1 /*
2 * wpa_supplicant - SME
3 * Copyright (c) 2009-2024, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/eloop.h"
13 #include "utils/ext_password.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/ieee802_11_common.h"
16 #include "common/ocv.h"
17 #include "eapol_supp/eapol_supp_sm.h"
18 #include "common/wpa_common.h"
19 #include "common/sae.h"
20 #include "common/dpp.h"
21 #include "rsn_supp/wpa.h"
22 #include "rsn_supp/pmksa_cache.h"
23 #include "config.h"
24 #include "wpa_supplicant_i.h"
25 #include "driver_i.h"
26 #include "wpas_glue.h"
27 #include "wps_supplicant.h"
28 #include "p2p_supplicant.h"
29 #include "notify.h"
30 #include "bss.h"
31 #include "bssid_ignore.h"
32 #include "scan.h"
33 #include "sme.h"
34 #include "hs20_supplicant.h"
35
36 #define SME_AUTH_TIMEOUT 5
37 #define SME_ASSOC_TIMEOUT 5
38
39 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
40 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
41 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
42 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
43
44
45 #ifdef CONFIG_SAE
46
index_within_array(const int * array,int idx)47 static int index_within_array(const int *array, int idx)
48 {
49 int i;
50 for (i = 0; i < idx; i++) {
51 if (array[i] <= 0)
52 return 0;
53 }
54 return 1;
55 }
56
57
sme_set_sae_group(struct wpa_supplicant * wpa_s,bool external)58 static int sme_set_sae_group(struct wpa_supplicant *wpa_s, bool external)
59 {
60 int *groups = wpa_s->conf->sae_groups;
61 int default_groups[] = { 19, 20, 21, 0 };
62
63 if (!groups || groups[0] <= 0)
64 groups = default_groups;
65
66 /* Configuration may have changed, so validate current index */
67 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
68 return -1;
69
70 for (;;) {
71 int group = groups[wpa_s->sme.sae_group_index];
72 if (group <= 0)
73 break;
74 if (!int_array_includes(wpa_s->sme.sae_rejected_groups,
75 group) &&
76 sae_set_group(&wpa_s->sme.sae, group) == 0) {
77 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
78 wpa_s->sme.sae.group);
79 wpa_s->sme.sae.akmp = external ?
80 wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
81 return 0;
82 }
83 wpa_s->sme.sae_group_index++;
84 }
85
86 return -1;
87 }
88
89
sme_auth_build_sae_commit(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,const u8 * bssid,const u8 * mld_addr,int external,int reuse,int * ret_use_pt,bool * ret_use_pk)90 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
91 struct wpa_ssid *ssid,
92 const u8 *bssid,
93 const u8 *mld_addr,
94 int external,
95 int reuse, int *ret_use_pt,
96 bool *ret_use_pk)
97 {
98 struct wpabuf *buf;
99 size_t len;
100 char *password = NULL;
101 struct wpa_bss *bss;
102 int use_pt = 0;
103 bool use_pk = false;
104 u8 rsnxe_capa = 0;
105 int key_mgmt = external ? wpa_s->sme.ext_auth_key_mgmt :
106 wpa_s->key_mgmt;
107 const u8 *addr = mld_addr ? mld_addr : bssid;
108 enum sae_pwe sae_pwe;
109
110 if (ret_use_pt)
111 *ret_use_pt = 0;
112 if (ret_use_pk)
113 *ret_use_pk = false;
114
115 #ifdef CONFIG_TESTING_OPTIONS
116 if (wpa_s->sae_commit_override) {
117 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
118 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
119 if (!buf)
120 goto fail;
121 if (!external) {
122 wpabuf_put_le16(buf, 1); /* Transaction seq# */
123 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
124 }
125 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
126 return buf;
127 }
128 #endif /* CONFIG_TESTING_OPTIONS */
129
130 if (ssid->sae_password) {
131 password = os_strdup(ssid->sae_password);
132 if (!password) {
133 wpa_dbg(wpa_s, MSG_INFO,
134 "SAE: Failed to allocate password");
135 goto fail;
136 }
137 }
138 if (!password && ssid->passphrase) {
139 password = os_strdup(ssid->passphrase);
140 if (!password) {
141 wpa_dbg(wpa_s, MSG_INFO,
142 "SAE: Failed to allocate password");
143 goto fail;
144 }
145 }
146 if (!password && ssid->ext_psk) {
147 struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
148 ssid->ext_psk);
149
150 if (!pw) {
151 wpa_msg(wpa_s, MSG_INFO,
152 "SAE: No password found from external storage");
153 goto fail;
154 }
155
156 password = os_malloc(wpabuf_len(pw) + 1);
157 if (!password) {
158 wpa_dbg(wpa_s, MSG_INFO,
159 "SAE: Failed to allocate password");
160 goto fail;
161 }
162 os_memcpy(password, wpabuf_head(pw), wpabuf_len(pw));
163 password[wpabuf_len(pw)] = '\0';
164 ext_password_free(pw);
165 }
166 if (!password) {
167 wpa_printf(MSG_DEBUG, "SAE: No password available");
168 goto fail;
169 }
170
171 if (reuse && wpa_s->sme.sae.tmp &&
172 ether_addr_equal(addr, wpa_s->sme.sae.tmp->bssid)) {
173 wpa_printf(MSG_DEBUG,
174 "SAE: Reuse previously generated PWE on a retry with the same AP");
175 use_pt = wpa_s->sme.sae.h2e;
176 use_pk = wpa_s->sme.sae.pk;
177 goto reuse_data;
178 }
179 if (sme_set_sae_group(wpa_s, external) < 0) {
180 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
181 goto fail;
182 }
183
184 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
185 if (!bss) {
186 wpa_printf(MSG_DEBUG,
187 "SAE: BSS not available, update scan result to get BSS");
188 wpa_supplicant_update_scan_results(wpa_s, bssid);
189 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
190 }
191 if (bss) {
192 const u8 *rsnxe;
193
194 rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
195 if (rsnxe && rsnxe[0] == WLAN_EID_VENDOR_SPECIFIC &&
196 rsnxe[1] >= 1 + 4)
197 rsnxe_capa = rsnxe[2 + 4];
198 else if (rsnxe && rsnxe[1] >= 1)
199 rsnxe_capa = rsnxe[2];
200 }
201
202 sae_pwe = wpas_get_ssid_sae_pwe(wpa_s, ssid);
203
204 if (ssid->sae_password_id &&
205 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
206 use_pt = 1;
207 if (wpa_key_mgmt_sae_ext_key(key_mgmt) &&
208 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
209 use_pt = 1;
210 if (bss && is_6ghz_freq(bss->freq) &&
211 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
212 use_pt = 1;
213 #ifdef CONFIG_SAE_PK
214 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
215 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
216 ((ssid->sae_password &&
217 sae_pk_valid_password(ssid->sae_password)) ||
218 (!ssid->sae_password && ssid->passphrase &&
219 sae_pk_valid_password(ssid->passphrase)))) {
220 use_pt = 1;
221 use_pk = true;
222 }
223
224 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
225 wpa_printf(MSG_DEBUG,
226 "SAE: Cannot use PK with the selected AP");
227 goto fail;
228 }
229 #endif /* CONFIG_SAE_PK */
230
231 if (use_pt || sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
232 sae_pwe == SAE_PWE_BOTH) {
233 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
234
235 if ((sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
236 ssid->sae_password_id ||
237 wpa_key_mgmt_sae_ext_key(key_mgmt)) &&
238 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK &&
239 !use_pt) {
240 wpa_printf(MSG_DEBUG,
241 "SAE: Cannot use H2E with the selected AP");
242 goto fail;
243 }
244 }
245
246 if (use_pt && !ssid->pt)
247 wpa_s_setup_sae_pt(wpa_s, ssid, true);
248 if (use_pt &&
249 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
250 wpa_s->own_addr, addr,
251 wpa_s->sme.sae_rejected_groups, NULL) < 0)
252 goto fail;
253 if (!use_pt &&
254 sae_prepare_commit(wpa_s->own_addr, addr,
255 (u8 *) password, os_strlen(password),
256 &wpa_s->sme.sae) < 0) {
257 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
258 goto fail;
259 }
260 if (wpa_s->sme.sae.tmp) {
261 os_memcpy(wpa_s->sme.sae.tmp->bssid, addr, ETH_ALEN);
262 if (use_pt && use_pk)
263 wpa_s->sme.sae.pk = 1;
264 #ifdef CONFIG_SAE_PK
265 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
266 ETH_ALEN);
267 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, addr, ETH_ALEN);
268 sae_pk_set_password(&wpa_s->sme.sae, password);
269 #endif /* CONFIG_SAE_PK */
270 }
271
272 reuse_data:
273 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
274 if (ssid->sae_password_id)
275 len += 4 + os_strlen(ssid->sae_password_id);
276 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
277 if (buf == NULL)
278 goto fail;
279 if (!external) {
280 wpabuf_put_le16(buf, 1); /* Transaction seq# */
281 if (use_pk)
282 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
283 else if (use_pt)
284 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
285 else
286 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
287 }
288 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
289 ssid->sae_password_id) < 0) {
290 wpabuf_free(buf);
291 goto fail;
292 }
293 if (ret_use_pt)
294 *ret_use_pt = use_pt;
295 if (ret_use_pk)
296 *ret_use_pk = use_pk;
297
298 str_clear_free(password);
299 return buf;
300
301 fail:
302 str_clear_free(password);
303 return NULL;
304 }
305
306
sme_auth_build_sae_confirm(struct wpa_supplicant * wpa_s,int external)307 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
308 int external)
309 {
310 struct wpabuf *buf;
311
312 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
313 if (buf == NULL)
314 return NULL;
315
316 if (!external) {
317 wpabuf_put_le16(buf, 2); /* Transaction seq# */
318 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
319 }
320 sae_write_confirm(&wpa_s->sme.sae, buf);
321
322 return buf;
323 }
324
325 #endif /* CONFIG_SAE */
326
327
328 /**
329 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
330 * @wpa_s: Pointer to wpa_supplicant data
331 * @bss: Pointer to the bss which is the target of authentication attempt
332 */
sme_auth_handle_rrm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)333 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
334 struct wpa_bss *bss)
335 {
336 const u8 rrm_ie_len = 5;
337 u8 *pos;
338 const u8 *rrm_ie;
339
340 wpa_s->rrm.rrm_used = 0;
341
342 wpa_printf(MSG_DEBUG,
343 "RRM: Determining whether RRM can be used - device support: 0x%x",
344 wpa_s->drv_rrm_flags);
345
346 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
347 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
348 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
349 return;
350 }
351
352 if (!((wpa_s->drv_rrm_flags &
353 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
354 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
355 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
356 wpa_printf(MSG_DEBUG,
357 "RRM: Insufficient RRM support in driver - do not use RRM");
358 return;
359 }
360
361 if (sizeof(wpa_s->sme.assoc_req_ie) <
362 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
363 wpa_printf(MSG_INFO,
364 "RRM: Unable to use RRM, no room for RRM IE");
365 return;
366 }
367
368 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
369 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
370 os_memset(pos, 0, 2 + rrm_ie_len);
371 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
372 *pos++ = rrm_ie_len;
373
374 /* Set supported capabilities flags */
375 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
376 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
377
378 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
379 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
380 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
381
382 if (wpa_s->lci)
383 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
384
385 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
386 wpa_s->rrm.rrm_used = 1;
387 }
388
389
wpas_ml_handle_removed_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)390 static void wpas_ml_handle_removed_links(struct wpa_supplicant *wpa_s,
391 struct wpa_bss *bss)
392 {
393 u16 removed_links = wpa_bss_parse_reconf_ml_element(wpa_s, bss);
394
395 wpa_s->valid_links &= ~removed_links;
396 }
397
398
399 #ifdef CONFIG_TESTING_OPTIONS
wpas_ml_connect_pref(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)400 static struct wpa_bss * wpas_ml_connect_pref(struct wpa_supplicant *wpa_s,
401 struct wpa_bss *bss,
402 struct wpa_ssid *ssid)
403 {
404 unsigned int low, high, i;
405
406 wpa_printf(MSG_DEBUG,
407 "MLD: valid_links=%d, band_pref=%u, bssid_pref=" MACSTR,
408 wpa_s->valid_links,
409 wpa_s->conf->mld_connect_band_pref,
410 MAC2STR(wpa_s->conf->mld_connect_bssid_pref));
411
412 /* Check if there are more than one link */
413 if (!(wpa_s->valid_links & (wpa_s->valid_links - 1)))
414 return bss;
415
416 if (!is_zero_ether_addr(wpa_s->conf->mld_connect_bssid_pref)) {
417 for_each_link(wpa_s->valid_links, i) {
418 if (wpa_s->mlo_assoc_link_id == i)
419 continue;
420
421 if (ether_addr_equal(
422 wpa_s->links[i].bssid,
423 wpa_s->conf->mld_connect_bssid_pref))
424 goto found;
425 }
426 }
427
428 if (wpa_s->conf->mld_connect_band_pref == MLD_CONNECT_BAND_PREF_AUTO)
429 return bss;
430
431 switch (wpa_s->conf->mld_connect_band_pref) {
432 case MLD_CONNECT_BAND_PREF_2GHZ:
433 low = 2412;
434 high = 2472;
435 break;
436 case MLD_CONNECT_BAND_PREF_5GHZ:
437 low = 5180;
438 high = 5985;
439 break;
440 case MLD_CONNECT_BAND_PREF_6GHZ:
441 low = 5955;
442 high = 7125;
443 break;
444 default:
445 return bss;
446 }
447
448 for_each_link(wpa_s->valid_links, i) {
449 if (wpa_s->mlo_assoc_link_id == i)
450 continue;
451
452 if (wpa_s->links[i].freq >= low && wpa_s->links[i].freq <= high)
453 goto found;
454 }
455
456 found:
457 if (i == MAX_NUM_MLD_LINKS) {
458 wpa_printf(MSG_DEBUG, "MLD: No match for connect/band pref");
459 return bss;
460 }
461
462 wpa_printf(MSG_DEBUG,
463 "MLD: Change BSS for connect: " MACSTR " -> " MACSTR,
464 MAC2STR(wpa_s->links[wpa_s->mlo_assoc_link_id].bssid),
465 MAC2STR(wpa_s->links[i].bssid));
466
467 /* Get the BSS entry and do the switch */
468 if (ssid && ssid->ssid_len)
469 bss = wpa_bss_get(wpa_s, wpa_s->links[i].bssid, ssid->ssid,
470 ssid->ssid_len);
471 else
472 bss = wpa_bss_get_bssid(wpa_s, wpa_s->links[i].bssid);
473 wpa_s->mlo_assoc_link_id = i;
474
475 return bss;
476 }
477 #endif /* CONFIG_TESTING_OPTIONS */
478
479
wpas_sme_ml_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data,int ie_offset)480 static int wpas_sme_ml_auth(struct wpa_supplicant *wpa_s,
481 union wpa_event_data *data,
482 int ie_offset)
483 {
484 struct ieee802_11_elems elems;
485 const u8 *mld_addr;
486 u16 status_code = data->auth.status_code;
487
488 if (!wpa_s->valid_links)
489 return 0;
490
491 if (ieee802_11_parse_elems(data->auth.ies + ie_offset,
492 data->auth.ies_len - ie_offset,
493 &elems, 0) == ParseFailed) {
494 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
495 return -1;
496 }
497
498 if (!elems.basic_mle || !elems.basic_mle_len) {
499 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
500 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
501 status_code == WLAN_STATUS_SUCCESS ||
502 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
503 status_code == WLAN_STATUS_SAE_PK)
504 return -1;
505 /* Accept missing Multi-Link element in failed authentication
506 * cases. */
507 return 0;
508 }
509
510 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
511 if (!mld_addr)
512 return -1;
513
514 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
515
516 if (!ether_addr_equal(wpa_s->ap_mld_addr, mld_addr)) {
517 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
518 MACSTR ")", MAC2STR(wpa_s->ap_mld_addr));
519 return -1;
520 }
521
522 return 0;
523 }
524
525
wpas_sme_set_mlo_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)526 static void wpas_sme_set_mlo_links(struct wpa_supplicant *wpa_s,
527 struct wpa_bss *bss, struct wpa_ssid *ssid)
528 {
529 u8 i;
530
531 wpa_s->valid_links = 0;
532 wpa_s->mlo_assoc_link_id = bss->mld_link_id;
533
534 for_each_link(bss->valid_links, i) {
535 const u8 *bssid = bss->mld_links[i].bssid;
536
537 wpa_s->valid_links |= BIT(i);
