1 /* 2 * wpa_supplicant - MBO 3 * 4 * Copyright(c) 2015 Intel Deutschland GmbH 5 * Contact Information: 6 * Intel Linux Wireless <ilw@linux.intel.com> 7 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497 8 * 9 * This software may be distributed under the terms of the BSD license. 10 * See README for more details. 11 */ 12 13 #include "utils/includes.h" 14 15 #include "utils/common.h" 16 #include "common/ieee802_11_defs.h" 17 #include "common/gas.h" 18 #include "rsn_supp/wpa.h" 19 #include "config.h" 20 #include "wpa_supplicant_i.h" 21 #include "driver_i.h" 22 #include "bss.h" 23 #include "scan.h" 24 25 /* type + length + oui + oui type */ 26 #define MBO_IE_HEADER 6 27 28 wpas_mbo_validate_non_pref_chan(u8 oper_class,u8 chan,u8 reason)29 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason) 30 { 31 if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE) 32 return -1; 33 34 /* Only checking the validity of the channel and oper_class */ 35 if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1) 36 return -1; 37 38 return 0; 39 } 40 41 mbo_attr_from_mbo_ie(const u8 * mbo_ie,enum mbo_attr_id attr)42 const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr) 43 { 44 const u8 *mbo; 45 u8 ie_len = mbo_ie[1]; 46 47 if (ie_len < MBO_IE_HEADER - 2) 48 return NULL; 49 mbo = mbo_ie + MBO_IE_HEADER; 50 51 return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr); 52 } 53 54 mbo_get_attr_from_ies(const u8 * ies,size_t ies_len,enum mbo_attr_id attr)55 const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len, 56 enum mbo_attr_id attr) 57 { 58 const u8 *mbo_ie; 59 60 mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE); 61 if (!mbo_ie) 62 return NULL; 63 64 return mbo_attr_from_mbo_ie(mbo_ie, attr); 65 } 66 67 wpas_mbo_get_bss_attr(struct wpa_bss * bss,enum mbo_attr_id attr,bool beacon)68 static const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, 69 enum mbo_attr_id attr, bool beacon) 70 { 71 const u8 *mbo, *end; 72 73 if (!bss) 74 return NULL; 75 76 if (beacon) 77 mbo = wpa_bss_get_vendor_ie_beacon(bss, MBO_IE_VENDOR_TYPE); 78 else 79 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE); 80 if (!mbo) 81 return NULL; 82 83 end = mbo + 2 + mbo[1]; 84 mbo += MBO_IE_HEADER; 85 86 return get_ie(mbo, end - mbo, attr); 87 } 88 89 wpas_mbo_check_assoc_disallow(struct wpa_bss * bss)90 const u8 * wpas_mbo_check_assoc_disallow(struct wpa_bss *bss) 91 { 92 const u8 *assoc_disallow; 93 94 assoc_disallow = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_ASSOC_DISALLOW, 95 bss->beacon_newer); 96 if (assoc_disallow && assoc_disallow[1] >= 1) 97 return assoc_disallow; 98 99 return NULL; 100 } 101 102 wpas_mbo_check_pmf(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)103 void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss, 104 struct wpa_ssid *ssid) 105 { 106 const u8 *rsne, *mbo, *oce; 107 struct wpa_ie_data ie; 108 109 wpa_s->disable_mbo_oce = 0; 110 if (!bss) 111 return; 112 mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND, false); 113 oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND, false); 114 if (!mbo && !oce) 115 return; 116 if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON)) 117 return; /* STA-CFON is not required to enable PMF */ 118 rsne = wpa_bss_get_rsne(wpa_s, bss, ssid, false); 119 if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0) 120 return; /* AP is not using RSN */ 121 122 if (!(ie.capabilities & WPA_CAPABILITY_MFPC)) 123 wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */ 124 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION) 125 wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */ 126 if (wpa_s->disable_mbo_oce) 127 wpa_printf(MSG_INFO, 128 "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF"); 129 } 130 131 wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)132 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s, 133 struct wpabuf *mbo, 134 u8 start, u8 end) 135 { 136 u8 i; 137 138 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class); 