1 /*
2 * wpa_supplicant - SME
3 * Copyright (c) 2009-2024, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/eloop.h"
13 #include "utils/ext_password.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/ieee802_11_common.h"
16 #include "common/ocv.h"
17 #include "eapol_supp/eapol_supp_sm.h"
18 #include "common/wpa_common.h"
19 #include "common/sae.h"
20 #include "common/dpp.h"
21 #include "rsn_supp/wpa.h"
22 #include "rsn_supp/pmksa_cache.h"
23 #include "config.h"
24 #include "wpa_supplicant_i.h"
25 #include "driver_i.h"
26 #include "wpas_glue.h"
27 #include "wps_supplicant.h"
28 #include "p2p_supplicant.h"
29 #include "notify.h"
30 #include "bss.h"
31 #include "bssid_ignore.h"
32 #include "scan.h"
33 #include "sme.h"
34 #include "hs20_supplicant.h"
35
36 #define SME_AUTH_TIMEOUT 5
37 #define SME_ASSOC_TIMEOUT 5
38
39 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
40 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
41 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
42 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
43
44
45 #ifdef CONFIG_SAE
46
index_within_array(const int * array,int idx)47 static int index_within_array(const int *array, int idx)
48 {
49 int i;
50 for (i = 0; i < idx; i++) {
51 if (array[i] <= 0)
52 return 0;
53 }
54 return 1;
55 }
56
57
sme_set_sae_group(struct wpa_supplicant * wpa_s,bool external)58 static int sme_set_sae_group(struct wpa_supplicant *wpa_s, bool external)
59 {
60 int *groups = wpa_s->conf->sae_groups;
61 int default_groups[] = { 19, 20, 21, 0 };
62
63 if (!groups || groups[0] <= 0)
64 groups = default_groups;
65
66 /* Configuration may have changed, so validate current index */
67 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
68 return -1;
69
70 for (;;) {
71 int group = groups[wpa_s->sme.sae_group_index];
72 if (group <= 0)
73 break;
74 if (!int_array_includes(wpa_s->sme.sae_rejected_groups,
75 group) &&
76 sae_set_group(&wpa_s->sme.sae, group) == 0) {
77 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
78 wpa_s->sme.sae.group);
79 wpa_s->sme.sae.akmp = external ?
80 wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
81 return 0;
82 }
83 wpa_s->sme.sae_group_index++;
84 }
85
86 return -1;
87 }
88
89
sme_auth_build_sae_commit(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,const u8 * bssid,const u8 * mld_addr,int external,int reuse,int * ret_use_pt,bool * ret_use_pk)90 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
91 struct wpa_ssid *ssid,
92 const u8 *bssid,
93 const u8 *mld_addr,
94 int external,
95 int reuse, int *ret_use_pt,
96 bool *ret_use_pk)
97 {
98 struct wpabuf *buf;
99 size_t len;
100 char *password = NULL;
101 struct wpa_bss *bss;
102 int use_pt = 0;
103 bool use_pk = false;
104 u8 rsnxe_capa = 0;
105 int key_mgmt = external ? wpa_s->sme.ext_auth_key_mgmt :
106 wpa_s->key_mgmt;
107 const u8 *addr = mld_addr ? mld_addr : bssid;
108 enum sae_pwe sae_pwe;
109
110 if (ret_use_pt)
111 *ret_use_pt = 0;
112 if (ret_use_pk)
113 *ret_use_pk = false;
114
115 #ifdef CONFIG_TESTING_OPTIONS
116 if (wpa_s->sae_commit_override) {
117 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
118 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
119 if (!buf)
120 goto fail;
121 if (!external) {
122 wpabuf_put_le16(buf, 1); /* Transaction seq# */
123 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
124 }
125 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
126 return buf;
127 }
128 #endif /* CONFIG_TESTING_OPTIONS */
129
130 if (ssid->sae_password) {
131 password = os_strdup(ssid->sae_password);
132 if (!password) {
133 wpa_dbg(wpa_s, MSG_INFO,
134 "SAE: Failed to allocate password");
135 goto fail;
136 }
137 }
138 if (!password && ssid->passphrase) {
139 password = os_strdup(ssid->passphrase);
140 if (!password) {
141 wpa_dbg(wpa_s, MSG_INFO,
142 "SAE: Failed to allocate password");
143 goto fail;
144 }
145 }
146 if (!password && ssid->ext_psk) {
147 struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
148 ssid->ext_psk);
149
150 if (!pw) {
151 wpa_msg(wpa_s, MSG_INFO,
152 "SAE: No password found from external storage");
153 goto fail;
154 }
155
156 password = os_malloc(wpabuf_len(pw) + 1);
157 if (!password) {
158 wpa_dbg(wpa_s, MSG_INFO,
159 "SAE: Failed to allocate password");
160 goto fail;
161 }
162 os_memcpy(password, wpabuf_head(pw), wpabuf_len(pw));
163 password[wpabuf_len(pw)] = '\0';
164 ext_password_free(pw);
165 }
166 if (!password) {
167 wpa_printf(MSG_DEBUG, "SAE: No password available");
168 goto fail;
169 }
170
171 if (reuse && wpa_s->sme.sae.tmp &&
172 ether_addr_equal(addr, wpa_s->sme.sae.tmp->bssid)) {
173 wpa_printf(MSG_DEBUG,
174 "SAE: Reuse previously generated PWE on a retry with the same AP");
175 use_pt = wpa_s->sme.sae.h2e;
176 use_pk = wpa_s->sme.sae.pk;
177 goto reuse_data;
178 }
179 if (sme_set_sae_group(wpa_s, external) < 0) {
180 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
181 goto fail;
182 }
183
184 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
185 if (!bss) {
186 wpa_printf(MSG_DEBUG,
187 "SAE: BSS not available, update scan result to get BSS");
188 wpa_supplicant_update_scan_results(wpa_s, bssid);
189 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
190 }
191 if (bss) {
192 const u8 *rsnxe;
193
194 rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
195 if (rsnxe && rsnxe[0] == WLAN_EID_VENDOR_SPECIFIC &&
196 rsnxe[1] >= 1 + 4)
197 rsnxe_capa = rsnxe[2 + 4];
198 else if (rsnxe && rsnxe[1] >= 1)
199 rsnxe_capa = rsnxe[2];
200 }
201
202 sae_pwe = wpas_get_ssid_sae_pwe(wpa_s, ssid);
203
204 if (ssid->sae_password_id &&
205 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
206 use_pt = 1;
207 if (wpa_key_mgmt_sae_ext_key(key_mgmt) &&
208 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
209 use_pt = 1;
210 if (bss && is_6ghz_freq(bss->freq) &&
211 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
212 use_pt = 1;
213 #ifdef CONFIG_SAE_PK
214 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
215 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
216 ((ssid->sae_password &&
217 sae_pk_valid_password(ssid->sae_password)) ||
218 (!ssid->sae_password && ssid->passphrase &&
219 sae_pk_valid_password(ssid->passphrase)))) {
220 use_pt = 1;
221 use_pk = true;
222 }
223
224 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
225 wpa_printf(MSG_DEBUG,
226 "SAE: Cannot use PK with the selected AP");
227 goto fail;
228 }
229 #endif /* CONFIG_SAE_PK */
230
231 if (use_pt || sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
232 sae_pwe == SAE_PWE_BOTH) {
233 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
234
235 if ((sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
236 ssid->sae_password_id ||
237 wpa_key_mgmt_sae_ext_key(key_mgmt)) &&
238 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK &&
239 !use_pt) {
240 wpa_printf(MSG_DEBUG,
241 "SAE: Cannot use H2E with the selected AP");
242 goto fail;
243 }
244 }
245
246 if (use_pt && !ssid->pt)
247 wpa_s_setup_sae_pt(wpa_s, ssid, true);
248 if (use_pt &&
249 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
250 wpa_s->own_addr, addr,
251 wpa_s->sme.sae_rejected_groups, NULL) < 0)
252 goto fail;
253 if (!use_pt &&
254 sae_prepare_commit(wpa_s->own_addr, addr,
255 (u8 *) password, os_strlen(password),
256 &wpa_s->sme.sae) < 0) {
257 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
258 goto fail;
259 }
260 if (wpa_s->sme.sae.tmp) {
261 os_memcpy(wpa_s->sme.sae.tmp->bssid, addr, ETH_ALEN);
262 if (use_pt && use_pk)
263 wpa_s->sme.sae.pk = 1;
264 #ifdef CONFIG_SAE_PK
265 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
266 ETH_ALEN);
267 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, addr, ETH_ALEN);
268 sae_pk_set_password(&wpa_s->sme.sae, password);
269 #endif /* CONFIG_SAE_PK */
270 }
271
272 reuse_data:
273 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
274 if (ssid->sae_password_id)
275 len += 4 + os_strlen(ssid->sae_password_id);
276 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
277 if (buf == NULL)
278 goto fail;
279 if (!external) {
280 wpabuf_put_le16(buf, 1); /* Transaction seq# */
281 if (use_pk)
282 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
283 else if (use_pt)
284 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
285 else
286 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
287 }
288 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
289 ssid->sae_password_id) < 0) {
290 wpabuf_free(buf);
291 goto fail;
292 }
293 if (ret_use_pt)
294 *ret_use_pt = use_pt;
295 if (ret_use_pk)
296 *ret_use_pk = use_pk;
297
298 str_clear_free(password);
299 return buf;
300
301 fail:
302 str_clear_free(password);
303 return NULL;
304 }
305
306
sme_auth_build_sae_confirm(struct wpa_supplicant * wpa_s,int external)307 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
308 int external)
309 {
310 struct wpabuf *buf;
311
312 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
313 if (buf == NULL)
314 return NULL;
315
316 if (!external) {
317 wpabuf_put_le16(buf, 2); /* Transaction seq# */
318 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
319 }
320 sae_write_confirm(&wpa_s->sme.sae, buf);
321
322 return buf;
323 }
324
325 #endif /* CONFIG_SAE */
326
327
328 /**
329 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
330 * @wpa_s: Pointer to wpa_supplicant data
331 * @bss: Pointer to the bss which is the target of authentication attempt
332 */
sme_auth_handle_rrm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)333 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
334 struct wpa_bss *bss)
335 {
336 const u8 rrm_ie_len = 5;
337 u8 *pos;
338 const u8 *rrm_ie;
339
340 wpa_s->rrm.rrm_used = 0;
341
342 wpa_printf(MSG_DEBUG,
343 "RRM: Determining whether RRM can be used - device support: 0x%x",
344 wpa_s->drv_rrm_flags);
345
346 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
347 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
348 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
349 return;
350 }
351
352 if (!((wpa_s->drv_rrm_flags &
353 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
354 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
355 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
356 wpa_printf(MSG_DEBUG,
357 "RRM: Insufficient RRM support in driver - do not use RRM");
358 return;
359 }
360
361 if (sizeof(wpa_s->sme.assoc_req_ie) <
362 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
363 wpa_printf(MSG_INFO,
364 "RRM: Unable to use RRM, no room for RRM IE");
365 return;
366 }
367
368 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
369 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
370 os_memset(pos, 0, 2 + rrm_ie_len);
371 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
372 *pos++ = rrm_ie_len;
373
374 /* Set supported capabilities flags */
375 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
376 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
377
378 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
379 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
380 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
381
382 if (wpa_s->lci)
383 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
384
385 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
386 wpa_s->rrm.rrm_used = 1;
387 }
388
389
wpas_ml_handle_removed_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)390 static void wpas_ml_handle_removed_links(struct wpa_supplicant *wpa_s,
391 struct wpa_bss *bss)
392 {
393 u16 removed_links = wpa_bss_parse_reconf_ml_element(wpa_s, bss);
394
395 wpa_s->valid_links &= ~removed_links;
396 }
397
398
399 #ifdef CONFIG_TESTING_OPTIONS
wpas_ml_connect_pref(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)400 static struct wpa_bss * wpas_ml_connect_pref(struct wpa_supplicant *wpa_s,
401 struct wpa_bss *bss,
402 struct wpa_ssid *ssid)
403 {
404 unsigned int low, high, i;
405
406 wpa_printf(MSG_DEBUG,
407 "MLD: valid_links=%d, band_pref=%u, bssid_pref=" MACSTR,
408 wpa_s->valid_links,
409 wpa_s->conf->mld_connect_band_pref,
410 MAC2STR(wpa_s->conf->mld_connect_bssid_pref));
411
412 /* Check if there are more than one link */
413 if (!(wpa_s->valid_links & (wpa_s->valid_links - 1)))
414 return bss;
415
416 if (!is_zero_ether_addr(wpa_s->conf->mld_connect_bssid_pref)) {
417 for_each_link(wpa_s->valid_links, i) {
418 if (wpa_s->mlo_assoc_link_id == i)
419 continue;
420
421 if (ether_addr_equal(
422 wpa_s->links[i].bssid,
423 wpa_s->conf->mld_connect_bssid_pref))
424 goto found;
425 }
426 }
427
428 if (wpa_s->conf->mld_connect_band_pref == MLD_CONNECT_BAND_PREF_AUTO)
429 return bss;
430
431 switch (wpa_s->conf->mld_connect_band_pref) {
432 case MLD_CONNECT_BAND_PREF_2GHZ:
433 low = 2412;
434 high = 2472;
435 break;
436 case MLD_CONNECT_BAND_PREF_5GHZ:
437 low = 5180;
438 high = 5985;
439 break;
440 case MLD_CONNECT_BAND_PREF_6GHZ:
441 low = 5955;
442 high = 7125;
443 break;
444 default:
445 return bss;
446 }
447
448 for_each_link(wpa_s->valid_links, i) {
449 if (wpa_s->mlo_assoc_link_id == i)
450 continue;
451
452 if (wpa_s->links[i].freq >= low && wpa_s->links[i].freq <= high)
453 goto found;
454 }
455
456 found:
457 if (i == MAX_NUM_MLD_LINKS) {
458 wpa_printf(MSG_DEBUG, "MLD: No match for connect/band pref");
459 return bss;
460 }
461
462 wpa_printf(MSG_DEBUG,
463 "MLD: Change BSS for connect: " MACSTR " -> " MACSTR,
464 MAC2STR(wpa_s->links[wpa_s->mlo_assoc_link_id].bssid),
465 MAC2STR(wpa_s->links[i].bssid));
466
467 /* Get the BSS entry and do the switch */
468 if (ssid && ssid->ssid_len)
469 bss = wpa_bss_get(wpa_s, wpa_s->links[i].bssid, ssid->ssid,
470 ssid->ssid_len);
471 else
472 bss = wpa_bss_get_bssid(wpa_s, wpa_s->links[i].bssid);
473 wpa_s->mlo_assoc_link_id = i;
474
475 return bss;
476 }
477 #endif /* CONFIG_TESTING_OPTIONS */
478
479
wpas_sme_ml_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data,int ie_offset)480 static int wpas_sme_ml_auth(struct wpa_supplicant *wpa_s,
481 union wpa_event_data *data,
482 int ie_offset)
483 {
484 struct ieee802_11_elems elems;
485 const u8 *mld_addr;
486 u16 status_code = data->auth.status_code;
487
488 if (!wpa_s->valid_links)
489 return 0;
490
491 if (ieee802_11_parse_elems(data->auth.ies + ie_offset,
492 data->auth.ies_len - ie_offset,
493 &elems, 0) == ParseFailed) {
494 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
495 return -1;
496 }
497
498 if (!elems.basic_mle || !elems.basic_mle_len) {
499 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
500 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
501 status_code == WLAN_STATUS_SUCCESS ||
502 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
503 status_code == WLAN_STATUS_SAE_PK)
504 return -1;
505 /* Accept missing Multi-Link element in failed authentication
506 * cases. */
507 return 0;
508 }
509
510 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
511 if (!mld_addr)
512 return -1;
513
514 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
515
516 if (!ether_addr_equal(wpa_s->ap_mld_addr, mld_addr)) {
517 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
518 MACSTR ")", MAC2STR(wpa_s->ap_mld_addr));
519 return -1;
520 }
521
522 return 0;
523 }
524
525
wpas_sme_set_mlo_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)526 static void wpas_sme_set_mlo_links(struct wpa_supplicant *wpa_s,
527 struct wpa_bss *bss, struct wpa_ssid *ssid)
528 {
529 u8 i;
530
531 wpa_s->valid_links = 0;
532 wpa_s->mlo_assoc_link_id = bss->mld_link_id;
533
534 for_each_link(bss->valid_links, i) {
535 const u8 *bssid = bss->mld_links[i].bssid;
536
537 wpa_s->valid_links |= BIT(i);
538 os_memcpy(wpa_s->links[i].bssid, bssid, ETH_ALEN);
