1 /* 2 * wpa_supplicant - WNM 3 * Copyright (c) 2011-2013, Qualcomm Atheros, Inc. 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "common/ieee802_11_defs.h" 13 #include "common/ieee802_11_common.h" 14 #include "common/wpa_ctrl.h" 15 #include "rsn_supp/wpa.h" 16 #include "wpa_supplicant_i.h" 17 #include "driver_i.h" 18 #include "scan.h" 19 #include "ctrl_iface.h" 20 #include "bss.h" 21 #include "wnm_sta.h" 22 #include "hs20_supplicant.h" 23 24 #define MAX_TFS_IE_LEN 1024 25 #define WNM_MAX_NEIGHBOR_REPORT 10 26 27 #define WNM_SCAN_RESULT_AGE 2 /* 2 seconds */ 28 29 /* get the TFS IE from driver */ 30 static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf, 31 u16 *buf_len, enum wnm_oper oper) 32 { 33 wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper); 34 35 return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len); 36 } 37 38 39 /* set the TFS IE to driver */ 40 static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s, 41 const u8 *addr, const u8 *buf, u16 buf_len, 42 enum wnm_oper oper) 43 { 44 u16 len = buf_len; 45 46 wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper); 47 48 return wpa_drv_wnm_oper(wpa_s, oper, addr, (u8 *) buf, &len); 49 } 50 51 52 /* MLME-SLEEPMODE.request */ 53 int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s, 54 u8 action, u16 intval, struct wpabuf *tfs_req) 55 { 56 struct ieee80211_mgmt *mgmt; 57 int res; 58 size_t len; 59 struct wnm_sleep_element *wnmsleep_ie; 60 u8 *wnmtfs_ie; 61 u8 wnmsleep_ie_len; 62 u16 wnmtfs_ie_len; /* possibly multiple IE(s) */ 63 enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD : 64 WNM_SLEEP_TFS_REQ_IE_NONE; 65 66 wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request " 67 "action=%s to " MACSTR, 68 action == 0 ? "enter" : "exit", 69 MAC2STR(wpa_s->bssid)); 70 71 /* WNM-Sleep Mode IE */ 72 wnmsleep_ie_len = sizeof(struct wnm_sleep_element); 73 wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element)); 74 if (wnmsleep_ie == NULL) 75 return -1; 76 wnmsleep_ie->eid = WLAN_EID_WNMSLEEP; 77 wnmsleep_ie->len = wnmsleep_ie_len - 2; 78 wnmsleep_ie->action_type = action; 79 wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT; 80 wnmsleep_ie->intval = host_to_le16(intval); 81 wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element", 82 (u8 *) wnmsleep_ie, wnmsleep_ie_len); 83 84 /* TFS IE(s) */ 85 if (tfs_req) { 86 wnmtfs_ie_len = wpabuf_len(tfs_req); 87 wnmtfs_ie = os_malloc(wnmtfs_ie_len); 88 if (wnmtfs_ie == NULL) { 89 os_free(wnmsleep_ie); 90 return -1; 91 } 92 os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len); 93 } else { 94 wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN); 95 if (wnmtfs_ie == NULL) { 96 os_free(wnmsleep_ie); 97 return -1; 98 } 99 if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len, 100 tfs_oper)) { 101 wnmtfs_ie_len = 0; 102 os_free(wnmtfs_ie); 103 wnmtfs_ie = NULL; 104 } 105 } 106 wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element", 107 (u8 *) wnmtfs_ie, wnmtfs_ie_len); 108 109 mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len); 110 if (mgmt == NULL) { 111 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for " 112 "WNM-Sleep Request action frame"); 113 os_free(wnmsleep_ie); 114 os_free(wnmtfs_ie); 115 return -1; 116 } 117 118 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN); 119 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN); 120 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN); 121 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 122 WLAN_FC_STYPE_ACTION); 123 mgmt->u.action.category = WLAN_ACTION_WNM; 124 mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ; 125 mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1; 126 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie, 127 wnmsleep_ie_len); 128 /* copy TFS IE here */ 129 if (wnmtfs_ie_len > 0) { 130 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable + 131 wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len); 132 } 133 134 len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len + 135 wnmtfs_ie_len; 136 137 res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 138 wpa_s->own_addr, wpa_s->bssid, 139 &mgmt->u.action.category, len, 0); 140 if (res < 0) 141 wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request " 142 "(action=%d, intval=%d)", action, intval); 143 else 144 wpa_s->wnmsleep_used = 1; 145 146 os_free(wnmsleep_ie); 147 os_free(wnmtfs_ie); 148 os_free(mgmt); 149 150 return res; 151 } 152 153 154 static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s, 155 const u8 *tfsresp_ie_start, 156 const u8 *tfsresp_ie_end) 157 { 158 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM, 159 wpa_s->bssid, NULL, NULL); 160 /* remove GTK/IGTK ?? */ 161 162 /* set the TFS Resp IE(s) */ 163 if (tfsresp_ie_start && tfsresp_ie_end && 164 tfsresp_ie_end - tfsresp_ie_start >= 0) { 165 u16 tfsresp_ie_len; 166 tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) - 167 tfsresp_ie_start; 168 wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found"); 169 /* pass the TFS Resp IE(s) to driver for processing */ 170 if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid, 171 tfsresp_ie_start, 172 tfsresp_ie_len, 173 WNM_SLEEP_TFS_RESP_IE_SET)) 174 wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE"); 175 } 176 } 177 178 179 static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s, 180 const u8 *frm, u16 key_len_total) 181 { 182 u8 *ptr, *end; 183 u8 gtk_len; 184 185 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM, wpa_s->bssid, 186 NULL, NULL); 187 188 /* Install GTK/IGTK */ 189 190 /* point to key data field */ 191 ptr = (u8 *) frm + 1 + 2; 192 end = ptr + key_len_total; 