538 os_memcpy(wpa_s->links[i].bssid, bssid, ETH_ALEN);
539 wpa_s->links[i].freq = bss->mld_links[i].freq;
540 wpa_s->links[i].disabled = bss->mld_links[i].disabled;
541
542 if (bss->mld_link_id == i)
543 wpa_s->links[i].bss = bss;
544 else if (ssid && ssid->ssid_len)
545 wpa_s->links[i].bss = wpa_bss_get(wpa_s, bssid,
546 ssid->ssid,
547 ssid->ssid_len);
548 else
549 wpa_s->links[i].bss = wpa_bss_get_bssid(wpa_s, bssid);
550 }
551 }
552
553
sme_add_assoc_req_ie(struct wpa_supplicant * wpa_s,const struct wpabuf * buf)554 static void sme_add_assoc_req_ie(struct wpa_supplicant *wpa_s,
555 const struct wpabuf *buf)
556 {
557 size_t len;
558 u8 *pos, *end;
559
560 if (!buf)
561 return;
562
563 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
564 end = wpa_s->sme.assoc_req_ie + sizeof(wpa_s->sme.assoc_req_ie);
565 if (pos >= end)
566 return;
567
568 len = wpabuf_len(buf);
569 if (len < (size_t) (end - pos)) {
570 os_memcpy(pos, wpabuf_head(buf), len);
571 wpa_s->sme.assoc_req_ie_len += len;
572 }
573 }
574
575
sme_send_authentication(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,int start)576 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
577 struct wpa_bss *bss, struct wpa_ssid *ssid,
578 int start)
579 {
580 struct wpa_driver_auth_params params;
581 struct wpa_ssid *old_ssid;
582 #ifdef CONFIG_IEEE80211R
583 const u8 *ie;
584 #endif /* CONFIG_IEEE80211R */
585 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
586 const u8 *md = NULL;
587 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
588 int bssid_changed;
589 struct wpabuf *resp = NULL;
590 u8 ext_capab[18];
591 int ext_capab_len;
592 int skip_auth;
593 u8 *wpa_ie;
594 size_t wpa_ie_len;
595 #ifdef CONFIG_MBO
596 const u8 *mbo_ie;
597 #endif /* CONFIG_MBO */
598 int omit_rsnxe = 0;
599
600 if (bss == NULL) {
601 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
602 "the network");
603 wpas_connect_work_done(wpa_s);
604 return;
605 }
606
607 os_memset(¶ms, 0, sizeof(params));
608
609 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
610 !wpa_bss_parse_basic_ml_element(wpa_s, bss, wpa_s->ap_mld_addr,
611 NULL, ssid, NULL) &&
612 bss->valid_links) {
613 wpa_printf(MSG_DEBUG, "MLD: In authentication");
614 wpas_sme_set_mlo_links(wpa_s, bss, ssid);
615
616 #ifdef CONFIG_TESTING_OPTIONS
617 bss = wpas_ml_connect_pref(wpa_s, bss, ssid);
618
619 if (wpa_s->conf->mld_force_single_link) {
620 wpa_printf(MSG_DEBUG, "MLD: Force single link");
621 wpa_s->valid_links = BIT(wpa_s->mlo_assoc_link_id);
622 }
623 #endif /* CONFIG_TESTING_OPTIONS */
624 params.mld = true;
625 params.mld_link_id = wpa_s->mlo_assoc_link_id;
626 params.ap_mld_addr = wpa_s->ap_mld_addr;
627 wpas_ml_handle_removed_links(wpa_s, bss);
628 }
629
630 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
631 wpa_s->reassoc_same_bss;
632 wpa_s->current_bss = bss;
633
634 wpa_s->reassociate = 0;
635
636 params.freq = bss->freq;
637 params.bssid = bss->bssid;
638 params.ssid = bss->ssid;
639 params.ssid_len = bss->ssid_len;
640 params.p2p = ssid->p2p_group;
641
642 if (wpa_s->sme.ssid_len != params.ssid_len ||
643 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
644 wpa_s->sme.prev_bssid_set = 0;
645
646 wpa_s->sme.freq = params.freq;
647 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
648 wpa_s->sme.ssid_len = params.ssid_len;
649
650 params.auth_alg = WPA_AUTH_ALG_OPEN;
651 #ifdef IEEE8021X_EAPOL
652 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
653 if (ssid->leap) {
654 if (ssid->non_leap == 0)
655 params.auth_alg = WPA_AUTH_ALG_LEAP;
656 else
657 params.auth_alg |= WPA_AUTH_ALG_LEAP;
658 }
659 }
660 #endif /* IEEE8021X_EAPOL */
661 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
662 params.auth_alg);
663 if (ssid->auth_alg) {
664 params.auth_alg = ssid->auth_alg;
665 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
666 "0x%x", params.auth_alg);
667 }
668 #ifdef CONFIG_SAE
669 wpa_s->sme.sae_pmksa_caching = 0;
670 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
671 const u8 *rsn;
672 struct wpa_ie_data ied;
673
674 rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
675 if (!rsn) {
676 wpa_dbg(wpa_s, MSG_DEBUG,
677 "SAE enabled, but target BSS does not advertise RSN");
678 #ifdef CONFIG_DPP
679 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
680 (ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
681 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
682 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
683 #endif /* CONFIG_DPP */
684 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
685 wpa_key_mgmt_sae(ied.key_mgmt)) {
686 if (wpas_is_sae_avoided(wpa_s, ssid, &ied)) {
687 wpa_dbg(wpa_s, MSG_DEBUG,
688 "SAE enabled, but disallowing SAE auth_alg without PMF");
689 } else {
690 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
691 params.auth_alg = WPA_AUTH_ALG_SAE;
692 }
693 } else {
694 wpa_dbg(wpa_s, MSG_DEBUG,
695 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
696 }
697 }
698 #endif /* CONFIG_SAE */
699
700 #ifdef CONFIG_WEP
701 {
702 int i;
703
704 for (i = 0; i < NUM_WEP_KEYS; i++) {
705 if (ssid->wep_key_len[i])
706 params.wep_key[i] = ssid->wep_key[i];
707 params.wep_key_len[i] = ssid->wep_key_len[i];
708 }
709 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
710 }
711 #endif /* CONFIG_WEP */
712
713 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
714 wpa_bss_get_rsne(wpa_s, bss, ssid, false)) &&
715 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
716 int try_opportunistic;
717 const u8 *cache_id = NULL;
718
719 try_opportunistic = (ssid->proactive_key_caching < 0 ?
720 wpa_s->conf->okc :
721 ssid->proactive_key_caching) &&
722 (ssid->proto & WPA_PROTO_RSN);
723 #ifdef CONFIG_FILS
724 if (wpa_key_mgmt_fils(ssid->key_mgmt))
725 cache_id = wpa_bss_get_fils_cache_id(bss);
726 #endif /* CONFIG_FILS */
727 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
728 params.mld ? params.ap_mld_addr :
729 bss->bssid,
730 wpa_s->current_ssid,
731 try_opportunistic, cache_id,
732 0, false) == 0)
733 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
734 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
735 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
736 wpa_s->sme.assoc_req_ie,
737 &wpa_s->sme.assoc_req_ie_len,
738 false)) {
739 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
740 "key management and encryption suites");
741 wpas_connect_work_done(wpa_s);
742 return;
743 }
744 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
745 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
746 /*
747 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
748 * use non-WPA since the scan results did not indicate that the
749 * AP is using WPA or WPA2.
750 */
751 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
752 wpa_s->sme.assoc_req_ie_len = 0;
753 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
754 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
755 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
756 wpa_s->sme.assoc_req_ie,
757 &wpa_s->sme.assoc_req_ie_len,
758 false)) {
759 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
760 "key management and encryption suites (no "
761 "scan results)");
762 wpas_connect_work_done(wpa_s);
763 return;
764 }
765 #ifdef CONFIG_WPS
766 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
767 struct wpabuf *wps_ie;
768
769 wpa_s->sme.assoc_req_ie_len = 0;
770 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
771 sme_add_assoc_req_ie(wpa_s, wps_ie);
772 wpabuf_free(wps_ie);
773 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
774 #endif /* CONFIG_WPS */
775 } else {
776 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
777 wpa_s->sme.assoc_req_ie_len = 0;
778 }
779
780 /* In case the WPA vendor IE is used, it should be placed after all the
781 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
782 * defined in the standard. Store the WPA IE so it can later be
783 * inserted at the correct location.
784 */
785 wpa_ie = NULL;
786 wpa_ie_len = 0;
787 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
788 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
789 wpa_s->sme.assoc_req_ie_len);
790 if (wpa_ie) {
791 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
792
793 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
794 wpa_s->sme.assoc_req_ie_len = 0;
795 } else {
796 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
797 wpas_connect_work_done(wpa_s);
798 return;
799 }
800 }
801
802 #ifdef CONFIG_IEEE80211R
803 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
804 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
805 md = ie + 2;
806 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
807 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
808 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
809 md = NULL;
810 if (md) {
811 /* Prepare for the next transition */
812 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
813 }
814
815 if (md) {
816 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
817 md[0], md[1]);
818
819 if (wpa_s->sme.assoc_req_ie_len + 5 <
820 sizeof(wpa_s->sme.assoc_req_ie)) {
821 struct rsn_mdie *mdie;
822 u8 *pos = wpa_s->sme.assoc_req_ie +
823 wpa_s->sme.assoc_req_ie_len;
824 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
825 *pos++ = sizeof(*mdie);
826 mdie = (struct rsn_mdie *) pos;
827 os_memcpy(mdie->mobility_domain, md,
828 MOBILITY_DOMAIN_ID_LEN);
829 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
830 wpa_s->sme.assoc_req_ie_len += 5;
831 }
832
833 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
834 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
835 wpa_sm_has_ft_keys(wpa_s->wpa, md)) {
836 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
837 "over-the-air");
838 omit_rsnxe = !wpa_bss_get_rsnxe(wpa_s, bss, ssid,
839 false);
840 params.auth_alg = WPA_AUTH_ALG_FT;
841 params.ie = wpa_s->sme.ft_ies;
842 params.ie_len = wpa_s->sme.ft_ies_len;
843 }
844 }
845 #endif /* CONFIG_IEEE80211R */
846
847 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
848 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
849 const u8 *rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
850 struct wpa_ie_data _ie;
851 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
852 _ie.capabilities &
853 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
854 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
855 "MFP: require MFP");
856 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
857 }
858 }
859
860 wpa_s->sme.spp_amsdu = wpa_sm_uses_spp_amsdu(wpa_s->wpa);
861
862 #ifdef CONFIG_P2P
863 if (wpa_s->global->p2p) {
864 u8 *pos;
865 size_t len;
866 int res;
867 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
868 len = sizeof(wpa_s->sme.assoc_req_ie) -
869 wpa_s->sme.assoc_req_ie_len;
870 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
871 ssid->p2p_group);
872 if (res >= 0)
873 wpa_s->sme.assoc_req_ie_len += res;
874 }
875 #endif /* CONFIG_P2P */
876
877 #ifdef CONFIG_FST
878 sme_add_assoc_req_ie(wpa_s, wpa_s->fst_ies);
879 #endif /* CONFIG_FST */
880
881 sme_auth_handle_rrm(wpa_s, bss);
882
883 #ifndef CONFIG_NO_RRM
884 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
885 wpa_s, ssid, bss,
886 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
887 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
888 #endif /* CONFIG_NO_RRM */
889
890 if (params.p2p)
891 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
892 else
893 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
894
895 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
896 sizeof(ext_capab), bss);
897 if (ext_capab_len > 0) {
898 u8 *pos = wpa_s->sme.assoc_req_ie;
899 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
900 pos += 2 + pos[1];
901 os_memmove(pos + ext_capab_len, pos,
902 wpa_s->sme.assoc_req_ie_len -
903 (pos - wpa_s->sme.assoc_req_ie));
904 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
905 os_memcpy(pos, ext_capab, ext_capab_len);
906 }
907
908 if (ssid->max_idle && wpa_s->sme.assoc_req_ie_len + 5 <=
909 sizeof(wpa_s->sme.assoc_req_ie)) {
910 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
911
912 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
913 *pos++ = 3;
914 WPA_PUT_LE16(pos, ssid->max_idle);
915 pos += 2;
916 *pos = 0; /* Idle Options */
917 wpa_s->sme.assoc_req_ie_len += 5;
918 }
919
920 #ifdef CONFIG_TESTING_OPTIONS
921 if (wpa_s->rsnxe_override_assoc) {
922 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
923 sme_add_assoc_req_ie(wpa_s, wpa_s->rsnxe_override_assoc);
924 } else
925 #endif /* CONFIG_TESTING_OPTIONS */
926 if (wpa_s->rsnxe_len > 0 &&
927 wpa_s->rsnxe_len <=
928 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
929 !omit_rsnxe) {
930 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
931 wpa_s->rsnxe, wpa_s->rsnxe_len);
932 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
933 }
934
935 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION &&
936 wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_KNOWN_STA_IDENTIFICATION)) {
937 struct wpabuf *e;
938
939 e = wpa_sm_known_sta_identification(
940 wpa_s->wpa,
941 params.mld ? params.ap_mld_addr : bss->bssid,
942 bss->tsf);
943 if (e) {
944 wpa_printf(MSG_DEBUG,
945 "SME: Add Known STA Identification element");
946 sme_add_assoc_req_ie(wpa_s, e);
947 wpabuf_free(e);
948 }
949 }
950
951 #ifdef CONFIG_HS20
952 if (is_hs20_network(wpa_s, ssid, bss)) {
953 struct wpabuf *hs20;
954
955 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
956 if (hs20) {
957 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
958
959 wpas_hs20_add_indication(hs20, pps_mo_id,
960 get_hs20_version(bss));
961 wpas_hs20_add_roam_cons_sel(hs20, ssid);
962 sme_add_assoc_req_ie(wpa_s, hs20);
963 wpabuf_free(hs20);
964 }
965 }
966 #endif /* CONFIG_HS20 */
967
968 if (wpa_ie) {
969 size_t len;
970
971 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
972
973 len = sizeof(wpa_s->sme.assoc_req_ie) -
974 wpa_s->sme.assoc_req_ie_len;
975
976 if (len > wpa_ie_len) {
977 os_memcpy(wpa_s->sme.assoc_req_ie +
978 wpa_s->sme.assoc_req_ie_len,
979 wpa_ie, wpa_ie_len);
980 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
981 } else {
982 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
983 }
984
985 os_free(wpa_ie);
986 }
987
988 sme_add_assoc_req_ie(wpa_s, wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]);
989
990 #ifdef CONFIG_MBO
991 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
992 if (!wpa_s->disable_mbo_oce && mbo_ie) {
993 int len;
994
995 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
996 wpa_s->sme.assoc_req_ie_len,
997 sizeof(wpa_s->sme.assoc_req_ie) -
998 wpa_s->sme.assoc_req_ie_len,
999 !!mbo_attr_from_mbo_ie(mbo_ie,
1000 OCE_ATTR_ID_CAPA_IND));
1001 if (len >= 0)
1002 wpa_s->sme.assoc_req_ie_len += len;
1003 }
1004 #endif /* CONFIG_MBO */
1005
1006 #ifdef CONFIG_SAE
1007 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
1008 pmksa_cache_set_current(wpa_s->wpa, NULL,
1009 params.mld ? params.ap_mld_addr :
1010 bss->bssid,
1011 ssid, 0,
1012 NULL,
1013 wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
1014 wpa_s->key_mgmt :
1015 (int) WPA_KEY_MGMT_SAE, false) == 0) {
1016 wpa_dbg(wpa_s, MSG_DEBUG,
1017 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
1018 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1019 params.auth_alg = WPA_AUTH_ALG_OPEN;
1020 wpa_s->sme.sae_pmksa_caching = 1;
1021 }
1022
1023 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
1024 if (start)
1025 resp = sme_auth_build_sae_commit(wpa_s, ssid,
1026 bss->bssid,
1027 params.mld ?