539 wpa_s->links[i].freq = bss->mld_links[i].freq;
540 wpa_s->links[i].disabled = bss->mld_links[i].disabled;
541
542 if (bss->mld_link_id == i)
543 wpa_s->links[i].bss = bss;
544 else if (ssid && ssid->ssid_len)
545 wpa_s->links[i].bss = wpa_bss_get(wpa_s, bssid,
546 ssid->ssid,
547 ssid->ssid_len);
548 else
549 wpa_s->links[i].bss = wpa_bss_get_bssid(wpa_s, bssid);
550 }
551 }
552
553
sme_add_assoc_req_ie(struct wpa_supplicant * wpa_s,const struct wpabuf * buf)554 static void sme_add_assoc_req_ie(struct wpa_supplicant *wpa_s,
555 const struct wpabuf *buf)
556 {
557 size_t len;
558 u8 *pos, *end;
559
560 if (!buf)
561 return;
562
563 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
564 end = wpa_s->sme.assoc_req_ie + sizeof(wpa_s->sme.assoc_req_ie);
565 if (pos >= end)
566 return;
567
568 len = wpabuf_len(buf);
569 if (len < (size_t) (end - pos)) {
570 os_memcpy(pos, wpabuf_head(buf), len);
571 wpa_s->sme.assoc_req_ie_len += len;
572 }
573 }
574
575
sme_send_authentication(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,int start)576 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
577 struct wpa_bss *bss, struct wpa_ssid *ssid,
578 int start)
579 {
580 struct wpa_driver_auth_params params;
581 struct wpa_ssid *old_ssid;
582 #ifdef CONFIG_IEEE80211R
583 const u8 *ie;
584 #endif /* CONFIG_IEEE80211R */
585 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
586 const u8 *md = NULL;
587 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
588 int bssid_changed;
589 struct wpabuf *resp = NULL;
590 u8 ext_capab[18];
591 int ext_capab_len;
592 int skip_auth;
593 u8 *wpa_ie;
594 size_t wpa_ie_len;
595 #ifdef CONFIG_MBO
596 const u8 *mbo_ie;
597 #endif /* CONFIG_MBO */
598 int omit_rsnxe = 0;
599
600 if (bss == NULL) {
601 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
602 "the network");
603 wpas_connect_work_done(wpa_s);
604 return;
605 }
606
607 os_memset(¶ms, 0, sizeof(params));
608
609 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
610 !wpa_bss_parse_basic_ml_element(wpa_s, bss, wpa_s->ap_mld_addr,
611 NULL, ssid, NULL) &&
612 bss->valid_links) {
613 wpa_printf(MSG_DEBUG, "MLD: In authentication");
614 wpas_sme_set_mlo_links(wpa_s, bss, ssid);
615
616 #ifdef CONFIG_TESTING_OPTIONS
617 bss = wpas_ml_connect_pref(wpa_s, bss, ssid);
618
619 if (wpa_s->conf->mld_force_single_link) {
620 wpa_printf(MSG_DEBUG, "MLD: Force single link");
621 wpa_s->valid_links = BIT(wpa_s->mlo_assoc_link_id);
622 }
623 #endif /* CONFIG_TESTING_OPTIONS */
624 params.mld = true;
625 params.mld_link_id = wpa_s->mlo_assoc_link_id;
626 params.ap_mld_addr = wpa_s->ap_mld_addr;
627 wpas_ml_handle_removed_links(wpa_s, bss);
628 }
629
630 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
631 wpa_s->reassoc_same_bss;
632 wpa_s->current_bss = bss;
633
634 wpa_s->reassociate = 0;
635
636 params.freq = bss->freq;
637 params.bssid = bss->bssid;
638 params.ssid = bss->ssid;
639 params.ssid_len = bss->ssid_len;
640 params.p2p = ssid->p2p_group;
641
642 if (wpa_s->sme.ssid_len != params.ssid_len ||
643 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
644 wpa_s->sme.prev_bssid_set = 0;
645
646 wpa_s->sme.freq = params.freq;
647 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
648 wpa_s->sme.ssid_len = params.ssid_len;
649
650 params.auth_alg = WPA_AUTH_ALG_OPEN;
651 #ifdef IEEE8021X_EAPOL
652 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
653 if (ssid->leap) {
654 if (ssid->non_leap == 0)
655 params.auth_alg = WPA_AUTH_ALG_LEAP;
656 else
657 params.auth_alg |= WPA_AUTH_ALG_LEAP;
658 }
659 }
660 #endif /* IEEE8021X_EAPOL */
661 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
662 params.auth_alg);
663 if (ssid->auth_alg) {
664 params.auth_alg = ssid->auth_alg;
665 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
666 "0x%x", params.auth_alg);
667 }
668 #ifdef CONFIG_SAE
669 wpa_s->sme.sae_pmksa_caching = 0;
670 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
671 const u8 *rsn;
672 struct wpa_ie_data ied;
673
674 rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
675 if (!rsn) {
676 wpa_dbg(wpa_s, MSG_DEBUG,
677 "SAE enabled, but target BSS does not advertise RSN");
678 #ifdef CONFIG_DPP
679 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
680 (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
681 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
682 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
683 #endif /* CONFIG_DPP */
684 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
685 wpa_key_mgmt_sae(ied.key_mgmt)) {
686 if (wpas_is_sae_avoided(wpa_s, ssid, &ied)) {
687 wpa_dbg(wpa_s, MSG_DEBUG,
688 "SAE enabled, but disallowing SAE auth_alg without PMF");
689 } else {
690 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
691 params.auth_alg = WPA_AUTH_ALG_SAE;
692 }
693 } else {
694 wpa_dbg(wpa_s, MSG_DEBUG,
695 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
696 }
697 }
698 #endif /* CONFIG_SAE */
699
700 #ifdef CONFIG_WEP
701 {
702 int i;
703
704 for (i = 0; i < NUM_WEP_KEYS; i++) {
705 if (ssid->wep_key_len[i])
706 params.wep_key[i] = ssid->wep_key[i];
707 params.wep_key_len[i] = ssid->wep_key_len[i];
708 }
709 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
710 }
711 #endif /* CONFIG_WEP */
712
713 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
714 wpa_bss_get_rsne(wpa_s, bss, ssid, false)) &&
715 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
716 int try_opportunistic;
717 const u8 *cache_id = NULL;
718
719 try_opportunistic = (ssid->proactive_key_caching < 0 ?
720 wpa_s->conf->okc :
721 ssid->proactive_key_caching) &&
722 (ssid->proto & WPA_PROTO_RSN);
723 #ifdef CONFIG_FILS
724 if (wpa_key_mgmt_fils(ssid->key_mgmt))
725 cache_id = wpa_bss_get_fils_cache_id(bss);
726 #endif /* CONFIG_FILS */
727 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
728 params.mld ? params.ap_mld_addr :
729 bss->bssid,
730 wpa_s->current_ssid,
731 try_opportunistic, cache_id,
732 0, false) == 0)
733 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
734 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
735 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
736 wpa_s->sme.assoc_req_ie,
737 &wpa_s->sme.assoc_req_ie_len,
738 false)) {
739 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
740 "key management and encryption suites");
741 wpas_connect_work_done(wpa_s);
742 return;
743 }
744 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
745 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
746 /*
747 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
748 * use non-WPA since the scan results did not indicate that the
749 * AP is using WPA or WPA2.
750 */
751 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
752 wpa_s->sme.assoc_req_ie_len = 0;
753 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
754 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
755 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
756 wpa_s->sme.assoc_req_ie,
757 &wpa_s->sme.assoc_req_ie_len,
758 false)) {
759 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
760 "key management and encryption suites (no "
761 "scan results)");
762 wpas_connect_work_done(wpa_s);
763 return;
764 }
765 #ifdef CONFIG_WPS
766 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
767 struct wpabuf *wps_ie;
768
769 wpa_s->sme.assoc_req_ie_len = 0;
770 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
771 sme_add_assoc_req_ie(wpa_s, wps_ie);
772 wpabuf_free(wps_ie);
773 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
774 #endif /* CONFIG_WPS */
775 } else {
776 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
777 wpa_s->sme.assoc_req_ie_len = 0;
778 }
779
780 /* In case the WPA vendor IE is used, it should be placed after all the
781 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
782 * defined in the standard. Store the WPA IE so it can later be
783 * inserted at the correct location.
784 */
785 wpa_ie = NULL;
786 wpa_ie_len = 0;
787 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
788 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
789 wpa_s->sme.assoc_req_ie_len);
790 if (wpa_ie) {
791 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
792
793 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
794 wpa_s->sme.assoc_req_ie_len = 0;
795 } else {
796 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
797 wpas_connect_work_done(wpa_s);
798 return;
799 }
800 }
801
802 #ifdef CONFIG_IEEE80211R
803 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
804 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
805 md = ie + 2;
806 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
807 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
808 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
809 md = NULL;
810 if (md) {
811 /* Prepare for the next transition */
812 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
813 }
814
815 if (md) {
816 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
817 md[0], md[1]);
818
819 if (wpa_s->sme.assoc_req_ie_len + 5 <
820 sizeof(wpa_s->sme.assoc_req_ie)) {
821 struct rsn_mdie *mdie;
822 u8 *pos = wpa_s->sme.assoc_req_ie +
823 wpa_s->sme.assoc_req_ie_len;
824 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
825 *pos++ = sizeof(*mdie);
826 mdie = (struct rsn_mdie *) pos;
827 os_memcpy(mdie->mobility_domain, md,
828 MOBILITY_DOMAIN_ID_LEN);
829 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
830 wpa_s->sme.assoc_req_ie_len += 5;
831 }
832
833 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
834 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
835 wpa_sm_has_ft_keys(wpa_s->wpa, md)) {
836 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
837 "over-the-air");
838 omit_rsnxe = !wpa_bss_get_rsnxe(wpa_s, bss, ssid,
839 false);
840 params.auth_alg = WPA_AUTH_ALG_FT;
841 params.ie = wpa_s->sme.ft_ies;
842 params.ie_len = wpa_s->sme.ft_ies_len;
843 }
844 }
845 #endif /* CONFIG_IEEE80211R */
846
847 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
848 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
849 const u8 *rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
850 struct wpa_ie_data _ie;
851 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
852 _ie.capabilities &
853 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
854 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
855 "MFP: require MFP");
856 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
857 }
858 }
859
860 wpa_s->sme.spp_amsdu = wpa_sm_uses_spp_amsdu(wpa_s->wpa);
861
862 #ifdef CONFIG_P2P
863 if (wpa_s->global->p2p) {
864 u8 *pos;
865 size_t len;
866 int res;
867 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
868 len = sizeof(wpa_s->sme.assoc_req_ie) -
869 wpa_s->sme.assoc_req_ie_len;
870 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
871 ssid->p2p_group);
872 if (res >= 0)
873 wpa_s->sme.assoc_req_ie_len += res;
874 }
875 #endif /* CONFIG_P2P */
876
877 #ifdef CONFIG_FST
878 sme_add_assoc_req_ie(wpa_s, wpa_s->fst_ies);
879 #endif /* CONFIG_FST */
880
881 sme_auth_handle_rrm(wpa_s, bss);
882
883 #ifndef CONFIG_NO_RRM
884 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
885 wpa_s, ssid, bss,
886 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
887 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
888 #endif /* CONFIG_NO_RRM */
889
890 if (params.p2p)
891 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
892 else
893 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
894
895 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
896 sizeof(ext_capab), bss);
897 if (ext_capab_len > 0) {
898 u8 *pos = wpa_s->sme.assoc_req_ie;
899 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
900 pos += 2 + pos[1];
901 os_memmove(pos + ext_capab_len, pos,
902 wpa_s->sme.assoc_req_ie_len -
903 (pos - wpa_s->sme.assoc_req_ie));
904 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
905 os_memcpy(pos, ext_capab, ext_capab_len);
906 }
907
908 if (ssid->max_idle && wpa_s->sme.assoc_req_ie_len + 5 <=
909 sizeof(wpa_s->sme.assoc_req_ie)) {
910 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
911
912 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
913 *pos++ = 3;
914 WPA_PUT_LE16(pos, ssid->max_idle);
915 pos += 2;
916 *pos = 0; /* Idle Options */
917 wpa_s->sme.assoc_req_ie_len += 5;
918 }
919
920 #ifdef CONFIG_TESTING_OPTIONS
921 if (wpa_s->rsnxe_override_assoc) {
922 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
923 sme_add_assoc_req_ie(wpa_s, wpa_s->rsnxe_override_assoc);
924 } else
925 #endif /* CONFIG_TESTING_OPTIONS */
926 if (wpa_s->rsnxe_len > 0 &&
927 wpa_s->rsnxe_len <=
928 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
929 !omit_rsnxe) {
930 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
931 wpa_s->rsnxe, wpa_s->rsnxe_len);
932 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
933 }
934
935 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION &&
936 wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_KNOWN_STA_IDENTIFICATION)) {
937 struct wpabuf *e;
938
939 e = wpa_sm_known_sta_identification(
940 wpa_s->wpa,
941 params.mld ? params.ap_mld_addr : bss->bssid,
942 bss->tsf);
943 if (e) {
944 wpa_printf(MSG_DEBUG,
945 "SME: Add Known STA Identification element");
946 sme_add_assoc_req_ie(wpa_s, e);
947 wpabuf_free(e);
948 }
949 }
950
951 #ifdef CONFIG_HS20
952 if (is_hs20_network(wpa_s, ssid, bss)
953 #ifndef ANDROID /* Android does not use the native HS 2.0 config */
954 && is_hs20_config(wpa_s)
955 #endif /* ANDROID */
956 ) {
957 struct wpabuf *hs20;
958
959 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
960 if (hs20) {
961 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
962
963 wpas_hs20_add_indication(hs20, pps_mo_id,
964 get_hs20_version(bss));
965 wpas_hs20_add_roam_cons_sel(hs20, ssid);
966 sme_add_assoc_req_ie(wpa_s, hs20);
967 wpabuf_free(hs20);
968 }
969 }
970 #endif /* CONFIG_HS20 */
971
972 if (wpa_ie) {
973 size_t len;
974
975 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
976
977 len = sizeof(wpa_s->sme.assoc_req_ie) -
978 wpa_s->sme.assoc_req_ie_len;
979
980 if (len > wpa_ie_len) {
981 os_memcpy(wpa_s->sme.assoc_req_ie +
982 wpa_s->sme.assoc_req_ie_len,
983 wpa_ie, wpa_ie_len);
984 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
985 } else {
986 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
987 }
988
989 os_free(wpa_ie);
990 }
991
992 sme_add_assoc_req_ie(wpa_s, wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]);
993
994 #ifdef CONFIG_MBO
995 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
996 if (!wpa_s->disable_mbo_oce && mbo_ie) {
997 int len;
998
999 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
1000 wpa_s->sme.assoc_req_ie_len,
1001 sizeof(wpa_s->sme.assoc_req_ie) -
1002 wpa_s->sme.assoc_req_ie_len,
1003 !!mbo_attr_from_mbo_ie(mbo_ie,
1004 OCE_ATTR_ID_CAPA_IND));
1005 if (len >= 0)
1006 wpa_s->sme.assoc_req_ie_len += len;
1007 }
1008 #endif /* CONFIG_MBO */
1009
1010 #ifdef CONFIG_SAE
1011 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
1012 pmksa_cache_set_current(wpa_s->wpa, NULL,
1013 params.mld ? params.ap_mld_addr :
1014 bss->bssid,
1015 ssid, 0,
1016 NULL,
1017 wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
1018 wpa_s->key_mgmt :
1019 (int) WPA_KEY_MGMT_SAE, false) == 0) {
1020 wpa_dbg(wpa_s, MSG_DEBUG,
1021 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
1022 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1023 params.auth_alg = WPA_AUTH_ALG_OPEN;
1024 wpa_s->sme.sae_pmksa_caching = 1;
1025 }
1026
1027 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
1028 if (start)
1029 resp = sme_auth_build_sae_commit(wpa_s, ssid,
1030 bss->bssid,
1031 params.mld ?