193 wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total); 194 195 if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) { 196 wpa_msg(wpa_s, MSG_INFO, 197 "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled"); 198 return; 199 } 200 201 while (end - ptr > 1) { 202 if (2 + ptr[1] > end - ptr) { 203 wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element " 204 "length"); 205 if (end > ptr) { 206 wpa_hexdump(MSG_DEBUG, "WNM: Remaining data", 207 ptr, end - ptr); 208 } 209 break; 210 } 211 if (*ptr == WNM_SLEEP_SUBELEM_GTK) { 212 if (ptr[1] < 11 + 5) { 213 wpa_printf(MSG_DEBUG, "WNM: Too short GTK " 214 "subelem"); 215 break; 216 } 217 gtk_len = *(ptr + 4); 218 if (ptr[1] < 11 + gtk_len || 219 gtk_len < 5 || gtk_len > 32) { 220 wpa_printf(MSG_DEBUG, "WNM: Invalid GTK " 221 "subelem"); 222 break; 223 } 224 wpa_wnmsleep_install_key( 225 wpa_s->wpa, 226 WNM_SLEEP_SUBELEM_GTK, 227 ptr); 228 ptr += 13 + gtk_len; 229 #ifdef CONFIG_IEEE80211W 230 } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) { 231 if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) { 232 wpa_printf(MSG_DEBUG, "WNM: Too short IGTK " 233 "subelem"); 234 break; 235 } 236 wpa_wnmsleep_install_key(wpa_s->wpa, 237 WNM_SLEEP_SUBELEM_IGTK, ptr); 238 ptr += 10 + WPA_IGTK_LEN; 239 #endif /* CONFIG_IEEE80211W */ 240 } else 241 break; /* skip the loop */ 242 } 243 } 244 245 246 static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, 247 const u8 *frm, int len) 248 { 249 /* 250 * Action [1] | Dialog Token [1] | Key Data Len [2] | Key Data | 251 * WNM-Sleep Mode IE | TFS Response IE 252 */ 253 const u8 *pos = frm; /* point to payload after the action field */ 254 u16 key_len_total; 255 struct wnm_sleep_element *wnmsleep_ie = NULL; 256 /* multiple TFS Resp IE (assuming consecutive) */ 257 const u8 *tfsresp_ie_start = NULL; 258 const u8 *tfsresp_ie_end = NULL; 259 size_t left; 260 261 if (!wpa_s->wnmsleep_used) { 262 wpa_printf(MSG_DEBUG, 263 "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); 264 return; 265 } 266 267 if (len < 3) 268 return; 269 key_len_total = WPA_GET_LE16(frm + 1); 270 271 wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d", 272 frm[0], key_len_total); 273 left = len - 3; 274 if (key_len_total > left) { 275 wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field"); 276 return; 277 } 278 pos += 3 + key_len_total; 279 while (pos - frm + 1 < len) { 280 u8 ie_len = *(pos + 1); 281 if (2 + ie_len > frm + len - pos) { 282 wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len); 283 break; 284 } 285 wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len); 286 if (*pos == WLAN_EID_WNMSLEEP && ie_len >= 4) 287 wnmsleep_ie = (struct wnm_sleep_element *) pos; 288 else if (*pos == WLAN_EID_TFS_RESP) { 289 if (!tfsresp_ie_start) 290 tfsresp_ie_start = pos; 291 tfsresp_ie_end = pos; 292 } else 293 wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos); 294 pos += ie_len + 2; 295 } 296 297 if (!wnmsleep_ie) { 298 wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found"); 299 return; 300 } 301 302 wpa_s->wnmsleep_used = 0; 303 304 if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || 305 wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { 306 wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " 307 "frame (action=%d, intval=%d)", 308 wnmsleep_ie->action_type, wnmsleep_ie->intval); 309 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) { 310 wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start, 311 tfsresp_ie_end); 312 } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) { 313 wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total); 314 } 315 } else { 316 wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame " 317 "(action=%d, intval=%d)", 318 wnmsleep_ie->action_type, wnmsleep_ie->intval); 319 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) 320 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL, 321 wpa_s->bssid, NULL, NULL); 322 else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) 323 wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL, 324 wpa_s->bssid, NULL, NULL); 325 } 326 } 327 328 329 void wnm_deallocate_memory(struct wpa_supplicant *wpa_s) 330 { 331 int i; 332 333 for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) { 334 os_free(wpa_s->wnm_neighbor_report_elements[i].meas_pilot); 335 os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid); 336 } 337 338 wpa_s->wnm_num_neighbor_report = 0; 339 os_free(wpa_s->wnm_neighbor_report_elements); 340 wpa_s->wnm_neighbor_report_elements = NULL; 341 } 342 343 344 static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, 345 u8 id, u8 elen, const u8 *pos) 346 { 347 switch (id) { 348 case WNM_NEIGHBOR_TSF: 349 if (elen < 2 + 2) { 350 wpa_printf(MSG_DEBUG, "WNM: Too short TSF"); 351 break; 352 } 353 rep->tsf_offset = WPA_GET_LE16(pos); 354 rep->beacon_int = WPA_GET_LE16(pos + 2); 355 rep->tsf_present = 1; 356 break; 357 case WNM_NEIGHBOR_CONDENSED_COUNTRY_STRING: 358 if (elen < 2) { 359 wpa_printf(MSG_DEBUG, "WNM: Too short condensed " 360 "country string"); 361 break; 362 } 363 os_memcpy(rep->country, pos, 2); 364 rep->country_present = 1; 365 break; 366 case WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE: 367 if (elen < 1) { 368 wpa_printf(MSG_DEBUG, "WNM: Too short BSS transition " 369 "candidate"); 370 break; 371 } 372 rep->preference = pos[0]; 373 rep->preference_present = 1; 374 break; 375 case WNM_NEIGHBOR_BSS_TERMINATION_DURATION: 376 rep->bss_term_tsf = WPA_GET_LE64(pos); 377 rep->bss_term_dur = WPA_GET_LE16(pos + 8); 378 rep->bss_term_present = 1; 379 break; 380 case WNM_NEIGHBOR_BEARING: 381 if (elen < 8) { 382 