interworking.c 50 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092
  1. /*
  2. * Interworking (IEEE 802.11u)
  3. * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
  4. *
  5. * This software may be distributed under the terms of the BSD license.
  6. * See README for more details.
  7. */
  8. #include "includes.h"
  9. #include "common.h"
  10. #include "common/ieee802_11_defs.h"
  11. #include "common/gas.h"
  12. #include "common/wpa_ctrl.h"
  13. #include "utils/pcsc_funcs.h"
  14. #include "utils/eloop.h"
  15. #include "drivers/driver.h"
  16. #include "eap_common/eap_defs.h"
  17. #include "eap_peer/eap.h"
  18. #include "eap_peer/eap_methods.h"
  19. #include "wpa_supplicant_i.h"
  20. #include "config.h"
  21. #include "config_ssid.h"
  22. #include "bss.h"
  23. #include "scan.h"
  24. #include "notify.h"
  25. #include "gas_query.h"
  26. #include "hs20_supplicant.h"
  27. #include "interworking.h"
  28. #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  29. #define INTERWORKING_3GPP
  30. #else
  31. #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  32. #define INTERWORKING_3GPP
  33. #else
  34. #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  35. #define INTERWORKING_3GPP
  36. #endif
  37. #endif
  38. #endif
  39. static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  40. static struct wpa_cred * interworking_credentials_available_realm(
  41. struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
  42. static struct wpa_cred * interworking_credentials_available_3gpp(
  43. struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
  44. static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  45. {
  46. if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  47. wpa_supplicant_cancel_sched_scan(wpa_s);
  48. wpa_supplicant_deauthenticate(wpa_s,
  49. WLAN_REASON_DEAUTH_LEAVING);
  50. }
  51. wpa_s->disconnected = 0;
  52. wpa_s->reassociate = 1;
  53. if (wpa_supplicant_fast_associate(wpa_s) >= 0)
  54. return;
  55. wpa_supplicant_req_scan(wpa_s, 0, 0);
  56. }
  57. static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  58. struct wpabuf *extra)
  59. {
  60. struct wpabuf *buf;
  61. size_t i;
  62. u8 *len_pos;
  63. buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
  64. (extra ? wpabuf_len(extra) : 0));
  65. if (buf == NULL)
  66. return NULL;
  67. len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
  68. for (i = 0; i < num_ids; i++)
  69. wpabuf_put_le16(buf, info_ids[i]);
  70. gas_anqp_set_element_len(buf, len_pos);
  71. if (extra)
  72. wpabuf_put_buf(buf, extra);
  73. gas_anqp_set_len(buf);
  74. return buf;
  75. }
  76. static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
  77. u8 dialog_token,
  78. enum gas_query_result result,
  79. const struct wpabuf *adv_proto,
  80. const struct wpabuf *resp,
  81. u16 status_code)
  82. {
  83. struct wpa_supplicant *wpa_s = ctx;
  84. anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
  85. status_code);
  86. interworking_next_anqp_fetch(wpa_s);
  87. }
  88. static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
  89. {
  90. struct wpa_cred *cred;
  91. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  92. if (cred->roaming_consortium_len)
  93. return 1;
  94. }
  95. return 0;
  96. }
  97. static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
  98. {
  99. struct wpa_cred *cred;
  100. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  101. if (cred->pcsc || cred->imsi)
  102. return 1;
  103. }
  104. return 0;
  105. }
  106. static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
  107. {
  108. struct wpa_cred *cred;
  109. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  110. if (cred->pcsc || cred->imsi)
  111. continue;
  112. if (!cred->eap_method)
  113. return 1;
  114. if (cred->realm && cred->roaming_consortium_len == 0)
  115. return 1;
  116. }
  117. return 0;
  118. }
  119. static int cred_with_domain(struct wpa_supplicant *wpa_s)
  120. {
  121. struct wpa_cred *cred;
  122. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  123. if (cred->domain || cred->pcsc || cred->imsi)
  124. return 1;
  125. }
  126. return 0;
  127. }
  128. static int additional_roaming_consortiums(struct wpa_bss *bss)
  129. {
  130. const u8 *ie;
  131. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  132. if (ie == NULL || ie[1] == 0)
  133. return 0;
  134. return ie[2]; /* Number of ANQP OIs */
  135. }
  136. static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
  137. {
  138. struct wpa_supplicant *wpa_s = eloop_ctx;
  139. interworking_next_anqp_fetch(wpa_s);
  140. }
  141. static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
  142. struct wpa_bss *bss)
  143. {
  144. struct wpabuf *buf;
  145. int ret = 0;
  146. int res;
  147. u16 info_ids[8];
  148. size_t num_info_ids = 0;
  149. struct wpabuf *extra = NULL;
  150. int all = wpa_s->fetch_all_anqp;
  151. wpa_printf(MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
  152. MAC2STR(bss->bssid));
  153. info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
  154. if (all) {
  155. info_ids[num_info_ids++] = ANQP_VENUE_NAME;
  156. info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
  157. }
  158. if (all || (cred_with_roaming_consortium(wpa_s) &&
  159. additional_roaming_consortiums(bss)))
  160. info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
  161. if (all)
  162. info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
  163. if (all || cred_with_nai_realm(wpa_s))
  164. info_ids[num_info_ids++] = ANQP_NAI_REALM;
  165. if (all || cred_with_3gpp(wpa_s))
  166. info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
  167. if (all || cred_with_domain(wpa_s))
  168. info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
  169. wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
  170. (u8 *) info_ids, num_info_ids * 2);
  171. #ifdef CONFIG_HS20
  172. if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
  173. u8 *len_pos;
  174. extra = wpabuf_alloc(100);
  175. if (!extra)
  176. return -1;
  177. len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
  178. wpabuf_put_be24(extra, OUI_WFA);
  179. wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
  180. wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
  181. wpabuf_put_u8(extra, 0); /* Reserved */
  182. wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
  183. if (all) {
  184. wpabuf_put_u8(extra,
  185. HS20_STYPE_OPERATOR_FRIENDLY_NAME);
  186. wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
  187. wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
  188. wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
  189. }
  190. gas_anqp_set_element_len(extra, len_pos);
  191. }
  192. #endif /* CONFIG_HS20 */
  193. buf = anqp_build_req(info_ids, num_info_ids, extra);
  194. wpabuf_free(extra);
  195. if (buf == NULL)
  196. return -1;
  197. res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, buf,
  198. interworking_anqp_resp_cb, wpa_s);
  199. if (res < 0) {
  200. wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
  201. ret = -1;
  202. eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
  203. NULL);
  204. } else
  205. wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
  206. "%u", res);
  207. wpabuf_free(buf);
  208. return ret;
  209. }
  210. struct nai_realm_eap {
  211. u8 method;
  212. u8 inner_method;
  213. enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
  214. u8 cred_type;
  215. u8 tunneled_cred_type;
  216. };
  217. struct nai_realm {
  218. u8 encoding;
  219. char *realm;
  220. u8 eap_count;
  221. struct nai_realm_eap *eap;
  222. };
  223. static void nai_realm_free(struct nai_realm *realms, u16 count)
  224. {
  225. u16 i;
  226. if (realms == NULL)
  227. return;
  228. for (i = 0; i < count; i++) {
  229. os_free(realms[i].eap);
  230. os_free(realms[i].realm);
  231. }
  232. os_free(realms);
  233. }