1028 params.ap_mld_addr :
1029 NULL, 0,
1030 start == 2, NULL,
1031 NULL);
1032 else
1033 resp = sme_auth_build_sae_confirm(wpa_s, 0);
1034 if (resp == NULL) {
1035 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1036 return;
1037 }
1038 params.auth_data = wpabuf_head(resp);
1039 params.auth_data_len = wpabuf_len(resp);
1040 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
1041 }
1042 #endif /* CONFIG_SAE */
1043
1044 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1045 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1046 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1047 if (bssid_changed)
1048 wpas_notify_bssid_changed(wpa_s);
1049
1050 old_ssid = wpa_s->current_ssid;
1051 wpa_s->current_ssid = ssid;
1052 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
1053 wpa_sm_set_ssid(wpa_s->wpa, bss->ssid, bss->ssid_len);
1054 wpa_supplicant_initiate_eapol(wpa_s);
1055
1056 #ifdef CONFIG_FILS
1057 /* TODO: FILS operations can in some cases be done between different
1058 * network_ctx (i.e., same credentials can be used with multiple
1059 * networks). */
1060 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
1061 wpa_key_mgmt_fils(ssid->key_mgmt)) {
1062 const u8 *indic;
1063 u16 fils_info;
1064 const u8 *realm, *username, *rrk;
1065 size_t realm_len, username_len, rrk_len;
1066 u16 next_seq_num;
1067
1068 /*
1069 * Check FILS Indication element (FILS Information field) bits
1070 * indicating supported authentication algorithms against local
1071 * configuration (ssid->fils_dh_group). Try to use FILS
1072 * authentication only if the AP supports the combination in the
1073 * network profile. */
1074 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
1075 if (!indic || indic[1] < 2) {
1076 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1077 " does not include FILS Indication element - cannot use FILS authentication with it",
1078 MAC2STR(bss->bssid));
1079 goto no_fils;
1080 }
1081
1082 fils_info = WPA_GET_LE16(indic + 2);
1083 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
1084 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1085 " does not support FILS SK without PFS - cannot use FILS authentication with it",
1086 MAC2STR(bss->bssid));
1087 goto no_fils;
1088 }
1089 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
1090 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1091 " does not support FILS SK with PFS - cannot use FILS authentication with it",
1092 MAC2STR(bss->bssid));
1093 goto no_fils;
1094 }
1095
1096 if (wpa_s->last_con_fail_realm &&
1097 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
1098 &username, &username_len,
1099 &realm, &realm_len, &next_seq_num,
1100 &rrk, &rrk_len) == 0 &&
1101 realm && realm_len == wpa_s->last_con_fail_realm_len &&
1102 os_memcmp(realm, wpa_s->last_con_fail_realm,
1103 realm_len) == 0) {
1104 wpa_printf(MSG_DEBUG,
1105 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
1106 goto no_fils;
1107 }
1108
1109 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
1110 params.mld ? params.ap_mld_addr :
1111 bss->bssid,
1112 ssid, 0,
1113 wpa_bss_get_fils_cache_id(bss),
1114 0, false) == 0)
1115 wpa_printf(MSG_DEBUG,
1116 "SME: Try to use FILS with PMKSA caching");
1117 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
1118 if (resp) {
1119 int auth_alg;
1120
1121 if (ssid->fils_dh_group)
1122 wpa_printf(MSG_DEBUG,
1123 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
1124 ssid->fils_dh_group);
1125 else
1126 wpa_printf(MSG_DEBUG,
1127 "SME: Try to use FILS SK authentication without PFS");
1128 auth_alg = ssid->fils_dh_group ?
1129 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
1130 params.auth_alg = auth_alg;
1131 params.auth_data = wpabuf_head(resp);
1132 params.auth_data_len = wpabuf_len(resp);
1133 wpa_s->sme.auth_alg = auth_alg;
1134 }
1135 }
1136 no_fils:
1137 #endif /* CONFIG_FILS */
1138
1139 wpa_supplicant_cancel_sched_scan(wpa_s);
1140 wpa_supplicant_cancel_scan(wpa_s);
1141
1142 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
1143 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
1144 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
1145
1146 eapol_sm_notify_portValid(wpa_s->eapol, false);
1147 wpa_clear_keys(wpa_s, bss->bssid);
1148 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1149 if (old_ssid != wpa_s->current_ssid)
1150 wpas_notify_network_changed(wpa_s);
1151
1152 #ifdef CONFIG_HS20
1153 hs20_configure_frame_filters(wpa_s);
1154 #endif /* CONFIG_HS20 */
1155
1156 #ifdef CONFIG_P2P
1157 /*
1158 * If multi-channel concurrency is not supported, check for any
1159 * frequency conflict. In case of any frequency conflict, remove the
1160 * least prioritized connection.
1161 */
1162 if (wpa_s->num_multichan_concurrent < 2) {
1163 int freq, num;
1164 num = get_shared_radio_freqs(wpa_s, &freq, 1, false);
1165 if (num > 0 && freq > 0 && freq != params.freq) {
1166 wpa_printf(MSG_DEBUG,
1167 "Conflicting frequency found (%d != %d)",
1168 freq, params.freq);
1169 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
1170 params.freq,
1171 ssid) < 0) {
1172 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1173 wpa_supplicant_mark_disassoc(wpa_s);
1174 wpabuf_free(resp);
1175 wpas_connect_work_done(wpa_s);
1176 return;
1177 }
1178 }
1179 }
1180 #endif /* CONFIG_P2P */
1181
1182 if (skip_auth) {
1183 wpa_msg(wpa_s, MSG_DEBUG,
1184 "SME: Skip authentication step on reassoc-to-same-BSS");
1185 wpabuf_free(resp);
1186 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
1187 return;
1188 }
1189
1190
1191 wpa_s->sme.auth_alg = params.auth_alg;
1192 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) {
1193 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
1194 "driver failed");
1195 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1196 wpa_supplicant_mark_disassoc(wpa_s);
1197 wpabuf_free(resp);
1198 wpas_connect_work_done(wpa_s);
1199 return;
1200 }
1201
1202 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
1203 NULL);
1204
1205 /*
1206 * Association will be started based on the authentication event from
1207 * the driver.
1208 */
1209
1210 wpabuf_free(resp);
1211 }
1212
1213
sme_auth_start_cb(struct wpa_radio_work * work,int deinit)1214 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
1215 {
1216 struct wpa_connect_work *cwork = work->ctx;
1217 struct wpa_supplicant *wpa_s = work->wpa_s;
1218
1219 wpa_s->roam_in_progress = false;
1220 #ifdef CONFIG_WNM
1221 wpa_s->bss_trans_mgmt_in_progress = false;
1222 #endif /* CONFIG_WNM */
1223
1224 if (deinit) {
1225 if (work->started)
1226 wpa_s->connect_work = NULL;
1227
1228 wpas_connect_work_free(cwork);
1229 return;
1230 }
1231
1232 wpa_s->connect_work = work;
1233
1234 if (cwork->bss_removed ||
1235 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
1236 wpas_network_disabled(wpa_s, cwork->ssid)) {
1237 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
1238 wpas_connect_work_done(wpa_s);
1239 return;
1240 }
1241
1242 /* Starting new connection, so clear the possibly used WPA IE from the
1243 * previous association. */
1244 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1245 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
1246 wpa_s->rsnxe_len = 0;
1247
1248 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
1249 wpas_notify_auth_changed(wpa_s);
1250 }
1251
1252
sme_authenticate(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)1253 void sme_authenticate(struct wpa_supplicant *wpa_s,
1254 struct wpa_bss *bss, struct wpa_ssid *ssid)
1255 {
1256 struct wpa_connect_work *cwork;
1257
1258 if (bss == NULL || ssid == NULL)
1259 return;
1260 if (wpa_s->connect_work) {
1261 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
1262 return;
1263 }
1264
1265 if (wpa_s->roam_in_progress) {
1266 wpa_dbg(wpa_s, MSG_DEBUG,
1267 "SME: Reject sme_authenticate() in favor of explicit roam request");
1268 return;
1269 }
1270 #ifdef CONFIG_WNM
1271 if (wpa_s->bss_trans_mgmt_in_progress) {
1272 wpa_dbg(wpa_s, MSG_DEBUG,
1273 "SME: Reject sme_authenticate() in favor of BSS transition management request");
1274 return;
1275 }
1276 #endif /* CONFIG_WNM */
1277 if (radio_work_pending(wpa_s, "sme-connect")) {
1278 /*
1279 * The previous sme-connect work might no longer be valid due to
1280 * the fact that the BSS list was updated. In addition, it makes
1281 * sense to adhere to the 'newer' decision.
1282 */
1283 wpa_dbg(wpa_s, MSG_DEBUG,
1284 "SME: Remove previous pending sme-connect");
1285 radio_remove_works(wpa_s, "sme-connect", 0);
1286 }
1287
1288 wpas_abort_ongoing_scan(wpa_s);
1289
1290 cwork = os_zalloc(sizeof(*cwork));
1291 if (cwork == NULL)
1292 return;
1293 cwork->bss = bss;
1294 cwork->ssid = ssid;
1295 cwork->sme = 1;
1296
1297 #ifdef CONFIG_SAE
1298 wpa_s->sme.sae.state = SAE_NOTHING;
1299 wpa_s->sme.sae.send_confirm = 0;
1300 wpa_s->sme.sae_group_index = 0;
1301 #endif /* CONFIG_SAE */
1302
1303 if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
1304 sme_auth_start_cb, cwork) < 0)
1305 wpas_connect_work_free(cwork);
1306 }
1307
1308
1309 #ifdef CONFIG_SAE
1310
1311 #define WPA_AUTH_FRAME_ML_IE_LEN (6 + ETH_ALEN)
1312
wpa_auth_ml_ie(struct wpabuf * buf,const u8 * mld_addr)1313 static void wpa_auth_ml_ie(struct wpabuf *buf, const u8 *mld_addr)
1314 {
1315
1316 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1317 wpabuf_put_u8(buf, 4 + ETH_ALEN);
1318 wpabuf_put_u8(buf, WLAN_EID_EXT_MULTI_LINK);
1319
1320 /* Basic Multi-Link element Control field */
1321 wpabuf_put_u8(buf, 0x0);
1322 wpabuf_put_u8(buf, 0x0);
1323
1324 /* Common Info */
1325 wpabuf_put_u8(buf, 0x7); /* length = Length field + MLD MAC address */
1326 wpabuf_put_data(buf, mld_addr, ETH_ALEN);
1327 }
1328
1329
sme_external_auth_build_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,u16 auth_transaction,u16 seq_num,u16 status_code,const u8 * mld_addr)1330 static int sme_external_auth_build_buf(struct wpabuf *buf,
1331 struct wpabuf *params,
1332 const u8 *sa, const u8 *da,
1333 u16 auth_transaction, u16 seq_num,
1334 u16 status_code, const u8 *mld_addr)
1335 {
1336 struct ieee80211_mgmt *resp;
1337
1338 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
1339 u.auth.variable));
1340
1341 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
1342 (WLAN_FC_STYPE_AUTH << 4));
1343 os_memcpy(resp->da, da, ETH_ALEN);
1344 os_memcpy(resp->sa, sa, ETH_ALEN);
1345 os_memcpy(resp->bssid, da, ETH_ALEN);
1346 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
1347 resp->seq_ctrl = host_to_le16(seq_num << 4);
1348 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
1349 resp->u.auth.status_code = host_to_le16(status_code);
1350 if (params)
1351 wpabuf_put_buf(buf, params);
1352
1353 if (mld_addr)
1354 wpa_auth_ml_ie(buf, mld_addr);
1355
1356 return 0;
1357 }
1358
1359
sme_external_auth_send_sae_commit(struct wpa_supplicant * wpa_s,const u8 * bssid,struct wpa_ssid * ssid)1360 static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
1361 const u8 *bssid,
1362 struct wpa_ssid *ssid)
1363 {
1364 struct wpabuf *resp, *buf;
1365 int use_pt;
1366 bool use_pk;
1367 u16 status;
1368
1369 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid,
1370 wpa_s->sme.ext_ml_auth ?
1371 wpa_s->sme.ext_auth_ap_mld_addr : NULL,
1372 1, 0, &use_pt, &use_pk);
1373 if (!resp) {
1374 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
1375 return -1;
1376 }
1377
1378 wpa_s->sme.sae.state = SAE_COMMITTED;
1379 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp) +
1380 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1381 0));
1382 if (!buf) {
1383 wpabuf_free(resp);
1384 return -1;
1385 }
1386
1387 wpa_s->sme.seq_num++;
1388 if (use_pk)
1389 status = WLAN_STATUS_SAE_PK;
1390 else if (use_pt)
1391 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
1392 else
1393 status = WLAN_STATUS_SUCCESS;
1394 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1395 wpa_s->sme.ext_ml_auth ?
1396 wpa_s->sme.ext_auth_ap_mld_addr : bssid, 1,
1397 wpa_s->sme.seq_num, status,
1398 wpa_s->sme.ext_ml_auth ?
1399 wpa_s->own_addr : NULL);
1400 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1401 wpabuf_free(resp);
1402 wpabuf_free(buf);
1403
1404 return 0;
1405 }
1406
1407
sme_send_external_auth_status(struct wpa_supplicant * wpa_s,u16 status)1408 static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
1409 u16 status)
1410 {
1411 struct external_auth params;
1412
1413 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1414 os_memset(¶ms, 0, sizeof(params));
1415 params.status = status;
1416 params.ssid = wpa_s->sme.ext_auth_ssid;
1417 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
1418 params.bssid = wpa_s->sme.ext_auth_bssid;
1419 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
1420 params.pmkid = wpa_s->sme.sae.pmkid;
1421 wpa_drv_send_external_auth_status(wpa_s, ¶ms);
1422 }
1423
1424
sme_handle_external_auth_start(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1425 static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
1426 union wpa_event_data *data)
1427 {
1428 struct wpa_ssid *ssid;
1429 size_t ssid_str_len = data->external_auth.ssid_len;
1430 const u8 *ssid_str = data->external_auth.ssid;
1431
1432 wpa_s->sme.ext_auth_wpa_ssid = NULL;
1433 /* Get the SSID conf from the ssid string obtained */
1434 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1435 if (!wpas_network_disabled(wpa_s, ssid) &&
1436 ssid_str_len == ssid->ssid_len &&
1437 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
1438 wpa_key_mgmt_sae(ssid->key_mgmt)) {
1439 /* Make sure PT is derived */
1440 wpa_s_setup_sae_pt(wpa_s, ssid, false);
1441 wpa_s->sme.ext_auth_wpa_ssid = ssid;
1442 break;
1443 }
1444 }
1445 if (!ssid ||
1446 sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
1447 ssid) < 0)
1448 return -1;
1449
1450 return 0;
1451 }
1452
1453
sme_external_auth_send_sae_confirm(struct wpa_supplicant * wpa_s,const u8 * da)1454 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
1455 const u8 *da)
1456 {
1457 struct wpabuf *resp, *buf;
1458
1459 resp = sme_auth_build_sae_confirm(wpa_s, 1);
1460 if (!resp) {
1461 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
1462 return;
1463 }
1464
1465 wpa_s->sme.sae.state = SAE_CONFIRMED;
1466 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp) +
1467 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
1468 0));
1469 if (!buf) {
1470 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
1471 wpabuf_free(resp);
1472 return;
1473 }
1474 wpa_s->sme.seq_num++;
1475 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
1476 da, 2, wpa_s->sme.seq_num,
1477 WLAN_STATUS_SUCCESS,
1478 wpa_s->sme.ext_ml_auth ?
