wnm_sta.c 45 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702
  1. /*
  2. * wpa_supplicant - WNM
  3. * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
  4. *
  5. * This software may be distributed under the terms of the BSD license.
  6. * See README for more details.
  7. */
  8. #include "utils/includes.h"
  9. #include "utils/common.h"
  10. #include "common/ieee802_11_defs.h"
  11. #include "common/ieee802_11_common.h"
  12. #include "common/wpa_ctrl.h"
  13. #include "rsn_supp/wpa.h"
  14. #include "config.h"
  15. #include "wpa_supplicant_i.h"
  16. #include "driver_i.h"
  17. #include "scan.h"
  18. #include "ctrl_iface.h"
  19. #include "bss.h"
  20. #include "wnm_sta.h"
  21. #include "hs20_supplicant.h"
  22. #define MAX_TFS_IE_LEN 1024
  23. #define WNM_MAX_NEIGHBOR_REPORT 10
  24. #define WNM_SCAN_RESULT_AGE 2 /* 2 seconds */
  25. /* get the TFS IE from driver */
  26. static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf,
  27. u16 *buf_len, enum wnm_oper oper)
  28. {
  29. wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper);
  30. return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len);
  31. }
  32. /* set the TFS IE to driver */
  33. static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s,
  34. const u8 *addr, const u8 *buf, u16 buf_len,
  35. enum wnm_oper oper)
  36. {
  37. u16 len = buf_len;
  38. wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper);
  39. return wpa_drv_wnm_oper(wpa_s, oper, addr, (u8 *) buf, &len);
  40. }
  41. /* MLME-SLEEPMODE.request */
  42. int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s,
  43. u8 action, u16 intval, struct wpabuf *tfs_req)
  44. {
  45. struct ieee80211_mgmt *mgmt;
  46. int res;
  47. size_t len;
  48. struct wnm_sleep_element *wnmsleep_ie;
  49. u8 *wnmtfs_ie;
  50. u8 wnmsleep_ie_len;
  51. u16 wnmtfs_ie_len; /* possibly multiple IE(s) */
  52. enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD :
  53. WNM_SLEEP_TFS_REQ_IE_NONE;
  54. wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request "
  55. "action=%s to " MACSTR,
  56. action == 0 ? "enter" : "exit",
  57. MAC2STR(wpa_s->bssid));
  58. /* WNM-Sleep Mode IE */
  59. wnmsleep_ie_len = sizeof(struct wnm_sleep_element);
  60. wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element));
  61. if (wnmsleep_ie == NULL)
  62. return -1;
  63. wnmsleep_ie->eid = WLAN_EID_WNMSLEEP;
  64. wnmsleep_ie->len = wnmsleep_ie_len - 2;
  65. wnmsleep_ie->action_type = action;
  66. wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT;
  67. wnmsleep_ie->intval = host_to_le16(intval);
  68. wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element",
  69. (u8 *) wnmsleep_ie, wnmsleep_ie_len);
  70. /* TFS IE(s) */
  71. if (tfs_req) {
  72. wnmtfs_ie_len = wpabuf_len(tfs_req);
  73. wnmtfs_ie = os_malloc(wnmtfs_ie_len);
  74. if (wnmtfs_ie == NULL) {
  75. os_free(wnmsleep_ie);
  76. return -1;
  77. }
  78. os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len);
  79. } else {
  80. wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN);
  81. if (wnmtfs_ie == NULL) {
  82. os_free(wnmsleep_ie);
  83. return -1;
  84. }
  85. if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len,
  86. tfs_oper)) {
  87. wnmtfs_ie_len = 0;
  88. os_free(wnmtfs_ie);
  89. wnmtfs_ie = NULL;
  90. }
  91. }
  92. wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element",
  93. (u8 *) wnmtfs_ie, wnmtfs_ie_len);
  94. mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len);
  95. if (mgmt == NULL) {
  96. wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
  97. "WNM-Sleep Request action frame");
  98. os_free(wnmsleep_ie);
  99. os_free(wnmtfs_ie);
  100. return -1;
  101. }
  102. os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
  103. os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
  104. os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
  105. mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
  106. WLAN_FC_STYPE_ACTION);
  107. mgmt->u.action.category = WLAN_ACTION_WNM;
  108. mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ;
  109. mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1;
  110. os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie,
  111. wnmsleep_ie_len);
  112. /* copy TFS IE here */
  113. if (wnmtfs_ie_len > 0) {
  114. os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable +
  115. wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len);
  116. }
  117. len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len +
  118. wnmtfs_ie_len;
  119. res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
  120. wpa_s->own_addr, wpa_s->bssid,
  121. &mgmt->u.action.category, len, 0);
  122. if (res < 0)
  123. wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request "
  124. "(action=%d, intval=%d)", action, intval);
  125. else
  126. wpa_s->wnmsleep_used = 1;
  127. os_free(wnmsleep_ie);
  128. os_free(wnmtfs_ie);
  129. os_free(mgmt);
  130. return res;
  131. }
  132. static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s,
  133. const u8 *tfsresp_ie_start,
  134. const u8 *tfsresp_ie_end)
  135. {
  136. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM,
  137. wpa_s->bssid, NULL, NULL);
  138. /* remove GTK/IGTK ?? */
  139. /* set the TFS Resp IE(s) */
  140. if (tfsresp_ie_start && tfsresp_ie_end &&
  141. tfsresp_ie_end - tfsresp_ie_start >= 0) {
  142. u16 tfsresp_ie_len;
  143. tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) -
  144. tfsresp_ie_start;
  145. wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found");
  146. /* pass the TFS Resp IE(s) to driver for processing */
  147. if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid,
  148. tfsresp_ie_start,
  149. tfsresp_ie_len,
  150. WNM_SLEEP_TFS_RESP_IE_SET))
  151. wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE");
  152. }
  153. }
  154. static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
  155. const u8 *frm, u16 key_len_total)
  156. {
  157. u8 *ptr, *end;
  158. u8 gtk_len;
  159. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM, wpa_s->bssid,
  160. NULL, NULL);
  161. /* Install GTK/IGTK */
  162. /* point to key data field */
  163. ptr = (u8 *) frm + 1 + 2;
  164. end = ptr + key_len_total;
  165. wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
  166. if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) {
  167. wpa_msg(wpa_s, MSG_INFO,
  168. "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled");
  169. return;
  170. }
  171. while (end - ptr > 1) {
  172. if (2 + ptr[1] > end - ptr) {
  173. wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
  174. "length");
  175. if (end > ptr) {
  176. wpa_hexdump(MSG_DEBUG, "WNM: Remaining data",
  177. ptr, end - ptr);
  178. }
  179. break;
  180. }
  181. if (*ptr == WNM_SLEEP_SUBELEM_GTK) {
  182. if (ptr[1] < 11 + 5) {
  183. wpa_printf(MSG_DEBUG, "WNM: Too short GTK "
  184. "subelem");
  185. break;
  186. }
  187. gtk_len = *(ptr + 4);
  188. if (ptr[1] < 11 + gtk_len ||
  189. gtk_len < 5 || gtk_len > 32) {
  190. wpa_printf(MSG_DEBUG, "WNM: Invalid GTK "
  191. "subelem");
  192. break;
  193. }
  194. wpa_wnmsleep_install_key(
  195. wpa_s->wpa,