139 140 for (i = start; i < end; i++) 141 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan); 142 143 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference); 144 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason); 145 } 146 147 wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf * mbo,size_t size)148 static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size) 149 { 150 wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT); 151 wpabuf_put_u8(mbo, size); /* Length */ 152 } 153 154 wpas_mbo_non_pref_chan_attr(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)155 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s, 156 struct wpabuf *mbo, u8 start, u8 end) 157 { 158 size_t size = end - start + 3; 159 160 if (size + 2 > wpabuf_tailroom(mbo)) 161 return; 162 163 wpas_mbo_non_pref_chan_attr_hdr(mbo, size); 164 wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end); 165 } 166 167 wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf * mbo,u8 len)168 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len) 169 { 170 wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC); 171 wpabuf_put_u8(mbo, len); /* Length */ 172 wpabuf_put_be24(mbo, OUI_WFA); 173 wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT); 174 } 175 176 wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,u8 start,u8 end)177 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s, 178 struct wpabuf *mbo, u8 start, 179 u8 end) 180 { 181 size_t size = end - start + 7; 182 183 if (size + 2 > wpabuf_tailroom(mbo)) 184 return; 185 186 wpas_mbo_non_pref_chan_subelem_hdr(mbo, size); 187 wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end); 188 } 189 190 wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant * wpa_s,struct wpabuf * mbo,int subelement)191 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s, 192 struct wpabuf *mbo, int subelement) 193 { 194 u8 i, start = 0; 195 struct wpa_mbo_non_pref_channel *start_pref; 196 197 if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) { 198 if (subelement) 199 wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4); 200 else 201 wpas_mbo_non_pref_chan_attr_hdr(mbo, 0); 202 return; 203 } 204 start_pref = &wpa_s->non_pref_chan[0]; 205 206 for (i = 1; i <= wpa_s->non_pref_chan_num; i++) { 207 struct wpa_mbo_non_pref_channel *non_pref = NULL; 208 209 if (i < wpa_s->non_pref_chan_num) 210 non_pref = &wpa_s->non_pref_chan[i]; 211 if (!non_pref || 212 non_pref->oper_class != start_pref->oper_class || 213 non_pref->reason != start_pref->reason || 214 non_pref->preference != start_pref->preference) { 215 if (subelement) 216 wpas_mbo_non_pref_chan_subelement(wpa_s, mbo, 217 start, i); 218 else 219 wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start, 220 i); 221 222 if (!non_pref) 223 return; 224 225 start = i; 226 start_pref = non_pref; 227 } 228 } 229 } 230 231 wpas_mbo_ie(struct wpa_supplicant * wpa_s,u8 * buf,size_t len,int add_oce_capa)232 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len, 233 int add_oce_capa) 234 { 235 struct wpabuf *mbo; 236 int res; 237 238 if (len < MBO_IE_HEADER + 3 + 7 + 239 ((wpa_s->enable_oce & OCE_STA) ? 3 : 0)) 240 return 0; 241 242 /* Leave room for the MBO IE header */ 243 mbo = wpabuf_alloc(len - MBO_IE_HEADER); 244 if (!mbo) 245 return 0; 246 247 /* Add non-preferred channels attribute */ 248 wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0); 249 250 /* 251 * Send cellular capabilities attribute even if AP does not advertise 252 * cellular capabilities. 