interworking.c 56 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315
  1. /*
  2. * Interworking (IEEE 802.11u)
  3. * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
  4. * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
  5. *
  6. * This software may be distributed under the terms of the BSD license.
  7. * See README for more details.
  8. */
  9. #include "includes.h"
  10. #include "common.h"
  11. #include "common/ieee802_11_defs.h"
  12. #include "common/gas.h"
  13. #include "common/wpa_ctrl.h"
  14. #include "utils/pcsc_funcs.h"
  15. #include "utils/eloop.h"
  16. #include "drivers/driver.h"
  17. #include "eap_common/eap_defs.h"
  18. #include "eap_peer/eap.h"
  19. #include "eap_peer/eap_methods.h"
  20. #include "eapol_supp/eapol_supp_sm.h"
  21. #include "rsn_supp/wpa.h"
  22. #include "wpa_supplicant_i.h"
  23. #include "config.h"
  24. #include "config_ssid.h"
  25. #include "bss.h"
  26. #include "scan.h"
  27. #include "notify.h"
  28. #include "gas_query.h"
  29. #include "hs20_supplicant.h"
  30. #include "interworking.h"
  31. #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  32. #define INTERWORKING_3GPP
  33. #else
  34. #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  35. #define INTERWORKING_3GPP
  36. #else
  37. #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  38. #define INTERWORKING_3GPP
  39. #endif
  40. #endif
  41. #endif
  42. static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  43. static struct wpa_cred * interworking_credentials_available_realm(
  44. struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
  45. static struct wpa_cred * interworking_credentials_available_3gpp(
  46. struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
  47. static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  48. {
  49. if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  50. wpa_supplicant_cancel_sched_scan(wpa_s);
  51. wpa_supplicant_deauthenticate(wpa_s,
  52. WLAN_REASON_DEAUTH_LEAVING);
  53. }
  54. wpa_s->disconnected = 0;
  55. wpa_s->reassociate = 1;
  56. if (wpa_supplicant_fast_associate(wpa_s) >= 0)
  57. return;
  58. wpa_supplicant_req_scan(wpa_s, 0, 0);
  59. }
  60. static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  61. struct wpabuf *extra)
  62. {
  63. struct wpabuf *buf;
  64. size_t i;
  65. u8 *len_pos;
  66. buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
  67. (extra ? wpabuf_len(extra) : 0));
  68. if (buf == NULL)
  69. return NULL;
  70. len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
  71. for (i = 0; i < num_ids; i++)
  72. wpabuf_put_le16(buf, info_ids[i]);
  73. gas_anqp_set_element_len(buf, len_pos);
  74. if (extra)
  75. wpabuf_put_buf(buf, extra);
  76. gas_anqp_set_len(buf);
  77. return buf;
  78. }
  79. static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
  80. u8 dialog_token,
  81. enum gas_query_result result,
  82. const struct wpabuf *adv_proto,
  83. const struct wpabuf *resp,
  84. u16 status_code)
  85. {
  86. struct wpa_supplicant *wpa_s = ctx;
  87. anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
  88. status_code);
  89. interworking_next_anqp_fetch(wpa_s);
  90. }
  91. static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
  92. {
  93. struct wpa_cred *cred;
  94. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  95. if (cred->roaming_consortium_len)
  96. return 1;
  97. if (cred->required_roaming_consortium_len)
  98. return 1;
  99. }
  100. return 0;
  101. }
  102. static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
  103. {
  104. struct wpa_cred *cred;
  105. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  106. if (cred->pcsc || cred->imsi)
  107. return 1;
  108. }
  109. return 0;
  110. }
  111. static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
  112. {
  113. struct wpa_cred *cred;
  114. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  115. if (cred->pcsc || cred->imsi)
  116. continue;
  117. if (!cred->eap_method)
  118. return 1;
  119. if (cred->realm && cred->roaming_consortium_len == 0)
  120. return 1;
  121. }
  122. return 0;
  123. }
  124. static int cred_with_domain(struct wpa_supplicant *wpa_s)
  125. {
  126. struct wpa_cred *cred;
  127. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  128. if (cred->domain || cred->pcsc || cred->imsi)
  129. return 1;
  130. }
  131. return 0;
  132. }
  133. static int additional_roaming_consortiums(struct wpa_bss *bss)
  134. {
  135. const u8 *ie;
  136. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  137. if (ie == NULL || ie[1] == 0)
  138. return 0;
  139. return ie[2]; /* Number of ANQP OIs */
  140. }
  141. static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
  142. {
  143. struct wpa_supplicant *wpa_s = eloop_ctx;
  144. interworking_next_anqp_fetch(wpa_s);
  145. }
  146. static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
  147. struct wpa_bss *bss)
  148. {
  149. struct wpabuf *buf;
  150. int ret = 0;
  151. int res;
  152. u16 info_ids[8];
  153. size_t num_info_ids = 0;
  154. struct wpabuf *extra = NULL;
  155. int all = wpa_s->fetch_all_anqp;
  156. wpa_printf(MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
  157. MAC2STR(bss->bssid));
  158. wpa_s->interworking_gas_bss = bss;
  159. info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
  160. if (all) {
  161. info_ids[num_info_ids++] = ANQP_VENUE_NAME;
  162. info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
  163. }
  164. if (all || (cred_with_roaming_consortium(wpa_s) &&
  165. additional_roaming_consortiums(bss)))
  166. info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
  167. if (all)
  168. info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
  169. if (all || cred_with_nai_realm(wpa_s))
  170. info_ids[num_info_ids++] = ANQP_NAI_REALM;
  171. if (all || cred_with_3gpp(wpa_s))
  172. info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
  173. if (all || cred_with_domain(wpa_s))
  174. info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
  175. wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
  176. (u8 *) info_ids, num_info_ids * 2);
  177. #ifdef CONFIG_HS20
  178. if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
  179. u8 *len_pos;
  180. extra = wpabuf_alloc(100);
  181. if (!extra)
  182. return -1;
  183. len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
  184. wpabuf_put_be24(extra, OUI_WFA);
  185. wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
  186. wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
  187. wpabuf_put_u8(extra, 0); /* Reserved */
  188. wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
  189. if (all) {
  190. wpabuf_put_u8(extra,
  191. HS20_STYPE_OPERATOR_FRIENDLY_NAME);
  192. wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
  193. wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
  194. wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
  195. }
  196. gas_anqp_set_element_len(extra, len_pos);
  197. }
  198. #endif /* CONFIG_HS20 */
  199. buf = anqp_build_req(info_ids, num_info_ids, extra);
  200. wpabuf_free(extra);
  201. if (buf == NULL)
  202. return -1;
  203. res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, buf,
  204. interworking_anqp_resp_cb, wpa_s);
  205. if (res < 0) {
  206. wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
  207. wpabuf_free(buf);
  208. ret = -1;
  209. eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
  210. NULL);
  211. } else
  212. wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
  213. "%u", res);
  214. return ret;
  215. }
  216. struct nai_realm_eap {
  217. u8 method;
  218. u8 inner_method;
  219. enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
  220. u8 cred_type;
  221. u8 tunneled_cred_type;
  222. };
  223. struct nai_realm {
  224. u8 encoding;
  225. char *realm;
  226. u8 eap_count;
  227. struct nai_realm_eap *eap;
  228. };
  229. static void nai_realm_free(struct nai_realm *realms, u16 count)
  230. {
  231. u16 i;
  232. if (realms == NULL)
  233. return;
  234. for (i = 0; i < count; i++) {
  235. os_free(realms[i].eap);
  236. os_free(realms[i].realm);
  237. }
  238. os_free(realms);
  239. }
  240. static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
  241. const u8 *end)
  242. {
  243. u8 elen, auth_count, a;
  244. const u8 *e_end;
  245. if (pos + 3 > end) {
  246. wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
  247. return NULL;
  248. }
  249. elen = *pos++;
  250. if (pos + elen > end || elen < 2) {
  251. wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
  252. return NULL;
  253. }
  254. e_end = pos + elen;
  255. e->method = *pos++;
  256. auth_count = *pos++;
  257. wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