  196. WNM_SLEEP_SUBELEM_GTK,
  197. ptr);
  198. ptr += 13 + gtk_len;
  199. #ifdef CONFIG_IEEE80211W
  200. } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) {
  201. if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) {
  202. wpa_printf(MSG_DEBUG, "WNM: Too short IGTK "
  203. "subelem");
  204. break;
  205. }
  206. wpa_wnmsleep_install_key(wpa_s->wpa,
  207. WNM_SLEEP_SUBELEM_IGTK, ptr);
  208. ptr += 10 + WPA_IGTK_LEN;
  209. #endif /* CONFIG_IEEE80211W */
  210. } else
  211. break; /* skip the loop */
  212. }
  213. }
  214. static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
  215. const u8 *frm, int len)
  216. {
  217. /*
  218. * Action [1] | Dialog Token [1] | Key Data Len [2] | Key Data |
  219. * WNM-Sleep Mode IE | TFS Response IE
  220. */
  221. const u8 *pos = frm; /* point to payload after the action field */
  222. u16 key_len_total;
  223. struct wnm_sleep_element *wnmsleep_ie = NULL;
  224. /* multiple TFS Resp IE (assuming consecutive) */
  225. const u8 *tfsresp_ie_start = NULL;
  226. const u8 *tfsresp_ie_end = NULL;
  227. size_t left;
  228. if (!wpa_s->wnmsleep_used) {
  229. wpa_printf(MSG_DEBUG,
  230. "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
  231. return;
  232. }
  233. if (len < 3)
  234. return;
  235. key_len_total = WPA_GET_LE16(frm + 1);
  236. wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d",
  237. frm[0], key_len_total);
  238. left = len - 3;
  239. if (key_len_total > left) {
  240. wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
  241. return;
  242. }
  243. pos += 3 + key_len_total;
  244. while (pos - frm + 1 < len) {
  245. u8 ie_len = *(pos + 1);
  246. if (2 + ie_len > frm + len - pos) {
  247. wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len);
  248. break;
  249. }
  250. wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len);
  251. if (*pos == WLAN_EID_WNMSLEEP && ie_len >= 4)
  252. wnmsleep_ie = (struct wnm_sleep_element *) pos;
  253. else if (*pos == WLAN_EID_TFS_RESP) {
  254. if (!tfsresp_ie_start)
  255. tfsresp_ie_start = pos;
  256. tfsresp_ie_end = pos;
  257. } else
  258. wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
  259. pos += ie_len + 2;
  260. }
  261. if (!wnmsleep_ie) {
  262. wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
  263. return;
  264. }
  265. if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
  266. wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
  267. wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
  268. "frame (action=%d, intval=%d)",
  269. wnmsleep_ie->action_type, wnmsleep_ie->intval);
  270. if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
  271. wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
  272. tfsresp_ie_end);
  273. } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
  274. wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
  275. }
  276. } else {
  277. wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "
  278. "(action=%d, intval=%d)",
  279. wnmsleep_ie->action_type, wnmsleep_ie->intval);
  280. if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER)
  281. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL,
  282. wpa_s->bssid, NULL, NULL);
  283. else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT)
  284. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL,
  285. wpa_s->bssid, NULL, NULL);
  286. }
  287. }
  288. void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
  289. {
  290. int i;
  291. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
  292. os_free(wpa_s->wnm_neighbor_report_elements[i].meas_pilot);
  293. os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
  294. }
  295. wpa_s->wnm_num_neighbor_report = 0;
  296. os_free(wpa_s->wnm_neighbor_report_elements);
  297. wpa_s->wnm_neighbor_report_elements = NULL;
  298. }
  299. static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
  300. u8 id, u8 elen, const u8 *pos)
  301. {
  302. switch (id) {
  303. case WNM_NEIGHBOR_TSF:
  304. if (elen < 2 + 2) {
  305. wpa_printf(MSG_DEBUG, "WNM: Too short TSF");
  306. break;
  307. }
  308. rep->tsf_offset = WPA_GET_LE16(pos);
  309. rep->beacon_int = WPA_GET_LE16(pos + 2);
  310. rep->tsf_present = 1;
  311. break;
  312. case WNM_NEIGHBOR_CONDENSED_COUNTRY_STRING:
  313. if (elen < 2) {
  314. wpa_printf(MSG_DEBUG, "WNM: Too short condensed "
  315. "country string");
  316. break;
  317. }
  318. os_memcpy(rep->country, pos, 2);
  319. rep->country_present = 1;
  320. break;
  321. case WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE:
  322. if (elen < 1) {
  323. wpa_printf(MSG_DEBUG, "WNM: Too short BSS transition "
  324. "candidate");
  325. break;
  326. }
  327. rep->preference = pos[0];
  328. rep->preference_present = 1;
  329. break;
  330. case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
  331. rep->bss_term_tsf = WPA_GET_LE64(pos);
  332. rep->bss_term_dur = WPA_GET_LE16(pos + 8);
  333. rep->bss_term_present = 1;
  334. break;
  335. case WNM_NEIGHBOR_BEARING:
  336. if (elen < 8) {
  337. wpa_printf(MSG_DEBUG, "WNM: Too short neighbor "
  338. "bearing");
  339. break;
  340. }
  341. rep->bearing = WPA_GET_LE16(pos);
  342. rep->distance = WPA_GET_LE32(pos + 2);
  343. rep->rel_height = WPA_GET_LE16(pos + 2 + 4);
  344. rep->bearing_present = 1;
  345. break;
  346. case WNM_NEIGHBOR_MEASUREMENT_PILOT:
  347. if (elen < 1) {
  348. wpa_printf(MSG_DEBUG, "WNM: Too short measurement "
  349. "pilot");
  350. break;
  351. }
  352. os_free(rep->meas_pilot);
  353. rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot));
  354. if (rep->meas_pilot == NULL)
  355. break;
  356. rep->meas_pilot->measurement_pilot = pos[0];
  357. rep->meas_pilot->subelem_len = elen - 1;
  358. os_memcpy(rep->meas_pilot->subelems, pos + 1, elen - 1);
  359. break;
  360. case WNM_NEIGHBOR_RRM_ENABLED_CAPABILITIES:
  361. if (elen < 5) {
  362. wpa_printf(MSG_DEBUG, "WNM: Too short RRM enabled "
  363. "capabilities");
  364. break;
  365. }
  366. os_memcpy(rep->rm_capab, pos, 5);
  367. rep->rm_capab_present = 1;
  368. break;
  369. case WNM_NEIGHBOR_MULTIPLE_BSSID:
  370. if (elen < 1) {
  371. wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID");
  372. break;
  373. }
  374. os_free(rep->mul_bssid);
  375. rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid));
  376. if (rep->mul_bssid == NULL)
  377. break;
  378. rep->mul_bssid->max_bssid_indicator = pos[0];
  379. rep->mul_bssid->subelem_len = elen - 1;
  380. os_memcpy(rep->mul_bssid->subelems, pos + 1, elen - 1);
  381. break;
  382. }
  383. }
  384. static int wnm_nei_get_chan(struct wpa_supplicant *wpa_s, u8 op_class, u8 chan)
  385. {
  386. struct wpa_bss *bss = wpa_s->current_bss;
  387. const char *country = NULL;
  388. int freq;
  389. if (bss) {
  390. const u8 *elem = wpa_bss_get_ie(bss, WLAN_EID_COUNTRY);
  391. if (elem && elem[1] >= 2)
  392. country = (const char *) (elem + 2);
  393. }
  394. freq = ieee80211_chan_to_freq(country, op_class, chan);
  395. if (freq <= 0 && op_class == 0) {
  396. /*
  397. * Some APs do not advertise correct operating class
  398. * information. Try to determine the most likely operating
  399. * frequency based on the channel number.