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor " 383 "bearing"); 384 break; 385 } 386 rep->bearing = WPA_GET_LE16(pos); 387 rep->distance = WPA_GET_LE32(pos + 2); 388 rep->rel_height = WPA_GET_LE16(pos + 2 + 4); 389 rep->bearing_present = 1; 390 break; 391 case WNM_NEIGHBOR_MEASUREMENT_PILOT: 392 if (elen < 1) { 393 wpa_printf(MSG_DEBUG, "WNM: Too short measurement " 394 "pilot"); 395 break; 396 } 397 os_free(rep->meas_pilot); 398 rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot)); 399 if (rep->meas_pilot == NULL) 400 break; 401 rep->meas_pilot->measurement_pilot = pos[0]; 402 rep->meas_pilot->subelem_len = elen - 1; 403 os_memcpy(rep->meas_pilot->subelems, pos + 1, elen - 1); 404 break; 405 case WNM_NEIGHBOR_RRM_ENABLED_CAPABILITIES: 406 if (elen < 5) { 407 wpa_printf(MSG_DEBUG, "WNM: Too short RRM enabled " 408 "capabilities"); 409 break; 410 } 411 os_memcpy(rep->rm_capab, pos, 5); 412 rep->rm_capab_present = 1; 413 break; 414 case WNM_NEIGHBOR_MULTIPLE_BSSID: 415 if (elen < 1) { 416 wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID"); 417 break; 418 } 419 os_free(rep->mul_bssid); 420 rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid)); 421 if (rep->mul_bssid == NULL) 422 break; 423 rep->mul_bssid->max_bssid_indicator = pos[0]; 424 rep->mul_bssid->subelem_len = elen - 1; 425 os_memcpy(rep->mul_bssid->subelems, pos + 1, elen - 1); 426 break; 427 } 428 } 429 430 431 static int wnm_nei_get_chan(struct wpa_supplicant *wpa_s, u8 op_class, u8 chan) 432 { 433 struct wpa_bss *bss = wpa_s->current_bss; 434 const char *country = NULL; 435 int freq; 436 437 if (bss) { 438 const u8 *elem = wpa_bss_get_ie(bss, WLAN_EID_COUNTRY); 439 440 if (elem && elem[1] >= 2) 441 country = (const char *) (elem + 2); 442 } 443 444 freq = ieee80211_chan_to_freq(country, op_class, chan); 445 if (freq <= 0 && op_class == 0) { 446 /* 447 * Some APs do not advertise correct operating class 448 * information. Try to determine the most likely operating 449 * frequency based on the channel number. 450 */ 451 if (chan >= 1 && chan <= 13) 452 freq = 2407 + chan * 5; 453 else if (chan == 14) 454 freq = 2484; 455 else if (chan >= 36 && chan <= 169) 456 freq = 5000 + chan * 5; 457 } 458 return freq; 459 } 460 461 462 static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s, 463 const u8 *pos, u8 len, 464 struct neighbor_report *rep) 465 { 466 u8 left = len; 467 468 if (left < 13) { 469 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor report"); 470 return; 471 } 472 473 os_memcpy(rep->bssid, pos, ETH_ALEN); 474 rep->bssid_info = WPA_GET_LE32(pos + ETH_ALEN); 475 rep->regulatory_class = *(pos + 10); 476 rep->channel_number = *(pos + 11); 477 rep->phy_type = *(pos + 12); 478 479 pos += 13; 480 left -= 13; 481 482 while (left >= 2) { 483 u8 id, elen; 484 485 id = *pos++; 486 elen = *pos++; 487 wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen); 488 left -= 2; 489 if (elen > left) { 490 wpa_printf(MSG_DEBUG, 491 "WNM: Truncated neighbor report subelement"); 492 break; 493 } 494 wnm_parse_neighbor_report_elem(rep, id, elen, pos); 495 left -= elen; 496 pos += elen; 497 } 498 499 rep->freq = wnm_nei_get_chan(wpa_s, rep->regulatory_class, 500 rep->channel_number); 501 } 502 503 504 static struct wpa_bss * 505 compare_scan_neighbor_results(struct wpa_supplicant *wpa_s, os_time_t age_secs) 506 { 507 508 u8 i; 509 struct wpa_bss *bss = wpa_s->current_bss; 510 struct wpa_bss *target; 511 512 if (!bss) 513 return NULL; 514 515 wpa_printf(MSG_DEBUG, "WNM: Current BSS " MACSTR " RSSI %d", 516 MAC2STR(wpa_s->bssid), bss->level); 517 518 for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) { 519 struct neighbor_report *nei; 520 521 nei = &wpa_s->wnm_neighbor_report_elements[i]; 522 if (nei->preference_present && nei->preference == 0) { 523 wpa_printf(MSG_DEBUG, "Skip excluded BSS " MACSTR, 524 MAC2STR(nei->bssid)); 525 continue; 526 } 527 528 target = wpa_bss_get_bssid(wpa_s, nei->bssid); 529 if (!target) { 530 wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR 531 " (pref %d) not found in scan results", 532 MAC2STR(nei->bssid), 533 nei->preference_present ? nei->preference : 534 -1); 535 continue; 536 } 537 538 if (age_secs) { 539 struct os_reltime now; 540 541 if (os_get_reltime(&now) == 0 && 542 os_reltime_expired(&now, &target->last_update, 543 age_secs)) { 544 wpa_printf(MSG_DEBUG, 545 "Candidate BSS is more than %ld seconds old", 546 age_secs); 547 continue; 548 } 549 } 550 551 if (bss->ssid_len != target->ssid_len || 552 os_memcmp(bss->ssid, target->ssid, bss->ssid_len) != 0) { 553 /* 554 * TODO: Could consider allowing transition to another 555 * ESS if PMF was enabled for the association. 556 */ 557 wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR 558 " (pref %d) in different ESS", 559 MAC2STR(nei->bssid), 560 nei->preference_present ? nei->preference : 561 -1); 562 continue; 563 } 564 565 if (wpa_s->current_ssid && 566 !wpa_scan_res_match(wpa_s, 0, target, wpa_s->current_ssid, 567 1, 0)) { 568 wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR 569 " (pref %d) does not match the current network profile", 570 MAC2STR(nei->bssid), 571 nei->preference_present ? nei->preference : 572 -1); 573 continue; 574 } 575 576 if (wpa_is_bss_tmp_disallowed(wpa_s, target->bssid)) { 577 wpa_printf(MSG_DEBUG, 578 "MBO: Candidate BSS " MACSTR 579 " retry delay is not over yet", 580 MAC2STR(nei->bssid)); 581 continue; 582 } 583 584 if (target->level < bss->level && target->level < -80) { 585 wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR 586 " (pref %d) does not have sufficient signal level (%d)", 587 MAC2STR(nei->bssid), 588 nei->preference_present ? nei->preference : 589 -1, 590 