  258. elen, e->method, auth_count);
  259. for (a = 0; a < auth_count; a++) {
  260. u8 id, len;
  261. if (pos + 2 > end || pos + 2 + pos[1] > end) {
  262. wpa_printf(MSG_DEBUG, "No room for Authentication "
  263. "Parameter subfield");
  264. return NULL;
  265. }
  266. id = *pos++;
  267. len = *pos++;
  268. switch (id) {
  269. case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
  270. if (len < 1)
  271. break;
  272. e->inner_non_eap = *pos;
  273. if (e->method != EAP_TYPE_TTLS)
  274. break;
  275. switch (*pos) {
  276. case NAI_REALM_INNER_NON_EAP_PAP:
  277. wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
  278. break;
  279. case NAI_REALM_INNER_NON_EAP_CHAP:
  280. wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
  281. break;
  282. case NAI_REALM_INNER_NON_EAP_MSCHAP:
  283. wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
  284. break;
  285. case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
  286. wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
  287. break;
  288. }
  289. break;
  290. case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
  291. if (len < 1)
  292. break;
  293. e->inner_method = *pos;
  294. wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
  295. e->inner_method);
  296. break;
  297. case NAI_REALM_EAP_AUTH_CRED_TYPE:
  298. if (len < 1)
  299. break;
  300. e->cred_type = *pos;
  301. wpa_printf(MSG_DEBUG, "Credential Type: %u",
  302. e->cred_type);
  303. break;
  304. case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
  305. if (len < 1)
  306. break;
  307. e->tunneled_cred_type = *pos;
  308. wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
  309. "Type: %u", e->tunneled_cred_type);
  310. break;
  311. default:
  312. wpa_printf(MSG_DEBUG, "Unsupported Authentication "
  313. "Parameter: id=%u len=%u", id, len);
  314. wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
  315. "Value", pos, len);
  316. break;
  317. }
  318. pos += len;
  319. }
  320. return e_end;
  321. }
  322. static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
  323. const u8 *end)
  324. {
  325. u16 len;
  326. const u8 *f_end;
  327. u8 realm_len, e;
  328. if (end - pos < 4) {
  329. wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
  330. "fixed fields");
  331. return NULL;
  332. }
  333. len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
  334. pos += 2;
  335. if (pos + len > end || len < 3) {
  336. wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
  337. "(len=%u; left=%u)",
  338. len, (unsigned int) (end - pos));
  339. return NULL;
  340. }
  341. f_end = pos + len;
  342. r->encoding = *pos++;
  343. realm_len = *pos++;
  344. if (pos + realm_len > f_end) {
  345. wpa_printf(MSG_DEBUG, "No room for NAI Realm "
  346. "(len=%u; left=%u)",
  347. realm_len, (unsigned int) (f_end - pos));
  348. return NULL;
  349. }
  350. wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
  351. r->realm = dup_binstr(pos, realm_len);
  352. if (r->realm == NULL)
  353. return NULL;
  354. pos += realm_len;
  355. if (pos + 1 > f_end) {
  356. wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
  357. return NULL;
  358. }
  359. r->eap_count = *pos++;
  360. wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
  361. if (pos + r->eap_count * 3 > f_end) {
  362. wpa_printf(MSG_DEBUG, "No room for EAP Methods");
  363. return NULL;
  364. }
  365. r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
  366. if (r->eap == NULL)
  367. return NULL;
  368. for (e = 0; e < r->eap_count; e++) {
  369. pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
  370. if (pos == NULL)
  371. return NULL;
  372. }
  373. return f_end;
  374. }
  375. static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
  376. {
  377. struct nai_realm *realm;
  378. const u8 *pos, *end;
  379. u16 i, num;
  380. if (anqp == NULL || wpabuf_len(anqp) < 2)
  381. return NULL;
  382. pos = wpabuf_head_u8(anqp);
  383. end = pos + wpabuf_len(anqp);
  384. num = WPA_GET_LE16(pos);
  385. wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
  386. pos += 2;
  387. if (num * 5 > end - pos) {
  388. wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
  389. "enough data (%u octets) for that many realms",
  390. num, (unsigned int) (end - pos));
  391. return NULL;
  392. }
  393. realm = os_calloc(num, sizeof(struct nai_realm));
  394. if (realm == NULL)
  395. return NULL;
  396. for (i = 0; i < num; i++) {
  397. pos = nai_realm_parse_realm(&realm[i], pos, end);
  398. if (pos == NULL) {
  399. nai_realm_free(realm, num);
  400. return NULL;
  401. }
  402. }
  403. *count = num;
  404. return realm;
  405. }
  406. static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
  407. {
  408. char *tmp, *pos, *end;
  409. int match = 0;
  410. if (realm->realm == NULL || home_realm == NULL)
  411. return 0;
  412. if (os_strchr(realm->realm, ';') == NULL)
  413. return os_strcasecmp(realm->realm, home_realm) == 0;
  414. tmp = os_strdup(realm->realm);
  415. if (tmp == NULL)
  416. return 0;
  417. pos = tmp;
  418. while (*pos) {
  419. end = os_strchr(pos, ';');
  420. if (end)
  421. *end = '\0';
  422. if (os_strcasecmp(pos, home_realm) == 0) {
  423. match = 1;
  424. break;
  425. }
  426. if (end == NULL)
  427. break;
  428. pos = end + 1;
  429. }
  430. os_free(tmp);
  431. return match;
  432. }
  433. static int nai_realm_cred_username(struct nai_realm_eap *eap)
  434. {
  435. if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
  436. return 0; /* method not supported */
  437. if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP &&
  438. eap->method != EAP_TYPE_FAST) {
  439. /* Only tunneled methods with username/password supported */
  440. return 0;
  441. }
  442. if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) {
  443. if (eap->inner_method &&
  444. eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
  445. return 0;
  446. if (!eap->inner_method &&
  447. eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL)
  448. return 0;
  449. }
  450. if (eap->method == EAP_TYPE_TTLS) {
  451. if (eap->inner_method == 0 && eap->inner_non_eap == 0)
  452. return 1; /* Assume TTLS/MSCHAPv2 is used */
  453. if (eap->inner_method &&
  454. eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
  455. return 0;
  456. if (eap->inner_non_eap &&
  457. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
  458. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
  459. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
  460. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2)
  461. return 0;
  462. }
  463. if (eap->inner_method &&
  464. eap->inner_method != EAP_TYPE_GTC &&
  465. eap->inner_method != EAP_TYPE_MSCHAPV2)
  466. return 0;
  467. return 1;
  468. }
  469. static int nai_realm_cred_cert(struct nai_realm_eap *eap)
  470. {
  471. if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
  472. return 0; /* method not supported */
  473. if (eap->method != EAP_TYPE_TLS) {
  474. /* Only EAP-TLS supported for credential authentication */
  475. return 0;
  476. }
  477. return 1;
  478. }
  479. static struct nai_realm_eap * nai_realm_find_eap(struct wpa_cred *cred,
  480. struct nai_realm *realm)
  481. {
  482. u8 e;
  483. if (cred == NULL ||
  484. cred->username == NULL ||
  485. cred->username[0] == '\0' ||
  486. ((cred->password == NULL ||
  487. cred->password[0] == '\0') &&
  488. (cred->private_key == NULL ||
  489. cred->private_key[0] == '\0')))
  490. return NULL;
  491. for (e = 0; e < realm->eap_count; e++) {
  492. struct nai_realm_eap *eap = &realm->eap[e];
  493. if (cred->password && cred->password[0] &&
  494. nai_realm_cred_username(eap))
  495. return eap;
  496. if (cred->private_key && cred->private_key[0] &&
  497. nai_realm_cred_cert(eap))
  498. return eap;
  499. }
  500. return NULL;
  501. }
  502. #ifdef INTERWORKING_3GPP
  503. static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
  504. {
  505. u8 plmn[3], plmn2[3];
  506. const u8 *pos, *end;
  507. u8 udhl;
  508. /*
  509. * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network
  510. * operator is allowed to include only two digits of the MNC, so allow
  511. * matches based on both two and three digit MNC assumptions. Since some
  512. * SIM/USIM cards may not expose MNC length conveniently, we may be
  513. * provided the default MNC length 3 here and as such, checking with MNC
  514. * length 2 is justifiable even though 3GPP TS 24.234 does not mention
  515. * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used
  516. * with otherwise matching values would not be good idea in general, so
  517. * this should not result in selecting incorrect networks.