  234. static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
  235. const u8 *end)
  236. {
  237. u8 elen, auth_count, a;
  238. const u8 *e_end;
  239. if (pos + 3 > end) {
  240. wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
  241. return NULL;
  242. }
  243. elen = *pos++;
  244. if (pos + elen > end || elen < 2) {
  245. wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
  246. return NULL;
  247. }
  248. e_end = pos + elen;
  249. e->method = *pos++;
  250. auth_count = *pos++;
  251. wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
  252. elen, e->method, auth_count);
  253. for (a = 0; a < auth_count; a++) {
  254. u8 id, len;
  255. if (pos + 2 > end || pos + 2 + pos[1] > end) {
  256. wpa_printf(MSG_DEBUG, "No room for Authentication "
  257. "Parameter subfield");
  258. return NULL;
  259. }
  260. id = *pos++;
  261. len = *pos++;
  262. switch (id) {
  263. case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
  264. if (len < 1)
  265. break;
  266. e->inner_non_eap = *pos;
  267. if (e->method != EAP_TYPE_TTLS)
  268. break;
  269. switch (*pos) {
  270. case NAI_REALM_INNER_NON_EAP_PAP:
  271. wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
  272. break;
  273. case NAI_REALM_INNER_NON_EAP_CHAP:
  274. wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
  275. break;
  276. case NAI_REALM_INNER_NON_EAP_MSCHAP:
  277. wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
  278. break;
  279. case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
  280. wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
  281. break;
  282. }
  283. break;
  284. case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
  285. if (len < 1)
  286. break;
  287. e->inner_method = *pos;
  288. wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
  289. e->inner_method);
  290. break;
  291. case NAI_REALM_EAP_AUTH_CRED_TYPE:
  292. if (len < 1)
  293. break;
  294. e->cred_type = *pos;
  295. wpa_printf(MSG_DEBUG, "Credential Type: %u",
  296. e->cred_type);
  297. break;
  298. case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
  299. if (len < 1)
  300. break;
  301. e->tunneled_cred_type = *pos;
  302. wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
  303. "Type: %u", e->tunneled_cred_type);
  304. break;
  305. default:
  306. wpa_printf(MSG_DEBUG, "Unsupported Authentication "
  307. "Parameter: id=%u len=%u", id, len);
  308. wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
  309. "Value", pos, len);
  310. break;
  311. }
  312. pos += len;
  313. }
  314. return e_end;
  315. }
  316. static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
  317. const u8 *end)
  318. {
  319. u16 len;
  320. const u8 *f_end;
  321. u8 realm_len, e;
  322. if (end - pos < 4) {
  323. wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
  324. "fixed fields");
  325. return NULL;
  326. }
  327. len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
  328. pos += 2;
  329. if (pos + len > end || len < 3) {
  330. wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
  331. "(len=%u; left=%u)",
  332. len, (unsigned int) (end - pos));
  333. return NULL;
  334. }
  335. f_end = pos + len;
  336. r->encoding = *pos++;
  337. realm_len = *pos++;
  338. if (pos + realm_len > f_end) {
  339. wpa_printf(MSG_DEBUG, "No room for NAI Realm "
  340. "(len=%u; left=%u)",
  341. realm_len, (unsigned int) (f_end - pos));
  342. return NULL;
  343. }
  344. wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
  345. r->realm = os_malloc(realm_len + 1);
  346. if (r->realm == NULL)
  347. return NULL;
  348. os_memcpy(r->realm, pos, realm_len);
  349. r->realm[realm_len] = '\0';
  350. pos += realm_len;
  351. if (pos + 1 > f_end) {
  352. wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
  353. return NULL;
  354. }
  355. r->eap_count = *pos++;
  356. wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
  357. if (pos + r->eap_count * 3 > f_end) {
  358. wpa_printf(MSG_DEBUG, "No room for EAP Methods");
  359. return NULL;
  360. }
  361. r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
  362. if (r->eap == NULL)
  363. return NULL;
  364. for (e = 0; e < r->eap_count; e++) {
  365. pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
  366. if (pos == NULL)
  367. return NULL;
  368. }
  369. return f_end;
  370. }
  371. static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
  372. {
  373. struct nai_realm *realm;
  374. const u8 *pos, *end;
  375. u16 i, num;
  376. if (anqp == NULL || wpabuf_len(anqp) < 2)
  377. return NULL;
  378. pos = wpabuf_head_u8(anqp);
  379. end = pos + wpabuf_len(anqp);
  380. num = WPA_GET_LE16(pos);
  381. wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
  382. pos += 2;
  383. if (num * 5 > end - pos) {
  384. wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
  385. "enough data (%u octets) for that many realms",
  386. num, (unsigned int) (end - pos));
  387. return NULL;
  388. }
  389. realm = os_calloc(num, sizeof(struct nai_realm));
  390. if (realm == NULL)
  391. return NULL;
  392. for (i = 0; i < num; i++) {
  393. pos = nai_realm_parse_realm(&realm[i], pos, end);
  394. if (pos == NULL) {
  395. nai_realm_free(realm, num);
  396. return NULL;
  397. }
  398. }
  399. *count = num;
  400. return realm;
  401. }
  402. static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
  403. {
  404. char *tmp, *pos, *end;
  405. int match = 0;
  406. if (realm->realm == NULL || home_realm == NULL)
  407. return 0;
  408. if (os_strchr(realm->realm, ';') == NULL)
  409. return os_strcasecmp(realm->realm, home_realm) == 0;
  410. tmp = os_strdup(realm->realm);
  411. if (tmp == NULL)
  412. return 0;
  413. pos = tmp;
  414. while (*pos) {
  415. end = os_strchr(pos, ';');
  416. if (end)
  417. *end = '\0';
  418. if (os_strcasecmp(pos, home_realm) == 0) {
  419. match = 1;
  420. break;
  421. }
  422. if (end == NULL)
  423. break;
  424. pos = end + 1;
  425. }
  426. os_free(tmp);
  427. return match;
  428. }
  429. static int nai_realm_cred_username(struct nai_realm_eap *eap)
  430. {
  431. if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
  432. return 0; /* method not supported */
  433. if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP) {
  434. /* Only tunneled methods with username/password supported */
  435. return 0;
  436. }
  437. if (eap->method == EAP_TYPE_PEAP) {
  438. if (eap->inner_method &&
  439. eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
  440. return 0;
  441. if (!eap->inner_method &&
  442. eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL)
  443. return 0;
  444. }
  445. if (eap->method == EAP_TYPE_TTLS) {
  446. if (eap->inner_method == 0 && eap->inner_non_eap == 0)
  447. return 1; /* Assume TTLS/MSCHAPv2 is used */
  448. if (eap->inner_method &&
  449. eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
  450. return 0;
  451. if (eap->inner_non_eap &&
  452. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
  453. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
  454. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
  455. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2)
  456. return 0;
  457. }
  458. if (eap->inner_method &&
  459. eap->inner_method != EAP_TYPE_GTC &&
  460. eap->inner_method != EAP_TYPE_MSCHAPV2)
  461. return 0;
  462. return 1;
  463. }
  464. static int nai_realm_cred_cert(struct nai_realm_eap *eap)
  465. {
  466. if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
  467. return 0; /* method not supported */
  468. if (eap->method != EAP_TYPE_TLS) {
  469. /* Only EAP-TLS supported for credential authentication */
  470. return 0;
  471. }
  472. return 1;
  473. }
  474. static struct nai_realm_eap * nai_realm_find_eap(struct wpa_cred *cred,
  475. struct nai_realm *realm)
  476. {
  477. u8 e;
  478. if (cred == NULL ||
  479. cred->username == NULL ||
  480. cred->username[0] == '\0' ||
