIG_P2P */
   6437 	wpa_debug_level = global->params.wpa_debug_level =
   6438 		params->wpa_debug_level;
   6439 	wpa_debug_show_keys = global->params.wpa_debug_show_keys =
   6440 		params->wpa_debug_show_keys;
   6441 	wpa_debug_timestamp = global->params.wpa_debug_timestamp =
   6442 		params->wpa_debug_timestamp;
   6443 
   6444 	wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
   6445 
   6446 	if (eloop_init()) {
   6447 		wpa_printf(MSG_ERROR, "Failed to initialize event loop");
   6448 		wpa_supplicant_deinit(global);
   6449 		return NULL;
   6450 	}
   6451 
   6452 	random_init(params->entropy_file);
   6453 
   6454 	global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
   6455 	if (global->ctrl_iface == NULL) {
   6456 		wpa_supplicant_deinit(global);
   6457 		return NULL;
   6458 	}
   6459 
   6460 	if (wpas_notify_supplicant_initialized(global)) {
   6461 		wpa_supplicant_deinit(global);
   6462 		return NULL;
   6463 	}
   6464 
   6465 	for (i = 0; wpa_drivers[i]; i++)
   6466 		global->drv_count++;
   6467 	if (global->drv_count == 0) {
   6468 		wpa_printf(MSG_ERROR, "No drivers enabled");
   6469 		wpa_supplicant_deinit(global);
   6470 		return NULL;
   6471 	}
   6472 	global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
   6473 	if (global->drv_priv == NULL) {
   6474 		wpa_supplicant_deinit(global);
   6475 		return NULL;
   6476 	}
   6477 
   6478 #ifdef CONFIG_WIFI_DISPLAY
   6479 	if (wifi_display_init(global) < 0) {
   6480 		wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
   6481 		wpa_supplicant_deinit(global);
   6482 		return NULL;
   6483 	}
   6484 #endif /* CONFIG_WIFI_DISPLAY */
   6485 
   6486 	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
   6487 			       wpas_periodic, global, NULL);
   6488 
   6489 	return global;
   6490 }
   6491 
   6492 
   6493 /**
   6494  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
   6495  * @global: Pointer to global data from wpa_supplicant_init()
   6496  * Returns: 0 after successful event loop run, -1 on failure
   6497  *
   6498  * This function starts the main event loop and continues running as long as
   6499  * there are any remaining events. In most cases, this function is running as
   6500  * long as the %wpa_supplicant process in still in use.
   6501  */
   6502 int wpa_supplicant_run(struct wpa_global *global)
   6503 {
   6504 	struct wpa_supplicant *wpa_s;
   6505 
   6506 	if (global->params.daemonize &&
   6507 	    (wpa_supplicant_daemon(global->params.pid_file) ||
   6508 	     eloop_sock_requeue()))
   6509 		return -1;
   6510 
   6511 #ifdef CONFIG_MATCH_IFACE
   6512 	if (wpa_supplicant_match_existing(global))
   6513 		return -1;
   6514 #endif
   6515 
   6516 	if (global->params.wait_for_monitor) {
   6517 		for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
   6518 			if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
   6519 				wpa_supplicant_ctrl_iface_wait(
   6520 					wpa_s->ctrl_iface);
   6521 	}
   6522 
   6523 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
   6524 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
   6525 
   6526 	eloop_run();
   6527 
   6528 	return 0;
   6529 }
   6530 
   6531 
   6532 /**
   6533  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
   6534  * @global: Pointer to global data from wpa_supplicant_init()
   6535  *
   6536  * This function is called to deinitialize %wpa_supplicant and to free all
   6537  * allocated resources. Remaining network interfaces will also be removed.