  518. */
  519. /* Match with 3 digit MNC */
  520. plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
  521. plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4);
  522. plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
  523. /* Match with 2 digit MNC */
  524. plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
  525. plmn2[1] = (imsi[2] - '0') | 0xf0;
  526. plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
  527. if (anqp == NULL)
  528. return 0;
  529. pos = wpabuf_head_u8(anqp);
  530. end = pos + wpabuf_len(anqp);
  531. if (pos + 2 > end)
  532. return 0;
  533. if (*pos != 0) {
  534. wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
  535. return 0;
  536. }
  537. pos++;
  538. udhl = *pos++;
  539. if (pos + udhl > end) {
  540. wpa_printf(MSG_DEBUG, "Invalid UDHL");
  541. return 0;
  542. }
  543. end = pos + udhl;
  544. wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)",
  545. plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2],
  546. imsi, mnc_len);
  547. while (pos + 2 <= end) {
  548. u8 iei, len;
  549. const u8 *l_end;
  550. iei = *pos++;
  551. len = *pos++ & 0x7f;
  552. if (pos + len > end)
  553. break;
  554. l_end = pos + len;
  555. if (iei == 0 && len > 0) {
  556. /* PLMN List */
  557. u8 num, i;
  558. wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element",
  559. pos, len);
  560. num = *pos++;
  561. for (i = 0; i < num; i++) {
  562. if (pos + 3 > l_end)
  563. break;
  564. if (os_memcmp(pos, plmn, 3) == 0 ||
  565. os_memcmp(pos, plmn2, 3) == 0)
  566. return 1; /* Found matching PLMN */
  567. pos += 3;
  568. }
  569. } else {
  570. wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element",
  571. pos, len);
  572. }
  573. pos = l_end;
  574. }
  575. return 0;
  576. }
  577. static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
  578. size_t mnc_len, char prefix)
  579. {
  580. const char *sep, *msin;
  581. char *end, *pos;
  582. size_t msin_len, plmn_len;
  583. /*
  584. * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
  585. * Root NAI:
  586. * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
  587. * <MNC> is zero-padded to three digits in case two-digit MNC is used
  588. */
  589. if (imsi == NULL || os_strlen(imsi) > 16) {
  590. wpa_printf(MSG_DEBUG, "No valid IMSI available");
  591. return -1;
  592. }
  593. sep = os_strchr(imsi, '-');
  594. if (sep) {
  595. plmn_len = sep - imsi;
  596. msin = sep + 1;
  597. } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
  598. plmn_len = 3 + mnc_len;
  599. msin = imsi + plmn_len;
  600. } else
  601. return -1;
  602. if (plmn_len != 5 && plmn_len != 6)
  603. return -1;
  604. msin_len = os_strlen(msin);
  605. pos = nai;
  606. end = nai + nai_len;
  607. if (prefix)
  608. *pos++ = prefix;
  609. os_memcpy(pos, imsi, plmn_len);
  610. pos += plmn_len;
  611. os_memcpy(pos, msin, msin_len);
  612. pos += msin_len;
  613. pos += os_snprintf(pos, end - pos, "@wlan.mnc");
  614. if (plmn_len == 5) {
  615. *pos++ = '0';
  616. *pos++ = imsi[3];
  617. *pos++ = imsi[4];
  618. } else {
  619. *pos++ = imsi[3];
  620. *pos++ = imsi[4];
  621. *pos++ = imsi[5];
  622. }
  623. pos += os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
  624. imsi[0], imsi[1], imsi[2]);
  625. return 0;
  626. }
  627. static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
  628. {
  629. char nai[100];
  630. if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
  631. return -1;
  632. return wpa_config_set_quoted(ssid, "identity", nai);
  633. }
  634. #endif /* INTERWORKING_3GPP */
  635. static int already_connected(struct wpa_supplicant *wpa_s,
  636. struct wpa_cred *cred, struct wpa_bss *bss)
  637. {
  638. struct wpa_ssid *ssid;
  639. if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL)
  640. return 0;
  641. ssid = wpa_s->current_ssid;
  642. if (ssid->parent_cred != cred)
  643. return 0;
  644. if (ssid->ssid_len != bss->ssid_len ||
  645. os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
  646. return 0;
  647. return 1;
  648. }
  649. static void remove_duplicate_network(struct wpa_supplicant *wpa_s,
  650. struct wpa_cred *cred,
  651. struct wpa_bss *bss)
  652. {
  653. struct wpa_ssid *ssid;
  654. for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
  655. if (ssid->parent_cred != cred)
  656. continue;
  657. if (ssid->ssid_len != bss->ssid_len ||
  658. os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
  659. continue;
  660. break;
  661. }
  662. if (ssid == NULL)
  663. return;
  664. wpa_printf(MSG_DEBUG, "Interworking: Remove duplicate network entry for the same credential");
  665. if (ssid == wpa_s->current_ssid) {
  666. wpa_sm_set_config(wpa_s->wpa, NULL);
  667. eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
  668. wpa_supplicant_deauthenticate(wpa_s,
  669. WLAN_REASON_DEAUTH_LEAVING);
  670. }
  671. wpas_notify_network_removed(wpa_s, ssid);
  672. wpa_config_remove_network(wpa_s->conf, ssid->id);
  673. }
  674. static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
  675. struct wpa_ssid *ssid)
  676. {
  677. if (wpa_config_set(ssid, "key_mgmt",
  678. wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
  679. "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP", 0) < 0)
  680. return -1;
  681. if (wpa_config_set(ssid, "proto", "RSN", 0) < 0)
  682. return -1;
  683. if (wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
  684. return -1;
  685. return 0;
  686. }
  687. static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
  688. struct wpa_cred *cred,
  689. struct wpa_bss *bss)
  690. {
  691. #ifdef INTERWORKING_3GPP
  692. struct wpa_ssid *ssid;
  693. int eap_type;
  694. int res;
  695. char prefix;
  696. if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
  697. return -1;
  698. wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " (3GPP)",
  699. MAC2STR(bss->bssid));
  700. if (already_connected(wpa_s, cred, bss)) {
  701. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
  702. MAC2STR(bss->bssid));
  703. return 0;
  704. }
  705. remove_duplicate_network(wpa_s, cred, bss);
  706. ssid = wpa_config_add_network(wpa_s->conf);
  707. if (ssid == NULL)
  708. return -1;
  709. ssid->parent_cred = cred;
  710. wpas_notify_network_added(wpa_s, ssid);
  711. wpa_config_set_network_defaults(ssid);
  712. ssid->priority = cred->priority;
  713. ssid->temporary = 1;
  714. ssid->ssid = os_zalloc(bss->ssid_len + 1);
  715. if (ssid->ssid == NULL)
  716. goto fail;
  717. os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
  718. ssid->ssid_len = bss->ssid_len;
  719. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  720. goto fail;
  721. eap_type = EAP_TYPE_SIM;
  722. if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
  723. eap_type = EAP_TYPE_AKA;
  724. if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
  725. if (cred->eap_method[0].method == EAP_TYPE_SIM ||
  726. cred->eap_method[0].method == EAP_TYPE_AKA ||
  727. cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
  728. eap_type = cred->eap_method[0].method;
  729. }
  730. switch (eap_type) {
  731. case EAP_TYPE_SIM:
  732. prefix = '1';
  733. res = wpa_config_set(ssid, "eap", "SIM", 0);
  734. break;
  735. case EAP_TYPE_AKA:
  736. prefix = '0';
  737. res = wpa_config_set(ssid, "eap", "AKA", 0);
  738. break;
  739. case EAP_TYPE_AKA_PRIME:
  740. prefix = '6';
  741. res = wpa_config_set(ssid, "eap", "AKA'", 0);
  742. break;
  743. default:
  744. res = -1;
  745. break;
  746. }
  747. if (res < 0) {
  748. wpa_printf(MSG_DEBUG, "Selected EAP method (%d) not supported",
  749. eap_type);
  750. goto fail;
  751. }
  752. if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
  753. wpa_printf(MSG_DEBUG, "Failed to set Root NAI");
  754. goto fail;
  755. }
  756. if (cred->milenage && cred->milenage[0]) {
  757. if (wpa_config_set_quoted(ssid, "password",
  758. cred->milenage) < 0)
  759. goto fail;
  760. } else if (cred->pcsc) {
  761. if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
  762. goto fail;
  763. if (wpa_s->conf->pcsc_pin &&
  764. wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
  765. < 0)
  766. goto fail;
  767. }
  768. if (cred->password && cred->password[0] &&
  769. wpa_config_set_quoted(ssid, "password", cred->password) < 0)
  770. goto fail;
  771. wpa_s->next_ssid = ssid;
  772. wpa_config_update_prio_list(wpa_s->conf);
  773. interworking_reconnect(wpa_s);
  774. return 0;
  775. fail:
  776. wpas_notify_network_removed(wpa_s, ssid);
  777. wpa_config_remove_network(wpa_s->conf, ssid->id);
  778. #endif /* INTERWORKING_3GPP */
  779. return -1;
  780. }
  781. static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
  782. size_t rc_len)
  783. {
  784. const u8 *pos, *end;
  785. u8 lens;
  786. if (ie == NULL)
  787. return 0;
  788. pos = ie + 2;
  789. end = ie + 2 + ie[1];
  790. /* Roaming Consortium element:
  791. * Number of ANQP OIs
  792. * OI #1 and #2 lengths
  793. * OI #1, [OI #2], [OI #3]
  794. */
  795. if (pos + 2 > end)
  796. return 0;
  797. pos++; /* skip Number of ANQP OIs */
  798. lens = *pos++;
  799. if (pos + (lens & 0x0f) + (lens >> 4) > end)
  800. return 0;
  801. if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  802. return 1;
  803. pos += lens & 0x0f;
  804. if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  805. return 1;
  806. pos += lens >> 4;
  807. if (pos < end && (size_t) (end - pos) == rc_len &&
  808. os_memcmp(pos, rc_id, rc_len) == 0)
  809. return 1;
  810. return 0;
  811. }
  812. static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
  813. const u8 *rc_id, size_t rc_len)
  814. {
  815. const u8 *pos, *end;
  816. u8 len;
  817. if (anqp == NULL)
  818. return 0;
  819. pos = wpabuf_head(anqp);
  820. end = pos + wpabuf_len(anqp);
  821. /* Set of <OI Length, OI> duples */
  822. while (pos < end) {
  823. len = *pos++;
  824. if (pos + len > end)
  825. break;
  826. if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  827. return 1;
  828. pos += len;
  829. }
  830. return 0;
  831. }
  832. static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
  833. const u8 *rc_id, size_t rc_len)
  834. {
  835. return roaming_consortium_element_match(ie, rc_id, rc_len) ||
  836. roaming_consortium_anqp_match(anqp, rc_id, rc_len);
  837. }
  838. static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss)
  839. {
  840. const u8 *ie;
  841. if (cred->required_roaming_consortium_len == 0)
  842. return 0;
  843. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  844. if (ie == NULL &&
  845. (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
  846. return 1;
  847. return !roaming_consortium_match(ie,
  848. bss->anqp ?
