1 /*
2 * wpa_supplicant - Radio Measurements
3 * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_common.h"
14 #include "wpa_supplicant_i.h"
15 #include "driver_i.h"
16 #include "bss.h"
17 #include "scan.h"
18 #include "p2p_supplicant.h"
19
20
wpas_rrm_neighbor_rep_timeout_handler(void * data,void * user_ctx)21 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
22 {
23 struct rrm_data *rrm = data;
24
25 if (!rrm->notify_neighbor_rep) {
26 wpa_printf(MSG_ERROR,
27 "RRM: Unexpected neighbor report timeout");
28 return;
29 }
30
31 wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
32 rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
33
34 rrm->notify_neighbor_rep = NULL;
35 rrm->neighbor_rep_cb_ctx = NULL;
36 }
37
38
39 /*
40 * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
41 * @wpa_s: Pointer to wpa_supplicant
42 */
wpas_rrm_reset(struct wpa_supplicant * wpa_s)43 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
44 {
45 wpa_s->rrm.rrm_used = 0;
46
47 eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
48 NULL);
49 if (wpa_s->rrm.notify_neighbor_rep)
50 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
51 wpa_s->rrm.next_neighbor_rep_token = 1;
52 wpas_clear_beacon_rep_data(wpa_s);
53 }
54
55
56 /*
57 * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
58 * @wpa_s: Pointer to wpa_supplicant
59 * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
60 * @report_len: Length of neighbor report buffer
61 */
wpas_rrm_process_neighbor_rep(struct wpa_supplicant * wpa_s,const u8 * report,size_t report_len)62 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
63 const u8 *report, size_t report_len)
64 {
65 struct wpabuf *neighbor_rep;
66
67 wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
68 if (report_len < 1)
69 return;
70
71 if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
72 wpa_printf(MSG_DEBUG,
73 "RRM: Discarding neighbor report with token %d (expected %d)",
74 report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
75 return;
76 }
77
78 eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
79 NULL);
80
81 if (!wpa_s->rrm.notify_neighbor_rep) {
82 wpa_msg(wpa_s, MSG_INFO, "RRM: Unexpected neighbor report");
83 return;
84 }
85
86 /* skipping the first byte, which is only an id (dialog token) */
87 neighbor_rep = wpabuf_alloc(report_len - 1);
88 if (!neighbor_rep) {
89 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
90 return;
91 }
92 wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
93 wpa_dbg(wpa_s, MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
94 report[0]);
95 wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
96 neighbor_rep);
97 wpa_s->rrm.notify_neighbor_rep = NULL;
98 wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
99 }
100
101
102 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
103 /* Workaround different, undefined for Windows, error codes used here */
104 #ifndef ENOTCONN
105 #define ENOTCONN -1
106 #endif
107 #ifndef EOPNOTSUPP
108 #define EOPNOTSUPP -1
109 #endif
110 #ifndef ECANCELED
111 #define ECANCELED -1
112 #endif
113 #endif
114
115 /* Measurement Request element + Location Subject + Maximum Age subelement */
116 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
117 /* Measurement Request element + Location Civic Request */
118 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
119
120
121 /**
122 * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
123 * @wpa_s: Pointer to wpa_supplicant
124 * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
125 * is sent in the request.
126 * @lci: if set, neighbor request will include LCI request
127 * @civic: if set, neighbor request will include civic location request
128 * @cb: Callback function to be called once the requested report arrives, or
129 * timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
130 * In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
131 * the requester's responsibility to free it.
132 * In the latter case NULL will be sent in 'neighbor_rep'.
133 * @cb_ctx: Context value to send the callback function
134 * Returns: 0 in case of success, negative error code otherwise
135 *
136 * In case there is a previous request which has not been answered yet, the
137 * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
138 * Request must contain a callback function.
139 */
wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant * wpa_s,const struct wpa_ssid_value * ssid,int lci,int civic,void (* cb)(void * ctx,struct wpabuf * neighbor_rep),void * cb_ctx)140 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
141 const struct wpa_ssid_value *ssid,
142 int lci, int civic,
143 void (*cb)(void *ctx,
144 struct wpabuf *neighbor_rep),
145 void *cb_ctx)
146 {
147 struct wpabuf *buf;
148 const u8 *rrm_ie;
149
150 if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
151 wpa_dbg(wpa_s, MSG_DEBUG, "RRM: No connection, no RRM.");
152 return -ENOTCONN;
153 }
154
155 if (!wpa_s->rrm.rrm_used) {
156 wpa_dbg(wpa_s, MSG_DEBUG, "RRM: No RRM in current connection.");
157 return -EOPNOTSUPP;
158 }
159
160 rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
161 WLAN_EID_RRM_ENABLED_CAPABILITIES);
162 if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
163 !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
164 wpa_dbg(wpa_s, MSG_DEBUG,
165 "RRM: No network support for Neighbor Report.");
166 return -EOPNOTSUPP;
167 }
168
169 /* Refuse if there's a live request */
170 if (wpa_s->rrm.notify_neighbor_rep) {
171 wpa_dbg(wpa_s, MSG_DEBUG,
172 "RRM: Currently handling previous Neighbor Report.");
173 return -EBUSY;
174 }
175
176 /* 3 = action category + action code + dialog token */
177 buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
178 (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
179 (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
180 if (buf == NULL) {
181 wpa_dbg(wpa_s, MSG_DEBUG,
182 "RRM: Failed to allocate Neighbor Report Request");
183 return -ENOMEM;
184 }
185
186 wpa_msg_only_for_cb(wpa_s, MSG_DEBUG,
187 "RRM: Neighbor report request (for %s), token=%d",
188 (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
189 wpa_s->rrm.next_neighbor_rep_token);
190 wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
191 (ssid ? anonymize_ssid(wpa_ssid_txt(ssid->ssid, ssid->ssid_len)) : ""),
192 wpa_s->rrm.next_neighbor_rep_token);
193
194 wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
195 wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
196 wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
197 if (ssid) {
198 wpabuf_put_u8(buf, WLAN_EID_SSID);
199 wpabuf_put_u8(buf, ssid->ssid_len);
200 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
201 }
202
203 if (lci) {
204 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
205 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
206 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
207
208 /*
209 * Measurement token; nonzero number that is unique among the
210 * Measurement Request elements in a particular frame.
211 */
212 wpabuf_put_u8(buf, 1); /* Measurement Token */
213
214 /*
215 * Parallel, Enable, Request, and Report bits are 0, Duration is
216 * reserved.
217 */
218 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
219 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
220
221 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
222 /* Location Subject */
223 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
224
225 /* Optional Subelements */
226 /*
227 * IEEE P802.11-REVmc/D5.0 Figure 9-170
228 * The Maximum Age subelement is required, otherwise the AP can
229 * send only data that was determined after receiving the
230 * request. Setting it here to unlimited age.
231 */
232 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
233 wpabuf_put_u8(buf, 2);
234 wpabuf_put_le16(buf, 0xffff);
235 }
236
237 if (civic) {
238 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
239 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
240 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
241
242 /*
243 * Measurement token; nonzero number that is unique among the
244 * Measurement Request elements in a particular frame.
245 */
246 wpabuf_put_u8(buf, 2); /* Measurement Token */
247
248 /*
249 * Parallel, Enable, Request, and Report bits are 0, Duration is
250 * reserved.
