interworking.c 77 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051
  1. /*
  2. * Interworking (IEEE 802.11u)
  3. * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
  4. * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
  5. *
  6. * This software may be distributed under the terms of the BSD license.
  7. * See README for more details.
  8. */
  9. #include "includes.h"
  10. #include "common.h"
  11. #include "common/ieee802_11_defs.h"
  12. #include "common/gas.h"
  13. #include "common/wpa_ctrl.h"
  14. #include "utils/pcsc_funcs.h"
  15. #include "utils/eloop.h"
  16. #include "drivers/driver.h"
  17. #include "eap_common/eap_defs.h"
  18. #include "eap_peer/eap.h"
  19. #include "eap_peer/eap_methods.h"
  20. #include "eapol_supp/eapol_supp_sm.h"
  21. #include "rsn_supp/wpa.h"
  22. #include "wpa_supplicant_i.h"
  23. #include "config.h"
  24. #include "config_ssid.h"
  25. #include "bss.h"
  26. #include "scan.h"
  27. #include "notify.h"
  28. #include "driver_i.h"
  29. #include "gas_query.h"
  30. #include "hs20_supplicant.h"
  31. #include "interworking.h"
  32. #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  33. #define INTERWORKING_3GPP
  34. #else
  35. #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  36. #define INTERWORKING_3GPP
  37. #else
  38. #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  39. #define INTERWORKING_3GPP
  40. #endif
  41. #endif
  42. #endif
  43. static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  44. static struct wpa_cred * interworking_credentials_available_realm(
  45. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  46. int *excluded);
  47. static struct wpa_cred * interworking_credentials_available_3gpp(
  48. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  49. int *excluded);
  50. static int cred_prio_cmp(const struct wpa_cred *a, const struct wpa_cred *b)
  51. {
  52. if (a->priority > b->priority)
  53. return 1;
  54. if (a->priority < b->priority)
  55. return -1;
  56. if (a->provisioning_sp == NULL || b->provisioning_sp == NULL ||
  57. os_strcmp(a->provisioning_sp, b->provisioning_sp) != 0)
  58. return 0;
  59. if (a->sp_priority < b->sp_priority)
  60. return 1;
  61. if (a->sp_priority > b->sp_priority)
  62. return -1;
  63. return 0;
  64. }
  65. static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  66. {
  67. unsigned int tried;
  68. if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  69. wpa_supplicant_cancel_sched_scan(wpa_s);
  70. wpa_supplicant_deauthenticate(wpa_s,
  71. WLAN_REASON_DEAUTH_LEAVING);
  72. }
  73. wpa_s->disconnected = 0;
  74. wpa_s->reassociate = 1;
  75. tried = wpa_s->interworking_fast_assoc_tried;
  76. wpa_s->interworking_fast_assoc_tried = 1;
  77. if (!tried && wpa_supplicant_fast_associate(wpa_s) >= 0)
  78. return;
  79. wpa_s->interworking_fast_assoc_tried = 0;
  80. wpa_supplicant_req_scan(wpa_s, 0, 0);
  81. }
  82. static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  83. struct wpabuf *extra)
  84. {
  85. struct wpabuf *buf;
  86. size_t i;
  87. u8 *len_pos;
  88. buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
  89. (extra ? wpabuf_len(extra) : 0));
  90. if (buf == NULL)
  91. return NULL;
  92. len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
  93. for (i = 0; i < num_ids; i++)
  94. wpabuf_put_le16(buf, info_ids[i]);
  95. gas_anqp_set_element_len(buf, len_pos);
  96. if (extra)
  97. wpabuf_put_buf(buf, extra);
  98. gas_anqp_set_len(buf);
  99. return buf;
  100. }
  101. static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
  102. u8 dialog_token,
  103. enum gas_query_result result,
  104. const struct wpabuf *adv_proto,
  105. const struct wpabuf *resp,
  106. u16 status_code)
  107. {
  108. struct wpa_supplicant *wpa_s = ctx;
  109. wpa_printf(MSG_DEBUG, "ANQP: Response callback dst=" MACSTR
  110. " dialog_token=%u result=%d status_code=%u",
  111. MAC2STR(dst), dialog_token, result, status_code);
  112. anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
  113. status_code);
  114. interworking_next_anqp_fetch(wpa_s);
  115. }
  116. static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
  117. {
  118. struct wpa_cred *cred;
  119. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  120. if (cred->roaming_consortium_len)
  121. return 1;
  122. if (cred->required_roaming_consortium_len)
  123. return 1;
  124. }
  125. return 0;
  126. }
  127. static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
  128. {
  129. struct wpa_cred *cred;
  130. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  131. if (cred->pcsc || cred->imsi)
  132. return 1;
  133. }
  134. return 0;
  135. }
  136. static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
  137. {
  138. struct wpa_cred *cred;
  139. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  140. if (cred->pcsc || cred->imsi)
  141. continue;
  142. if (!cred->eap_method)
  143. return 1;
  144. if (cred->realm && cred->roaming_consortium_len == 0)
  145. return 1;
  146. }
  147. return 0;
  148. }
  149. static int cred_with_domain(struct wpa_supplicant *wpa_s)
  150. {
  151. struct wpa_cred *cred;
  152. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  153. if (cred->domain || cred->pcsc || cred->imsi ||
