1 /*
2 * wpa_supplicant - MBO
3 *
4 * Copyright(c) 2015 Intel Deutschland GmbH
5 * Contact Information:
6 * Intel Linux Wireless <ilw@linux.intel.com>
7 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
8 *
9 * This software may be distributed under the terms of the BSD license.
10 * See README for more details.
11 */
12
13 #include "utils/includes.h"
14
15 #include "utils/common.h"
16 #include "common/ieee802_11_defs.h"
17 #include "common/gas.h"
18 #include "rsn_supp/wpa.h"
19 #include "config.h"
20 #include "wpa_supplicant_i.h"
21 #include "driver_i.h"
22 #include "bss.h"
23 #include "scan.h"
24
25 /* type + length + oui + oui type */
26 #define MBO_IE_HEADER 6
27
28
wpas_mbo_validate_non_pref_chan(u8 oper_class,u8 chan,u8 reason)29 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
30 {
31 if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
32 return -1;
33
34 /* Only checking the validity of the channel and oper_class */
35 if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
36 return -1;
37
38 return 0;
39 }
40
41
mbo_attr_from_mbo_ie(const u8 * mbo_ie,enum mbo_attr_id attr)42 const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
43 {
44 const u8 *mbo;
45 u8 ie_len = mbo_ie[1];
46
47 if (ie_len < MBO_IE_HEADER - 2)
48 return NULL;
49 mbo = mbo_ie + MBO_IE_HEADER;
50
51 return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
52 }
53
54
mbo_get_attr_from_ies(const u8 * ies,size_t ies_len,enum mbo_attr_id attr)55 const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
56 enum mbo_attr_id attr)
57 {
58 const u8 *mbo_ie;
59
60 mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
61 if (!mbo_ie)
62 return NULL;
63
64 return mbo_attr_from_mbo_ie(mbo_ie, attr);
65 }
66
67
wpas_mbo_get_bss_attr(struct wpa_bss * bss,enum mbo_attr_id attr)68 const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
69 {
70 const u8 *mbo, *end;
71
72 if (!bss)
73 return NULL;
74
75 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
76 if (!mbo)
77 return NULL;
78
79 end = mbo + 2 + mbo[1];
80 mbo += MBO_IE_HEADER;
81
82 return get_ie(mbo, end - mbo, attr);
83 }
84
85
wpas_mbo_check_pmf(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)86 void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
87 struct wpa_ssid *ssid)
88 {
89 const u8 *rsne, *mbo, *oce;
90 struct wpa_ie_data ie;
91
92 wpa_s->disable_mbo_oce = 0;
93 if (!bss)
94 return;
95 mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND);
96 oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND);
97 if (!mbo && !oce)
98 return;
99 if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
100 return; /* STA-CFON is not required to enable PMF */
101 rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
102 if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
103 return; /* AP is not using RSN */
104
105 if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
106 wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
107 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
108 wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
109 if (wpa_s->disable_mbo_oce)
110 wpa_printf(MSG_INFO,
111 "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
112 }
113
114
wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)115 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
116 struct wpabuf *mbo,
117 u8 start, u8 end)
118 {
119 u8 i;
120
121 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
122
123 for (i = start; i < end; i++)
124 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
125
126 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
127 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
128 }
129
130
wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf * mbo,size_t size)131 static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
132 {
133 wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
134 wpabuf_put_u8(mbo, size); /* Length */
135 }
136
137
wpas_mbo_non_pref_chan_attr(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)138 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
139 struct wpabuf *mbo, u8 start, u8 end)
140 {
141 size_t size = end - start + 3;
142
143 if (size + 2 > wpabuf_tailroom(mbo))
144 return;
145
146 wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
147 wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
148 }
149
150
wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf * mbo,u8 len)151 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
152 {
153 wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
154 wpabuf_put_u8(mbo, len); /* Length */
155 wpabuf_put_be24(mbo, OUI_WFA);
156 wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
157 }
158
159
wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)160 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
161 struct wpabuf *mbo, u8 start,
162 u8 end)
163 {
164 size_t size = end - start + 7;
165
166 if (size + 2 > wpabuf_tailroom(mbo))
167 return;
168
169 wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
170 wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
171 }
172
173
wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,int subelement)174 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
175 struct wpabuf *mbo, int subelement)
176 {
177 u8 i, start = 0;
178 struct wpa_mbo_non_pref_channel *start_pref;
179
180 if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
181 if (subelement)
182 wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
183 else
184 wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
185 return;
186 }
187 start_pref = &wpa_s->non_pref_chan[0];
188
189 for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
190 struct wpa_mbo_non_pref_channel *non_pref = NULL;
191
192 if (i < wpa_s->non_pref_chan_num)
193 non_pref = &wpa_s->non_pref_chan[i];
194 if (!non_pref ||
195 non_pref->oper_class != start_pref->oper_class ||
196 non_pref->reason != start_pref->reason ||
197 non_pref->preference != start_pref->preference) {
198 if (subelement)
199 wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
200 start, i);
201 else
202 wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
203 i);
204
205 if (!non_pref)
206 return;
207
208 start = i;
209 start_pref = non_pref;
210 }
211 }
212 }
213
214
wpas_mbo_ie(struct wpa_supplicant * wpa_s,u8 * buf,size_t len,int add_oce_capa)215 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len,
216 int add_oce_capa)
217 {
218 struct wpabuf *mbo;
219 int res;
220
221 if (len < MBO_IE_HEADER + 3 + 7 +
222 ((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
223 return 0;
224
225 /* Leave room for the MBO IE header */
226 mbo = wpabuf_alloc(len - MBO_IE_HEADER);
227 if (!mbo)
228 return 0;
229
230 /* Add non-preferred channels attribute */
231 wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
232
233 /*
234 * Send cellular capabilities attribute even if AP does not advertise
235 * cellular capabilities.