251 */
252 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
253 /* Measurement Type */
254 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
255
256 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
257 * Location Civic request */
258 /* Location Subject */
259 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
260 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
261 /* Location Service Interval Units: Seconds */
262 wpabuf_put_u8(buf, 0);
263 /* Location Service Interval: 0 - Only one report is requested
264 */
265 wpabuf_put_le16(buf, 0);
266 /* No optional subelements */
267 }
268
269 wpa_s->rrm.next_neighbor_rep_token++;
270
271 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
272 wpa_s->own_addr, wpa_s->bssid,
273 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
274 wpa_dbg(wpa_s, MSG_DEBUG,
275 "RRM: Failed to send Neighbor Report Request");
276 wpabuf_free(buf);
277 return -ECANCELED;
278 }
279
280 wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
281 wpa_s->rrm.notify_neighbor_rep = cb;
282 eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
283 wpas_rrm_neighbor_rep_timeout_handler,
284 &wpa_s->rrm, NULL);
285
286 wpabuf_free(buf);
287 return 0;
288 }
289
290
wpas_rrm_report_elem(struct wpabuf ** buf,u8 token,u8 mode,u8 type,const u8 * data,size_t data_len)291 static int wpas_rrm_report_elem(struct wpabuf **buf, u8 token, u8 mode, u8 type,
292 const u8 *data, size_t data_len)
293 {
294 if (wpabuf_resize(buf, 5 + data_len))
295 return -1;
296
297 wpabuf_put_u8(*buf, WLAN_EID_MEASURE_REPORT);
298 wpabuf_put_u8(*buf, 3 + data_len);
299 wpabuf_put_u8(*buf, token);
300 wpabuf_put_u8(*buf, mode);
301 wpabuf_put_u8(*buf, type);
302
303 if (data_len)
304 wpabuf_put_data(*buf, data, data_len);
305
306 return 0;
307 }
308
309
310 static int
wpas_rrm_build_lci_report(struct wpa_supplicant * wpa_s,const struct rrm_measurement_request_element * req,struct wpabuf ** buf)311 wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
312 const struct rrm_measurement_request_element *req,
313 struct wpabuf **buf)
314 {
315 u8 subject;
316 u16 max_age = 0;
317 struct os_reltime t, diff;
318 unsigned long diff_l;
319 const u8 *subelem;
320 const u8 *request = req->variable;
321 size_t len = req->len - 3;
322
323 if (len < 1)
324 return -1;
325
326 if (!wpa_s->lci)
327 goto reject;
328
329 subject = *request++;
330 len--;
331
332 wpa_printf(MSG_DEBUG, "Measurement request location subject=%u",
333 subject);
334
335 if (subject != LOCATION_SUBJECT_REMOTE) {
336 wpa_printf(MSG_INFO,
337 "Not building LCI report - bad location subject");
338 return 0;
339 }
340
341 /* Subelements are formatted exactly like elements */
342 wpa_hexdump(MSG_DEBUG, "LCI request subelements", request, len);
343 subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
344 if (subelem && subelem[1] == 2)
345 max_age = WPA_GET_LE16(subelem + 2);
346
347 if (os_get_reltime(&t))
348 goto reject;
349
350 os_reltime_sub(&t, &wpa_s->lci_time, &diff);
351 /* LCI age is calculated in 10th of a second units. */
352 diff_l = diff.sec * 10 + diff.usec / 100000;
353
354 if (max_age != 0xffff && max_age < diff_l)
355 goto reject;
356
357 if (wpas_rrm_report_elem(buf, req->token,
358 MEASUREMENT_REPORT_MODE_ACCEPT, req->type,
359 wpabuf_head_u8(wpa_s->lci),
360 wpabuf_len(wpa_s->lci)) < 0) {
361 wpa_printf(MSG_DEBUG, "Failed to add LCI report element");
362 return -1;
363 }
364
365 return 0;
366
367 reject:
368 if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
369 wpas_rrm_report_elem(buf, req->token,
370 MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
371 req->type, NULL, 0) < 0) {
372 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
373 return -1;
374 }
375
376 return 0;
377 }
378
379
wpas_rrm_send_msr_report_mpdu(struct wpa_supplicant * wpa_s,const u8 * data,size_t len)380 static void wpas_rrm_send_msr_report_mpdu(struct wpa_supplicant *wpa_s,
381 const u8 *data, size_t len)
382 {
383 struct wpabuf *report = wpabuf_alloc(len + 3);
384
385 if (!report)
386 return;
387
388 wpabuf_put_u8(report, WLAN_ACTION_RADIO_MEASUREMENT);
389 wpabuf_put_u8(report, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
390 wpabuf_put_u8(report, wpa_s->rrm.token);
391
392 wpabuf_put_data(report, data, len);
393
394 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
395 wpa_s->own_addr, wpa_s->bssid,
396 wpabuf_head(report), wpabuf_len(report), 0)) {
397 wpa_printf(MSG_ERROR,
398 "RRM: Radio measurement report failed: Sending Action frame failed");
399 }
400
401 wpabuf_free(report);
402 }
403
404
wpas_rrm_beacon_rep_update_last_frame(u8 * pos,size_t len)405 static int wpas_rrm_beacon_rep_update_last_frame(u8 *pos, size_t len)
406 {
407 struct rrm_measurement_report_element *msr_rep;
408 u8 *end = pos + len;
409 u8 *msr_rep_end;
410 struct rrm_measurement_beacon_report *rep = NULL;
411 u8 *subelem;
412
413 /* Find the last beacon report element */
414 while (end - pos >= (int) sizeof(*msr_rep)) {
415 msr_rep = (struct rrm_measurement_report_element *) pos;
416 msr_rep_end = pos + msr_rep->len + 2;
417
418 if (msr_rep->eid != WLAN_EID_MEASURE_REPORT ||
419 msr_rep_end > end) {
420 /* Should not happen. This indicates a bug. */
421 wpa_printf(MSG_ERROR,
422 "RRM: non-measurement report element in measurement report frame");
423 return -1;
424 }
425
426 if (msr_rep->type == MEASURE_TYPE_BEACON)
427 rep = (struct rrm_measurement_beacon_report *)
428 msr_rep->variable;
429
430 pos += pos[1] + 2;
431 }
432
433 if (!rep)
434 return 0;
435
436 subelem = rep->variable;
437 while (subelem + 2 < msr_rep_end &&
438 subelem[0] != WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION)
439 subelem += 2 + subelem[1];
440
441 if (subelem + 2 < msr_rep_end &&
442 subelem[0] == WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION &&
443 subelem[1] == 1 &&
444 subelem + BEACON_REPORT_LAST_INDICATION_SUBELEM_LEN <= end)
445 subelem[2] = 1;
446
447 return 0;
448 }
449
450
wpas_rrm_send_msr_report(struct wpa_supplicant * wpa_s,struct wpabuf * buf)451 static void wpas_rrm_send_msr_report(struct wpa_supplicant *wpa_s,