  154. cred->roaming_partner)
  155. return 1;
  156. }
  157. return 0;
  158. }
  159. #ifdef CONFIG_HS20
  160. static int cred_with_min_backhaul(struct wpa_supplicant *wpa_s)
  161. {
  162. struct wpa_cred *cred;
  163. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  164. if (cred->min_dl_bandwidth_home ||
  165. cred->min_ul_bandwidth_home ||
  166. cred->min_dl_bandwidth_roaming ||
  167. cred->min_ul_bandwidth_roaming)
  168. return 1;
  169. }
  170. return 0;
  171. }
  172. static int cred_with_conn_capab(struct wpa_supplicant *wpa_s)
  173. {
  174. struct wpa_cred *cred;
  175. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  176. if (cred->num_req_conn_capab)
  177. return 1;
  178. }
  179. return 0;
  180. }
  181. #endif /* CONFIG_HS20 */
  182. static int additional_roaming_consortiums(struct wpa_bss *bss)
  183. {
  184. const u8 *ie;
  185. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  186. if (ie == NULL || ie[1] == 0)
  187. return 0;
  188. return ie[2]; /* Number of ANQP OIs */
  189. }
  190. static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
  191. {
  192. struct wpa_supplicant *wpa_s = eloop_ctx;
  193. interworking_next_anqp_fetch(wpa_s);
  194. }
  195. static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
  196. struct wpa_bss *bss)
  197. {
  198. struct wpabuf *buf;
  199. int ret = 0;
  200. int res;
  201. u16 info_ids[8];
  202. size_t num_info_ids = 0;
  203. struct wpabuf *extra = NULL;
  204. int all = wpa_s->fetch_all_anqp;
  205. wpa_msg(wpa_s, MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
  206. MAC2STR(bss->bssid));
  207. wpa_s->interworking_gas_bss = bss;
  208. info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
  209. if (all) {
  210. info_ids[num_info_ids++] = ANQP_VENUE_NAME;
  211. info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
  212. }
  213. if (all || (cred_with_roaming_consortium(wpa_s) &&
  214. additional_roaming_consortiums(bss)))
  215. info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
  216. if (all)
  217. info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
  218. if (all || cred_with_nai_realm(wpa_s))
  219. info_ids[num_info_ids++] = ANQP_NAI_REALM;
  220. if (all || cred_with_3gpp(wpa_s)) {
  221. info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
  222. wpa_supplicant_scard_init(wpa_s, NULL);
  223. }
  224. if (all || cred_with_domain(wpa_s))
  225. info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
  226. wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
  227. (u8 *) info_ids, num_info_ids * 2);
  228. #ifdef CONFIG_HS20
  229. if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
  230. u8 *len_pos;
  231. extra = wpabuf_alloc(100);
  232. if (!extra)
  233. return -1;
  234. len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
  235. wpabuf_put_be24(extra, OUI_WFA);
  236. wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
  237. wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
  238. wpabuf_put_u8(extra, 0); /* Reserved */
  239. wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
  240. if (all)
  241. wpabuf_put_u8(extra,
  242. HS20_STYPE_OPERATOR_FRIENDLY_NAME);
  243. if (all || cred_with_min_backhaul(wpa_s))
  244. wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
  245. if (all || cred_with_conn_capab(wpa_s))
  246. wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
  247. if (all)
  248. wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
  249. if (all)
  250. wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_LIST);
  251. gas_anqp_set_element_len(extra, len_pos);
  252. }
  253. #endif /* CONFIG_HS20 */
  254. buf = anqp_build_req(info_ids, num_info_ids, extra);
  255. wpabuf_free(extra);
  256. if (buf == NULL)
  257. return -1;
  258. res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, buf,
  259. interworking_anqp_resp_cb, wpa_s);
  260. if (res < 0) {
  261. wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
  262. wpabuf_free(buf);
  263. ret = -1;
  264. eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
  265. NULL);
  266. } else
  267. wpa_msg(wpa_s, MSG_DEBUG,
  268. "ANQP: Query started with dialog token %u", res);
  269. return ret;
  270. }
  271. struct nai_realm_eap {
  272. u8 method;
  273. u8 inner_method;
  274. enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
  275. u8 cred_type;
  276. u8 tunneled_cred_type;
  277. };
  278. struct nai_realm {
  279. u8 encoding;
  280. char *realm;
  281. u8 eap_count;
  282. struct nai_realm_eap *eap;
  283. };
  284. static void nai_realm_free(struct nai_realm *realms, u16 count)
  285. {
  286. u16 i;
  287. if (realms == NULL)
  288. return;
  289. for (i = 0; i < count; i++) {
  290. os_free(realms[i].eap);
  291. os_free(realms[i].realm);
  292. }
  293. os_free(realms);
  294. }
  295. static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
  296. const u8 *end)
  297. {
  298. u8 elen, auth_count, a;
  299. const u8 *e_end;
  300. if (pos + 3 > end) {
  301. wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
  302. return NULL;
  303. }
  304. elen = *pos++;
  305. if (pos + elen > end || elen < 2) {
  306. wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