236 */
237 wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
238 wpabuf_put_u8(mbo, 1);
239 wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
240
241 /* Add OCE capability indication attribute if OCE is enabled */
242 if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
243 wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
244 wpabuf_put_u8(mbo, 1);
245 wpabuf_put_u8(mbo, OCE_RELEASE);
246 }
247
248 res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
249 if (!res)
250 wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");
251
252 wpabuf_free(mbo);
253 return res;
254 }
255
256
wpas_mbo_send_wnm_notification(struct wpa_supplicant * wpa_s,const u8 * data,size_t len)257 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
258 const u8 *data, size_t len)
259 {
260 struct wpabuf *buf;
261 int res;
262
263 /*
264 * Send WNM-Notification Request frame only in case of a change in
265 * non-preferred channels list during association, if the AP supports
266 * MBO.
267 */
268 if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
269 !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
270 return;
271
272 buf = wpabuf_alloc(4 + len);
273 if (!buf)
274 return;
275
276 wpabuf_put_u8(buf, WLAN_ACTION_WNM);
277 wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
278 wpa_s->mbo_wnm_token++;
279 if (wpa_s->mbo_wnm_token == 0)
280 wpa_s->mbo_wnm_token++;
281 wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
282 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
283
284 wpabuf_put_data(buf, data, len);
285
286 res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
287 wpa_s->own_addr, wpa_s->bssid,
288 wpabuf_head(buf), wpabuf_len(buf), 0);
289 if (res < 0)
290 wpa_printf(MSG_DEBUG,
291 "Failed to send WNM-Notification Request frame with non-preferred channel list");
292
293 wpabuf_free(buf);
294 }
295
296
wpas_mbo_non_pref_chan_changed(struct wpa_supplicant * wpa_s)297 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
298 {
299 struct wpabuf *buf;
300
301 buf = wpabuf_alloc(512);
302 if (!buf)
303 return;
304
305 wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
306 wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
307 wpabuf_len(buf));
308 wpas_update_mbo_connect_params(wpa_s);
309 wpabuf_free(buf);
310 }
311
312
wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel * a,struct wpa_mbo_non_pref_channel * b)313 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
314 struct wpa_mbo_non_pref_channel *b)
315 {
316 return a->oper_class == b->oper_class && a->chan == b->chan;
317 }
318
319
320 /*
321 * wpa_non_pref_chan_cmp - Compare two channels for sorting
322 *
323 * In MBO IE non-preferred channel subelement we can put many channels in an
324 * attribute if they are in the same operating class and have the same
325 * preference and reason. To make it easy for the functions that build
326 * the IE attributes and WNM Request subelements, save the channels sorted
327 * by their oper_class and reason.
328 */
wpa_non_pref_chan_cmp(const void * _a,const void * _b)329 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
330 {
331 const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
332
333 if (a->oper_class != b->oper_class)
334 return (int) a->oper_class - (int) b->oper_class;
335 if (a->reason != b->reason)
336 return (int) a->reason - (int) b->reason;
337 return (int) a->preference - (int) b->preference;
338 }
339
340
wpas_mbo_update_non_pref_chan(struct wpa_supplicant * wpa_s,const char * non_pref_chan)341 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
342 const char *non_pref_chan)
343 {
344 char *cmd, *token, *context = NULL;
345 struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
346 size_t num = 0, size = 0;
347 unsigned i;
348
349 wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
350 non_pref_chan ? non_pref_chan : "N/A");
351
352 /*
353 * The shortest channel configuration is 7 characters - 3 colons and
354 * 4 values.