452 struct wpabuf *buf)
453 {
454 int len = wpabuf_len(buf);
455 u8 *pos = wpabuf_mhead_u8(buf), *next = pos;
456
457 #define MPDU_REPORT_LEN (int) (IEEE80211_MAX_MMPDU_SIZE - IEEE80211_HDRLEN - 3)
458
459 while (len) {
460 int send_len = (len > MPDU_REPORT_LEN) ? next - pos : len;
461
462 if (send_len == len)
463 wpas_rrm_beacon_rep_update_last_frame(pos, len);
464
465 if (send_len == len ||
466 (send_len + next[1] + 2) > MPDU_REPORT_LEN) {
467 wpas_rrm_send_msr_report_mpdu(wpa_s, pos, send_len);
468 len -= send_len;
469 pos = next;
470 }
471
472 if (len)
473 next += next[1] + 2;
474 }
475 #undef MPDU_REPORT_LEN
476 }
477
478
wpas_add_channel(u8 op_class,u8 chan,u8 num_primary_channels,int * freqs)479 static int wpas_add_channel(u8 op_class, u8 chan, u8 num_primary_channels,
480 int *freqs)
481 {
482 size_t i;
483
484 for (i = 0; i < num_primary_channels; i++) {
485 u8 primary_chan = chan - (2 * num_primary_channels - 2) + i * 4;
486
487 freqs[i] = ieee80211_chan_to_freq(NULL, op_class, primary_chan);
488 /* ieee80211_chan_to_freq() is not really meant for this
489 * conversion of 20 MHz primary channel numbers for wider VHT
490 * channels, so handle those as special cases here for now. */
491 if (freqs[i] < 0 &&
492 (op_class == 128 || op_class == 129 || op_class == 130))
493 freqs[i] = 5000 + 5 * primary_chan;
494 if (freqs[i] < 0) {
495 wpa_printf(MSG_DEBUG,
496 "Beacon Report: Invalid channel %u",
497 chan);
498 return -1;
499 }
500 }
501
502 return 0;
503 }
504
505
wpas_add_channels(const struct oper_class_map * op,struct hostapd_hw_modes * mode,const u8 * channels,const u8 size)506 static int * wpas_add_channels(const struct oper_class_map *op,
507 struct hostapd_hw_modes *mode,
508 const u8 *channels, const u8 size)
509 {
510 int *freqs, *next_freq;
511 u8 num_primary_channels, i;
512 u8 num_chans;
513
514 num_chans = channels ? size :
515 (op->max_chan - op->min_chan) / op->inc + 1;
516
517 if (op->bw == BW80 || op->bw == BW80P80)
518 num_primary_channels = 4;
519 else if (op->bw == BW160)
520 num_primary_channels = 8;
521 else if (op->bw == BW320)
522 num_primary_channels = 16;
523 else
524 num_primary_channels = 1;
525
526 /* one extra place for the zero-terminator */
527 freqs = os_calloc(num_chans * num_primary_channels + 1, sizeof(*freqs));
528 if (!freqs) {
529 wpa_printf(MSG_ERROR,
530 "Beacon Report: Failed to allocate freqs array");
531 return NULL;
532 }
533
534 next_freq = freqs;
535 for (i = 0; i < num_chans; i++) {
536 u8 chan = channels ? channels[i] : op->min_chan + i * op->inc;
537 enum chan_allowed res = verify_channel(mode, op->op_class, chan,
538 op->bw);
539
540 if (res == NOT_ALLOWED)
541 continue;
542
543 if (wpas_add_channel(op->op_class, chan, num_primary_channels,
544 next_freq) < 0) {
545 os_free(freqs);
546 return NULL;
547 }
548
549 next_freq += num_primary_channels;
550 }
551
552 if (!freqs[0]) {
553 os_free(freqs);
554 return NULL;
555 }
556
557 return freqs;
558 }
559
560
wpas_op_class_freqs(const struct oper_class_map * op,struct hostapd_hw_modes * mode)561 static int * wpas_op_class_freqs(const struct oper_class_map *op,
562 struct hostapd_hw_modes *mode)
563 {
564 u8 channels_80mhz_5ghz[] = { 42, 58, 106, 122, 138, 155, 171 };
565 u8 channels_160mhz_5ghz[] = { 50, 114, 163 };
566 u8 channels_80mhz_6ghz[] = { 7, 23, 39, 55, 71, 87, 103, 119, 135, 151,
567 167, 183, 199, 215 };
568 u8 channels_160mhz_6ghz[] = { 15, 47, 79, 111, 143, 175, 207 };
569 u8 channels_320mhz_6ghz[] = { 31, 63, 95, 127, 159, 191 };
570 const u8 *channels = NULL;
571 size_t num_chan = 0;
572 bool is_6ghz = is_6ghz_op_class(op->op_class);
573
574 /*
575 * When adding all channels in the operating class, 80 + 80 MHz
576 * operating classes are like 80 MHz channels because we add all valid
577 * channels anyway.
578 */
579 if (op->bw == BW80 || op->bw == BW80P80) {
580 channels = is_6ghz ? channels_80mhz_6ghz : channels_80mhz_5ghz;
581 num_chan = is_6ghz ? ARRAY_SIZE(channels_80mhz_6ghz) :
582 ARRAY_SIZE(channels_80mhz_5ghz);
583 } else if (op->bw == BW160) {
584 channels = is_6ghz ? channels_160mhz_6ghz :
585 channels_160mhz_5ghz;
586 num_chan = is_6ghz ? ARRAY_SIZE(channels_160mhz_6ghz) :
587 ARRAY_SIZE(channels_160mhz_5ghz);
588 } else if (op->bw == BW320) {
589 channels = channels_320mhz_6ghz;
590 num_chan = ARRAY_SIZE(channels_320mhz_6ghz);
591 }
592
593 return wpas_add_channels(op, mode, channels, num_chan);
594 }
595
596
wpas_channel_report_freqs(struct wpa_supplicant * wpa_s,const char * country,const u8 * subelems,size_t len)597 static int * wpas_channel_report_freqs(struct wpa_supplicant *wpa_s,
598 const char *country, const u8 *subelems,
599 size_t len)
600 {
601 int *freqs = NULL, *new_freqs;
602 const u8 *end = subelems + len;
603
604 while (end - subelems > 2) {
605 const struct oper_class_map *op;
606 const u8 *ap_chan_elem, *pos;
607 u8 left;
608 struct hostapd_hw_modes *mode;
609
610 ap_chan_elem = get_ie(subelems, end - subelems,
611 WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL);
612 if (!ap_chan_elem)
613 break;
614 pos = ap_chan_elem + 2;
615 left = ap_chan_elem[1];
616 if (left < 1)
617 break;
618 subelems = ap_chan_elem + 2 + left;
619
620 op = get_oper_class(country, *pos);
621 if (!op) {
622 wpa_printf(MSG_DEBUG,
623 "Beacon request: unknown operating class in AP Channel Report subelement %u",
624 *pos);
625 goto out;
626 }
627 pos++;
628 left--;
629
630 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode,
631 is_6ghz_op_class(op->op_class));
632 if (!mode)
633 continue;
634
635 /*
636 * For 80 + 80 MHz operating classes, this AP Channel Report
637 * element should be followed by another element specifying
638 * the second 80 MHz channel. For now just add this 80 MHz
639 * channel, the second 80 MHz channel will be added when the
640 * next element is parsed.
641 * TODO: Verify that this AP Channel Report element is followed
642 * by a corresponding AP Channel Report element as specified in
643 * IEEE Std 802.11-2016, 11.11.9.1.