  400. */
  401. if (chan >= 1 && chan <= 13)
  402. freq = 2407 + chan * 5;
  403. else if (chan == 14)
  404. freq = 2484;
  405. else if (chan >= 36 && chan <= 169)
  406. freq = 5000 + chan * 5;
  407. }
  408. return freq;
  409. }
  410. static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s,
  411. const u8 *pos, u8 len,
  412. struct neighbor_report *rep)
  413. {
  414. u8 left = len;
  415. if (left < 13) {
  416. wpa_printf(MSG_DEBUG, "WNM: Too short neighbor report");
  417. return;
  418. }
  419. os_memcpy(rep->bssid, pos, ETH_ALEN);
  420. rep->bssid_info = WPA_GET_LE32(pos + ETH_ALEN);
  421. rep->regulatory_class = *(pos + 10);
  422. rep->channel_number = *(pos + 11);
  423. rep->phy_type = *(pos + 12);
  424. pos += 13;
  425. left -= 13;
  426. while (left >= 2) {
  427. u8 id, elen;
  428. id = *pos++;
  429. elen = *pos++;
  430. wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen);
  431. left -= 2;
  432. if (elen > left) {
  433. wpa_printf(MSG_DEBUG,
  434. "WNM: Truncated neighbor report subelement");
  435. break;
  436. }
  437. wnm_parse_neighbor_report_elem(rep, id, elen, pos);
  438. left -= elen;
  439. pos += elen;
  440. }
  441. rep->freq = wnm_nei_get_chan(wpa_s, rep->regulatory_class,
  442. rep->channel_number);
  443. }
  444. static void wnm_clear_acceptable(struct wpa_supplicant *wpa_s)
  445. {
  446. unsigned int i;
  447. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++)
  448. wpa_s->wnm_neighbor_report_elements[i].acceptable = 0;
  449. }
  450. static struct wpa_bss * get_first_acceptable(struct wpa_supplicant *wpa_s)
  451. {
  452. unsigned int i;
  453. struct neighbor_report *nei;
  454. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
  455. nei = &wpa_s->wnm_neighbor_report_elements[i];
  456. if (nei->acceptable)
  457. return wpa_bss_get_bssid(wpa_s, nei->bssid);
  458. }
  459. return NULL;
  460. }
  461. #ifdef CONFIG_MBO
  462. static struct wpa_bss *
  463. get_mbo_transition_candidate(struct wpa_supplicant *wpa_s,
  464. enum mbo_transition_reject_reason *reason)
  465. {
  466. struct wpa_bss *target = NULL;
  467. struct wpa_bss_trans_info params;
  468. struct wpa_bss_candidate_info *info = NULL;
  469. struct neighbor_report *nei = wpa_s->wnm_neighbor_report_elements;
  470. u8 *first_candidate_bssid = NULL, *pos;
  471. unsigned int i;
  472. params.mbo_transition_reason = wpa_s->wnm_mbo_transition_reason;
  473. params.n_candidates = 0;
  474. params.bssid = os_calloc(wpa_s->wnm_num_neighbor_report, ETH_ALEN);
  475. if (!params.bssid)
  476. return NULL;
  477. pos = params.bssid;
  478. for (i = 0; i < wpa_s->wnm_num_neighbor_report; nei++, i++) {
  479. if (nei->is_first)
  480. first_candidate_bssid = nei->bssid;
  481. if (!nei->acceptable)
  482. continue;
  483. os_memcpy(pos, nei->bssid, ETH_ALEN);
  484. pos += ETH_ALEN;
  485. params.n_candidates++;
  486. }
  487. if (!params.n_candidates)
  488. goto end;
  489. info = wpa_drv_get_bss_trans_status(wpa_s, &params);
  490. if (!info) {
  491. /* If failed to get candidate BSS transition status from driver,
  492. * get the first acceptable candidate from wpa_supplicant.
  493. */
  494. target = wpa_bss_get_bssid(wpa_s, params.bssid);
  495. goto end;
  496. }
  497. /* Get the first acceptable candidate from driver */
  498. for (i = 0; i < info->num; i++) {
  499. if (info->candidates[i].is_accept) {
  500. target = wpa_bss_get_bssid(wpa_s,
  501. info->candidates[i].bssid);
  502. goto end;
  503. }
  504. }
  505. /* If Disassociation Imminent is set and driver rejects all the
  506. * candidate select first acceptable candidate which has
  507. * rssi > disassoc_imminent_rssi_threshold
  508. */
  509. if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
  510. for (i = 0; i < info->num; i++) {
  511. target = wpa_bss_get_bssid(wpa_s,
  512. info->candidates[i].bssid);
  513. if (target->level <
  514. wpa_s->conf->disassoc_imminent_rssi_threshold)
  515. continue;
  516. goto end;
  517. }
  518. }
  519. /* While sending BTM reject use reason code of the first candidate
  520. * received in BTM request frame
  521. */
  522. if (reason) {
  523. for (i = 0; i < info->num; i++) {
  524. if (first_candidate_bssid &&
  525. os_memcmp(first_candidate_bssid,
  526. info->candidates[i].bssid, ETH_ALEN) == 0)
  527. {
  528. *reason = info->candidates[i].reject_reason;
  529. break;
  530. }
  531. }
  532. }
  533. target = NULL;
  534. end:
  535. os_free(params.bssid);
  536. if (info) {
  537. os_free(info->candidates);
  538. os_free(info);
  539. }
  540. return target;
  541. }
  542. #endif /* CONFIG_MBO */
  543. static struct wpa_bss *
  544. compare_scan_neighbor_results(struct wpa_supplicant *wpa_s, os_time_t age_secs,
  545. enum mbo_transition_reject_reason *reason)
  546. {
  547. u8 i;
  548. struct wpa_bss *bss = wpa_s->current_bss;
  549. struct wpa_bss *target;
  550. if (!bss)
  551. return NULL;
  552. wpa_printf(MSG_DEBUG, "WNM: Current BSS " MACSTR " RSSI %d",
  553. MAC2STR(wpa_s->bssid), bss->level);
  554. wnm_clear_acceptable(wpa_s);
  555. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
  556. struct neighbor_report *nei;
  557. nei = &wpa_s->wnm_neighbor_report_elements[i];
  558. if (nei->preference_present && nei->preference == 0) {
  559. wpa_printf(MSG_DEBUG, "Skip excluded BSS " MACSTR,
  560. MAC2STR(nei->bssid));
  561. continue;
  562. }
  563. target = wpa_bss_get_bssid(wpa_s, nei->bssid);
  564. if (!target) {
  565. wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
  566. " (pref %d) not found in scan results",
  567. MAC2STR(nei->bssid),
  568. nei->preference_present ? nei->preference :
  569. -1);
  570. continue;
  571. }
  572. if (age_secs) {
  573. struct os_reltime now;
  574. if (os_get_reltime(&now) == 0 &&
  575. os_reltime_expired(&now, &target->last_update,
  576. age_secs)) {
  577. wpa_printf(MSG_DEBUG,
  578. "Candidate BSS is more than %ld seconds old",
  579. age_secs);
  580. continue;
  581. }
  582. }
  583. if (bss->ssid_len != target->ssid_len ||
  584. os_memcmp(bss->ssid, target->ssid, bss->ssid_len) != 0) {
  585. /*
  586. * TODO: Could consider allowing transition to another
  587. * ESS if PMF was enabled for the association.
