1 /*
2 * Copyright (c) 2009, Atheros Communications, Inc.
3 * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #include <sys/stat.h>
11
12 #include "common.h"
13 #include "eloop.h"
14 #include "common/ieee802_11_common.h"
15 #include "common/ieee802_11_defs.h"
16 #include "common/gas.h"
17 #include "common/wpa_ctrl.h"
18 #include "rsn_supp/wpa.h"
19 #include "wpa_supplicant_i.h"
20 #include "driver_i.h"
21 #include "config.h"
22 #include "scan.h"
23 #include "notify.h"
24 #include "bss.h"
25 #include "blacklist.h"
26 #include "gas_query.h"
27 #include "interworking.h"
28 #include "hs20_supplicant.h"
29 #include "base64.h"
30
31
32 #define OSU_MAX_ITEMS 10
33
34 struct osu_lang_string {
35 char lang[4];
36 char text[253];
37 };
38
39 struct osu_icon {
40 u16 width;
41 u16 height;
42 char lang[4];
43 char icon_type[256];
44 char filename[256];
45 unsigned int id;
46 unsigned int failed:1;
47 };
48
49 struct osu_provider {
50 u8 bssid[ETH_ALEN];
51 u8 osu_ssid[SSID_MAX_LEN];
52 u8 osu_ssid_len;
53 u8 osu_ssid2[SSID_MAX_LEN];
54 u8 osu_ssid2_len;
55 char server_uri[256];
56 u32 osu_methods; /* bit 0 = OMA-DM, bit 1 = SOAP-XML SPP */
57 char osu_nai[256];
58 char osu_nai2[256];
59 struct osu_lang_string friendly_name[OSU_MAX_ITEMS];
60 size_t friendly_name_count;
61 struct osu_lang_string serv_desc[OSU_MAX_ITEMS];
62 size_t serv_desc_count;
63 struct osu_icon icon[OSU_MAX_ITEMS];
64 size_t icon_count;
65 };
66
67
hs20_configure_frame_filters(struct wpa_supplicant * wpa_s)68 void hs20_configure_frame_filters(struct wpa_supplicant *wpa_s)
69 {
70 struct wpa_bss *bss = wpa_s->current_bss;
71 u8 *bssid = wpa_s->bssid;
72 const u8 *ie;
73 const u8 *ext_capa;
74 u32 filter = 0;
75
76 if (!bss || !is_hs20_network(wpa_s, wpa_s->current_ssid, bss)) {
77 wpa_printf(MSG_DEBUG,
78 "Not configuring frame filtering - BSS " MACSTR
79 " is not a Hotspot 2.0 network", MAC2STR(bssid));
80 return;
81 }
82
83 ie = wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE);
84
85 /* Check if DGAF disabled bit is zero (5th byte in the IE) */
86 if (!ie || ie[1] < 5)
87 wpa_printf(MSG_DEBUG,
88 "Not configuring frame filtering - Can't extract DGAF bit");
89 else if (!(ie[6] & HS20_DGAF_DISABLED))
90 filter |= WPA_DATA_FRAME_FILTER_FLAG_GTK;
91
92 ext_capa = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
93 if (!ext_capa || ext_capa[1] < 2) {
94 wpa_printf(MSG_DEBUG,
95 "Not configuring frame filtering - Can't extract Proxy ARP bit");
96 return;
97 }
98
99 if (wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_PROXY_ARP))
100 filter |= WPA_DATA_FRAME_FILTER_FLAG_ARP |
101 WPA_DATA_FRAME_FILTER_FLAG_NA;
102
103 wpa_drv_configure_frame_filters(wpa_s, filter);
104 }
105
106
wpas_hs20_add_indication(struct wpabuf * buf,int pps_mo_id,int ap_release)107 void wpas_hs20_add_indication(struct wpabuf *buf, int pps_mo_id, int ap_release)
108 {
109 int release;
110 u8 conf;
111
112 release = (HS20_VERSION >> 4) + 1;
113 if (ap_release > 0 && release > ap_release)
114 release = ap_release;
115 if (release < 2)
116 pps_mo_id = -1;
117
118 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
119 wpabuf_put_u8(buf, pps_mo_id >= 0 ? 7 : 5);
120 wpabuf_put_be24(buf, OUI_WFA);
121 wpabuf_put_u8(buf, HS20_INDICATION_OUI_TYPE);
122 conf = (release - 1) << 4;
123 if (pps_mo_id >= 0)
124 conf |= HS20_PPS_MO_ID_PRESENT;
125 wpabuf_put_u8(buf, conf);
126 if (pps_mo_id >= 0)
127 wpabuf_put_le16(buf, pps_mo_id);
128 }
129
130
wpas_hs20_add_roam_cons_sel(struct wpabuf * buf,const struct wpa_ssid * ssid)131 void wpas_hs20_add_roam_cons_sel(struct wpabuf *buf,
132 const struct wpa_ssid *ssid)
133 {
134 if (!ssid->roaming_consortium_selection ||
135 !ssid->roaming_consortium_selection_len)
136 return;
137
138 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
139 wpabuf_put_u8(buf, 4 + ssid->roaming_consortium_selection_len);
140 wpabuf_put_be24(buf, OUI_WFA);
141 wpabuf_put_u8(buf, HS20_ROAMING_CONS_SEL_OUI_TYPE);
142 wpabuf_put_data(buf, ssid->roaming_consortium_selection,
143 ssid->roaming_consortium_selection_len);
144 }
145
146
get_hs20_version(struct wpa_bss * bss)147 int get_hs20_version(struct wpa_bss *bss)
148 {
149 const u8 *ie;
150
151 if (!bss)
152 return 0;
153
154 ie = wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE);
155 if (!ie || ie[1] < 5)
156 return 0;
157
158 return ((ie[6] >> 4) & 0x0f) + 1;
159 }
160
161
is_hs20_network(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,struct wpa_bss * bss)162 int is_hs20_network(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
163 struct wpa_bss *bss)
164 {
165 if (!wpa_s->conf->hs20 || !ssid)
166 return 0;
167
168 if (ssid->parent_cred)
169 return 1;
170
171 if (bss && !wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE))
172 return 0;
173
174 /*
175 * This may catch some non-Hotspot 2.0 cases, but it is safer to do that
176 * than cause Hotspot 2.0 connections without indication element getting
177 * added. Non-Hotspot 2.0 APs should ignore the unknown vendor element.