   6538  */
   6539 void wpa_supplicant_deinit(struct wpa_global *global)
   6540 {
   6541 	int i;
   6542 
   6543 	if (global == NULL)
   6544 		return;
   6545 
   6546 	eloop_cancel_timeout(wpas_periodic, global, NULL);
   6547 
   6548 #ifdef CONFIG_WIFI_DISPLAY
   6549 	wifi_display_deinit(global);
   6550 #endif /* CONFIG_WIFI_DISPLAY */
   6551 
   6552 	while (global->ifaces)
   6553 		wpa_supplicant_remove_iface(global, global->ifaces, 1);
   6554 
   6555 	if (global->ctrl_iface)
   6556 		wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
   6557 
   6558 	wpas_notify_supplicant_deinitialized(global);
   6559 
   6560 	eap_peer_unregister_methods();
   6561 #ifdef CONFIG_AP
   6562 	eap_server_unregister_methods();
   6563 #endif /* CONFIG_AP */
   6564 
   6565 	for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
   6566 		if (!global->drv_priv[i])
   6567 			continue;
   6568 		wpa_drivers[i]->global_deinit(global->drv_priv[i]);
   6569 	}
   6570 	os_free(global->drv_priv);
   6571 
   6572 	random_deinit();
   6573 
   6574 	eloop_destroy();
   6575 
   6576 	if (global->params.pid_file) {
   6577 		os_daemonize_terminate(global->params.pid_file);
   6578 		os_free(global->params.pid_file);
   6579 	}
   6580 	os_free(global->params.ctrl_interface);
   6581 	os_free(global->params.ctrl_interface_group);
   6582 	os_free(global->params.override_driver);
   6583 	os_free(global->params.override_ctrl_interface);
   6584 #ifdef CONFIG_MATCH_IFACE
   6585 	os_free(global->params.match_ifaces);
   6586 #endif /* CONFIG_MATCH_IFACE */
   6587 #ifdef CONFIG_P2P
   6588 	os_free(global->params.conf_p2p_dev);
   6589 #endif /* CONFIG_P2P */
   6590 
   6591 	os_free(global->p2p_disallow_freq.range);
   6592 	os_free(global->p2p_go_avoid_freq.range);
   6593 	os_free(global->add_psk);
   6594 
   6595 	os_free(global);
   6596 	wpa_debug_close_syslog();
   6597 	wpa_debug_close_file();
   6598 	wpa_debug_close_linux_tracing();
   6599 }
   6600 
   6601 
   6602 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
   6603 {
   6604 	if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
   6605 	    wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
   6606 		char country[3];
   6607 		country[0] = wpa_s->conf->country[0];
   6608 		country[1] = wpa_s->conf->country[1];
   6609 		country[2] = '\0';
   6610 		if (wpa_drv_set_country(wpa_s, country) < 0) {
   6611 			wpa_printf(MSG_ERROR, "Failed to set country code "
   6612 				   "'%s'", country);
   6613 		}
   6614 	}
   6615 
   6616 	if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
   6617 		wpas_init_ext_pw(wpa_s);
   6618 
   6619 	if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
   6620 		wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
   6621 
   6622 	if (wpa_s->conf->changed_parameters & CFG_CHANGED_WOWLAN_TRIGGERS) {
   6623 		struct wpa_driver_capa capa;
   6624 		int res = wpa_drv_get_capa(wpa_s, &capa);
   6625 
   6626 		if (res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
   6627 			wpa_printf(MSG_ERROR,
   6628 				   "Failed to update wowlan_triggers to '%s'",
   6629 				   wpa_s->conf->wowlan_triggers);
   6630 	}
   6631 
   6632 #ifdef CONFIG_WPS
   6633 	wpas_wps_update_config(wpa_s);
   6634 #endif /* CONFIG_WPS */
   6635 	wpas_p2p_update_config(wpa_s);
   6636 	wpa_s->conf->changed_parameters = 0;
   6637 }
   6638 
   6639 
   6640 void add_freq(int *freqs, int *num_freqs, int freq)
   6641 {
   6642 	int i;
   6643 
   6644 	for (i = 0; i < *num_freqs; i++) {
   6645 		if (freqs[i] == freq)
   6646 			return;
   6647 	}
   6648 
   6649 	freqs[*num_freqs] = freq;
   6650 	(*num_freqs)++;
   6651 }
   6652 
   6653 
   6654 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
   6655 {
   6656 	struct wpa_bss *bss, *cbss;
   6657 	const int max_freqs = 10;
   6658 	int *freqs;
   6659 	int num_freqs = 0;
   6660 
   6661 	freqs = os_calloc(max_freqs + 1, sizeof(int));
   6662 	if (freqs == NULL)
   6663 		return NULL;
   6664 
   6665 	cbss = wpa_s->current_bss;
   6666 
   6667 	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
   6668 		if (bss == cbss)
   6669 			continue;
   6670 		if (bss->ssid_len == cbss->ssid_len &&
   6671 		    os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
   6672 		    wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
   6673 			add_freq(freqs, &num_freqs, bss->freq);
   6674 			if (num_freqs == max_freqs)
   6675 				break;
   6676 		}
   6677 	}
   6678 
   6679 	if (num_freqs == 0) {
   6680 		os_free(freqs);
   6681 		freqs = NULL;
   6682 	}
   6683 
   6684 	return freqs;
   6685 }
   6686 
   6687 
   6688 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
   6689 {
   6690 	int timeout;
   6691 	int count;
   6692 	int *freqs = NULL;
   6693 
   6694 	wpas_connect_work_done(wpa_s);
   6695 
   6696 	/*
   6697 	 * Remove possible authentication timeout since the connection failed.
   6698 	 */
   6699 	eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
   6700 
   6701 	/*
   6702 	 * There is no point in blacklisting the AP if this event is
   6703 	 * generated based on local request to disconnect.
   6704 	 */
   6705 	if (wpa_s->own_disconnect_req) {
   6706 		wpa_s->own_disconnect_req = 0;
   6707 		wpa_dbg(wpa_s, MSG_DEBUG,
   6708 			"Ignore connection failure due to local request to disconnect");
   6709 		return;
   6710 	}
   6711 	if (wpa_s->disconnected) {
   6712 		wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
   6713 			"indication since interface has been put into "
   6714 			"disconnected state");
   6715 		return;
   6716 	}
   6717 	if (wpa_s->auto_reconnect_disabled) {
   6718 		wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
   6719 			"indication since auto connect is disabled");
   6720 		return;
   6721 	}
   6722 
   6723 	/*
   6724 	 * Add the failed BSSID into the blacklist and speed up next scan
   6725 	 * attempt if there could be other APs that could accept association.