  849. bss->anqp->roaming_consortium : NULL,
  850. cred->required_roaming_consortium,
  851. cred->required_roaming_consortium_len);
  852. }
  853. static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
  854. {
  855. size_t i;
  856. if (!cred->excluded_ssid)
  857. return 0;
  858. for (i = 0; i < cred->num_excluded_ssid; i++) {
  859. struct excluded_ssid *e = &cred->excluded_ssid[i];
  860. if (bss->ssid_len == e->ssid_len &&
  861. os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
  862. return 1;
  863. }
  864. return 0;
  865. }
  866. static struct wpa_cred * interworking_credentials_available_roaming_consortium(
  867. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  868. {
  869. struct wpa_cred *cred, *selected = NULL;
  870. const u8 *ie;
  871. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  872. if (ie == NULL &&
  873. (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
  874. return NULL;
  875. if (wpa_s->conf->cred == NULL)
  876. return NULL;
  877. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  878. if (cred->roaming_consortium_len == 0)
  879. continue;
  880. if (!roaming_consortium_match(ie,
  881. bss->anqp ?
  882. bss->anqp->roaming_consortium :
  883. NULL,
  884. cred->roaming_consortium,
  885. cred->roaming_consortium_len))
  886. continue;
  887. if (cred_excluded_ssid(cred, bss))
  888. continue;
  889. if (cred_no_required_oi_match(cred, bss))
  890. continue;
  891. if (selected == NULL ||
  892. selected->priority < cred->priority)
  893. selected = cred;
  894. }
  895. return selected;
  896. }
  897. static int interworking_set_eap_params(struct wpa_ssid *ssid,
  898. struct wpa_cred *cred, int ttls)
  899. {
  900. if (cred->eap_method) {
  901. ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
  902. cred->eap_method->method == EAP_TYPE_TTLS;
  903. os_free(ssid->eap.eap_methods);
  904. ssid->eap.eap_methods =
  905. os_malloc(sizeof(struct eap_method_type) * 2);
  906. if (ssid->eap.eap_methods == NULL)
  907. return -1;
  908. os_memcpy(ssid->eap.eap_methods, cred->eap_method,
  909. sizeof(*cred->eap_method));
  910. ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
  911. ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
  912. }
  913. if (ttls && cred->username && cred->username[0]) {
  914. const char *pos;
  915. char *anon;
  916. /* Use anonymous NAI in Phase 1 */
  917. pos = os_strchr(cred->username, '@');
  918. if (pos) {
  919. size_t buflen = 9 + os_strlen(pos) + 1;
  920. anon = os_malloc(buflen);
  921. if (anon == NULL)
  922. return -1;
  923. os_snprintf(anon, buflen, "anonymous%s", pos);
  924. } else if (cred->realm) {
  925. size_t buflen = 10 + os_strlen(cred->realm) + 1;
  926. anon = os_malloc(buflen);
  927. if (anon == NULL)
  928. return -1;
  929. os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
  930. } else {
  931. anon = os_strdup("anonymous");
  932. if (anon == NULL)
  933. return -1;
  934. }
  935. if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
  936. 0) {
  937. os_free(anon);
  938. return -1;
  939. }
  940. os_free(anon);
  941. }
  942. if (cred->username && cred->username[0] &&
  943. wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
  944. return -1;
  945. if (cred->password && cred->password[0]) {
  946. if (cred->ext_password &&
  947. wpa_config_set(ssid, "password", cred->password, 0) < 0)
  948. return -1;
  949. if (!cred->ext_password &&
  950. wpa_config_set_quoted(ssid, "password", cred->password) <
  951. 0)
  952. return -1;
  953. }
  954. if (cred->client_cert && cred->client_cert[0] &&
  955. wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
  956. return -1;
  957. #ifdef ANDROID
  958. if (cred->private_key &&
  959. os_strncmp(cred->private_key, "keystore://", 11) == 0) {
  960. /* Use OpenSSL engine configuration for Android keystore */
  961. if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
  962. wpa_config_set_quoted(ssid, "key_id",
  963. cred->private_key + 11) < 0 ||
  964. wpa_config_set(ssid, "engine", "1", 0) < 0)
  965. return -1;
  966. } else
  967. #endif /* ANDROID */
  968. if (cred->private_key && cred->private_key[0] &&
  969. wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
  970. return -1;
  971. if (cred->private_key_passwd && cred->private_key_passwd[0] &&
  972. wpa_config_set_quoted(ssid, "private_key_passwd",
  973. cred->private_key_passwd) < 0)
  974. return -1;
  975. if (cred->phase1) {
  976. os_free(ssid->eap.phase1);
  977. ssid->eap.phase1 = os_strdup(cred->phase1);
  978. }
  979. if (cred->phase2) {
  980. os_free(ssid->eap.phase2);
  981. ssid->eap.phase2 = os_strdup(cred->phase2);
  982. }
  983. if (cred->ca_cert && cred->ca_cert[0] &&
  984. wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
  985. return -1;
  986. if (cred->domain_suffix_match && cred->domain_suffix_match[0] &&
  987. wpa_config_set_quoted(ssid, "domain_suffix_match",
  988. cred->domain_suffix_match) < 0)
  989. return -1;
  990. return 0;
  991. }
  992. static int interworking_connect_roaming_consortium(
  993. struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
  994. struct wpa_bss *bss)
  995. {
  996. struct wpa_ssid *ssid;
  997. wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " based on "
  998. "roaming consortium match", MAC2STR(bss->bssid));
  999. if (already_connected(wpa_s, cred, bss)) {
  1000. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
  1001. MAC2STR(bss->bssid));
  1002. return 0;
  1003. }
  1004. remove_duplicate_network(wpa_s, cred, bss);
  1005. ssid = wpa_config_add_network(wpa_s->conf);
  1006. if (ssid == NULL)
  1007. return -1;
  1008. ssid->parent_cred = cred;
  1009. wpas_notify_network_added(wpa_s, ssid);
  1010. wpa_config_set_network_defaults(ssid);
  1011. ssid->priority = cred->priority;
  1012. ssid->temporary = 1;
  1013. ssid->ssid = os_zalloc(bss->ssid_len + 1);
  1014. if (ssid->ssid == NULL)
  1015. goto fail;
  1016. os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
  1017. ssid->ssid_len = bss->ssid_len;
  1018. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  1019. goto fail;
  1020. if (cred->eap_method == NULL) {
  1021. wpa_printf(MSG_DEBUG, "Interworking: No EAP method set for "
  1022. "credential using roaming consortium");
  1023. goto fail;
  1024. }
  1025. if (interworking_set_eap_params(
  1026. ssid, cred,
  1027. cred->eap_method->vendor == EAP_VENDOR_IETF &&
  1028. cred->eap_method->method == EAP_TYPE_TTLS) < 0)
  1029. goto fail;
  1030. wpa_s->next_ssid = ssid;
  1031. wpa_config_update_prio_list(wpa_s->conf);
  1032. interworking_reconnect(wpa_s);
  1033. return 0;
  1034. fail:
  1035. wpas_notify_network_removed(wpa_s, ssid);
  1036. wpa_config_remove_network(wpa_s->conf, ssid->id);
  1037. return -1;
  1038. }
  1039. int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1040. {
  1041. struct wpa_cred *cred, *cred_rc, *cred_3gpp;
  1042. struct wpa_ssid *ssid;
  1043. struct nai_realm *realm;
  1044. struct nai_realm_eap *eap = NULL;
  1045. u16 count, i;
  1046. char buf[100];
  1047. if (wpa_s->conf->cred == NULL || bss == NULL)
  1048. return -1;
  1049. if (disallowed_bssid(wpa_s, bss->bssid) ||
  1050. disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
  1051. wpa_printf(MSG_DEBUG, "Interworking: Reject connection to disallowed BSS "
  1052. MACSTR, MAC2STR(bss->bssid));
  1053. return -1;
  1054. }
  1055. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
  1056. /*
  1057. * We currently support only HS 2.0 networks and those are
  1058. * required to use WPA2-Enterprise.