  588. */
  589. wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
  590. " (pref %d) in different ESS",
  591. MAC2STR(nei->bssid),
  592. nei->preference_present ? nei->preference :
  593. -1);
  594. continue;
  595. }
  596. if (wpa_s->current_ssid &&
  597. !wpa_scan_res_match(wpa_s, 0, target, wpa_s->current_ssid,
  598. 1, 0)) {
  599. wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
  600. " (pref %d) does not match the current network profile",
  601. MAC2STR(nei->bssid),
  602. nei->preference_present ? nei->preference :
  603. -1);
  604. continue;
  605. }
  606. if (wpa_is_bss_tmp_disallowed(wpa_s, target->bssid)) {
  607. wpa_printf(MSG_DEBUG,
  608. "MBO: Candidate BSS " MACSTR
  609. " retry delay is not over yet",
  610. MAC2STR(nei->bssid));
  611. continue;
  612. }
  613. if (target->level < bss->level && target->level < -80) {
  614. wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
  615. " (pref %d) does not have sufficient signal level (%d)",
  616. MAC2STR(nei->bssid),
  617. nei->preference_present ? nei->preference :
  618. -1,
  619. target->level);
  620. continue;
  621. }
  622. nei->acceptable = 1;
  623. }
  624. #ifdef CONFIG_MBO
  625. if (wpa_s->wnm_mbo_trans_reason_present)
  626. target = get_mbo_transition_candidate(wpa_s, reason);
  627. else
  628. target = get_first_acceptable(wpa_s);
  629. #else /* CONFIG_MBO */
  630. target = get_first_acceptable(wpa_s);
  631. #endif /* CONFIG_MBO */
  632. if (target) {
  633. wpa_printf(MSG_DEBUG,
  634. "WNM: Found an acceptable preferred transition candidate BSS "
  635. MACSTR " (RSSI %d)",
  636. MAC2STR(target->bssid), target->level);
  637. }
  638. return target;
  639. }
  640. static int wpa_bss_ies_eq(struct wpa_bss *a, struct wpa_bss *b, u8 eid)
  641. {
  642. const u8 *ie_a, *ie_b;
  643. if (!a || !b)
  644. return 0;
  645. ie_a = wpa_bss_get_ie(a, eid);
  646. ie_b = wpa_bss_get_ie(b, eid);
  647. if (!ie_a || !ie_b || ie_a[1] != ie_b[1])
  648. return 0;
  649. return os_memcmp(ie_a, ie_b, ie_a[1]) == 0;
  650. }
  651. static u32 wnm_get_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  652. {
  653. u32 info = 0;
  654. info |= NEI_REP_BSSID_INFO_AP_UNKNOWN_REACH;
  655. /*
  656. * Leave the security and key scope bits unset to indicate that the
  657. * security information is not available.
  658. */
  659. if (bss->caps & WLAN_CAPABILITY_SPECTRUM_MGMT)
  660. info |= NEI_REP_BSSID_INFO_SPECTRUM_MGMT;
  661. if (bss->caps & WLAN_CAPABILITY_QOS)
  662. info |= NEI_REP_BSSID_INFO_QOS;
  663. if (bss->caps & WLAN_CAPABILITY_APSD)
  664. info |= NEI_REP_BSSID_INFO_APSD;
  665. if (bss->caps & WLAN_CAPABILITY_RADIO_MEASUREMENT)
  666. info |= NEI_REP_BSSID_INFO_RM;
  667. if (bss->caps & WLAN_CAPABILITY_DELAYED_BLOCK_ACK)
  668. info |= NEI_REP_BSSID_INFO_DELAYED_BA;
  669. if (bss->caps & WLAN_CAPABILITY_IMM_BLOCK_ACK)
  670. info |= NEI_REP_BSSID_INFO_IMM_BA;
  671. if (wpa_bss_ies_eq(bss, wpa_s->current_bss, WLAN_EID_MOBILITY_DOMAIN))
  672. info |= NEI_REP_BSSID_INFO_MOBILITY_DOMAIN;
  673. if (wpa_bss_ies_eq(bss, wpa_s->current_bss, WLAN_EID_HT_CAP))
  674. info |= NEI_REP_BSSID_INFO_HT;
  675. return info;
  676. }
  677. static int wnm_add_nei_rep(u8 *buf, size_t len, const u8 *bssid, u32 bss_info,
  678. u8 op_class, u8 chan, u8 phy_type, u8 pref)
  679. {
  680. u8 *pos = buf;
  681. if (len < 18) {
  682. wpa_printf(MSG_DEBUG,
  683. "WNM: Not enough room for Neighbor Report element");
  684. return -1;
  685. }
  686. *pos++ = WLAN_EID_NEIGHBOR_REPORT;
  687. /* length: 13 for basic neighbor report + 3 for preference subelement */
  688. *pos++ = 16;
  689. os_memcpy(pos, bssid, ETH_ALEN);
  690. pos += ETH_ALEN;
  691. WPA_PUT_LE32(pos, bss_info);
  692. pos += 4;
  693. *pos++ = op_class;
  694. *pos++ = chan;
  695. *pos++ = phy_type;
  696. *pos++ = WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE;
  697. *pos++ = 1;
  698. *pos++ = pref;
  699. return pos - buf;
  700. }
  701. static int wnm_nei_rep_add_bss(struct wpa_supplicant *wpa_s,
  702. struct wpa_bss *bss, u8 *buf, size_t len,
  703. u8 pref)
  704. {
  705. const u8 *ie;
  706. u8 op_class, chan;
  707. int sec_chan = 0, vht = 0;
  708. enum phy_type phy_type;
  709. u32 info;
  710. struct ieee80211_ht_operation *ht_oper = NULL;
  711. struct ieee80211_vht_operation *vht_oper = NULL;
  712. ie = wpa_bss_get_ie(bss, WLAN_EID_HT_OPERATION);
  713. if (ie && ie[1] >= 2) {
  714. ht_oper = (struct ieee80211_ht_operation *) (ie + 2);
  715. if (ht_oper->ht_param & HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
  716. sec_chan = 1;
  717. else if (ht_oper->ht_param &
  718. HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
  719. sec_chan = -1;
  720. }
  721. ie = wpa_bss_get_ie(bss, WLAN_EID_VHT_OPERATION);
  722. if (ie && ie[1] >= 1) {
  723. vht_oper = (struct ieee80211_vht_operation *) (ie + 2);
  724. if (vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_80MHZ ||
  725. vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_160MHZ ||
  726. vht_oper->vht_op_info_chwidth == VHT_CHANWIDTH_80P80MHZ)
  727. vht = vht_oper->vht_op_info_chwidth;
  728. }
  729. if (ieee80211_freq_to_channel_ext(bss->freq, sec_chan, vht, &op_class,
  730. &chan) == NUM_HOSTAPD_MODES) {
  731. wpa_printf(MSG_DEBUG,
  732. "WNM: Cannot determine operating class and channel");
  733. return -2;
  734. }
  735. phy_type = ieee80211_get_phy_type(bss->freq, (ht_oper != NULL),
  736. (vht_oper != NULL));
  737. if (phy_type == PHY_TYPE_UNSPECIFIED) {
  738. wpa_printf(MSG_DEBUG,
  739. "WNM: Cannot determine BSS phy type for Neighbor Report");
  740. return -2;
  741. }
  742. info = wnm_get_bss_info(wpa_s, bss);
  743. return wnm_add_nei_rep(buf, len, bss->bssid, info, op_class, chan,
  744. phy_type, pref);
  745. }
  746. static int wnm_add_cand_list(struct wpa_supplicant *wpa_s, u8 *buf, size_t len)
  747. {
  748. u8 *pos = buf;
  749. unsigned int i, pref = 255;
  750. struct os_reltime now;
  751. struct wpa_ssid *ssid = wpa_s->current_ssid;
  752. if (!ssid)
  753. return 0;
  754. /*
  755. * TODO: Define when scan results are no longer valid for the candidate
  756. * list.