253 */ 254 wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA); 255 wpabuf_put_u8(mbo, 1); 256 wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa); 257 258 /* Add OCE capability indication attribute if OCE is enabled */ 259 if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) { 260 wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND); 261 wpabuf_put_u8(mbo, 1); 262 wpabuf_put_u8(mbo, OCE_RELEASE); 263 } 264 265 res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo)); 266 if (!res) 267 wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE"); 268 269 wpabuf_free(mbo); 270 return res; 271 } 272 273 wpas_mbo_send_wnm_notification(struct wpa_supplicant * wpa_s,const u8 * data,size_t len)274 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s, 275 const u8 *data, size_t len) 276 { 277 struct wpabuf *buf; 278 int res; 279 280 /* 281 * Send WNM-Notification Request frame only in case of a change in 282 * non-preferred channels list during association, if the AP supports 283 * MBO. 284 */ 285 if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss || 286 !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE)) 287 return; 288 289 buf = wpabuf_alloc(4 + len); 290 if (!buf) 291 return; 292 293 wpabuf_put_u8(buf, WLAN_ACTION_WNM); 294 wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ); 295 wpa_s->mbo_wnm_token++; 296 if (wpa_s->mbo_wnm_token == 0) 297 wpa_s->mbo_wnm_token++; 298 wpabuf_put_u8(buf, wpa_s->mbo_wnm_token); 299 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */ 300 301 wpabuf_put_data(buf, data, len); 302 303 res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, 304 wpa_s->own_addr, wpa_s->bssid, 305 wpabuf_head(buf), wpabuf_len(buf), 0); 306 if (res < 0) 307 wpa_printf(MSG_DEBUG, 308 "Failed to send WNM-Notification Request frame with non-preferred channel list"); 309 310 wpabuf_free(buf); 311 } 312 313 wpas_mbo_non_pref_chan_changed(struct wpa_supplicant * wpa_s)314 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s) 315 { 316 struct wpabuf *buf; 317 318 buf = wpabuf_alloc(512); 319 if (!buf) 320 return; 321 322 wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1); 323 wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf), 324 wpabuf_len(buf)); 325 wpas_update_mbo_connect_params(wpa_s); 326 wpabuf_free(buf); 327 } 328 329 wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel * a,struct wpa_mbo_non_pref_channel * b)330 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a, 331 struct wpa_mbo_non_pref_channel *b) 332 { 333 return a->oper_class == b->oper_class && a->chan == b->chan; 334 } 335 336 337 /* 338 * wpa_non_pref_chan_cmp - Compare two channels for sorting 339 * 340 * In MBO IE non-preferred channel subelement we can put many channels in an 341 * attribute if they are in the same operating class and have the same 342 * preference and reason. To make it easy for the functions that build 343 * the IE attributes and WNM Request subelements, save the channels sorted 344 * by their oper_class and reason. 345 */ wpa_non_pref_chan_cmp(const void * _a,const void * _b)346 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b) 347 { 348 const struct wpa_mbo_non_pref_channel *a = _a, *b = _b; 349 350 if (a->oper_class != b->oper_class) 351 return (int) a->oper_class - (int) b->oper_class; 352 if (a->reason != b->reason) 353 return (int) a->reason - (int) b->reason; 354 return (int) a->preference - (int) b->preference; 355 } 356 357 wpas_mbo_update_non_pref_chan(struct wpa_supplicant * wpa_s,const char * non_pref_chan)358 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s, 359 const char *non_pref_chan) 360 { 361 char *cmd, *token, *context = NULL; 362 struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans; 363 size_t num = 0, size = 0; 364 unsigned i; 365 366 wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s", 367 non_pref_chan ? non_pref_chan : "N/A"); 368 369 /* 370 * The shortest channel configuration is 7 characters - 3 colons and 371 * 4 values. 