  1059. */
  1060. wpa_printf(MSG_DEBUG, "Interworking: Network does not use "
  1061. "RSN");
  1062. return -1;
  1063. }
  1064. cred_rc = interworking_credentials_available_roaming_consortium(wpa_s,
  1065. bss);
  1066. if (cred_rc) {
  1067. wpa_printf(MSG_DEBUG, "Interworking: Highest roaming "
  1068. "consortium matching credential priority %d",
  1069. cred_rc->priority);
  1070. }
  1071. cred = interworking_credentials_available_realm(wpa_s, bss);
  1072. if (cred) {
  1073. wpa_printf(MSG_DEBUG, "Interworking: Highest NAI Realm list "
  1074. "matching credential priority %d",
  1075. cred->priority);
  1076. }
  1077. cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss);
  1078. if (cred_3gpp) {
  1079. wpa_printf(MSG_DEBUG, "Interworking: Highest 3GPP matching "
  1080. "credential priority %d", cred_3gpp->priority);
  1081. }
  1082. if (cred_rc &&
  1083. (cred == NULL || cred_rc->priority >= cred->priority) &&
  1084. (cred_3gpp == NULL || cred_rc->priority >= cred_3gpp->priority))
  1085. return interworking_connect_roaming_consortium(wpa_s, cred_rc,
  1086. bss);
  1087. if (cred_3gpp &&
  1088. (cred == NULL || cred_3gpp->priority >= cred->priority)) {
  1089. return interworking_connect_3gpp(wpa_s, cred_3gpp, bss);
  1090. }
  1091. if (cred == NULL) {
  1092. wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
  1093. "found for " MACSTR, MAC2STR(bss->bssid));
  1094. return -1;
  1095. }
  1096. realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
  1097. &count);
  1098. if (realm == NULL) {
  1099. wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
  1100. "Realm list from " MACSTR, MAC2STR(bss->bssid));
  1101. return -1;
  1102. }
  1103. for (i = 0; i < count; i++) {
  1104. if (!nai_realm_match(&realm[i], cred->realm))
  1105. continue;
  1106. eap = nai_realm_find_eap(cred, &realm[i]);
  1107. if (eap)
  1108. break;
  1109. }
  1110. if (!eap) {
  1111. wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
  1112. "and EAP method found for " MACSTR,
  1113. MAC2STR(bss->bssid));
  1114. nai_realm_free(realm, count);
  1115. return -1;
  1116. }
  1117. wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR,
  1118. MAC2STR(bss->bssid));
  1119. if (already_connected(wpa_s, cred, bss)) {
  1120. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
  1121. MAC2STR(bss->bssid));
  1122. nai_realm_free(realm, count);
  1123. return 0;
  1124. }
  1125. remove_duplicate_network(wpa_s, cred, bss);
  1126. ssid = wpa_config_add_network(wpa_s->conf);
  1127. if (ssid == NULL) {
  1128. nai_realm_free(realm, count);
  1129. return -1;
  1130. }
  1131. ssid->parent_cred = cred;
  1132. wpas_notify_network_added(wpa_s, ssid);
  1133. wpa_config_set_network_defaults(ssid);
  1134. ssid->priority = cred->priority;
  1135. ssid->temporary = 1;
  1136. ssid->ssid = os_zalloc(bss->ssid_len + 1);
  1137. if (ssid->ssid == NULL)
  1138. goto fail;
  1139. os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
  1140. ssid->ssid_len = bss->ssid_len;
  1141. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  1142. goto fail;
  1143. if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
  1144. eap->method), 0) < 0)
  1145. goto fail;
  1146. switch (eap->method) {
  1147. case EAP_TYPE_TTLS:
  1148. if (eap->inner_method) {
  1149. os_snprintf(buf, sizeof(buf), "\"autheap=%s\"",
  1150. eap_get_name(EAP_VENDOR_IETF,
  1151. eap->inner_method));
  1152. if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
  1153. goto fail;
  1154. break;
  1155. }
  1156. switch (eap->inner_non_eap) {
  1157. case NAI_REALM_INNER_NON_EAP_PAP:
  1158. if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
  1159. 0)
  1160. goto fail;
  1161. break;
  1162. case NAI_REALM_INNER_NON_EAP_CHAP:
  1163. if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
  1164. < 0)
  1165. goto fail;
  1166. break;
  1167. case NAI_REALM_INNER_NON_EAP_MSCHAP:
  1168. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
  1169. 0) < 0)
  1170. goto fail;
  1171. break;
  1172. case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
  1173. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
  1174. 0) < 0)
  1175. goto fail;
  1176. break;
  1177. default:
  1178. /* EAP params were not set - assume TTLS/MSCHAPv2 */
  1179. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
  1180. 0) < 0)
  1181. goto fail;
  1182. break;
  1183. }
  1184. break;
  1185. case EAP_TYPE_PEAP:
  1186. case EAP_TYPE_FAST:
  1187. if (wpa_config_set(ssid, "phase1", "\"fast_provisioning=2\"",
  1188. 0) < 0)
  1189. goto fail;
  1190. if (wpa_config_set(ssid, "pac_file",
  1191. "\"blob://pac_interworking\"", 0) < 0)
  1192. goto fail;
  1193. os_snprintf(buf, sizeof(buf), "\"auth=%s\"",
  1194. eap_get_name(EAP_VENDOR_IETF,
  1195. eap->inner_method ?