  307. return NULL;
  308. }
  309. e_end = pos + elen;
  310. e->method = *pos++;
  311. auth_count = *pos++;
  312. wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
  313. elen, e->method, auth_count);
  314. for (a = 0; a < auth_count; a++) {
  315. u8 id, len;
  316. if (pos + 2 > end || pos + 2 + pos[1] > end) {
  317. wpa_printf(MSG_DEBUG, "No room for Authentication "
  318. "Parameter subfield");
  319. return NULL;
  320. }
  321. id = *pos++;
  322. len = *pos++;
  323. switch (id) {
  324. case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
  325. if (len < 1)
  326. break;
  327. e->inner_non_eap = *pos;
  328. if (e->method != EAP_TYPE_TTLS)
  329. break;
  330. switch (*pos) {
  331. case NAI_REALM_INNER_NON_EAP_PAP:
  332. wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
  333. break;
  334. case NAI_REALM_INNER_NON_EAP_CHAP:
  335. wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
  336. break;
  337. case NAI_REALM_INNER_NON_EAP_MSCHAP:
  338. wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
  339. break;
  340. case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
  341. wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
  342. break;
  343. }
  344. break;
  345. case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
  346. if (len < 1)
  347. break;
  348. e->inner_method = *pos;
  349. wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
  350. e->inner_method);
  351. break;
  352. case NAI_REALM_EAP_AUTH_CRED_TYPE:
  353. if (len < 1)
  354. break;
  355. e->cred_type = *pos;
  356. wpa_printf(MSG_DEBUG, "Credential Type: %u",
  357. e->cred_type);
  358. break;
  359. case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
  360. if (len < 1)
  361. break;
  362. e->tunneled_cred_type = *pos;
  363. wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
  364. "Type: %u", e->tunneled_cred_type);
  365. break;
  366. default:
  367. wpa_printf(MSG_DEBUG, "Unsupported Authentication "
  368. "Parameter: id=%u len=%u", id, len);
  369. wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
  370. "Value", pos, len);
  371. break;
  372. }
  373. pos += len;
  374. }
  375. return e_end;
  376. }
  377. static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
  378. const u8 *end)
  379. {
  380. u16 len;
  381. const u8 *f_end;
  382. u8 realm_len, e;
  383. if (end - pos < 4) {
  384. wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
  385. "fixed fields");
  386. return NULL;
  387. }
  388. len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
  389. pos += 2;
  390. if (pos + len > end || len < 3) {
  391. wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
  392. "(len=%u; left=%u)",
  393. len, (unsigned int) (end - pos));
  394. return NULL;
  395. }
  396. f_end = pos + len;
  397. r->encoding = *pos++;
  398. realm_len = *pos++;
  399. if (pos + realm_len > f_end) {
  400. wpa_printf(MSG_DEBUG, "No room for NAI Realm "
  401. "(len=%u; left=%u)",
  402. realm_len, (unsigned int) (f_end - pos));
  403. return NULL;
  404. }
  405. wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
  406. r->realm = dup_binstr(pos, realm_len);
  407. if (r->realm == NULL)
  408. return NULL;
  409. pos += realm_len;
  410. if (pos + 1 > f_end) {
  411. wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
  412. return NULL;
  413. }
  414. r->eap_count = *pos++;
  415. wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
  416. if (pos + r->eap_count * 3 > f_end) {
  417. wpa_printf(MSG_DEBUG, "No room for EAP Methods");
  418. return NULL;
  419. }
  420. r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
  421. if (r->eap == NULL)
  422. return NULL;
  423. for (e = 0; e < r->eap_count; e++) {
  424. pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
  425. if (pos == NULL)
  426. return NULL;
  427. }
  428. return f_end;
  429. }
  430. static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
  431. {
  432. struct nai_realm *realm;
  433. const u8 *pos, *end;
  434. u16 i, num;
  435. size_t left;
  436. if (anqp == NULL)
  437. return NULL;
  438. left = wpabuf_len(anqp);
  439. if (left < 2)
  440. return NULL;
  441. pos = wpabuf_head_u8(anqp);
  442. end = pos + left;
  443. num = WPA_GET_LE16(pos);
  444. wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
  445. pos += 2;
  446. left -= 2;
  447. if (num > left / 5) {
  448. wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
  449. "enough data (%u octets) for that many realms",
  450. num, (unsigned int) left);
  451. return NULL;
  452. }
  453. realm = os_calloc(num, sizeof(struct nai_realm));
  454. if (realm == NULL)
  455. return NULL;
  456. for (i = 0; i < num; i++) {
  457. pos = nai_realm_parse_realm(&realm[i], pos, end);
  458. if (pos == NULL) {
  459. nai_realm_free(realm, num);
  460. return NULL;
  461. }
  462. }
  463. *count = num;
  464. return realm;
  465. }
  466. static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
  467. {
  468. char *tmp, *pos, *end;
  469. int match = 0;
  470. if (realm->realm == NULL || home_realm == NULL)
  471. return 0;
  472. if (os_strchr(realm->realm, ';') == NULL)
  473. return os_strcasecmp(realm->realm, home_realm) == 0;
  474. tmp = os_strdup(realm->realm);