178 */
179
180 if (!(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X))
181 return 0;
182 if (!(ssid->pairwise_cipher & WPA_CIPHER_CCMP))
183 return 0;
184 if (ssid->proto != WPA_PROTO_RSN)
185 return 0;
186
187 return 1;
188 }
189
190
hs20_get_pps_mo_id(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid)191 int hs20_get_pps_mo_id(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
192 {
193 struct wpa_cred *cred;
194
195 if (ssid == NULL)
196 return 0;
197
198 if (ssid->update_identifier)
199 return ssid->update_identifier;
200
201 if (ssid->parent_cred == NULL)
202 return 0;
203
204 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
205 if (ssid->parent_cred == cred)
206 return cred->update_identifier;
207 }
208
209 return 0;
210 }
211
212
hs20_put_anqp_req(u32 stypes,const u8 * payload,size_t payload_len,struct wpabuf * buf)213 void hs20_put_anqp_req(u32 stypes, const u8 *payload, size_t payload_len,
214 struct wpabuf *buf)
215 {
216 u8 *len_pos;
217
218 if (buf == NULL)
219 return;
220
221 len_pos = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
222 wpabuf_put_be24(buf, OUI_WFA);
223 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
224 if (stypes == BIT(HS20_STYPE_NAI_HOME_REALM_QUERY)) {
225 wpabuf_put_u8(buf, HS20_STYPE_NAI_HOME_REALM_QUERY);
226 wpabuf_put_u8(buf, 0); /* Reserved */
227 if (payload)
228 wpabuf_put_data(buf, payload, payload_len);
229 } else if (stypes == BIT(HS20_STYPE_ICON_REQUEST)) {
230 wpabuf_put_u8(buf, HS20_STYPE_ICON_REQUEST);
231 wpabuf_put_u8(buf, 0); /* Reserved */
232 if (payload)
233 wpabuf_put_data(buf, payload, payload_len);
234 } else {
235 u8 i;
236 wpabuf_put_u8(buf, HS20_STYPE_QUERY_LIST);
237 wpabuf_put_u8(buf, 0); /* Reserved */
238 for (i = 0; i < 32; i++) {
239 if (stypes & BIT(i))
240 wpabuf_put_u8(buf, i);
241 }
242 }
243 gas_anqp_set_element_len(buf, len_pos);
244
245 gas_anqp_set_len(buf);
246 }
247
248
hs20_build_anqp_req(u32 stypes,const u8 * payload,size_t payload_len)249 static struct wpabuf * hs20_build_anqp_req(u32 stypes, const u8 *payload,
250 size_t payload_len)
251 {
252 struct wpabuf *buf;
253
254 buf = gas_anqp_build_initial_req(0, 100 + payload_len);
255 if (buf == NULL)
256 return NULL;
257
258 hs20_put_anqp_req(stypes, payload, payload_len, buf);
259
260 return buf;
261 }
262
263
hs20_anqp_send_req(struct wpa_supplicant * wpa_s,const u8 * dst,u32 stypes,const u8 * payload,size_t payload_len,int inmem)264 int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
265 const u8 *payload, size_t payload_len, int inmem)
266 {
267 struct wpabuf *buf;
268 int ret = 0;
269 int freq;
270 struct wpa_bss *bss;
271 int res;
272 struct icon_entry *icon_entry;
273
274 bss = wpa_bss_get_bssid(wpa_s, dst);
275 if (!bss) {
276 wpa_printf(MSG_WARNING,
277 "ANQP: Cannot send query to unknown BSS "
278 MACSTR, MAC2STR(dst));
279 return -1;
280 }
281
282 wpa_bss_anqp_unshare_alloc(bss);
283 freq = bss->freq;
284
285 wpa_printf(MSG_DEBUG, "HS20: ANQP Query Request to " MACSTR " for "
286 "subtypes 0x%x", MAC2STR(dst), stypes);
287
288 buf = hs20_build_anqp_req(stypes, payload, payload_len);
289 if (buf == NULL)
290 return -1;
291
292 res = gas_query_req(wpa_s->gas, dst, freq, 0, buf, anqp_resp_cb, wpa_s);
293 if (res < 0) {
294 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
295 wpabuf_free(buf);
296 return -1;
297 } else
298 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
299 "%u", res);
300
301 if (inmem) {
302 icon_entry = os_zalloc(sizeof(struct icon_entry));
303 if (!icon_entry)
304 return -1;
305 os_memcpy(icon_entry->bssid, dst, ETH_ALEN);
306 icon_entry->file_name = os_malloc(payload_len + 1);
307 if (!icon_entry->file_name) {
308 os_free(icon_entry);
309 return -1;
310 }
311 os_memcpy(icon_entry->file_name, payload, payload_len);
312 icon_entry->file_name[payload_len] = '\0';
313 icon_entry->dialog_token = res;
314
315 dl_list_add(&wpa_s->icon_head, &icon_entry->list);
316 }
317
318 return ret;
319 }
320
321
hs20_find_icon(struct wpa_supplicant * wpa_s,const u8 * bssid,const char * file_name)322 static struct icon_entry * hs20_find_icon(struct wpa_supplicant *wpa_s,
323 const u8 *bssid,
324 const char *file_name)
325 {
326 struct icon_entry *icon;
327
328 dl_list_for_each(icon, &wpa_s->icon_head, struct icon_entry, list) {
329 if (os_memcmp(icon->bssid, bssid, ETH_ALEN) == 0 &&
330 os_strcmp(icon->file_name, file_name) == 0 && icon->image)
331 return icon;
332 }
333
334 return NULL;
335 }
336
337
hs20_get_icon(struct wpa_supplicant * wpa_s,const u8 * bssid,const char * file_name,size_t offset,size_t size,char * reply,size_t buf_len)338 int hs20_get_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
339 const char *file_name, size_t offset, size_t size,
340 char *reply, size_t buf_len)
341 {
342 struct icon_entry *icon;
343 size_t out_size;
344 unsigned char *b64;
345 size_t b64_size;
346 int reply_size;
347
348 wpa_printf(MSG_DEBUG, "HS20: Get icon " MACSTR " %s @ %u +%u (%u)",
349 MAC2STR(bssid), file_name, (unsigned int) offset,
350 (unsigned int) size, (unsigned int) buf_len);
351
352 icon = hs20_find_icon(wpa_s, bssid, file_name);
353 if (!icon || !icon->image || offset >= icon->image_len)
354 return -1;
355 if (size > icon->image_len - offset)
356 size = icon->image_len - offset;
357 out_size = buf_len - 3 /* max base64 padding */;
358 if (size * 4 > out_size * 3)
359 size = out_size * 3 / 4;
360 if (size == 0)
361 return -1;
362
363 b64 = base64_encode(&icon->image[offset], size, &b64_size);