  1196. eap->inner_method :
  1197. EAP_TYPE_MSCHAPV2));
  1198. if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
  1199. goto fail;
  1200. break;
  1201. case EAP_TYPE_TLS:
  1202. break;
  1203. }
  1204. if (interworking_set_eap_params(ssid, cred,
  1205. eap->method == EAP_TYPE_TTLS) < 0)
  1206. goto fail;
  1207. nai_realm_free(realm, count);
  1208. wpa_s->next_ssid = ssid;
  1209. wpa_config_update_prio_list(wpa_s->conf);
  1210. interworking_reconnect(wpa_s);
  1211. return 0;
  1212. fail:
  1213. wpas_notify_network_removed(wpa_s, ssid);
  1214. wpa_config_remove_network(wpa_s->conf, ssid->id);
  1215. nai_realm_free(realm, count);
  1216. return -1;
  1217. }
  1218. static struct wpa_cred * interworking_credentials_available_3gpp(
  1219. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1220. {
  1221. struct wpa_cred *selected = NULL;
  1222. #ifdef INTERWORKING_3GPP
  1223. struct wpa_cred *cred;
  1224. int ret;
  1225. if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
  1226. return NULL;
  1227. #ifdef CONFIG_EAP_PROXY
  1228. if (!wpa_s->imsi[0]) {
  1229. size_t len;
  1230. wpa_printf(MSG_DEBUG, "Interworking: IMSI not available - try to read again through eap_proxy");
  1231. wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol,
  1232. wpa_s->imsi,
  1233. &len);
  1234. if (wpa_s->mnc_len > 0) {
  1235. wpa_s->imsi[len] = '\0';
  1236. wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
  1237. wpa_s->imsi, wpa_s->mnc_len);
  1238. } else {
  1239. wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
  1240. }
  1241. }
  1242. #endif /* CONFIG_EAP_PROXY */
  1243. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1244. char *sep;
  1245. const char *imsi;
  1246. int mnc_len;
  1247. char imsi_buf[16];
  1248. size_t msin_len;
  1249. #ifdef PCSC_FUNCS
  1250. if (cred->pcsc && wpa_s->conf->pcsc_reader && wpa_s->scard &&
  1251. wpa_s->imsi[0]) {
  1252. imsi = wpa_s->imsi;
  1253. mnc_len = wpa_s->mnc_len;
  1254. goto compare;
  1255. }
  1256. #endif /* PCSC_FUNCS */
  1257. #ifdef CONFIG_EAP_PROXY
  1258. if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
  1259. imsi = wpa_s->imsi;
  1260. mnc_len = wpa_s->mnc_len;
  1261. goto compare;
  1262. }
  1263. #endif /* CONFIG_EAP_PROXY */
  1264. if (cred->imsi == NULL || !cred->imsi[0] ||
  1265. (!wpa_s->conf->external_sim &&
  1266. (cred->milenage == NULL || !cred->milenage[0])))
  1267. continue;
  1268. sep = os_strchr(cred->imsi, '-');
  1269. if (sep == NULL ||
  1270. (sep - cred->imsi != 5 && sep - cred->imsi != 6))
  1271. continue;
  1272. mnc_len = sep - cred->imsi - 3;
  1273. os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len);
  1274. sep++;
  1275. msin_len = os_strlen(cred->imsi);
  1276. if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1)
  1277. msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1;
  1278. os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len);
  1279. imsi_buf[3 + mnc_len + msin_len] = '\0';
  1280. imsi = imsi_buf;
  1281. #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
  1282. compare:
  1283. #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
  1284. wpa_printf(MSG_DEBUG, "Interworking: Parsing 3GPP info from "
  1285. MACSTR, MAC2STR(bss->bssid));
  1286. ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
  1287. wpa_printf(MSG_DEBUG, "PLMN match %sfound", ret ? "" : "not ");
  1288. if (ret) {
  1289. if (cred_excluded_ssid(cred, bss))
  1290. continue;
  1291. if (cred_no_required_oi_match(cred, bss))
  1292. continue;
  1293. if (selected == NULL ||
  1294. selected->priority < cred->priority)
  1295. selected = cred;
  1296. }
  1297. }
  1298. #endif /* INTERWORKING_3GPP */
  1299. return selected;
  1300. }
  1301. static struct wpa_cred * interworking_credentials_available_realm(
  1302. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1303. {
  1304. struct wpa_cred *cred, *selected = NULL;
  1305. struct nai_realm *realm;
  1306. u16 count, i;
  1307. if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
  1308. return NULL;
  1309. if (wpa_s->conf->cred == NULL)
  1310. return NULL;
  1311. wpa_printf(MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
  1312. MACSTR, MAC2STR(bss->bssid));
  1313. realm = nai_realm_parse(bss->anqp->nai_realm, &count);
  1314. if (realm == NULL) {
  1315. wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
  1316. "Realm list from " MACSTR, MAC2STR(bss->bssid));
  1317. return NULL;
  1318. }
  1319. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1320. if (cred->realm == NULL)
  1321. continue;
  1322. for (i = 0; i < count; i++) {
  1323. if (!nai_realm_match(&realm[i], cred->realm))
  1324. continue;
  1325. if (nai_realm_find_eap(cred, &realm[i])) {
  1326. if (cred_excluded_ssid(cred, bss))
  1327. continue;
  1328. if (cred_no_required_oi_match(cred, bss))
  1329. continue;
  1330. if (selected == NULL ||
  1331. selected->priority < cred->priority)
  1332. selected = cred;
  1333. break;
  1334. }
  1335. }
  1336. }
  1337. nai_realm_free(realm, count);
  1338. return selected;
  1339. }
  1340. static struct wpa_cred * interworking_credentials_available(
  1341. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1342. {
  1343. struct wpa_cred *cred, *cred2;
  1344. if (disallowed_bssid(wpa_s, bss->bssid) ||
  1345. disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
  1346. wpa_printf(MSG_DEBUG, "Interworking: Ignore disallowed BSS "
  1347. MACSTR, MAC2STR(bss->bssid));
  1348. return NULL;
  1349. }
  1350. cred = interworking_credentials_available_realm(wpa_s, bss);
  1351. cred2 = interworking_credentials_available_3gpp(wpa_s, bss);
  1352. if (cred && cred2 && cred2->priority >= cred->priority)
  1353. cred = cred2;
  1354. if (!cred)
  1355. cred = cred2;
  1356. cred2 = interworking_credentials_available_roaming_consortium(wpa_s,
  1357. bss);
  1358. if (cred && cred2 && cred2->priority >= cred->priority)
  1359. cred = cred2;
  1360. if (!cred)
  1361. cred = cred2;
  1362. return cred;
  1363. }
  1364. static int domain_name_list_contains(struct wpabuf *domain_names,
  1365. const char *domain)
  1366. {
  1367. const u8 *pos, *end;
  1368. size_t len;
  1369. len = os_strlen(domain);
  1370. pos = wpabuf_head(domain_names);
  1371. end = pos + wpabuf_len(domain_names);
  1372. while (pos + 1 < end) {
  1373. if (pos + 1 + pos[0] > end)
  1374. break;
  1375. wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
  1376. pos + 1, pos[0]);
  1377. if (pos[0] == len &&
  1378. os_strncasecmp(domain, (const char *) (pos + 1), len) == 0)
  1379. return 1;
  1380. pos += 1 + pos[0];
  1381. }
  1382. return 0;
  1383. }
  1384. int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
  1385. struct wpa_cred *cred,
  1386. struct wpabuf *domain_names)
  1387. {
  1388. size_t i;
  1389. int ret = -1;
  1390. #ifdef INTERWORKING_3GPP
  1391. char nai[100], *realm;
  1392. char *imsi = NULL;
  1393. int mnc_len = 0;
  1394. if (cred->imsi)
  1395. imsi = cred->imsi;
  1396. #ifdef CONFIG_PCSC
  1397. else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
  1398. wpa_s->scard && wpa_s->imsi[0]) {
  1399. imsi = wpa_s->imsi;
  1400. mnc_len = wpa_s->mnc_len;
  1401. }
  1402. #endif /* CONFIG_PCSC */
  1403. #ifdef CONFIG_EAP_PROXY
  1404. else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
  1405. imsi = wpa_s->imsi;
  1406. mnc_len = wpa_s->mnc_len;
  1407. }
  1408. #endif /* CONFIG_EAP_PROXY */
  1409. if (domain_names &&
  1410. imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
  1411. realm = os_strchr(nai, '@');
  1412. if (realm)
  1413. realm++;
  1414. wpa_printf(MSG_DEBUG, "Interworking: Search for match "
  1415. "with SIM/USIM domain %s", realm);
  1416. if (realm &&
  1417. domain_name_list_contains(domain_names, realm))
  1418. return 1;
  1419. if (realm)
  1420. ret = 0;
  1421. }
  1422. #endif /* INTERWORKING_3GPP */
  1423. if (domain_names == NULL || cred->domain == NULL)
  1424. return ret;
  1425. for (i = 0; i < cred->num_domain; i++) {
  1426. wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
  1427. "home SP FQDN %s", cred->domain[i]);
  1428. if (domain_name_list_contains(domain_names, cred->domain[i]))
  1429. return 1;
  1430. }
  1431. return 0;
  1432. }
  1433. static int interworking_home_sp(struct wpa_supplicant *wpa_s,
  1434. struct wpabuf *domain_names)
  1435. {
  1436. struct wpa_cred *cred;
  1437. if (domain_names == NULL || wpa_s->conf->cred == NULL)
  1438. return -1;
  1439. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1440. int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
  1441. if (res)
  1442. return res;
  1443. }
  1444. return 0;
  1445. }
  1446. static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
  1447. {
  1448. struct wpa_bss *bss;
  1449. struct wpa_ssid *ssid;
  1450. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1451. for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
  1452. if (wpas_network_disabled(wpa_s, ssid) ||
  1453. ssid->mode != WPAS_MODE_INFRA)
  1454. continue;
  1455. if (ssid->ssid_len != bss->ssid_len ||
  1456. os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
  1457. 0)
  1458. continue;
  1459. /*
  1460. * TODO: Consider more accurate matching of security
  1461. * configuration similarly to what is done in events.c
  1462. */
  1463. return 1;
  1464. }
  1465. }
  1466. return 0;
  1467. }
  1468. static void interworking_select_network(struct wpa_supplicant *wpa_s)
  1469. {
  1470. struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
  1471. int selected_prio = -999999, selected_home_prio = -999999;
  1472. unsigned int count = 0;
  1473. const char *type;
  1474. int res;
  1475. struct wpa_cred *cred;
  1476. wpa_s->network_select = 0;
  1477. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1478. cred = interworking_credentials_available(wpa_s, bss);
  1479. if (!cred)
  1480. continue;
  1481. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
  1482. /*
  1483. * We currently support only HS 2.0 networks and those
  1484. * are required to use WPA2-Enterprise.
  1485. */
  1486. wpa_printf(MSG_DEBUG, "Interworking: Credential match "
  1487. "with " MACSTR " but network does not use "
  1488. "RSN", MAC2STR(bss->bssid));
  1489. continue;
  1490. }
  1491. count++;
  1492. res = interworking_home_sp(wpa_s, bss->anqp ?