  481. ((cred->password == NULL ||
  482. cred->password[0] == '\0') &&
  483. (cred->private_key == NULL ||
  484. cred->private_key[0] == '\0')))
  485. return NULL;
  486. for (e = 0; e < realm->eap_count; e++) {
  487. struct nai_realm_eap *eap = &realm->eap[e];
  488. if (cred->password && cred->password[0] &&
  489. nai_realm_cred_username(eap))
  490. return eap;
  491. if (cred->private_key && cred->private_key[0] &&
  492. nai_realm_cred_cert(eap))
  493. return eap;
  494. }
  495. return NULL;
  496. }
  497. #ifdef INTERWORKING_3GPP
  498. static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
  499. {
  500. u8 plmn[3];
  501. const u8 *pos, *end;
  502. u8 udhl;
  503. /* See Annex A of 3GPP TS 24.234 v8.1.0 for description */
  504. plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
  505. plmn[1] = imsi[2] - '0';
  506. /* default to MNC length 3 if unknown */
  507. if (mnc_len != 2)
  508. plmn[1] |= (imsi[5] - '0') << 4;
  509. else
  510. plmn[1] |= 0xf0;
  511. plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
  512. if (anqp == NULL)
  513. return 0;
  514. pos = wpabuf_head_u8(anqp);
  515. end = pos + wpabuf_len(anqp);
  516. if (pos + 2 > end)
  517. return 0;
  518. if (*pos != 0) {
  519. wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
  520. return 0;
  521. }
  522. pos++;
  523. udhl = *pos++;
  524. if (pos + udhl > end) {
  525. wpa_printf(MSG_DEBUG, "Invalid UDHL");
  526. return 0;
  527. }
  528. end = pos + udhl;
  529. while (pos + 2 <= end) {
  530. u8 iei, len;
  531. const u8 *l_end;
  532. iei = *pos++;
  533. len = *pos++ & 0x7f;
  534. if (pos + len > end)
  535. break;
  536. l_end = pos + len;
  537. if (iei == 0 && len > 0) {
  538. /* PLMN List */
  539. u8 num, i;
  540. num = *pos++;
  541. for (i = 0; i < num; i++) {
  542. if (pos + 3 > end)
  543. break;
  544. if (os_memcmp(pos, plmn, 3) == 0)
  545. return 1; /* Found matching PLMN */
  546. pos += 3;
  547. }
  548. }
  549. pos = l_end;
  550. }
  551. return 0;
  552. }
  553. static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
  554. size_t mnc_len, char prefix)
  555. {
  556. const char *sep, *msin;
  557. char *end, *pos;
  558. size_t msin_len, plmn_len;
  559. /*
  560. * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
  561. * Root NAI:
  562. * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
  563. * <MNC> is zero-padded to three digits in case two-digit MNC is used
  564. */
  565. if (imsi == NULL || os_strlen(imsi) > 16) {
  566. wpa_printf(MSG_DEBUG, "No valid IMSI available");
  567. return -1;
  568. }
  569. sep = os_strchr(imsi, '-');
  570. if (sep) {
  571. plmn_len = sep - imsi;
  572. msin = sep + 1;
  573. } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
  574. plmn_len = 3 + mnc_len;
  575. msin = imsi + plmn_len;
  576. } else
  577. return -1;
  578. if (plmn_len != 5 && plmn_len != 6)
  579. return -1;
  580. msin_len = os_strlen(msin);
  581. pos = nai;
  582. end = nai + nai_len;
  583. if (prefix)
  584. *pos++ = prefix;
  585. os_memcpy(pos, imsi, plmn_len);
  586. pos += plmn_len;
  587. os_memcpy(pos, msin, msin_len);
  588. pos += msin_len;
  589. pos += os_snprintf(pos, end - pos, "@wlan.mnc");
  590. if (plmn_len == 5) {
  591. *pos++ = '0';
  592. *pos++ = imsi[3];
  593. *pos++ = imsi[4];
  594. } else {
  595. *pos++ = imsi[3];
  596. *pos++ = imsi[4];
  597. *pos++ = imsi[5];
  598. }
  599. pos += os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
  600. imsi[0], imsi[1], imsi[2]);
  601. return 0;
  602. }
  603. static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
  604. {
  605. char nai[100];
  606. if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
  607. return -1;
  608. return wpa_config_set_quoted(ssid, "identity", nai);
  609. }
  610. #endif /* INTERWORKING_3GPP */
  611. static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
  612. struct wpa_ssid *ssid)
  613. {
  614. if (wpa_config_set(ssid, "key_mgmt",
  615. wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
  616. "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP", 0) < 0)
  617. return -1;
  618. if (wpa_config_set(ssid, "proto", "RSN", 0) < 0)
  619. return -1;
  620. if (wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
  621. return -1;
  622. return 0;
  623. }
  624. static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
  625. struct wpa_cred *cred,
  626. struct wpa_bss *bss)
  627. {
  628. #ifdef INTERWORKING_3GPP
  629. struct wpa_ssid *ssid;
  630. const u8 *ie;
  631. int eap_type;
  632. int res;
  633. char prefix;
  634. if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
  635. return -1;
  636. ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
  637. if (ie == NULL)
  638. return -1;
  639. wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " (3GPP)",
  640. MAC2STR(bss->bssid));
  641. ssid = wpa_config_add_network(wpa_s->conf);
  642. if (ssid == NULL)
  643. return -1;
  644. ssid->parent_cred = cred;
  645. wpas_notify_network_added(wpa_s, ssid);
  646. wpa_config_set_network_defaults(ssid);
  647. ssid->priority = cred->priority;
  648. ssid->temporary = 1;
  649. ssid->ssid = os_zalloc(ie[1] + 1);
  650. if (ssid->ssid == NULL)
  651. goto fail;
  652. os_memcpy(ssid->ssid, ie + 2, ie[1]);
  653. ssid->ssid_len = ie[1];
  654. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  655. goto fail;
  656. eap_type = EAP_TYPE_SIM;
  657. if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
  658. eap_type = EAP_TYPE_AKA;
  659. if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
  660. if (cred->eap_method[0].method == EAP_TYPE_SIM ||
  661. cred->eap_method[0].method == EAP_TYPE_AKA ||
  662. cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
  663. eap_type = cred->eap_method[0].method;
  664. }
  665. switch (eap_type) {
  666. case EAP_TYPE_SIM:
  667. prefix = '1';
  668. res = wpa_config_set(ssid, "eap", "SIM", 0);
  669. break;
  670. case EAP_TYPE_AKA:
  671. prefix = '0';
  672. res = wpa_config_set(ssid, "eap", "AKA", 0);
  673. break;
  674. case EAP_TYPE_AKA_PRIME:
  675. prefix = '6';
  676. res = wpa_config_set(ssid, "eap", "AKA'", 0);
  677. break;
  678. default:
  679. res = -1;
  680. break;
  681. }
  682. if (res < 0) {
  683. wpa_printf(MSG_DEBUG, "Selected EAP method (%d) not supported",
  684. eap_type);
  685. goto fail;
  686. }
  687. if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
  688. wpa_printf(MSG_DEBUG, "Failed to set Root NAI");
  689. goto fail;
  690. }
  691. if (cred->milenage && cred->milenage[0]) {
  692. if (wpa_config_set_quoted(ssid, "password",
  693. cred->milenage) < 0)
  694. goto fail;
  695. } else if (cred->pcsc) {
  696. if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
  697. goto fail;
  698. if (wpa_s->conf->pcsc_pin &&
  699. wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
  700. < 0)
  701. goto fail;
  702. }
  703. if (cred->password && cred->password[0] &&
  704. wpa_config_set_quoted(ssid, "password", cred->password) < 0)
  705. goto fail;
  706. wpa_config_update_prio_list(wpa_s->conf);
  707. interworking_reconnect(wpa_s);
  708. return 0;
  709. fail:
  710. wpas_notify_network_removed(wpa_s, ssid);
  711. wpa_config_remove_network(wpa_s->conf, ssid->id);
  712. #endif /* INTERWORKING_3GPP */
  713. return -1;
  714. }
  715. static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
  716. size_t rc_len)
  717. {
  718. const u8 *pos, *end;
  719. u8 lens;
  720. if (ie == NULL)
  721. return 0;
  722. pos = ie + 2;
  723. end = ie + 2 + ie[1];
  724. /* Roaming Consortium element:
  725. * Number of ANQP OIs
  726. * OI #1 and #2 lengths
  727. * OI #1, [OI #2], [OI #3]
  728. */
  729. if (pos + 2 > end)
  730. return 0;
  731. pos++; /* skip Number of ANQP OIs */
  732. lens = *pos++;
  733. if (pos + (lens & 0x0f) + (lens >> 4) > end)
  734. return 0;
  735. if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  736. return 1;