1479 wpa_s->own_addr : NULL);
1480
1481 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
1482 wpabuf_free(resp);
1483 wpabuf_free(buf);
1484 }
1485
1486
is_sae_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)1487 static bool is_sae_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
1488 {
1489 /* suite is supposed to be the selector value in host byte order with
1490 * the OUI in three most significant octets. However, the initial
1491 * implementation swapped that byte order and did not work with drivers
1492 * that followed the expected byte order. Keep a workaround here to
1493 * match that initial implementation so that already deployed use cases
1494 * remain functional. */
1495 if (RSN_SELECTOR_GET(&suite) == RSN_AUTH_KEY_MGMT_SAE) {
1496 /* Old drivers which follow initial implementation send SAE AKM
1497 * for both SAE and FT-SAE connections. In that case, determine
1498 * the actual AKM from wpa_s->key_mgmt. */
1499 wpa_s->sme.ext_auth_key_mgmt = wpa_s->key_mgmt;
1500 return true;
1501 }
1502
1503 if (suite == RSN_AUTH_KEY_MGMT_SAE)
1504 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
1505 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE)
1506 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE;
1507 else if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1508 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
1509 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1510 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1511 else
1512 return false;
1513
1514 return true;
1515 }
1516
1517
sme_external_auth_trigger(struct wpa_supplicant * wpa_s,union wpa_event_data * data)1518 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
1519 union wpa_event_data *data)
1520 {
1521 if (!is_sae_key_mgmt_suite(wpa_s, data->external_auth.key_mgmt_suite))
1522 return;
1523
1524 if (data->external_auth.action == EXT_AUTH_START) {
1525 if (!data->external_auth.bssid || !data->external_auth.ssid)
1526 return;
1527 os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
1528 ETH_ALEN);
1529 os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
1530 data->external_auth.ssid_len);
1531 wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
1532 if (data->external_auth.mld_addr) {
1533 wpa_s->sme.ext_ml_auth = true;
1534 os_memcpy(wpa_s->sme.ext_auth_ap_mld_addr,
1535 data->external_auth.mld_addr, ETH_ALEN);
1536 } else {
1537 wpa_s->sme.ext_ml_auth = false;
1538 }
1539 wpa_s->sme.seq_num = 0;
1540 wpa_s->sme.sae.state = SAE_NOTHING;
1541 wpa_s->sme.sae.send_confirm = 0;
1542 wpa_s->sme.sae_group_index = 0;
1543 if (sme_handle_external_auth_start(wpa_s, data) < 0)
1544 sme_send_external_auth_status(wpa_s,
1545 WLAN_STATUS_UNSPECIFIED_FAILURE);
1546 } else if (data->external_auth.action == EXT_AUTH_ABORT) {
1547 /* Report failure to driver for the wrong trigger */
1548 sme_send_external_auth_status(wpa_s,
1549 WLAN_STATUS_UNSPECIFIED_FAILURE);
1550 }
1551 }
1552
1553
sme_sae_is_group_enabled(struct wpa_supplicant * wpa_s,int group)1554 static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
1555 {
1556 int *groups = wpa_s->conf->sae_groups;
1557 int default_groups[] = { 19, 20, 21, 0 };
1558 int i;
1559
1560 if (!groups)
1561 groups = default_groups;
1562
1563 for (i = 0; groups[i] > 0; i++) {
1564 if (groups[i] == group)
1565 return 1;
1566 }
1567
1568 return 0;
1569 }
1570
1571
sme_check_sae_rejected_groups(struct wpa_supplicant * wpa_s,const struct wpabuf * groups)1572 static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
1573 const struct wpabuf *groups)
1574 {
1575 size_t i, count, len;
1576 const u8 *pos;
1577
1578 if (!groups)
1579 return 0;
1580
1581 pos = wpabuf_head(groups);
1582 len = wpabuf_len(groups);
1583 if (len & 1) {
1584 wpa_printf(MSG_DEBUG,
1585 "SAE: Invalid length of the Rejected Groups element payload: %zu",
1586 len);
1587 return 1;
1588 }
1589 count = len / 2;
1590 for (i = 0; i < count; i++) {
1591 int enabled;
1592 u16 group;
1593
1594 group = WPA_GET_LE16(pos);
1595 pos += 2;
1596 enabled = sme_sae_is_group_enabled(wpa_s, group);
1597 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
1598 group, enabled ? "enabled" : "disabled");
1599 if (enabled)
1600 return 1;
1601 }
1602
1603 return 0;
1604 }
1605
1606
sme_external_ml_auth(struct wpa_supplicant * wpa_s,const u8 * data,size_t len,int ie_offset,u16 status_code)1607 static int sme_external_ml_auth(struct wpa_supplicant *wpa_s,
1608 const u8 *data, size_t len, int ie_offset,
1609 u16 status_code)
1610 {
1611 struct ieee802_11_elems elems;
1612 const u8 *mld_addr;
1613
1614 if (ieee802_11_parse_elems(data + ie_offset, len - ie_offset,
1615 &elems, 0) == ParseFailed) {
1616 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
1617 return -1;
1618 }
1619
1620 if (!elems.basic_mle || !elems.basic_mle_len) {
1621 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
1622 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
1623 status_code == WLAN_STATUS_SUCCESS ||
1624 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1625 status_code == WLAN_STATUS_SAE_PK)
1626 return -1;
1627 /* Accept missing Multi-Link element in failed authentication
1628 * cases. */
1629 return 0;
1630 }
1631
1632 mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
1633 if (!mld_addr) {
1634 wpa_printf(MSG_DEBUG, "MLD: No MLD address in ML element");
1635 return -1;
1636 }
1637
1638 wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
1639
1640 if (!ether_addr_equal(wpa_s->sme.ext_auth_ap_mld_addr, mld_addr)) {
1641 wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
1642 MACSTR ")",
1643 MAC2STR(wpa_s->sme.ext_auth_ap_mld_addr));
1644 return -1;
1645 }
1646
1647 return 0;
1648 }
1649
1650
sme_sae_auth(struct wpa_supplicant * wpa_s,u16 auth_transaction,u16 status_code,const u8 * data,size_t len,int external,const u8 * sa,int * ie_offset)1651 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
1652 u16 status_code, const u8 *data, size_t len,
1653 int external, const u8 *sa, int *ie_offset)
1654 {
1655 int *groups;
1656
1657 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
1658 "status code %u", auth_transaction, status_code);
1659
1660 if (auth_transaction == 1 &&
1661 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1662 wpa_s->sme.sae.state == SAE_COMMITTED &&
1663 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1664 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1665 int default_groups[] = { 19, 20, 21, 0 };
1666 u16 group;
1667 const u8 *token_pos;
1668 size_t token_len;
1669 int h2e = 0;
1670
1671 groups = wpa_s->conf->sae_groups;
1672 if (!groups || groups[0] <= 0)
1673 groups = default_groups;
1674
1675 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
1676 data, len);
1677 if (len < sizeof(le16)) {
1678 wpa_dbg(wpa_s, MSG_DEBUG,
1679 "SME: Too short SAE anti-clogging token request");
1680 return -1;
1681 }
1682 group = WPA_GET_LE16(data);
1683 wpa_dbg(wpa_s, MSG_DEBUG,
1684 "SME: SAE anti-clogging token requested (group %u)",
1685 group);
1686 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
1687 WLAN_STATUS_SUCCESS) {
1688 wpa_dbg(wpa_s, MSG_ERROR,
1689 "SME: SAE group %u of anti-clogging request is invalid",
1690 group);
1691 return -1;
1692 }
1693 wpabuf_free(wpa_s->sme.sae_token);
1694 token_pos = data + sizeof(le16);
1695 token_len = len - sizeof(le16);
1696 h2e = wpa_s->sme.sae.h2e;
1697 if (h2e) {
1698 u8 id, elen, extid;
1699
1700 if (token_len < 3) {
1701 wpa_dbg(wpa_s, MSG_DEBUG,
1702 "SME: Too short SAE anti-clogging token container");
1703 return -1;
1704 }
1705 id = *token_pos++;
1706 elen = *token_pos++;
1707 extid = *token_pos++;
1708 if (id != WLAN_EID_EXTENSION ||
1709 elen == 0 || elen > token_len - 2 ||
1710 extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
1711 wpa_dbg(wpa_s, MSG_DEBUG,
1712 "SME: Invalid SAE anti-clogging token container header");
1713 return -1;
1714 }
1715 token_len = elen - 1;
1716 #ifdef CONFIG_IEEE80211BE
1717 } else if ((wpa_s->valid_links ||
1718 (external && wpa_s->sme.ext_ml_auth)) &&
1719 token_len > 12 &&
1720 token_pos[token_len - 12] == WLAN_EID_EXTENSION &&
1721 token_pos[token_len - 11] == 10 &&
1722 token_pos[token_len - 10] ==
1723 WLAN_EID_EXT_MULTI_LINK) {
1724 /* IEEE P802.11be requires H2E to be used whenever SAE
1725 * is used for ML association. However, some early
1726 * Wi-Fi 7 APs enable MLO without H2E. Recognize this
1727 * special case based on the fixed length Basic
1728 * Multi-Link element being at the end of the data that
1729 * would contain the unknown variable length
1730 * Anti-Clogging Token field. The Basic Multi-Link
1731 * element in Authentication frames include the MLD MAC
1732 * addreess in the Common Info field and all subfields
1733 * of the Presence Bitmap subfield of the Multi-Link
1734 * Control field of the element zero and consequently,
1735 * has a fixed length of 12 octets. */
1736 wpa_printf(MSG_DEBUG,
1737 "SME: Detected Basic Multi-Link element at the end of Anti-Clogging Token field");
1738 token_len -= 12;
1739 #endif /* CONFIG_IEEE80211BE */
1740 }
1741
1742 *ie_offset = token_pos + token_len - data;
1743
1744 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
1745 if (!wpa_s->sme.sae_token) {
1746 wpa_dbg(wpa_s, MSG_ERROR,
1747 "SME: Failed to allocate SAE token");
1748 return -1;
1749 }
1750
1751 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
1752 wpa_s->sme.sae_token);
1753 if (!external) {
1754 sme_send_authentication(wpa_s, wpa_s->current_bss,
1755 wpa_s->current_ssid, 2);
1756 } else {
1757 if (wpa_s->sme.ext_ml_auth &&
1758 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1759 status_code))
1760 return -1;
1761
1762 sme_external_auth_send_sae_commit(
1763 wpa_s, wpa_s->sme.ext_auth_bssid,
1764 wpa_s->sme.ext_auth_wpa_ssid);
1765 }
1766 return 0;
1767 }
1768
1769 if (auth_transaction == 1 &&
1770 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1771 wpa_s->sme.sae.state == SAE_COMMITTED &&
1772 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
1773 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
1774 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
1775 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
1776 wpa_s->sme.sae.group);
1777 wpa_s->sme.sae_group_index++;
1778 if (sme_set_sae_group(wpa_s, external) < 0)
1779 return -1; /* no other groups enabled */
1780 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
1781 if (!external) {
1782 sme_send_authentication(wpa_s, wpa_s->current_bss,
1783 wpa_s->current_ssid, 1);
1784 } else {
1785 if (wpa_s->sme.ext_ml_auth &&
1786 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1787 status_code))
1788 return -1;
1789
1790 sme_external_auth_send_sae_commit(
1791 wpa_s, wpa_s->sme.ext_auth_bssid,
1792 wpa_s->sme.ext_auth_wpa_ssid);
1793 }
1794 return 0;
1795 }
1796
1797 if (auth_transaction == 1 &&
1798 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1799 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1800
1801 wpa_msg(wpa_s, MSG_INFO,
1802 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
1803 MAC2STR(bssid));
1804 return -1;
1805 }
1806
1807 if (status_code != WLAN_STATUS_SUCCESS &&
1808 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
1809 status_code != WLAN_STATUS_SAE_PK) {
1810 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
1811
1812 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
1813 " auth_type=%u auth_transaction=%u status_code=%u",
1814 MAC2STR(bssid), WLAN_AUTH_SAE,
1815 auth_transaction, status_code);
1816 return -2;
1817 }
1818
1819 if (auth_transaction == 1) {
1820 u16 res;
1821
1822 groups = wpa_s->conf->sae_groups;
1823
1824 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
1825 if ((external && !wpa_s->sme.ext_auth_wpa_ssid) ||
1826 (!external &&
1827 (!wpa_s->current_bss || !wpa_s->current_ssid)))
1828 return -1;
1829 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
1830 wpa_printf(MSG_DEBUG,
1831 "SAE: Ignore commit message while waiting for confirm");
1832 return 0;
1833 }
1834 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
1835 wpa_printf(MSG_DEBUG,
1836 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
1837 return -1;
1838 }
1839 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
1840 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
1841 wpa_printf(MSG_DEBUG,
1842 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
1843 return -1;
1844 }
1845 if (!wpa_s->sme.sae.pk &&
1846 status_code == WLAN_STATUS_SAE_PK) {
1847 wpa_printf(MSG_DEBUG,
1848 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
1849 return -1;
1850 }
1851
1852 if (groups && groups[0] <= 0)
1853 groups = NULL;
1854 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
1855 groups, status_code ==
1856 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
1857 status_code == WLAN_STATUS_SAE_PK,
1858 ie_offset);
1859 if (res == SAE_SILENTLY_DISCARD) {
1860 wpa_printf(MSG_DEBUG,
1861 "SAE: Drop commit message due to reflection attack");
1862 return 0;
1863 }
1864 if (res != WLAN_STATUS_SUCCESS)
1865 return -1;
1866
1867 if (wpa_s->sme.sae.tmp &&
1868 sme_check_sae_rejected_groups(
1869 wpa_s,
1870 wpa_s->sme.sae.tmp->peer_rejected_groups))
1871 return -1;
1872
1873 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
1874 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
1875 "commit");
1876 return -1;
1877 }
1878
1879 wpabuf_free(wpa_s->sme.sae_token);
1880 wpa_s->sme.sae_token = NULL;
1881 if (!external) {
1882 sme_send_authentication(wpa_s, wpa_s->current_bss,
1883 wpa_s->current_ssid, 0);
1884 } else {
1885 if (wpa_s->sme.ext_ml_auth &&
1886 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1887 status_code))
1888 return -1;
1889
1890 sme_external_auth_send_sae_confirm(wpa_s, sa);
1891 }
1892 return 0;
1893 } else if (auth_transaction == 2) {
1894 if (status_code != WLAN_STATUS_SUCCESS)
1895 return -1;
1896 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
1897 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
1898 return -1;
1899 if (sae_check_confirm(&wpa_s->sme.sae, data, len,
1900 ie_offset) < 0)
1901 return -1;
1902 if (external && wpa_s->sme.ext_ml_auth &&
1903 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
1904 status_code))
1905 return -1;
1906
1907 wpa_s->sme.sae.state = SAE_ACCEPTED;
1908 sae_clear_temp_data(&wpa_s->sme.sae);
1909 wpa_s_clear_sae_rejected(wpa_s);
1910
1911 if (external) {
1912 /* Report success to driver */
1913 sme_send_external_auth_status(wpa_s,
1914 WLAN_STATUS_SUCCESS);
1915 }
1916
1917 return 1;
1918 }
1919
1920 return -1;
1921 }
1922
1923
sme_sae_set_pmk(struct wpa_supplicant * wpa_s,const u8 * bssid)1924 static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
1925 {
1926 wpa_printf(MSG_DEBUG,
1927 "SME: SAE completed - setting PMK for 4-way handshake");
1928 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, wpa_s->sme.sae.pmk_len,
1929 wpa_s->sme.sae.pmkid, bssid);
1930 if (wpa_s->conf->sae_pmkid_in_assoc) {
1931 /* Update the own RSNE contents now that we have set the PMK
1932 * and added a PMKSA cache entry based on the successfully
1933 * completed SAE exchange. In practice, this will add the PMKID
1934 * into RSNE. */
1935 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
1936 sizeof(wpa_s->sme.assoc_req_ie)) {
1937 wpa_msg(wpa_s, MSG_WARNING,
1938 "RSN: Not enough room for inserting own PMKID into RSNE");
1939 return -1;
1940 }
1941 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
1942 &wpa_s->sme.assoc_req_ie_len,
1943 wpa_s->sme.sae.pmkid, true) < 0)
1944 return -1;
1945 wpa_hexdump(MSG_DEBUG,
1946 "SME: Updated Association Request IEs",
1947 wpa_s->sme.assoc_req_ie,
1948 wpa_s->sme.assoc_req_ie_len);
1949 }
1950
1951 return 0;
1952 }
1953
1954
sme_external_auth_mgmt_rx(struct wpa_supplicant * wpa_s,const u8 * auth_frame,size_t len)1955 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
1956 const u8 *auth_frame, size_t len)
1957 {
1958 const struct ieee80211_mgmt *header;
1959 size_t auth_length;
1960
1961 header = (const struct ieee80211_mgmt *) auth_frame;
1962 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
1963
1964 if (len < auth_length) {
1965 /* Notify failure to the driver */
1966 sme_send_external_auth_status(wpa_s,
1967 WLAN_STATUS_UNSPECIFIED_FAILURE);
1968 return;
1969 }
1970
1971 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
1972 int res;
1973 int ie_offset = 0;
1974
1975 res = sme_sae_auth(
1976 wpa_s, le_to_host16(header->u.auth.auth_transaction),
1977 le_to_host16(header->u.auth.status_code),
1978 header->u.auth.variable,
1979 len - auth_length, 1, header->sa, &ie_offset);
1980 if (res < 0) {
1981 /* Notify failure to the driver */
1982 sme_send_external_auth_status(
1983 wpa_s,
1984 res == -2 ?