   6726 	 * The current blacklist count indicates how many times we have tried
   6727 	 * connecting to this AP and multiple attempts mean that other APs are
   6728 	 * either not available or has already been tried, so that we can start
   6729 	 * increasing the delay here to avoid constant scanning.
   6730 	 */
   6731 	count = wpa_blacklist_add(wpa_s, bssid);
   6732 	if (count == 1 && wpa_s->current_bss) {
   6733 		/*
   6734 		 * This BSS was not in the blacklist before. If there is
   6735 		 * another BSS available for the same ESS, we should try that
   6736 		 * next. Otherwise, we may as well try this one once more
   6737 		 * before allowing other, likely worse, ESSes to be considered.
   6738 		 */
   6739 		freqs = get_bss_freqs_in_ess(wpa_s);
   6740 		if (freqs) {
   6741 			wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
   6742 				"has been seen; try it next");
   6743 			wpa_blacklist_add(wpa_s, bssid);
   6744 			/*
   6745 			 * On the next scan, go through only the known channels
   6746 			 * used in this ESS based on previous scans to speed up
   6747 			 * common load balancing use case.
   6748 			 */
   6749 			os_free(wpa_s->next_scan_freqs);
   6750 			wpa_s->next_scan_freqs = freqs;
   6751 		}
   6752 	}
   6753 
   6754 	/*
   6755 	 * Add previous failure count in case the temporary blacklist was
   6756 	 * cleared due to no other BSSes being available.
   6757 	 */
   6758 	count += wpa_s->extra_blacklist_count;
   6759 
   6760 	if (count > 3 && wpa_s->current_ssid) {
   6761 		wpa_printf(MSG_DEBUG, "Continuous association failures - "
   6762 			   "consider temporary network disabling");
   6763 		wpas_auth_failed(wpa_s, "CONN_FAILED");
   6764 	}
   6765 
   6766 	switch (count) {
   6767 	case 1:
   6768 		timeout = 100;
   6769 		break;
   6770 	case 2:
   6771 		timeout = 500;
   6772 		break;
   6773 	case 3:
   6774 		timeout = 1000;
   6775 		break;
   6776 	case 4:
   6777 		timeout = 5000;
   6778 		break;
   6779 	default:
   6780 		timeout = 10000;
   6781 		break;
   6782 	}
   6783 
   6784 	wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
   6785 		"ms", count, timeout);
   6786 
   6787 	/*
   6788 	 * TODO: if more than one possible AP is available in scan results,
   6789 	 * could try the other ones before requesting a new scan.
   6790 	 */
   6791 
   6792 	/* speed up the connection attempt with normal scan */
   6793 	wpa_s->normal_scans = 0;
   6794 	wpa_supplicant_req_scan(wpa_s, timeout / 1000,
   6795 				1000 * (timeout % 1000));
   6796 }
   6797 
   6798 
   6799 #ifdef CONFIG_FILS
   6800 void fils_connection_failure(struct wpa_supplicant *wpa_s)
   6801 {
   6802 	struct wpa_ssid *ssid = wpa_s->current_ssid;
   6803 	const u8 *realm, *username, *rrk;
   6804 	size_t realm_len, username_len, rrk_len;
   6805 	u16 next_seq_num;
   6806 
   6807 	if (!ssid || !ssid->eap.erp || !wpa_key_mgmt_fils(ssid->key_mgmt) ||
   6808 	    eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
   6809 				  &username, &username_len,
   6810 				  &realm, &realm_len, &next_seq_num,
   6811 				  &rrk, &rrk_len) != 0 ||
   6812 	    !realm)
   6813 		return;
   6814 
   6815 	wpa_hexdump_ascii(MSG_DEBUG,
   6816 			  "FILS: Store last connection failure realm",
   6817 			  realm, realm_len);
   6818 	os_free(wpa_s->last_con_fail_realm);
   6819 	wpa_s->last_con_fail_realm = os_malloc(realm_len);
   6820 	if (wpa_s->last_con_fail_realm) {
   6821 		wpa_s->last_con_fail_realm_len = realm_len;
   6822 		os_memcpy(wpa_s->last_con_fail_realm, realm, realm_len);
   6823 	}
   6824 }
   6825 #endif /* CONFIG_FILS */
   6826 
   6827 
   6828 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
   6829 {
   6830 	return wpa_s->conf->ap_scan == 2 ||
   6831 		(wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
   6832 }
   6833 
   6834 
   6835 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW) || defined (CONFIG_CTRL_IFACE_HIDL)
   6836 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
   6837 					      struct wpa_ssid *ssid,
   6838 					      const char *field,
   6839 					      const char *value)
   6840 {
   6841 #ifdef IEEE8021X_EAPOL
   6842 	enum wpa_ctrl_req_type rtype;
   6843 