  737. pos += lens & 0x0f;
  738. if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  739. return 1;
  740. pos += lens >> 4;
  741. if (pos < end && (size_t) (end - pos) == rc_len &&
  742. os_memcmp(pos, rc_id, rc_len) == 0)
  743. return 1;
  744. return 0;
  745. }
  746. static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
  747. const u8 *rc_id, size_t rc_len)
  748. {
  749. const u8 *pos, *end;
  750. u8 len;
  751. if (anqp == NULL)
  752. return 0;
  753. pos = wpabuf_head(anqp);
  754. end = pos + wpabuf_len(anqp);
  755. /* Set of <OI Length, OI> duples */
  756. while (pos < end) {
  757. len = *pos++;
  758. if (pos + len > end)
  759. break;
  760. if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  761. return 1;
  762. pos += len;
  763. }
  764. return 0;
  765. }
  766. static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
  767. const u8 *rc_id, size_t rc_len)
  768. {
  769. return roaming_consortium_element_match(ie, rc_id, rc_len) ||
  770. roaming_consortium_anqp_match(anqp, rc_id, rc_len);
  771. }
  772. static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
  773. {
  774. size_t i;
  775. if (!cred->excluded_ssid)
  776. return 0;
  777. for (i = 0; i < cred->num_excluded_ssid; i++) {
  778. struct excluded_ssid *e = &cred->excluded_ssid[i];
  779. if (bss->ssid_len == e->ssid_len &&
  780. os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
  781. return 1;
  782. }
  783. return 0;
  784. }
  785. static struct wpa_cred * interworking_credentials_available_roaming_consortium(
  786. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  787. {
  788. struct wpa_cred *cred, *selected = NULL;
  789. const u8 *ie;
  790. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  791. if (ie == NULL &&
  792. (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
  793. return NULL;
  794. if (wpa_s->conf->cred == NULL)
  795. return NULL;
  796. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  797. if (cred->roaming_consortium_len == 0)
  798. continue;
  799. if (!roaming_consortium_match(ie,
  800. bss->anqp ?
  801. bss->anqp->roaming_consortium :
  802. NULL,
  803. cred->roaming_consortium,
  804. cred->roaming_consortium_len))
  805. continue;
  806. if (cred_excluded_ssid(cred, bss))
  807. continue;
  808. if (selected == NULL ||
  809. selected->priority < cred->priority)
  810. selected = cred;
  811. }
  812. return selected;
  813. }
  814. static int interworking_set_eap_params(struct wpa_ssid *ssid,
  815. struct wpa_cred *cred, int ttls)
  816. {
  817. if (cred->eap_method) {
  818. ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
  819. cred->eap_method->method == EAP_TYPE_TTLS;
  820. os_free(ssid->eap.eap_methods);
  821. ssid->eap.eap_methods =
  822. os_malloc(sizeof(struct eap_method_type) * 2);
  823. if (ssid->eap.eap_methods == NULL)
  824. return -1;
  825. os_memcpy(ssid->eap.eap_methods, cred->eap_method,
  826. sizeof(*cred->eap_method));
  827. ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
  828. ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
  829. }
  830. if (ttls && cred->username && cred->username[0]) {
  831. const char *pos;
  832. char *anon;
  833. /* Use anonymous NAI in Phase 1 */
  834. pos = os_strchr(cred->username, '@');
  835. if (pos) {
  836. size_t buflen = 9 + os_strlen(pos) + 1;
  837. anon = os_malloc(buflen);
  838. if (anon == NULL)
  839. return -1;
  840. os_snprintf(anon, buflen, "anonymous%s", pos);
  841. } else if (cred->realm) {
  842. size_t buflen = 10 + os_strlen(cred->realm) + 1;
  843. anon = os_malloc(buflen);
  844. if (anon == NULL)
  845. return -1;
  846. os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
  847. } else {
  848. anon = os_strdup("anonymous");
  849. if (anon == NULL)
  850. return -1;
  851. }
  852. if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
  853. 0) {
  854. os_free(anon);
  855. return -1;
  856. }
  857. os_free(anon);
  858. }
  859. if (cred->username && cred->username[0] &&
  860. wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
  861. return -1;
  862. if (cred->password && cred->password[0]) {
  863. if (cred->ext_password &&
  864. wpa_config_set(ssid, "password", cred->password, 0) < 0)
  865. return -1;
  866. if (!cred->ext_password &&
  867. wpa_config_set_quoted(ssid, "password", cred->password) <
  868. 0)
  869. return -1;
  870. }
  871. if (cred->client_cert && cred->client_cert[0] &&
  872. wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
  873. return -1;
  874. #ifdef ANDROID
  875. if (cred->private_key &&
  876. os_strncmp(cred->private_key, "keystore://", 11) == 0) {
  877. /* Use OpenSSL engine configuration for Android keystore */
  878. if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
  879. wpa_config_set_quoted(ssid, "key_id",
  880. cred->private_key + 11) < 0 ||
  881. wpa_config_set(ssid, "engine", "1", 0) < 0)
  882. return -1;
  883. } else
  884. #endif /* ANDROID */
  885. if (cred->private_key && cred->private_key[0] &&
  886. wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
  887. return -1;
  888. if (cred->private_key_passwd && cred->private_key_passwd[0] &&
  889. wpa_config_set_quoted(ssid, "private_key_passwd",
  890. cred->private_key_passwd) < 0)
  891. return -1;
  892. if (cred->phase1) {
  893. os_free(ssid->eap.phase1);
  894. ssid->eap.phase1 = os_strdup(cred->phase1);
  895. }
  896. if (cred->phase2) {
  897. os_free(ssid->eap.phase2);
  898. ssid->eap.phase2 = os_strdup(cred->phase2);
  899. }
  900. if (cred->ca_cert && cred->ca_cert[0] &&
  901. wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
  902. return -1;
  903. return 0;
  904. }
  905. static int interworking_connect_roaming_consortium(
  906. struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
  907. struct wpa_bss *bss, const u8 *ssid_ie)
  908. {
  909. struct wpa_ssid *ssid;
  910. wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " based on "
  911. "roaming consortium match", MAC2STR(bss->bssid));
  912. ssid = wpa_config_add_network(wpa_s->conf);
  913. if (ssid == NULL)
  914. return -1;
  915. ssid->parent_cred = cred;
  916. wpas_notify_network_added(wpa_s, ssid);
  917. wpa_config_set_network_defaults(ssid);
  918. ssid->priority = cred->priority;
  919. ssid->temporary = 1;
  920. ssid->ssid = os_zalloc(ssid_ie[1] + 1);
  921. if (ssid->ssid == NULL)
  922. goto fail;
  923. os_memcpy(ssid->ssid, ssid_ie + 2, ssid_ie[1]);
  924. ssid->ssid_len = ssid_ie[1];
  925. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  926. goto fail;
  927. if (cred->eap_method == NULL) {
  928. wpa_printf(MSG_DEBUG, "Interworking: No EAP method set for "
  929. "credential using roaming consortium");
  930. goto fail;
  931. }
  932. if (interworking_set_eap_params(
  933. ssid, cred,
  934. cred->eap_method->vendor == EAP_VENDOR_IETF &&
  935. cred->eap_method->method == EAP_TYPE_TTLS) < 0)
  936. goto fail;
  937. wpa_config_update_prio_list(wpa_s->conf);
  938. interworking_reconnect(wpa_s);
  939. return 0;
  940. fail:
  941. wpas_notify_network_removed(wpa_s, ssid);
  942. wpa_config_remove_network(wpa_s->conf, ssid->id);
  943. return -1;
  944. }
  945. int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  946. {
  947. struct wpa_cred *cred, *cred_rc, *cred_3gpp;
  948. struct wpa_ssid *ssid;
  949. struct nai_realm *realm;
  950. struct nai_realm_eap *eap = NULL;
  951. u16 count, i;
  952. char buf[100];
  953. const u8 *ie;
  954. if (wpa_s->conf->cred == NULL || bss == NULL)
  955. return -1;
  956. ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
  957. if (ie == NULL || ie[1] == 0) {
  958. wpa_printf(MSG_DEBUG, "Interworking: No SSID known for "
  959. MACSTR, MAC2STR(bss->bssid));
  960. return -1;
  961. }
  962. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
  963. /*
  964. * We currently support only HS 2.0 networks and those are
  965. * required to use WPA2-Enterprise.