1985 le_to_host16(header->u.auth.status_code) :
1986 WLAN_STATUS_UNSPECIFIED_FAILURE);
1987 return;
1988 }
1989 if (res != 1)
1990 return;
1991
1992 if (sme_sae_set_pmk(wpa_s,
1993 wpa_s->sme.ext_ml_auth ?
1994 wpa_s->sme.ext_auth_ap_mld_addr :
1995 wpa_s->sme.ext_auth_bssid) < 0)
1996 return;
1997 }
1998 }
1999
2000 #endif /* CONFIG_SAE */
2001
2002
sme_event_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2003 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
2004 {
2005 struct wpa_ssid *ssid = wpa_s->current_ssid;
2006 int ie_offset = 0;
2007
2008 if (ssid == NULL) {
2009 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2010 "when network is not selected");
2011 return;
2012 }
2013
2014 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
2015 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
2016 "when not in authenticating state");
2017 return;
2018 }
2019
2020 if (!ether_addr_equal(wpa_s->pending_bssid, data->auth.peer) &&
2021 !(wpa_s->valid_links &&
2022 ether_addr_equal(wpa_s->ap_mld_addr, data->auth.peer))) {
2023 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
2024 "unexpected peer " MACSTR,
2025 MAC2STR(data->auth.peer));
2026 return;
2027 }
2028
2029 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
2030 " auth_type=%d auth_transaction=%d status_code=%d",
2031 MAC2STR(data->auth.peer), data->auth.auth_type,
2032 data->auth.auth_transaction, data->auth.status_code);
2033 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
2034 data->auth.ies, data->auth.ies_len);
2035
2036 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
2037
2038 #ifdef CONFIG_SAE
2039 if (data->auth.auth_type == WLAN_AUTH_SAE) {
2040 const u8 *addr = wpa_s->pending_bssid;
2041 int res;
2042
2043 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
2044 data->auth.status_code, data->auth.ies,
2045 data->auth.ies_len, 0, data->auth.peer,
2046 &ie_offset);
2047 if (res < 0) {
2048 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2049 NULL);
2050 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2051
2052 if (wpa_s->sme.sae_rejected_groups &&
2053 ssid->disabled_until.sec) {
2054 wpa_printf(MSG_DEBUG,
2055 "SME: Clear SAE state with rejected groups due to continuous failures");
2056 wpa_s_clear_sae_rejected(wpa_s);
2057 }
2058 }
2059 if (res != 1)
2060 return;
2061
2062 if (wpa_s->valid_links)
2063 addr = wpa_s->ap_mld_addr;
2064
2065 if (sme_sae_set_pmk(wpa_s, addr) < 0)
2066 return;
2067 }
2068 #endif /* CONFIG_SAE */
2069
2070 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
2071 char *ie_txt = NULL;
2072
2073 if (data->auth.ies && data->auth.ies_len) {
2074 size_t buflen = 2 * data->auth.ies_len + 1;
2075 ie_txt = os_malloc(buflen);
2076 if (ie_txt) {
2077 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
2078 data->auth.ies_len);
2079 }
2080 }
2081 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
2082 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
2083 MAC2STR(data->auth.peer), data->auth.auth_type,
2084 data->auth.auth_transaction, data->auth.status_code,
2085 ie_txt ? " ie=" : "",
2086 ie_txt ? ie_txt : "");
2087 os_free(ie_txt);
2088
2089 #ifdef CONFIG_FILS
2090 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
2091 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
2092 fils_connection_failure(wpa_s);
2093 #endif /* CONFIG_FILS */
2094
2095 if (data->auth.status_code !=
2096 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
2097 wpa_s->sme.auth_alg == data->auth.auth_type ||
2098 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
2099 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2100 NULL);
2101 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2102 return;
2103 }
2104
2105 wpas_connect_work_done(wpa_s);
2106
2107 switch (data->auth.auth_type) {
2108 case WLAN_AUTH_OPEN:
2109 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
2110
2111 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
2112 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2113 wpa_s->current_ssid);
2114 return;
2115
2116 case WLAN_AUTH_SHARED_KEY:
2117 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
2118
2119 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
2120 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
2121 wpa_s->current_ssid);
2122 return;
2123
2124 default:
2125 return;
2126 }
2127 }
2128
2129 #ifdef CONFIG_IEEE80211R
2130 if (data->auth.auth_type == WLAN_AUTH_FT) {
2131 const u8 *ric_ies = NULL;
2132 size_t ric_ies_len = 0;
2133
2134 if (wpa_s->ric_ies) {
2135 ric_ies = wpabuf_head(wpa_s->ric_ies);
2136 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
2137 }
2138 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
2139 data->auth.ies_len, 0,
2140 data->auth.peer,
2141 ric_ies, ric_ies_len) < 0) {
2142 wpa_dbg(wpa_s, MSG_DEBUG,
2143 "SME: FT Authentication response processing failed");
2144 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2145 MACSTR
2146 " reason=%d locally_generated=1",
2147 MAC2STR(wpa_s->pending_bssid),
2148 WLAN_REASON_DEAUTH_LEAVING);
2149 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2150 NULL);
2151 wpa_supplicant_mark_disassoc(wpa_s);
2152 return;
2153 }
2154 }
2155 #endif /* CONFIG_IEEE80211R */
2156
2157 #ifdef CONFIG_FILS
2158 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
2159 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
2160 u16 expect_auth_type;
2161
2162 expect_auth_type = wpa_s->sme.auth_alg ==
2163 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
2164 WLAN_AUTH_FILS_SK;
2165 if (data->auth.auth_type != expect_auth_type) {
2166 wpa_dbg(wpa_s, MSG_DEBUG,
2167 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
2168 data->auth.auth_type, expect_auth_type);
2169 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2170 MACSTR
2171 " reason=%d locally_generated=1",
2172 MAC2STR(wpa_s->pending_bssid),
2173 WLAN_REASON_DEAUTH_LEAVING);
2174 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2175 NULL);
2176 wpa_supplicant_mark_disassoc(wpa_s);
2177 return;
2178 }
2179
2180 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
2181 data->auth.ies, data->auth.ies_len) < 0) {
2182 wpa_dbg(wpa_s, MSG_DEBUG,
2183 "SME: FILS Authentication response processing failed");
2184 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
2185 MACSTR
2186 " reason=%d locally_generated=1",
2187 MAC2STR(wpa_s->pending_bssid),
2188 WLAN_REASON_DEAUTH_LEAVING);
2189 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2190 NULL);
2191 wpa_supplicant_mark_disassoc(wpa_s);
2192 return;
2193 }
2194 }
2195 #endif /* CONFIG_FILS */
2196
2197 /* TODO: Support additional auth_type values as well */
2198 if ((data->auth.auth_type == WLAN_AUTH_OPEN ||
2199 data->auth.auth_type == WLAN_AUTH_SAE) &&
2200 wpas_sme_ml_auth(wpa_s, data, ie_offset) < 0) {
2201 wpa_dbg(wpa_s, MSG_DEBUG,
2202 "MLD: Failed to parse ML Authentication frame");
2203 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
2204 " reason=%d locally_generated=1",
2205 MAC2STR(wpa_s->pending_bssid),
2206 WLAN_REASON_DEAUTH_LEAVING);
2207 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2208 wpa_supplicant_deauthenticate(wpa_s,
2209 WLAN_REASON_DEAUTH_LEAVING);
2210 wpa_printf(MSG_DEBUG,
2211 "MLD: Authentication - clearing MLD state");
2212 wpas_reset_mlo_info(wpa_s);
2213 return;
2214 }
2215
2216 sme_associate(wpa_s, ssid->mode, data->auth.peer,
2217 data->auth.auth_type);
2218 }
2219
2220
2221 #ifdef CONFIG_IEEE80211R
remove_ie(u8 * buf,size_t * len,u8 eid)2222 static void remove_ie(u8 *buf, size_t *len, u8 eid)
2223 {
2224 u8 *pos, *next, *end;
2225
2226 pos = (u8 *) get_ie(buf, *len, eid);
2227 if (pos) {
2228 next = pos + 2 + pos[1];
2229 end = buf + *len;
2230 *len -= 2 + pos[1];
2231 os_memmove(pos, next, end - next);
2232 }
2233 }
2234 #endif /* CONFIG_IEEE80211R */
2235
2236
sme_associate(struct wpa_supplicant * wpa_s,enum wpas_mode mode,const u8 * bssid,u16 auth_type)2237 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
2238 const u8 *bssid, u16 auth_type)
2239 {
2240 struct wpa_driver_associate_params params;
2241 struct ieee802_11_elems elems;
2242 struct wpa_ssid *ssid = wpa_s->current_ssid;
2243 #ifdef CONFIG_FILS
2244 u8 nonces[2 * FILS_NONCE_LEN];
2245 #endif /* CONFIG_FILS */
2246 #ifdef CONFIG_HT_OVERRIDES
2247 struct ieee80211_ht_capabilities htcaps;
2248 struct ieee80211_ht_capabilities htcaps_mask;
2249 #endif /* CONFIG_HT_OVERRIDES */
2250 #ifdef CONFIG_VHT_OVERRIDES
2251 struct ieee80211_vht_capabilities vhtcaps;
2252 struct ieee80211_vht_capabilities vhtcaps_mask;
2253 #endif /* CONFIG_VHT_OVERRIDES */
2254
2255 os_memset(¶ms, 0, sizeof(params));
2256
2257 /* Save auth type, in case we need to retry after comeback timer. */
2258 wpa_s->sme.assoc_auth_type = auth_type;
2259
2260 #ifdef CONFIG_FILS
2261 if (auth_type == WLAN_AUTH_FILS_SK ||
2262 auth_type == WLAN_AUTH_FILS_SK_PFS) {
2263 struct wpabuf *buf;
2264 const u8 *snonce, *anonce;
2265 const unsigned int max_hlp = 20;
2266 struct wpabuf *hlp[max_hlp];
2267 unsigned int i, num_hlp = 0;
2268 struct fils_hlp_req *req;
2269
2270 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
2271 list) {
2272 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
2273 wpabuf_len(req->pkt));
2274 if (!hlp[num_hlp])
2275 break;
2276 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
2277 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
2278 ETH_ALEN);
2279 wpabuf_put_data(hlp[num_hlp],
2280 "\xaa\xaa\x03\x00\x00\x00", 6);
2281 wpabuf_put_buf(hlp[num_hlp], req->pkt);
2282 num_hlp++;
2283 if (num_hlp >= max_hlp)
2284 break;
2285 }
2286
2287 buf = fils_build_assoc_req(wpa_s->wpa, ¶ms.fils_kek,
2288 ¶ms.fils_kek_len, &snonce,
2289 &anonce,
2290 (const struct wpabuf **) hlp,
2291 num_hlp);
2292 for (i = 0; i < num_hlp; i++)
2293 wpabuf_free(hlp[i]);
2294 if (!buf)
2295 return;
2296 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
2297 wpa_s->sme.assoc_req_ie,
2298 wpa_s->sme.assoc_req_ie_len);
2299 #ifdef CONFIG_IEEE80211R
2300 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
2301 /* Remove RSNE and MDE to allow them to be overridden
2302 * with FILS+FT specific values from
2303 * fils_build_assoc_req(). */
2304 remove_ie(wpa_s->sme.assoc_req_ie,
2305 &wpa_s->sme.assoc_req_ie_len,
2306 WLAN_EID_RSN);
2307 wpa_hexdump(MSG_DEBUG,
2308 "FILS: assoc_req after RSNE removal",
2309 wpa_s->sme.assoc_req_ie,
2310 wpa_s->sme.assoc_req_ie_len);
2311 remove_ie(wpa_s->sme.assoc_req_ie,
2312 &wpa_s->sme.assoc_req_ie_len,
2313 WLAN_EID_MOBILITY_DOMAIN);
2314 wpa_hexdump(MSG_DEBUG,
2315 "FILS: assoc_req after MDE removal",
2316 wpa_s->sme.assoc_req_ie,
2317 wpa_s->sme.assoc_req_ie_len);
2318 }
2319 #endif /* CONFIG_IEEE80211R */
2320 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
2321 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
2322 sizeof(wpa_s->sme.assoc_req_ie)) {
2323 wpa_printf(MSG_ERROR,
2324 "FILS: Not enough buffer room for own AssocReq elements");
2325 wpabuf_free(buf);
2326 return;
2327 }
2328 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2329 wpabuf_head(buf), wpabuf_len(buf));
2330 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
2331 wpabuf_free(buf);
2332 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
2333 wpa_s->sme.assoc_req_ie,
2334 wpa_s->sme.assoc_req_ie_len);
2335
2336 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
2337 os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
2338 params.fils_nonces = nonces;
2339 params.fils_nonces_len = sizeof(nonces);
2340 }
2341 #endif /* CONFIG_FILS */
2342
2343 #ifdef CONFIG_OWE
2344 #ifdef CONFIG_TESTING_OPTIONS
2345 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
2346 WLAN_EID_EXT_OWE_DH_PARAM)) {
2347 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
2348 } else
2349 #endif /* CONFIG_TESTING_OPTIONS */
2350 if (auth_type == WLAN_AUTH_OPEN &&
2351 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
2352 struct wpabuf *owe_ie;
2353 u16 group;
2354
2355 if (ssid && ssid->owe_group) {
2356 group = ssid->owe_group;
2357 } else if (wpa_s->assoc_status_code ==
2358 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
2359 if (wpa_s->last_owe_group == 19)
2360 group = 20;
2361 else if (wpa_s->last_owe_group == 20)
2362 group = 21;
2363 else
2364 group = OWE_DH_GROUP;
2365 } else {
2366 group = OWE_DH_GROUP;
2367 }
2368
2369 wpa_s->last_owe_group = group;
2370 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
2371 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
2372 if (!owe_ie) {
2373 wpa_printf(MSG_ERROR,
2374 "OWE: Failed to build IE for Association Request frame");
2375 return;
2376 }
2377 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
2378 sizeof(wpa_s->sme.assoc_req_ie)) {
2379 wpa_printf(MSG_ERROR,
2380 "OWE: Not enough buffer room for own Association Request frame elements");
2381 wpabuf_free(owe_ie);
2382 return;
2383 }
2384 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2385 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
2386 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
2387 wpabuf_free(owe_ie);
2388 }
2389 #endif /* CONFIG_OWE */
2390
2391 #ifdef CONFIG_DPP2
2392 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
2393 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
2394 !ssid->dpp_pfs_fallback) {
2395 struct rsn_pmksa_cache_entry *pmksa;
2396
2397 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2398 if (!pmksa || !pmksa->dpp_pfs)
2399 goto pfs_fail;
2400
2401 dpp_pfs_free(wpa_s->dpp_pfs);
2402 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