364 if (b64 && buf_len >= b64_size) {
365 os_memcpy(reply, b64, b64_size);
366 reply_size = b64_size;
367 } else {
368 reply_size = -1;
369 }
370 os_free(b64);
371 return reply_size;
372 }
373
374
hs20_free_icon_entry(struct icon_entry * icon)375 static void hs20_free_icon_entry(struct icon_entry *icon)
376 {
377 wpa_printf(MSG_DEBUG, "HS20: Free stored icon from " MACSTR
378 " dialog_token=%u file_name=%s image_len=%u",
379 MAC2STR(icon->bssid), icon->dialog_token,
380 icon->file_name ? icon->file_name : "N/A",
381 (unsigned int) icon->image_len);
382 os_free(icon->file_name);
383 os_free(icon->image);
384 os_free(icon);
385 }
386
387
hs20_del_icon(struct wpa_supplicant * wpa_s,const u8 * bssid,const char * file_name)388 int hs20_del_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
389 const char *file_name)
390 {
391 struct icon_entry *icon, *tmp;
392 int count = 0;
393
394 if (!bssid)
395 wpa_printf(MSG_DEBUG, "HS20: Delete all stored icons");
396 else if (!file_name)
397 wpa_printf(MSG_DEBUG, "HS20: Delete all stored icons for "
398 MACSTR, MAC2STR(bssid));
399 else
400 wpa_printf(MSG_DEBUG, "HS20: Delete stored icons for "
401 MACSTR " file name %s", MAC2STR(bssid), file_name);
402
403 dl_list_for_each_safe(icon, tmp, &wpa_s->icon_head, struct icon_entry,
404 list) {
405 if ((!bssid || os_memcmp(icon->bssid, bssid, ETH_ALEN) == 0) &&
406 (!file_name ||
407 os_strcmp(icon->file_name, file_name) == 0)) {
408 dl_list_del(&icon->list);
409 hs20_free_icon_entry(icon);
410 count++;
411 }
412 }
413 return count == 0 ? -1 : 0;
414 }
415
416
hs20_set_osu_access_permission(const char * osu_dir,const char * fname)417 static void hs20_set_osu_access_permission(const char *osu_dir,
418 const char *fname)
419 {
420 struct stat statbuf;
421
422 /* Get OSU directory information */
423 if (stat(osu_dir, &statbuf) < 0) {
424 wpa_printf(MSG_WARNING, "Cannot stat the OSU directory %s",
425 osu_dir);
426 return;
427 }
428
429 if (chmod(fname, statbuf.st_mode) < 0) {
430 wpa_printf(MSG_WARNING,
431 "Cannot change the permissions for %s", fname);
432 return;
433 }
434
435 if (lchown(fname, statbuf.st_uid, statbuf.st_gid) < 0) {
436 wpa_printf(MSG_WARNING, "Cannot change the ownership for %s",
437 fname);
438 }
439 }
440
441
hs20_remove_duplicate_icons(struct wpa_supplicant * wpa_s,struct icon_entry * new_icon)442 static void hs20_remove_duplicate_icons(struct wpa_supplicant *wpa_s,
443 struct icon_entry *new_icon)
444 {
445 struct icon_entry *icon, *tmp;
446
447 dl_list_for_each_safe(icon, tmp, &wpa_s->icon_head, struct icon_entry,
448 list) {
449 if (icon == new_icon)
450 continue;
451 if (os_memcmp(icon->bssid, new_icon->bssid, ETH_ALEN) == 0 &&
452 os_strcmp(icon->file_name, new_icon->file_name) == 0) {
453 dl_list_del(&icon->list);
454 hs20_free_icon_entry(icon);
455 }
456 }
457 }
458
459
hs20_process_icon_binary_file(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * pos,size_t slen,u8 dialog_token)460 static int hs20_process_icon_binary_file(struct wpa_supplicant *wpa_s,
461 const u8 *sa, const u8 *pos,
462 size_t slen, u8 dialog_token)
463 {
464 char fname[256];
465 int png;
466 FILE *f;
467 u16 data_len;
468 struct icon_entry *icon;
469
470 dl_list_for_each(icon, &wpa_s->icon_head, struct icon_entry, list) {
471 if (icon->dialog_token == dialog_token && !icon->image &&
472 os_memcmp(icon->bssid, sa, ETH_ALEN) == 0) {
473 icon->image = os_memdup(pos, slen);
474 if (!icon->image)
475 return -1;
476 icon->image_len = slen;
477 hs20_remove_duplicate_icons(wpa_s, icon);
478 wpa_msg(wpa_s, MSG_INFO,
479 RX_HS20_ICON MACSTR " %s %u",
480 MAC2STR(sa), icon->file_name,
481 (unsigned int) icon->image_len);
482 wpas_notify_hs20_icon_query_done(wpa_s, sa,
483 icon->file_name,
484 icon->image,
485 icon->image_len);
486 return 0;
487 }
488 }
489
490 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR " Icon Binary File",
491 MAC2STR(sa));
492
493 if (slen < 4) {
494 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
495 "value from " MACSTR, MAC2STR(sa));
496 return -1;
497 }
498
499 wpa_printf(MSG_DEBUG, "HS 2.0: Download Status Code %u", *pos);
500 if (*pos != 0)
501 return -1;
502 pos++;
503 slen--;
504
505 if ((size_t) 1 + pos[0] > slen) {
506 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
507 "value from " MACSTR, MAC2STR(sa));
508 return -1;
509 }
510 wpa_hexdump_ascii(MSG_DEBUG, "Icon Type", pos + 1, pos[0]);
511 png = os_strncasecmp((char *) pos + 1, "image/png", 9) == 0;
512 slen -= 1 + pos[0];
513 pos += 1 + pos[0];
514
515 if (slen < 2) {
516 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
517 "value from " MACSTR, MAC2STR(sa));
518 return -1;
519 }
520 data_len = WPA_GET_LE16(pos);
521 pos += 2;
522 slen -= 2;
523
524 if (data_len > slen) {
525 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
526 "value from " MACSTR, MAC2STR(sa));
527 return -1;
528 }
529
530 wpa_printf(MSG_DEBUG, "Icon Binary Data: %u bytes", data_len);
531 if (wpa_s->conf->osu_dir == NULL)
532 return -1;
533
534 wpa_s->osu_icon_id++;
535 if (wpa_s->osu_icon_id == 0)
536 wpa_s->osu_icon_id++;
537 snprintf(fname, sizeof(fname), "%s/osu-icon-%u.%s",
538 wpa_s->conf->osu_dir, wpa_s->osu_icon_id,
539 png ? "png" : "icon");
540 f = fopen(fname, "wb");
541 if (f == NULL)
542 return -1;
543
544 hs20_set_osu_access_permission(wpa_s->conf->osu_dir, fname);
545
546 if (fwrite(pos, slen, 1, f) != 1) {
547 fclose(f);
548 unlink(fname);
549 return -1;
550 }
551 fclose(f);
552
553 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP_ICON "%s", fname);