  966. */
  967. wpa_printf(MSG_DEBUG, "Interworking: Network does not use "
  968. "RSN");
  969. return -1;
  970. }
  971. cred_rc = interworking_credentials_available_roaming_consortium(wpa_s,
  972. bss);
  973. if (cred_rc) {
  974. wpa_printf(MSG_DEBUG, "Interworking: Highest roaming "
  975. "consortium matching credential priority %d",
  976. cred_rc->priority);
  977. }
  978. cred = interworking_credentials_available_realm(wpa_s, bss);
  979. if (cred) {
  980. wpa_printf(MSG_DEBUG, "Interworking: Highest NAI Realm list "
  981. "matching credential priority %d",
  982. cred->priority);
  983. }
  984. cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss);
  985. if (cred_3gpp) {
  986. wpa_printf(MSG_DEBUG, "Interworking: Highest 3GPP matching "
  987. "credential priority %d", cred_3gpp->priority);
  988. }
  989. if (cred_rc &&
  990. (cred == NULL || cred_rc->priority >= cred->priority) &&
  991. (cred_3gpp == NULL || cred_rc->priority >= cred_3gpp->priority))
  992. return interworking_connect_roaming_consortium(wpa_s, cred_rc,
  993. bss, ie);
  994. if (cred_3gpp &&
  995. (cred == NULL || cred_3gpp->priority >= cred->priority)) {
  996. return interworking_connect_3gpp(wpa_s, cred_3gpp, bss);
  997. }
  998. if (cred == NULL) {
  999. wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
  1000. "found for " MACSTR, MAC2STR(bss->bssid));
  1001. return -1;
  1002. }
  1003. realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
  1004. &count);
  1005. if (realm == NULL) {
  1006. wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
  1007. "Realm list from " MACSTR, MAC2STR(bss->bssid));
  1008. return -1;
  1009. }
  1010. for (i = 0; i < count; i++) {
  1011. if (!nai_realm_match(&realm[i], cred->realm))
  1012. continue;
  1013. eap = nai_realm_find_eap(cred, &realm[i]);
  1014. if (eap)
  1015. break;
  1016. }
  1017. if (!eap) {
  1018. wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
  1019. "and EAP method found for " MACSTR,
  1020. MAC2STR(bss->bssid));
  1021. nai_realm_free(realm, count);
  1022. return -1;
  1023. }
  1024. wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR,
  1025. MAC2STR(bss->bssid));
  1026. ssid = wpa_config_add_network(wpa_s->conf);
  1027. if (ssid == NULL) {
  1028. nai_realm_free(realm, count);
  1029. return -1;
  1030. }
  1031. ssid->parent_cred = cred;
  1032. wpas_notify_network_added(wpa_s, ssid);
  1033. wpa_config_set_network_defaults(ssid);
  1034. ssid->priority = cred->priority;
  1035. ssid->temporary = 1;
  1036. ssid->ssid = os_zalloc(ie[1] + 1);
  1037. if (ssid->ssid == NULL)
  1038. goto fail;
  1039. os_memcpy(ssid->ssid, ie + 2, ie[1]);
  1040. ssid->ssid_len = ie[1];
  1041. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  1042. goto fail;
  1043. if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
  1044. eap->method), 0) < 0)
  1045. goto fail;
  1046. switch (eap->method) {
  1047. case EAP_TYPE_TTLS:
  1048. if (eap->inner_method) {
  1049. os_snprintf(buf, sizeof(buf), "\"autheap=%s\"",
  1050. eap_get_name(EAP_VENDOR_IETF,
  1051. eap->inner_method));
  1052. if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
  1053. goto fail;
  1054. break;
  1055. }
  1056. switch (eap->inner_non_eap) {
  1057. case NAI_REALM_INNER_NON_EAP_PAP:
  1058. if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
  1059. 0)
  1060. goto fail;
  1061. break;
  1062. case NAI_REALM_INNER_NON_EAP_CHAP:
  1063. if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
  1064. < 0)
  1065. goto fail;
  1066. break;
  1067. case NAI_REALM_INNER_NON_EAP_MSCHAP:
  1068. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
  1069. 0) < 0)
  1070. goto fail;
  1071. break;
  1072. case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
  1073. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
  1074. 0) < 0)
  1075. goto fail;
  1076. break;
  1077. default:
  1078. /* EAP params were not set - assume TTLS/MSCHAPv2 */
  1079. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
  1080. 0) < 0)
  1081. goto fail;
  1082. break;
  1083. }
  1084. break;
  1085. case EAP_TYPE_PEAP:
  1086. os_snprintf(buf, sizeof(buf), "\"auth=%s\"",
  1087. eap_get_name(EAP_VENDOR_IETF,
  1088. eap->inner_method ?