  475. if (tmp == NULL)
  476. return 0;
  477. pos = tmp;
  478. while (*pos) {
  479. end = os_strchr(pos, ';');
  480. if (end)
  481. *end = '\0';
  482. if (os_strcasecmp(pos, home_realm) == 0) {
  483. match = 1;
  484. break;
  485. }
  486. if (end == NULL)
  487. break;
  488. pos = end + 1;
  489. }
  490. os_free(tmp);
  491. return match;
  492. }
  493. static int nai_realm_cred_username(struct wpa_supplicant *wpa_s,
  494. struct nai_realm_eap *eap)
  495. {
  496. if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
  497. wpa_msg(wpa_s, MSG_DEBUG,
  498. "nai-realm-cred-username: EAP method not supported: %d",
  499. eap->method);
  500. return 0; /* method not supported */
  501. }
  502. if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP &&
  503. eap->method != EAP_TYPE_FAST) {
  504. /* Only tunneled methods with username/password supported */
  505. wpa_msg(wpa_s, MSG_DEBUG,
  506. "nai-realm-cred-username: Method: %d is not TTLS, PEAP, or FAST",
  507. eap->method);
  508. return 0;
  509. }
  510. if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) {
  511. if (eap->inner_method &&
  512. eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
  513. wpa_msg(wpa_s, MSG_DEBUG,
  514. "nai-realm-cred-username: PEAP/FAST: Inner method not supported: %d",
  515. eap->inner_method);
  516. return 0;
  517. }
  518. if (!eap->inner_method &&
  519. eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) {
  520. wpa_msg(wpa_s, MSG_DEBUG,
  521. "nai-realm-cred-username: MSCHAPv2 not supported");
  522. return 0;
  523. }
  524. }
  525. if (eap->method == EAP_TYPE_TTLS) {
  526. if (eap->inner_method == 0 && eap->inner_non_eap == 0)
  527. return 1; /* Assume TTLS/MSCHAPv2 is used */
  528. if (eap->inner_method &&
  529. eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
  530. wpa_msg(wpa_s, MSG_DEBUG,
  531. "nai-realm-cred-username: TTLS, but inner not supported: %d",
  532. eap->inner_method);
  533. return 0;
  534. }
  535. if (eap->inner_non_eap &&
  536. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
  537. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
  538. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
  539. eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) {
  540. wpa_msg(wpa_s, MSG_DEBUG,
  541. "nai-realm-cred-username: TTLS, inner-non-eap not supported: %d",
  542. eap->inner_non_eap);
  543. return 0;
  544. }
  545. }
  546. if (eap->inner_method &&
  547. eap->inner_method != EAP_TYPE_GTC &&
  548. eap->inner_method != EAP_TYPE_MSCHAPV2) {
  549. wpa_msg(wpa_s, MSG_DEBUG,
  550. "nai-realm-cred-username: inner-method not GTC or MSCHAPv2: %d",
  551. eap->inner_method);
  552. return 0;
  553. }
  554. return 1;
  555. }
  556. static int nai_realm_cred_cert(struct wpa_supplicant *wpa_s,
  557. struct nai_realm_eap *eap)
  558. {
  559. if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
  560. wpa_msg(wpa_s, MSG_DEBUG,
  561. "nai-realm-cred-cert: Method not supported: %d",
  562. eap->method);
  563. return 0; /* method not supported */
  564. }
  565. if (eap->method != EAP_TYPE_TLS) {
  566. /* Only EAP-TLS supported for credential authentication */
  567. wpa_msg(wpa_s, MSG_DEBUG,
  568. "nai-realm-cred-cert: Method not TLS: %d",
  569. eap->method);
  570. return 0;
  571. }
  572. return 1;
  573. }
  574. static struct nai_realm_eap * nai_realm_find_eap(struct wpa_supplicant *wpa_s,
  575. struct wpa_cred *cred,
  576. struct nai_realm *realm)
  577. {
  578. u8 e;
  579. if (cred->username == NULL ||
  580. cred->username[0] == '\0' ||
  581. ((cred->password == NULL ||
  582. cred->password[0] == '\0') &&
  583. (cred->private_key == NULL ||
  584. cred->private_key[0] == '\0'))) {
  585. wpa_msg(wpa_s, MSG_DEBUG,
  586. "nai-realm-find-eap: incomplete cred info: username: %s password: %s private_key: %s",
  587. cred->username ? cred->username : "NULL",
  588. cred->password ? cred->password : "NULL",
  589. cred->private_key ? cred->private_key : "NULL");
  590. return NULL;
  591. }
  592. for (e = 0; e < realm->eap_count; e++) {
  593. struct nai_realm_eap *eap = &realm->eap[e];
  594. if (cred->password && cred->password[0] &&
  595. nai_realm_cred_username(wpa_s, eap))
  596. return eap;
  597. if (cred->private_key && cred->private_key[0] &&
  598. nai_realm_cred_cert(wpa_s, eap))
  599. return eap;
  600. }
  601. return NULL;
  602. }
  603. #ifdef INTERWORKING_3GPP
  604. static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
  605. {
  606. u8 plmn[3], plmn2[3];
  607. const u8 *pos, *end;
  608. u8 udhl;
  609. /*
  610. * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network
  611. * operator is allowed to include only two digits of the MNC, so allow
  612. * matches based on both two and three digit MNC assumptions. Since some
  613. * SIM/USIM cards may not expose MNC length conveniently, we may be
  614. * provided the default MNC length 3 here and as such, checking with MNC
  615. * length 2 is justifiable even though 3GPP TS 24.234 does not mention
  616. * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used
  617. * with otherwise matching values would not be good idea in general, so
  618. * this should not result in selecting incorrect networks.