644 */
645 new_freqs = wpas_add_channels(op, mode, pos, left);
646 if (new_freqs)
647 int_array_concat(&freqs, new_freqs);
648
649 os_free(new_freqs);
650 }
651
652 return freqs;
653 out:
654 os_free(freqs);
655 return NULL;
656 }
657
658
wpas_beacon_request_freqs(struct wpa_supplicant * wpa_s,u8 op_class,u8 chan,const u8 * subelems,size_t len)659 static int * wpas_beacon_request_freqs(struct wpa_supplicant *wpa_s,
660 u8 op_class, u8 chan,
661 const u8 *subelems, size_t len)
662 {
663 int *freqs = NULL, *ext_freqs = NULL;
664 struct hostapd_hw_modes *mode;
665 const char *country = NULL;
666 const struct oper_class_map *op;
667 const u8 *elem;
668
669 if (!wpa_s->current_bss)
670 return NULL;
671 elem = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
672 if (elem && elem[1] >= 2)
673 country = (const char *) (elem + 2);
674
675 op = get_oper_class(country, op_class);
676 if (!op) {
677 wpa_printf(MSG_DEBUG,
678 "Beacon request: invalid operating class %d",
679 op_class);
680 return NULL;
681 }
682
683 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode,
684 is_6ghz_op_class(op->op_class));
685 if (!mode)
686 return NULL;
687
688 switch (chan) {
689 case 0:
690 freqs = wpas_op_class_freqs(op, mode);
691 if (!freqs)
692 return NULL;
693 break;
694 case 255:
695 /* freqs will be added from AP channel subelements */
696 break;
697 default:
698 freqs = wpas_add_channels(op, mode, &chan, 1);
699 if (!freqs)
700 return NULL;
701 break;
702 }
703
704 ext_freqs = wpas_channel_report_freqs(wpa_s, country, subelems, len);
705 if (ext_freqs) {
706 int_array_concat(&freqs, ext_freqs);
707 os_free(ext_freqs);
708 int_array_sort_unique(freqs);
709 }
710
711 return freqs;
712 }
713
714
wpas_get_op_chan_phy(int freq,const u8 * ies,size_t ies_len,u8 * op_class,u8 * chan,u8 * phy_type)715 int wpas_get_op_chan_phy(int freq, const u8 *ies, size_t ies_len,
716 u8 *op_class, u8 *chan, u8 *phy_type)
717 {
718 const u8 *ie;
719 int sec_chan = 0, vht = 0;
720 struct ieee80211_ht_operation *ht_oper = NULL;
721 struct ieee80211_vht_operation *vht_oper = NULL;
722 u8 seg0, seg1;
723
724 ie = get_ie(ies, ies_len, WLAN_EID_HT_OPERATION);
725 if (ie && ie[1] >= sizeof(struct ieee80211_ht_operation)) {
726 u8 sec_chan_offset;
727
728 ht_oper = (struct ieee80211_ht_operation *) (ie + 2);
729 sec_chan_offset = ht_oper->ht_param &
730 HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
731 if (sec_chan_offset == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
732 sec_chan = 1;
733 else if (sec_chan_offset ==
734 HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
735 sec_chan = -1;
736 }
737
738 ie = get_ie(ies, ies_len, WLAN_EID_VHT_OPERATION);
739 if (ie && ie[1] >= sizeof(struct ieee80211_vht_operation)) {
740 vht_oper = (struct ieee80211_vht_operation *) (ie + 2);
741
742 switch (vht_oper->vht_op_info_chwidth) {
743 case CHANWIDTH_80MHZ:
744 seg0 = vht_oper->vht_op_info_chan_center_freq_seg0_idx;
745 seg1 = vht_oper->vht_op_info_chan_center_freq_seg1_idx;
746 if (seg1 && abs(seg1 - seg0) == 8)
747 vht = CONF_OPER_CHWIDTH_160MHZ;
748 else if (seg1)
749 vht = CONF_OPER_CHWIDTH_80P80MHZ;
750 else
751 vht = CONF_OPER_CHWIDTH_80MHZ;
752 break;
753 case CHANWIDTH_160MHZ:
754 vht = CONF_OPER_CHWIDTH_160MHZ;
755 break;
756 case CHANWIDTH_80P80MHZ:
757 vht = CONF_OPER_CHWIDTH_80P80MHZ;
758 break;
759 default:
760 vht = CONF_OPER_CHWIDTH_USE_HT;
761 break;
762 }
763 }
764
765 if (ieee80211_freq_to_channel_ext(freq, sec_chan, vht, op_class,
766 chan) == NUM_HOSTAPD_MODES) {
767 wpa_printf(MSG_DEBUG,
768 "Cannot determine operating class and channel");
769 return -1;
770 }
771
772 *phy_type = ieee80211_get_phy_type(freq, ht_oper != NULL,
773 vht_oper != NULL);
774 if (*phy_type == PHY_TYPE_UNSPECIFIED) {
775 wpa_printf(MSG_DEBUG, "Cannot determine phy type");
776 return -1;
777 }
778
779 return 0;
780 }
781
782
wpas_beacon_rep_add_frame_body(struct bitfield * eids,struct bitfield * ext_eids,enum beacon_report_detail detail,struct wpa_bss * bss,u8 * buf,size_t buf_len,const u8 ** ies_buf,size_t * ie_len,int add_fixed)783 static int wpas_beacon_rep_add_frame_body(struct bitfield *eids,
784 struct bitfield *ext_eids,
785 enum beacon_report_detail detail,
786 struct wpa_bss *bss, u8 *buf,
787 size_t buf_len, const u8 **ies_buf,
788 size_t *ie_len, int add_fixed)
789 {
790 const u8 *ies = *ies_buf;
791 size_t ies_len = *ie_len;
792 u8 *pos = buf;
793 int rem_len;
794
795 rem_len = 255 - sizeof(struct rrm_measurement_beacon_report) -
796 sizeof(struct rrm_measurement_report_element) - 2 -
797 REPORTED_FRAME_BODY_SUBELEM_LEN;
798
799 if (detail > BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
800 wpa_printf(MSG_DEBUG,
801 "Beacon Request: Invalid reporting detail: %d",
802 detail);
803 return -1;
804 }
805
806 if (detail == BEACON_REPORT_DETAIL_NONE)
807 return 0;
808
809 /*
810 * Minimal frame body subelement size: EID(1) + length(1) + TSF(8) +
811 * beacon interval(2) + capabilities(2) = 14 bytes
812 */
813 if (add_fixed && buf_len < 14)
814 return -1;
815
816 *pos++ = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY;
817 /* The length will be filled later */
818 pos++;
819
820 if (add_fixed) {
821 WPA_PUT_LE64(pos, bss->tsf);
822 pos += sizeof(bss->tsf);
823 WPA_PUT_LE16(pos, bss->beacon_int);
824 pos += 2;
825 WPA_PUT_LE16(pos, bss->caps);
826 pos += 2;
827 }
828
829 rem_len -= pos - buf;
830
831 /*
832 * According to IEEE Std 802.11-2016, 9.4.2.22.7, if the reported frame
833 * body subelement causes the element to exceed the maximum element
834 * size, the subelement is truncated so that the last IE is a complete
835 * IE. So even when required to report all IEs, add elements one after
836 * the other and stop once there is no more room in the measurement
837 * element.
838 */
839 while (ies_len > 2 && 2U + ies[1] <= ies_len && rem_len > 0) {
840 if (detail == BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS ||
841 (eids && bitfield_is_set(eids, ies[0])) ||
842 (ext_eids && ies[0] == WLAN_EID_EXTENSION && ies[1] &&
843 bitfield_is_set(ext_eids, ies[2]))) {
844 u8 elen = ies[1];
845
846 if (2 + elen > buf + buf_len - pos ||
847 2 + elen > rem_len)
848 break;
849
850 *pos++ = ies[0];
851 *pos++ = elen;
852 os_memcpy(pos, ies + 2, elen);
853 pos += elen;
854 rem_len -= 2 + elen;
855 }
856
857 ies_len -= 2 + ies[1];
858 ies += 2 + ies[1];
859 }
860
861 *ie_len = ies_len;
862 *ies_buf = ies;
863
864 /* Now the length is known */
865 buf[1] = pos - buf - 2;
866 return pos - buf;
867 }
868
869
wpas_add_beacon_rep_elem(struct beacon_rep_data * data,struct wpa_bss * bss,struct wpabuf ** wpa_buf,struct rrm_measurement_beacon_report * rep,const u8 ** ie,size_t * ie_len,u8 idx)870 static int wpas_add_beacon_rep_elem(struct beacon_rep_data *data,
871 struct wpa_bss *bss,
872 struct wpabuf **wpa_buf,
873 struct rrm_measurement_beacon_report *rep,
874 const u8 **ie, size_t *ie_len, u8 idx)
875 {
876 int ret;
877 u8 *buf, *pos;
878 u32 subelems_len = REPORTED_FRAME_BODY_SUBELEM_LEN +
879 (data->last_indication ?