   6844 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
   6845 	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
   6846 			      (const u8 *) value, os_strlen(value));
   6847 
   6848 	rtype = wpa_supplicant_ctrl_req_from_string(field);
   6849 	return wpa_supplicant_ctrl_rsp_handle(wpa_s, ssid, rtype, value, strlen(value));
   6850 #else /* IEEE8021X_EAPOL */
   6851 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
   6852 	return -1;
   6853 #endif /* IEEE8021X_EAPOL */
   6854 }
   6855 
   6856 int wpa_supplicant_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
   6857 				   struct wpa_ssid *ssid,
   6858 				   enum wpa_ctrl_req_type rtype,
   6859 				   const char *value, int value_len)
   6860 {
   6861 #ifdef IEEE8021X_EAPOL
   6862 	struct eap_peer_config *eap = &ssid->eap;
   6863 	char *identity, *imsi_identity;
   6864 
   6865 	switch (rtype) {
   6866 	case WPA_CTRL_REQ_EAP_IDENTITY:
   6867 		os_free(eap->identity);
   6868 		os_free(eap->imsi_identity);
   6869 		if (value == NULL)
   6870 			return -1;
   6871 		identity = os_strchr(value, ':');
   6872 		if (identity == NULL) {
   6873 			/* plain identity */
   6874 			eap->identity = (u8 *)os_strdup(value);
   6875 			eap->identity_len = os_strlen(value);
   6876 		} else {
   6877 			/* have both plain identity and encrypted identity */
   6878 			imsi_identity = value;
   6879 			*identity++ = '\0';
   6880 			/* plain identity */
   6881 			eap->imsi_identity = (u8 *)dup_binstr(imsi_identity, strlen(imsi_identity));
   6882 			eap->imsi_identity_len = strlen(imsi_identity);
   6883 			/* encrypted identity */
   6884 			eap->identity = (u8 *)dup_binstr(identity,
   6885 							 value_len - strlen(imsi_identity) - 1);
   6886 			eap->identity_len = value_len - strlen(imsi_identity) - 1;
   6887 		}
   6888 		eap->pending_req_identity = 0;
   6889 		if (ssid == wpa_s->current_ssid)
   6890 			wpa_s->reassociate = 1;
   6891 		break;
   6892 	case WPA_CTRL_REQ_EAP_PASSWORD:
   6893 		bin_clear_free(eap->password, eap->password_len);
   6894 		eap->password = (u8 *) os_strdup(value);
   6895 		eap->password_len = value_len;
   6896 		eap->pending_req_password = 0;
   6897 		if (ssid == wpa_s->current_ssid)
   6898 			wpa_s->reassociate = 1;
   6899 		break;
   6900 	case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
   6901 		bin_clear_free(eap->new_password, eap->new_password_len);
   6902 		eap->new_password = (u8 *) os_strdup(value);
   6903 		eap->new_password_len = value_len;
   6904 		eap->pending_req_new_password = 0;
   6905 		if (ssid == wpa_s->current_ssid)
   6906 			wpa_s->reassociate = 1;
   6907 		break;
   6908 	case WPA_CTRL_REQ_EAP_PIN:
   6909 		str_clear_free(eap->pin);
   6910 		eap->pin = os_strdup(value);
   6911 		eap->pending_req_pin = 0;
   6912 		if (ssid == wpa_s->current_ssid)
   6913 			wpa_s->reassociate = 1;
   6914 		break;
   6915 	case WPA_CTRL_REQ_EAP_OTP:
   6916 		bin_clear_free(eap->otp, eap->otp_len);
   6917 		eap->otp = (u8 *) os_strdup(value);
   6918 		eap->otp_len = value_len;
   6919 		os_free(eap->pending_req_otp);
   6920 		eap->pending_req_otp = NULL;
   6921 		eap->pending_req_otp_len = 0;
   6922 		break;
   6923 	case WPA_CTRL_REQ_EAP_PASSPHRASE:
   6924 		str_clear_free(eap->private_key_passwd);
   6925 		eap->private_key_passwd = os_strdup(value);
   6926 		eap->pending_req_passphrase = 0;
   6927 		if (ssid == wpa_s->current_ssid)
   6928 			wpa_s->reassociate = 1;
   6929 		break;
   6930 	case WPA_CTRL_REQ_SIM:
   6931 		str_clear_free(eap->external_sim_resp);
   6932 		eap->external_sim_resp = os_strdup(value);
   6933 		eap->pending_req_sim = 0;
   6934 		break;
   6935 	case WPA_CTRL_REQ_PSK_PASSPHRASE:
   6936 		if (wpa_config_set(ssid, "psk", value, 0) < 0)
   6937 			return -1;
   6938 		ssid->mem_only_psk = 1;
   6939 		if (ssid->passphrase)
   6940 			wpa_config_update_psk(ssid);
   6941 		if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
   6942 			wpa_supplicant_req_scan(wpa_s, 0, 0);
   6943 		break;
   6944 	case WPA_CTRL_REQ_EXT_CERT_CHECK:
   6945 		if (eap->pending_ext_cert_check != PENDING_CHECK)
   6946 			return -1;
   6947 		if (os_strcmp(value, "good") == 0)