  619. */
  620. /* Match with 3 digit MNC */
  621. plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
  622. plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4);
  623. plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
  624. /* Match with 2 digit MNC */
  625. plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
  626. plmn2[1] = (imsi[2] - '0') | 0xf0;
  627. plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
  628. if (anqp == NULL)
  629. return 0;
  630. pos = wpabuf_head_u8(anqp);
  631. end = pos + wpabuf_len(anqp);
  632. if (pos + 2 > end)
  633. return 0;
  634. if (*pos != 0) {
  635. wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
  636. return 0;
  637. }
  638. pos++;
  639. udhl = *pos++;
  640. if (pos + udhl > end) {
  641. wpa_printf(MSG_DEBUG, "Invalid UDHL");
  642. return 0;
  643. }
  644. end = pos + udhl;
  645. wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)",
  646. plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2],
  647. imsi, mnc_len);
  648. while (pos + 2 <= end) {
  649. u8 iei, len;
  650. const u8 *l_end;
  651. iei = *pos++;
  652. len = *pos++ & 0x7f;
  653. if (pos + len > end)
  654. break;
  655. l_end = pos + len;
  656. if (iei == 0 && len > 0) {
  657. /* PLMN List */
  658. u8 num, i;
  659. wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element",
  660. pos, len);
  661. num = *pos++;
  662. for (i = 0; i < num; i++) {
  663. if (pos + 3 > l_end)
  664. break;
  665. if (os_memcmp(pos, plmn, 3) == 0 ||
  666. os_memcmp(pos, plmn2, 3) == 0)
  667. return 1; /* Found matching PLMN */
  668. pos += 3;
  669. }
  670. } else {
  671. wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element",
  672. pos, len);
  673. }
  674. pos = l_end;
  675. }
  676. return 0;
  677. }
  678. static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
  679. size_t mnc_len, char prefix)
  680. {
  681. const char *sep, *msin;
  682. char *end, *pos;
  683. size_t msin_len, plmn_len;
  684. /*
  685. * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
  686. * Root NAI:
  687. * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
  688. * <MNC> is zero-padded to three digits in case two-digit MNC is used
  689. */
  690. if (imsi == NULL || os_strlen(imsi) > 16) {
  691. wpa_printf(MSG_DEBUG, "No valid IMSI available");
  692. return -1;
  693. }
  694. sep = os_strchr(imsi, '-');
  695. if (sep) {
  696. plmn_len = sep - imsi;
  697. msin = sep + 1;
  698. } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
  699. plmn_len = 3 + mnc_len;
  700. msin = imsi + plmn_len;
  701. } else
  702. return -1;
  703. if (plmn_len != 5 && plmn_len != 6)
  704. return -1;
  705. msin_len = os_strlen(msin);
  706. pos = nai;
  707. end = nai + nai_len;
  708. if (prefix)
  709. *pos++ = prefix;
  710. os_memcpy(pos, imsi, plmn_len);
  711. pos += plmn_len;
  712. os_memcpy(pos, msin, msin_len);
  713. pos += msin_len;
  714. pos += os_snprintf(pos, end - pos, "@wlan.mnc");
  715. if (plmn_len == 5) {
  716. *pos++ = '0';
  717. *pos++ = imsi[3];
  718. *pos++ = imsi[4];
  719. } else {
  720. *pos++ = imsi[3];
  721. *pos++ = imsi[4];
  722. *pos++ = imsi[5];
  723. }
  724. os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
  725. imsi[0], imsi[1], imsi[2]);
  726. return 0;
  727. }
  728. static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
  729. {
  730. char nai[100];
  731. if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
  732. return -1;
  733. return wpa_config_set_quoted(ssid, "identity", nai);
  734. }
  735. #endif /* INTERWORKING_3GPP */
  736. static int already_connected(struct wpa_supplicant *wpa_s,
  737. struct wpa_cred *cred, struct wpa_bss *bss)
  738. {
  739. struct wpa_ssid *ssid, *sel_ssid;
  740. struct wpa_bss *selected;
  741. if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL)
  742. return 0;
  743. ssid = wpa_s->current_ssid;
  744. if (ssid->parent_cred != cred)
  745. return 0;
  746. if (ssid->ssid_len != bss->ssid_len ||
  747. os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
  748. return 0;
  749. sel_ssid = NULL;
  750. selected = wpa_supplicant_pick_network(wpa_s, &sel_ssid);
  751. if (selected && sel_ssid && sel_ssid->priority > ssid->priority)
  752. return 0; /* higher priority network in scan results */
  753. return 1;
  754. }
  755. static void remove_duplicate_network(struct wpa_supplicant *wpa_s,
  756. struct wpa_cred *cred,
  757. struct wpa_bss *bss)
  758. {
  759. struct wpa_ssid *ssid;
  760. for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
  761. if (ssid->parent_cred != cred)
  762. continue;
  763. if (ssid->ssid_len != bss->ssid_len ||
  764. os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
  765. continue;
  766. break;
  767. }
  768. if (ssid == NULL)
  769. return;
  770. wpa_printf(MSG_DEBUG, "Interworking: Remove duplicate network entry for the same credential");
  771. if (ssid == wpa_s->current_ssid) {
  772. wpa_sm_set_config(wpa_s->wpa, NULL);
  773. eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
  774. wpa_supplicant_deauthenticate(wpa_s,
  775. WLAN_REASON_DEAUTH_LEAVING);
  776. }
  777. wpas_notify_network_removed(wpa_s, ssid);
  778. wpa_config_remove_network(wpa_s->conf, ssid->id);
  779. }
  780. static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
  781. struct wpa_ssid *ssid)
  782. {
  783. const char *key_mgmt = NULL;
  784. #ifdef CONFIG_IEEE80211R
  785. int res;
  786. struct wpa_driver_capa capa;
  787. res = wpa_drv_get_capa(wpa_s, &capa);
  788. if (res == 0 && capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT) {
  789. key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
  790. "WPA-EAP WPA-EAP-SHA256 FT-EAP" :