554 return 0;
555 }
556
557
hs20_continue_icon_fetch(void * eloop_ctx,void * sock_ctx)558 static void hs20_continue_icon_fetch(void *eloop_ctx, void *sock_ctx)
559 {
560 struct wpa_supplicant *wpa_s = eloop_ctx;
561 if (wpa_s->fetch_osu_icon_in_progress)
562 hs20_next_osu_icon(wpa_s);
563 }
564
565
hs20_osu_icon_fetch_result(struct wpa_supplicant * wpa_s,int res)566 static void hs20_osu_icon_fetch_result(struct wpa_supplicant *wpa_s, int res)
567 {
568 size_t i, j;
569 struct os_reltime now, tmp;
570 int dur;
571
572 os_get_reltime(&now);
573 os_reltime_sub(&now, &wpa_s->osu_icon_fetch_start, &tmp);
574 dur = tmp.sec * 1000 + tmp.usec / 1000;
575 wpa_printf(MSG_DEBUG, "HS 2.0: Icon fetch dur=%d ms res=%d",
576 dur, res);
577
578 for (i = 0; i < wpa_s->osu_prov_count; i++) {
579 struct osu_provider *osu = &wpa_s->osu_prov[i];
580 for (j = 0; j < osu->icon_count; j++) {
581 struct osu_icon *icon = &osu->icon[j];
582 if (icon->id || icon->failed)
583 continue;
584 if (res < 0)
585 icon->failed = 1;
586 else
587 icon->id = wpa_s->osu_icon_id;
588 return;
589 }
590 }
591 }
592
593
hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,const u8 * sa,const u8 * data,size_t slen,u8 dialog_token)594 void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,
595 struct wpa_bss *bss, const u8 *sa,
596 const u8 *data, size_t slen, u8 dialog_token)
597 {
598 const u8 *pos = data;
599 u8 subtype;
600 struct wpa_bss_anqp *anqp = NULL;
601 int ret;
602
603 if (slen < 2)
604 return;
605
606 if (bss)
607 anqp = bss->anqp;
608
609 subtype = *pos++;
610 slen--;
611
612 pos++; /* Reserved */
613 slen--;
614
615 switch (subtype) {
616 case HS20_STYPE_CAPABILITY_LIST:
617 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
618 " HS Capability List", MAC2STR(sa));
619 wpa_hexdump_ascii(MSG_DEBUG, "HS Capability List", pos, slen);
620 if (anqp) {
621 wpabuf_free(anqp->hs20_capability_list);
622 anqp->hs20_capability_list =
623 wpabuf_alloc_copy(pos, slen);
624 }
625 break;
626 case HS20_STYPE_OPERATOR_FRIENDLY_NAME:
627 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
628 " Operator Friendly Name", MAC2STR(sa));
629 wpa_hexdump_ascii(MSG_DEBUG, "oper friendly name", pos, slen);
630 if (anqp) {
631 wpabuf_free(anqp->hs20_operator_friendly_name);
632 anqp->hs20_operator_friendly_name =
633 wpabuf_alloc_copy(pos, slen);
634 }
635 break;
636 case HS20_STYPE_WAN_METRICS:
637 wpa_hexdump(MSG_DEBUG, "WAN Metrics", pos, slen);
638 if (slen < 13) {
639 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short WAN "
640 "Metrics value from " MACSTR, MAC2STR(sa));
641 break;
642 }
643 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
644 " WAN Metrics %02x:%u:%u:%u:%u:%u", MAC2STR(sa),
645 pos[0], WPA_GET_LE32(pos + 1), WPA_GET_LE32(pos + 5),
646 pos[9], pos[10], WPA_GET_LE16(pos + 11));
647 if (anqp) {
648 wpabuf_free(anqp->hs20_wan_metrics);
649 anqp->hs20_wan_metrics = wpabuf_alloc_copy(pos, slen);
650 }
651 break;
652 case HS20_STYPE_CONNECTION_CAPABILITY:
653 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
654 " Connection Capability", MAC2STR(sa));
655 wpa_hexdump_ascii(MSG_DEBUG, "conn capability", pos, slen);
656 if (anqp) {
657 wpabuf_free(anqp->hs20_connection_capability);
658 anqp->hs20_connection_capability =
659 wpabuf_alloc_copy(pos, slen);
660 }
661 break;
662 case HS20_STYPE_OPERATING_CLASS:
663 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
664 " Operating Class", MAC2STR(sa));
665 wpa_hexdump_ascii(MSG_DEBUG, "Operating Class", pos, slen);
666 if (anqp) {
667 wpabuf_free(anqp->hs20_operating_class);
668 anqp->hs20_operating_class =
669 wpabuf_alloc_copy(pos, slen);
670 }
671 break;
672 case HS20_STYPE_OSU_PROVIDERS_LIST:
673 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
674 " OSU Providers list", MAC2STR(sa));
675 wpa_s->num_prov_found++;
676 if (anqp) {
677 wpabuf_free(anqp->hs20_osu_providers_list);
678 anqp->hs20_osu_providers_list =
679 wpabuf_alloc_copy(pos, slen);
680 }
681 break;
682 case HS20_STYPE_ICON_BINARY_FILE:
683 ret = hs20_process_icon_binary_file(wpa_s, sa, pos, slen,
684 dialog_token);
685 if (wpa_s->fetch_osu_icon_in_progress) {
686 hs20_osu_icon_fetch_result(wpa_s, ret);
687 eloop_cancel_timeout(hs20_continue_icon_fetch,
688 wpa_s, NULL);
689 eloop_register_timeout(0, 0, hs20_continue_icon_fetch,
690 wpa_s, NULL);
691 }
692 break;
693 case HS20_STYPE_OPERATOR_ICON_METADATA:
694 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
695 " Operator Icon Metadata", MAC2STR(sa));
696 wpa_hexdump(MSG_DEBUG, "Operator Icon Metadata", pos, slen);
697 if (anqp) {
698 wpabuf_free(anqp->hs20_operator_icon_metadata);
699 anqp->hs20_operator_icon_metadata =
700 wpabuf_alloc_copy(pos, slen);
701 }
702 break;
703 case HS20_STYPE_OSU_PROVIDERS_NAI_LIST:
704 wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
705 " OSU Providers NAI List", MAC2STR(sa));
706 if (anqp) {
707 wpabuf_free(anqp->hs20_osu_providers_nai_list);
708 anqp->hs20_osu_providers_nai_list =
709 wpabuf_alloc_copy(pos, slen);
710 }
711 break;
712 default:
713 wpa_printf(MSG_DEBUG, "HS20: Unsupported subtype %u", subtype);
714 break;
715 }
716 }
717
718
hs20_notify_parse_done(struct wpa_supplicant * wpa_s)719 void hs20_notify_parse_done(struct wpa_supplicant *wpa_s)
720 {
721 if (!wpa_s->fetch_osu_icon_in_progress)
722 return;
723 if (eloop_is_timeout_registered(hs20_continue_icon_fetch, wpa_s, NULL))
724 return;
725 /*
726 * We are going through icon fetch, but no icon response was received.