target->level); 591 continue; 592 } 593 594 wpa_printf(MSG_DEBUG, 595 "WNM: Found an acceptable preferred transition candidate BSS " 596 MACSTR " (RSSI %d)", 597 MAC2STR(nei->bssid), target->level); 598 return target; 599 } 600 601 return NULL; 602 } 603 604 605 static int wpa_bss_ies_eq(struct wpa_bss *a, struct wpa_bss *b, u8 eid) 606 { 607 const u8 *ie_a, *ie_b; 608 609 if (!a || !b) 610 return 0; 611 612 ie_a = wpa_bss_get_ie(a, eid); 613 ie_b = wpa_bss_get_ie(b, eid); 614 615 if (!ie_a || !ie_b || ie_a[1] != ie_b[1]) 616 return 0; 617 618 return os_memcmp(ie_a, ie_b, ie_a[1]) == 0; 619 } 620 621 622 static u32 wnm_get_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss) 623 { 624 u32 info = 0; 625 626 info |= NEI_REP_BSSID_INFO_AP_UNKNOWN_REACH; 627 628 /* 629 * Leave the security and key scope bits unset to indicate that the 630 * security information is not available. 631 */ 632 633 if (bss->caps & WLAN_CAPABILITY_SPECTRUM_MGMT) 634 info |= NEI_REP_BSSID_INFO_SPECTRUM_MGMT; 635 if (bss->caps & WLAN_CAPABILITY_QOS) 636 info |= NEI_REP_BSSID_INFO_QOS; 637 if (bss->caps & WLAN_CAPABILITY_APSD) 638 info |= NEI_REP_BSSID_INFO_APSD; 639 if (bss->caps & WLAN_CAPABILITY_RADIO_MEASUREMENT) 640 info |= NEI_REP_BSSID_INFO_RM; 641 if (bss->caps & WLAN_CAPABILITY_DELAYED_BLOCK_ACK) 642 info |= NEI_REP_BSSID_INFO_DELAYED_BA; 643 if (bss->caps & WLAN_CAPABILITY_IMM_BLOCK_ACK) 644 info |= NEI_REP_BSSID_INFO_IMM_BA; 645 if (wpa_bss_ies_eq(bss, wpa_s->current_bss, WLAN_EID_MOBILITY_DOMAIN)) 646 info |= NEI_REP_BSSID_INFO_MOBILITY_DOMAIN; 647 if (wpa_bss_ies_eq(bss, wpa_s->current_bss, WLAN_EID_HT_CAP)) 648 info |= NEI_REP_BSSID_INFO_HT; 649 650 return info; 651 } 652 653 654 static int wnm_add_nei_rep(u8 *buf, size_t len, const u8 *bssid, u32 bss_info, 655 u8 op_class, u8 chan, u8 phy_type, u8 pref) 656 { 657 u8 *pos = buf; 658 659 if (len < 18) { 660 wpa_printf(MSG_DEBUG, 661 "WNM: Not enough room for Neighbor Report element"); 662 return -1; 663 } 664 665 *pos++ = WLAN_EID_NEIGHBOR_REPORT; 666 /* length: 13 for basic neighbor report + 3 for preference subelement */ 667 *pos++ = 16; 668 os_memcpy(pos, bssid, ETH_ALEN); 669 pos += ETH_ALEN; 670 WPA_PUT_LE32(pos, bss_info); 671 pos += 4; 672 *pos++ = op_class; 673 *pos++ = chan; 674 *pos++ = phy_type; 675 *pos++ = WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE; 676 *pos++ = 1; 677 *pos++ = pref; 678 return pos - buf; 679 } 680 681 682 static int wnm_nei_rep_add_bss(struct wpa_supplicant *wpa_s, 683 struct wpa_bss *bss, u8 *buf, size_t len, 684 u8 pref) 685 { 686 const u8 *ie; 687 u8 op_class, chan; 688 int sec_chan = 0, vht = 0; 689 enum phy_type phy_type; 690 u32 info; 691 struct ieee80211_ht_operation *ht_oper = NULL; 692 struct ieee80211_vht_operation *vht_oper = NULL; 693 694 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_OPERATION); 695 if (ie && ie[1] >= 2) { 696 ht_oper = (struct ieee80211_ht_operation *) (ie + 2); 697 698 if (ht_oper->ht_param & HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE) 699 sec_chan = 1; 700 else if (ht_oper->ht_param & 701 HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW) 702 sec_chan = -1; 703 } 704 705 ie = wpa_bss_get_ie(bss, WLAN_EID_VHT_OPERATION); 706 if (ie && ie[1] >= 1) { 707 vht_oper = (struct ieee80211_vht_operation *) (ie + 2); 708 709 if (vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_80MHZ || 710 vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_160MHZ || 711 vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_80P80MHZ) 712 vht = vht_oper->vht_op_info_chwidth; 713 } 714 715 if (ieee80211_freq_to_channel_ext(bss->freq, sec_chan, vht, &op_class, 716 &chan) == NUM_HOSTAPD_MODES) { 717 wpa_printf(MSG_DEBUG, 718 "WNM: Cannot determine operating class and channel"); 719 return -2; 720 } 721 722 phy_type = ieee80211_get_phy_type(bss->freq, (ht_oper != NULL), 723 (vht_oper != NULL)); 724 if (phy_type == PHY_TYPE_UNSPECIFIED) { 725 wpa_printf(MSG_DEBUG, 726 "WNM: Cannot determine BSS phy type for Neighbor Report"); 727 return -2; 728 } 729 730 info = wnm_get_bss_info(wpa_s, bss); 731 732 return wnm_add_nei_rep(buf, len, bss->bssid, info, op_class, chan, 733 phy_type, pref); 734 } 735 736 737 static int wnm_add_cand_list(struct wpa_supplicant *wpa_s, u8 *buf, size_t len) 738 { 739 u8 *pos = buf; 740 unsigned int i, pref = 255; 741 struct os_reltime now; 742 struct wpa_ssid *ssid = wpa_s->current_ssid; 743 744 if (!ssid) 745 return 0; 746 747 /* 748 * TODO: Define when scan results are no longer valid for the candidate 749 * list. 750 */ 751 os_get_reltime(&now); 752 if (os_reltime_expired(&now, &wpa_s->last_scan, 10)) 753 return 0; 754 755 wpa_printf(MSG_DEBUG, 756 "WNM: Add candidate list to BSS Transition Management Response frame"); 757 for (i = 0; i < wpa_s->last_scan_res_used && pref; i++) { 758 struct wpa_bss *bss = wpa_s->last_scan_res[i]; 759 int res; 760 761 if (wpa_scan_res_match(wpa_s, i, bss, ssid, 1, 0)) { 762 res = wnm_nei_rep_add_bss(wpa_s, bss, pos, len, pref--); 763 if (res == -2) 764 continue; /* could not build entry for BSS */ 765 if (res < 0) 766 break; /* no more room for candidates */ 767 if (pref == 1) 768 break; 769 770 pos += res; 771 len -= res; 772 } 773 } 774 775 wpa_hexdump(MSG_DEBUG, 776 "WNM: BSS Transition Management Response candidate list", 777 buf, pos - buf); 778 779 return pos - buf; 780 } 781 782 783 static void wnm_send_bss_transition_mgmt_resp( 784 struct wpa_supplicant *wpa_s, u8 dialog_token, 785 enum bss_trans_mgmt_status_code status, u8 delay, 786 const u8 *target_bssid) 787 { 788 u8 buf[2000], *pos; 789 struct ieee80211_mgmt *mgmt; 790 size_t len; 791 int res; 792 793 wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Response " 794 "to " MACSTR " dialog_token=%u status=%u delay=%d", 795 MAC2STR(wpa_s->bssid), dialog_token, status, delay); 796 if (!wpa_s->current_bss) { 797 wpa_printf(MSG_DEBUG, 798 "WNM: Current BSS not known - drop response"); 799 return; 800 } 801 802 mgmt = (struct ieee80211_mgmt *) buf; 803 os_memset(&buf, 0, sizeof(buf)); 804 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN); 805 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN); 806 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN); 807 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 808 WLAN_FC_STYPE_ACTION); 809 mgmt->u.action.category = WLAN_ACTION_WNM; 810 mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP; 811 mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token; 812 mgmt->u.action.u.bss_tm_resp.status_code = status; 813 mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay; 814 pos = mgmt->u.action.u.bss_tm_resp.variable; 815 if (target_bssid) { 816 os_memcpy(pos, target_bssid, ETH_ALEN); 817 pos += ETH_ALEN; 818 } else if (status == WNM_BSS_TM_ACCEPT) { 819 /* 820 * P802.11-REVmc clarifies that the Target BSSID field is always 821 * present when status code is zero, so use a fake value here if 822 * no BSSID is yet known. 823 */ 824 os_memset(pos, 0, ETH_ALEN); 825 pos += ETH_ALEN; 826 } 827 828 if (status == WNM_BSS_TM_ACCEPT) 829 pos += wnm_add_cand_list(wpa_s, pos, buf + sizeof(buf) - pos); 830 831 #ifdef CONFIG_MBO 832 if (status != WNM_BSS_TM_ACCEPT) { 833 pos += wpas_mbo_ie_bss_trans_reject( 834 wpa_s, pos, buf + sizeof(buf) - pos, 835 MBO_TRANSITION_REJECT_REASON_UNSPECIFIED); 836 } 837 #endif /* CONFIG_MBO */ 838 839 len = pos - (u8 *) &mgmt->u.action.category; 840 841 res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 842 wpa_s->own_addr, wpa_s->bssid, 843 &mgmt->u.action.category, len, 0); 844 if (res < 0) { 845 wpa_printf(MSG_DEBUG, 846 "WNM: Failed to send BSS Transition Management Response"); 847 } 848 } 849 850 851 static void wnm_bss_tm_connect(struct wpa_supplicant *wpa_s, 852 struct wpa_bss *bss, struct wpa_ssid *ssid, 853 int after_new_scan) 854 { 855 wpa_dbg(wpa_s, MSG_DEBUG, 856 "WNM: Transition to BSS " MACSTR 857 " based on BSS Transition Management Request (old BSSID " 858 MACSTR " after_new_scan=%d)", 859 MAC2STR(bss->bssid), MAC2STR(wpa_s->bssid), after_new_scan); 860 861 /* Send the BSS Management Response - Accept */ 862 if (wpa_s->wnm_reply) { 863 wpa_s->wnm_reply = 0; 864 wpa_printf(MSG_DEBUG, 865 "WNM: Sending successful BSS Transition Management Response"); 866 wnm_send_bss_transition_mgmt_resp(wpa_s, 867 wpa_s->wnm_dialog_token, 868 WNM_BSS_TM_ACCEPT, 869 0, bss->bssid); 870 } 871 872 if (bss == wpa_s->current_bss) { 873 wpa_printf(MSG_DEBUG, 874 "WNM: Already associated with the preferred candidate"); 875 wnm_deallocate_memory(wpa_s); 876 return; 877 } 878 879 wpa_s->reassociate = 1; 880 wpa_printf(MSG_DEBUG, "WNM: Issuing connect"); 881 wpa_supplicant_connect(wpa_s, bss, ssid); 882 wnm_deallocate_memory(wpa_s); 883 } 884 885 886 int wnm_scan_process(struct wpa_supplicant *wpa_s, int reply_on_fail) 887 { 888 struct wpa_bss *bss; 889 struct wpa_ssid *ssid = wpa_s->current_ssid; 890 enum bss_trans_mgmt_status_code status = WNM_BSS_TM_REJECT_UNSPECIFIED; 891 892 if (!wpa_s->wnm_neighbor_report_elements) 893 return 0; 894 895 wpa_dbg(wpa_s, MSG_DEBUG, 896 "WNM: Process scan results for BSS Transition Management"); 897 if (os_reltime_before(&wpa_s->wnm_cand_valid_until, 898 &wpa_s->scan_trigger_time)) { 899 wpa_printf(MSG_DEBUG, "WNM: Previously stored BSS transition candidate list is not valid anymore - drop it"); 900 wnm_deallocate_memory(wpa_s); 901 return 0; 902 } 903 904 if (!wpa_s->current_bss || 905 os_memcmp(wpa_s->wnm_cand_from_bss, wpa_s->current_bss->bssid, 906 ETH_ALEN) != 0) { 907 wpa_printf(MSG_DEBUG, "WNM: Stored BSS transition candidate list not from the current BSS - ignore it"); 908 return 0; 909 } 910 911 /* Compare the Neighbor Report and scan results */ 912 bss = compare_scan_neighbor_results(wpa_s, 0); 913 if (!bss) { 914 wpa_printf(MSG_DEBUG, "WNM: No BSS transition candidate match found"); 915 status = WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES; 916 goto send_bss_resp_fail; 917 } 918 919 /* Associate to the network */ 920 wnm_bss_tm_connect(wpa_s, bss, ssid, 1); 921 return 1; 922 923 send_bss_resp_fail: 924 if (!reply_on_fail) 925 return 0; 926 927 /* Send reject response for all the failures */ 928 929 if (wpa_s->wnm_reply) { 930 wpa_s->wnm_reply = 0; 931 wnm_send_bss_transition_mgmt_resp(wpa_s, 932 wpa_s->wnm_dialog_token, 933 status, 0, NULL); 934 } 935 wnm_deallocate_memory(wpa_s); 936 937 return 0; 938 } 939 940 941 static int cand_pref_compar(const void *a, const void *b) 942 { 943 const struct neighbor_report *aa = a; 944 const struct neighbor_report *bb = b; 945 946 if (!aa->preference_present && !bb->preference_present) 947 return 0; 948 if (!aa->preference_present) 949 return 1; 950 if (!bb->preference_present) 951 return -1; 952 if (bb->preference > aa->preference) 953 return 1; 954 if (bb->preference < aa->preference) 955 return -1; 956 return 0; 957 } 958 959 960 static void wnm_sort_cand_list(struct wpa_supplicant *wpa_s) 961 { 962 if (!wpa_s->wnm_neighbor_report_elements) 963 return; 964 qsort(wpa_s->wnm_neighbor_report_elements, 965 wpa_s->wnm_num_neighbor_report, sizeof(struct neighbor_report), 966 cand_pref_compar); 967 } 968 969 970 static void wnm_dump_cand_list(struct wpa_supplicant *wpa_s) 971 { 972 unsigned int i; 973 974 wpa_printf(MSG_DEBUG, "WNM: BSS Transition Candidate List"); 975 if (!wpa_s->wnm_neighbor_report_elements) 976 return; 977 for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) { 978 struct neighbor_report *nei; 979 980 nei = &wpa_s->wnm_neighbor_report_elements[i]; 981 wpa_printf(MSG_DEBUG, "%u: " MACSTR 982 " info=0x%x op_class=%u chan=%u phy=%u pref=%d freq=%d", 983 i, MAC2STR(nei->bssid), nei->bssid_info, 984 nei->regulatory_class, 985 nei->channel_number, nei->phy_type, 986 nei->preference_present ? nei->preference : -1, 987 nei->freq); 988 } 989 } 990 991 992 static int chan_supported(struct wpa_supplicant *wpa_s, int freq) 993 { 994 unsigned int i; 995 996 for (i = 0; i < wpa_s->hw.num_modes; i++) { 997 struct hostapd_hw_modes *mode = &wpa_s->hw.modes[i]; 998 int j; 999 1000 for (j = 0; j < mode->num_channels; j++) { 1001 struct hostapd_channel_data *chan; 1002 1003 chan = &mode->channels[j]; 1004 if (chan->freq == freq && 1005 !