1032 params.ap_mld_addr :
1033 NULL, 0,
1034 start == 2, NULL,
1035 NULL);
1036 else
1037 resp = sme_auth_build_sae_confirm(wpa_s, 0);
1038 if (resp == NULL) {
1039 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1040 return;
1041 }
1042 params.auth_data = wpabuf_head(resp);
1043 params.auth_data_len = wpabuf_len(resp);
1044 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
1045 }
1046 #endif /* CONFIG_SAE */
1047
1048 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1049 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1050 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1051 if (bssid_changed)
1052 wpas_notify_bssid_changed(wpa_s);
1053
1054 old_ssid = wpa_s->current_ssid;
1055 wpa_s->current_ssid = ssid;
1056 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
1057 wpa_sm_set_ssid(wpa_s->wpa, bss->ssid, bss->ssid_len);
1058 wpa_supplicant_initiate_eapol(wpa_s);
1059
1060 #ifdef CONFIG_FILS
1061 /* TODO: FILS operations can in some cases be done between different
1062 * network_ctx (i.e., same credentials can be used with multiple
1063 * networks). */
1064 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
1065 wpa_key_mgmt_fils(ssid->key_mgmt)) {
1066 const u8 *indic;
1067 u16 fils_info;
1068 const u8 *realm, *username, *rrk;
1069 size_t realm_len, username_len, rrk_len;
1070 u16 next_seq_num;
1071
1072 /*
1073 * Check FILS Indication element (FILS Information field) bits
1074 * indicating supported authentication algorithms against local
1075 * configuration (ssid->fils_dh_group). Try to use FILS
1076 * authentication only if the AP supports the combination in the
1077 * network profile. */
1078 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
1079 if (!indic || indic[1] < 2) {
1080 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1081 " does not include FILS Indication element - cannot use FILS authentication with it",
1082 MAC2STR(bss->bssid));
1083 goto no_fils;
1084 }
1085
1086 fils_info = WPA_GET_LE16(indic + 2);
1087 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
1088 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1089 " does not support FILS SK without PFS - cannot use FILS authentication with it",
1090 MAC2STR(bss->bssid));
1091 goto no_fils;
1092 }
1093 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
1094 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1095 " does not support FILS SK with PFS - cannot use FILS authentication with it",
1096 MAC2STR(bss->bssid));
1097 goto no_fils;
1098 }
1099
1100 if (wpa_s->last_con_fail_realm &&
1101 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
1102 &username, &username_len,
1103 &realm, &realm_len, &next_seq_num,
1104 &rrk, &rrk_len) == 0 &&
1105 realm && realm_len == wpa_s->last_con_fail_realm_len &&
1106 os_memcmp(realm, wpa_s->last_con_fail_realm,
1107 realm_len) == 0) {
1108 wpa_printf(MSG_DEBUG,
1109 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
1110 goto no_fils;
1111 }
1112
1113 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
1114 params.mld ? params.ap_mld_addr :
1115 bss->bssid,
1116 ssid, 0,
1117 wpa_bss_get_fils_cache_id(bss),
1118 0, false) == 0)
1119 wpa_printf(MSG_DEBUG,
1120 "SME: Try to use FILS with PMKSA caching");
1121 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
1122 if (resp) {
1123 int auth_alg;
1124
1125 if (ssid->fils_dh_group)
1126 wpa_printf(MSG_DEBUG,
1127 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
1128 ssid->fils_dh_group);
1129 else
1130 wpa_printf(MSG_DEBUG,
1131 "SME: Try to use FILS SK authentication without PFS");
1132 auth_alg = ssid->fils_dh_group ?
1133 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
1134 params.auth_alg = auth_alg;
1135 params.auth_data = wpabuf_head(resp);
1136 params.auth_data_len = wpabuf_len(resp);
1137 wpa_s->sme.auth_alg = auth_alg;
1138 }
1139 }
1140 no_fils:
1141 #endif /* CONFIG_FILS */
1142
1143 wpa_supplicant_cancel_sched_scan(wpa_s);
1144 wpa_supplicant_cancel_scan(wpa_s);
1145
1146 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
1147 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
1148 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
1149
1150 eapol_sm_notify_portValid(wpa_s->eapol, false);
1151 wpa_clear_keys(wpa_s, bss->bssid);
1152 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1153 if (old_ssid != wpa_s->current_ssid)
1154 wpas_notify_network_changed(wpa_s);
1155
1156 #ifdef CONFIG_HS20
1157 hs20_configure_frame_filters(wpa_s);
1158 #endif /* CONFIG_HS20 */
1159
1160 #ifdef CONFIG_P2P
1161 /*
1162 * If multi-channel concurrency is not supported, check for any
1163 * frequency conflict. In case of any frequency conflict, remove the
1164 * least prioritized connection.
1165 */
1166 if (wpa_s->num_multichan_concurrent < 2) {
1167 int freq, num;
1168 num = get_shared_radio_freqs(wpa_s, &freq, 1, false);
1169 if (num > 0 && freq > 0 && freq != params.freq) {
1170 wpa_printf(MSG_DEBUG,
1171 "Conflicting frequency found (%d != %d)",
1172 freq, params.freq);
1173 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
1174 params.freq,
1175 ssid) < 0) {
1176 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1177 wpa_supplicant_mark_disassoc(wpa_s);
1178 wpabuf_free(resp);
1179 wpas_connect_work_done(wpa_s);
1180 return;
1181 }
1182 }
1183 }
1184 #endif /* CONFIG_P2P */
1185
1186 if (skip_auth) {
1187 wpa_msg(wpa_s, MSG_DEBUG,
1188 "SME: Skip authentication step on reassoc-to-same-BSS");
1189 wpabuf_free(resp);
1190 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
1191 return;
1192 }
1193
1194
1195 wpa_s->sme.auth_alg = params.auth_alg;
1196 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) {
1197 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
1198 "driver failed");
1199 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1200 wpa_supplicant_mark_disassoc(wpa_s);
1201 wpabuf_free(resp);
1202 wpas_connect_work_done(wpa_s);
1203 return;
1204 }
1205
1206 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
1207 NULL);
1208
1209 /*
1210 * Association will be started based on the authentication event from
1211 * the driver.
1212 */
1213
1214 wpabuf_free(resp);
1215 }
1216
1217
sme_auth_start_cb(struct wpa_radio_work * work,int deinit)1218 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
1219 {
1220 struct wpa_connect_work *cwork = work->ctx;
1221 struct wpa_supplicant *wpa_s = work->wpa_s;
1222
1223 wpa_s->roam_in_progress = false;
1224 #ifdef CONFIG_WNM
1225 wpa_s->bss_trans_mgmt_in_progress = false;
1226 #endif /* CONFIG_WNM */
1227
1228 if (deinit) {
1229 if (work->started)
1230 wpa_s->connect_work = NULL;
1231
1232 wpas_connect_work_free(cwork);
1233 return;
1234 }
1235
1236 wpa_s->connect_work = work;
1237
1238 if (cwork->bss_removed ||
1239 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
1240 wpas_network_disabled(wpa_s, cwork->ssid)) {
1241 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
1242 wpas_connect_work_done(wpa_s);
1243 return;
1244 }
1245
1246 /* Starting new connection, so clear the possibly used WPA IE from the
1247 * previous association. */
1248 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1249 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
1250 wpa_s->rsnxe_len = 0;
1251
1252 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
1253 wpas_notify_auth_changed(wpa_s);
1254 }
1255
1256
sme_authenticate(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)1257 void sme_authenticate(struct wpa_supplicant *wpa_s,
1258 struct wpa_bss *bss, struct wpa_ssid *ssid)
1259 {
1260 struct wpa_connect_work *cwork;
1261
1262 if (bss == NULL || ssid == NULL)
1263 return;
1264 if (wpa_s->connect_work) {
1265 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
1266 return;
1267 }
1268
1269 if (wpa_s->roam_in_progress) {
1270 wpa_dbg(wpa_s, MSG_DEBUG,
1271 "SME: Reject sme_authenticate() in favor of explicit roam request");
1272 return;
1273 }
1274 #ifdef CONFIG_WNM
1275 if (wpa_s->bss_trans_mgmt_in_progress) {
1276 wpa_dbg(wpa_s, MSG_DEBUG,
1277 "SME: Reject sme_authenticate() in favor of BSS transition management request");
1278 return;
1279 }
1280 #endif /* CONFIG_WNM */
1281 if (radio_work_pending(wpa_s, "sme-connect")) {
1282 /*
1283 * The previous sme-connect work might no longer be valid due to
1284 * the fact that the BSS list was updated. In addition, it makes
1285 * sense to adhere to the 'newer' decision.
1286 */
1287 wpa_dbg(wpa_s, MSG_DEBUG,
1288 "SME: Remove previous pending sme-connect");
1289 radio_remove_works(wpa_s, "sme-connect", 0);
1290 }
1291
1292 wpas_abort_ongoing_scan(wpa_s);
1293
1294 cwork = os_zalloc(sizeof(*cwork));
1295 if (cwork == NULL)
1296 return;
1297 cwork->bss = bss;
1298 cwork->ssid = ssid;
1299 cwork->sme = 1;
1300
1301 #ifdef CONFIG_SAE
1302 wpa_s->sme.sae.state = SAE_NOTHING;
1303 wpa_s->sme.sae.send_confirm = 0;
1304 wpa_s->sme.sae_group_index = 0;
1305 #endif /* CONFIG_SAE */
1306
1307 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
1308 sme_auth_start_cb, cwork) < 0)
1309 wpas_connect_work_free(cwork);
1310 }
1311
1312
1313 #ifdef CONFIG_SAE
1314
1315 #define WPA_AUTH_FRAME_ML_IE_LEN (6 + ETH_ALEN)
1316
wpa_auth_ml_ie(struct wpabuf * buf,const u8 * mld_addr)1317 static void wpa_auth_ml_ie(struct wpabuf *buf, const u8 *mld_addr)
1318 {
1319
1320 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1321 wpabuf_put_u8(buf, 4 + ETH_ALEN);
1322 wpabuf_put_u8(buf, WLAN_EID_EXT_MULTI_LINK);
1323
1324 /* Basic Multi-Link element Control field */
1325 wpabuf_put_u8(buf, 0x0);
1326 wpabuf_put_u8(buf, 0x0);
1327
1328 /* Common Info */
1329 wpabuf_put_u8(buf, 0x7); /* length = Length field + MLD MAC address */
1330 wpabuf_put_data(buf, mld_addr, ETH_ALEN);
1331 }
1332
1333
sme_external_auth_build_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,u16 auth_transaction,u16 seq_num,u16 status_code,const u8 * mld_addr)1334 static int sme_external_auth_build_buf(struct wpabuf *buf,
1335 struct wpabuf *params,
1336 const u8 *sa, const u8 *da,
1337 u16 auth_transaction, u16 seq_num,
1338 u16 status_code, const u8 *mld_addr)
1339 {
1340 struct ieee80211_mgmt *resp;
1341
1342 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
1343 u.auth.variable));
1344
1345 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
1346 (WLAN_FC_STYPE_AUTH << 4));
1347 os_memcpy(resp->da, da, ETH_ALEN);
1348 os_memcpy(resp->sa, sa, ETH_ALEN);
1349 os_memcpy(resp->bssid, da, ETH_ALEN);
1350 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
1351 resp->seq_ctrl = host_to_le16(seq_num << 4);
1352 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
1353 resp->u.auth.status_code = host_to_le16(status_code);
1354 if (params)
1355 wpabuf_put_buf(buf, params);
1356
1357 if (mld_addr)
1358 wpa_auth_ml_ie(buf, mld_addr);
1359
1360 return 0;
1361 }
1362
1363
sme_external_auth_send_sae_commit(struct wpa_supplicant * wpa_s,const u8 * bssid,struct wpa_ssid * ssid)1364 static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
1365 const u8 *bssid,
1366 struct wpa_ssid *ssid)
1367 {
1368 struct wpabuf *resp, *buf;
1369 int use_pt;
1370 bool use_pk;
1371 u16 status;
1372
1373 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid,
1374 wpa_s->sme.ext_ml_auth ?
1375 wpa_s->sme.ext_auth_ap_mld_addr : NULL,
1376 1, 0, &use_pt, &use_pk);
1377 if (!resp) {
1378 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
1379 return -1;
1380 }
1381
1382 wpa_s->sme.sae.state = SAE_COMMITTED;
1383 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp) +
1384 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1385 0));
1386 if (!buf) {
1387 wpabuf_free(resp);
1388 return -1;
1389 }
1390
1391 wpa_s->sme.seq_num++;
1392 if (use_pk)
1393 status = WLAN_STATUS_SAE_PK;
1394 else if (use_pt)
1395 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
1396 else
1397 status = WLAN_STATUS_SUCCESS;
1398 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1399 wpa_s->sme.ext_ml_auth ?
1400 wpa_s->sme.ext_auth_ap_mld_addr : bssid, 1,
1401 wpa_s->sme.seq_num, status,
1402 wpa_s->sme.ext_ml_auth ?