  1089. eap->inner_method :
  1090. EAP_TYPE_MSCHAPV2));
  1091. if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
  1092. goto fail;
  1093. break;
  1094. case EAP_TYPE_TLS:
  1095. break;
  1096. }
  1097. if (interworking_set_eap_params(ssid, cred,
  1098. eap->method == EAP_TYPE_TTLS) < 0)
  1099. goto fail;
  1100. nai_realm_free(realm, count);
  1101. wpa_config_update_prio_list(wpa_s->conf);
  1102. interworking_reconnect(wpa_s);
  1103. return 0;
  1104. fail:
  1105. wpas_notify_network_removed(wpa_s, ssid);
  1106. wpa_config_remove_network(wpa_s->conf, ssid->id);
  1107. nai_realm_free(realm, count);
  1108. return -1;
  1109. }
  1110. static struct wpa_cred * interworking_credentials_available_3gpp(
  1111. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1112. {
  1113. struct wpa_cred *selected = NULL;
  1114. #ifdef INTERWORKING_3GPP
  1115. struct wpa_cred *cred;
  1116. int ret;
  1117. if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
  1118. return NULL;
  1119. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1120. char *sep;
  1121. const char *imsi;
  1122. int mnc_len;
  1123. #ifdef PCSC_FUNCS
  1124. if (cred->pcsc && wpa_s->conf->pcsc_reader && wpa_s->scard &&
  1125. wpa_s->imsi[0]) {
  1126. imsi = wpa_s->imsi;
  1127. mnc_len = wpa_s->mnc_len;
  1128. goto compare;
  1129. }
  1130. #endif /* PCSC_FUNCS */
  1131. if (cred->imsi == NULL || !cred->imsi[0] ||
  1132. cred->milenage == NULL || !cred->milenage[0])
  1133. continue;
  1134. sep = os_strchr(cred->imsi, '-');
  1135. if (sep == NULL ||
  1136. (sep - cred->imsi != 5 && sep - cred->imsi != 6))
  1137. continue;
  1138. mnc_len = sep - cred->imsi - 3;
  1139. imsi = cred->imsi;
  1140. #ifdef PCSC_FUNCS
  1141. compare:
  1142. #endif /* PCSC_FUNCS */
  1143. wpa_printf(MSG_DEBUG, "Interworking: Parsing 3GPP info from "
  1144. MACSTR, MAC2STR(bss->bssid));
  1145. ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
  1146. wpa_printf(MSG_DEBUG, "PLMN match %sfound", ret ? "" : "not ");
  1147. if (ret) {
  1148. if (cred_excluded_ssid(cred, bss))
  1149. continue;
  1150. if (selected == NULL ||
  1151. selected->priority < cred->priority)
  1152. selected = cred;
  1153. }
  1154. }
  1155. #endif /* INTERWORKING_3GPP */
  1156. return selected;
  1157. }
  1158. static struct wpa_cred * interworking_credentials_available_realm(
  1159. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1160. {
  1161. struct wpa_cred *cred, *selected = NULL;
  1162. struct nai_realm *realm;
  1163. u16 count, i;
  1164. if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
  1165. return NULL;
  1166. if (wpa_s->conf->cred == NULL)
  1167. return NULL;
  1168. wpa_printf(MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
  1169. MACSTR, MAC2STR(bss->bssid));
  1170. realm = nai_realm_parse(bss->anqp->nai_realm, &count);
  1171. if (realm == NULL) {
  1172. wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
  1173. "Realm list from " MACSTR, MAC2STR(bss->bssid));
  1174. return NULL;
  1175. }
  1176. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1177. if (cred->realm == NULL)
  1178. continue;
  1179. for (i = 0; i < count; i++) {
  1180. if (!nai_realm_match(&realm[i], cred->realm))
  1181. continue;
  1182. if (nai_realm_find_eap(cred, &realm[i])) {
  1183. if (cred_excluded_ssid(cred, bss))
  1184. continue;
  1185. if (selected == NULL ||
  1186. selected->priority < cred->priority)
  1187. selected = cred;
  1188. break;
  1189. }
  1190. }
  1191. }
  1192. nai_realm_free(realm, count);
  1193. return selected;
  1194. }
  1195. static struct wpa_cred * interworking_credentials_available(
  1196. struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1197. {
  1198. struct wpa_cred *cred, *cred2;
  1199. cred = interworking_credentials_available_realm(wpa_s, bss);
  1200. cred2 = interworking_credentials_available_3gpp(wpa_s, bss);
  1201. if (cred && cred2 && cred2->priority >= cred->priority)
  1202. cred = cred2;
  1203. if (!cred)
  1204. cred = cred2;
  1205. cred2 = interworking_credentials_available_roaming_consortium(wpa_s,
  1206. bss);
  1207. if (cred && cred2 && cred2->priority >= cred->priority)
  1208. cred = cred2;
  1209. if (!cred)
  1210. cred = cred2;
  1211. return cred;
  1212. }
  1213. static int domain_name_list_contains(struct wpabuf *domain_names,
  1214. const char *domain)
  1215. {
  1216. const u8 *pos, *end;
  1217. size_t len;
  1218. len = os_strlen(domain);
  1219. pos = wpabuf_head(domain_names);
  1220. end = pos + wpabuf_len(domain_names);
  1221. while (pos + 1 < end) {
  1222. if (pos + 1 + pos[0] > end)
  1223. break;
  1224. wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
  1225. pos + 1, pos[0]);
  1226. if (pos[0] == len &&
  1227. os_strncasecmp(domain, (const char *) (pos + 1), len) == 0)
  1228. return 1;
  1229. pos += 1 + pos[0];
  1230. }
  1231. return 0;
  1232. }
  1233. int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
  1234. struct wpa_cred *cred,
  1235. struct wpabuf *domain_names)
  1236. {
  1237. #ifdef INTERWORKING_3GPP
  1238. char nai[100], *realm;
  1239. char *imsi = NULL;
  1240. int mnc_len = 0;
  1241. if (cred->imsi)
  1242. imsi = cred->imsi;
  1243. #ifdef CONFIG_PCSC
  1244. else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
  1245. wpa_s->scard && wpa_s->imsi[0]) {
  1246. imsi = wpa_s->imsi;
  1247. mnc_len = wpa_s->mnc_len;
  1248. }
  1249. #endif /* CONFIG_PCSC */
  1250. if (domain_names &&
  1251. imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
  1252. realm = os_strchr(nai, '@');
  1253. if (realm)
  1254. realm++;
  1255. wpa_printf(MSG_DEBUG, "Interworking: Search for match "
  1256. "with SIM/USIM domain %s", realm);
  1257. if (realm &&
  1258. domain_name_list_contains(domain_names, realm))
  1259. return 1;
  1260. }
  1261. #endif /* INTERWORKING_3GPP */
  1262. if (domain_names == NULL || cred->domain == NULL)
  1263. return 0;
  1264. wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
  1265. "home SP FQDN %s", cred->domain);
  1266. if (domain_name_list_contains(domain_names, cred->domain))
  1267. return 1;
  1268. return 0;
  1269. }
  1270. static int interworking_home_sp(struct wpa_supplicant *wpa_s,
  1271. struct wpabuf *domain_names)
  1272. {
  1273. struct wpa_cred *cred;
  1274. if (domain_names == NULL || wpa_s->conf->cred == NULL)
  1275. return -1;
  1276. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1277. int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
  1278. if (res)
  1279. return res;
  1280. }
  1281. return 0;
  1282. }
  1283. static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
  1284. {
  1285. struct wpa_bss *bss;
  1286. struct wpa_ssid *ssid;
  1287. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1288. for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
  1289. if (wpas_network_disabled(wpa_s, ssid) ||
  1290. ssid->mode != WPAS_MODE_INFRA)
  1291. continue;
  1292. if (ssid->ssid_len != bss->ssid_len ||
  1293. os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
  1294. 0)
  1295. continue;
  1296. /*
  1297. * TODO: Consider more accurate matching of security
  1298. * configuration similarly to what is done in events.c
  1299. */
  1300. return 1;
  1301. }
  1302. }
  1303. return 0;
  1304. }
  1305. static void interworking_select_network(struct wpa_supplicant *wpa_s)
  1306. {
  1307. struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
  1308. int selected_prio = -999999, selected_home_prio = -999999;
  1309. unsigned int count = 0;
  1310. const char *type;
  1311. int res;
  1312. struct wpa_cred *cred;
  1313. wpa_s->network_select = 0;
  1314. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1315. cred = interworking_credentials_available(wpa_s, bss);
  1316. if (!cred)
  1317. continue;
  1318. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
  1319. /*
  1320. * We currently support only HS 2.0 networks and those
  1321. * are required to use WPA2-Enterprise.
  1322. */
  1323. wpa_printf(MSG_DEBUG, "Interworking: Credential match "
  1324. "with " MACSTR " but network does not use "
  1325. "RSN", MAC2STR(bss->bssid));
  1326. continue;
  1327. }
  1328. count++;
  1329. res = interworking_home_sp(wpa_s, bss->anqp ?