880 BEACON_REPORT_LAST_INDICATION_SUBELEM_LEN : 0);
881
882 /* Maximum element length: Beacon Report element + Reported Frame Body
883 * subelement + all IEs of the reported Beacon frame + Reported Frame
884 * Body Fragment ID subelement */
885 buf = os_malloc(sizeof(*rep) + 14 + *ie_len + subelems_len);
886 if (!buf)
887 return -1;
888
889 os_memcpy(buf, rep, sizeof(*rep));
890
891 ret = wpas_beacon_rep_add_frame_body(data->eids, data->ext_eids,
892 data->report_detail,
893 bss, buf + sizeof(*rep),
894 14 + *ie_len, ie, ie_len,
895 idx == 0);
896 if (ret < 0)
897 goto out;
898
899 pos = buf + ret + sizeof(*rep);
900 pos[0] = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY_FRAGMENT_ID;
901 pos[1] = 2;
902
903 /*
904 * Only one Beacon Report Measurement is supported at a time, so
905 * the Beacon Report ID can always be set to 1.
906 */
907 pos[2] = 1;
908
909 /* Fragment ID Number (bits 0..6) and More Frame Body Fragments (bit 7)
910 */
911 pos[3] = idx;
912 if (data->report_detail != BEACON_REPORT_DETAIL_NONE && *ie_len)
913 pos[3] |= REPORTED_FRAME_BODY_MORE_FRAGMENTS;
914 else
915 pos[3] &= ~REPORTED_FRAME_BODY_MORE_FRAGMENTS;
916
917 pos += REPORTED_FRAME_BODY_SUBELEM_LEN;
918
919 if (data->last_indication) {
920 pos[0] = WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION;
921 pos[1] = 1;
922
923 /* This field will be updated later if this is the last frame */
924 pos[2] = 0;
925 }
926
927 ret = wpas_rrm_report_elem(wpa_buf, data->token,
928 MEASUREMENT_REPORT_MODE_ACCEPT,
929 MEASURE_TYPE_BEACON, buf,
930 ret + sizeof(*rep) + subelems_len);
931 out:
932 os_free(buf);
933 return ret;
934 }
935
936
wpas_add_beacon_rep(struct wpa_supplicant * wpa_s,struct wpabuf ** wpa_buf,struct wpa_bss * bss,u64 start,u64 parent_tsf)937 static int wpas_add_beacon_rep(struct wpa_supplicant *wpa_s,
938 struct wpabuf **wpa_buf, struct wpa_bss *bss,
939 u64 start, u64 parent_tsf)
940 {
941 struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
942 const u8 *ies = wpa_bss_ie_ptr(bss);
943 const u8 *pos = ies;
944 size_t ies_len = bss->ie_len ? bss->ie_len : bss->beacon_ie_len;
945 struct rrm_measurement_beacon_report rep;
946 u8 idx = 0;
947
948 if (!ether_addr_equal(data->bssid, broadcast_ether_addr) &&
949 !ether_addr_equal(data->bssid, bss->bssid))
950 return 0;
951
952 if (data->ssid_len &&
953 (data->ssid_len != bss->ssid_len ||
954 os_memcmp(data->ssid, bss->ssid, bss->ssid_len) != 0))
955 return 0;
956
957 if (wpas_get_op_chan_phy(bss->freq, ies, ies_len, &rep.op_class,
958 &rep.channel, &rep.report_info) < 0)
959 return 0;
960
961 rep.start_time = host_to_le64(start);
962 rep.duration = host_to_le16(data->scan_params.duration);
963 rep.rcpi = rssi_to_rcpi(bss->level);
964 rep.rsni = 255; /* 255 indicates that RSNI is not available */
965 os_memcpy(rep.bssid, bss->bssid, ETH_ALEN);
966 rep.antenna_id = 0; /* unknown */
967 rep.parent_tsf = host_to_le32(parent_tsf);
968
969 do {
970 int ret;
971
972 ret = wpas_add_beacon_rep_elem(data, bss, wpa_buf, &rep,
973 &pos, &ies_len, idx++);
974 if (ret)
975 return ret;
976 } while (data->report_detail != BEACON_REPORT_DETAIL_NONE &&
977 ies_len >= 2);
978
979 return 0;
980 }
981
982
wpas_beacon_rep_no_results(struct wpa_supplicant * wpa_s,struct wpabuf ** buf)983 static int wpas_beacon_rep_no_results(struct wpa_supplicant *wpa_s,
984 struct wpabuf **buf)
985 {
986 return wpas_rrm_report_elem(buf, wpa_s->beacon_rep_data.token,
987 MEASUREMENT_REPORT_MODE_ACCEPT,
988 MEASURE_TYPE_BEACON, NULL, 0);
989 }
990
991
wpas_beacon_rep_table(struct wpa_supplicant * wpa_s,struct wpabuf ** buf)992 static void wpas_beacon_rep_table(struct wpa_supplicant *wpa_s,
993 struct wpabuf **buf)
994 {
995 size_t i;
996
997 for (i = 0; i < wpa_s->last_scan_res_used; i++) {
998 if (wpas_add_beacon_rep(wpa_s, buf, wpa_s->last_scan_res[i],
999 0, 0) < 0)
1000 break;
1001 }
1002
1003 if (!(*buf))
1004 wpas_beacon_rep_no_results(wpa_s, buf);
1005
1006 wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", *buf);
1007 }
1008
1009
wpas_rrm_refuse_request(struct wpa_supplicant * wpa_s)1010 void wpas_rrm_refuse_request(struct wpa_supplicant *wpa_s)
1011 {
1012 if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr)) {
1013 struct wpabuf *buf = NULL;
1014
1015 if (wpas_rrm_report_elem(&buf, wpa_s->beacon_rep_data.token,
1016 MEASUREMENT_REPORT_MODE_REJECT_REFUSED,
1017 MEASURE_TYPE_BEACON, NULL, 0)) {
1018 wpa_printf(MSG_ERROR, "RRM: Memory allocation failed");
1019 wpabuf_free(buf);
1020 return;
1021 }
1022
1023 wpas_rrm_send_msr_report(wpa_s, buf);
1024 wpabuf_free(buf);
1025 }
1026
1027 wpas_clear_beacon_rep_data(wpa_s);
1028 }
1029
1030
wpas_rrm_scan_timeout(void * eloop_ctx,void * timeout_ctx)1031 static void wpas_rrm_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1032 {
1033 struct wpa_supplicant *wpa_s = eloop_ctx;
1034 struct wpa_driver_scan_params *params =
1035 &wpa_s->beacon_rep_data.scan_params;
1036 u16 prev_duration = params->duration;
1037
1038 if (!wpa_s->current_bss)
1039 return;
1040
1041 if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) &&
1042 params->duration) {
1043 wpa_printf(MSG_DEBUG,
1044 "RRM: Cannot set scan duration due to missing driver support");
1045 params->duration = 0;
1046 }
1047 os_get_reltime(&wpa_s->beacon_rep_scan);
1048 if (wpa_s->scanning || wpas_p2p_in_progress(wpa_s) ||
1049 wpa_supplicant_trigger_scan(wpa_s, params, true, false))
1050 wpas_rrm_refuse_request(wpa_s);
1051 params->duration = prev_duration;
1052 }
1053
1054
wpas_rm_handle_beacon_req_subelem(struct wpa_supplicant * wpa_s,struct beacon_rep_data * data,u8 sid,u8 slen,const u8 * subelem)1055 static int wpas_rm_handle_beacon_req_subelem(struct wpa_supplicant *wpa_s,
1056 struct beacon_rep_data *data,
1057 u8 sid, u8 slen, const u8 *subelem)
1058 {
1059 struct bitfield *eids;
1060 u8 report_info, i;
1061
1062 switch (sid) {
1063 case WLAN_BEACON_REQUEST_SUBELEM_SSID:
1064 if (!slen) {
1065 wpa_printf(MSG_DEBUG,
1066 "SSID subelement with zero length - wildcard SSID");
1067 break;
1068 }
1069
1070 if (slen > SSID_MAX_LEN) {
1071 wpa_printf(MSG_DEBUG,
1072 "Invalid SSID subelement length: %u", slen);
1073 return -1;
1074 }
1075