(chan->flag & HOSTAPD_CHAN_DISABLED)) 1006 return 1; 1007 } 1008 } 1009 1010 return 0; 1011 } 1012 1013 1014 static void wnm_set_scan_freqs(struct wpa_supplicant *wpa_s) 1015 { 1016 int *freqs; 1017 int num_freqs = 0; 1018 unsigned int i; 1019 1020 if (!wpa_s->wnm_neighbor_report_elements) 1021 return; 1022 1023 if (wpa_s->hw.modes == NULL) 1024 return; 1025 1026 os_free(wpa_s->next_scan_freqs); 1027 wpa_s->next_scan_freqs = NULL; 1028 1029 freqs = os_calloc(wpa_s->wnm_num_neighbor_report + 1, sizeof(int)); 1030 if (freqs == NULL) 1031 return; 1032 1033 for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) { 1034 struct neighbor_report *nei; 1035 1036 nei = &wpa_s->wnm_neighbor_report_elements[i]; 1037 if (nei->freq <= 0) { 1038 wpa_printf(MSG_DEBUG, 1039 "WNM: Unknown neighbor operating frequency for " 1040 MACSTR " - scan all channels", 1041 MAC2STR(nei->bssid)); 1042 os_free(freqs); 1043 return; 1044 } 1045 if (chan_supported(wpa_s, nei->freq)) 1046 add_freq(freqs, &num_freqs, nei->freq); 1047 } 1048 1049 if (num_freqs == 0) { 1050 os_free(freqs); 1051 return; 1052 } 1053 1054 wpa_printf(MSG_DEBUG, 1055 "WNM: Scan %d frequencies based on transition candidate list", 1056 num_freqs); 1057 wpa_s->next_scan_freqs = freqs; 1058 } 1059 1060 1061 static int wnm_fetch_scan_results(struct wpa_supplicant *wpa_s) 1062 { 1063 struct wpa_scan_results *scan_res; 1064 struct wpa_bss *bss; 1065 struct wpa_ssid *ssid = wpa_s->current_ssid; 1066 u8 i, found = 0; 1067 size_t j; 1068 1069 wpa_dbg(wpa_s, MSG_DEBUG, 1070 "WNM: Fetch current scan results from the driver for checking transition candidates"); 1071 scan_res = wpa_drv_get_scan_results2(wpa_s); 1072 if (!scan_res) { 1073 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Failed to get scan results"); 1074 return 0; 1075 } 1076 1077 if (scan_res->fetch_time.sec == 0) 1078 os_get_reltime(&scan_res->fetch_time); 1079 1080 filter_scan_res(wpa_s, scan_res); 1081 1082 for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) { 1083 struct neighbor_report *nei; 1084 1085 nei = &wpa_s->wnm_neighbor_report_elements[i]; 1086 if (nei->preference_present && nei->preference == 0) 1087 continue; 1088 1089 for (j = 0; j < scan_res->num; j++) { 1090 struct wpa_scan_res *res; 1091 const u8 *ssid_ie; 1092 1093 res = scan_res->res[j]; 1094 if (os_memcmp(nei->bssid, res->bssid, ETH_ALEN) != 0 || 1095 res->age > WNM_SCAN_RESULT_AGE * 1000) 1096 continue; 1097 bss = wpa_s->current_bss; 1098 ssid_ie = wpa_scan_get_ie(res, WLAN_EID_SSID); 1099 if (bss && ssid_ie && 1100 (bss->ssid_len != ssid_ie[1] || 1101 os_memcmp(bss->ssid, ssid_ie + 2, 1102 bss->ssid_len) != 0)) 1103 continue; 1104 1105 /* Potential candidate found */ 1106 found = 1; 1107 scan_snr(res); 1108 scan_est_throughput(wpa_s, res); 1109 wpa_bss_update_scan_res(wpa_s, res, 1110 &scan_res->fetch_time); 1111 } 1112 } 1113 1114 wpa_scan_results_free(scan_res); 1115 if (!found) { 1116 wpa_dbg(wpa_s, MSG_DEBUG, 1117 "WNM: No transition candidate matches existing scan results"); 1118 return 0; 1119 } 1120 1121 bss = compare_scan_neighbor_results(wpa_s, WNM_SCAN_RESULT_AGE); 1122 if (!bss) { 1123 wpa_dbg(wpa_s, MSG_DEBUG, 1124 "WNM: Comparison of scan results against transition candidates did not find matches"); 1125 return 0; 1126 } 1127 1128 /* Associate to the network */ 1129 wnm_bss_tm_connect(wpa_s, bss, ssid, 0); 1130 return 1; 1131 } 1132 1133 1134 static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s, 1135 const u8 *pos, const u8 *end, 1136 int reply) 1137 { 1138 unsigned int beacon_int; 1139 u8 valid_int; 1140 #ifdef CONFIG_MBO 1141 const u8 *vendor; 1142 #endif /* CONFIG_MBO */ 1143 1144 if (end - pos < 5) 1145 return; 1146 1147 if (wpa_s->current_bss) 1148 beacon_int = wpa_s->current_bss->beacon_int; 1149 else 1150 beacon_int = 100; /* best guess */ 1151 1152 wpa_s->wnm_dialog_token = pos[0]; 1153 wpa_s->wnm_mode = pos[1]; 1154 wpa_s->wnm_dissoc_timer = WPA_GET_LE16(pos + 2); 1155 valid_int = pos[4]; 1156 wpa_s->wnm_reply = reply; 1157 1158 wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: " 1159 "dialog_token=%u request_mode=0x%x " 1160 "disassoc_timer=%u validity_interval=%u", 1161 wpa_s->wnm_dialog_token, wpa_s->wnm_mode, 1162 wpa_s->wnm_dissoc_timer, valid_int); 1163 1164 #if defined(CONFIG_MBO) && defined(CONFIG_TESTING_OPTIONS) 1165 if (wpa_s->reject_btm_req_reason) { 1166 wpa_printf(MSG_INFO, 1167 "WNM: Testing - reject BSS Transition Management Request: reject_btm_req_reason=%d", 1168 wpa_s->reject_btm_req_reason); 1169 wnm_send_bss_transition_mgmt_resp(wpa_s, 1170 wpa_s->wnm_dialog_token, 1171 wpa_s->reject_btm_req_reason, 1172 0, NULL); 1173 return; 1174 } 1175 #endif /* CONFIG_MBO && CONFIG_TESTING_OPTIONS */ 1176 1177 pos += 5; 1178 1179 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) { 1180 if (end - pos < 12) { 1181 wpa_printf(MSG_DEBUG, "WNM: Too short BSS TM Request"); 