  1330. bss->anqp->domain_name : NULL);
  1331. if (res > 0)
  1332. type = "home";
  1333. else if (res == 0)
  1334. type = "roaming";
  1335. else
  1336. type = "unknown";
  1337. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_AP MACSTR " type=%s",
  1338. MAC2STR(bss->bssid), type);
  1339. if (wpa_s->auto_select ||
  1340. (wpa_s->conf->auto_interworking &&
  1341. wpa_s->auto_network_select)) {
  1342. if (selected == NULL ||
  1343. cred->priority > selected_prio) {
  1344. selected = bss;
  1345. selected_prio = cred->priority;
  1346. }
  1347. if (res > 0 &&
  1348. (selected_home == NULL ||
  1349. cred->priority > selected_home_prio)) {
  1350. selected_home = bss;
  1351. selected_home_prio = cred->priority;
  1352. }
  1353. }
  1354. }
  1355. if (selected_home && selected_home != selected &&
  1356. selected_home_prio >= selected_prio) {
  1357. /* Prefer network operated by the Home SP */
  1358. selected = selected_home;
  1359. }
  1360. if (count == 0) {
  1361. /*
  1362. * No matching network was found based on configured
  1363. * credentials. Check whether any of the enabled network blocks
  1364. * have matching APs.
  1365. */
  1366. if (interworking_find_network_match(wpa_s)) {
  1367. wpa_printf(MSG_DEBUG, "Interworking: Possible BSS "
  1368. "match for enabled network configurations");
  1369. if (wpa_s->auto_select)
  1370. interworking_reconnect(wpa_s);
  1371. return;
  1372. }
  1373. if (wpa_s->auto_network_select) {
  1374. wpa_printf(MSG_DEBUG, "Interworking: Continue "
  1375. "scanning after ANQP fetch");
  1376. wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
  1377. 0);
  1378. return;
  1379. }
  1380. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
  1381. "with matching credentials found");
  1382. }
  1383. if (selected)
  1384. interworking_connect(wpa_s, selected);
  1385. }
  1386. static struct wpa_bss_anqp *
  1387. interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  1388. {
  1389. struct wpa_bss *other;
  1390. if (is_zero_ether_addr(bss->hessid))
  1391. return NULL; /* Cannot be in the same homegenous ESS */
  1392. dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
  1393. if (other == bss)
  1394. continue;
  1395. if (other->anqp == NULL)
  1396. continue;
  1397. if (other->anqp->roaming_consortium == NULL &&
  1398. other->anqp->nai_realm == NULL &&
  1399. other->anqp->anqp_3gpp == NULL &&
  1400. other->anqp->domain_name == NULL)
  1401. continue;
  1402. if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
  1403. continue;
  1404. if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
  1405. continue;
  1406. if (bss->ssid_len != other->ssid_len ||
  1407. os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
  1408. continue;
  1409. wpa_printf(MSG_DEBUG, "Interworking: Share ANQP data with "
  1410. "already fetched BSSID " MACSTR " and " MACSTR,
  1411. MAC2STR(other->bssid), MAC2STR(bss->bssid));
  1412. other->anqp->users++;
  1413. return other->anqp;
  1414. }
  1415. return NULL;
  1416. }
  1417. static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
  1418. {
  1419. struct wpa_bss *bss;
  1420. int found = 0;
  1421. const u8 *ie;
  1422. if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress)
  1423. return;
  1424. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1425. if (!(bss->caps & IEEE80211_CAP_ESS))
  1426. continue;
  1427. ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
  1428. if (ie == NULL || ie[1] < 4 || !(ie[5] & 0x80))
  1429. continue; /* AP does not support Interworking */
  1430. if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
  1431. if (bss->anqp == NULL) {
  1432. bss->anqp = interworking_match_anqp_info(wpa_s,
  1433. bss);
  1434. if (bss->anqp) {
  1435. /* Shared data already fetched */
  1436. continue;
  1437. }
  1438. bss->anqp = wpa_bss_anqp_alloc();
  1439. if (bss->anqp == NULL)
  1440. break;
  1441. }
  1442. found++;
  1443. bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
  1444. wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
  1445. MACSTR, MAC2STR(bss->bssid));
  1446. interworking_anqp_send_req(wpa_s, bss);
  1447. break;
  1448. }
  1449. }
  1450. if (found == 0) {
  1451. wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
  1452. wpa_s->fetch_anqp_in_progress = 0;
  1453. if (wpa_s->network_select)
  1454. interworking_select_network(wpa_s);
  1455. }
  1456. }
  1457. void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
  1458. {
  1459. struct wpa_bss *bss;
  1460. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
  1461. bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
  1462. wpa_s->fetch_anqp_in_progress = 1;
  1463. interworking_next_anqp_fetch(wpa_s);
  1464. }
  1465. int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
  1466. {
  1467. if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
  1468. return 0;
  1469. wpa_s->network_select = 0;
  1470. wpa_s->fetch_all_anqp = 1;
  1471. interworking_start_fetch_anqp(wpa_s);
  1472. return 0;
  1473. }
  1474. void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
  1475. {
  1476. if (!wpa_s->fetch_anqp_in_progress)
  1477. return;
  1478. wpa_s->fetch_anqp_in_progress = 0;
  1479. }
  1480. int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
  1481. u16 info_ids[], size_t num_ids)
  1482. {
  1483. struct wpabuf *buf;
  1484. int ret = 0;
  1485. int freq;
  1486. struct wpa_bss *bss;
  1487. int res;
  1488. freq = wpa_s->assoc_freq;
  1489. bss = wpa_bss_get_bssid(wpa_s, dst);
  1490. if (bss) {
  1491. wpa_bss_anqp_unshare_alloc(bss);
  1492. freq = bss->freq;
  1493. }
  1494. if (freq <= 0)
  1495. return -1;
  1496. wpa_printf(MSG_DEBUG, "ANQP: Query Request to " MACSTR " for %u id(s)",
  1497. MAC2STR(dst), (unsigned int) num_ids);
  1498. buf = anqp_build_req(info_ids, num_ids, NULL);
  1499. if (buf == NULL)
  1500. return -1;
  1501. res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
  1502. if (res < 0) {
  1503. wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
  1504. ret = -1;
  1505. } else
  1506. wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
  1507. "%u", res);
  1508. wpabuf_free(buf);
  1509. return ret;
  1510. }
  1511. static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
  1512. const u8 *sa, u16 info_id,
  1513. const u8 *data, size_t slen)
  1514. {
  1515. const u8 *pos = data;
  1516. struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);
  1517. struct wpa_bss_anqp *anqp = NULL;
  1518. #ifdef CONFIG_HS20
  1519. u8 type;
  1520. #endif /* CONFIG_HS20 */
  1521. if (bss)
  1522. anqp = bss->anqp;
  1523. switch (info_id) {
  1524. case ANQP_CAPABILITY_LIST:
  1525. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1526. " ANQP Capability list", MAC2STR(sa));
  1527. break;
  1528. case ANQP_VENUE_NAME:
  1529. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1530. " Venue Name", MAC2STR(sa));
  1531. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
  1532. if (anqp) {
  1533. wpabuf_free(anqp->venue_name);
  1534. anqp->venue_name = wpabuf_alloc_copy(pos, slen);
  1535. }
  1536. break;
  1537. case ANQP_NETWORK_AUTH_TYPE:
  1538. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1539. " Network Authentication Type information",
  1540. MAC2STR(sa));
  1541. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
  1542. "Type", pos, slen);
  1543. if (anqp) {
  1544. wpabuf_free(anqp->network_auth_type);