1076 data->ssid_len = slen;
1077 os_memcpy(data->ssid, subelem, data->ssid_len);
1078 break;
1079 case WLAN_BEACON_REQUEST_SUBELEM_INFO:
1080 if (slen != 2) {
1081 wpa_printf(MSG_DEBUG,
1082 "Invalid reporting information subelement length: %u",
1083 slen);
1084 return -1;
1085 }
1086
1087 report_info = subelem[0];
1088 if (report_info != 0) {
1089 wpa_printf(MSG_DEBUG,
1090 "reporting information=%u is not supported",
1091 report_info);
1092 return 0;
1093 }
1094 break;
1095 case WLAN_BEACON_REQUEST_SUBELEM_DETAIL:
1096 if (slen != 1) {
1097 wpa_printf(MSG_DEBUG,
1098 "Invalid reporting detail subelement length: %u",
1099 slen);
1100 return -1;
1101 }
1102
1103 data->report_detail = subelem[0];
1104 if (data->report_detail >
1105 BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
1106 wpa_printf(MSG_DEBUG, "Invalid reporting detail: %u",
1107 subelem[0]);
1108 return -1;
1109 }
1110
1111 break;
1112 case WLAN_BEACON_REQUEST_SUBELEM_REQUEST:
1113 case WLAN_BEACON_REQUEST_SUBELEM_EXT_REQUEST:
1114 if (data->report_detail !=
1115 BEACON_REPORT_DETAIL_REQUESTED_ONLY) {
1116 wpa_printf(MSG_DEBUG,
1117 "Beacon request: request subelement is present but report detail is %u",
1118 data->report_detail);
1119 return -1;
1120 }
1121
1122 if (!slen) {
1123 wpa_printf(MSG_DEBUG,
1124 "Invalid request subelement length: %u",
1125 slen);
1126 return -1;
1127 }
1128
1129 if (sid == WLAN_BEACON_REQUEST_SUBELEM_EXT_REQUEST) {
1130 if (slen < 2) {
1131 wpa_printf(MSG_DEBUG,
1132 "Invalid extended request");
1133 return -1;
1134 }
1135 if (subelem[0] != WLAN_EID_EXTENSION) {
1136 wpa_printf(MSG_DEBUG,
1137 "Skip unknown Requested Element ID %u in Extended Request subelement",
1138 subelem[0]);
1139 break;
1140 }
1141
1142 /* Skip the Requested Element ID field */
1143 subelem++;
1144 slen--;
1145 }
1146
1147 if ((sid == WLAN_BEACON_REQUEST_SUBELEM_REQUEST &&
1148 data->eids) ||
1149 (sid == WLAN_BEACON_REQUEST_SUBELEM_EXT_REQUEST &&
1150 data->ext_eids)) {
1151 wpa_printf(MSG_DEBUG,
1152 "Beacon Request: Request sub elements appear more than once");
1153 return -1;
1154 }
1155
1156 eids = bitfield_alloc(255);
1157 if (!eids) {
1158 wpa_printf(MSG_DEBUG, "Failed to allocate EIDs bitmap");
1159 return -1;
1160 }
1161
1162 if (sid == WLAN_BEACON_REQUEST_SUBELEM_REQUEST)
1163 data->eids = eids;
1164 else
1165 data->ext_eids = eids;
1166
1167 for (i = 0; i < slen; i++)
1168 bitfield_set(eids, subelem[i]);
1169 break;
1170 case WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL:
1171 /* Skip - it will be processed when freqs are added */
1172 break;
1173 case WLAN_BEACON_REQUEST_SUBELEM_LAST_INDICATION:
1174 if (slen != 1) {
1175 wpa_printf(MSG_DEBUG,
1176 "Beacon request: Invalid last indication request subelement length: %u",
1177 slen);
1178 return -1;
1179 }
1180
1181 data->last_indication = subelem[0];
1182 break;
1183 default:
1184 wpa_printf(MSG_DEBUG,
1185 "Beacon request: Unknown subelement id %u", sid);
1186 break;
1187 }
1188
1189 return 1;
1190 }
1191
1192
1193 /**
1194 * Returns 0 if the next element can be processed, 1 if some operation was
1195 * triggered, and -1 if processing failed (i.e., the element is in invalid
1196 * format or an internal error occurred).
1197 */
1198 static int
wpas_rm_handle_beacon_req(struct wpa_supplicant * wpa_s,u8 elem_token,int duration_mandatory,const struct rrm_measurement_beacon_request * req,size_t len,struct wpabuf ** buf)1199 wpas_rm_handle_beacon_req(struct wpa_supplicant *wpa_s,
1200 u8 elem_token, int duration_mandatory,
1201 const struct rrm_measurement_beacon_request *req,
1202 size_t len, struct wpabuf **buf)
1203 {
1204 struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1205 struct wpa_driver_scan_params *params = &data->scan_params;
1206 const u8 *subelems;
1207 size_t elems_len;
1208 u16 rand_interval;
1209 u32 interval_usec;
1210 u32 _rand;
1211 int ret = 0, res;
1212 u8 reject_mode;
1213
1214 if (len < sizeof(*req))
1215 return -1;
1216
1217 if (req->mode != BEACON_REPORT_MODE_PASSIVE &&
1218 req->mode != BEACON_REPORT_MODE_ACTIVE &&
1219 req->mode != BEACON_REPORT_MODE_TABLE)
1220 return 0;
1221
1222 subelems = req->variable;
1223 elems_len = len - sizeof(*req);
1224 rand_interval = le_to_host16(req->rand_interval);
1225
1226 os_free(params->freqs);
1227 os_memset(params, 0, sizeof(*params));
1228
1229 data->token = elem_token;
1230
1231 /* default reporting detail is all fixed length fields and all
1232 * elements */
1233 data->report_detail = BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS;
1234 os_memcpy(data->bssid, req->bssid, ETH_ALEN);
1235
1236 while (elems_len >= 2) {
1237 if (subelems[1] > elems_len - 2) {
1238 wpa_printf(MSG_DEBUG,
1239 "Beacon Request: Truncated subelement");
1240 ret = -1;
1241 goto out;
1242 }
1243
1244 res = wpas_rm_handle_beacon_req_subelem(
1245 wpa_s, data, subelems[0], subelems[1], &subelems[2]);
1246 if (res < 0) {
1247 ret = res;
1248 goto out;
1249 } else if (!res) {
1250 reject_mode = MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE;
1251 goto out_reject;
1252 }
1253
1254 elems_len -= 2 + subelems[1];
1255 subelems += 2 + subelems[1];
1256 }
1257
1258 if (req->mode == BEACON_REPORT_MODE_TABLE) {
1259 wpas_beacon_rep_table(wpa_s, buf);
1260 goto out;
1261 }
1262
1263 params->freqs = wpas_beacon_request_freqs(wpa_s, req->oper_class,
1264 req->channel, req->variable,
1265 len - sizeof(*req));
1266 if (!params->freqs) {
1267 wpa_printf(MSG_DEBUG, "Beacon request: No valid channels");
1268 reject_mode = MEASUREMENT_REPORT_MODE_REJECT_REFUSED;
1269 goto out_reject;
1270 }
1271
1272 params->duration = le_to_host16(req->duration);
1273 params->duration_mandatory = duration_mandatory;
1274 if (!params->duration) {
1275 wpa_printf(MSG_DEBUG, "Beacon request: Duration is 0");
1276 ret = -1;
1277 goto out;
1278 }
1279
1280 params->only_new_results = 1;
1281
1282 if (req->mode == BEACON_REPORT_MODE_ACTIVE) {
1283 params->ssids[params->num_ssids].ssid = data->ssid;
1284 params->ssids[params->num_ssids++].ssid_len = data->ssid_len;
1285 }
1286
1287 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
1288 _rand = os_random();
1289 interval_usec = (_rand % (rand_interval + 1)) * 1024;