  791. "WPA-EAP FT-EAP";
  792. }
  793. #endif /* CONFIG_IEEE80211R */
  794. if (!key_mgmt)
  795. key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
  796. "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP";
  797. if (wpa_config_set(ssid, "key_mgmt", key_mgmt, 0) < 0)
  798. return -1;
  799. if (wpa_config_set(ssid, "proto", "RSN", 0) < 0)
  800. return -1;
  801. if (wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
  802. return -1;
  803. return 0;
  804. }
  805. static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
  806. struct wpa_cred *cred,
  807. struct wpa_bss *bss, int only_add)
  808. {
  809. #ifdef INTERWORKING_3GPP
  810. struct wpa_ssid *ssid;
  811. int eap_type;
  812. int res;
  813. char prefix;
  814. if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
  815. return -1;
  816. wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
  817. " (3GPP)", MAC2STR(bss->bssid));
  818. if (already_connected(wpa_s, cred, bss)) {
  819. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
  820. MAC2STR(bss->bssid));
  821. return wpa_s->current_ssid->id;
  822. }
  823. remove_duplicate_network(wpa_s, cred, bss);
  824. ssid = wpa_config_add_network(wpa_s->conf);
  825. if (ssid == NULL)
  826. return -1;
  827. ssid->parent_cred = cred;
  828. wpas_notify_network_added(wpa_s, ssid);
  829. wpa_config_set_network_defaults(ssid);
  830. ssid->priority = cred->priority;
  831. ssid->temporary = 1;
  832. ssid->ssid = os_zalloc(bss->ssid_len + 1);
  833. if (ssid->ssid == NULL)
  834. goto fail;
  835. os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
  836. ssid->ssid_len = bss->ssid_len;
  837. ssid->eap.sim_num = cred->sim_num;
  838. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  839. goto fail;
  840. eap_type = EAP_TYPE_SIM;
  841. if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
  842. eap_type = EAP_TYPE_AKA;
  843. if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
  844. if (cred->eap_method[0].method == EAP_TYPE_SIM ||
  845. cred->eap_method[0].method == EAP_TYPE_AKA ||
  846. cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
  847. eap_type = cred->eap_method[0].method;
  848. }
  849. switch (eap_type) {
  850. case EAP_TYPE_SIM:
  851. prefix = '1';
  852. res = wpa_config_set(ssid, "eap", "SIM", 0);
  853. break;
  854. case EAP_TYPE_AKA:
  855. prefix = '0';
  856. res = wpa_config_set(ssid, "eap", "AKA", 0);
  857. break;
  858. case EAP_TYPE_AKA_PRIME:
  859. prefix = '6';
  860. res = wpa_config_set(ssid, "eap", "AKA'", 0);
  861. break;
  862. default:
  863. res = -1;
  864. break;
  865. }
  866. if (res < 0) {
  867. wpa_msg(wpa_s, MSG_DEBUG,
  868. "Selected EAP method (%d) not supported", eap_type);
  869. goto fail;
  870. }
  871. if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
  872. wpa_msg(wpa_s, MSG_DEBUG, "Failed to set Root NAI");
  873. goto fail;
  874. }
  875. if (cred->milenage && cred->milenage[0]) {
  876. if (wpa_config_set_quoted(ssid, "password",
  877. cred->milenage) < 0)
  878. goto fail;
  879. } else if (cred->pcsc) {
  880. if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
  881. goto fail;
  882. if (wpa_s->conf->pcsc_pin &&
  883. wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
  884. < 0)
  885. goto fail;
  886. }
  887. wpa_s->next_ssid = ssid;
  888. wpa_config_update_prio_list(wpa_s->conf);
  889. if (!only_add)
  890. interworking_reconnect(wpa_s);
  891. return ssid->id;
  892. fail:
  893. wpas_notify_network_removed(wpa_s, ssid);
  894. wpa_config_remove_network(wpa_s->conf, ssid->id);
  895. #endif /* INTERWORKING_3GPP */
  896. return -1;
  897. }
  898. static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
  899. size_t rc_len)
  900. {
  901. const u8 *pos, *end;
  902. u8 lens;
  903. if (ie == NULL)
  904. return 0;
  905. pos = ie + 2;
  906. end = ie + 2 + ie[1];
  907. /* Roaming Consortium element:
  908. * Number of ANQP OIs
  909. * OI #1 and #2 lengths
  910. * OI #1, [OI #2], [OI #3]
  911. */
  912. if (pos + 2 > end)
  913. return 0;
  914. pos++; /* skip Number of ANQP OIs */
  915. lens = *pos++;
  916. if (pos + (lens & 0x0f) + (lens >> 4) > end)
  917. return 0;
  918. if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  919. return 1;
  920. pos += lens & 0x0f;
  921. if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  922. return 1;
  923. pos += lens >> 4;
  924. if (pos < end && (size_t) (end - pos) == rc_len &&
  925. os_memcmp(pos, rc_id, rc_len) == 0)
  926. return 1;
  927. return 0;
  928. }
  929. static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
  930. const u8 *rc_id, size_t rc_len)
  931. {
  932. const u8 *pos, *end;
  933. u8 len;
  934. if (anqp == NULL)
  935. return 0;
  936. pos = wpabuf_head(anqp);
  937. end = pos + wpabuf_len(anqp);
  938. /* Set of <OI Length, OI> duples */
  939. while (pos < end) {
  940. len = *pos++;
  941. if (pos + len > end)
  942. break;
  943. if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
  944. return 1;
  945. pos += len;
  946. }
  947. return 0;
  948. }
  949. static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
  950. const u8 *rc_id, size_t rc_len)
  951. {
  952. return roaming_consortium_element_match(ie, rc_id, rc_len) ||
  953. roaming_consortium_anqp_match(anqp, rc_id, rc_len);
  954. }
  955. static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss)
  956. {
  957. const u8 *ie;
  958. if (cred->required_roaming_consortium_len == 0)
  959. return 0;
  960. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  961. if (ie == NULL &&
  962. (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
  963. return 1;
  964. return !roaming_consortium_match(ie,
  965. bss->anqp ?