2403 ssid->dpp_netaccesskey_len);
2404 if (!wpa_s->dpp_pfs) {
2405 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
2406 /* Try to continue without PFS */
2407 goto pfs_fail;
2408 }
2409 if (wpa_s->sme.assoc_req_ie_len +
2410 wpabuf_len(wpa_s->dpp_pfs->ie) >
2411 sizeof(wpa_s->sme.assoc_req_ie)) {
2412 wpa_printf(MSG_ERROR,
2413 "DPP: Not enough buffer room for own Association Request frame elements");
2414 dpp_pfs_free(wpa_s->dpp_pfs);
2415 wpa_s->dpp_pfs = NULL;
2416 goto pfs_fail;
2417 }
2418 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2419 wpabuf_head(wpa_s->dpp_pfs->ie),
2420 wpabuf_len(wpa_s->dpp_pfs->ie));
2421 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
2422 }
2423 pfs_fail:
2424 #endif /* CONFIG_DPP2 */
2425
2426 #ifndef CONFIG_NO_ROBUST_AV
2427 wpa_s->mscs_setup_done = false;
2428 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
2429 wpa_s->robust_av.valid_config) {
2430 struct wpabuf *mscs_ie;
2431 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
2432
2433 buf_len = 3 + /* MSCS descriptor IE header */
2434 1 + /* Request type */
2435 2 + /* User priority control */
2436 4 + /* Stream timeout */
2437 3 + /* TCLAS Mask IE header */
2438 wpa_s->robust_av.frame_classifier_len;
2439 mscs_ie = wpabuf_alloc(buf_len);
2440 if (!mscs_ie) {
2441 wpa_printf(MSG_INFO,
2442 "MSCS: Failed to allocate MSCS IE");
2443 goto mscs_fail;
2444 }
2445
2446 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
2447 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
2448 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
2449 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
2450 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
2451 mscs_ie_len = wpabuf_len(mscs_ie);
2452 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
2453 wpabuf_head(mscs_ie), mscs_ie_len);
2454 *wpa_ie_len += mscs_ie_len;
2455 }
2456
2457 wpabuf_free(mscs_ie);
2458 }
2459 mscs_fail:
2460 #endif /* CONFIG_NO_ROBUST_AV */
2461
2462 wpa_s->sme.assoc_req_ie_len =
2463 wpas_populate_wfa_capa(wpa_s, wpa_s->current_bss,
2464 wpa_s->sme.assoc_req_ie,
2465 wpa_s->sme.assoc_req_ie_len,
2466 sizeof(wpa_s->sme.assoc_req_ie));
2467
2468 if (ssid && ssid->multi_ap_backhaul_sta) {
2469 size_t multi_ap_ie_len;
2470 struct multi_ap_params multi_ap = { 0 };
2471
2472 multi_ap.capability = MULTI_AP_BACKHAUL_STA;
2473 multi_ap.profile = ssid->multi_ap_profile;
2474
2475 multi_ap_ie_len = add_multi_ap_ie(
2476 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
2477 sizeof(wpa_s->sme.assoc_req_ie) -
2478 wpa_s->sme.assoc_req_ie_len,
2479 &multi_ap);
2480 if (multi_ap_ie_len == 0) {
2481 wpa_printf(MSG_ERROR,
2482 "Multi-AP: Failed to build Multi-AP IE");
2483 return;
2484 }
2485 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
2486 }
2487
2488 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE_SUPPORT,
2489 wpas_rsn_overriding(wpa_s, ssid));
2490 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2491 RSN_OVERRIDE_NOT_USED);
2492 if (wpas_rsn_overriding(wpa_s, ssid) &&
2493 wpas_ap_supports_rsn_overriding(wpa_s, wpa_s->current_bss) &&
2494 wpa_s->sme.assoc_req_ie_len + 2 + 4 <=
2495 sizeof(wpa_s->sme.assoc_req_ie)) {
2496 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
2497 const u8 *ie;
2498 enum rsn_selection_variant variant = RSN_SELECTION_RSNE;
2499
2500 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
2501 RSN_OVERRIDE_RSNE);
2502 ie = wpa_bss_get_rsne(wpa_s, wpa_s->current_bss, ssid,
2503 wpa_s->valid_links);
2504 if (ie && ie[0] == WLAN_EID_VENDOR_SPECIFIC && ie[1] >= 4) {
2505 u32 type;
2506
2507 type = WPA_GET_BE32(&ie[2]);
2508 if (type == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
2509 variant = RSN_SELECTION_RSNE_OVERRIDE;
2510 wpa_sm_set_param(wpa_s->wpa,
2511 WPA_PARAM_RSN_OVERRIDE,
2512 RSN_OVERRIDE_RSNE_OVERRIDE);
2513 } else if (type == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
2514 variant = RSN_SELECTION_RSNE_OVERRIDE_2;
2515 wpa_sm_set_param(wpa_s->wpa,
2516 WPA_PARAM_RSN_OVERRIDE,
2517 RSN_OVERRIDE_RSNE_OVERRIDE_2);
2518 }
2519 }
2520
2521 /* Indicate which RSNE variant was used */
2522 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
2523 *pos++ = 4 + 1;
2524 WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);
2525 pos += 4;
2526 *pos = variant;
2527 wpa_s->sme.assoc_req_ie_len += 2 + 4 + 1;
2528 }
2529
2530 params.bssid = bssid;
2531 params.ssid = wpa_s->sme.ssid;
2532 params.ssid_len = wpa_s->sme.ssid_len;
2533 params.freq.freq = wpa_s->sme.freq;
2534 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
2535 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
2536 wpa_s->sme.assoc_req_ie : NULL;
2537 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2538 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
2539 params.wpa_ie, params.wpa_ie_len);
2540 params.pairwise_suite = wpa_s->pairwise_cipher;
2541 params.group_suite = wpa_s->group_cipher;
2542 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
2543 params.key_mgmt_suite = wpa_s->key_mgmt;
2544 params.wpa_proto = wpa_s->wpa_proto;
2545 #ifdef CONFIG_HT_OVERRIDES
2546 os_memset(&htcaps, 0, sizeof(htcaps));
2547 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2548 params.htcaps = (u8 *) &htcaps;
2549 params.htcaps_mask = (u8 *) &htcaps_mask;
2550 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, ¶ms);
2551 #endif /* CONFIG_HT_OVERRIDES */
2552 #ifdef CONFIG_VHT_OVERRIDES
2553 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2554 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2555 params.vhtcaps = &vhtcaps;
2556 params.vhtcaps_mask = &vhtcaps_mask;
2557 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, ¶ms);
2558 #endif /* CONFIG_VHT_OVERRIDES */
2559 #ifdef CONFIG_HE_OVERRIDES
2560 wpa_supplicant_apply_he_overrides(wpa_s, ssid, ¶ms);
2561 #endif /* CONFIG_HE_OVERRIDES */
2562 wpa_supplicant_apply_eht_overrides(wpa_s, ssid, ¶ms);
2563 #ifdef CONFIG_IEEE80211R
2564 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
2565 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
2566 WLAN_EID_RIC_DATA)) {
2567 /* There seems to be a pretty inconvenient bug in the Linux
2568 * kernel IE splitting functionality when RIC is used. For now,
2569 * skip correct behavior in IE construction here (i.e., drop the
2570 * additional non-FT-specific IEs) to avoid kernel issues. This
2571 * is fine since RIC is used only for testing purposes in the
2572 * current implementation. */
2573 wpa_printf(MSG_INFO,
2574 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
2575 params.wpa_ie = wpa_s->sme.ft_ies;
2576 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
2577 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
2578 const u8 *rm_en, *pos, *end;
2579 size_t rm_en_len = 0;
2580 u8 *rm_en_dup = NULL, *wpos;
2581
2582 /* Remove RSNE, MDE, FTE to allow them to be overridden with
2583 * FT specific values */
2584 remove_ie(wpa_s->sme.assoc_req_ie,
2585 &wpa_s->sme.assoc_req_ie_len,
2586 WLAN_EID_RSN);
2587 remove_ie(wpa_s->sme.assoc_req_ie,
2588 &wpa_s->sme.assoc_req_ie_len,
2589 WLAN_EID_MOBILITY_DOMAIN);
2590 remove_ie(wpa_s->sme.assoc_req_ie,
2591 &wpa_s->sme.assoc_req_ie_len,
2592 WLAN_EID_FAST_BSS_TRANSITION);
2593 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
2594 wpa_s->sme.assoc_req_ie_len,
2595 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2596 if (rm_en) {
2597 /* Need to remove RM Enabled Capabilities element as
2598 * well temporarily, so that it can be placed between
2599 * RSNE and MDE. */
2600 rm_en_len = 2 + rm_en[1];
2601 rm_en_dup = os_memdup(rm_en, rm_en_len);
2602 remove_ie(wpa_s->sme.assoc_req_ie,
2603 &wpa_s->sme.assoc_req_ie_len,
2604 WLAN_EID_RRM_ENABLED_CAPABILITIES);
2605 }
2606 wpa_hexdump(MSG_DEBUG,
2607 "SME: Association Request IEs after FT IE removal",
2608 wpa_s->sme.assoc_req_ie,
2609 wpa_s->sme.assoc_req_ie_len);
2610 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
2611 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
2612 wpa_printf(MSG_ERROR,
2613 "SME: Not enough buffer room for FT IEs in Association Request frame");
2614 os_free(rm_en_dup);
2615 return;
2616 }
2617
2618 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
2619 rm_en_len,
2620 wpa_s->sme.assoc_req_ie,
2621 wpa_s->sme.assoc_req_ie_len);
2622 pos = wpa_s->sme.ft_ies;
2623 end = pos + wpa_s->sme.ft_ies_len;
2624 wpos = wpa_s->sme.assoc_req_ie;
2625 if (*pos == WLAN_EID_RSN) {
2626 os_memcpy(wpos, pos, 2 + pos[1]);
2627 wpos += 2 + pos[1];
2628 pos += 2 + pos[1];
2629 }
2630 if (rm_en_dup) {
2631 os_memcpy(wpos, rm_en_dup, rm_en_len);
2632 wpos += rm_en_len;
2633 os_free(rm_en_dup);
2634 }
2635 os_memcpy(wpos, pos, end - pos);
2636 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
2637 rm_en_len;
2638 params.wpa_ie = wpa_s->sme.assoc_req_ie;
2639 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
2640 wpa_hexdump(MSG_DEBUG,
2641 "SME: Association Request IEs after FT override",
2642 params.wpa_ie, params.wpa_ie_len);
2643 }
2644 #endif /* CONFIG_IEEE80211R */
2645 params.mode = mode;
2646 params.mgmt_frame_protection = wpa_s->sme.mfp;
2647 params.spp_amsdu = wpa_s->sme.spp_amsdu;
2648 params.rrm_used = wpa_s->rrm.rrm_used;
2649 if (wpa_s->sme.prev_bssid_set)
2650 params.prev_bssid = wpa_s->sme.prev_bssid;
2651
2652 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2653 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
2654 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
2655 params.freq.freq);
2656
2657 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2658
2659 if (params.wpa_ie == NULL ||
2660 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
2661 < 0) {
2662 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
2663 os_memset(&elems, 0, sizeof(elems));
2664 }
2665 if (elems.rsn_ie) {
2666 params.wpa_proto = WPA_PROTO_RSN;
2667 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
2668 elems.rsn_ie_len + 2);
2669 } else if (elems.wpa_ie) {
2670 params.wpa_proto = WPA_PROTO_WPA;
2671 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
2672 elems.wpa_ie_len + 2);
2673 } else
2674 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2675 if (elems.rsnxe)
2676 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
2677 elems.rsnxe_len + 2);
2678 else
2679 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
2680 if (ssid && ssid->p2p_group)
2681 params.p2p = 1;
2682
2683 if (wpa_s->p2pdev->set_sta_uapsd)
2684 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2685 else
2686 params.uapsd = -1;
2687
2688 if (wpa_s->valid_links) {
2689 unsigned int i;
2690
2691 wpa_printf(MSG_DEBUG,
2692 "MLD: In association. assoc_link_id=%u, valid_links=0x%x",
2693 wpa_s->mlo_assoc_link_id, wpa_s->valid_links);
2694
2695 params.mld_params.mld_addr = wpa_s->ap_mld_addr;
2696 params.mld_params.valid_links = wpa_s->valid_links;
2697 params.mld_params.assoc_link_id = wpa_s->mlo_assoc_link_id;
2698 for_each_link(wpa_s->valid_links, i) {
2699 params.mld_params.mld_links[i].bssid =
2700 wpa_s->links[i].bssid;
2701 params.mld_params.mld_links[i].freq =
2702 wpa_s->links[i].freq;
2703 params.mld_params.mld_links[i].disabled =
2704 wpa_s->links[i].disabled;
2705
2706 wpa_printf(MSG_DEBUG,
2707 "MLD: id=%u, freq=%d, disabled=%u, " MACSTR,
2708 i, wpa_s->links[i].freq,
2709 wpa_s->links[i].disabled,
2710 MAC2STR(wpa_s->links[i].bssid));
2711 }
2712 }
2713
2714 if (wpa_drv_associate(wpa_s, ¶ms) < 0) {
2715 unsigned int n_failed_links = 0;
2716 int i;
2717
2718 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
2719 "driver failed");
2720
2721 /* Prepare list of failed links for error report */
2722 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
2723 if (!(wpa_s->valid_links & BIT(i)) ||
2724 wpa_s->mlo_assoc_link_id == i ||
2725 !params.mld_params.mld_links[i].error)
2726 continue;
2727
2728 wpa_bssid_ignore_add(wpa_s, wpa_s->links[i].bssid);
2729 n_failed_links++;
2730 }
2731
2732 if (n_failed_links) {
2733 /* Deauth and connect (possibly to the same AP MLD) */
2734 wpa_drv_deauthenticate(wpa_s, wpa_s->ap_mld_addr,
2735 WLAN_REASON_DEAUTH_LEAVING);
2736 wpas_connect_work_done(wpa_s);
2737 wpa_supplicant_mark_disassoc(wpa_s);
2738 wpas_request_connection(wpa_s);
2739 } else {
2740 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
2741 NULL);
2742 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2743 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2744 }
2745 return;
2746 }
2747
2748 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
2749 NULL);
2750
2751 #ifdef CONFIG_TESTING_OPTIONS
2752 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
2753 wpa_s->last_assoc_req_wpa_ie = NULL;
2754 if (params.wpa_ie)
2755 wpa_s->last_assoc_req_wpa_ie =
2756 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
2757 #endif /* CONFIG_TESTING_OPTIONS */
2758 }
2759
2760
sme_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)2761 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2762 const u8 *ies, size_t ies_len)
2763 {
2764 if (md == NULL || ies == NULL) {
2765 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
2766 os_free(wpa_s->sme.ft_ies);
2767 wpa_s->sme.ft_ies = NULL;
2768 wpa_s->sme.ft_ies_len = 0;
2769 wpa_s->sme.ft_used = 0;
2770 return 0;
2771 }
2772
2773 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
2774 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
2775 os_free(wpa_s->sme.ft_ies);
2776 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
2777 if (wpa_s->sme.ft_ies == NULL)
2778 return -1;
2779 wpa_s->sme.ft_ies_len = ies_len;
2780 return 0;
2781 }
2782
2783