1403 wpa_s->own_addr : NULL);
1404 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1405 wpabuf_free(resp);
1406 wpabuf_free(buf);
1407
1408 return 0;
1409 }
1410
1411
sme_send_external_auth_status(struct wpa_supplicant * wpa_s,u16 status)1412 static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
1413 u16 status)
1414 {
1415 struct external_auth params;
1416
1417 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1418 os_memset(¶ms, 0, sizeof(params));
1419 params.status = status;
1420 params.ssid = wpa_s->sme.ext_auth_ssid;
1421 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
1422 params.bssid = wpa_s->sme.ext_auth_bssid;
1423 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
1424 params.pmkid = wpa_s->sme.sae.pmkid;
1425 wpa_drv_send_external_auth_status(wpa_s, ¶ms);
1426 }
1427
1428
sme_handle_external_auth_start(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1429 static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
1430 union wpa_event_data *data)
1431 {
1432 struct wpa_ssid *ssid;
1433 size_t ssid_str_len = data->external_auth.ssid_len;
1434 const u8 *ssid_str = data->external_auth.ssid;
1435
1436 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1437 /* Get the SSID conf from the ssid string obtained */
1438 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1439 if (!wpas_network_disabled(wpa_s, ssid) &&
1440 ssid_str_len == ssid->ssid_len &&
1441 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
1442 wpa_key_mgmt_sae(ssid->key_mgmt)) {
1443 /* Make sure PT is derived */
1444 wpa_s_setup_sae_pt(wpa_s, ssid, false);
1445 wpa_s->sme.ext_auth_wpa_ssid = ssid;
1446 break;
1447 }
1448 }
1449 if (!ssid ||
1450 sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
1451 ssid) < 0)
1452 return -1;
1453
1454 return 0;
1455 }
1456
1457
sme_external_auth_send_sae_confirm(struct wpa_supplicant * wpa_s,const u8 * da)1458 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1459 const u8 *da)
1460 {
1461 struct wpabuf *resp, *buf;
1462
1463 resp = sme_auth_build_sae_confirm(wpa_s, 1);
1464 if (!resp) {
1465 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1466 return;
1467 }
1468
1469 wpa_s->sme.sae.state = SAE_CONFIRMED;
1470 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp) +
1471 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1472 0));
1473 if (!buf) {
1474 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1475 wpabuf_free(resp);
1476 return;
1477 }
1478 wpa_s->sme.seq_num++;
1479 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1480 da, 2, wpa_s->sme.seq_num,
1481 WLAN_STATUS_SUCCESS,
1482 wpa_s->sme.ext_ml_auth ?
1483 wpa_s->own_addr : NULL);
1484
1485 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1486 wpabuf_free(resp);
1487 wpabuf_free(buf);
1488 }
1489
1490
is_sae_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)1491 static bool is_sae_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
1492 {
1493 /* suite is supposed to be the selector value in host byte order with
1494 * the OUI in three most significant octets. However, the initial
1495 * implementation swapped that byte order and did not work with drivers
1496 * that followed the expected byte order. Keep a workaround here to
1497 * match that initial implementation so that already deployed use cases
1498 * remain functional. */
1499 if (RSN_SELECTOR_GET(&suite) == RSN_AUTH_KEY_MGMT_SAE) {
1500 /* Old drivers which follow initial implementation send SAE AKM
1501 * for both SAE and FT-SAE connections. In that case, determine
1502 * the actual AKM from wpa_s->key_mgmt. */
1503 wpa_s->sme.ext_auth_key_mgmt = wpa_s->key_mgmt;
1504 return true;
1505 }
1506
1507 if (suite == RSN_AUTH_KEY_MGMT_SAE)
1508 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
1509 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE)
1510 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE;
1511 else if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1512 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
1513 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1514 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1515 else
1516 return false;
1517
1518 return true;
1519 }
1520
1521
sme_external_auth_trigger(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1522 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1523 union wpa_event_data *data)
1524 {
1525 if (!is_sae_key_mgmt_suite(wpa_s, data->external_auth.key_mgmt_suite))
1526 return;
1527
1528 if (data->external_auth.action == EXT_AUTH_START) {
1529 if (!data->external_auth.bssid || !data->external_auth.ssid)
1530 return;
1531 os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
1532 ETH_ALEN);
1533 os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
1534 data->external_auth.ssid_len);
1535 wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
1536 if (data->external_auth.mld_addr) {
1537 wpa_s->sme.ext_ml_auth = true;
1538 os_memcpy(wpa_s->sme.ext_auth_ap_mld_addr,
1539 data->external_auth.mld_addr, ETH_ALEN);
1540 } else {
1541 wpa_s->sme.ext_ml_auth = false;
1542 }
1543 wpa_s->sme.seq_num = 0;
1544 wpa_s->sme.sae.state = SAE_NOTHING;
1545 wpa_s->sme.sae.send_confirm = 0;
1546 wpa_s->sme.sae_group_index = 0;
1547 if (sme_handle_external_auth_start(wpa_s, data) < 0)
1548 sme_send_external_auth_status(wpa_s,
1549 WLAN_STATUS_UNSPECIFIED_FAILURE);
1550 } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1551 /* Report failure to driver for the wrong trigger */
1552 sme_send_external_auth_status(wpa_s,
1553 WLAN_STATUS_UNSPECIFIED_FAILURE);
1554 }
1555 }
1556
1557
sme_sae_is_group_enabled(struct wpa_supplicant * wpa_s,int group)1558 static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
1559 {
1560 int *groups = wpa_s->conf->sae_groups;
1561 int default_groups[] = { 19, 20, 21, 0 };
1562 int i;
1563
1564 if (!groups)
1565 groups = default_groups;
1566
1567 for (i = 0; groups[i] > 0; i++) {
1568 if (groups[i] == group)
1569 return 1;
1570 }
1571
1572 return 0;
1573 }
1574
1575
sme_check_sae_rejected_groups(struct wpa_supplicant * wpa_s,const struct wpabuf * groups)1576 static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
1577 const struct wpabuf *groups)
1578 {
1579 size_t i, count, len;
1580 const u8 *pos;
1581
1582 if (!groups)
1583 return 0;
1584
1585 pos = wpabuf_head(groups);
1586 len = wpabuf_len(groups);
1587 if (len & 1) {
1588 wpa_printf(MSG_DEBUG,
1589 "SAE: Invalid length of the Rejected Groups element payload: %zu",
1590 len);
1591 return 1;
1592 }
1593 count = len / 2;
1594 for (i = 0; i < count; i++) {
1595 int enabled;
1596 u16 group;
1597
1598 group = WPA_GET_LE16(pos);
1599 pos += 2;
1600 enabled = sme_sae_is_group_enabled(wpa_s, group);
1601 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
1602 group, enabled ? "enabled" : "disabled");
1603 if (enabled)
1604 return 1;
1605 }
1606
1607 return 0;
1608 }
1609
1610
sme_external_ml_auth(struct wpa_supplicant * wpa_s,const u8 * data,size_t len,int ie_offset,u16 status_code)1611 static int sme_external_ml_auth(struct wpa_supplicant *wpa_s,
1612 const u8 *data, size_t len, int ie_offset,
1613 u16 status_code)
1614 {
1615 struct ieee802_11_elems elems;
1616 const u8 *mld_addr;
1617
1618 if (ieee802_11_parse_elems(data + ie_offset, len - ie_offset,
1619 &elems, 0) == ParseFailed) {
1620 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
1621 return -1;
1622 }
1623
1624 if (!elems.basic_mle || !elems.basic_mle_len) {
1625 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
1626 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
1627 status_code == WLAN_STATUS_SUCCESS ||
1628 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1629 status_code == WLAN_STATUS_SAE_PK)
1630 return -1;
1631 /* Accept missing Multi-Link element in failed authentication
1632 * cases. */
1633 return 0;
1634 }
1635
1636 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
1637 if (!mld_addr) {
1638 wpa_printf(MSG_DEBUG, "MLD: No MLD address in ML element");
1639 return -1;
1640 }
1641
1642 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
1643
1644 if (!ether_addr_equal(wpa_s->sme.ext_auth_ap_mld_addr, mld_addr)) {
1645 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
1646 MACSTR ")",
1647 MAC2STR(wpa_s->sme.ext_auth_ap_mld_addr));
1648 return -1;
1649 }
1650
1651 return 0;
1652 }
1653
1654
sme_sae_auth(struct wpa_supplicant * wpa_s,u16 auth_transaction,u16 status_code,const u8 * data,size_t len,int external,const u8 * sa,int * ie_offset)1655 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
1656 u16 status_code, const u8 *data, size_t len,
1657 int external, const u8 *sa, int *ie_offset)
1658 {
1659 int *groups;
1660
1661 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1662 "status code %u", auth_transaction, status_code);
1663
1664 if (auth_transaction == 1 &&
1665 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1666 wpa_s->sme.sae.state == SAE_COMMITTED &&
1667 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1668 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1669 int default_groups[] = { 19, 20, 21, 0 };
1670 u16 group;
1671 const u8 *token_pos;
1672 size_t token_len;
1673 int h2e = 0;
1674
1675 groups = wpa_s->conf->sae_groups;
1676 if (!groups || groups[0] <= 0)
1677 groups = default_groups;
1678
1679 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
1680 data, len);
1681 if (len < sizeof(le16)) {
1682 wpa_dbg(wpa_s, MSG_DEBUG,
1683 "SME: Too short SAE anti-clogging token request");
1684 return -1;
1685 }
1686 group = WPA_GET_LE16(data);
1687 wpa_dbg(wpa_s, MSG_DEBUG,
1688 "SME: SAE anti-clogging token requested (group %u)",
1689 group);
1690 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1691 WLAN_STATUS_SUCCESS) {
1692 wpa_dbg(wpa_s, MSG_ERROR,
1693 "SME: SAE group %u of anti-clogging request is invalid",
1694 group);
1695 return -1;
1696 }
1697 wpabuf_free(wpa_s->sme.sae_token);
1698 token_pos = data + sizeof(le16);
1699 token_len = len - sizeof(le16);
1700 h2e = wpa_s->sme.sae.h2e;
1701 if (h2e) {
1702 u8 id, elen, extid;
1703
1704 if (token_len < 3) {
1705 wpa_dbg(wpa_s, MSG_DEBUG,
1706 "SME: Too short SAE anti-clogging token container");
1707 return -1;
1708 }
1709 id = *token_pos++;
1710 elen = *token_pos++;
1711 extid = *token_pos++;
1712 if (id != WLAN_EID_EXTENSION ||
1713 elen == 0 || elen > token_len - 2 ||
1714 extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
1715 wpa_dbg(wpa_s, MSG_DEBUG,
1716 "SME: Invalid SAE anti-clogging token container header");
1717 return -1;
1718 }
1719 token_len = elen - 1;
1720 #ifdef CONFIG_IEEE80211BE
1721 } else if ((wpa_s->valid_links ||
1722 (external && wpa_s->sme.ext_ml_auth)) &&
1723 token_len > 12 &&
1724 token_pos[token_len - 12] == WLAN_EID_EXTENSION &&
1725 token_pos[token_len - 11] == 10 &&
1726 token_pos[token_len - 10] ==
1727 WLAN_EID_EXT_MULTI_LINK) {
1728 /* IEEE P802.11be requires H2E to be used whenever SAE
1729 * is used for ML association. However, some early
1730 * Wi-Fi 7 APs enable MLO without H2E. Recognize this
1731 * special case based on the fixed length Basic
1732 * Multi-Link element being at the end of the data that
1733 * would contain the unknown variable length
1734 * Anti-Clogging Token field. The Basic Multi-Link
1735 * element in Authentication frames include the MLD MAC
1736 * addreess in the Common Info field and all subfields
1737 * of the Presence Bitmap subfield of the Multi-Link
1738 * Control field of the element zero and consequently,
1739 * has a fixed length of 12 octets. */
1740 wpa_printf(MSG_DEBUG,
1741 "SME: Detected Basic Multi-Link element at the end of Anti-Clogging Token field");
1742 token_len -= 12;
1743 #endif /* CONFIG_IEEE80211BE */
1744 }
1745
1746 *ie_offset = token_pos + token_len - data;
1747
1748 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
1749 if (!wpa_s->sme.sae_token) {
1750 wpa_dbg(wpa_s, MSG_ERROR,
1751 "SME: Failed to allocate SAE token");
1752 return -1;
1753 }
1754
1755 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
1756 wpa_s->sme.sae_token);
1757 if (!external) {
1758 sme_send_authentication(wpa_s, wpa_s->current_bss,
1759 wpa_s->current_ssid, 2);
1760 } else {
1761 if (wpa_s->sme.ext_ml_auth &&
1762 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1763 status_code))
1764 return -1;
1765
1766 sme_external_auth_send_sae_commit(
1767 wpa_s, wpa_s->sme.ext_auth_bssid,
1768 wpa_s->sme.ext_auth_wpa_ssid);
1769 }
1770 return 0;
1771 }
1772
1773 if (auth_transaction == 1 &&
1774 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1775 wpa_s->sme.sae.state == SAE_COMMITTED &&
1776 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1777 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1778 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
1779 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
1780 wpa_s->sme.sae.group);
1781 wpa_s->sme.sae_group_index++;
1782 if (sme_set_sae_group(wpa_s, external) < 0)
1783 return -1; /* no other groups enabled */
1784 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
1785 if (!external) {
1786 sme_send_authentication(wpa_s, wpa_s->current_bss,
1787 wpa_s->current_ssid, 1);
1788 } else {
1789 if (wpa_s->sme.ext_ml_auth &&
1790 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1791 status_code))
1792 return -1;
1793
1794 sme_external_auth_send_sae_commit(
1795 wpa_s, wpa_s->sme.ext_auth_bssid,
1796 wpa_s->sme.ext_auth_wpa_ssid);
1797 }
1798 return 0;
1799 }
1800
1801 if (auth_transaction == 1 &&
1802 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1803 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1804
1805 wpa_msg(wpa_s, MSG_INFO,
1806 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1807 MAC2STR(bssid));
1808 return -1;
1809 }
1810
1811 if (status_code != WLAN_STATUS_SUCCESS &&
1812 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
1813 status_code != WLAN_STATUS_SAE_PK) {
1814 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1815
1816 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1817 " auth_type=%u auth_transaction=%u status_code=%u",
1818 MAC2STR(bssid), WLAN_AUTH_SAE,
1819 auth_transaction, status_code);
1820 return -2;
1821 }
1822
1823 if (auth_transaction == 1) {
1824 u16 res;
1825
1826 groups = wpa_s->conf->sae_groups;
1827
1828 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
1829 if ((external && !wpa_s->sme.ext_auth_wpa_ssid) ||
1830 (!external &&
1831 (!wpa_s->current_bss || !wpa_s->current_ssid)))
1832 return -1;
1833 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
1834 wpa_printf(MSG_DEBUG,
1835 "SAE: Ignore commit message while waiting for confirm");
1836 return 0;
1837 }
1838 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
1839 wpa_printf(MSG_DEBUG,
1840 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
1841 return -1;
1842 }
1843 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
1844 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
1845 wpa_printf(MSG_DEBUG,
1846 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
1847 return -1;
1848 }
1849 if (!wpa_s->sme.sae.pk &&
1850 status_code == WLAN_STATUS_SAE_PK) {
1851 wpa_printf(MSG_DEBUG,
1852 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
1853 return -1;
1854 }
1855
1856 if (groups && groups[0] <= 0)
1857 groups = NULL;
1858 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
1859 groups, status_code ==
1860 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1861 status_code == WLAN_STATUS_SAE_PK,
1862 ie_offset);
1863 if (res == SAE_SILENTLY_DISCARD) {
1864 wpa_printf(MSG_DEBUG,
1865 "SAE: Drop commit message due to reflection attack");
1866 return 0;
1867 }
1868 if (res != WLAN_STATUS_SUCCESS)
1869 return -1;
1870
1871 if (wpa_s->sme.sae.tmp &&
1872 sme_check_sae_rejected_groups(
1873 wpa_s,
1874 wpa_s->sme.sae.tmp->peer_rejected_groups))
1875 return -1;
1876
1877 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1878 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1879 "commit");
1880 return -1;
1881 }
1882
1883 wpabuf_free(wpa_s->sme.sae_token);
1884 wpa_s->sme.sae_token = NULL;
1885 if (!external) {
1886 sme_send_authentication(wpa_s, wpa_s->current_bss,
1887 wpa_s->current_ssid, 0);
1888 } else {
1889 if (wpa_s->sme.ext_ml_auth &&
1890 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1891 status_code))
1892 return -1;
1893
1894 sme_external_auth_send_sae_confirm(wpa_s, sa);
1895 }
1896 return 0;
1897 } else if (auth_transaction == 2) {
1898 if (status_code != WLAN_STATUS_SUCCESS)
1899 return -1;
1900 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
1901 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
1902 return -1;
1903 if (sae_check_confirm(&wpa_s->sme.sae, data, len,
1904 ie_offset) < 0)
1905 return -1;
1906 if (external && wpa_s->sme.ext_ml_auth &&
1907 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1908 status_code))
1909 return -1;
1910
1911 wpa_s->sme.sae.state = SAE_ACCEPTED;
1912 sae_clear_temp_data(&wpa_s->sme.sae);
1913 wpa_s_clear_sae_rejected(wpa_s);
1914
1915 if (external) {
1916 /* Report success to driver */
1917 sme_send_external_auth_status(wpa_s,
1918 WLAN_STATUS_SUCCESS);
1919 }
1920
1921 return 1;
1922 }
1923
1924 return -1;
1925 }
1926
1927
sme_sae_set_pmk(struct wpa_supplicant * wpa_s,const u8 * bssid)1928 static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
1929 {
1930 wpa_printf(MSG_DEBUG,
1931 "SME: SAE completed - setting PMK for 4-way handshake");
1932 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, wpa_s->sme.sae.pmk_len,
1933 wpa_s->sme.sae.pmkid, bssid);
1934 if (wpa_s->conf->sae_pmkid_in_assoc) {
1935 /* Update the own RSNE contents now that we have set the PMK
1936 * and added a PMKSA cache entry based on the successfully
1937 * completed SAE exchange. In practice, this will add the PMKID
1938 * into RSNE. */
1939 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
1940 sizeof(wpa_s->sme.assoc_req_ie)) {
1941 wpa_msg(wpa_s, MSG_WARNING,
1942 "RSN: Not enough room for inserting own PMKID into RSNE");
1943 return -1;
1944 }
1945 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
1946 &wpa_s->sme.assoc_req_ie_len,
1947 wpa_s->sme.sae.pmkid, true) < 0)
1948 return -1;
1949 wpa_hexdump(MSG_DEBUG,
1950 "SME: Updated Association Request IEs",
1951 wpa_s->sme.assoc_req_ie,
1952 wpa_s->sme.assoc_req_ie_len);
1953 }
1954
1955 return 0;
1956 }
1957
1958
sme_external_auth_mgmt_rx(struct wpa_supplicant * wpa_s,const u8 * auth_frame,size_t len)1959 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1960 const u8 *auth_frame, size_t len)
1961 {
1962 const struct ieee80211_mgmt *header;
1963 size_t auth_length;
1964
1965 header = (const struct ieee80211_mgmt *) auth_frame;
1966 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1967
1968 if (len < auth_length) {
1969 /* Notify failure to the driver */
1970 sme_send_external_auth_status(wpa_s,
1971 WLAN_STATUS_UNSPECIFIED_FAILURE);
1972 return;
1973 }
1974
1975 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
1976 int res;
1977 int ie_offset = 0;
1978
1979 res = sme_sae_auth(
1980 wpa_s, le_to_host16(header->u.auth.auth_transaction),
1981 le_to_host16(header->u.auth.status_code),
1982 header->u.auth.variable,
1983 len - auth_length, 1, header->sa, &ie_offset);
1984 if (res < 0) {
1985 /* Notify failure to the driver */
1986 sme_send_external_auth_status(
1987 wpa_s,
1988 res == -2 ?