   6948 			eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
   6949 		else if (os_strcmp(value, "bad") == 0)
   6950 			eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
   6951 		else
   6952 			return -1;
   6953 		break;
   6954 	default:
   6955 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown type %d", rtype);
   6956 		return -1;
   6957 	}
   6958 
   6959 	return 0;
   6960 #else /* IEEE8021X_EAPOL */
   6961 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
   6962 	return -1;
   6963 #endif /* IEEE8021X_EAPOL */
   6964 }
   6965 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW || CONFIG_CTRL_IFACE_HIDL */
   6966 
   6967 
   6968 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
   6969 {
   6970 	int i;
   6971 	unsigned int drv_enc;
   6972 
   6973 	if (wpa_s->p2p_mgmt)
   6974 		return 1; /* no normal network profiles on p2p_mgmt interface */
   6975 
   6976 	if (ssid == NULL)
   6977 		return 1;
   6978 
   6979 	if (ssid->disabled)
   6980 		return 1;
   6981 
   6982 	if (wpa_s->drv_capa_known)
   6983 		drv_enc = wpa_s->drv_enc;
   6984 	else
   6985 		drv_enc = (unsigned int) -1;
   6986 
   6987 	for (i = 0; i < NUM_WEP_KEYS; i++) {
   6988 		size_t len = ssid->wep_key_len[i];
   6989 		if (len == 0)
   6990 			continue;
   6991 		if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
   6992 			continue;
   6993 		if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
   6994 			continue;
   6995 		if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
   6996 			continue;
   6997 		return 1; /* invalid WEP key */
   6998 	}
   6999 
   7000 	if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
   7001 	    (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
   7002 	    !(wpa_key_mgmt_sae(ssid->key_mgmt) && ssid->sae_password) &&
   7003 	    !ssid->mem_only_psk)
   7004 		return 1;
   7005 
   7006 	return 0;
   7007 }
   7008 
   7009 
   7010 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
   7011 {
   7012 #ifdef CONFIG_IEEE80211W
   7013 	if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
   7014 		if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
   7015 		    !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
   7016 			/*
   7017 			 * Driver does not support BIP -- ignore pmf=1 default
   7018 			 * since the connection with PMF would fail and the
   7019 			 * configuration does not require PMF to be enabled.
   7020 			 */
   7021 			return NO_MGMT_FRAME_PROTECTION;
   7022 		}
   7023 
   7024 		if (ssid &&
   7025 		    (ssid->key_mgmt &
   7026 		     ~(WPA_KEY_MGMT_NONE | WPA_KEY_MGMT_WPS |
   7027 		       WPA_KEY_MGMT_IEEE8021X_NO_WPA)) == 0) {
   7028 			/*
   7029 			 * Do not use the default PMF value for non-RSN networks
   7030 			 * since PMF is available only with RSN and pmf=2
   7031 			 * configuration would otherwise prevent connections to
   7032 			 * all open networks.
   7033 			 */
   7034 			return NO_MGMT_FRAME_PROTECTION;
   7035 		}
   7036 
   7037 		return wpa_s->conf->pmf;
   7038 	}
   7039 
   7040 	return ssid->ieee80211w;
   7041 #else /* CONFIG_IEEE80211W */
   7042 	return NO_MGMT_FRAME_PROTECTION;
   7043 #endif /* CONFIG_IEEE80211W */
   7044 }
   7045 
   7046 
   7047 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
   7048 {
   7049 	if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
   7050 		return 1;
   7051 	if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
   7052 		return 0;
   7053 	return -1;
   7054 }
   7055 
   7056 
   7057 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
   7058 {
   7059 	struct wpa_ssid *ssid = wpa_s->current_ssid;
   7060 	int dur;
   7061 	struct os_reltime now;
   7062 
   7063 	if (ssid == NULL) {
   7064 		wpa_printf(MSG_DEBUG, "Authentication failure but no known "
   7065 			   "SSID block");
   7066 		return;
   7067 	}
   7068 
   7069 	if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
   7070 		return;
   7071 
   7072 	ssid->auth_failures++;
   7073 
   7074 #ifdef CONFIG_P2P
   7075 	if (ssid->p2p_group &&
   7076 	    (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
   7077 		/*
   7078 		 * Skip the wait time since there is a short timeout on the
   7079 		 * connection to a P2P group.