727 * Assume this means the current AP could not provide an answer to avoid
728 * getting stuck in fetch iteration.
729 */
730 hs20_icon_fetch_failed(wpa_s);
731 }
732
733
hs20_free_osu_prov_entry(struct osu_provider * prov)734 static void hs20_free_osu_prov_entry(struct osu_provider *prov)
735 {
736 }
737
738
hs20_free_osu_prov(struct wpa_supplicant * wpa_s)739 void hs20_free_osu_prov(struct wpa_supplicant *wpa_s)
740 {
741 size_t i;
742 for (i = 0; i < wpa_s->osu_prov_count; i++)
743 hs20_free_osu_prov_entry(&wpa_s->osu_prov[i]);
744 os_free(wpa_s->osu_prov);
745 wpa_s->osu_prov = NULL;
746 wpa_s->osu_prov_count = 0;
747 }
748
749
hs20_osu_fetch_done(struct wpa_supplicant * wpa_s)750 static void hs20_osu_fetch_done(struct wpa_supplicant *wpa_s)
751 {
752 char fname[256];
753 FILE *f;
754 size_t i, j;
755
756 wpa_s->fetch_osu_info = 0;
757 wpa_s->fetch_osu_icon_in_progress = 0;
758
759 if (wpa_s->conf->osu_dir == NULL) {
760 hs20_free_osu_prov(wpa_s);
761 wpa_s->fetch_anqp_in_progress = 0;
762 return;
763 }
764
765 snprintf(fname, sizeof(fname), "%s/osu-providers.txt",
766 wpa_s->conf->osu_dir);
767 f = fopen(fname, "w");
768 if (f == NULL) {
769 wpa_msg(wpa_s, MSG_INFO,
770 "Could not write OSU provider information");
771 hs20_free_osu_prov(wpa_s);
772 wpa_s->fetch_anqp_in_progress = 0;
773 return;
774 }
775
776 hs20_set_osu_access_permission(wpa_s->conf->osu_dir, fname);
777
778 for (i = 0; i < wpa_s->osu_prov_count; i++) {
779 struct osu_provider *osu = &wpa_s->osu_prov[i];
780 if (i > 0)
781 fprintf(f, "\n");
782 fprintf(f, "OSU-PROVIDER " MACSTR "\n"
783 "uri=%s\n"
784 "methods=%08x\n",
785 MAC2STR(osu->bssid), osu->server_uri, osu->osu_methods);
786 if (osu->osu_ssid_len) {
787 fprintf(f, "osu_ssid=%s\n",
788 wpa_ssid_txt(osu->osu_ssid,
789 osu->osu_ssid_len));
790 }
791 if (osu->osu_ssid2_len) {
792 fprintf(f, "osu_ssid2=%s\n",
793 wpa_ssid_txt(osu->osu_ssid2,
794 osu->osu_ssid2_len));
795 }
796 if (osu->osu_nai[0])
797 fprintf(f, "osu_nai=%s\n", osu->osu_nai);
798 if (osu->osu_nai2[0])
799 fprintf(f, "osu_nai2=%s\n", osu->osu_nai2);
800 for (j = 0; j < osu->friendly_name_count; j++) {
801 fprintf(f, "friendly_name=%s:%s\n",
802 osu->friendly_name[j].lang,
803 osu->friendly_name[j].text);
804 }
805 for (j = 0; j < osu->serv_desc_count; j++) {
806 fprintf(f, "desc=%s:%s\n",
807 osu->serv_desc[j].lang,
808 osu->serv_desc[j].text);
809 }
810 for (j = 0; j < osu->icon_count; j++) {
811 struct osu_icon *icon = &osu->icon[j];
812 if (icon->failed)
813 continue; /* could not fetch icon */
814 fprintf(f, "icon=%u:%u:%u:%s:%s:%s\n",
815 icon->id, icon->width, icon->height, icon->lang,
816 icon->icon_type, icon->filename);
817 }
818 }
819 fclose(f);
820 hs20_free_osu_prov(wpa_s);
821
822 wpa_msg(wpa_s, MSG_INFO, "OSU provider fetch completed");
823 wpa_s->fetch_anqp_in_progress = 0;
824 }
825
826
hs20_next_osu_icon(struct wpa_supplicant * wpa_s)827 void hs20_next_osu_icon(struct wpa_supplicant *wpa_s)
828 {
829 size_t i, j;
830
831 wpa_printf(MSG_DEBUG, "HS 2.0: Ready to fetch next icon");
832
833 for (i = 0; i < wpa_s->osu_prov_count; i++) {
834 struct osu_provider *osu = &wpa_s->osu_prov[i];
835 for (j = 0; j < osu->icon_count; j++) {
836 struct osu_icon *icon = &osu->icon[j];
837 if (icon->id || icon->failed)
838 continue;
839
840 wpa_printf(MSG_DEBUG, "HS 2.0: Try to fetch icon '%s' "
841 "from " MACSTR, icon->filename,
842 MAC2STR(osu->bssid));
843 os_get_reltime(&wpa_s->osu_icon_fetch_start);
844 if (hs20_anqp_send_req(wpa_s, osu->bssid,
845 BIT(HS20_STYPE_ICON_REQUEST),
846 (u8 *) icon->filename,
847 os_strlen(icon->filename),
848 0) < 0) {
849 icon->failed = 1;
850 continue;
851 }
852 return;
853 }
854 }
855
856 wpa_printf(MSG_DEBUG, "HS 2.0: No more icons to fetch");
857 hs20_osu_fetch_done(wpa_s);
858 }
859
860
hs20_osu_add_prov(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,const u8 * osu_ssid,u8 osu_ssid_len,const u8 * osu_ssid2,u8 osu_ssid2_len,const u8 * pos,size_t len)861 static void hs20_osu_add_prov(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
862 const u8 *osu_ssid, u8 osu_ssid_len,
863 const u8 *osu_ssid2, u8 osu_ssid2_len,
864 const u8 *pos, size_t len)
865 {
866 struct osu_provider *prov;
867 const u8 *end = pos + len;
868 u16 len2;
869 const u8 *pos2;
870 u8 uri_len, osu_method_len, osu_nai_len;
871
872 wpa_hexdump(MSG_DEBUG, "HS 2.0: Parsing OSU Provider", pos, len);
873 prov = os_realloc_array(wpa_s->osu_prov,
874 wpa_s->osu_prov_count + 1,
875 sizeof(*prov));
876 if (prov == NULL)
877 return;
878 wpa_s->osu_prov = prov;
879 prov = &prov[wpa_s->osu_prov_count];
880 os_memset(prov, 0, sizeof(*prov));
881
882 os_memcpy(prov->bssid, bss->bssid, ETH_ALEN);