1290 eloop_register_timeout(0, interval_usec, wpas_rrm_scan_timeout, wpa_s,
1291 NULL);
1292 return 1;
1293 out_reject:
1294 if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1295 wpas_rrm_report_elem(buf, elem_token, reject_mode,
1296 MEASURE_TYPE_BEACON, NULL, 0) < 0) {
1297 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1298 ret = -1;
1299 }
1300 out:
1301 wpas_clear_beacon_rep_data(wpa_s);
1302 return ret;
1303 }
1304
1305
1306 static int
wpas_rrm_handle_msr_req_element(struct wpa_supplicant * wpa_s,const struct rrm_measurement_request_element * req,struct wpabuf ** buf)1307 wpas_rrm_handle_msr_req_element(
1308 struct wpa_supplicant *wpa_s,
1309 const struct rrm_measurement_request_element *req,
1310 struct wpabuf **buf)
1311 {
1312 int duration_mandatory;
1313
1314 wpa_printf(MSG_DEBUG, "Measurement request type %d token %d",
1315 req->type, req->token);
1316
1317 if (req->mode & MEASUREMENT_REQUEST_MODE_ENABLE) {
1318 /* Enable bit is not supported for now */
1319 wpa_printf(MSG_DEBUG, "RRM: Enable bit not supported, ignore");
1320 return 0;
1321 }
1322
1323 if ((req->mode & MEASUREMENT_REQUEST_MODE_PARALLEL) &&
1324 req->type > MEASURE_TYPE_RPI_HIST) {
1325 /* Parallel measurements are not supported for now */
1326 wpa_printf(MSG_DEBUG,
1327 "RRM: Parallel measurements are not supported, reject");
1328 goto reject;
1329 }
1330
1331 duration_mandatory =
1332 !!(req->mode & MEASUREMENT_REQUEST_MODE_DURATION_MANDATORY);
1333
1334 switch (req->type) {
1335 case MEASURE_TYPE_LCI:
1336 return wpas_rrm_build_lci_report(wpa_s, req, buf);
1337 case MEASURE_TYPE_BEACON:
1338 if (duration_mandatory &&
1339 !(wpa_s->drv_rrm_flags &
1340 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL)) {
1341 wpa_printf(MSG_DEBUG,
1342 "RRM: Driver does not support dwell time configuration - reject beacon report with mandatory duration");
1343 goto reject;
1344 }
1345 return wpas_rm_handle_beacon_req(wpa_s, req->token,
1346 duration_mandatory,
1347 (const void *) req->variable,
1348 req->len - 3, buf);
1349 default:
1350 wpa_printf(MSG_INFO,
1351 "RRM: Unsupported radio measurement type %u",
1352 req->type);
1353 break;
1354 }
1355
1356 reject:
1357 if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1358 wpas_rrm_report_elem(buf, req->token,
1359 MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
1360 req->type, NULL, 0) < 0) {
1361 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1362 return -1;
1363 }
1364
1365 return 0;
1366 }
1367
1368
1369 static struct wpabuf *
wpas_rrm_process_msr_req_elems(struct wpa_supplicant * wpa_s,const u8 * pos,size_t len)1370 wpas_rrm_process_msr_req_elems(struct wpa_supplicant *wpa_s, const u8 *pos,
1371 size_t len)
1372 {
1373 struct wpabuf *buf = NULL;
1374
1375 while (len) {
1376 const struct rrm_measurement_request_element *req;
1377 int res;
1378
1379 if (len < 2) {
1380 wpa_printf(MSG_DEBUG, "RRM: Truncated element");
1381 goto out;
1382 }
1383
1384 req = (const struct rrm_measurement_request_element *) pos;
1385 if (req->eid != WLAN_EID_MEASURE_REQUEST) {
1386 wpa_printf(MSG_DEBUG,
1387 "RRM: Expected Measurement Request element, but EID is %u",
1388 req->eid);
1389 goto out;
1390 }
1391
1392 if (req->len < 3) {
1393 wpa_printf(MSG_DEBUG, "RRM: Element length too short");
1394 goto out;
1395 }
1396
1397 if (req->len > len - 2) {
1398 wpa_printf(MSG_DEBUG, "RRM: Element length too long");
1399 goto out;
1400 }
1401
1402 res = wpas_rrm_handle_msr_req_element(wpa_s, req, &buf);
1403 if (res < 0)
1404 goto out;
1405
1406 pos += req->len + 2;
1407 len -= req->len + 2;
1408 }
1409
1410 return buf;
1411
1412 out:
1413 wpabuf_free(buf);
1414 return NULL;
1415 }
1416
1417
wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant * wpa_s,const u8 * src,const u8 * dst,const u8 * frame,size_t len)1418 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
1419 const u8 *src, const u8 *dst,
1420 const u8 *frame, size_t len)
1421 {
1422 struct wpabuf *report;
1423
1424 if (wpa_s->wpa_state != WPA_COMPLETED) {
1425 wpa_printf(MSG_INFO,
1426 "RRM: Ignoring radio measurement request: Not associated");
1427 return;
1428 }
1429
1430 if (!wpa_s->rrm.rrm_used) {
1431 wpa_printf(MSG_INFO,
1432 "RRM: Ignoring radio measurement request: Not RRM network");
1433 return;
1434 }
1435
1436 if (len < 3) {
1437 wpa_printf(MSG_INFO,
1438 "RRM: Ignoring too short radio measurement request");
1439 return;
1440 }
1441
1442 wpa_s->rrm.token = *frame;
1443 os_memcpy(wpa_s->rrm.dst_addr, dst, ETH_ALEN);
1444
1445 /* Number of repetitions is not supported */
1446
1447 report = wpas_rrm_process_msr_req_elems(wpa_s, frame + 3, len - 3);
1448 if (!report)
1449 return;
1450
1451 wpas_rrm_send_msr_report(wpa_s, report);
1452 wpabuf_free(report);
1453 }
1454
1455
wpas_rrm_handle_link_measurement_request(struct wpa_supplicant * wpa_s,const u8 * src,const u8 * frame,size_t len,int rssi)1456 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
1457 const u8 *src,
1458 const u8 *frame, size_t len,
1459 int rssi)
1460 {
1461 struct wpabuf *buf;
1462 const struct rrm_link_measurement_request *req;
1463 struct rrm_link_measurement_report report;
1464
1465 if (wpa_s->wpa_state != WPA_COMPLETED) {
1466 wpa_printf(MSG_INFO,
1467 "RRM: Ignoring link measurement request. Not associated");
1468 return;
1469 }
1470
1471 if (!wpa_s->rrm.rrm_used) {
1472 wpa_printf(MSG_INFO,
1473 "RRM: Ignoring link measurement request. Not RRM network");
1474 return;
1475 }
1476
1477 if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
1478 wpa_printf(MSG_INFO,
1479 "RRM: Measurement report failed. TX power insertion not supported");
1480 return;
1481 }
1482
1483 req = (const struct rrm_link_measurement_request *) frame;
1484 if (len < sizeof(*req)) {
1485 wpa_printf(MSG_INFO,
1486 "RRM: Link measurement report failed. Request too short");
1487 return;
1488 }
1489
1490 os_memset(&report, 0, sizeof(report));
1491 report.dialog_token = req->dialog_token;
1492 report.tpc.eid = WLAN_EID_TPC_REPORT;
1493 report.tpc.len = 2;
1494 /* Note: The driver is expected to update report.tpc.tx_power and
1495 * report.tpc.link_margin subfields when sending out this frame.