sme_deauth(struct wpa_supplicant * wpa_s,const u8 ** link_bssids)2784 static void sme_deauth(struct wpa_supplicant *wpa_s, const u8 **link_bssids)
2785 {
2786 int bssid_changed;
2787 const u8 *bssid;
2788
2789 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2790
2791 if (wpa_s->valid_links)
2792 bssid = wpa_s->ap_mld_addr;
2793 else
2794 bssid = wpa_s->pending_bssid;
2795
2796 if (wpa_drv_deauthenticate(wpa_s, bssid,
2797 WLAN_REASON_DEAUTH_LEAVING) < 0) {
2798 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
2799 "failed");
2800 }
2801 wpa_s->sme.prev_bssid_set = 0;
2802
2803 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, link_bssids);
2804 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2805 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2806 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2807 if (bssid_changed)
2808 wpas_notify_bssid_changed(wpa_s);
2809 }
2810
2811
sme_assoc_comeback_timer(void * eloop_ctx,void * timeout_ctx)2812 static void sme_assoc_comeback_timer(void *eloop_ctx, void *timeout_ctx)
2813 {
2814 struct wpa_supplicant *wpa_s = eloop_ctx;
2815
2816 if (!wpa_s->current_bss || !wpa_s->current_ssid) {
2817 wpa_msg(wpa_s, MSG_DEBUG,
2818 "SME: Comeback timeout expired; SSID/BSSID cleared; ignoring");
2819 return;
2820 }
2821
2822 wpa_msg(wpa_s, MSG_DEBUG,
2823 "SME: Comeback timeout expired; retry associating with "
2824 MACSTR "; mode=%d auth_type=%u",
2825 MAC2STR(wpa_s->current_bss->bssid),
2826 wpa_s->current_ssid->mode,
2827 wpa_s->sme.assoc_auth_type);
2828
2829 /* Authentication state was completed already; just try association
2830 * again. */
2831 sme_associate(wpa_s, wpa_s->current_ssid->mode,
2832 wpa_s->current_bss->bssid,
2833 wpa_s->sme.assoc_auth_type);
2834 }
2835
2836
sme_try_assoc_comeback(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2837 static bool sme_try_assoc_comeback(struct wpa_supplicant *wpa_s,
2838 union wpa_event_data *data)
2839 {
2840 struct ieee802_11_elems elems;
2841 u32 timeout_interval;
2842 unsigned long comeback_usec;
2843 u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
2844
2845 #ifdef CONFIG_TESTING_OPTIONS
2846 if (wpa_s->test_assoc_comeback_type != -1)
2847 type = wpa_s->test_assoc_comeback_type;
2848 #endif /* CONFIG_TESTING_OPTIONS */
2849
2850 if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
2851 data->assoc_reject.resp_ies_len,
2852 &elems, 0) == ParseFailed) {
2853 wpa_msg(wpa_s, MSG_INFO,
2854 "SME: Temporary assoc reject: failed to parse (Re)Association Response frame elements");
2855 return false;
2856 }
2857
2858 if (!elems.timeout_int) {
2859 wpa_msg(wpa_s, MSG_INFO,
2860 "SME: Temporary assoc reject: missing timeout interval IE");
2861 return false;
2862 }
2863
2864 if (elems.timeout_int[0] != type) {
2865 wpa_msg(wpa_s, MSG_INFO,
2866 "SME: Temporary assoc reject: missing association comeback time");
2867 return false;
2868 }
2869
2870 timeout_interval = WPA_GET_LE32(&elems.timeout_int[1]);
2871 if (timeout_interval > 60000) {
2872 /* This is unprotected information and there is no point in
2873 * getting stuck waiting for very long duration based on it */
2874 wpa_msg(wpa_s, MSG_DEBUG,
2875 "SME: Ignore overly long association comeback interval: %u TUs",
2876 timeout_interval);
2877 return false;
2878 }
2879 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association comeback interval: %u TUs",
2880 timeout_interval);
2881
2882 comeback_usec = timeout_interval * 1024;
2883 eloop_register_timeout(comeback_usec / 1000000, comeback_usec % 1000000,
2884 sme_assoc_comeback_timer, wpa_s, NULL);
2885 return true;
2886 }
2887
2888
sme_event_assoc_reject(struct wpa_supplicant * wpa_s,union wpa_event_data * data,const u8 ** link_bssids)2889 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
2890 union wpa_event_data *data,
2891 const u8 **link_bssids)
2892 {
2893 const u8 *bssid;
2894
2895 if (wpa_s->valid_links)
2896 bssid = wpa_s->ap_mld_addr;
2897 else
2898 bssid = wpa_s->pending_bssid;
2899
2900 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
2901 "status code %d", MAC2STR(wpa_s->pending_bssid),
2902 data->assoc_reject.status_code);
2903
2904 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
2905 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
2906
2907 /* Authentication phase has been completed at this point. Check whether
2908 * the AP rejected association temporarily due to still holding a
2909 * security associationis with us (MFP). If so, we must wait for the
2910 * AP's association comeback timeout period before associating again. */
2911 if (data->assoc_reject.status_code ==
2912 WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
2913 wpa_msg(wpa_s, MSG_DEBUG,
2914 "SME: Temporary association reject from BSS " MACSTR,
2915 MAC2STR(bssid));
2916 if (sme_try_assoc_comeback(wpa_s, data)) {
2917 /* Break out early; comeback error is not a failure. */
2918 return;
2919 }
2920 }
2921
2922 #ifdef CONFIG_SAE
2923 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
2924 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
2925 wpa_dbg(wpa_s, MSG_DEBUG,
2926 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
2927 wpa_sm_aborted_cached(wpa_s->wpa);
2928 wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
2929 if (wpa_s->current_bss) {
2930 struct wpa_bss *bss = wpa_s->current_bss;
2931 struct wpa_ssid *ssid = wpa_s->current_ssid;
2932
2933 wpa_drv_deauthenticate(wpa_s, bssid,
2934 WLAN_REASON_DEAUTH_LEAVING);
2935 wpas_connect_work_done(wpa_s);
2936 wpa_supplicant_mark_disassoc(wpa_s);
2937 wpa_supplicant_connect(wpa_s, bss, ssid);
2938 return;
2939 }
2940 }
2941 #endif /* CONFIG_SAE */
2942
2943 #ifdef CONFIG_DPP
2944 if (wpa_s->current_ssid &&
2945 wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_DPP &&
2946 !data->assoc_reject.timed_out &&
2947 data->assoc_reject.status_code == WLAN_STATUS_INVALID_PMKID) {
2948 struct rsn_pmksa_cache_entry *pmksa;
2949
2950 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2951 if (pmksa) {
2952 wpa_dbg(wpa_s, MSG_DEBUG,
2953 "DPP: Drop PMKSA cache entry for the BSS due to invalid PMKID report");
2954 wpa_sm_pmksa_cache_remove(wpa_s->wpa, pmksa);
2955 }
2956 wpa_sm_aborted_cached(wpa_s->wpa);
2957 if (wpa_s->current_bss) {
2958 struct wpa_bss *bss = wpa_s->current_bss;
2959 struct wpa_ssid *ssid = wpa_s->current_ssid;
2960
2961 wpa_dbg(wpa_s, MSG_DEBUG,
2962 "DPP: Try network introduction again");
2963 wpas_connect_work_done(wpa_s);
2964 wpa_supplicant_mark_disassoc(wpa_s);
2965 wpa_supplicant_connect(wpa_s, bss, ssid);
2966 return;
2967 }
2968 }
2969 #endif /* CONFIG_DPP */
2970
2971 /*
2972 * For now, unconditionally terminate the previous authentication. In
2973 * theory, this should not be needed, but mac80211 gets quite confused
2974 * if the authentication is left pending.. Some roaming cases might
2975 * benefit from using the previous authentication, so this could be
2976 * optimized in the future.
2977 */
2978 sme_deauth(wpa_s, link_bssids);
2979 }
2980
2981
sme_event_auth_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2982 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
2983 union wpa_event_data *data)
2984 {
2985 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
2986 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2987 wpa_supplicant_mark_disassoc(wpa_s);
2988 }
2989
2990
sme_event_assoc_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)2991 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
2992 union wpa_event_data *data)
2993 {
2994 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
2995 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
2996 wpa_supplicant_mark_disassoc(wpa_s);
2997 }
2998
2999
sme_event_disassoc(struct wpa_supplicant * wpa_s,struct disassoc_info * info)3000 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
3001 struct disassoc_info *info)
3002 {
3003 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
3004 if (wpa_s->sme.prev_bssid_set) {
3005 /*
3006 * cfg80211/mac80211 can get into somewhat confused state if
3007 * the AP only disassociates us and leaves us in authenticated
3008 * state. For now, force the state to be cleared to avoid
3009 * confusing errors if we try to associate with the AP again.
3010 */
3011 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
3012 "driver state");
3013 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
3014 WLAN_REASON_DEAUTH_LEAVING);
3015 }
3016 }
3017
3018
sme_auth_timer(void * eloop_ctx,void * timeout_ctx)3019 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
3020 {
3021 struct wpa_supplicant *wpa_s = eloop_ctx;
3022 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
3023 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
3024 sme_deauth(wpa_s, NULL);
3025 }
3026 }
3027
3028
sme_assoc_timer(void * eloop_ctx,void * timeout_ctx)3029 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
3030 {
3031 struct wpa_supplicant *wpa_s = eloop_ctx;
3032 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
3033 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
3034 sme_deauth(wpa_s, NULL);
3035 }
3036 }
3037
3038
sme_state_changed(struct wpa_supplicant * wpa_s)3039 void sme_state_changed(struct wpa_supplicant *wpa_s)
3040 {
3041 /* Make sure timers are cleaned up appropriately. */
3042 if (wpa_s->wpa_state != WPA_ASSOCIATING) {
3043 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3044 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3045 }
3046 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
3047 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3048 }
3049
3050
sme_clear_on_disassoc(struct wpa_supplicant * wpa_s)3051 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
3052 {
3053 wpa_s->sme.prev_bssid_set = 0;
3054 #ifdef CONFIG_SAE
3055 wpabuf_free(wpa_s->sme.sae_token);
3056 wpa_s->sme.sae_token = NULL;
3057 sae_clear_data(&wpa_s->sme.sae);
3058 #endif /* CONFIG_SAE */
3059 #ifdef CONFIG_IEEE80211R
3060 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
3061 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
3062 #endif /* CONFIG_IEEE80211R */
3063 sme_stop_sa_query(wpa_s);
3064 }
3065
3066
sme_deinit(struct wpa_supplicant * wpa_s)3067 void sme_deinit(struct wpa_supplicant *wpa_s)
3068 {
3069 sme_clear_on_disassoc(wpa_s);
3070 #ifdef CONFIG_SAE
3071 os_free(wpa_s->sme.sae_rejected_groups);
3072 wpa_s->sme.sae_rejected_groups = NULL;
3073 #endif /* CONFIG_SAE */
3074
3075 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
3076 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3077 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3078 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
3079 }
3080
3081
sme_send_2040_bss_coex(struct wpa_supplicant * wpa_s,const u8 * chan_list,u8 num_channels,u8 num_intol)3082 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
3083 const u8 *chan_list, u8 num_channels,
3084 u8 num_intol)
3085 {
3086 struct ieee80211_2040_bss_coex_ie *bc_ie;
3087 struct ieee80211_2040_intol_chan_report *ic_report;
3088 struct wpabuf *buf;
3089
3090 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
3091 " (num_channels=%u num_intol=%u)",
3092 MAC2STR(wpa_s->bssid), num_channels, num_intol);
3093 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
3094 chan_list, num_channels);
3095
3096 buf = wpabuf_alloc(2 + /* action.category + action_code */
3097 sizeof(struct ieee80211_2040_bss_coex_ie) +
3098 sizeof(struct ieee80211_2040_intol_chan_report) +
3099 num_channels);
3100 if (buf == NULL)
3101 return;
3102
3103 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
3104 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
3105
3106 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
3107 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
3108 bc_ie->length = 1;
3109 if (num_intol)
3110 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
3111
3112 if (num_channels > 0) {
3113 ic_report = wpabuf_put(buf, sizeof(*ic_report));
3114 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
3115 ic_report->length = num_channels + 1;
3116 ic_report->op_class = 0;
3117 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
3118 num_channels);
3119 }
3120
3121 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3122 wpa_s->own_addr, wpa_s->bssid,
3123 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
3124 wpa_msg(wpa_s, MSG_INFO,
3125 "SME: Failed to send 20/40 BSS Coexistence frame");
3126 }
3127
3128 wpabuf_free(buf);
3129 }
3130
3131
sme_proc_obss_scan(struct wpa_supplicant * wpa_s)3132 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
3133 {
3134 struct wpa_bss *bss;
3135 const u8 *ie;
3136 u16 ht_cap;
3137 u8 chan_list[P2P_MAX_CHANNELS], channel;
3138 u8 num_channels = 0, num_intol = 0, i;
3139
3140 if (!wpa_s->sme.sched_obss_scan)
3141 return 0;
3142
3143 wpa_s->sme.sched_obss_scan = 0;
3144 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
3145 return 1;
3146
3147 /*
3148 * Check whether AP uses regulatory triplet or channel triplet in
3149 * country info. Right now the operating class of the BSS channel
3150 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
3151 * based on the assumption that operating class triplet is not used in
3152 * beacon frame. If the First Channel Number/Operating Extension
3153 * Identifier octet has a positive integer value of 201 or greater,
3154 * then its operating class triplet.
3155 *
3156 * TODO: If Supported Operating Classes element is present in beacon
3157 * frame, have to lookup operating class in Annex E and fill them in
3158 * 2040 coex frame.