883 os_memcpy(prov->osu_ssid, osu_ssid, osu_ssid_len);
884 prov->osu_ssid_len = osu_ssid_len;
885 if (osu_ssid2)
886 os_memcpy(prov->osu_ssid2, osu_ssid2, osu_ssid2_len);
887 prov->osu_ssid2_len = osu_ssid2_len;
888
889 /* OSU Friendly Name Length */
890 if (end - pos < 2) {
891 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
892 "Friendly Name Length");
893 return;
894 }
895 len2 = WPA_GET_LE16(pos);
896 pos += 2;
897 if (len2 > end - pos) {
898 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
899 "Friendly Name Duples");
900 return;
901 }
902 pos2 = pos;
903 pos += len2;
904
905 /* OSU Friendly Name Duples */
906 while (pos - pos2 >= 4 && prov->friendly_name_count < OSU_MAX_ITEMS) {
907 struct osu_lang_string *f;
908 if (1 + pos2[0] > pos - pos2 || pos2[0] < 3) {
909 wpa_printf(MSG_DEBUG, "Invalid OSU Friendly Name");
910 break;
911 }
912 f = &prov->friendly_name[prov->friendly_name_count++];
913 os_memcpy(f->lang, pos2 + 1, 3);
914 os_memcpy(f->text, pos2 + 1 + 3, pos2[0] - 3);
915 pos2 += 1 + pos2[0];
916 }
917
918 /* OSU Server URI */
919 if (end - pos < 1) {
920 wpa_printf(MSG_DEBUG,
921 "HS 2.0: Not enough room for OSU Server URI length");
922 return;
923 }
924 uri_len = *pos++;
925 if (uri_len > end - pos) {
926 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Server "
927 "URI");
928 return;
929 }
930 os_memcpy(prov->server_uri, pos, uri_len);
931 pos += uri_len;
932
933 /* OSU Method list */
934 if (end - pos < 1) {
935 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Method "
936 "list length");
937 return;
938 }
939 osu_method_len = pos[0];
940 if (osu_method_len > end - pos - 1) {
941 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Method "
942 "list");
943 return;
944 }
945 pos2 = pos + 1;
946 pos += 1 + osu_method_len;
947 while (pos2 < pos) {
948 if (*pos2 < 32)
949 prov->osu_methods |= BIT(*pos2);
950 pos2++;
951 }
952
953 /* Icons Available Length */
954 if (end - pos < 2) {
955 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for Icons "
956 "Available Length");
957 return;
958 }
959 len2 = WPA_GET_LE16(pos);
960 pos += 2;
961 if (len2 > end - pos) {
962 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for Icons "
963 "Available");
964 return;
965 }
966 pos2 = pos;
967 pos += len2;
968
969 /* Icons Available */
970 while (pos2 < pos) {
971 struct osu_icon *icon = &prov->icon[prov->icon_count];
972 u8 flen;
973
974 if (2 + 2 + 3 + 1 + 1 > pos - pos2) {
975 wpa_printf(MSG_DEBUG, "HS 2.0: Invalid Icon Metadata");
976 break;
977 }
978
979 icon->width = WPA_GET_LE16(pos2);
980 pos2 += 2;
981 icon->height = WPA_GET_LE16(pos2);
982 pos2 += 2;
983 os_memcpy(icon->lang, pos2, 3);
984 pos2 += 3;
985
986 flen = *pos2++;
987 if (flen > pos - pos2) {
988 wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon Type");
989 break;
990 }
991 os_memcpy(icon->icon_type, pos2, flen);
992 pos2 += flen;
993
994 if (pos - pos2 < 1) {
995 wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon "
996 "Filename length");
997 break;
998 }
999 flen = *pos2++;
1000 if (flen > pos - pos2) {
1001 wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon "
1002 "Filename");
1003 break;
1004 }
1005 os_memcpy(icon->filename, pos2, flen);
1006 pos2 += flen;
1007
1008 prov->icon_count++;
1009 }
1010
1011 /* OSU_NAI */
1012 if (end - pos < 1) {
1013 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU_NAI");
1014 return;
1015 }
1016 osu_nai_len = *pos++;
1017 if (osu_nai_len > end - pos) {
1018 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU_NAI");
1019 return;
1020 }
1021 os_memcpy(prov->osu_nai, pos, osu_nai_len);
1022 pos += osu_nai_len;
1023
1024 /* OSU Service Description Length */
1025 if (end - pos < 2) {
1026 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
1027 "Service Description Length");
1028 return;
1029 }
1030 len2 = WPA_GET_LE16(pos);
1031 pos += 2;
1032 if (len2 > end - pos) {
1033 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
1034 "Service Description Duples");
1035 return;
1036 }
1037 pos2 = pos;
1038 pos += len2;
1039
1040 /* OSU Service Description Duples */
1041 while (pos - pos2 >= 4 && prov->serv_desc_count < OSU_MAX_ITEMS) {
1042 struct osu_lang_string *f;
1043 u8 descr_len;
1044
1045 descr_len = *pos2++;
1046 if (descr_len > pos - pos2 || descr_len < 3) {
1047 wpa_printf(MSG_DEBUG, "Invalid OSU Service "
1048 "Description");
1049 break;
1050 }
1051 f = &prov->serv_desc[prov->serv_desc_count++];
1052 os_memcpy(f->lang, pos2, 3);
1053 os_memcpy(f->text, pos2 + 3, descr_len - 3);
1054 pos2 += descr_len;
1055 }
1056
1057 wpa_printf(MSG_DEBUG, "HS 2.0: Added OSU Provider through " MACSTR,