   7080 		 */
   7081 		return;
   7082 	}
   7083 #endif /* CONFIG_P2P */
   7084 
   7085 	if (ssid->auth_failures > 50)
   7086 		dur = 300;
   7087 	else if (ssid->auth_failures > 10)
   7088 		dur = 120;
   7089 	else if (ssid->auth_failures > 5)
   7090 		dur = 90;
   7091 	else if (ssid->auth_failures > 3)
   7092 		dur = 60;
   7093 	else if (ssid->auth_failures > 2)
   7094 		dur = 30;
   7095 	else if (ssid->auth_failures > 1)
   7096 		dur = 20;
   7097 	else
   7098 		dur = 10;
   7099 
   7100 	if (ssid->auth_failures > 1 &&
   7101 	    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
   7102 		dur += os_random() % (ssid->auth_failures * 10);
   7103 
   7104 	os_get_reltime(&now);
   7105 	if (now.sec + dur <= ssid->disabled_until.sec)
   7106 		return;
   7107 
   7108 	ssid->disabled_until.sec = now.sec + dur;
   7109 
   7110 	wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
   7111 		"id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
   7112 		ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
   7113 		ssid->auth_failures, dur, reason);
   7114 }
   7115 
   7116 
   7117 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
   7118 			      struct wpa_ssid *ssid, int clear_failures)
   7119 {
   7120 	if (ssid == NULL)
   7121 		return;
   7122 
   7123 	if (ssid->disabled_until.sec) {
   7124 		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
   7125 			"id=%d ssid=\"%s\"",
   7126 			ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
   7127 	}
   7128 	ssid->disabled_until.sec = 0;
   7129 	ssid->disabled_until.usec = 0;
   7130 	if (clear_failures)
   7131 		ssid->auth_failures = 0;
   7132 }
   7133 
   7134 
   7135 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
   7136 {
   7137 	size_t i;
   7138 
   7139 	if (wpa_s->disallow_aps_bssid == NULL)
   7140 		return 0;
   7141 
   7142 	for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
   7143 		if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
   7144 			      bssid, ETH_ALEN) == 0)
   7145 			return 1;
   7146 	}
   7147 
   7148 	return 0;
   7149 }
   7150 
   7151 
   7152 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
   7153 		    size_t ssid_len)
   7154 {
   7155 	size_t i;
   7156 
   7157 	if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
   7158 		return 0;
   7159 
   7160 	for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
   7161 		struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
   7162 		if (ssid_len == s->ssid_len &&
   7163 		    os_memcmp(ssid, s->ssid, ssid_len) == 0)
   7164 			return 1;
   7165 	}
   7166 
   7167 	return 0;
   7168 }
   7169 
   7170 
   7171 /**
   7172  * wpas_request_connection - Request a new connection
   7173  * @wpa_s: Pointer to the network interface
   7174  *
   7175  * This function is used to request a new connection to be found. It will mark
   7176  * the interface to allow reassociation and request a new scan to find a
   7177  * suitable network to connect to.
   7178  */
   7179 void wpas_request_connection(struct wpa_supplicant *wpa_s)
   7180 {
   7181 	wpa_s->normal_scans = 0;
   7182 	wpa_s->scan_req = NORMAL_SCAN_REQ;
   7183 	wpa_supplicant_reinit_autoscan(wpa_s);
   7184 	wpa_s->extra_blacklist_count = 0;
   7185 	wpa_s->disconnected = 0;
   7186 	wpa_s->reassociate = 1;
   7187 	wpa_s->last_owe_group = 0;
   7188 
   7189 	if (wpa_supplicant_fast_associate(wpa_s) != 1)
   7190 		wpa_supplicant_req_scan(wpa_s, 0, 0);
   7191 	else
   7192 		wpa_s->reattach = 0;
   7193 }
   7194 
   7195 
   7196 /**
   7197  * wpas_request_disconnection - Request disconnection
   7198  * @wpa_s: Pointer to the network interface
   7199  *
   7200  * This function is used to request disconnection from the currently connected
   7201  * network. This will stop any ongoing scans and initiate deauthentication.
   7202  */
   7203 void wpas_request_disconnection(struct wpa_supplicant *wpa_s)
   7204 {
   7205 #ifdef CONFIG_SME
   7206 	wpa_s->sme.prev_bssid_set = 0;
   7207 #endif /* CONFIG_SME */
   7208 	wpa_s->reassociate = 0;
   7209 	wpa_s->disconnected = 1;
   7210 	wpa_supplicant_cancel_sched_scan(wpa_s);
   7211 	wpa_supplicant_cancel_scan(wpa_s);
   7212 	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
   7213 	eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
   7214 	radio_remove_works(wpa_s, "connect", 0);
   7215 	radio_remove_works(wpa_s, "sme-connect", 0);
   7216 }
   7217 
   7218 
   7219 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
   7220 		    struct wpa_used_freq_data *freqs_data,
   7221 		    unsigned int len)
   7222 {
   7223 	unsigned int i;
   7224 
   7225 	wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
   7226 		len, title);
   7227 	for (i = 0; i < len; i++) {
   7228 		struct wpa_used_freq_data *cur = &freqs_data[i];
   7229 		wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
   7230 			i, cur->freq, cur->flags);
   7231 	}
   7232 }
   7233 
   7234 
   7235 /*
   7236  * Find the operating frequencies of any of the virtual interfaces that
   7237  * are using the same radio as the current interface, and in addition, get
   7238  * information about the interface types that are using the frequency.