  757. */
  758. os_get_reltime(&now);
  759. if (os_reltime_expired(&now, &wpa_s->last_scan, 10))
  760. return 0;
  761. wpa_printf(MSG_DEBUG,
  762. "WNM: Add candidate list to BSS Transition Management Response frame");
  763. for (i = 0; i < wpa_s->last_scan_res_used && pref; i++) {
  764. struct wpa_bss *bss = wpa_s->last_scan_res[i];
  765. int res;
  766. if (wpa_scan_res_match(wpa_s, i, bss, ssid, 1, 0)) {
  767. res = wnm_nei_rep_add_bss(wpa_s, bss, pos, len, pref--);
  768. if (res == -2)
  769. continue; /* could not build entry for BSS */
  770. if (res < 0)
  771. break; /* no more room for candidates */
  772. if (pref == 1)
  773. break;
  774. pos += res;
  775. len -= res;
  776. }
  777. }
  778. wpa_hexdump(MSG_DEBUG,
  779. "WNM: BSS Transition Management Response candidate list",
  780. buf, pos - buf);
  781. return pos - buf;
  782. }
  783. static void wnm_send_bss_transition_mgmt_resp(
  784. struct wpa_supplicant *wpa_s, u8 dialog_token,
  785. enum bss_trans_mgmt_status_code status,
  786. enum mbo_transition_reject_reason reason,
  787. u8 delay, const u8 *target_bssid)
  788. {
  789. u8 buf[2000], *pos;
  790. struct ieee80211_mgmt *mgmt;
  791. size_t len;
  792. int res;
  793. wpa_printf(MSG_DEBUG,
  794. "WNM: Send BSS Transition Management Response to " MACSTR
  795. " dialog_token=%u status=%u reason=%u delay=%d",
  796. MAC2STR(wpa_s->bssid), dialog_token, status, reason, delay);
  797. if (!wpa_s->current_bss) {
  798. wpa_printf(MSG_DEBUG,
  799. "WNM: Current BSS not known - drop response");
  800. return;
  801. }
  802. mgmt = (struct ieee80211_mgmt *) buf;
  803. os_memset(&buf, 0, sizeof(buf));
  804. os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
  805. os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
  806. os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
  807. mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
  808. WLAN_FC_STYPE_ACTION);
  809. mgmt->u.action.category = WLAN_ACTION_WNM;
  810. mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP;
  811. mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token;
  812. mgmt->u.action.u.bss_tm_resp.status_code = status;
  813. mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay;
  814. pos = mgmt->u.action.u.bss_tm_resp.variable;
  815. if (target_bssid) {
  816. os_memcpy(pos, target_bssid, ETH_ALEN);
  817. pos += ETH_ALEN;
  818. } else if (status == WNM_BSS_TM_ACCEPT) {
  819. /*
  820. * P802.11-REVmc clarifies that the Target BSSID field is always
  821. * present when status code is zero, so use a fake value here if
  822. * no BSSID is yet known.
  823. */
  824. os_memset(pos, 0, ETH_ALEN);
  825. pos += ETH_ALEN;
  826. }
  827. if (status == WNM_BSS_TM_ACCEPT)
  828. pos += wnm_add_cand_list(wpa_s, pos, buf + sizeof(buf) - pos);
  829. #ifdef CONFIG_MBO
  830. if (status != WNM_BSS_TM_ACCEPT &&
  831. wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE)) {
  832. pos += wpas_mbo_ie_bss_trans_reject(
  833. wpa_s, pos, buf + sizeof(buf) - pos, reason);
  834. }
  835. #endif /* CONFIG_MBO */
  836. len = pos - (u8 *) &mgmt->u.action.category;
  837. res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
  838. wpa_s->own_addr, wpa_s->bssid,
  839. &mgmt->u.action.category, len, 0);
  840. if (res < 0) {
  841. wpa_printf(MSG_DEBUG,
  842. "WNM: Failed to send BSS Transition Management Response");
  843. }
  844. }
  845. static void wnm_bss_tm_connect(struct wpa_supplicant *wpa_s,
  846. struct wpa_bss *bss, struct wpa_ssid *ssid,
  847. int after_new_scan)
  848. {
  849. wpa_dbg(wpa_s, MSG_DEBUG,
  850. "WNM: Transition to BSS " MACSTR
  851. " based on BSS Transition Management Request (old BSSID "
  852. MACSTR " after_new_scan=%d)",
  853. MAC2STR(bss->bssid), MAC2STR(wpa_s->bssid), after_new_scan);
  854. /* Send the BSS Management Response - Accept */
  855. if (wpa_s->wnm_reply) {
  856. wpa_s->wnm_reply = 0;
  857. wpa_printf(MSG_DEBUG,
  858. "WNM: Sending successful BSS Transition Management Response");
  859. wnm_send_bss_transition_mgmt_resp(
  860. wpa_s, wpa_s->wnm_dialog_token, WNM_BSS_TM_ACCEPT,
  861. MBO_TRANSITION_REASON_UNSPECIFIED, 0, bss->bssid);
  862. }
  863. if (bss == wpa_s->current_bss) {
  864. wpa_printf(MSG_DEBUG,
  865. "WNM: Already associated with the preferred candidate");
  866. wnm_deallocate_memory(wpa_s);
  867. return;
  868. }
  869. wpa_s->reassociate = 1;
  870. wpa_printf(MSG_DEBUG, "WNM: Issuing connect");
  871. wpa_supplicant_connect(wpa_s, bss, ssid);
  872. wnm_deallocate_memory(wpa_s);
  873. }
  874. int wnm_scan_process(struct wpa_supplicant *wpa_s, int reply_on_fail)
  875. {
  876. struct wpa_bss *bss;
  877. struct wpa_ssid *ssid = wpa_s->current_ssid;
  878. enum bss_trans_mgmt_status_code status = WNM_BSS_TM_REJECT_UNSPECIFIED;
  879. enum mbo_transition_reject_reason reason =
  880. MBO_TRANSITION_REJECT_REASON_UNSPECIFIED;
  881. if (!wpa_s->wnm_neighbor_report_elements)
  882. return 0;
  883. wpa_dbg(wpa_s, MSG_DEBUG,
  884. "WNM: Process scan results for BSS Transition Management");
  885. if (os_reltime_before(&wpa_s->wnm_cand_valid_until,
  886. &wpa_s->scan_trigger_time)) {
  887. wpa_printf(MSG_DEBUG, "WNM: Previously stored BSS transition candidate list is not valid anymore - drop it");
  888. wnm_deallocate_memory(wpa_s);
  889. return 0;
  890. }
  891. if (!wpa_s->current_bss ||
  892. os_memcmp(wpa_s->wnm_cand_from_bss, wpa_s->current_bss->bssid,
  893. ETH_ALEN) != 0) {
  894. wpa_printf(MSG_DEBUG, "WNM: Stored BSS transition candidate list not from the current BSS - ignore it");
  895. return 0;
  896. }
  897. /* Compare the Neighbor Report and scan results */
  898. bss = compare_scan_neighbor_results(wpa_s, 0, &reason);
  899. if (!bss) {
  900. wpa_printf(MSG_DEBUG, "WNM: No BSS transition candidate match found");
  901. status = WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES;
  902. goto send_bss_resp_fail;
  903. }