1989 le_to_host16(header->u.auth.status_code) :
1990 WLAN_STATUS_UNSPECIFIED_FAILURE);
1991 return;
1992 }
1993 if (res != 1)
1994 return;
1995
1996 if (sme_sae_set_pmk(wpa_s,
1997 wpa_s->sme.ext_ml_auth ?
1998 wpa_s->sme.ext_auth_ap_mld_addr :
1999 wpa_s->sme.ext_auth_bssid) < 0)
2000 return;
2001 }
2002 }
2003
2004 #endif /* CONFIG_SAE */
2005
2006
sme_event_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2007 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
2008 {
2009 struct wpa_ssid *ssid = wpa_s->current_ssid;
2010 int ie_offset = 0;
2011
2012 if (ssid == NULL) {
2013 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2014 "when network is not selected");
2015 return;
2016 }
2017
2018 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
2019 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2020 "when not in authenticating state");
2021 return;
2022 }
2023
2024 if (!ether_addr_equal(wpa_s->pending_bssid, data->auth.peer) &&
2025 !(wpa_s->valid_links &&
2026 ether_addr_equal(wpa_s->ap_mld_addr, data->auth.peer))) {
2027 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
2028 "unexpected peer " MACSTR,
2029 MAC2STR(data->auth.peer));
2030 return;
2031 }
2032
2033 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
2034 " auth_type=%d auth_transaction=%d status_code=%d",
2035 MAC2STR(data->auth.peer), data->auth.auth_type,
2036 data->auth.auth_transaction, data->auth.status_code);
2037 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
2038 data->auth.ies, data->auth.ies_len);
2039
2040 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2041
2042 #ifdef CONFIG_SAE
2043 if (data->auth.auth_type == WLAN_AUTH_SAE) {
2044 const u8 *addr = wpa_s->pending_bssid;
2045 int res;
2046
2047 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
2048 data->auth.status_code, data->auth.ies,
2049 data->auth.ies_len, 0, data->auth.peer,
2050 &ie_offset);
2051 if (res < 0) {
2052 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2053 NULL);
2054 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2055
2056 if (wpa_s->sme.sae_rejected_groups &&
2057 ssid->disabled_until.sec) {
2058 wpa_printf(MSG_DEBUG,
2059 "SME: Clear SAE state with rejected groups due to continuous failures");
2060 wpa_s_clear_sae_rejected(wpa_s);
2061 }
2062 }
2063 if (res != 1)
2064 return;
2065
2066 if (wpa_s->valid_links)
2067 addr = wpa_s->ap_mld_addr;
2068
2069 if (sme_sae_set_pmk(wpa_s, addr) < 0)
2070 return;
2071 }
2072 #endif /* CONFIG_SAE */
2073
2074 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
2075 char *ie_txt = NULL;
2076
2077 if (data->auth.ies && data->auth.ies_len) {
2078 size_t buflen = 2 * data->auth.ies_len + 1;
2079 ie_txt = os_malloc(buflen);
2080 if (ie_txt) {
2081 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
2082 data->auth.ies_len);
2083 }
2084 }
2085 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
2086 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
2087 MAC2STR(data->auth.peer), data->auth.auth_type,
2088 data->auth.auth_transaction, data->auth.status_code,
2089 ie_txt ? " ie=" : "",
2090 ie_txt ? ie_txt : "");
2091 os_free(ie_txt);
2092
2093 #ifdef CONFIG_FILS
2094 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
2095 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
2096 fils_connection_failure(wpa_s);
2097 #endif /* CONFIG_FILS */
2098
2099 if (data->auth.status_code !=
2100 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
2101 wpa_s->sme.auth_alg == data->auth.auth_type ||
2102 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
2103 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2104 NULL);
2105 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2106 return;
2107 }
2108
2109 wpas_connect_work_done(wpa_s);
2110
2111 switch (data->auth.auth_type) {
2112 case WLAN_AUTH_OPEN:
2113 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
2114
2115 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
2116 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2117 wpa_s->current_ssid);
2118 return;
2119
2120 case WLAN_AUTH_SHARED_KEY:
2121 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
2122
2123 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
2124 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2125 wpa_s->current_ssid);
2126 return;
2127
2128 default:
2129 return;
2130 }
2131 }
2132
2133 #ifdef CONFIG_IEEE80211R
2134 if (data->auth.auth_type == WLAN_AUTH_FT) {
2135 const u8 *ric_ies = NULL;
2136 size_t ric_ies_len = 0;
2137
2138 if (wpa_s->ric_ies) {
2139 ric_ies = wpabuf_head(wpa_s->ric_ies);
2140 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
2141 }
2142 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
2143 data->auth.ies_len, 0,
2144 data->auth.peer,
2145 ric_ies, ric_ies_len) < 0) {
2146 wpa_dbg(wpa_s, MSG_DEBUG,
2147 "SME: FT Authentication response processing failed");
2148 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2149 MACSTR
2150 " reason=%d locally_generated=1",
2151 MAC2STR(wpa_s->pending_bssid),
2152 WLAN_REASON_DEAUTH_LEAVING);
2153 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2154 NULL);
2155 wpa_supplicant_mark_disassoc(wpa_s);
2156 return;
2157 }
2158 }
2159 #endif /* CONFIG_IEEE80211R */
2160
2161 #ifdef CONFIG_FILS
2162 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
2163 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
2164 u16 expect_auth_type;
2165
2166 expect_auth_type = wpa_s->sme.auth_alg ==
2167 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
2168 WLAN_AUTH_FILS_SK;
2169 if (data->auth.auth_type != expect_auth_type) {
2170 wpa_dbg(wpa_s, MSG_DEBUG,
2171 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
2172 data->auth.auth_type, expect_auth_type);
2173 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2174 MACSTR
2175 " reason=%d locally_generated=1",
2176 MAC2STR(wpa_s->pending_bssid),
2177 WLAN_REASON_DEAUTH_LEAVING);
2178 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2179 NULL);
2180 wpa_supplicant_mark_disassoc(wpa_s);
2181 return;
2182 }
2183
2184 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
2185 data->auth.ies, data->auth.ies_len) < 0) {
2186 wpa_dbg(wpa_s, MSG_DEBUG,
2187 "SME: FILS Authentication response processing failed");
2188 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2189 MACSTR
2190 " reason=%d locally_generated=1",
2191 MAC2STR(wpa_s->pending_bssid),
2192 WLAN_REASON_DEAUTH_LEAVING);
2193 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2194 NULL);
2195 wpa_supplicant_mark_disassoc(wpa_s);
2196 return;
2197 }
2198 }
2199 #endif /* CONFIG_FILS */
2200
2201 /* TODO: Support additional auth_type values as well */
2202 if ((data->auth.auth_type == WLAN_AUTH_OPEN ||
2203 data->auth.auth_type == WLAN_AUTH_SAE) &&
2204 wpas_sme_ml_auth(wpa_s, data, ie_offset) < 0) {
2205 wpa_dbg(wpa_s, MSG_DEBUG,
2206 "MLD: Failed to parse ML Authentication frame");
2207 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
2208 " reason=%d locally_generated=1",
2209 MAC2STR(wpa_s->pending_bssid),
2210 WLAN_REASON_DEAUTH_LEAVING);
2211 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2212 wpa_supplicant_deauthenticate(wpa_s,
2213 WLAN_REASON_DEAUTH_LEAVING);
2214 wpa_printf(MSG_DEBUG,
2215 "MLD: Authentication - clearing MLD state");
2216 wpas_reset_mlo_info(wpa_s);
2217 return;
2218 }
2219
2220 sme_associate(wpa_s, ssid->mode, data->auth.peer,
2221 data->auth.auth_type);
2222 }
2223
2224
2225 #ifdef CONFIG_IEEE80211R
remove_ie(u8 * buf,size_t * len,u8 eid)2226 static void remove_ie(u8 *buf, size_t *len, u8 eid)
2227 {
2228 u8 *pos, *next, *end;
2229
2230 pos = (u8 *) get_ie(buf, *len, eid);
2231 if (pos) {
2232 next = pos + 2 + pos[1];
2233 end = buf + *len;
2234 *len -= 2 + pos[1];
2235 os_memmove(pos, next, end - next);
2236 }
2237 }
2238 #endif /* CONFIG_IEEE80211R */
2239
2240
sme_associate(struct wpa_supplicant * wpa_s,enum wpas_mode mode,const u8 * bssid,u16 auth_type)2241 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
2242 const u8 *bssid, u16 auth_type)
2243 {
2244 struct wpa_driver_associate_params params;
2245 struct ieee802_11_elems elems;
2246 struct wpa_ssid *ssid = wpa_s->current_ssid;
2247 #ifdef CONFIG_FILS
2248 u8 nonces[2 * FILS_NONCE_LEN];
2249 #endif /* CONFIG_FILS */
2250 #ifdef CONFIG_HT_OVERRIDES
2251 struct ieee80211_ht_capabilities htcaps;
2252 struct ieee80211_ht_capabilities htcaps_mask;
2253 #endif /* CONFIG_HT_OVERRIDES */
2254 #ifdef CONFIG_VHT_OVERRIDES
2255 struct ieee80211_vht_capabilities vhtcaps;
2256 struct ieee80211_vht_capabilities vhtcaps_mask;
2257 #endif /* CONFIG_VHT_OVERRIDES */
2258
2259 os_memset(¶ms, 0, sizeof(params));
2260
2261 /* Save auth type, in case we need to retry after comeback timer. */
2262 wpa_s->sme.assoc_auth_type = auth_type;
2263
2264 #ifdef CONFIG_FILS
2265 if (auth_type == WLAN_AUTH_FILS_SK ||
2266 auth_type == WLAN_AUTH_FILS_SK_PFS) {
2267 struct wpabuf *buf;
2268 const u8 *snonce, *anonce;
2269 const unsigned int max_hlp = 20;
2270 struct wpabuf *hlp[max_hlp];
2271 unsigned int i, num_hlp = 0;
2272 struct fils_hlp_req *req;
2273
2274 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
2275 list) {
2276 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
2277 wpabuf_len(req->pkt));
2278 if (!hlp[num_hlp])
2279 break;
2280 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
2281 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
2282 ETH_ALEN);
2283 wpabuf_put_data(hlp[num_hlp],
2284 "\xaa\xaa\x03\x00\x00\x00", 6);
2285 wpabuf_put_buf(hlp[num_hlp], req->pkt);
2286 num_hlp++;
2287 if (num_hlp >= max_hlp)
2288 break;
2289 }
2290
2291 buf = fils_build_assoc_req(wpa_s->wpa, ¶ms.fils_kek,
2292 ¶ms.fils_kek_len, &snonce,
2293 &anonce,
2294 (const struct wpabuf **) hlp,
2295 num_hlp);
2296 for (i = 0; i < num_hlp; i++)
2297 wpabuf_free(hlp[i]);
2298 if (!buf)
2299 return;
2300 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
2301 wpa_s->sme.assoc_req_ie,
2302 wpa_s->sme.assoc_req_ie_len);
2303 #ifdef CONFIG_IEEE80211R
2304 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
2305 /* Remove RSNE and MDE to allow them to be overridden
2306 * with FILS+FT specific values from
2307 * fils_build_assoc_req(). */
2308 remove_ie(wpa_s->sme.assoc_req_ie,
2309 &wpa_s->sme.assoc_req_ie_len,
2310 WLAN_EID_RSN);
2311 wpa_hexdump(MSG_DEBUG,
2312 "FILS: assoc_req after RSNE removal",
2313 wpa_s->sme.assoc_req_ie,
2314 wpa_s->sme.assoc_req_ie_len);
2315 remove_ie(wpa_s->sme.assoc_req_ie,
2316 &wpa_s->sme.assoc_req_ie_len,
2317 WLAN_EID_MOBILITY_DOMAIN);
2318 wpa_hexdump(MSG_DEBUG,
2319 "FILS: assoc_req after MDE removal",
2320 wpa_s->sme.assoc_req_ie,
2321 wpa_s->sme.assoc_req_ie_len);
2322 }
2323 #endif /* CONFIG_IEEE80211R */
2324 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
2325 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
2326 sizeof(wpa_s->sme.assoc_req_ie)) {
2327 wpa_printf(MSG_ERROR,
2328 "FILS: Not enough buffer room for own AssocReq elements");
2329 wpabuf_free(buf);
2330 return;
2331 }
2332 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2333 wpabuf_head(buf), wpabuf_len(buf));
2334 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
2335 wpabuf_free(buf);
2336 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
2337 wpa_s->sme.assoc_req_ie,
2338 wpa_s->sme.assoc_req_ie_len);
2339
2340 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
2341 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
2342 params.fils_nonces = nonces;
2343 params.fils_nonces_len = sizeof(nonces);
2344 }
2345 #endif /* CONFIG_FILS */
2346
2347 #ifdef CONFIG_OWE
2348 #ifdef CONFIG_TESTING_OPTIONS
2349 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
2350 WLAN_EID_EXT_OWE_DH_PARAM)) {
2351 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
2352 } else
2353 #endif /* CONFIG_TESTING_OPTIONS */
2354 if (auth_type == WLAN_AUTH_OPEN &&
2355 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
2356 struct wpabuf *owe_ie;
2357 u16 group;
2358
2359 if (ssid && ssid->owe_group) {
2360 group = ssid->owe_group;
2361 } else if (wpa_s->assoc_status_code ==
2362 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
2363 if (wpa_s->last_owe_group == 19)
2364 group = 20;
2365 else if (wpa_s->last_owe_group == 20)
2366 group = 21;
2367 else
2368 group = OWE_DH_GROUP;
2369 } else {
2370 group = OWE_DH_GROUP;
2371 }
2372
2373 wpa_s->last_owe_group = group;
2374 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
2375 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
2376 if (!owe_ie) {
2377 wpa_printf(MSG_ERROR,
2378 "OWE: Failed to build IE for Association Request frame");
2379 return;
2380 }
2381 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
2382 sizeof(wpa_s->sme.assoc_req_ie)) {
2383 wpa_printf(MSG_ERROR,
2384 "OWE: Not enough buffer room for own Association Request frame elements");
2385 wpabuf_free(owe_ie);
2386 return;
2387 }
2388 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2389 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
2390 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
2391 wpabuf_free(owe_ie);
2392 }
2393 #endif /* CONFIG_OWE */
2394
2395 #ifdef CONFIG_DPP2
2396 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
2397 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
2398 !ssid->dpp_pfs_fallback) {
2399 struct rsn_pmksa_cache_entry *pmksa;
2400
2401 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2402 if (!pmksa || !pmksa->dpp_pfs)
2403 goto pfs_fail;
2404
2405 dpp_pfs_free(wpa_s->dpp_pfs);
2406 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