  966. bss->anqp->roaming_consortium : NULL,
  967. cred->required_roaming_consortium,
  968. cred->required_roaming_consortium_len);
  969. }
  970. static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
  971. {
  972. size_t i;
  973. if (!cred->excluded_ssid)
  974. return 0;
  975. for (i = 0; i < cred->num_excluded_ssid; i++) {
  976. struct excluded_ssid *e = &cred->excluded_ssid[i];
  977. if (bss->ssid_len == e->ssid_len &&
  978. os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
  979. return 1;
  980. }
  981. return 0;
  982. }
  983. static int cred_below_min_backhaul(struct wpa_supplicant *wpa_s,
  984. struct wpa_cred *cred, struct wpa_bss *bss)
  985. {
  986. int res;
  987. unsigned int dl_bandwidth, ul_bandwidth;
  988. const u8 *wan;
  989. u8 wan_info, dl_load, ul_load;
  990. u16 lmd;
  991. u32 ul_speed, dl_speed;
  992. if (!cred->min_dl_bandwidth_home &&
  993. !cred->min_ul_bandwidth_home &&
  994. !cred->min_dl_bandwidth_roaming &&
  995. !cred->min_ul_bandwidth_roaming)
  996. return 0; /* No bandwidth constraint specified */
  997. if (bss->anqp == NULL || bss->anqp->hs20_wan_metrics == NULL)
  998. return 0; /* No WAN Metrics known - ignore constraint */
  999. wan = wpabuf_head(bss->anqp->hs20_wan_metrics);
  1000. wan_info = wan[0];
  1001. if (wan_info & BIT(3))
  1002. return 1; /* WAN link at capacity */
  1003. lmd = WPA_GET_LE16(wan + 11);
  1004. if (lmd == 0)
  1005. return 0; /* Downlink/Uplink Load was not measured */
  1006. dl_speed = WPA_GET_LE32(wan + 1);
  1007. ul_speed = WPA_GET_LE32(wan + 5);
  1008. dl_load = wan[9];
  1009. ul_load = wan[10];
  1010. if (dl_speed >= 0xffffff)
  1011. dl_bandwidth = dl_speed / 255 * (255 - dl_load);
  1012. else
  1013. dl_bandwidth = dl_speed * (255 - dl_load) / 255;
  1014. if (ul_speed >= 0xffffff)
  1015. ul_bandwidth = ul_speed / 255 * (255 - ul_load);
  1016. else
  1017. ul_bandwidth = ul_speed * (255 - ul_load) / 255;
  1018. res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
  1019. bss->anqp->domain_name : NULL);
  1020. if (res > 0) {
  1021. if (cred->min_dl_bandwidth_home > dl_bandwidth)
  1022. return 1;
  1023. if (cred->min_ul_bandwidth_home > ul_bandwidth)
  1024. return 1;
  1025. } else {
  1026. if (cred->min_dl_bandwidth_roaming > dl_bandwidth)
  1027. return 1;
  1028. if (cred->min_ul_bandwidth_roaming > ul_bandwidth)
  1029. return 1;
  1030. }
  1031. return 0;
  1032. }
  1033. static int cred_over_max_bss_load(struct wpa_supplicant *wpa_s,
  1034. struct wpa_cred *cred, struct wpa_bss *bss)
  1035. {
  1036. const u8 *ie;
  1037. int res;
  1038. if (!cred->max_bss_load)
  1039. return 0; /* No BSS Load constraint specified */
  1040. ie = wpa_bss_get_ie(bss, WLAN_EID_BSS_LOAD);
  1041. if (ie == NULL || ie[1] < 3)
  1042. return 0; /* No BSS Load advertised */
  1043. res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
  1044. bss->anqp->domain_name : NULL);
  1045. if (res <= 0)
  1046. return 0; /* Not a home network */
  1047. return ie[4] > cred->max_bss_load;
  1048. }
  1049. static int has_proto_match(const u8 *pos, const u8 *end, u8 proto)
  1050. {
  1051. while (pos + 4 <= end) {
  1052. if (pos[0] == proto && pos[3] == 1 /* Open */)
  1053. return 1;
  1054. pos += 4;
  1055. }
  1056. return 0;
  1057. }
  1058. static int has_proto_port_match(const u8 *pos, const u8 *end, u8 proto,
  1059. u16 port)
  1060. {
  1061. while (pos + 4 <= end) {
  1062. if (pos[0] == proto && WPA_GET_LE16(&pos[1]) == port &&
  1063. pos[3] == 1 /* Open */)
  1064. return 1;
  1065. pos += 4;
  1066. }
  1067. return 0;
  1068. }
  1069. static int cred_conn_capab_missing(struct wpa_supplicant *wpa_s,
  1070. struct wpa_cred *cred, struct wpa_bss *bss)
  1071. {
  1072. int res;
  1073. const u8 *capab, *end;
  1074. unsigned int i, j;
  1075. int *ports;
  1076. if (!cred->num_req_conn_capab)
  1077. return 0; /* No connection capability constraint specified */
  1078. if (bss->anqp == NULL || bss->anqp->hs20_connection_capability == NULL)
  1079. return 0; /* No Connection Capability known - ignore constraint
  1080. */
  1081. res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ?
  1082. bss->anqp->domain_name : NULL);
  1083. if (res > 0)
  1084. return 0; /* No constraint in home network */
  1085. capab = wpabuf_head(bss->anqp->hs20_connection_capability);
  1086. end = capab + wpabuf_len(bss->anqp->hs20_connection_capability);
  1087. for (i = 0; i < cred->num_req_conn_capab; i++) {
  1088. ports = cred->req_conn_capab_port[i];
  1089. if (!ports) {
  1090. if (!has_proto_match(capab, end,
  1091. cred->req_conn_capab_proto[i]))
  1092. return 1;
  1093. } else {
  1094. for (j = 0; ports[j] > -1; j++) {
  1095. if (!has_proto_port_match(
  1096. capab, end,
  1097. cred->req_conn_capab_proto[i],
  1098. ports[j]))
  1099. return 1;
  1100. }
  1101. }
  1102. }
  1103. return 0;
  1104. }
  1105. static struct wpa_cred * interworking_credentials_available_roaming_consortium(
  1106. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  1107. int *excluded)
  1108. {
  1109. struct wpa_cred *cred, *selected = NULL;
  1110. const u8 *ie;
  1111. int is_excluded = 0;
  1112. ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
  1113. if (ie == NULL &&
  1114. (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
  1115. return NULL;
  1116. if (wpa_s->conf->cred == NULL)
  1117. return NULL;
  1118. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1119. if (cred->roaming_consortium_len == 0)
  1120. continue;
  1121. if (!roaming_consortium_match(ie,
  1122. bss->anqp ?