1058 MAC2STR(bss->bssid));
1059 wpa_s->osu_prov_count++;
1060 }
1061
1062
hs20_osu_icon_fetch(struct wpa_supplicant * wpa_s)1063 void hs20_osu_icon_fetch(struct wpa_supplicant *wpa_s)
1064 {
1065 struct wpa_bss *bss;
1066 struct wpabuf *prov_anqp;
1067 const u8 *pos, *end;
1068 u16 len;
1069 const u8 *osu_ssid, *osu_ssid2;
1070 u8 osu_ssid_len, osu_ssid2_len;
1071 u8 num_providers;
1072
1073 hs20_free_osu_prov(wpa_s);
1074
1075 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1076 struct wpa_ie_data data;
1077 const u8 *ie;
1078
1079 if (bss->anqp == NULL)
1080 continue;
1081 prov_anqp = bss->anqp->hs20_osu_providers_list;
1082 if (prov_anqp == NULL)
1083 continue;
1084 ie = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1085 if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &data) == 0 &&
1086 (data.key_mgmt & WPA_KEY_MGMT_OSEN)) {
1087 osu_ssid2 = bss->ssid;
1088 osu_ssid2_len = bss->ssid_len;
1089 } else {
1090 osu_ssid2 = NULL;
1091 osu_ssid2_len = 0;
1092 }
1093 wpa_printf(MSG_DEBUG, "HS 2.0: Parsing OSU Providers list from "
1094 MACSTR, MAC2STR(bss->bssid));
1095 wpa_hexdump_buf(MSG_DEBUG, "HS 2.0: OSU Providers list",
1096 prov_anqp);
1097 pos = wpabuf_head(prov_anqp);
1098 end = pos + wpabuf_len(prov_anqp);
1099
1100 /* OSU SSID */
1101 if (end - pos < 1)
1102 continue;
1103 if (1 + pos[0] > end - pos) {
1104 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for "
1105 "OSU SSID");
1106 continue;
1107 }
1108 osu_ssid_len = *pos++;
1109 if (osu_ssid_len > SSID_MAX_LEN) {
1110 wpa_printf(MSG_DEBUG, "HS 2.0: Invalid OSU SSID "
1111 "Length %u", osu_ssid_len);
1112 continue;
1113 }
1114 osu_ssid = pos;
1115 pos += osu_ssid_len;
1116
1117 if (end - pos < 1) {
1118 wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for "
1119 "Number of OSU Providers");
1120 continue;
1121 }
1122 num_providers = *pos++;
1123 wpa_printf(MSG_DEBUG, "HS 2.0: Number of OSU Providers: %u",
1124 num_providers);
1125
1126 /* OSU Providers */
1127 while (end - pos > 2 && num_providers > 0) {
1128 num_providers--;
1129 len = WPA_GET_LE16(pos);
1130 pos += 2;
1131 if (len > (unsigned int) (end - pos))
1132 break;
1133 hs20_osu_add_prov(wpa_s, bss, osu_ssid,
1134 osu_ssid_len, osu_ssid2,
1135 osu_ssid2_len, pos, len);
1136 pos += len;
1137 }
1138
1139 if (pos != end) {
1140 wpa_printf(MSG_DEBUG, "HS 2.0: Ignored %d bytes of "
1141 "extra data after OSU Providers",
1142 (int) (end - pos));
1143 }
1144
1145 prov_anqp = bss->anqp->hs20_osu_providers_nai_list;
1146 if (!prov_anqp)
1147 continue;
1148 wpa_printf(MSG_DEBUG,
1149 "HS 2.0: Parsing OSU Providers NAI List from "
1150 MACSTR, MAC2STR(bss->bssid));
1151 wpa_hexdump_buf(MSG_DEBUG, "HS 2.0: OSU Providers NAI List",
1152 prov_anqp);
1153 pos = wpabuf_head(prov_anqp);
1154 end = pos + wpabuf_len(prov_anqp);
1155 num_providers = 0;
1156 while (end - pos > 0) {
1157 len = *pos++;
1158 if (end - pos < len) {
1159 wpa_printf(MSG_DEBUG,
1160 "HS 2.0: Not enough room for OSU_NAI");
1161 break;
1162 }
1163 if (num_providers >= wpa_s->osu_prov_count) {
1164 wpa_printf(MSG_DEBUG,
1165 "HS 2.0: Ignore unexpected OSU Provider NAI List entries");
1166 break;
1167 }
1168 os_memcpy(wpa_s->osu_prov[num_providers].osu_nai2,
1169 pos, len);
1170 pos += len;
1171 num_providers++;
1172 }
1173 }
1174
1175 wpa_s->fetch_osu_icon_in_progress = 1;
1176 hs20_next_osu_icon(wpa_s);
1177 }
1178
1179
hs20_osu_scan_res_handler(struct wpa_supplicant * wpa_s,struct wpa_scan_results * scan_res)1180 static void hs20_osu_scan_res_handler(struct wpa_supplicant *wpa_s,
1181 struct wpa_scan_results *scan_res)
1182 {
1183 wpa_printf(MSG_DEBUG, "OSU provisioning fetch scan completed");
1184 if (!wpa_s->fetch_osu_waiting_scan) {
1185 wpa_printf(MSG_DEBUG, "OSU fetch have been canceled");
1186 return;
1187 }
1188 wpa_s->network_select = 0;
1189 wpa_s->fetch_all_anqp = 1;
1190 wpa_s->fetch_osu_info = 1;
1191 wpa_s->fetch_osu_icon_in_progress = 0;
1192
1193 interworking_start_fetch_anqp(wpa_s);
1194 }
1195
1196
hs20_fetch_osu(struct wpa_supplicant * wpa_s,int skip_scan)1197 int hs20_fetch_osu(struct wpa_supplicant *wpa_s, int skip_scan)
1198 {
1199 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
1200 wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
1201 "interface disabled");
1202 return -1;
1203 }
1204
1205 if (wpa_s->scanning) {
1206 wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
1207 "scanning");
1208 return -1;
1209 }
1210
1211 if (wpa_s->conf->osu_dir == NULL) {
1212 wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
1213 "osu_dir not configured");
1214 return -1;
1215 }
1216
1217 if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