  904. /* Associate to the network */
  905. wnm_bss_tm_connect(wpa_s, bss, ssid, 1);
  906. return 1;
  907. send_bss_resp_fail:
  908. if (!reply_on_fail)
  909. return 0;
  910. /* Send reject response for all the failures */
  911. if (wpa_s->wnm_reply) {
  912. wpa_s->wnm_reply = 0;
  913. wnm_send_bss_transition_mgmt_resp(wpa_s,
  914. wpa_s->wnm_dialog_token,
  915. status, reason, 0, NULL);
  916. }
  917. wnm_deallocate_memory(wpa_s);
  918. return 0;
  919. }
  920. static int cand_pref_compar(const void *a, const void *b)
  921. {
  922. const struct neighbor_report *aa = a;
  923. const struct neighbor_report *bb = b;
  924. if (!aa->preference_present && !bb->preference_present)
  925. return 0;
  926. if (!aa->preference_present)
  927. return 1;
  928. if (!bb->preference_present)
  929. return -1;
  930. if (bb->preference > aa->preference)
  931. return 1;
  932. if (bb->preference < aa->preference)
  933. return -1;
  934. return 0;
  935. }
  936. static void wnm_sort_cand_list(struct wpa_supplicant *wpa_s)
  937. {
  938. if (!wpa_s->wnm_neighbor_report_elements)
  939. return;
  940. qsort(wpa_s->wnm_neighbor_report_elements,
  941. wpa_s->wnm_num_neighbor_report, sizeof(struct neighbor_report),
  942. cand_pref_compar);
  943. }
  944. static void wnm_dump_cand_list(struct wpa_supplicant *wpa_s)
  945. {
  946. unsigned int i;
  947. wpa_printf(MSG_DEBUG, "WNM: BSS Transition Candidate List");
  948. if (!wpa_s->wnm_neighbor_report_elements)
  949. return;
  950. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
  951. struct neighbor_report *nei;
  952. nei = &wpa_s->wnm_neighbor_report_elements[i];
  953. wpa_printf(MSG_DEBUG, "%u: " MACSTR
  954. " info=0x%x op_class=%u chan=%u phy=%u pref=%d freq=%d",
  955. i, MAC2STR(nei->bssid), nei->bssid_info,
  956. nei->regulatory_class,
  957. nei->channel_number, nei->phy_type,
  958. nei->preference_present ? nei->preference : -1,
  959. nei->freq);
  960. }
  961. }
  962. static int chan_supported(struct wpa_supplicant *wpa_s, int freq)
  963. {
  964. unsigned int i;
  965. for (i = 0; i < wpa_s->hw.num_modes; i++) {
  966. struct hostapd_hw_modes *mode = &wpa_s->hw.modes[i];
  967. int j;
  968. for (j = 0; j < mode->num_channels; j++) {
  969. struct hostapd_channel_data *chan;
  970. chan = &mode->channels[j];
  971. if (chan->freq == freq &&
  972. !(chan->flag & HOSTAPD_CHAN_DISABLED))
  973. return 1;
  974. }
  975. }
  976. return 0;
  977. }
  978. static void wnm_set_scan_freqs(struct wpa_supplicant *wpa_s)
  979. {
  980. int *freqs;
  981. int num_freqs = 0;
  982. unsigned int i;
  983. if (!wpa_s->wnm_neighbor_report_elements)
  984. return;
  985. if (wpa_s->hw.modes == NULL)
  986. return;
  987. os_free(wpa_s->next_scan_freqs);
  988. wpa_s->next_scan_freqs = NULL;
  989. freqs = os_calloc(wpa_s->wnm_num_neighbor_report + 1, sizeof(int));
  990. if (freqs == NULL)
  991. return;
  992. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
  993. struct neighbor_report *nei;
  994. nei = &wpa_s->wnm_neighbor_report_elements[i];
  995. if (nei->freq <= 0) {
  996. wpa_printf(MSG_DEBUG,
  997. "WNM: Unknown neighbor operating frequency for "
  998. MACSTR " - scan all channels",
  999. MAC2STR(nei->bssid));
  1000. os_free(freqs);
  1001. return;
  1002. }
  1003. if (chan_supported(wpa_s, nei->freq))
  1004. add_freq(freqs, &num_freqs, nei->freq);
  1005. }
  1006. if (num_freqs == 0) {
  1007. os_free(freqs);
  1008. return;
  1009. }
  1010. wpa_printf(MSG_DEBUG,
  1011. "WNM: Scan %d frequencies based on transition candidate list",
  1012. num_freqs);
  1013. wpa_s->next_scan_freqs = freqs;
  1014. }
  1015. static int wnm_fetch_scan_results(struct wpa_supplicant *wpa_s)
  1016. {
  1017. struct wpa_scan_results *scan_res;
  1018. struct wpa_bss *bss;
  1019. struct wpa_ssid *ssid = wpa_s->current_ssid;
  1020. u8 i, found = 0;
  1021. size_t j;
  1022. wpa_dbg(wpa_s, MSG_DEBUG,
  1023. "WNM: Fetch current scan results from the driver for checking transition candidates");
  1024. scan_res = wpa_drv_get_scan_results2(wpa_s);
  1025. if (!scan_res) {
  1026. wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Failed to get scan results");
  1027. return 0;
  1028. }
  1029. if (scan_res->fetch_time.sec == 0)
  1030. os_get_reltime(&scan_res->fetch_time);
  1031. filter_scan_res(wpa_s, scan_res);
  1032. for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
  1033. struct neighbor_report *nei;
  1034. nei = &wpa_s->wnm_neighbor_report_elements[i];
  1035. if (nei->preference_present && nei->preference == 0)
  1036. continue;
  1037. for (j = 0; j < scan_res->num; j++) {
  1038. struct wpa_scan_res *res;
  1039. const u8 *ssid_ie;
  1040. res = scan_res->res[j];
  1041. if (os_memcmp(nei->bssid, res->bssid, ETH_ALEN) != 0 ||
  1042. res->age > WNM_SCAN_RESULT_AGE * 1000)
  1043. continue;
  1044. bss = wpa_s->current_bss;
  1045. ssid_ie = wpa_scan_get_ie(res, WLAN_EID_SSID);
  1046. if (bss && ssid_ie &&
  1047. (bss->ssid_len != ssid_ie[1] ||
  1048. os_memcmp(bss->ssid, ssid_ie + 2,
  1049. bss->ssid_len) != 0))
  1050. continue;
  1051. /* Potential candidate found */
  1052. found = 1;
  1053. scan_snr(res);
  1054. scan_est_throughput(wpa_s, res);
  1055. wpa_bss_update_scan_res(wpa_s, res,
  1056. &scan_res->fetch_time);
  1057. }
  1058. }
  1059. wpa_scan_results_free(scan_res);
  1060. if (!found) {
  1061. wpa_dbg(wpa_s, MSG_DEBUG,
  1062. "WNM: No transition candidate matches existing scan results");
  1063. return 0;
  1064. }
  1065. bss = compare_scan_neighbor_results(wpa_s, WNM_SCAN_RESULT_AGE, NULL);
  1066. if (!bss) {
  1067. wpa_dbg(wpa_s, MSG_DEBUG,
  1068. "WNM: Comparison of scan results against transition candidates did not find matches");
  1069. return 0;
  1070. }
  1071. /* Associate to the network */
  1072. wnm_bss_tm_connect(wpa_s, bss, ssid, 0);
  1073. return 1;
  1074. }
  1075. static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