355 */
356 if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
357 goto update;
358
359 cmd = os_strdup(non_pref_chan);
360 if (!cmd)
361 return -1;
362
363 while ((token = str_token(cmd, " ", &context))) {
364 struct wpa_mbo_non_pref_channel *chan;
365 int ret;
366 unsigned int _oper_class;
367 unsigned int _chan;
368 unsigned int _preference;
369 unsigned int _reason;
370
371 if (num == size) {
372 size = size ? size * 2 : 1;
373 tmp_chans = os_realloc_array(chans, size,
374 sizeof(*chans));
375 if (!tmp_chans) {
376 wpa_printf(MSG_ERROR,
377 "Couldn't reallocate non_pref_chan");
378 goto fail;
379 }
380 chans = tmp_chans;
381 }
382
383 chan = &chans[num];
384
385 ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
386 &_chan, &_preference, &_reason);
387 if (ret != 4 ||
388 _oper_class > 255 || _chan > 255 ||
389 _preference > 255 || _reason > 65535 ) {
390 wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
391 token);
392 goto fail;
393 }
394 chan->oper_class = _oper_class;
395 chan->chan = _chan;
396 chan->preference = _preference;
397 chan->reason = _reason;
398
399 if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
400 chan->chan, chan->reason)) {
401 wpa_printf(MSG_ERROR,
402 "Invalid non_pref_chan: oper class %d chan %d reason %d",
403 chan->oper_class, chan->chan, chan->reason);
404 goto fail;
405 }
406
407 for (i = 0; i < num; i++)
408 if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
409 break;
410 if (i != num) {
411 wpa_printf(MSG_ERROR,
412 "oper class %d chan %d is duplicated",
413 chan->oper_class, chan->chan);
414 goto fail;
415 }
416
417 num++;
418 }
419
420 os_free(cmd);
421
422 if (chans) {
423 qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
424 wpa_non_pref_chan_cmp);
425 }
426
427 update:
428 os_free(wpa_s->non_pref_chan);
429 wpa_s->non_pref_chan = chans;
430 wpa_s->non_pref_chan_num = num;
431 wpas_mbo_non_pref_chan_changed(wpa_s);
432
433 return 0;
434
435 fail:
436 os_free(chans);
437 os_free(cmd);
438 return -1;
439 }
440
441
wpas_mbo_scan_ie(struct wpa_supplicant * wpa_s,struct wpabuf * ie)442 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
443 {
444 u8 *len;
445
446 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
447 len = wpabuf_put(ie, 1);
448
449 wpabuf_put_be24(ie, OUI_WFA);
450 wpabuf_put_u8(ie, MBO_OUI_TYPE);
451
452 wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
453 wpabuf_put_u8(ie, 1);
454 wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
455 if (wpa_s->enable_oce & OCE_STA) {
456 wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
457 wpabuf_put_u8(ie, 1);
458 wpabuf_put_u8(ie, OCE_RELEASE);
459 }
460 *len = (u8 *) wpabuf_put(ie, 0) - len - 1;
461 }
462
463
wpas_mbo_ie_trans_req(struct wpa_supplicant * wpa_s,const u8 * mbo_ie,size_t len)464 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
465 size_t len)
466 {
467 const u8 *pos;
468 u8 id, elen;
469
470 if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
471 mbo_ie[3] != MBO_OUI_TYPE)
472 return;
473
474 pos = mbo_ie + 4;
475 len -= 4;
476
477 while (len >= 2) {
478 id = *pos++;
479 elen = *pos++;
480 len -= 2;
481
482 if (elen > len)
483 goto fail;
484
485 switch (id) {
486 case MBO_ATTR_ID_CELL_DATA_PREF:
487 if (elen != 1)
488 goto fail;
489
490 if (wpa_s->conf->mbo_cell_capa ==
491 MBO_CELL_CAPA_AVAILABLE) {
492 wpa_s->wnm_mbo_cell_pref_present = 1;
493 wpa_s->wnm_mbo_cell_preference = *pos;
494 } else {
495 wpa_printf(MSG_DEBUG,
496 "MBO: Station does not support "
497 "Cellular data connection");
498 }
499 break;
500 case MBO_ATTR_ID_TRANSITION_REASON:
501 if (elen != 1)
502 goto fail;
503
504 wpa_s->wnm_mbo_trans_reason_present = 1;
505 wpa_s->wnm_mbo_transition_reason = *pos;
506 break;
507 case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
508 if (elen != 2)
509 goto fail;
510
511 if (wpa_s->wnm_mode &
512 WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
513 wpa_printf(MSG_DEBUG,
514 "MBO: Unexpected association retry delay, "
515 "BSS is terminating");
516 goto fail;
517 } else if (wpa_s->wnm_mode &
518 WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
519 wpa_s->wnm_mbo_assoc_retry_delay_present = 1;
520 wpa_s->wnm_mbo_assoc_retry_delay_sec = WPA_GET_LE16(pos);
521 wpa_printf(MSG_DEBUG,
522 "MBO: Association retry delay: %u",
523 wpa_s->wnm_mbo_assoc_retry_delay_sec);
524 } else {