1182 return; 1183 } 1184 os_memcpy(wpa_s->wnm_bss_termination_duration, pos, 12); 1185 pos += 12; /* BSS Termination Duration */ 1186 } 1187 1188 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) { 1189 char url[256]; 1190 1191 if (end - pos < 1 || 1 + pos[0] > end - pos) { 1192 wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition " 1193 "Management Request (URL)"); 1194 return; 1195 } 1196 os_memcpy(url, pos + 1, pos[0]); 1197 url[pos[0]] = '\0'; 1198 pos += 1 + pos[0]; 1199 1200 wpa_msg(wpa_s, MSG_INFO, ESS_DISASSOC_IMMINENT "%d %u %s", 1201 wpa_sm_pmf_enabled(wpa_s->wpa), 1202 wpa_s->wnm_dissoc_timer * beacon_int * 128 / 125, url); 1203 } 1204 1205 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) { 1206 wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - " 1207 "Disassociation Timer %u", wpa_s->wnm_dissoc_timer); 1208 if (wpa_s->wnm_dissoc_timer && !wpa_s->scanning) { 1209 /* TODO: mark current BSS less preferred for 1210 * selection */ 1211 wpa_printf(MSG_DEBUG, "Trying to find another BSS"); 1212 wpa_supplicant_req_scan(wpa_s, 0, 0); 1213 } 1214 } 1215 1216 #ifdef CONFIG_MBO 1217 vendor = get_ie(pos, end - pos, WLAN_EID_VENDOR_SPECIFIC); 1218 if (vendor) 1219 wpas_mbo_ie_trans_req(wpa_s, vendor + 2, vendor[1]); 1220 #endif /* CONFIG_MBO */ 1221 1222 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED) { 1223 unsigned int valid_ms; 1224 1225 wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available"); 1226 wnm_deallocate_memory(wpa_s); 1227 wpa_s->wnm_neighbor_report_elements = os_calloc( 1228 WNM_MAX_NEIGHBOR_REPORT, 1229 sizeof(struct neighbor_report)); 1230 if (wpa_s->wnm_neighbor_report_elements == NULL) 1231 return; 1232 1233 while (end - pos >= 2 && 1234 wpa_s->wnm_num_neighbor_report < WNM_MAX_NEIGHBOR_REPORT) 1235 { 1236 u8 tag = *pos++; 1237 u8 len = *pos++; 1238 1239 wpa_printf(MSG_DEBUG, "WNM: Neighbor report tag %u", 1240 tag); 1241 if (len > end - pos) { 1242 wpa_printf(MSG_DEBUG, "WNM: Truncated request"); 1243 return; 1244 } 1245 if (tag == WLAN_EID_NEIGHBOR_REPORT) { 1246 struct neighbor_report *rep; 1247 rep = &wpa_s->wnm_neighbor_report_elements[ 1248 wpa_s->wnm_num_neighbor_report]; 1249 wnm_parse_neighbor_report(wpa_s, pos, len, rep); 1250 wpa_s->wnm_num_neighbor_report++; 1251 } 1252 1253 pos += len; 1254 } 1255 1256 if (!wpa_s->wnm_num_neighbor_report) { 1257 wpa_printf(MSG_DEBUG, 1258 "WNM: Candidate list included bit is set, but no candidates found"); 1259 wnm_send_bss_transition_mgmt_resp( 1260 wpa_s, wpa_s->wnm_dialog_token, 1261 WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES, 1262 0, NULL); 1263 return; 1264 } 1265 1266 wnm_sort_cand_list(wpa_s); 1267 wnm_dump_cand_list(wpa_s); 1268 valid_ms = valid_int * beacon_int * 128 / 125; 1269 wpa_printf(MSG_DEBUG, "WNM: Candidate list valid for %u ms", 1270 valid_ms); 1271 os_get_reltime(&wpa_s->wnm_cand_valid_until); 1272 wpa_s->wnm_cand_valid_until.sec += valid_ms / 1000; 1273 wpa_s->wnm_cand_valid_until.usec += (valid_ms % 1000) * 1000; 1274 wpa_s->wnm_cand_valid_until.sec += 1275 wpa_s->wnm_cand_valid_until.usec / 1000000; 1276 wpa_s->wnm_cand_valid_until.usec %= 1000000; 1277 os_memcpy(wpa_s->wnm_cand_from_bss, wpa_s->bssid, ETH_ALEN); 1278 1279 /* 1280 * Fetch the latest scan results from the kernel and check for 1281 * candidates based on those results first. This can help in 1282 * finding more up-to-date information should the driver has 1283 * done some internal scanning operations after the last scan 1284 * result update in wpa_supplicant. 1285 */ 1286 if (wnm_fetch_scan_results(wpa_s) > 0) 1287 return; 1288 1289 /* 1290 * Try to use previously received scan results, if they are 1291 * recent enough to use for a connection. 1292 */ 1293 if (wpa_s->last_scan_res_used > 0) { 1294 struct os_reltime now; 1295 1296 os_get_reltime(&now); 1297 if (!os_reltime_expired(&now, &wpa_s->last_scan, 10)) { 1298 wpa_printf(MSG_DEBUG, 1299 "WNM: Try to use recent scan results"); 1300 if (wnm_scan_process(wpa_s, 0) > 0) 1301 return; 1302 wpa_printf(MSG_DEBUG, 1303 "WNM: No match in previous scan results - try a new scan"); 1304 } 1305 } 1306 1307 wnm_set_scan_freqs(wpa_s); 1308 if (wpa_s->wnm_num_neighbor_report == 1) { 1309 os_memcpy(wpa_s->next_scan_bssid, 1310 wpa_s->wnm_neighbor_report_elements[0].bssid, 1311 ETH_ALEN); 1312 wpa_printf(MSG_DEBUG, 1313 "WNM: Scan only for a specific BSSID since there is only a single candidate " 1314 MACSTR, MAC2STR(wpa_s->next_scan_bssid)); 1315 } 1316 wpa_supplicant_req_scan(wpa_s, 0, 0); 1317 } else if (reply) { 1318 enum bss_trans_mgmt_status_code status; 1319 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) 1320 status = WNM_BSS_TM_ACCEPT; 1321 else { 1322 wpa_msg(wpa_s, MSG_INFO, "WNM: BSS Transition Management Request did not include candidates"); 1323 status = WNM_BSS_TM_REJECT_UNSPECIFIED; 1324 } 1325 wnm_send_bss_transition_mgmt_resp(wpa_s, 1326 wpa_s->wnm_dialog_token, 1327 status, 0, NULL); 1328 } 1329 } 1330 1331 1332 int wnm_send_bss_transition_mgmt_query(struct wpa_supplicant *wpa_s, 1333 u8 query_reason, int cand_list) 1334 { 1335 u8 buf[2000], *pos; 1336 struct ieee80211_mgmt *mgmt; 1337 size_t len; 1338 int ret; 1339 1340 wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Query to " 1341 MACSTR " query_reason=%u%s", 1342 MAC2STR(wpa_s->bssid), query_reason, 1343 cand_list ? " candidate list" : ""); 1344 1345 mgmt = (struct ieee80211_mgmt *) buf; 1346 os_memset(&buf, 0, sizeof(buf)); 1347 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN); 1348 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN); 1349 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN); 1350 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 