1496 * Similarly, the driver would need to update report.rx_ant_id and
1497 * report.tx_ant_id subfields. */
1498 report.rsni = 255; /* 255 indicates that RSNI is not available */
1499 report.rcpi = rssi_to_rcpi(rssi);
1500
1501 /* action_category + action_code */
1502 buf = wpabuf_alloc(2 + sizeof(report));
1503 if (buf == NULL) {
1504 wpa_printf(MSG_ERROR,
1505 "RRM: Link measurement report failed. Buffer allocation failed");
1506 return;
1507 }
1508
1509 wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
1510 wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
1511 wpabuf_put_data(buf, &report, sizeof(report));
1512 wpa_hexdump_buf(MSG_DEBUG, "RRM: Link measurement report", buf);
1513
1514 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
1515 wpa_s->own_addr, wpa_s->bssid,
1516 wpabuf_head(buf), wpabuf_len(buf), 0)) {
1517 wpa_printf(MSG_ERROR,
1518 "RRM: Link measurement report failed. Send action failed");
1519 }
1520 wpabuf_free(buf);
1521 }
1522
1523
wpas_beacon_rep_scan_match(struct wpa_supplicant * wpa_s,const u8 * bssid)1524 static bool wpas_beacon_rep_scan_match(struct wpa_supplicant *wpa_s,
1525 const u8 *bssid)
1526 {
1527 u8 i;
1528
1529 if (!wpa_s->valid_links)
1530 return ether_addr_equal(wpa_s->current_bss->bssid, bssid);
1531
1532 for_each_link(wpa_s->valid_links, i) {
1533 if (ether_addr_equal(wpa_s->links[i].bssid, bssid))
1534 return true;
1535 }
1536
1537 wpa_printf(MSG_DEBUG, "RRM: MLD: no match for TSF BSSID=" MACSTR,
1538 MAC2STR(bssid));
1539
1540 return false;
1541 }
1542
1543
wpas_beacon_rep_scan_process(struct wpa_supplicant * wpa_s,struct wpa_scan_results * scan_res,struct scan_info * info)1544 int wpas_beacon_rep_scan_process(struct wpa_supplicant *wpa_s,
1545 struct wpa_scan_results *scan_res,
1546 struct scan_info *info)
1547 {
1548 size_t i = 0;
1549 struct wpabuf *buf = NULL;
1550
1551 if (!wpa_s->beacon_rep_data.token)
1552 return 0;
1553
1554 if (!wpa_s->current_bss)
1555 goto out;
1556
1557 /* If the measurement was aborted, don't report partial results */
1558 if (info->aborted)
1559 goto out;
1560
1561 wpa_printf(MSG_DEBUG, "RRM: TSF BSSID: " MACSTR_SEC " current BSS: " MACSTR_SEC,
1562 MAC2STR_SEC(info->scan_start_tsf_bssid),
1563 MAC2STR_SEC(wpa_s->current_bss->bssid));
1564 if ((wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1565 !wpas_beacon_rep_scan_match(wpa_s, info->scan_start_tsf_bssid)) {
1566 wpa_printf(MSG_DEBUG,
1567 "RRM: Ignore scan results due to mismatching TSF BSSID");
1568 goto out;
1569 }
1570
1571 for (i = 0; i < scan_res->num; i++) {
1572 struct wpa_bss *bss =
1573 wpa_bss_get_bssid(wpa_s, scan_res->res[i]->bssid);
1574
1575 if (!bss)
1576 continue;
1577
1578 if ((wpa_s->drv_rrm_flags &
1579 WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1580 !wpas_beacon_rep_scan_match(wpa_s,
1581 scan_res->res[i]->tsf_bssid)) {
1582 wpa_printf(MSG_DEBUG,
1583 "RRM: Ignore scan result for " MACSTR_SEC
1584 " due to mismatching TSF BSSID" MACSTR_SEC,
1585 MAC2STR_SEC(scan_res->res[i]->bssid),
1586 MAC2STR_SEC(scan_res->res[i]->tsf_bssid));
1587 continue;
1588 }
1589
1590 /*
1591 * Don't report results that were not received during the
1592 * current measurement.
1593 */
1594 if (!(wpa_s->drv_rrm_flags &
1595 WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT)) {
1596 struct os_reltime update_time, diff;
1597
1598 /* For now, allow 8 ms older results due to some
1599 * unknown issue with cfg80211 BSS table updates during
1600 * a scan with the current BSS.
1601 * TODO: Fix this more properly to avoid having to have
1602 * this type of hacks in place. */
1603 calculate_update_time(&scan_res->fetch_time,
1604 scan_res->res[i]->age,
1605 &update_time);
1606 os_reltime_sub(&wpa_s->beacon_rep_scan,
1607 &update_time, &diff);
1608 if (os_reltime_before(&update_time,
1609 &wpa_s->beacon_rep_scan) &&
1610 (diff.sec || diff.usec >= 8000)) {
1611 wpa_printf(MSG_DEBUG,
1612 "RRM: Ignore scan result for " MACSTR_SEC
1613 " due to old update (age(ms) %u, calculated age %u.%06u seconds)",
1614 MAC2STR_SEC(scan_res->res[i]->bssid),
1615 scan_res->res[i]->age,
1616 (unsigned int) diff.sec,
1617 (unsigned int) diff.usec);
1618 continue;
1619 }
1620 } else if (info->scan_start_tsf >
1621 scan_res->res[i]->parent_tsf) {
1622 continue;
1623 }
1624
1625 if (wpas_add_beacon_rep(wpa_s, &buf, bss, info->scan_start_tsf,
1626 scan_res->res[i]->parent_tsf) < 0)
1627 break;
1628 }
1629
1630 if (!buf && wpas_beacon_rep_no_results(wpa_s, &buf))
1631 goto out;
1632
1633 wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", buf);
1634
1635 wpas_rrm_send_msr_report(wpa_s, buf);
1636 wpabuf_free(buf);
1637
1638 out:
1639 wpas_clear_beacon_rep_data(wpa_s);
1640 return 1;
1641 }
1642
1643
wpas_clear_beacon_rep_data(struct wpa_supplicant * wpa_s)1644 void wpas_clear_beacon_rep_data(struct wpa_supplicant *wpa_s)
1645 {
1646 struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1647
1648 eloop_cancel_timeout(wpas_rrm_scan_timeout, wpa_s, NULL);
1649 bitfield_free(data->eids);
1650 bitfield_free(data->ext_eids);
1651 os_free(data->scan_params.freqs);
1652 os_memset(data, 0, sizeof(*data));
1653 }
1654