   7239  */
   7240 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
   7241 				struct wpa_used_freq_data *freqs_data,
   7242 				unsigned int len)
   7243 {
   7244 	struct wpa_supplicant *ifs;
   7245 	u8 bssid[ETH_ALEN];
   7246 	int freq;
   7247 	unsigned int idx = 0, i;
   7248 
   7249 	wpa_dbg(wpa_s, MSG_DEBUG,
   7250 		"Determining shared radio frequencies (max len %u)", len);
   7251 	os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
   7252 
   7253 	dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
   7254 			 radio_list) {
   7255 		if (idx == len)
   7256 			break;
   7257 
   7258 		if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
   7259 			continue;
   7260 
   7261 		if (ifs->current_ssid->mode == WPAS_MODE_AP ||
   7262 		    ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
   7263 		    ifs->current_ssid->mode == WPAS_MODE_MESH)
   7264 			freq = ifs->current_ssid->frequency;
   7265 		else if (wpa_drv_get_bssid(ifs, bssid) == 0)
   7266 			freq = ifs->assoc_freq;
   7267 		else
   7268 			continue;
   7269 
   7270 		/* Hold only distinct freqs */
   7271 		for (i = 0; i < idx; i++)
   7272 			if (freqs_data[i].freq == freq)
   7273 				break;
   7274 
   7275 		if (i == idx)
   7276 			freqs_data[idx++].freq = freq;
   7277 
   7278 		if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
   7279 			freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
   7280 				WPA_FREQ_USED_BY_P2P_CLIENT :
   7281 				WPA_FREQ_USED_BY_INFRA_STATION;
   7282 		}
   7283 	}
   7284 
   7285 	dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
   7286 	return idx;
   7287 }
   7288 
   7289 
   7290 /*
   7291  * Find the operating frequencies of any of the virtual interfaces that
   7292  * are using the same radio as the current interface.
   7293  */
   7294 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
   7295 			   int *freq_array, unsigned int len)
   7296 {
   7297 	struct wpa_used_freq_data *freqs_data;
   7298 	int num, i;
   7299 
   7300 	os_memset(freq_array, 0, sizeof(int) * len);
   7301 
   7302 	freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
   7303 	if (!freqs_data)
   7304 		return -1;
   7305 
   7306 	num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
   7307 	for (i = 0; i < num; i++)
   7308 		freq_array[i] = freqs_data[i].freq;
   7309 
   7310 	os_free(freqs_data);
   7311 
   7312 	return num;
   7313 }
   7314 
   7315 
   7316 struct wpa_supplicant *
   7317 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
   7318 {
   7319 	switch (frame) {
   7320 #ifdef CONFIG_P2P
   7321 	case VENDOR_ELEM_PROBE_REQ_P2P:
   7322 	case VENDOR_ELEM_PROBE_RESP_P2P:
   7323 	case VENDOR_ELEM_PROBE_RESP_P2P_GO:
   7324 	case VENDOR_ELEM_BEACON_P2P_GO:
   7325 	case VENDOR_ELEM_P2P_PD_REQ:
   7326 	case VENDOR_ELEM_P2P_PD_RESP:
   7327 	case VENDOR_ELEM_P2P_GO_NEG_REQ:
   7328 	case VENDOR_ELEM_P2P_GO_NEG_RESP:
   7329 	case VENDOR_ELEM_P2P_GO_NEG_CONF:
   7330 	case VENDOR_ELEM_P2P_INV_REQ:
   7331 	case VENDOR_ELEM_P2P_INV_RESP:
   7332 	case VENDOR_ELEM_P2P_ASSOC_REQ:
   7333 	case VENDOR_ELEM_P2P_ASSOC_RESP:
   7334 		return wpa_s->p2pdev;
   7335 #endif /* CONFIG_P2P */
   7336 	default:
   7337 		return wpa_s;
   7338 	}
   7339 }
   7340 
   7341 
   7342 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
   7343 {
   7344 	unsigned int i;
   7345 	char buf[30];
   7346 
   7347 	wpa_printf(MSG_DEBUG, "Update vendor elements");
   7348 
   7349 	for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
   7350 		if (wpa_s->vendor_elem[i]) {
   7351 			int res;
   7352 
   7353 			res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
   7354 			if (!os_snprintf_error(sizeof(buf), res)) {
   7355 				wpa_hexdump_buf(MSG_DEBUG, buf,
   7356 						wpa_s->vendor_elem[i]);
   7357 			}
   7358 		}
   7359 	}
   7360 
   7361 #ifdef CONFIG_P2P
   7362 	if (wpa_s->parent == wpa_s &&
   7363 	    wpa_s->global->p2p &&
   7364 	    !wpa_s->global->p2p_disabled)
   7365 		p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
   7366 #endif /* CONFIG_P2P */
   7367 }
   7368 
   7369 
   7370 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
   7371 			    const u8 *elem, size_t len)
   7372 {
   7373 	u8 *ie, *end;
   7374 
   7375 	ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