2407 ssid->dpp_netaccesskey_len);
2408 if (!wpa_s->dpp_pfs) {
2409 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
2410 /* Try to continue without PFS */
2411 goto pfs_fail;
2412 }
2413 if (wpa_s->sme.assoc_req_ie_len +
2414 wpabuf_len(wpa_s->dpp_pfs->ie) >
2415 sizeof(wpa_s->sme.assoc_req_ie)) {
2416 wpa_printf(MSG_ERROR,
2417 "DPP: Not enough buffer room for own Association Request frame elements");
2418 dpp_pfs_free(wpa_s->dpp_pfs);
2419 wpa_s->dpp_pfs = NULL;
2420 goto pfs_fail;
2421 }
2422 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2423 wpabuf_head(wpa_s->dpp_pfs->ie),
2424 wpabuf_len(wpa_s->dpp_pfs->ie));
2425 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
2426 }
2427 pfs_fail:
2428 #endif /* CONFIG_DPP2 */
2429
2430 #ifndef CONFIG_NO_ROBUST_AV
2431 wpa_s->mscs_setup_done = false;
2432 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
2433 wpa_s->robust_av.valid_config) {
2434 struct wpabuf *mscs_ie;
2435 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
2436
2437 buf_len = 3 + /* MSCS descriptor IE header */
2438 1 + /* Request type */
2439 2 + /* User priority control */
2440 4 + /* Stream timeout */
2441 3 + /* TCLAS Mask IE header */
2442 wpa_s->robust_av.frame_classifier_len;
2443 mscs_ie = wpabuf_alloc(buf_len);
2444 if (!mscs_ie) {
2445 wpa_printf(MSG_INFO,
2446 "MSCS: Failed to allocate MSCS IE");
2447 goto mscs_fail;
2448 }
2449
2450 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
2451 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
2452 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
2453 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
2454 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
2455 mscs_ie_len = wpabuf_len(mscs_ie);
2456 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
2457 wpabuf_head(mscs_ie), mscs_ie_len);
2458 *wpa_ie_len += mscs_ie_len;
2459 }
2460
2461 wpabuf_free(mscs_ie);
2462 }
2463 mscs_fail:
2464 #endif /* CONFIG_NO_ROBUST_AV */
2465
2466 wpa_s->sme.assoc_req_ie_len =
2467 wpas_populate_wfa_capa(wpa_s, wpa_s->current_bss,
2468 wpa_s->sme.assoc_req_ie,
2469 wpa_s->sme.assoc_req_ie_len,
2470 sizeof(wpa_s->sme.assoc_req_ie));
2471
2472 if (ssid && ssid->multi_ap_backhaul_sta) {
2473 size_t multi_ap_ie_len;
2474 struct multi_ap_params multi_ap = { 0 };
2475
2476 multi_ap.capability = MULTI_AP_BACKHAUL_STA;
2477 multi_ap.profile = ssid->multi_ap_profile;
2478
2479 multi_ap_ie_len = add_multi_ap_ie(
2480 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2481 sizeof(wpa_s->sme.assoc_req_ie) -
2482 wpa_s->sme.assoc_req_ie_len,
2483 &multi_ap);
2484 if (multi_ap_ie_len == 0) {
2485 wpa_printf(MSG_ERROR,
2486 "Multi-AP: Failed to build Multi-AP IE");
2487 return;
2488 }
2489 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
2490 }
2491
2492 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE_SUPPORT,
2493 wpas_rsn_overriding(wpa_s, ssid));
2494 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2495 RSN_OVERRIDE_NOT_USED);
2496 if (wpas_rsn_overriding(wpa_s, ssid) &&
2497 wpas_ap_supports_rsn_overriding(wpa_s, wpa_s->current_bss) &&
2498 wpa_s->sme.assoc_req_ie_len + 2 + 4 <=
2499 sizeof(wpa_s->sme.assoc_req_ie)) {
2500 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
2501 const u8 *ie;
2502 enum rsn_selection_variant variant = RSN_SELECTION_RSNE;
2503
2504 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2505 RSN_OVERRIDE_RSNE);
2506 ie = wpa_bss_get_rsne(wpa_s, wpa_s->current_bss, ssid,
2507 wpa_s->valid_links);
2508 if (ie && ie[0] == WLAN_EID_VENDOR_SPECIFIC && ie[1] >= 4) {
2509 u32 type;
2510
2511 type = WPA_GET_BE32(&ie[2]);
2512 if (type == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
2513 variant = RSN_SELECTION_RSNE_OVERRIDE;
2514 wpa_sm_set_param(wpa_s->wpa,
2515 WPA_PARAM_RSN_OVERRIDE,
2516 RSN_OVERRIDE_RSNE_OVERRIDE);
2517 } else if (type == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
2518 variant = RSN_SELECTION_RSNE_OVERRIDE_2;
2519 wpa_sm_set_param(wpa_s->wpa,
2520 WPA_PARAM_RSN_OVERRIDE,
2521 RSN_OVERRIDE_RSNE_OVERRIDE_2);
2522 }
2523 }
2524
2525 /* Indicate which RSNE variant was used */
2526 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
2527 *pos++ = 4 + 1;
2528 WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);
2529 pos += 4;
2530 *pos = variant;
2531 wpa_s->sme.assoc_req_ie_len += 2 + 4 + 1;
2532 }
2533
2534 params.bssid = bssid;
2535 params.ssid = wpa_s->sme.ssid;
2536 params.ssid_len = wpa_s->sme.ssid_len;
2537 params.freq.freq = wpa_s->sme.freq;
2538 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
2539 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
2540 wpa_s->sme.assoc_req_ie : NULL;
2541 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2542 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
2543 params.wpa_ie, params.wpa_ie_len);
2544 params.pairwise_suite = wpa_s->pairwise_cipher;
2545 params.group_suite = wpa_s->group_cipher;
2546 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
2547 params.key_mgmt_suite = wpa_s->key_mgmt;
2548 params.wpa_proto = wpa_s->wpa_proto;
2549 #ifdef CONFIG_HT_OVERRIDES
2550 os_memset(&htcaps, 0, sizeof(htcaps));
2551 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2552 params.htcaps = (u8 *) &htcaps;
2553 params.htcaps_mask = (u8 *) &htcaps_mask;
2554 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, ¶ms);
2555 #endif /* CONFIG_HT_OVERRIDES */
2556 #ifdef CONFIG_VHT_OVERRIDES
2557 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2558 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2559 params.vhtcaps = &vhtcaps;
2560 params.vhtcaps_mask = &vhtcaps_mask;
2561 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, ¶ms);
2562 #endif /* CONFIG_VHT_OVERRIDES */
2563 #ifdef CONFIG_HE_OVERRIDES
2564 wpa_supplicant_apply_he_overrides(wpa_s, ssid, ¶ms);
2565 #endif /* CONFIG_HE_OVERRIDES */
2566 wpa_supplicant_apply_eht_overrides(wpa_s, ssid, ¶ms);
2567 #ifdef CONFIG_IEEE80211R
2568 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
2569 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
2570 WLAN_EID_RIC_DATA)) {
2571 /* There seems to be a pretty inconvenient bug in the Linux
2572 * kernel IE splitting functionality when RIC is used. For now,
2573 * skip correct behavior in IE construction here (i.e., drop the
2574 * additional non-FT-specific IEs) to avoid kernel issues. This
2575 * is fine since RIC is used only for testing purposes in the
2576 * current implementation. */
2577 wpa_printf(MSG_INFO,
2578 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
2579 params.wpa_ie = wpa_s->sme.ft_ies;
2580 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
2581 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
2582 const u8 *rm_en, *pos, *end;
2583 size_t rm_en_len = 0;
2584 u8 *rm_en_dup = NULL, *wpos;
2585
2586 /* Remove RSNE, MDE, FTE to allow them to be overridden with
2587 * FT specific values */
2588 remove_ie(wpa_s->sme.assoc_req_ie,
2589 &wpa_s->sme.assoc_req_ie_len,
2590 WLAN_EID_RSN);
2591 remove_ie(wpa_s->sme.assoc_req_ie,
2592 &wpa_s->sme.assoc_req_ie_len,
2593 WLAN_EID_MOBILITY_DOMAIN);
2594 remove_ie(wpa_s->sme.assoc_req_ie,
2595 &wpa_s->sme.assoc_req_ie_len,
2596 WLAN_EID_FAST_BSS_TRANSITION);
2597 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
2598 wpa_s->sme.assoc_req_ie_len,
2599 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2600 if (rm_en) {
2601 /* Need to remove RM Enabled Capabilities element as
2602 * well temporarily, so that it can be placed between
2603 * RSNE and MDE. */
2604 rm_en_len = 2 + rm_en[1];
2605 rm_en_dup = os_memdup(rm_en, rm_en_len);
2606 remove_ie(wpa_s->sme.assoc_req_ie,
2607 &wpa_s->sme.assoc_req_ie_len,
2608 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2609 }
2610 wpa_hexdump(MSG_DEBUG,
2611 "SME: Association Request IEs after FT IE removal",
2612 wpa_s->sme.assoc_req_ie,
2613 wpa_s->sme.assoc_req_ie_len);
2614 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
2615 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
2616 wpa_printf(MSG_ERROR,
2617 "SME: Not enough buffer room for FT IEs in Association Request frame");
2618 os_free(rm_en_dup);
2619 return;
2620 }
2621
2622 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
2623 rm_en_len,
2624 wpa_s->sme.assoc_req_ie,
2625 wpa_s->sme.assoc_req_ie_len);
2626 pos = wpa_s->sme.ft_ies;
2627 end = pos + wpa_s->sme.ft_ies_len;
2628 wpos = wpa_s->sme.assoc_req_ie;
2629 if (*pos == WLAN_EID_RSN) {
2630 os_memcpy(wpos, pos, 2 + pos[1]);
2631 wpos += 2 + pos[1];
2632 pos += 2 + pos[1];
2633 }
2634 if (rm_en_dup) {
2635 os_memcpy(wpos, rm_en_dup, rm_en_len);
2636 wpos += rm_en_len;
2637 os_free(rm_en_dup);
2638 }
2639 os_memcpy(wpos, pos, end - pos);
2640 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
2641 rm_en_len;
2642 params.wpa_ie = wpa_s->sme.assoc_req_ie;
2643 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2644 wpa_hexdump(MSG_DEBUG,
2645 "SME: Association Request IEs after FT override",
2646 params.wpa_ie, params.wpa_ie_len);
2647 }
2648 #endif /* CONFIG_IEEE80211R */
2649 params.mode = mode;
2650 params.mgmt_frame_protection = wpa_s->sme.mfp;
2651 params.spp_amsdu = wpa_s->sme.spp_amsdu;
2652 params.rrm_used = wpa_s->rrm.rrm_used;
2653 if (wpa_s->sme.prev_bssid_set)
2654 params.prev_bssid = wpa_s->sme.prev_bssid;
2655
2656 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2657 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
2658 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
2659 params.freq.freq);
2660
2661 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2662
2663 if (params.wpa_ie == NULL ||
2664 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
2665 < 0) {
2666 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
2667 os_memset(&elems, 0, sizeof(elems));
2668 }
2669 if (elems.rsn_ie) {
2670 params.wpa_proto = WPA_PROTO_RSN;
2671 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
2672 elems.rsn_ie_len + 2);
2673 } else if (elems.wpa_ie) {
2674 params.wpa_proto = WPA_PROTO_WPA;
2675 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
2676 elems.wpa_ie_len + 2);
2677 } else
2678 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2679 if (elems.rsnxe)
2680 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
2681 elems.rsnxe_len + 2);
2682 else
2683 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
2684 if (ssid && ssid->p2p_group)
2685 params.p2p = 1;
2686
2687 if (wpa_s->p2pdev->set_sta_uapsd)
2688 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2689 else
2690 params.uapsd = -1;
2691
2692 if (wpa_s->valid_links) {
2693 unsigned int i;
2694
2695 wpa_printf(MSG_DEBUG,
2696 "MLD: In association. assoc_link_id=%u, valid_links=0x%x",
2697 wpa_s->mlo_assoc_link_id, wpa_s->valid_links);
2698
2699 params.mld_params.mld_addr = wpa_s->ap_mld_addr;
2700 params.mld_params.valid_links = wpa_s->valid_links;
2701 params.mld_params.assoc_link_id = wpa_s->mlo_assoc_link_id;
2702 for_each_link(wpa_s->valid_links, i) {
2703 params.mld_params.mld_links[i].bssid =
2704 wpa_s->links[i].bssid;
2705 params.mld_params.mld_links[i].freq =
2706 wpa_s->links[i].freq;
2707 params.mld_params.mld_links[i].disabled =
2708 wpa_s->links[i].disabled;
2709
2710 wpa_printf(MSG_DEBUG,
2711 "MLD: id=%u, freq=%d, disabled=%u, " MACSTR,
2712 i, wpa_s->links[i].freq,
2713 wpa_s->links[i].disabled,
2714 MAC2STR(wpa_s->links[i].bssid));
2715 }
2716 }
2717
2718 if (wpa_drv_associate(wpa_s, ¶ms) < 0) {
2719 unsigned int n_failed_links = 0;
2720 int i;
2721
2722 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
2723 "driver failed");
2724
2725 /* Prepare list of failed links for error report */
2726 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
2727 if (!(wpa_s->valid_links & BIT(i)) ||
2728 wpa_s->mlo_assoc_link_id == i ||
2729 !params.mld_params.mld_links[i].error)
2730 continue;
2731
2732 wpa_bssid_ignore_add(wpa_s, wpa_s->links[i].bssid);
2733 n_failed_links++;
2734 }
2735
2736 if (n_failed_links) {
2737 /* Deauth and connect (possibly to the same AP MLD) */
2738 wpa_drv_deauthenticate(wpa_s, wpa_s->ap_mld_addr,
2739 WLAN_REASON_DEAUTH_LEAVING);
2740 wpas_connect_work_done(wpa_s);
2741 wpa_supplicant_mark_disassoc(wpa_s);
2742 wpas_request_connection(wpa_s);
2743 } else {
2744 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2745 NULL);
2746 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2747 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2748 }
2749 return;
2750 }
2751
2752 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
2753 NULL);
2754
2755 #ifdef CONFIG_TESTING_OPTIONS
2756 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
2757 wpa_s->last_assoc_req_wpa_ie = NULL;
2758 if (params.wpa_ie)
2759 wpa_s->last_assoc_req_wpa_ie =
2760 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
2761 #endif /* CONFIG_TESTING_OPTIONS */
2762 }
2763
2764
sme_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)2765 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2766 const u8 *ies, size_t ies_len)
2767 {
2768 if (md == NULL || ies == NULL) {
2769 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
2770 os_free(wpa_s->sme.ft_ies);
2771 wpa_s->sme.ft_ies = NULL;
2772 wpa_s->sme.ft_ies_len = 0;
2773 wpa_s->sme.ft_used = 0;
2774 return 0;
2775 }
2776
2777 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
2778 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
2779 os_free(wpa_s->sme.ft_ies);
2780 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
2781 if (wpa_s->sme.ft_ies == NULL)
2782 return -1;
2783 wpa_s->sme.ft_ies_len = ies_len;
2784 return 0;
2785 }
2786
2787