1351 WLAN_FC_STYPE_ACTION); 1352 mgmt->u.action.category = WLAN_ACTION_WNM; 1353 mgmt->u.action.u.bss_tm_query.action = WNM_BSS_TRANS_MGMT_QUERY; 1354 mgmt->u.action.u.bss_tm_query.dialog_token = 1; 1355 mgmt->u.action.u.bss_tm_query.query_reason = query_reason; 1356 pos = mgmt->u.action.u.bss_tm_query.variable; 1357 1358 if (cand_list) 1359 pos += wnm_add_cand_list(wpa_s, pos, buf + sizeof(buf) - pos); 1360 1361 len = pos - (u8 *) &mgmt->u.action.category; 1362 1363 ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 1364 wpa_s->own_addr, wpa_s->bssid, 1365 &mgmt->u.action.category, len, 0); 1366 1367 return ret; 1368 } 1369 1370 1371 static void ieee802_11_rx_wnm_notif_req_wfa(struct wpa_supplicant *wpa_s, 1372 const u8 *sa, const u8 *data, 1373 int len) 1374 { 1375 const u8 *pos, *end, *next; 1376 u8 ie, ie_len; 1377 1378 pos = data; 1379 end = data + len; 1380 1381 while (end - pos > 1) { 1382 ie = *pos++; 1383 ie_len = *pos++; 1384 wpa_printf(MSG_DEBUG, "WNM: WFA subelement %u len %u", 1385 ie, ie_len); 1386 if (ie_len > end - pos) { 1387 wpa_printf(MSG_DEBUG, "WNM: Not enough room for " 1388 "subelement"); 1389 break; 1390 } 1391 next = pos + ie_len; 1392 if (ie_len < 4) { 1393 pos = next; 1394 continue; 1395 } 1396 wpa_printf(MSG_DEBUG, "WNM: Subelement OUI %06x type %u", 1397 WPA_GET_BE24(pos), pos[3]); 1398 1399 #ifdef CONFIG_HS20 1400 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 5 && 1401 WPA_GET_BE24(pos) == OUI_WFA && 1402 pos[3] == HS20_WNM_SUB_REM_NEEDED) { 1403 /* Subscription Remediation subelement */ 1404 const u8 *ie_end; 1405 u8 url_len; 1406 char *url; 1407 u8 osu_method; 1408 1409 wpa_printf(MSG_DEBUG, "WNM: Subscription Remediation " 1410 "subelement"); 1411 ie_end = pos + ie_len; 1412 pos += 4; 1413 url_len = *pos++; 1414 if (url_len == 0) { 1415 wpa_printf(MSG_DEBUG, "WNM: No Server URL included"); 1416 url = NULL; 1417 osu_method = 1; 1418 } else { 1419 if (url_len + 1 > ie_end - pos) { 1420 wpa_printf(MSG_DEBUG, "WNM: Not enough room for Server URL (len=%u) and Server Method (left %d)", 1421 url_len, 1422 (int) (ie_end - pos)); 1423 break; 1424 } 1425 url = os_malloc(url_len + 1); 1426 if (url == NULL) 1427 break; 1428 os_memcpy(url, pos, url_len); 1429 url[url_len] = '\0'; 1430 osu_method = pos[url_len]; 1431 } 1432 hs20_rx_subscription_remediation(wpa_s, url, 1433 osu_method); 1434 os_free(url); 1435 pos = next; 1436 continue; 1437 } 1438 1439 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 8 && 1440 WPA_GET_BE24(pos) == OUI_WFA && 1441 pos[3] == HS20_WNM_DEAUTH_IMMINENT_NOTICE) { 1442 const u8 *ie_end; 1443 u8 url_len; 1444 char *url; 1445 u8 code; 1446 u16 reauth_delay; 1447 1448 ie_end = pos + ie_len; 1449 pos += 4; 1450 code = *pos++; 1451 reauth_delay = WPA_GET_LE16(pos); 1452 pos += 2; 1453 url_len = *pos++; 1454 wpa_printf(MSG_DEBUG, "WNM: HS 2.0 Deauthentication " 1455 "Imminent - Reason Code %u " 1456 "Re-Auth Delay %u URL Length %u", 1457 code, reauth_delay, url_len); 1458 if (url_len > ie_end - pos) 1459 break; 1460 url = os_malloc(url_len + 1); 1461 if (url == NULL) 1462 break; 1463 os_memcpy(url, pos, url_len); 1464 url[url_len] = '\0'; 1465 hs20_rx_deauth_imminent_notice(wpa_s, code, 1466 reauth_delay, url); 1467 os_free(url); 1468 pos = next; 1469 continue; 1470 } 1471 #endif /* CONFIG_HS20 */ 1472 1473 pos = next; 1474 } 1475 } 1476 1477 1478 static void ieee802_11_rx_wnm_notif_req(struct wpa_supplicant *wpa_s, 1479 const u8 *sa, const u8 *frm, int len) 1480 { 1481 const u8 *pos, *end; 1482 u8 dialog_token, type; 1483 1484 /* Dialog Token [1] | Type [1] | Subelements */ 1485 1486 if (len < 2 || sa == NULL) 1487 return; 1488 end = frm + len; 1489 pos = frm; 1490 dialog_token = *pos++; 1491 type = *pos++; 1492 1493 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Received WNM-Notification Request " 1494 "(dialog_token %u type %u sa " MACSTR ")", 1495 dialog_token, type, MAC2STR(sa)); 1496 wpa_hexdump(MSG_DEBUG, "WNM-Notification Request subelements", 1497 pos, end - pos); 1498 1499 if (wpa_s->wpa_state != WPA_COMPLETED || 1500 os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) { 1501 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: WNM-Notification frame not " 1502 "from our AP - ignore it"); 1503 return; 1504 } 1505 1506 switch (type) { 1507 case 1: 1508 ieee802_11_rx_wnm_notif_req_wfa(wpa_s, sa, pos, end - pos); 1509 break; 1510 default: 1511 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Ignore unknown " 1512 "WNM-Notification type %u", type); 1513 break; 1514 } 1515 } 1516 1517 1518 void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s, 1519 const struct ieee80211_mgmt *mgmt, size_t len) 1520 { 1521 const u8 *pos, *end; 1522 u8 act; 1523 1524 if (len < IEEE80211_HDRLEN + 2) 1525 return; 1526 1527 pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1; 1528 act = *pos++; 1529 end = ((const u8 *) mgmt) + len; 1530 1531 wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR, 1532 act, MAC2STR(mgmt->sa)); 1533 if (wpa_s->wpa_state < WPA_ASSOCIATED || 1534 os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) { 1535 wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action " 1536 "frame"); 1537 return; 1538 } 1539 1540 switch (act) { 1541 case WNM_BSS_TRANS_MGMT_REQ: 1542 ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end, 1543 !(mgmt->da[0] & 0x01)); 1544 break; 1545 case WNM_SLEEP_MODE_RESP: 1546 ieee802_11_rx_wnmsleep_resp(wpa_s, pos, end - pos); 1547 break; 1548 case WNM_NOTIFICATION_REQ: 1549 ieee802_11_rx_wnm_notif_req(wpa_s, mgmt->sa, pos, end - pos); 1550 break; 1551 default: 1552 wpa_printf(MSG_ERROR, "WNM: Unknown request"); 1553 break; 1554 } 1555 } 1556