   7376 	end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
   7377 
   7378 	for (; ie + 1 < end; ie += 2 + ie[1]) {
   7379 		if (ie + len > end)
   7380 			break;
   7381 		if (os_memcmp(ie, elem, len) != 0)
   7382 			continue;
   7383 
   7384 		if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
   7385 			wpabuf_free(wpa_s->vendor_elem[frame]);
   7386 			wpa_s->vendor_elem[frame] = NULL;
   7387 		} else {
   7388 			os_memmove(ie, ie + len, end - (ie + len));
   7389 			wpa_s->vendor_elem[frame]->used -= len;
   7390 		}
   7391 		wpas_vendor_elem_update(wpa_s);
   7392 		return 0;
   7393 	}
   7394 
   7395 	return -1;
   7396 }
   7397 
   7398 
   7399 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
   7400 				   u16 num_modes, enum hostapd_hw_mode mode)
   7401 {
   7402 	u16 i;
   7403 
   7404 	for (i = 0; i < num_modes; i++) {
   7405 		if (modes[i].mode == mode)
   7406 			return &modes[i];
   7407 	}
   7408 
   7409 	return NULL;
   7410 }
   7411 
   7412 
   7413 static struct
   7414 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
   7415 						 const u8 *bssid)
   7416 {
   7417 	struct wpa_bss_tmp_disallowed *bss;
   7418 
   7419 	dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
   7420 			 struct wpa_bss_tmp_disallowed, list) {
   7421 		if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
   7422 			return bss;
   7423 	}
   7424 
   7425 	return NULL;
   7426 }
   7427 
   7428 
   7429 static int wpa_set_driver_tmp_disallow_list(struct wpa_supplicant *wpa_s)
   7430 {
   7431 	struct wpa_bss_tmp_disallowed *tmp;
   7432 	unsigned int num_bssid = 0;
   7433 	u8 *bssids;
   7434 	int ret;
   7435 
   7436 	bssids = os_malloc(dl_list_len(&wpa_s->bss_tmp_disallowed) * ETH_ALEN);
   7437 	if (!bssids)
   7438 		return -1;
   7439 	dl_list_for_each(tmp, &wpa_s->bss_tmp_disallowed,
   7440 			 struct wpa_bss_tmp_disallowed, list) {
   7441 		os_memcpy(&bssids[num_bssid * ETH_ALEN], tmp->bssid,
   7442 			  ETH_ALEN);
   7443 		num_bssid++;
   7444 	}
   7445 	ret = wpa_drv_set_bssid_blacklist(wpa_s, num_bssid, bssids);
   7446 	os_free(bssids);
   7447 	return ret;
   7448 }
   7449 
   7450 
   7451 static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx)
   7452 {
   7453 	struct wpa_supplicant *wpa_s = eloop_ctx;
   7454 	struct wpa_bss_tmp_disallowed *tmp, *bss = timeout_ctx;
   7455 
   7456 	/* Make sure the bss is not already freed */
   7457 	dl_list_for_each(tmp, &wpa_s->bss_tmp_disallowed,
   7458 			 struct wpa_bss_tmp_disallowed, list) {
   7459 		if (bss == tmp) {
   7460 			dl_list_del(&tmp->list);
   7461 			os_free(tmp);
   7462 			wpa_set_driver_tmp_disallow_list(wpa_s);
   7463 			break;
   7464 		}
   7465 	}
   7466 }
   7467 
   7468 
   7469 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
   7470 			  unsigned int sec, int rssi_threshold)
   7471 {
   7472 	struct wpa_bss_tmp_disallowed *bss;
   7473 
   7474 	bss = wpas_get_disallowed_bss(wpa_s, bssid);
   7475 	if (bss) {
   7476 		eloop_cancel_timeout(wpa_bss_tmp_disallow_timeout, wpa_s, bss);
   7477 		goto finish;
   7478 	}
   7479 
   7480 	bss = os_malloc(sizeof(*bss));
   7481 	if (!bss) {
   7482 		wpa_printf(MSG_DEBUG,
   7483 			   "Failed to allocate memory for temp disallow BSS");
   7484 		return;
   7485 	}
   7486 
   7487 	os_memcpy(bss->bssid, bssid, ETH_ALEN);
   7488 	dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
   7489 	wpa_set_driver_tmp_disallow_list(wpa_s);
   7490 
   7491 finish:
   7492 	bss->rssi_threshold = rssi_threshold;
   7493 	eloop_register_timeout(sec, 0, wpa_bss_tmp_disallow_timeout,
   7494 			       wpa_s, bss);
   7495 }
   7496 
   7497 
   7498 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s,
   7499 			      struct wpa_bss *bss)
   7500 {
   7501 	struct wpa_bss_tmp_disallowed *disallowed = NULL, *tmp, *prev;
   7502 
   7503 	dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
   7504 			 struct wpa_bss_tmp_disallowed, list) {
   7505 		if (os_memcmp(bss->bssid, tmp->bssid, ETH_ALEN) == 0) {
   7506 			disallowed = tmp;
   7507 			break;
   7508 		}
   7509 	}
   7510 	if (!disallowed)
   7511 		return 0;
   7512 
   7513 	if (disallowed->rssi_threshold != 0 &&
   7514 	    bss->level > disallowed->rssi_threshold)
   7515 		return 0;
   7516 
   7517 	return 1;
   7518 }
   7519