525 wpa_printf(MSG_DEBUG,
526 "MBO: Association retry delay attribute "
527 "not in disassoc imminent mode");
528 }
529
530 break;
531 case MBO_ATTR_ID_AP_CAPA_IND:
532 case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
533 case MBO_ATTR_ID_CELL_DATA_CAPA:
534 case MBO_ATTR_ID_ASSOC_DISALLOW:
535 case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
536 wpa_printf(MSG_DEBUG,
537 "MBO: Attribute %d should not be included in BTM Request frame",
538 id);
539 break;
540 default:
541 wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
542 id);
543 return;
544 }
545
546 pos += elen;
547 len -= elen;
548 }
549
550 if (wpa_s->wnm_mbo_cell_pref_present)
551 wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
552 wpa_s->wnm_mbo_cell_preference);
553
554 if (wpa_s->wnm_mbo_trans_reason_present)
555 wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
556 wpa_s->wnm_mbo_transition_reason);
557
558 if (wpa_s->wnm_mbo_assoc_retry_delay_sec && wpa_s->current_bss)
559 wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
560 wpa_s->wnm_mbo_assoc_retry_delay_sec, 0);
561
562 return;
563 fail:
564 wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
565 id, elen, len);
566 }
567
568
wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant * wpa_s,u8 * pos,size_t len,enum mbo_transition_reject_reason reason)569 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
570 size_t len,
571 enum mbo_transition_reject_reason reason)
572 {
573 u8 reject_attr[3];
574
575 reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
576 reject_attr[1] = 1;
577 reject_attr[2] = reason;
578
579 return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
580 }
581
582
wpas_mbo_update_cell_capa(struct wpa_supplicant * wpa_s,u8 mbo_cell_capa)583 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
584 {
585 u8 cell_capa[7];
586
587 if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
588 wpa_printf(MSG_DEBUG,
589 "MBO: Cellular capability already set to %u",
590 mbo_cell_capa);
591 return;
592 }
593
594 wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
595
596 cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
597 cell_capa[1] = 5; /* Length */
598 WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
599 cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
600 cell_capa[6] = mbo_cell_capa;
601
602 wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
603 wpa_supplicant_set_default_scan_ies(wpa_s);
604 wpas_update_mbo_connect_params(wpa_s);
605 }
606
607
mbo_build_anqp_buf(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,u32 mbo_subtypes)608 struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
609 struct wpa_bss *bss, u32 mbo_subtypes)
610 {
611 struct wpabuf *anqp_buf;
612 u8 *len_pos;
613 u8 i;
614
615 if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
616 wpa_printf(MSG_INFO, "MBO: " MACSTR
617 " does not support MBO - cannot request MBO ANQP elements from it",
618 MAC2STR(bss->bssid));
619 return NULL;
620 }
621
622 /* Allocate size for the maximum case - all MBO subtypes are set */
623 anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
624 if (!anqp_buf)
625 return NULL;
626
627 len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
628 wpabuf_put_be24(anqp_buf, OUI_WFA);
629 wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
630
631 wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);
632
633 /* The first valid MBO subtype is 1 */
634 for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
635 if (mbo_subtypes & BIT(i))
636 wpabuf_put_u8(anqp_buf, i);
637 }
638
639 gas_anqp_set_element_len(anqp_buf, len_pos);
640
641 return anqp_buf;
642 }
643
644
mbo_parse_rx_anqp_resp(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,const u8 * sa,const u8 * data,size_t slen)645 void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
646 struct wpa_bss *bss, const u8 *sa,
647 const u8 *data, size_t slen)
648 {
649 const u8 *pos = data;
650 u8 subtype;
651
652 if (slen < 1)
653 return;
654
655 subtype = *pos++;
656 slen--;
657
658 switch (subtype) {
659 case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
660 if (slen < 1)
661 break;
662 wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
663 " cell_conn_pref=%u", MAC2STR(sa), *pos);
664 break;
665 default:
666 wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
667 subtype);
668 break;
669 }
670 }
671