  1493. bss->anqp->domain_name : NULL);
  1494. if (res > 0)
  1495. type = "home";
  1496. else if (res == 0)
  1497. type = "roaming";
  1498. else
  1499. type = "unknown";
  1500. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_AP MACSTR " type=%s",
  1501. MAC2STR(bss->bssid), type);
  1502. if (wpa_s->auto_select ||
  1503. (wpa_s->conf->auto_interworking &&
  1504. wpa_s->auto_network_select)) {
  1505. if (selected == NULL ||
  1506. cred->priority > selected_prio) {
  1507. selected = bss;
  1508. selected_prio = cred->priority;
  1509. }
  1510. if (res > 0 &&
  1511. (selected_home == NULL ||
  1512. cred->priority > selected_home_prio)) {
  1513. selected_home = bss;
  1514. selected_home_prio = cred->priority;
  1515. }
  1516. }
  1517. }
  1518. if (selected_home && selected_home != selected &&
  1519. selected_home_prio >= selected_prio) {
  1520. /* Prefer network operated by the Home SP */
  1521. selected = selected_home;
  1522. }
  1523. if (count == 0) {
  1524. /*
  1525. * No matching network was found based on configured
  1526. * credentials. Check whether any of the enabled network blocks
  1527. * have matching APs.
  1528. */
  1529. if (interworking_find_network_match(wpa_s)) {
  1530. wpa_printf(MSG_DEBUG, "Interworking: Possible BSS "
  1531. "match for enabled network configurations");
  1532. if (wpa_s->auto_select)
  1533. interworking_reconnect(wpa_s);
  1534. return;
  1535. }
  1536. if (wpa_s->auto_network_select) {
  1537. wpa_printf(MSG_DEBUG, "Interworking: Continue "
  1538. "scanning after ANQP fetch");
  1539. wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
  1540. 0);
  1541. return;
  1542. }
  1543. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
  1544. "with matching credentials found");
  1545. }
  1546. if (selected)
  1547. interworking_connect(wpa_s, selected);
  1548. }
  1549. static struct wpa_bss_anqp *
  1550. interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1551. {
  1552. struct wpa_bss *other;
  1553. if (is_zero_ether_addr(bss->hessid))
  1554. return NULL; /* Cannot be in the same homegenous ESS */
  1555. dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
  1556. if (other == bss)
  1557. continue;
  1558. if (other->anqp == NULL)
  1559. continue;
  1560. if (other->anqp->roaming_consortium == NULL &&
  1561. other->anqp->nai_realm == NULL &&
  1562. other->anqp->anqp_3gpp == NULL &&
  1563. other->anqp->domain_name == NULL)
  1564. continue;
  1565. if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
  1566. continue;
  1567. if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
  1568. continue;
  1569. if (bss->ssid_len != other->ssid_len ||
  1570. os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
  1571. continue;
  1572. wpa_printf(MSG_DEBUG, "Interworking: Share ANQP data with "
  1573. "already fetched BSSID " MACSTR " and " MACSTR,
  1574. MAC2STR(other->bssid), MAC2STR(bss->bssid));
  1575. other->anqp->users++;
  1576. return other->anqp;
  1577. }
  1578. return NULL;
  1579. }
  1580. static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
  1581. {
  1582. struct wpa_bss *bss;
  1583. int found = 0;
  1584. const u8 *ie;
  1585. if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress)
  1586. return;
  1587. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1588. if (!(bss->caps & IEEE80211_CAP_ESS))
  1589. continue;
  1590. ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
  1591. if (ie == NULL || ie[1] < 4 || !(ie[5] & 0x80))
  1592. continue; /* AP does not support Interworking */
  1593. if (disallowed_bssid(wpa_s, bss->bssid) ||
  1594. disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len))
  1595. continue; /* Disallowed BSS */
  1596. if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
  1597. if (bss->anqp == NULL) {
  1598. bss->anqp = interworking_match_anqp_info(wpa_s,
  1599. bss);
  1600. if (bss->anqp) {
  1601. /* Shared data already fetched */
  1602. continue;
  1603. }
  1604. bss->anqp = wpa_bss_anqp_alloc();
  1605. if (bss->anqp == NULL)
  1606. break;
  1607. }
  1608. found++;
  1609. bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
  1610. wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
  1611. MACSTR, MAC2STR(bss->bssid));
  1612. interworking_anqp_send_req(wpa_s, bss);
  1613. break;
  1614. }
  1615. }
  1616. if (found == 0) {
  1617. wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
  1618. wpa_s->fetch_anqp_in_progress = 0;
  1619. if (wpa_s->network_select)
  1620. interworking_select_network(wpa_s);
  1621. }
  1622. }
  1623. void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
  1624. {
  1625. struct wpa_bss *bss;
  1626. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
  1627. bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
  1628. wpa_s->fetch_anqp_in_progress = 1;
  1629. interworking_next_anqp_fetch(wpa_s);
  1630. }
  1631. int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
  1632. {
  1633. if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
  1634. return 0;
  1635. wpa_s->network_select = 0;
  1636. wpa_s->fetch_all_anqp = 1;
  1637. interworking_start_fetch_anqp(wpa_s);
  1638. return 0;
  1639. }
  1640. void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
  1641. {
  1642. if (!wpa_s->fetch_anqp_in_progress)
  1643. return;
  1644. wpa_s->fetch_anqp_in_progress = 0;
  1645. }
  1646. int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
  1647. u16 info_ids[], size_t num_ids)
  1648. {
  1649. struct wpabuf *buf;
  1650. int ret = 0;
  1651. int freq;
  1652. struct wpa_bss *bss;
  1653. int res;
  1654. freq = wpa_s->assoc_freq;
  1655. bss = wpa_bss_get_bssid(wpa_s, dst);
  1656. if (bss) {
  1657. wpa_bss_anqp_unshare_alloc(bss);
  1658. freq = bss->freq;
  1659. }
  1660. if (freq <= 0)
  1661. return -1;
  1662. wpa_printf(MSG_DEBUG, "ANQP: Query Request to " MACSTR " for %u id(s)",
  1663. MAC2STR(dst), (unsigned int) num_ids);
  1664. buf = anqp_build_req(info_ids, num_ids, NULL);
  1665. if (buf == NULL)
  1666. return -1;
  1667. res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
  1668. if (res < 0) {
  1669. wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
  1670. wpabuf_free(buf);
  1671. ret = -1;
  1672. } else
  1673. wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
  1674. "%u", res);
  1675. return ret;
  1676. }
  1677. static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
  1678. struct wpa_bss *bss, const u8 *sa,
  1679. u16 info_id,
  1680. const u8 *data, size_t slen)
  1681. {
  1682. const u8 *pos = data;
  1683. struct wpa_bss_anqp *anqp = NULL;
  1684. #ifdef CONFIG_HS20
  1685. u8 type;
  1686. #endif /* CONFIG_HS20 */
  1687. if (bss)
  1688. anqp = bss->anqp;
  1689. switch (info_id) {
  1690. case ANQP_CAPABILITY_LIST:
  1691. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1692. " ANQP Capability list", MAC2STR(sa));
  1693. break;
  1694. case ANQP_VENUE_NAME:
  1695. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1696. " Venue Name", MAC2STR(sa));
  1697. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
  1698. if (anqp) {
  1699. wpabuf_free(anqp->venue_name);
  1700. anqp->venue_name = wpabuf_alloc_copy(pos, slen);
  1701. }
  1702. break;
  1703. case ANQP_NETWORK_AUTH_TYPE:
  1704. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1705. " Network Authentication Type information",
  1706. MAC2STR(sa));
  1707. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
  1708. "Type", pos, slen);
  1709. if (anqp) {
  1710. wpabuf_free(anqp->network_auth_type);
  1711. anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
  1712. }
  1713. break;
  1714. case ANQP_ROAMING_CONSORTIUM:
  1715. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1716. " Roaming Consortium list", MAC2STR(sa));
  1717. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
  1718. pos, slen);
  1719. if (anqp) {
  1720. wpabuf_free(anqp->roaming_consortium);
  1721. anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