  1076. const u8 *pos, const u8 *end,
  1077. int reply)
  1078. {
  1079. unsigned int beacon_int;
  1080. u8 valid_int;
  1081. #ifdef CONFIG_MBO
  1082. const u8 *vendor;
  1083. #endif /* CONFIG_MBO */
  1084. if (end - pos < 5)
  1085. return;
  1086. #ifdef CONFIG_MBO
  1087. wpa_s->wnm_mbo_trans_reason_present = 0;
  1088. wpa_s->wnm_mbo_transition_reason = 0;
  1089. #endif /* CONFIG_MBO */
  1090. if (wpa_s->current_bss)
  1091. beacon_int = wpa_s->current_bss->beacon_int;
  1092. else
  1093. beacon_int = 100; /* best guess */
  1094. wpa_s->wnm_dialog_token = pos[0];
  1095. wpa_s->wnm_mode = pos[1];
  1096. wpa_s->wnm_dissoc_timer = WPA_GET_LE16(pos + 2);
  1097. valid_int = pos[4];
  1098. wpa_s->wnm_reply = reply;
  1099. wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: "
  1100. "dialog_token=%u request_mode=0x%x "
  1101. "disassoc_timer=%u validity_interval=%u",
  1102. wpa_s->wnm_dialog_token, wpa_s->wnm_mode,
  1103. wpa_s->wnm_dissoc_timer, valid_int);
  1104. #if defined(CONFIG_MBO) && defined(CONFIG_TESTING_OPTIONS)
  1105. if (wpa_s->reject_btm_req_reason) {
  1106. wpa_printf(MSG_INFO,
  1107. "WNM: Testing - reject BSS Transition Management Request: reject_btm_req_reason=%d",
  1108. wpa_s->reject_btm_req_reason);
  1109. wnm_send_bss_transition_mgmt_resp(
  1110. wpa_s, wpa_s->wnm_dialog_token,
  1111. wpa_s->reject_btm_req_reason,
  1112. MBO_TRANSITION_REASON_UNSPECIFIED, 0, NULL);
  1113. return;
  1114. }
  1115. #endif /* CONFIG_MBO && CONFIG_TESTING_OPTIONS */
  1116. pos += 5;
  1117. if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
  1118. if (end - pos < 12) {
  1119. wpa_printf(MSG_DEBUG, "WNM: Too short BSS TM Request");
  1120. return;
  1121. }
  1122. os_memcpy(wpa_s->wnm_bss_termination_duration, pos, 12);
  1123. pos += 12; /* BSS Termination Duration */
  1124. }
  1125. if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) {
  1126. char url[256];
  1127. if (end - pos < 1 || 1 + pos[0] > end - pos) {
  1128. wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition "
  1129. "Management Request (URL)");
  1130. return;
  1131. }
  1132. os_memcpy(url, pos + 1, pos[0]);
  1133. url[pos[0]] = '\0';
  1134. pos += 1 + pos[0];
  1135. wpa_msg(wpa_s, MSG_INFO, ESS_DISASSOC_IMMINENT "%d %u %s",
  1136. wpa_sm_pmf_enabled(wpa_s->wpa),
  1137. wpa_s->wnm_dissoc_timer * beacon_int * 128 / 125, url);
  1138. }
  1139. if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
  1140. wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - "
  1141. "Disassociation Timer %u", wpa_s->wnm_dissoc_timer);
  1142. if (wpa_s->wnm_dissoc_timer && !wpa_s->scanning) {
  1143. /* TODO: mark current BSS less preferred for
  1144. * selection */
  1145. wpa_printf(MSG_DEBUG, "Trying to find another BSS");
  1146. wpa_supplicant_req_scan(wpa_s, 0, 0);
  1147. }
  1148. }
  1149. #ifdef CONFIG_MBO
  1150. vendor = get_ie(pos, end - pos, WLAN_EID_VENDOR_SPECIFIC);
  1151. if (vendor)
  1152. wpas_mbo_ie_trans_req(wpa_s, vendor + 2, vendor[1]);
  1153. #endif /* CONFIG_MBO */
  1154. if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED) {
  1155. unsigned int valid_ms;
  1156. wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
  1157. wnm_deallocate_memory(wpa_s);
  1158. wpa_s->wnm_neighbor_report_elements = os_calloc(
  1159. WNM_MAX_NEIGHBOR_REPORT,
  1160. sizeof(struct neighbor_report));
  1161. if (wpa_s->wnm_neighbor_report_elements == NULL)
  1162. return;
  1163. while (end - pos >= 2 &&
  1164. wpa_s->wnm_num_neighbor_report < WNM_MAX_NEIGHBOR_REPORT)
  1165. {
  1166. u8 tag = *pos++;
  1167. u8 len = *pos++;
  1168. wpa_printf(MSG_DEBUG, "WNM: Neighbor report tag %u",
  1169. tag);
  1170. if (len > end - pos) {
  1171. wpa_printf(MSG_DEBUG, "WNM: Truncated request");
  1172. return;
  1173. }
  1174. if (tag == WLAN_EID_NEIGHBOR_REPORT) {
  1175. struct neighbor_report *rep;
  1176. rep = &wpa_s->wnm_neighbor_report_elements[
  1177. wpa_s->wnm_num_neighbor_report];
  1178. wnm_parse_neighbor_report(wpa_s, pos, len, rep);
  1179. wpa_s->wnm_num_neighbor_report++;
  1180. #ifdef CONFIG_MBO
  1181. if (wpa_s->wnm_mbo_trans_reason_present &&
  1182. wpa_s->wnm_num_neighbor_report == 1) {
  1183. rep->is_first = 1;
  1184. wpa_printf(MSG_DEBUG,
  1185. "WNM: First transition candidate is "
  1186. MACSTR, MAC2STR(rep->bssid));
  1187. }
  1188. #endif /* CONFIG_MBO */
  1189. }
  1190. pos += len;
  1191. }
  1192. if (!wpa_s->wnm_num_neighbor_report) {
  1193. wpa_printf(MSG_DEBUG,
  1194. "WNM: Candidate list included bit is set, but no candidates found");
  1195. wnm_send_bss_transition_mgmt_resp(
  1196. wpa_s, wpa_s->wnm_dialog_token,
  1197. WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES,
  1198. MBO_TRANSITION_REASON_UNSPECIFIED, 0, NULL);
  1199. return;
  1200. }
  1201. wnm_sort_cand_list(wpa_s);
  1202. wnm_dump_cand_list(wpa_s);
  1203. valid_ms = valid_int * beacon_int * 128 / 125;
  1204. wpa_printf(MSG_DEBUG, "WNM: Candidate list valid for %u ms",
  1205. valid_ms);
  1206. os_get_reltime(&wpa_s->wnm_cand_valid_until);
  1207. wpa_s->wnm_cand_valid_until.sec += valid_ms / 1000;
  1208. wpa_s->wnm_cand_valid_until.usec += (valid_ms % 1000) * 1000;
  1209. wpa_s->wnm_cand_valid_until.sec +=
  1210. wpa_s->wnm_cand_valid_until.usec / 1000000;
  1211. wpa_s->wnm_cand_valid_until.usec %= 1000000;
  1212. os_memcpy(wpa_s->wnm_cand_from_bss, wpa_s->bssid, ETH_ALEN);
  1213. /*
  1214. * Fetch the latest scan results from the kernel and check for
  1215. * candidates based on those results first. This can help in
  1216. * finding more up-to-date information should the driver has
  1217. * done some internal scanning operations after the last scan
  1218. * result update in wpa_supplicant.
  1219. */
  1220. if (wnm_fetch_scan_results(wpa_s) > 0)
  1221. return;
  1222. /*
  1223. * Try to use previously received scan results, if they are
  1224. * recent enough to use for a connection.