  1545. anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
  1546. }
  1547. break;
  1548. case ANQP_ROAMING_CONSORTIUM:
  1549. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1550. " Roaming Consortium list", MAC2STR(sa));
  1551. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
  1552. pos, slen);
  1553. if (anqp) {
  1554. wpabuf_free(anqp->roaming_consortium);
  1555. anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
  1556. }
  1557. break;
  1558. case ANQP_IP_ADDR_TYPE_AVAILABILITY:
  1559. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1560. " IP Address Type Availability information",
  1561. MAC2STR(sa));
  1562. wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
  1563. pos, slen);
  1564. if (anqp) {
  1565. wpabuf_free(anqp->ip_addr_type_availability);
  1566. anqp->ip_addr_type_availability =
  1567. wpabuf_alloc_copy(pos, slen);
  1568. }
  1569. break;
  1570. case ANQP_NAI_REALM:
  1571. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1572. " NAI Realm list", MAC2STR(sa));
  1573. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
  1574. if (anqp) {
  1575. wpabuf_free(anqp->nai_realm);
  1576. anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
  1577. }
  1578. break;
  1579. case ANQP_3GPP_CELLULAR_NETWORK:
  1580. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1581. " 3GPP Cellular Network information", MAC2STR(sa));
  1582. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
  1583. pos, slen);
  1584. if (anqp) {
  1585. wpabuf_free(anqp->anqp_3gpp);
  1586. anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
  1587. }
  1588. break;
  1589. case ANQP_DOMAIN_NAME:
  1590. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  1591. " Domain Name list", MAC2STR(sa));
  1592. wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
  1593. if (anqp) {
  1594. wpabuf_free(anqp->domain_name);
  1595. anqp->domain_name = wpabuf_alloc_copy(pos, slen);
  1596. }
  1597. break;
  1598. case ANQP_VENDOR_SPECIFIC:
  1599. if (slen < 3)
  1600. return;
  1601. switch (WPA_GET_BE24(pos)) {
  1602. #ifdef CONFIG_HS20
  1603. case OUI_WFA:
  1604. pos += 3;
  1605. slen -= 3;
  1606. if (slen < 1)
  1607. return;
  1608. type = *pos++;
  1609. slen--;
  1610. switch (type) {
  1611. case HS20_ANQP_OUI_TYPE:
  1612. hs20_parse_rx_hs20_anqp_resp(wpa_s, sa, pos,
  1613. slen);
  1614. break;
  1615. default:
  1616. wpa_printf(MSG_DEBUG, "HS20: Unsupported ANQP "
  1617. "vendor type %u", type);
  1618. break;
  1619. }
  1620. break;
  1621. #endif /* CONFIG_HS20 */
  1622. default:
  1623. wpa_printf(MSG_DEBUG, "Interworking: Unsupported "
  1624. "vendor-specific ANQP OUI %06x",
  1625. WPA_GET_BE24(pos));
  1626. return;
  1627. }
  1628. break;
  1629. default:
  1630. wpa_printf(MSG_DEBUG, "Interworking: Unsupported ANQP Info ID "
  1631. "%u", info_id);
  1632. break;
  1633. }
  1634. }
  1635. void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
  1636. enum gas_query_result result,
  1637. const struct wpabuf *adv_proto,
  1638. const struct wpabuf *resp, u16 status_code)
  1639. {
  1640. struct wpa_supplicant *wpa_s = ctx;
  1641. const u8 *pos;
  1642. const u8 *end;
  1643. u16 info_id;
  1644. u16 slen;
  1645. if (result != GAS_QUERY_SUCCESS)
  1646. return;
  1647. pos = wpabuf_head(adv_proto);
  1648. if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
  1649. pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
  1650. wpa_printf(MSG_DEBUG, "ANQP: Unexpected Advertisement "
  1651. "Protocol in response");
  1652. return;
  1653. }
  1654. pos = wpabuf_head(resp);
  1655. end = pos + wpabuf_len(resp);
  1656. while (pos < end) {
  1657. if (pos + 4 > end) {
  1658. wpa_printf(MSG_DEBUG, "ANQP: Invalid element");
  1659. break;
  1660. }
  1661. info_id = WPA_GET_LE16(pos);
  1662. pos += 2;
  1663. slen = WPA_GET_LE16(pos);
  1664. pos += 2;
  1665. if (pos + slen > end) {
  1666. wpa_printf(MSG_DEBUG, "ANQP: Invalid element length "
  1667. "for Info ID %u", info_id);
  1668. break;
  1669. }
  1670. interworking_parse_rx_anqp_resp(wpa_s, dst, info_id, pos,
  1671. slen);
  1672. pos += slen;
  1673. }
  1674. }
  1675. static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
  1676. struct wpa_scan_results *scan_res)
  1677. {
  1678. wpa_printf(MSG_DEBUG, "Interworking: Scan results available - start "
  1679. "ANQP fetch");
  1680. interworking_start_fetch_anqp(wpa_s);
  1681. }
  1682. int interworking_select(struct wpa_supplicant *wpa_s, int auto_select)
  1683. {
  1684. interworking_stop_fetch_anqp(wpa_s);
  1685. wpa_s->network_select = 1;
  1686. wpa_s->auto_network_select = 0;
  1687. wpa_s->auto_select = !!auto_select;
  1688. wpa_s->fetch_all_anqp = 0;
  1689. wpa_printf(MSG_DEBUG, "Interworking: Start scan for network "
  1690. "selection");
  1691. wpa_s->scan_res_handler = interworking_scan_res_handler;
  1692. wpa_s->scan_req = MANUAL_SCAN_REQ;
  1693. wpa_supplicant_req_scan(wpa_s, 0, 0);
  1694. return 0;
  1695. }
  1696. static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
  1697. enum gas_query_result result,
  1698. const struct wpabuf *adv_proto,
  1699. const struct wpabuf *resp, u16 status_code)
  1700. {
  1701. struct wpa_supplicant *wpa_s = ctx;
  1702. wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
  1703. " dialog_token=%d status_code=%d resp_len=%d",
  1704. MAC2STR(addr), dialog_token, status_code,
  1705. resp ? (int) wpabuf_len(resp) : -1);
  1706. if (!resp)
  1707. return;
  1708. wpabuf_free(wpa_s->last_gas_resp);
  1709. wpa_s->last_gas_resp = wpabuf_dup(resp);
  1710. if (wpa_s->last_gas_resp == NULL)
  1711. return;
  1712. os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
  1713. wpa_s->last_gas_dialog_token = dialog_token;
  1714. }
  1715. int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
  1716. const struct wpabuf *adv_proto,
  1717. const struct wpabuf *query)
  1718. {
  1719. struct wpabuf *buf;
  1720. int ret = 0;
  1721. int freq;
  1722. struct wpa_bss *bss;
  1723. int res;
  1724. size_t len;
  1725. u8 query_resp_len_limit = 0, pame_bi = 0;
  1726. freq = wpa_s->assoc_freq;
  1727. bss = wpa_bss_get_bssid(wpa_s, dst);
  1728. if (bss)
  1729. freq = bss->freq;
  1730. if (freq <= 0)
  1731. return -1;
  1732. wpa_printf(MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
  1733. MAC2STR(dst), freq);
  1734. wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
  1735. wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
  1736. len = 3 + wpabuf_len(adv_proto) + 2;
  1737. if (query)
  1738. len += wpabuf_len(query);
  1739. buf = gas_build_initial_req(0, len);
  1740. if (buf == NULL)
  1741. return -1;
  1742. /* Advertisement Protocol IE */
  1743. wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
  1744. wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
  1745. wpabuf_put_u8(buf, (query_resp_len_limit & 0x7f) |
  1746. (pame_bi ? 0x80 : 0));
  1747. wpabuf_put_buf(buf, adv_proto);
  1748. /* GAS Query */
  1749. if (query) {
  1750. wpabuf_put_le16(buf, wpabuf_len(query));
  1751. wpabuf_put_buf(buf, query);
  1752. } else
  1753. wpabuf_put_le16(buf, 0);
  1754. res = gas_query_req(wpa_s->gas, dst, freq, buf, gas_resp_cb, wpa_s);
  1755. if (res < 0) {
  1756. wpa_printf(MSG_DEBUG, "GAS: Failed to send Query Request");
  1757. ret = -1;
  1758. } else
  1759. wpa_printf(MSG_DEBUG, "GAS: Query started with dialog token "
  1760. "%u", res);
  1761. wpabuf_free(buf);
  1762. return ret;
  1763. }