1218 wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
1219 "fetch in progress (%d, %d)",
1220 wpa_s->fetch_anqp_in_progress,
1221 wpa_s->network_select);
1222 return -1;
1223 }
1224
1225 wpa_msg(wpa_s, MSG_INFO, "Starting OSU provisioning information fetch");
1226 wpa_s->num_osu_scans = 0;
1227 wpa_s->num_prov_found = 0;
1228 if (skip_scan) {
1229 wpa_s->network_select = 0;
1230 wpa_s->fetch_all_anqp = 1;
1231 wpa_s->fetch_osu_info = 1;
1232 wpa_s->fetch_osu_icon_in_progress = 0;
1233
1234 interworking_start_fetch_anqp(wpa_s);
1235 } else {
1236 hs20_start_osu_scan(wpa_s);
1237 }
1238
1239 return 0;
1240 }
1241
1242
hs20_start_osu_scan(struct wpa_supplicant * wpa_s)1243 void hs20_start_osu_scan(struct wpa_supplicant *wpa_s)
1244 {
1245 wpa_s->fetch_osu_waiting_scan = 1;
1246 wpa_s->num_osu_scans++;
1247 wpa_s->scan_req = MANUAL_SCAN_REQ;
1248 wpa_s->scan_res_handler = hs20_osu_scan_res_handler;
1249 wpa_supplicant_req_scan(wpa_s, 0, 0);
1250 }
1251
1252
hs20_cancel_fetch_osu(struct wpa_supplicant * wpa_s)1253 void hs20_cancel_fetch_osu(struct wpa_supplicant *wpa_s)
1254 {
1255 wpa_printf(MSG_DEBUG, "Cancel OSU fetch");
1256 interworking_stop_fetch_anqp(wpa_s);
1257 wpa_s->fetch_osu_waiting_scan = 0;
1258 wpa_s->network_select = 0;
1259 wpa_s->fetch_osu_info = 0;
1260 wpa_s->fetch_osu_icon_in_progress = 0;
1261 }
1262
1263
hs20_icon_fetch_failed(struct wpa_supplicant * wpa_s)1264 void hs20_icon_fetch_failed(struct wpa_supplicant *wpa_s)
1265 {
1266 hs20_osu_icon_fetch_result(wpa_s, -1);
1267 eloop_cancel_timeout(hs20_continue_icon_fetch, wpa_s, NULL);
1268 eloop_register_timeout(0, 0, hs20_continue_icon_fetch, wpa_s, NULL);
1269 }
1270
1271
hs20_rx_subscription_remediation(struct wpa_supplicant * wpa_s,const char * url,u8 osu_method)1272 void hs20_rx_subscription_remediation(struct wpa_supplicant *wpa_s,
1273 const char *url, u8 osu_method)
1274 {
1275 if (url)
1276 wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION "%u %s",
1277 osu_method, url);
1278 else
1279 wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION);
1280 wpas_notify_hs20_rx_subscription_remediation(wpa_s, url, osu_method);
1281 }
1282
1283
hs20_rx_deauth_imminent_notice(struct wpa_supplicant * wpa_s,u8 code,u16 reauth_delay,const char * url)1284 void hs20_rx_deauth_imminent_notice(struct wpa_supplicant *wpa_s, u8 code,
1285 u16 reauth_delay, const char *url)
1286 {
1287 if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
1288 wpa_printf(MSG_DEBUG, "HS 2.0: Ignore deauthentication imminent notice since PMF was not enabled");
1289 return;
1290 }
1291
1292 wpa_msg(wpa_s, MSG_INFO, HS20_DEAUTH_IMMINENT_NOTICE "%u %u %s",
1293 code, reauth_delay, url);
1294 wpas_notify_hs20_rx_deauth_imminent_notice(wpa_s, code, reauth_delay, url);
1295
1296 if (code == HS20_DEAUTH_REASON_CODE_BSS) {
1297 wpa_printf(MSG_DEBUG, "HS 2.0: Add BSS to blacklist");
1298 wpa_blacklist_add(wpa_s, wpa_s->bssid);
1299 /* TODO: For now, disable full ESS since some drivers may not
1300 * support disabling per BSS. */
1301 if (wpa_s->current_ssid) {
1302 struct os_reltime now;
1303 os_get_reltime(&now);
1304 if (now.sec + reauth_delay <=
1305 wpa_s->current_ssid->disabled_until.sec)
1306 return;
1307 wpa_printf(MSG_DEBUG, "HS 2.0: Disable network for %u seconds (BSS)",
1308 reauth_delay);
1309 wpa_s->current_ssid->disabled_until.sec =
1310 now.sec + reauth_delay;
1311 }
1312 }
1313
1314 if (code == HS20_DEAUTH_REASON_CODE_ESS && wpa_s->current_ssid) {
1315 struct os_reltime now;
1316 os_get_reltime(&now);
1317 if (now.sec + reauth_delay <=
1318 wpa_s->current_ssid->disabled_until.sec)
1319 return;
1320 wpa_printf(MSG_DEBUG, "HS 2.0: Disable network for %u seconds",
1321 reauth_delay);
1322 wpa_s->current_ssid->disabled_until.sec =
1323 now.sec + reauth_delay;
1324 }
1325 }
1326
1327
hs20_rx_t_c_acceptance(struct wpa_supplicant * wpa_s,const char * url)1328 void hs20_rx_t_c_acceptance(struct wpa_supplicant *wpa_s, const char *url)
1329 {
1330 if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
1331 wpa_printf(MSG_DEBUG,
1332 "HS 2.0: Ignore Terms and Conditions Acceptance since PMF was not enabled");
1333 return;
1334 }
1335
1336 wpa_msg(wpa_s, MSG_INFO, HS20_T_C_ACCEPTANCE "%s", url);
1337 }
1338
1339
hs20_init(struct wpa_supplicant * wpa_s)1340 void hs20_init(struct wpa_supplicant *wpa_s)
1341 {
1342 dl_list_init(&wpa_s->icon_head);
1343 }
1344
1345
hs20_deinit(struct wpa_supplicant * wpa_s)1346 void hs20_deinit(struct wpa_supplicant *wpa_s)
1347 {
1348 eloop_cancel_timeout(hs20_continue_icon_fetch, wpa_s, NULL);
1349 hs20_free_osu_prov(wpa_s);
1350 if (wpa_s->icon_head.next)
1351 hs20_del_icon(wpa_s, NULL, NULL);
1352 }
1353