  1225. */
  1226. if (wpa_s->last_scan_res_used > 0) {
  1227. struct os_reltime now;
  1228. os_get_reltime(&now);
  1229. if (!os_reltime_expired(&now, &wpa_s->last_scan, 10)) {
  1230. wpa_printf(MSG_DEBUG,
  1231. "WNM: Try to use recent scan results");
  1232. if (wnm_scan_process(wpa_s, 0) > 0)
  1233. return;
  1234. wpa_printf(MSG_DEBUG,
  1235. "WNM: No match in previous scan results - try a new scan");
  1236. }
  1237. }
  1238. wnm_set_scan_freqs(wpa_s);
  1239. if (wpa_s->wnm_num_neighbor_report == 1) {
  1240. os_memcpy(wpa_s->next_scan_bssid,
  1241. wpa_s->wnm_neighbor_report_elements[0].bssid,
  1242. ETH_ALEN);
  1243. wpa_printf(MSG_DEBUG,
  1244. "WNM: Scan only for a specific BSSID since there is only a single candidate "
  1245. MACSTR, MAC2STR(wpa_s->next_scan_bssid));
  1246. }
  1247. wpa_supplicant_req_scan(wpa_s, 0, 0);
  1248. } else if (reply) {
  1249. enum bss_trans_mgmt_status_code status;
  1250. if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT)
  1251. status = WNM_BSS_TM_ACCEPT;
  1252. else {
  1253. wpa_msg(wpa_s, MSG_INFO, "WNM: BSS Transition Management Request did not include candidates");
  1254. status = WNM_BSS_TM_REJECT_UNSPECIFIED;
  1255. }
  1256. wnm_send_bss_transition_mgmt_resp(
  1257. wpa_s, wpa_s->wnm_dialog_token, status,
  1258. MBO_TRANSITION_REASON_UNSPECIFIED, 0, NULL);
  1259. }
  1260. }
  1261. int wnm_send_bss_transition_mgmt_query(struct wpa_supplicant *wpa_s,
  1262. u8 query_reason, int cand_list)
  1263. {
  1264. u8 buf[2000], *pos;
  1265. struct ieee80211_mgmt *mgmt;
  1266. size_t len;
  1267. int ret;
  1268. wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Query to "
  1269. MACSTR " query_reason=%u%s",
  1270. MAC2STR(wpa_s->bssid), query_reason,
  1271. cand_list ? " candidate list" : "");
  1272. mgmt = (struct ieee80211_mgmt *) buf;
  1273. os_memset(&buf, 0, sizeof(buf));
  1274. os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
  1275. os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
  1276. os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
  1277. mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
  1278. WLAN_FC_STYPE_ACTION);
  1279. mgmt->u.action.category = WLAN_ACTION_WNM;
  1280. mgmt->u.action.u.bss_tm_query.action = WNM_BSS_TRANS_MGMT_QUERY;
  1281. mgmt->u.action.u.bss_tm_query.dialog_token = 1;
  1282. mgmt->u.action.u.bss_tm_query.query_reason = query_reason;
  1283. pos = mgmt->u.action.u.bss_tm_query.variable;
  1284. if (cand_list)
  1285. pos += wnm_add_cand_list(wpa_s, pos, buf + sizeof(buf) - pos);
  1286. len = pos - (u8 *) &mgmt->u.action.category;
  1287. ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
  1288. wpa_s->own_addr, wpa_s->bssid,
  1289. &mgmt->u.action.category, len, 0);
  1290. return ret;
  1291. }
  1292. static void ieee802_11_rx_wnm_notif_req_wfa(struct wpa_supplicant *wpa_s,
  1293. const u8 *sa, const u8 *data,
  1294. int len)
  1295. {
  1296. const u8 *pos, *end, *next;
  1297. u8 ie, ie_len;
  1298. pos = data;
  1299. end = data + len;
  1300. while (end - pos > 1) {
  1301. ie = *pos++;
  1302. ie_len = *pos++;
  1303. wpa_printf(MSG_DEBUG, "WNM: WFA subelement %u len %u",
  1304. ie, ie_len);
  1305. if (ie_len > end - pos) {
  1306. wpa_printf(MSG_DEBUG, "WNM: Not enough room for "
  1307. "subelement");
  1308. break;
  1309. }
  1310. next = pos + ie_len;
  1311. if (ie_len < 4) {
  1312. pos = next;
  1313. continue;
  1314. }
  1315. wpa_printf(MSG_DEBUG, "WNM: Subelement OUI %06x type %u",
  1316. WPA_GET_BE24(pos), pos[3]);
  1317. #ifdef CONFIG_HS20
  1318. if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 5 &&
  1319. WPA_GET_BE24(pos) == OUI_WFA &&
  1320. pos[3] == HS20_WNM_SUB_REM_NEEDED) {
  1321. /* Subscription Remediation subelement */
  1322. const u8 *ie_end;
  1323. u8 url_len;
  1324. char *url;
  1325. u8 osu_method;
  1326. wpa_printf(MSG_DEBUG, "WNM: Subscription Remediation "
  1327. "subelement");
  1328. ie_end = pos + ie_len;
  1329. pos += 4;
  1330. url_len = *pos++;
  1331. if (url_len == 0) {
  1332. wpa_printf(MSG_DEBUG, "WNM: No Server URL included");
  1333. url = NULL;
  1334. osu_method = 1;
  1335. } else {
  1336. if (url_len + 1 > ie_end - pos) {
  1337. wpa_printf(MSG_DEBUG, "WNM: Not enough room for Server URL (len=%u) and Server Method (left %d)",
  1338. url_len,
  1339. (int) (ie_end - pos));
  1340. break;
  1341. }
  1342. url = os_malloc(url_len + 1);
  1343. if (url == NULL)
  1344. break;
  1345. os_memcpy(url, pos, url_len);
  1346. url[url_len] = '\0';
  1347. osu_method = pos[url_len];
  1348. }
  1349. hs20_rx_subscription_remediation(wpa_s, url,
  1350. osu_method);
  1351. os_free(url);
  1352. pos = next;
  1353. continue;
  1354. }
  1355. if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 8 &&
  1356. WPA_GET_BE24(pos) == OUI_WFA &&
  1357. pos[3] == HS20_WNM_DEAUTH_IMMINENT_NOTICE) {
  1358. const u8 *ie_end;
  1359. u8 url_len;
  1360. char *url;
  1361. u8 code;
  1362. u16 reauth_delay;
  1363. ie_end = pos + ie_len;
  1364. pos += 4;
  1365. code = *pos++;
  1366. reauth_delay = WPA_GET_LE16(pos);
  1367. pos += 2;
  1368. url_len = *pos++;
  1369. wpa_printf(MSG_DEBUG, "WNM: HS 2.0 Deauthentication "
  1370. "Imminent - Reason Code %u "
  1371. "Re-Auth Delay %u URL Length %u",
  1372. code, reauth_delay, url_len);
  1373. if (url_len > ie_end - pos)
  1374. break;
  1375. url = os_malloc(url_len + 1);
  1376. if (url == NULL)
  1377. break;
  1378. os_memcpy(url, pos, url_len);
  1379. url[url_len] = '\0';
  1380. hs20_rx_deauth_imminent_notice(wpa_s, code,
  1381. reauth_delay, url);
  1382. os_free(url);
  1383. pos = next;
  1384. continue;
  1385. }
  1386. #endif /* CONFIG_HS20 */
  1387. pos = next;
  1388. }
  1389. }
  1390. static void ieee802_11_rx_wnm_notif_req(struct wpa_supplicant *wpa_s,
  1391. const u8 *sa, const u8 *frm, int len)
  1392. {
  1393. const u8 *pos, *end;
  1394. u8 dialog_token, type;
  1395. /* Dialog Token [1] | Type [1] | Subelements */
  1396. if (len < 2 || sa == NULL)
  1397. return;
  1398. end = frm + len;
  1399. pos = frm;
  1400. dialog_token = *pos++;
  1401. type = *pos++;
  1402. wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Received WNM-Notification Request "
  1403. "(dialog_token %u type %u sa " MACSTR ")",
  1404. dialog_token, type, MAC2STR(sa));
  1405. wpa_hexdump(MSG_DEBUG, "WNM-Notification Request subelements",
  1406. pos, end - pos);
  1407. if (wpa_s->wpa_state != WPA_COMPLETED ||
  1408. os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) {
  1409. wpa_dbg(wpa_s, MSG_DEBUG, "WNM: WNM-Notification frame not "
  1410. "from our AP - ignore it");
  1411. return;
  1412. }
  1413. switch (type) {
  1414. case 1:
  1415. ieee802_11_rx_wnm_notif_req_wfa(wpa_s, sa, pos, end - pos);
  1416. break;
  1417. default:
  1418. wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Ignore unknown "
  1419. "WNM-Notification type %u", type);
  1420. break;
  1421. }
  1422. }
  1423. void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
  1424. const struct ieee80211_mgmt *mgmt, size_t len)
  1425. {
  1426. const u8 *pos, *end;
  1427. u8 act;
  1428. if (len < IEEE80211_HDRLEN + 2)
  1429. return;
  1430. pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
  1431. act = *pos++;
  1432. end = ((const u8 *) mgmt) + len;
  1433. wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR,
  1434. act, MAC2STR(mgmt->sa));
  1435. if (wpa_s->wpa_state < WPA_ASSOCIATED ||
  1436. os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
  1437. wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action "
  1438. "frame");
  1439. return;
  1440. }
  1441. switch (act) {
  1442. case WNM_BSS_TRANS_MGMT_REQ:
  1443. ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end,
  1444. !(mgmt->da[0] & 0x01));
  1445. break;
  1446. case WNM_SLEEP_MODE_RESP:
  1447. ieee802_11_rx_wnmsleep_resp(wpa_s, pos, end - pos);
  1448. break;
  1449. case WNM_NOTIFICATION_REQ:
  1450. ieee802_11_rx_wnm_notif_req(wpa_s, mgmt->sa, pos, end - pos);
  1451. break;
  1452. default:
  1453. wpa_printf(MSG_ERROR, "WNM: Unknown request");
  1454. break;
  1455. }
  1456. }