372 */ 373 if (!non_pref_chan || os_strlen(non_pref_chan) < 7) 374 goto update; 375 376 cmd = os_strdup(non_pref_chan); 377 if (!cmd) 378 return -1; 379 380 while ((token = str_token(cmd, " ", &context))) { 381 struct wpa_mbo_non_pref_channel *chan; 382 int ret; 383 unsigned int _oper_class; 384 unsigned int _chan; 385 unsigned int _preference; 386 unsigned int _reason; 387 388 if (num == size) { 389 size = size ? size * 2 : 1; 390 tmp_chans = os_realloc_array(chans, size, 391 sizeof(*chans)); 392 if (!tmp_chans) { 393 wpa_printf(MSG_ERROR, 394 "Couldn't reallocate non_pref_chan"); 395 goto fail; 396 } 397 chans = tmp_chans; 398 } 399 400 chan = &chans[num]; 401 402 ret = sscanf(token, "%u:%u:%u:%u", &_oper_class, 403 &_chan, &_preference, &_reason); 404 if (ret != 4 || 405 _oper_class > 255 || _chan > 255 || 406 _preference > 255 || _reason > 65535 ) { 407 wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s", 408 token); 409 goto fail; 410 } 411 chan->oper_class = _oper_class; 412 chan->chan = _chan; 413 chan->preference = _preference; 414 chan->reason = _reason; 415 416 if (wpas_mbo_validate_non_pref_chan(chan->oper_class, 417 chan->chan, chan->reason)) { 418 wpa_printf(MSG_ERROR, 419 "Invalid non_pref_chan: oper class %d chan %d reason %d", 420 chan->oper_class, chan->chan, chan->reason); 421 goto fail; 422 } 423 424 for (i = 0; i < num; i++) 425 if (wpa_non_pref_chan_is_eq(chan, &chans[i])) 426 break; 427 if (i != num) { 428 wpa_printf(MSG_ERROR, 429 "oper class %d chan %d is duplicated", 430 chan->oper_class, chan->chan); 431 goto fail; 432 } 433 434 num++; 435 } 436 437 os_free(cmd); 438 439 if (chans) { 440 qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel), 441 wpa_non_pref_chan_cmp); 442 } 443 444 update: 445 os_free(wpa_s->non_pref_chan); 446 wpa_s->non_pref_chan = chans; 447 wpa_s->non_pref_chan_num = num; 448 wpas_mbo_non_pref_chan_changed(wpa_s); 449 450 return 0; 451 452 fail: 453 os_free(chans); 454 os_free(cmd); 455 return -1; 456 } 457 458 wpas_mbo_scan_ie(struct wpa_supplicant * wpa_s,struct wpabuf * ie)459 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie) 460 { 461 u8 *len; 462 463 if (wpa_s->drv_max_probe_req_ie_len < 464 9 + ((wpa_s->enable_oce & OCE_STA) ? 3 : 0)) 465 return; 466 467 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC); 468 len = wpabuf_put(ie, 1); 469 470 wpabuf_put_be24(ie, OUI_WFA); 471 wpabuf_put_u8(ie, MBO_OUI_TYPE); 472 473 wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA); 474 wpabuf_put_u8(ie, 1); 475 wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa); 476 if (wpa_s->enable_oce & OCE_STA) { 477 wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND); 478 wpabuf_put_u8(ie, 1); 479 wpabuf_put_u8(ie, OCE_RELEASE); 480 } 481 *len = (u8 *) wpabuf_put(ie, 0) - len - 1; 482 } 483 484 wpas_mbo_ie_trans_req(struct wpa_supplicant * wpa_s,const u8 * mbo_ie,size_t len)485 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie, 486 size_t len) 487 { 488 const u8 *pos, *cell_pref = NULL; 489 u8 id, elen; 490 u16 disallowed_sec = 0; 491 492 if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA || 493 mbo_ie[3] != MBO_OUI_TYPE) 494 return; 495 496 pos = mbo_ie + 4; 497 len -= 4; 498 499 while (len >= 2) { 500 id = *pos++; 501 elen = *pos++; 502 len -= 2; 503 504 if (elen > len) 505 goto fail; 506 507 switch (id) { 508 case MBO_ATTR_ID_CELL_DATA_PREF: 509 if (elen != 1) 510 goto fail; 511 512 if (wpa_s->conf->mbo_cell_capa == 513 MBO_CELL_CAPA_AVAILABLE) 514 cell_pref = pos; 515 else 516 wpa_printf(MSG_DEBUG, 517 "MBO: Station does not support Cellular data connection"); 518 break; 519 case MBO_ATTR_ID_TRANSITION_REASON: 520 if (elen != 1) 521 goto fail; 522 523 wpa_s->wnm_mbo_trans_reason_present = 1; 524 wpa_s->wnm_mbo_transition_reason = *pos; 525 break; 526 case MBO_ATTR_ID_ASSOC_RETRY_DELAY: 527 if (elen != 2) 528 goto fail; 529 530 if (wpa_s->wnm_mode & 531 WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) { 532 wpa_printf(MSG_DEBUG, 533 "MBO: Unexpected association retry delay, BSS is terminating"); 534 goto fail; 535 } else if (wpa_s->wnm_mode & 536 WNM_BSS_TM_REQ_DISASSOC_IMMINENT) { 537 disallowed_sec = WPA_GET_LE16(pos); 538 wpa_printf(MSG_DEBUG, 539 "MBO: Association retry delay: %u", 540 disallowed_sec); 541 } else { 542 wpa_printf(MSG_DEBUG, 543 "MBO: Association retry delay attribute not in disassoc imminent mode"); 544 } 545 546 break; 547 case MBO_ATTR_ID_AP_CAPA_IND: 548 case MBO_ATTR_ID_NON_PREF_CHAN_REPORT: 549 case MBO_ATTR_ID_CELL_DATA_CAPA: 