3159 */
3160 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
3161 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
3162 return 1;
3163
3164 os_memset(chan_list, 0, sizeof(chan_list));
3165
3166 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
3167 /* Skip other band bss */
3168 enum hostapd_hw_mode mode;
3169 mode = ieee80211_freq_to_chan(bss->freq, &channel);
3170 if (mode != HOSTAPD_MODE_IEEE80211G &&
3171 mode != HOSTAPD_MODE_IEEE80211B)
3172 continue;
3173
3174 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
3175 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
3176 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
3177 " freq=%u chan=%u ht_cap=0x%x",
3178 MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
3179
3180 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
3181 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
3182 num_intol++;
3183
3184 /* Check whether the channel is already considered */
3185 for (i = 0; i < num_channels; i++) {
3186 if (channel == chan_list[i])
3187 break;
3188 }
3189 if (i != num_channels)
3190 continue;
3191
3192 chan_list[num_channels++] = channel;
3193 }
3194 }
3195
3196 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
3197 return 1;
3198 }
3199
3200
wpa_obss_scan_freqs_list(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)3201 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
3202 struct wpa_driver_scan_params *params)
3203 {
3204 /* Include only affected channels */
3205 struct hostapd_hw_modes *mode;
3206 int count, i;
3207 int start, end;
3208
3209 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
3210 HOSTAPD_MODE_IEEE80211G, false);
3211 if (mode == NULL) {
3212 /* No channels supported in this band - use empty list */
3213 params->freqs = os_zalloc(sizeof(int));
3214 return;
3215 }
3216
3217 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
3218 wpa_s->current_bss) {
3219 const u8 *ie;
3220
3221 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
3222 if (ie && ie[1] >= 2) {
3223 u8 o;
3224
3225 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
3226 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
3227 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
3228 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
3229 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
3230 }
3231 }
3232
3233 start = wpa_s->assoc_freq - 10;
3234 end = wpa_s->assoc_freq + 10;
3235 switch (wpa_s->sme.ht_sec_chan) {
3236 case HT_SEC_CHAN_UNKNOWN:
3237 /* HT40+ possible on channels 1..9 */
3238 if (wpa_s->assoc_freq <= 2452)
3239 start -= 20;
3240 /* HT40- possible on channels 5-13 */
3241 if (wpa_s->assoc_freq >= 2432)
3242 end += 20;
3243 break;
3244 case HT_SEC_CHAN_ABOVE:
3245 end += 20;
3246 break;
3247 case HT_SEC_CHAN_BELOW:
3248 start -= 20;
3249 break;
3250 }
3251 wpa_printf(MSG_DEBUG,
3252 "OBSS: assoc_freq %d possible affected range %d-%d",
3253 wpa_s->assoc_freq, start, end);
3254
3255 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
3256 if (params->freqs == NULL)
3257 return;
3258 for (count = 0, i = 0; i < mode->num_channels; i++) {
3259 int freq;
3260
3261 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
3262 continue;
3263 freq = mode->channels[i].freq;
3264 if (freq - 10 >= end || freq + 10 <= start)
3265 continue; /* not affected */
3266 params->freqs[count++] = freq;
3267 }
3268 }
3269
3270
sme_obss_scan_timeout(void * eloop_ctx,void * timeout_ctx)3271 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3272 {
3273 struct wpa_supplicant *wpa_s = eloop_ctx;
3274 struct wpa_driver_scan_params params;
3275
3276 if (!wpa_s->current_bss) {
3277 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
3278 return;
3279 }
3280
3281 os_memset(¶ms, 0, sizeof(params));
3282 wpa_obss_scan_freqs_list(wpa_s, ¶ms);
3283 params.low_priority = 1;
3284 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
3285
3286 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms, true, false))
3287 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
3288 else
3289 wpa_s->sme.sched_obss_scan = 1;
3290 os_free(params.freqs);
3291
3292 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3293 sme_obss_scan_timeout, wpa_s, NULL);
3294 }
3295
3296
sme_sched_obss_scan(struct wpa_supplicant * wpa_s,int enable)3297 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
3298 {
3299 const u8 *ie;
3300 struct wpa_bss *bss = wpa_s->current_bss;
3301 struct wpa_ssid *ssid = wpa_s->current_ssid;
3302 struct hostapd_hw_modes *hw_mode = NULL;
3303 int i;
3304
3305 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
3306 wpa_s->sme.sched_obss_scan = 0;
3307 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
3308 if (!enable)
3309 return;
3310
3311 /*
3312 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
3313 * or it expects OBSS scan to be performed by wpa_supplicant.
3314 */
3315 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
3316 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
3317 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
3318 return;
3319
3320 #ifdef CONFIG_HT_OVERRIDES
3321 /* No need for OBSS scan if HT40 is explicitly disabled */
3322 if (ssid->disable_ht40)
3323 return;
3324 #endif /* CONFIG_HT_OVERRIDES */
3325
3326 if (!wpa_s->hw.modes)
3327 return;
3328
3329 /* only HT caps in 11g mode are relevant */
3330 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3331 hw_mode = &wpa_s->hw.modes[i];
3332 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
3333 break;
3334 }
3335
3336 /* Driver does not support HT40 for 11g or doesn't have 11g. */
3337 if (i == wpa_s->hw.num_modes || !hw_mode ||
3338 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3339 return;
3340
3341 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
3342 return; /* Not associated on 2.4 GHz band */
3343
3344 /* Check whether AP supports HT40 */
3345 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
3346 if (!ie || ie[1] < 2 ||
3347 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
3348 return; /* AP does not support HT40 */
3349
3350 ie = wpa_bss_get_ie(wpa_s->current_bss,
3351 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
3352 if (!ie || ie[1] < 14)
3353 return; /* AP does not request OBSS scans */
3354
3355 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
3356 if (wpa_s->sme.obss_scan_int < 10) {
3357 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
3358 "replaced with the minimum 10 sec",
3359 wpa_s->sme.obss_scan_int);
3360 wpa_s->sme.obss_scan_int = 10;
3361 }
3362 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
3363 wpa_s->sme.obss_scan_int);
3364 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
3365 sme_obss_scan_timeout, wpa_s, NULL);
3366 }
3367
3368
3369 static const unsigned int sa_query_max_timeout = 1000;
3370 static const unsigned int sa_query_retry_timeout = 201;
3371 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
3372
sme_check_sa_query_timeout(struct wpa_supplicant * wpa_s)3373 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
3374 {
3375 u32 tu;
3376 struct os_reltime now, passed;
3377 os_get_reltime(&now);
3378 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
3379 tu = (passed.sec * 1000000 + passed.usec) / 1024;
3380 if (sa_query_max_timeout < tu) {
3381 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
3382 sme_stop_sa_query(wpa_s);
3383 wpa_supplicant_deauthenticate(
3384 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
3385 return 1;
3386 }
3387
3388 return 0;
3389 }
3390
3391
sme_send_sa_query_req(struct wpa_supplicant * wpa_s,const u8 * trans_id)3392 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
3393 const u8 *trans_id)
3394 {
3395 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3396 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3397
3398 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
3399 MACSTR, MAC2STR(wpa_s->bssid));
3400 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
3401 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3402 req[0] = WLAN_ACTION_SA_QUERY;
3403 req[1] = WLAN_SA_QUERY_REQUEST;
3404 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
3405
3406 #ifdef CONFIG_OCV
3407 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3408 struct wpa_channel_info ci;
3409
3410 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3411 wpa_printf(MSG_WARNING,
3412 "Failed to get channel info for OCI element in SA Query Request frame");
3413 return;
3414 }
3415
3416 #ifdef CONFIG_TESTING_OPTIONS
3417 if (wpa_s->oci_freq_override_saquery_req) {
3418 wpa_printf(MSG_INFO,
3419 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
3420 ci.frequency,
3421 wpa_s->oci_freq_override_saquery_req);
3422 ci.frequency = wpa_s->oci_freq_override_saquery_req;
3423 }
3424 #endif /* CONFIG_TESTING_OPTIONS */
3425
3426 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
3427 return;
3428
3429 req_len += OCV_OCI_EXTENDED_LEN;
3430 }
3431 #endif /* CONFIG_OCV */
3432
3433 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3434 wpa_s->own_addr, wpa_s->bssid,
3435 req, req_len, 0) < 0)
3436 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
3437 "Request");
3438 }
3439
3440
sme_sa_query_timer(void * eloop_ctx,void * timeout_ctx)3441 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
3442 {
3443 struct wpa_supplicant *wpa_s = eloop_ctx;
3444 unsigned int timeout, sec, usec;
3445 u8 *trans_id, *nbuf;
3446
3447 if (wpa_s->sme.sa_query_count > 0 &&
3448 sme_check_sa_query_timeout(wpa_s))
3449 return;
3450
3451 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
3452 wpa_s->sme.sa_query_count + 1,
3453 WLAN_SA_QUERY_TR_ID_LEN);
3454 if (nbuf == NULL) {
3455 sme_stop_sa_query(wpa_s);
3456 return;
3457 }
3458 if (wpa_s->sme.sa_query_count == 0) {
3459 /* Starting a new SA Query procedure */
3460 os_get_reltime(&wpa_s->sme.sa_query_start);
3461 }
3462 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
3463 wpa_s->sme.sa_query_trans_id = nbuf;
3464 wpa_s->sme.sa_query_count++;
3465
3466 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
3467 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
3468 sme_stop_sa_query(wpa_s);
3469 return;
3470 }
3471
3472 timeout = sa_query_retry_timeout;
3473 sec = ((timeout / 1000) * 1024) / 1000;
3474 usec = (timeout % 1000) * 1024;
3475 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
3476
3477 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
3478 wpa_s->sme.sa_query_count);
3479
3480 sme_send_sa_query_req(wpa_s, trans_id);
3481 }
3482
3483
sme_start_sa_query(struct wpa_supplicant * wpa_s)3484 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
3485 {
3486 sme_sa_query_timer(wpa_s, NULL);
3487 }
3488
3489
sme_stop_sa_query(struct wpa_supplicant * wpa_s)3490 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
3491 {
3492 if (wpa_s->sme.sa_query_trans_id)
3493 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
3494 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
3495 os_free(wpa_s->sme.sa_query_trans_id);
3496 wpa_s->sme.sa_query_trans_id = NULL;
3497 wpa_s->sme.sa_query_count = 0;
3498 }
3499
3500
sme_event_unprot_disconnect(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * da,u16 reason_code)3501 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
3502 const u8 *da, u16 reason_code)
3503 {
3504 struct wpa_ssid *ssid;
3505 struct os_reltime now;
3506
3507 if (wpa_s->wpa_state != WPA_COMPLETED)
3508 return;
3509 ssid = wpa_s->current_ssid;
3510 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
3511 return;
3512 if (!ether_addr_equal(sa, wpa_s->bssid))
3513 return;
3514 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
3515 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
3516 return;
3517 if (wpa_s->sme.sa_query_count > 0)
3518 return;
3519 #ifdef CONFIG_TESTING_OPTIONS
3520 if (wpa_s->disable_sa_query)
3521 return;
3522 #endif /* CONFIG_TESTING_OPTIONS */
3523
3524 os_get_reltime(&now);
3525 if (wpa_s->sme.last_unprot_disconnect.sec &&
3526 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
3527 return; /* limit SA Query procedure frequency */
3528 wpa_s->sme.last_unprot_disconnect = now;
3529
3530 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
3531 "possible AP/STA state mismatch - trigger SA Query");
3532 sme_start_sa_query(wpa_s);
3533 }
3534
3535
sme_event_ch_switch(struct wpa_supplicant * wpa_s)3536 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
3537 {
3538 unsigned int usec;
3539 u32 _rand;
3540
3541 if (wpa_s->wpa_state != WPA_COMPLETED ||
3542 !wpa_sm_ocv_enabled(wpa_s->wpa))
3543 return;
3544
3545 wpa_dbg(wpa_s, MSG_DEBUG,
3546 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
3547 sme_stop_sa_query(wpa_s);
3548
3549 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
3550 _rand = os_random();
3551 usec = _rand % (sa_query_ch_switch_max_delay + 1);
3552 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
3553 }
3554
3555
sme_process_sa_query_request(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3556 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
3557 const u8 *sa, const u8 *data,
3558 size_t len)
3559 {
3560 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
3561 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
3562
3563 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
3564 MACSTR, MAC2STR(wpa_s->bssid));
3565
3566 resp[0] = WLAN_ACTION_SA_QUERY;
3567 resp[1] = WLAN_SA_QUERY_RESPONSE;
3568 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
3569
3570 #ifdef CONFIG_OCV
3571 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3572 struct wpa_channel_info ci;
3573
3574 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3575 wpa_printf(MSG_WARNING,
3576 "Failed to get channel info for OCI element in SA Query Response frame");
3577 return;
3578 }
3579
3580 #ifdef CONFIG_TESTING_OPTIONS
3581 if (wpa_s->oci_freq_override_saquery_resp) {
3582 wpa_printf(MSG_INFO,
3583 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
3584 ci.frequency,
3585 wpa_s->oci_freq_override_saquery_resp);
3586 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
3587 }
3588 #endif /* CONFIG_TESTING_OPTIONS */
3589
3590 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
3591 return;
3592
3593 resp_len += OCV_OCI_EXTENDED_LEN;
3594 }
3595 #endif /* CONFIG_OCV */
3596
3597 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3598 wpa_s->own_addr, wpa_s->bssid,
3599 resp, resp_len, 0) < 0)
3600 wpa_msg(wpa_s, MSG_INFO,
3601 "SME: Failed to send SA Query Response");
3602 }
3603
3604
sme_process_sa_query_response(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)3605 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
3606 const u8 *sa, const u8 *data,
3607 size_t len)
3608 {
3609 int i;
3610
3611 if (!wpa_s->sme.sa_query_trans_id)
3612 return;
3613
3614 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
3615 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3616
3617 if (!ether_addr_equal(sa, wpa_s->bssid))
3618 return;
3619
3620 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
3621 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
3622 i * WLAN_SA_QUERY_TR_ID_LEN,
3623 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
3624 break;
3625 }
3626
3627 if (i >= wpa_s->sme.sa_query_count) {
3628 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
3629 "transaction identifier found");
3630 return;
3631 }
3632
3633 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
3634 "from " MACSTR, MAC2STR(sa));
3635 sme_stop_sa_query(wpa_s);
3636 }
3637
3638
sme_sa_query_rx(struct wpa_supplicant * wpa_s,const u8 * da,const u8 * sa,const u8 * data,size_t len)3639 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
3640 const u8 *data, size_t len)
3641 {
3642 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
3643 return;
3644 if (is_multicast_ether_addr(da)) {
3645 wpa_printf(MSG_DEBUG,
3646 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
3647 MAC2STR(da), MAC2STR(sa));
3648 return;
3649 }
3650
3651 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
3652 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
3653
3654 #ifdef CONFIG_OCV
3655 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
3656 struct ieee802_11_elems elems;
3657 struct wpa_channel_info ci;
3658
3659 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
3660 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
3661 &elems, 1) == ParseFailed) {
3662 wpa_printf(MSG_DEBUG,
3663 "SA Query: Failed to parse elements");
3664 return;
3665 }
3666
3667 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
3668 wpa_printf(MSG_WARNING,
3669 "Failed to get channel info to validate received OCI in SA Query Action frame");
3670 return;
3671 }
3672
3673 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
3674 channel_width_to_int(ci.chanwidth),
3675 ci.seg1_idx) != OCI_SUCCESS) {
3676 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
3677 " frame=saquery%s error=%s",
3678 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
3679 "req" : "resp", ocv_errorstr);
3680 return;
3681 }
3682 }
3683 #endif /* CONFIG_OCV */
3684
3685 if (data[0] == WLAN_SA_QUERY_REQUEST)
3686 sme_process_sa_query_request(wpa_s, sa, data, len);
3687 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
3688 sme_process_sa_query_response(wpa_s, sa, data, len);
3689 }
3690