sme_deauth(struct wpa_supplicant * wpa_s,const u8 ** link_bssids)2788 static void sme_deauth(struct wpa_supplicant *wpa_s, const u8 **link_bssids)
2789 {
2790 int bssid_changed;
2791 const u8 *bssid;
2792
2793 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2794
2795 if (wpa_s->valid_links)
2796 bssid = wpa_s->ap_mld_addr;
2797 else
2798 bssid = wpa_s->pending_bssid;
2799
2800 if (wpa_drv_deauthenticate(wpa_s, bssid,
2801 WLAN_REASON_DEAUTH_LEAVING) < 0) {
2802 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
2803 "failed");
2804 }
2805 wpa_s->sme.prev_bssid_set = 0;
2806
2807 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, link_bssids);
2808 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2809 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2810 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2811 if (bssid_changed)
2812 wpas_notify_bssid_changed(wpa_s);
2813 }
2814
2815
sme_assoc_comeback_timer(void * eloop_ctx,void * timeout_ctx)2816 static void sme_assoc_comeback_timer(void *eloop_ctx, void *timeout_ctx)
2817 {
2818 struct wpa_supplicant *wpa_s = eloop_ctx;
2819
2820 if (!wpa_s->current_bss || !wpa_s->current_ssid) {
2821 wpa_msg(wpa_s, MSG_DEBUG,
2822 "SME: Comeback timeout expired; SSID/BSSID cleared; ignoring");
2823 return;
2824 }
2825
2826 wpa_msg(wpa_s, MSG_DEBUG,
2827 "SME: Comeback timeout expired; retry associating with "
2828 MACSTR "; mode=%d auth_type=%u",
2829 MAC2STR(wpa_s->current_bss->bssid),
2830 wpa_s->current_ssid->mode,
2831 wpa_s->sme.assoc_auth_type);
2832
2833 /* Authentication state was completed already; just try association
2834 * again. */
2835 sme_associate(wpa_s, wpa_s->current_ssid->mode,
2836 wpa_s->current_bss->bssid,
2837 wpa_s->sme.assoc_auth_type);
2838 }
2839
2840
sme_try_assoc_comeback(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2841 static bool sme_try_assoc_comeback(struct wpa_supplicant *wpa_s,
2842 union wpa_event_data *data)
2843 {
2844 struct ieee802_11_elems elems;
2845 u32 timeout_interval;
2846 unsigned long comeback_usec;
2847 u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
2848
2849 #ifdef CONFIG_TESTING_OPTIONS
2850 if (wpa_s->test_assoc_comeback_type != -1)
2851 type = wpa_s->test_assoc_comeback_type;
2852 #endif /* CONFIG_TESTING_OPTIONS */
2853
2854 if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
2855 data->assoc_reject.resp_ies_len,
2856 &elems, 0) == ParseFailed) {
2857 wpa_msg(wpa_s, MSG_INFO,
2858 "SME: Temporary assoc reject: failed to parse (Re)Association Response frame elements");
2859 return false;
2860 }
2861
2862 if (!elems.timeout_int) {
2863 wpa_msg(wpa_s, MSG_INFO,
2864 "SME: Temporary assoc reject: missing timeout interval IE");
2865 return false;
2866 }
2867
2868 if (elems.timeout_int[0] != type) {
2869 wpa_msg(wpa_s, MSG_INFO,
2870 "SME: Temporary assoc reject: missing association comeback time");
2871 return false;
2872 }
2873
2874 timeout_interval = WPA_GET_LE32(&elems.timeout_int[1]);
2875 if (timeout_interval > 60000) {
2876 /* This is unprotected information and there is no point in
2877 * getting stuck waiting for very long duration based on it */
2878 wpa_msg(wpa_s, MSG_DEBUG,
2879 "SME: Ignore overly long association comeback interval: %u TUs",
2880 timeout_interval);
2881 return false;
2882 }
2883 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association comeback interval: %u TUs",
2884 timeout_interval);
2885
2886 comeback_usec = timeout_interval * 1024;
2887 eloop_register_timeout(comeback_usec / 1000000, comeback_usec % 1000000,
2888 sme_assoc_comeback_timer, wpa_s, NULL);
2889 return true;
2890 }
2891
2892
sme_event_assoc_reject(struct wpa_supplicant * wpa_s,union wpa_event_data * data,const u8 ** link_bssids)2893 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
2894 union wpa_event_data *data,
2895 const u8 **link_bssids)
2896 {
2897 const u8 *bssid;
2898
2899 if (wpa_s->valid_links)
2900 bssid = wpa_s->ap_mld_addr;
2901 else
2902 bssid = wpa_s->pending_bssid;
2903
2904 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
2905 "status code %d", MAC2STR(wpa_s->pending_bssid),
2906 data->assoc_reject.status_code);
2907
2908 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2909 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
2910
2911 /* Authentication phase has been completed at this point. Check whether
2912 * the AP rejected association temporarily due to still holding a
2913 * security associationis with us (MFP). If so, we must wait for the
2914 * AP's association comeback timeout period before associating again. */
2915 if (data->assoc_reject.status_code ==
2916 WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
2917 wpa_msg(wpa_s, MSG_DEBUG,
2918 "SME: Temporary association reject from BSS " MACSTR,
2919 MAC2STR(bssid));
2920 if (sme_try_assoc_comeback(wpa_s, data)) {
2921 /* Break out early; comeback error is not a failure. */
2922 return;
2923 }
2924 }
2925
2926 #ifdef CONFIG_SAE
2927 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
2928 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
2929 wpa_dbg(wpa_s, MSG_DEBUG,
2930 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
2931 wpa_sm_aborted_cached(wpa_s->wpa);
2932 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
2933 if (wpa_s->current_bss) {
2934 struct wpa_bss *bss = wpa_s->current_bss;
2935 struct wpa_ssid *ssid = wpa_s->current_ssid;
2936
2937 wpa_drv_deauthenticate(wpa_s, bssid,
2938 WLAN_REASON_DEAUTH_LEAVING);
2939 wpas_connect_work_done(wpa_s);
2940 wpa_supplicant_mark_disassoc(wpa_s);
2941 wpa_supplicant_connect(wpa_s, bss, ssid);
2942 return;
2943 }
2944 }
2945 #endif /* CONFIG_SAE */
2946
2947 #ifdef CONFIG_DPP
2948 if (wpa_s->current_ssid &&
2949 wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_DPP &&
2950 !data->assoc_reject.timed_out &&
2951 data->assoc_reject.status_code == WLAN_STATUS_INVALID_PMKID) {
2952 struct rsn_pmksa_cache_entry *pmksa;
2953
2954 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2955 if (pmksa) {
2956 wpa_dbg(wpa_s, MSG_DEBUG,
2957 "DPP: Drop PMKSA cache entry for the BSS due to invalid PMKID report");
2958 wpa_sm_pmksa_cache_remove(wpa_s->wpa, pmksa);
2959 }
2960 wpa_sm_aborted_cached(wpa_s->wpa);
2961 if (wpa_s->current_bss) {
2962 struct wpa_bss *bss = wpa_s->current_bss;
2963 struct wpa_ssid *ssid = wpa_s->current_ssid;
2964
2965 wpa_dbg(wpa_s, MSG_DEBUG,
2966 "DPP: Try network introduction again");
2967 wpas_connect_work_done(wpa_s);
2968 wpa_supplicant_mark_disassoc(wpa_s);
2969 wpa_supplicant_connect(wpa_s, bss, ssid);
2970 return;
2971 }
2972 }
2973 #endif /* CONFIG_DPP */
2974
2975 /*
2976 * For now, unconditionally terminate the previous authentication. In
2977 * theory, this should not be needed, but mac80211 gets quite confused
2978 * if the authentication is left pending.. Some roaming cases might
2979 * benefit from using the previous authentication, so this could be
2980 * optimized in the future.
2981 */
2982 sme_deauth(wpa_s, link_bssids);
2983 }
2984
2985
sme_event_auth_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2986 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
2987 union wpa_event_data *data)
2988 {
2989 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
2990 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2991 wpa_supplicant_mark_disassoc(wpa_s);
2992 }
2993
2994
sme_event_assoc_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2995 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
2996 union wpa_event_data *data)
2997 {
2998 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
2999 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
3000 wpa_supplicant_mark_disassoc(wpa_s);
3001 }
3002
3003
sme_event_disassoc(struct wpa_supplicant * wpa_s,struct disassoc_info * info)3004 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
3005 struct disassoc_info *info)
3006 {
3007 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
3008 if (wpa_s->sme.prev_bssid_set) {
3009 /*
3010 * cfg80211/mac80211 can get into somewhat confused state if
3011 * the AP only disassociates us and leaves us in authenticated
3012 * state. For now, force the state to be cleared to avoid
3013 * confusing errors if we try to associate with the AP again.
3014 */
3015 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
3016 "driver state");
3017 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
3018 WLAN_REASON_DEAUTH_LEAVING);
3019 }
3020 }
3021
3022
sme_auth_timer(void * eloop_ctx,void * timeout_ctx)3023 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
3024 {
3025 struct wpa_supplicant *wpa_s = eloop_ctx;
3026 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
3027 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
3028 sme_deauth(wpa_s, NULL);
3029 }
3030 }
3031
3032
sme_assoc_timer(void * eloop_ctx,void * timeout_ctx)3033 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
3034 {
3035 struct wpa_supplicant *wpa_s = eloop_ctx;
3036 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
3037 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
3038 sme_deauth(wpa_s, NULL);
3039 }
3040 }
3041
3042
sme_state_changed(struct wpa_supplicant * wpa_s)3043 void sme_state_changed(struct wpa_supplicant *wpa_s)
3044 {
3045 /* Make sure timers are cleaned up appropriately. */
3046 if (wpa_s->wpa_state != WPA_ASSOCIATING) {
3047 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3048 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3049 }
3050 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
3051 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3052 }
3053
3054
sme_clear_on_disassoc(struct wpa_supplicant * wpa_s)3055 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
3056 {
3057 wpa_s->sme.prev_bssid_set = 0;
3058 #ifdef CONFIG_SAE
3059 wpabuf_free(wpa_s->sme.sae_token);
3060 wpa_s->sme.sae_token = NULL;
3061 sae_clear_data(&wpa_s->sme.sae);
3062 #endif /* CONFIG_SAE */
3063 #ifdef CONFIG_IEEE80211R
3064 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
3065 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
3066 #endif /* CONFIG_IEEE80211R */
3067 sme_stop_sa_query(wpa_s);
3068 }
3069
3070
sme_deinit(struct wpa_supplicant * wpa_s)3071 void sme_deinit(struct wpa_supplicant *wpa_s)
3072 {
3073 sme_clear_on_disassoc(wpa_s);
3074 #ifdef CONFIG_SAE
3075 os_free(wpa_s->sme.sae_rejected_groups);
3076 wpa_s->sme.sae_rejected_groups = NULL;
3077 #endif /* CONFIG_SAE */
3078
3079 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3080 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3081 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3082 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3083 }
3084
3085
sme_send_2040_bss_coex(struct wpa_supplicant * wpa_s,const u8 * chan_list,u8 num_channels,u8 num_intol)3086 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
3087 const u8 *chan_list, u8 num_channels,
3088 u8 num_intol)
3089 {
3090 struct ieee80211_2040_bss_coex_ie *bc_ie;
3091 struct ieee80211_2040_intol_chan_report *ic_report;
3092 struct wpabuf *buf;
3093
3094 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
3095 " (num_channels=%u num_intol=%u)",
3096 MAC2STR(wpa_s->bssid), num_channels, num_intol);
3097 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
3098 chan_list, num_channels);
3099
3100 buf = wpabuf_alloc(2 + /* action.category + action_code */
3101 sizeof(struct ieee80211_2040_bss_coex_ie) +
3102 sizeof(struct ieee80211_2040_intol_chan_report) +
3103 num_channels);
3104 if (buf == NULL)
3105 return;
3106
3107 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
3108 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
3109
3110 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
3111 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
3112 bc_ie->length = 1;
3113 if (num_intol)
3114 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
3115
3116 if (num_channels > 0) {
3117 ic_report = wpabuf_put(buf, sizeof(*ic_report));
3118 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
3119 ic_report->length = num_channels + 1;
3120 ic_report->op_class = 0;
3121 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
3122 num_channels);
3123 }
3124
3125 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3126 wpa_s->own_addr, wpa_s->bssid,
3127 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
3128 wpa_msg(wpa_s, MSG_INFO,
3129 "SME: Failed to send 20/40 BSS Coexistence frame");
3130 }
3131
3132 wpabuf_free(buf);
3133 }
3134
3135
sme_proc_obss_scan(struct wpa_supplicant * wpa_s)3136 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
3137 {
3138 struct wpa_bss *bss;
3139 const u8 *ie;
3140 u16 ht_cap;
3141 u8 chan_list[P2P_MAX_CHANNELS], channel;
3142 u8 num_channels = 0, num_intol = 0, i;
3143
3144 if (!wpa_s->sme.sched_obss_scan)
3145 return 0;
3146
3147 wpa_s->sme.sched_obss_scan = 0;
3148 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
3149 return 1;
3150
3151 /*
3152 * Check whether AP uses regulatory triplet or channel triplet in
3153 * country info. Right now the operating class of the BSS channel
3154 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
3155 * based on the assumption that operating class triplet is not used in
3156 * beacon frame. If the First Channel Number/Operating Extension
3157 * Identifier octet has a positive integer value of 201 or greater,
3158 * then its operating class triplet.
3159 *
3160 * TODO: If Supported Operating Classes element is present in beacon
3161 * frame, have to lookup operating class in Annex E and fill them in
3162 * 2040 coex frame.