  1722. }
  1723. break;
  1724. case ANQP_IP_ADDR_TYPE_AVAILABILITY:
  1725. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1726. " IP Address Type Availability information",
  1727. MAC2STR(sa));
  1728. wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
  1729. pos, slen);
  1730. if (anqp) {
  1731. wpabuf_free(anqp->ip_addr_type_availability);
  1732. anqp->ip_addr_type_availability =
  1733. wpabuf_alloc_copy(pos, slen);
  1734. }
  1735. break;
  1736. case ANQP_NAI_REALM:
  1737. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1738. " NAI Realm list", MAC2STR(sa));
  1739. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
  1740. if (anqp) {
  1741. wpabuf_free(anqp->nai_realm);
  1742. anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
  1743. }
  1744. break;
  1745. case ANQP_3GPP_CELLULAR_NETWORK:
  1746. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1747. " 3GPP Cellular Network information", MAC2STR(sa));
  1748. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
  1749. pos, slen);
  1750. if (anqp) {
  1751. wpabuf_free(anqp->anqp_3gpp);
  1752. anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
  1753. }
  1754. break;
  1755. case ANQP_DOMAIN_NAME:
  1756. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1757. " Domain Name list", MAC2STR(sa));
  1758. wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
  1759. if (anqp) {
  1760. wpabuf_free(anqp->domain_name);
  1761. anqp->domain_name = wpabuf_alloc_copy(pos, slen);
  1762. }
  1763. break;
  1764. case ANQP_VENDOR_SPECIFIC:
  1765. if (slen < 3)
  1766. return;
  1767. switch (WPA_GET_BE24(pos)) {
  1768. #ifdef CONFIG_HS20
  1769. case OUI_WFA:
  1770. pos += 3;
  1771. slen -= 3;
  1772. if (slen < 1)
  1773. return;
  1774. type = *pos++;
  1775. slen--;
  1776. switch (type) {
  1777. case HS20_ANQP_OUI_TYPE:
  1778. hs20_parse_rx_hs20_anqp_resp(wpa_s, sa, pos,
  1779. slen);
  1780. break;
  1781. default:
  1782. wpa_printf(MSG_DEBUG, "HS20: Unsupported ANQP "
  1783. "vendor type %u", type);
  1784. break;
  1785. }
  1786. break;
  1787. #endif /* CONFIG_HS20 */
  1788. default:
  1789. wpa_printf(MSG_DEBUG, "Interworking: Unsupported "
  1790. "vendor-specific ANQP OUI %06x",
  1791. WPA_GET_BE24(pos));
  1792. return;
  1793. }
  1794. break;
  1795. default:
  1796. wpa_printf(MSG_DEBUG, "Interworking: Unsupported ANQP Info ID "
  1797. "%u", info_id);
  1798. break;
  1799. }
  1800. }
  1801. void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
  1802. enum gas_query_result result,
  1803. const struct wpabuf *adv_proto,
  1804. const struct wpabuf *resp, u16 status_code)
  1805. {
  1806. struct wpa_supplicant *wpa_s = ctx;
  1807. const u8 *pos;
  1808. const u8 *end;
  1809. u16 info_id;
  1810. u16 slen;
  1811. struct wpa_bss *bss = NULL, *tmp;
  1812. if (result != GAS_QUERY_SUCCESS)
  1813. return;
  1814. pos = wpabuf_head(adv_proto);
  1815. if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
  1816. pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
  1817. wpa_printf(MSG_DEBUG, "ANQP: Unexpected Advertisement "
  1818. "Protocol in response");
  1819. return;
  1820. }
  1821. /*
  1822. * If possible, select the BSS entry based on which BSS entry was used
  1823. * for the request. This can help in cases where multiple BSS entries
  1824. * may exist for the same AP.
  1825. */
  1826. dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
  1827. if (tmp == wpa_s->interworking_gas_bss &&
  1828. os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
  1829. bss = tmp;
  1830. break;
  1831. }
  1832. }
  1833. if (bss == NULL)
  1834. bss = wpa_bss_get_bssid(wpa_s, dst);
  1835. pos = wpabuf_head(resp);
  1836. end = pos + wpabuf_len(resp);
  1837. while (pos < end) {
  1838. if (pos + 4 > end) {
  1839. wpa_printf(MSG_DEBUG, "ANQP: Invalid element");
  1840. break;
  1841. }
  1842. info_id = WPA_GET_LE16(pos);
  1843. pos += 2;
  1844. slen = WPA_GET_LE16(pos);
  1845. pos += 2;
  1846. if (pos + slen > end) {
  1847. wpa_printf(MSG_DEBUG, "ANQP: Invalid element length "
  1848. "for Info ID %u", info_id);
  1849. break;
  1850. }
  1851. interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
  1852. slen);
  1853. pos += slen;
  1854. }
  1855. }
  1856. static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
  1857. struct wpa_scan_results *scan_res)
  1858. {
  1859. wpa_printf(MSG_DEBUG, "Interworking: Scan results available - start "
  1860. "ANQP fetch");
  1861. interworking_start_fetch_anqp(wpa_s);
  1862. }
  1863. int interworking_select(struct wpa_supplicant *wpa_s, int auto_select,
  1864. int *freqs)
  1865. {
  1866. interworking_stop_fetch_anqp(wpa_s);
  1867. wpa_s->network_select = 1;
  1868. wpa_s->auto_network_select = 0;
  1869. wpa_s->auto_select = !!auto_select;
  1870. wpa_s->fetch_all_anqp = 0;
  1871. wpa_printf(MSG_DEBUG, "Interworking: Start scan for network "
  1872. "selection");
  1873. wpa_s->scan_res_handler = interworking_scan_res_handler;
  1874. wpa_s->normal_scans = 0;
  1875. wpa_s->scan_req = MANUAL_SCAN_REQ;
  1876. os_free(wpa_s->manual_scan_freqs);
  1877. wpa_s->manual_scan_freqs = freqs;
  1878. wpa_s->after_wps = 0;
  1879. wpa_s->known_wps_freq = 0;
  1880. wpa_supplicant_req_scan(wpa_s, 0, 0);
  1881. return 0;
  1882. }
  1883. static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
  1884. enum gas_query_result result,
  1885. const struct wpabuf *adv_proto,
  1886. const struct wpabuf *resp, u16 status_code)
  1887. {
  1888. struct wpa_supplicant *wpa_s = ctx;
  1889. struct wpabuf *n;
  1890. wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
  1891. " dialog_token=%d status_code=%d resp_len=%d",
  1892. MAC2STR(addr), dialog_token, status_code,
  1893. resp ? (int) wpabuf_len(resp) : -1);
  1894. if (!resp)
  1895. return;
  1896. n = wpabuf_dup(resp);
  1897. if (n == NULL)
  1898. return;
  1899. wpabuf_free(wpa_s->prev_gas_resp);
  1900. wpa_s->prev_gas_resp = wpa_s->last_gas_resp;
  1901. os_memcpy(wpa_s->prev_gas_addr, wpa_s->last_gas_addr, ETH_ALEN);
  1902. wpa_s->prev_gas_dialog_token = wpa_s->last_gas_dialog_token;
  1903. wpa_s->last_gas_resp = n;
  1904. os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
  1905. wpa_s->last_gas_dialog_token = dialog_token;
  1906. }
  1907. int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
  1908. const struct wpabuf *adv_proto,
  1909. const struct wpabuf *query)
  1910. {
  1911. struct wpabuf *buf;
  1912. int ret = 0;
  1913. int freq;
  1914. struct wpa_bss *bss;
  1915. int res;
  1916. size_t len;
  1917. u8 query_resp_len_limit = 0, pame_bi = 0;
  1918. freq = wpa_s->assoc_freq;
  1919. bss = wpa_bss_get_bssid(wpa_s, dst);
  1920. if (bss)
  1921. freq = bss->freq;
  1922. if (freq <= 0)
  1923. return -1;
  1924. wpa_printf(MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
  1925. MAC2STR(dst), freq);
  1926. wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
  1927. wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
  1928. len = 3 + wpabuf_len(adv_proto) + 2;
  1929. if (query)
  1930. len += wpabuf_len(query);
  1931. buf = gas_build_initial_req(0, len);
  1932. if (buf == NULL)
  1933. return -1;
  1934. /* Advertisement Protocol IE */
  1935. wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
  1936. wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
  1937. wpabuf_put_u8(buf, (query_resp_len_limit & 0x7f) |
  1938. (pame_bi ? 0x80 : 0));
  1939. wpabuf_put_buf(buf, adv_proto);
  1940. /* GAS Query */
  1941. if (query) {
  1942. wpabuf_put_le16(buf, wpabuf_len(query));
  1943. wpabuf_put_buf(buf, query);
  1944. } else
  1945. wpabuf_put_le16(buf, 0);
  1946. res = gas_query_req(wpa_s->gas, dst, freq, buf, gas_resp_cb, wpa_s);
  1947. if (res < 0) {
  1948. wpa_printf(MSG_DEBUG, "GAS: Failed to send Query Request");
  1949. wpabuf_free(buf);
  1950. ret = -1;
  1951. } else
  1952. wpa_printf(MSG_DEBUG, "GAS: Query started with dialog token "
  1953. "%u", res);
  1954. return ret;
  1955. }