550 case MBO_ATTR_ID_ASSOC_DISALLOW: 551 case MBO_ATTR_ID_TRANSITION_REJECT_REASON: 552 wpa_printf(MSG_DEBUG, 553 "MBO: Attribute %d should not be included in BTM Request frame", 554 id); 555 break; 556 default: 557 wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u", 558 id); 559 return; 560 } 561 562 pos += elen; 563 len -= elen; 564 } 565 566 if (cell_pref) 567 wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u", 568 *cell_pref); 569 570 if (wpa_s->wnm_mbo_trans_reason_present) 571 wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u", 572 wpa_s->wnm_mbo_transition_reason); 573 574 if (disallowed_sec && wpa_s->current_bss) 575 wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid, 576 disallowed_sec, 0); 577 578 return; 579 fail: 580 wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)", 581 id, elen, len); 582 } 583 584 wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant * wpa_s,u8 * pos,size_t len,enum mbo_transition_reject_reason reason)585 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos, 586 size_t len, 587 enum mbo_transition_reject_reason reason) 588 { 589 u8 reject_attr[3]; 590 591 reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON; 592 reject_attr[1] = 1; 593 reject_attr[2] = reason; 594 595 return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr)); 596 } 597 598 wpas_mbo_update_cell_capa(struct wpa_supplicant * wpa_s,u8 mbo_cell_capa)599 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa) 600 { 601 u8 cell_capa[7]; 602 603 if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) { 604 wpa_printf(MSG_DEBUG, 605 "MBO: Cellular capability already set to %u", 606 mbo_cell_capa); 607 return; 608 } 609 610 wpa_s->conf->mbo_cell_capa = mbo_cell_capa; 611 612 cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC; 613 cell_capa[1] = 5; /* Length */ 614 WPA_PUT_BE24(cell_capa + 2, OUI_WFA); 615 cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA; 616 cell_capa[6] = mbo_cell_capa; 617 618 wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7); 619 wpa_supplicant_set_default_scan_ies(wpa_s); 620 wpas_update_mbo_connect_params(wpa_s); 621 } 622 623 mbo_build_anqp_buf(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,u32 mbo_subtypes)624 struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s, 625 struct wpa_bss *bss, u32 mbo_subtypes) 626 { 627 struct wpabuf *anqp_buf; 628 u8 *len_pos; 629 u8 i; 630 631 if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) { 632 wpa_printf(MSG_INFO, "MBO: " MACSTR 633 " does not support MBO - cannot request MBO ANQP elements from it", 634 MAC2STR(bss->bssid)); 635 return NULL; 636 } 637 638 /* Allocate size for the maximum case - all MBO subtypes are set */ 639 anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE); 640 if (!anqp_buf) 641 return NULL; 642 643 len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC); 644 wpabuf_put_be24(anqp_buf, OUI_WFA); 645 wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE); 646 647 wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST); 648 649 /* The first valid MBO subtype is 1 */ 650 for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) { 651 if (mbo_subtypes & BIT(i)) 652 wpabuf_put_u8(anqp_buf, i); 653 } 654 655 gas_anqp_set_element_len(anqp_buf, len_pos); 656 657 return anqp_buf; 658 } 659 660 mbo_parse_rx_anqp_resp(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,const u8 * sa,const u8 * data,size_t slen)661 void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s, 662 struct wpa_bss *bss, const u8 *sa, 663 const u8 *data, size_t slen) 664 { 665 const u8 *pos = data; 666 u8 subtype; 667 668 if (slen < 1) 669 return; 670 671 subtype = *pos++; 672 slen--; 673 674 switch (subtype) { 675 case MBO_ANQP_SUBTYPE_CELL_CONN_PREF: 676 if (slen < 1) 677 break; 678 wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR 679 " cell_conn_pref=%u", MAC2STR(sa), *pos); 680 break; 681 default: 682 wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u", 683 subtype); 684 break; 685 } 686 } 687