3163 */
3164 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
3165 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
3166 return 1;
3167
3168 os_memset(chan_list, 0, sizeof(chan_list));
3169
3170 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
3171 /* Skip other band bss */
3172 enum hostapd_hw_mode mode;
3173 mode = ieee80211_freq_to_chan(bss->freq, &channel);
3174 if (mode != HOSTAPD_MODE_IEEE80211G &&
3175 mode != HOSTAPD_MODE_IEEE80211B)
3176 continue;
3177
3178 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
3179 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
3180 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
3181 " freq=%u chan=%u ht_cap=0x%x",
3182 MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
3183
3184 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
3185 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
3186 num_intol++;
3187
3188 /* Check whether the channel is already considered */
3189 for (i = 0; i < num_channels; i++) {
3190 if (channel == chan_list[i])
3191 break;
3192 }
3193 if (i != num_channels)
3194 continue;
3195
3196 chan_list[num_channels++] = channel;
3197 }
3198 }
3199
3200 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
3201 return 1;
3202 }
3203
3204
wpa_obss_scan_freqs_list(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)3205 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
3206 struct wpa_driver_scan_params *params)
3207 {
3208 /* Include only affected channels */
3209 struct hostapd_hw_modes *mode;
3210 int count, i;
3211 int start, end;
3212
3213 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
3214 HOSTAPD_MODE_IEEE80211G, false);
3215 if (mode == NULL) {
3216 /* No channels supported in this band - use empty list */
3217 params->freqs = os_zalloc(sizeof(int));
3218 return;
3219 }
3220
3221 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
3222 wpa_s->current_bss) {
3223 const u8 *ie;
3224
3225 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
3226 if (ie && ie[1] >= 2) {
3227 u8 o;
3228
3229 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
3230 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
3231 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
3232 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
3233 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
3234 }
3235 }
3236
3237 start = wpa_s->assoc_freq - 10;
3238 end = wpa_s->assoc_freq + 10;
3239 switch (wpa_s->sme.ht_sec_chan) {
3240 case HT_SEC_CHAN_UNKNOWN:
3241 /* HT40+ possible on channels 1..9 */
3242 if (wpa_s->assoc_freq <= 2452)
3243 start -= 20;
3244 /* HT40- possible on channels 5-13 */
3245 if (wpa_s->assoc_freq >= 2432)
3246 end += 20;
3247 break;
3248 case HT_SEC_CHAN_ABOVE:
3249 end += 20;
3250 break;
3251 case HT_SEC_CHAN_BELOW:
3252 start -= 20;
3253 break;
3254 }
3255 wpa_printf(MSG_DEBUG,
3256 "OBSS: assoc_freq %d possible affected range %d-%d",
3257 wpa_s->assoc_freq, start, end);
3258
3259 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
3260 if (params->freqs == NULL)
3261 return;
3262 for (count = 0, i = 0; i < mode->num_channels; i++) {
3263 int freq;
3264
3265 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
3266 continue;
3267 freq = mode->channels[i].freq;
3268 if (freq - 10 >= end || freq + 10 <= start)
3269 continue; /* not affected */
3270 params->freqs[count++] = freq;
3271 }
3272 }
3273
3274
sme_obss_scan_timeout(void * eloop_ctx,void * timeout_ctx)3275 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3276 {
3277 struct wpa_supplicant *wpa_s = eloop_ctx;
3278 struct wpa_driver_scan_params params;
3279
3280 if (!wpa_s->current_bss) {
3281 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
3282 return;
3283 }
3284
3285 os_memset(¶ms, 0, sizeof(params));
3286 wpa_obss_scan_freqs_list(wpa_s, ¶ms);
3287 params.low_priority = 1;
3288 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
3289
3290 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms, true, false))
3291 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
3292 else
3293 wpa_s->sme.sched_obss_scan = 1;
3294 os_free(params.freqs);
3295
3296 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3297 sme_obss_scan_timeout, wpa_s, NULL);
3298 }
3299
3300
sme_sched_obss_scan(struct wpa_supplicant * wpa_s,int enable)3301 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
3302 {
3303 const u8 *ie;
3304 struct wpa_bss *bss = wpa_s->current_bss;
3305 struct wpa_ssid *ssid = wpa_s->current_ssid;
3306 struct hostapd_hw_modes *hw_mode = NULL;
3307 int i;
3308
3309 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3310 wpa_s->sme.sched_obss_scan = 0;
3311 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
3312 if (!enable)
3313 return;
3314
3315 /*
3316 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
3317 * or it expects OBSS scan to be performed by wpa_supplicant.
3318 */
3319 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
3320 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
3321 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
3322 return;
3323
3324 #ifdef CONFIG_HT_OVERRIDES
3325 /* No need for OBSS scan if HT40 is explicitly disabled */
3326 if (ssid->disable_ht40)
3327 return;
3328 #endif /* CONFIG_HT_OVERRIDES */
3329
3330 if (!wpa_s->hw.modes)
3331 return;
3332
3333 /* only HT caps in 11g mode are relevant */
3334 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3335 hw_mode = &wpa_s->hw.modes[i];
3336 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
3337 break;
3338 }
3339
3340 /* Driver does not support HT40 for 11g or doesn't have 11g. */
3341 if (i == wpa_s->hw.num_modes || !hw_mode ||
3342 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3343 return;
3344
3345 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
3346 return; /* Not associated on 2.4 GHz band */
3347
3348 /* Check whether AP supports HT40 */
3349 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
3350 if (!ie || ie[1] < 2 ||
3351 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3352 return; /* AP does not support HT40 */
3353
3354 ie = wpa_bss_get_ie(wpa_s->current_bss,
3355 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
3356 if (!ie || ie[1] < 14)
3357 return; /* AP does not request OBSS scans */
3358
3359 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
3360 if (wpa_s->sme.obss_scan_int < 10) {
3361 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
3362 "replaced with the minimum 10 sec",
3363 wpa_s->sme.obss_scan_int);
3364 wpa_s->sme.obss_scan_int = 10;
3365 }
3366 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
3367 wpa_s->sme.obss_scan_int);
3368 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3369 sme_obss_scan_timeout, wpa_s, NULL);
3370 }
3371
3372
3373 static const unsigned int sa_query_max_timeout = 1000;
3374 static const unsigned int sa_query_retry_timeout = 201;
3375 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
3376
sme_check_sa_query_timeout(struct wpa_supplicant * wpa_s)3377 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
3378 {
3379 u32 tu;
3380 struct os_reltime now, passed;
3381 os_get_reltime(&now);
3382 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
3383 tu = (passed.sec * 1000000 + passed.usec) / 1024;
3384 if (sa_query_max_timeout < tu) {
3385 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
3386 sme_stop_sa_query(wpa_s);
3387 wpa_supplicant_deauthenticate(
3388 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
3389 return 1;
3390 }
3391
3392 return 0;
3393 }
3394
3395
sme_send_sa_query_req(struct wpa_supplicant * wpa_s,const u8 * trans_id)3396 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
3397 const u8 *trans_id)
3398 {
3399 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3400 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3401
3402 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
3403 MACSTR, MAC2STR(wpa_s->bssid));
3404 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
3405 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3406 req[0] = WLAN_ACTION_SA_QUERY;
3407 req[1] = WLAN_SA_QUERY_REQUEST;
3408 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3409
3410 #ifdef CONFIG_OCV
3411 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3412 struct wpa_channel_info ci;
3413
3414 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3415 wpa_printf(MSG_WARNING,
3416 "Failed to get channel info for OCI element in SA Query Request frame");
3417 return;
3418 }
3419
3420 #ifdef CONFIG_TESTING_OPTIONS
3421 if (wpa_s->oci_freq_override_saquery_req) {
3422 wpa_printf(MSG_INFO,
3423 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
3424 ci.frequency,
3425 wpa_s->oci_freq_override_saquery_req);
3426 ci.frequency = wpa_s->oci_freq_override_saquery_req;
3427 }
3428 #endif /* CONFIG_TESTING_OPTIONS */
3429
3430 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
3431 return;
3432
3433 req_len += OCV_OCI_EXTENDED_LEN;
3434 }
3435 #endif /* CONFIG_OCV */
3436
3437 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3438 wpa_s->own_addr, wpa_s->bssid,
3439 req, req_len, 0) < 0)
3440 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
3441 "Request");
3442 }
3443
3444
sme_sa_query_timer(void * eloop_ctx,void * timeout_ctx)3445 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
3446 {
3447 struct wpa_supplicant *wpa_s = eloop_ctx;
3448 unsigned int timeout, sec, usec;
3449 u8 *trans_id, *nbuf;
3450
3451 if (wpa_s->sme.sa_query_count > 0 &&
3452 sme_check_sa_query_timeout(wpa_s))
3453 return;
3454
3455 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
3456 wpa_s->sme.sa_query_count + 1,
3457 WLAN_SA_QUERY_TR_ID_LEN);
3458 if (nbuf == NULL) {
3459 sme_stop_sa_query(wpa_s);
3460 return;
3461 }
3462 if (wpa_s->sme.sa_query_count == 0) {
3463 /* Starting a new SA Query procedure */
3464 os_get_reltime(&wpa_s->sme.sa_query_start);
3465 }
3466 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
3467 wpa_s->sme.sa_query_trans_id = nbuf;
3468 wpa_s->sme.sa_query_count++;
3469
3470 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
3471 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
3472 sme_stop_sa_query(wpa_s);
3473 return;
3474 }
3475
3476 timeout = sa_query_retry_timeout;
3477 sec = ((timeout / 1000) * 1024) / 1000;
3478 usec = (timeout % 1000) * 1024;
3479 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
3480
3481 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
3482 wpa_s->sme.sa_query_count);
3483
3484 sme_send_sa_query_req(wpa_s, trans_id);
3485 }
3486
3487
sme_start_sa_query(struct wpa_supplicant * wpa_s)3488 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
3489 {
3490 sme_sa_query_timer(wpa_s, NULL);
3491 }
3492
3493
sme_stop_sa_query(struct wpa_supplicant * wpa_s)3494 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
3495 {
3496 if (wpa_s->sme.sa_query_trans_id)
3497 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
3498 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
3499 os_free(wpa_s->sme.sa_query_trans_id);
3500 wpa_s->sme.sa_query_trans_id = NULL;
3501 wpa_s->sme.sa_query_count = 0;
3502 }
3503
3504
sme_event_unprot_disconnect(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * da,u16 reason_code)3505 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
3506 const u8 *da, u16 reason_code)
3507 {
3508 struct wpa_ssid *ssid;
3509 struct os_reltime now;
3510
3511 if (wpa_s->wpa_state != WPA_COMPLETED)
3512 return;
3513 ssid = wpa_s->current_ssid;
3514 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
3515 return;
3516 if (!ether_addr_equal(sa, wpa_s->bssid))
3517 return;
3518 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
3519 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
3520 return;
3521 if (wpa_s->sme.sa_query_count > 0)
3522 return;
3523 #ifdef CONFIG_TESTING_OPTIONS
3524 if (wpa_s->disable_sa_query)
3525 return;
3526 #endif /* CONFIG_TESTING_OPTIONS */
3527
3528 os_get_reltime(&now);
3529 if (wpa_s->sme.last_unprot_disconnect.sec &&
3530 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
3531 return; /* limit SA Query procedure frequency */
3532 wpa_s->sme.last_unprot_disconnect = now;
3533
3534 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
3535 "possible AP/STA state mismatch - trigger SA Query");
3536 sme_start_sa_query(wpa_s);
3537 }
3538
3539
sme_event_ch_switch(struct wpa_supplicant * wpa_s)3540 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
3541 {
3542 unsigned int usec;
3543 u32 _rand;
3544
3545 if (wpa_s->wpa_state != WPA_COMPLETED ||
3546 !wpa_sm_ocv_enabled(wpa_s->wpa))
3547 return;
3548
3549 wpa_dbg(wpa_s, MSG_DEBUG,
3550 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
3551 sme_stop_sa_query(wpa_s);
3552
3553 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
3554 _rand = os_random();
3555 usec = _rand % (sa_query_ch_switch_max_delay + 1);
3556 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
3557 }
3558
3559
sme_process_sa_query_request(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3560 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
3561 const u8 *sa, const u8 *data,
3562 size_t len)
3563 {
3564 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3565 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3566
3567 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
3568 MACSTR, MAC2STR(wpa_s->bssid));
3569
3570 resp[0] = WLAN_ACTION_SA_QUERY;
3571 resp[1] = WLAN_SA_QUERY_RESPONSE;
3572 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
3573
3574 #ifdef CONFIG_OCV
3575 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3576 struct wpa_channel_info ci;
3577
3578 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3579 wpa_printf(MSG_WARNING,
3580 "Failed to get channel info for OCI element in SA Query Response frame");
3581 return;
3582 }
3583
3584 #ifdef CONFIG_TESTING_OPTIONS
3585 if (wpa_s->oci_freq_override_saquery_resp) {
3586 wpa_printf(MSG_INFO,
3587 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
3588 ci.frequency,
3589 wpa_s->oci_freq_override_saquery_resp);
3590 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
3591 }
3592 #endif /* CONFIG_TESTING_OPTIONS */
3593
3594 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
3595 return;
3596
3597 resp_len += OCV_OCI_EXTENDED_LEN;
3598 }
3599 #endif /* CONFIG_OCV */
3600
3601 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3602 wpa_s->own_addr, wpa_s->bssid,
3603 resp, resp_len, 0) < 0)
3604 wpa_msg(wpa_s, MSG_INFO,
3605 "SME: Failed to send SA Query Response");
3606 }
3607
3608
sme_process_sa_query_response(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3609 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
3610 const u8 *sa, const u8 *data,
3611 size_t len)
3612 {
3613 int i;
3614
3615 if (!wpa_s->sme.sa_query_trans_id)
3616 return;
3617
3618 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
3619 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3620
3621 if (!ether_addr_equal(sa, wpa_s->bssid))
3622 return;
3623
3624 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
3625 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
3626 i * WLAN_SA_QUERY_TR_ID_LEN,
3627 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
3628 break;
3629 }
3630
3631 if (i >= wpa_s->sme.sa_query_count) {
3632 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
3633 "transaction identifier found");
3634 return;
3635 }
3636
3637 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
3638 "from " MACSTR, MAC2STR(sa));
3639 sme_stop_sa_query(wpa_s);
3640 }
3641
3642
sme_sa_query_rx(struct wpa_supplicant * wpa_s,const u8 * da,const u8 * sa,const u8 * data,size_t len)3643 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
3644 const u8 *data, size_t len)
3645 {
3646 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
3647 return;
3648 if (is_multicast_ether_addr(da)) {
3649 wpa_printf(MSG_DEBUG,
3650 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
3651 MAC2STR(da), MAC2STR(sa));
3652 return;
3653 }
3654
3655 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
3656 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3657
3658 #ifdef CONFIG_OCV
3659 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3660 struct ieee802_11_elems elems;
3661 struct wpa_channel_info ci;
3662
3663 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
3664 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
3665 &elems, 1) == ParseFailed) {
3666 wpa_printf(MSG_DEBUG,
3667 "SA Query: Failed to parse elements");
3668 return;
3669 }
3670
3671 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3672 wpa_printf(MSG_WARNING,
3673 "Failed to get channel info to validate received OCI in SA Query Action frame");
3674 return;
3675 }
3676
3677 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
3678 channel_width_to_int(ci.chanwidth),
3679 ci.seg1_idx) != OCI_SUCCESS) {
3680 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
3681 " frame=saquery%s error=%s",
3682 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
3683 "req" : "resp", ocv_errorstr);
3684 return;
3685 }
3686 }
3687 #endif /* CONFIG_OCV */
3688
3689 if (data[0] == WLAN_SA_QUERY_REQUEST)
3690 sme_process_sa_query_request(wpa_s, sa, data, len);
3691 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
3692 sme_process_sa_query_response(wpa_s, sa, data, len);
3693 }
3694