  1123. bss->anqp->roaming_consortium :
  1124. NULL,
  1125. cred->roaming_consortium,
  1126. cred->roaming_consortium_len))
  1127. continue;
  1128. if (cred_no_required_oi_match(cred, bss))
  1129. continue;
  1130. if (!ignore_bw && cred_below_min_backhaul(wpa_s, cred, bss))
  1131. continue;
  1132. if (!ignore_bw && cred_over_max_bss_load(wpa_s, cred, bss))
  1133. continue;
  1134. if (!ignore_bw && cred_conn_capab_missing(wpa_s, cred, bss))
  1135. continue;
  1136. if (cred_excluded_ssid(cred, bss)) {
  1137. if (excluded == NULL)
  1138. continue;
  1139. if (selected == NULL) {
  1140. selected = cred;
  1141. is_excluded = 1;
  1142. }
  1143. } else {
  1144. if (selected == NULL || is_excluded ||
  1145. cred_prio_cmp(selected, cred) < 0) {
  1146. selected = cred;
  1147. is_excluded = 0;
  1148. }
  1149. }
  1150. }
  1151. if (excluded)
  1152. *excluded = is_excluded;
  1153. return selected;
  1154. }
  1155. static int interworking_set_eap_params(struct wpa_ssid *ssid,
  1156. struct wpa_cred *cred, int ttls)
  1157. {
  1158. if (cred->eap_method) {
  1159. ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
  1160. cred->eap_method->method == EAP_TYPE_TTLS;
  1161. os_free(ssid->eap.eap_methods);
  1162. ssid->eap.eap_methods =
  1163. os_malloc(sizeof(struct eap_method_type) * 2);
  1164. if (ssid->eap.eap_methods == NULL)
  1165. return -1;
  1166. os_memcpy(ssid->eap.eap_methods, cred->eap_method,
  1167. sizeof(*cred->eap_method));
  1168. ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
  1169. ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
  1170. }
  1171. if (ttls && cred->username && cred->username[0]) {
  1172. const char *pos;
  1173. char *anon;
  1174. /* Use anonymous NAI in Phase 1 */
  1175. pos = os_strchr(cred->username, '@');
  1176. if (pos) {
  1177. size_t buflen = 9 + os_strlen(pos) + 1;
  1178. anon = os_malloc(buflen);
  1179. if (anon == NULL)
  1180. return -1;
  1181. os_snprintf(anon, buflen, "anonymous%s", pos);
  1182. } else if (cred->realm) {
  1183. size_t buflen = 10 + os_strlen(cred->realm) + 1;
  1184. anon = os_malloc(buflen);
  1185. if (anon == NULL)
  1186. return -1;
  1187. os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
  1188. } else {
  1189. anon = os_strdup("anonymous");
  1190. if (anon == NULL)
  1191. return -1;
  1192. }
  1193. if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
  1194. 0) {
  1195. os_free(anon);
  1196. return -1;
  1197. }
  1198. os_free(anon);
  1199. }
  1200. if (cred->username && cred->username[0] &&
  1201. wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
  1202. return -1;
  1203. if (cred->password && cred->password[0]) {
  1204. if (cred->ext_password &&
  1205. wpa_config_set(ssid, "password", cred->password, 0) < 0)
  1206. return -1;
  1207. if (!cred->ext_password &&
  1208. wpa_config_set_quoted(ssid, "password", cred->password) <
  1209. 0)
  1210. return -1;
  1211. }
  1212. if (cred->client_cert && cred->client_cert[0] &&
  1213. wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
  1214. return -1;
  1215. #ifdef ANDROID
  1216. if (cred->private_key &&
  1217. os_strncmp(cred->private_key, "keystore://", 11) == 0) {
  1218. /* Use OpenSSL engine configuration for Android keystore */
  1219. if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
  1220. wpa_config_set_quoted(ssid, "key_id",
  1221. cred->private_key + 11) < 0 ||
  1222. wpa_config_set(ssid, "engine", "1", 0) < 0)
  1223. return -1;
  1224. } else
  1225. #endif /* ANDROID */
  1226. if (cred->private_key && cred->private_key[0] &&
  1227. wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
  1228. return -1;
  1229. if (cred->private_key_passwd && cred->private_key_passwd[0] &&
  1230. wpa_config_set_quoted(ssid, "private_key_passwd",
  1231. cred->private_key_passwd) < 0)
  1232. return -1;
  1233. if (cred->phase1) {
  1234. os_free(ssid->eap.phase1);
  1235. ssid->eap.phase1 = os_strdup(cred->phase1);
  1236. }
  1237. if (cred->phase2) {
  1238. os_free(ssid->eap.phase2);
  1239. ssid->eap.phase2 = os_strdup(cred->phase2);
  1240. }
  1241. if (cred->ca_cert && cred->ca_cert[0] &&
  1242. wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
  1243. return -1;
  1244. if (cred->domain_suffix_match && cred->domain_suffix_match[0] &&
  1245. wpa_config_set_quoted(ssid, "domain_suffix_match",
  1246. cred->domain_suffix_match) < 0)
  1247. return -1;
  1248. ssid->eap.ocsp = cred->ocsp;
  1249. return 0;
  1250. }
  1251. static int interworking_connect_roaming_consortium(
  1252. struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
  1253. struct wpa_bss *bss, int only_add)
  1254. {
  1255. struct wpa_ssid *ssid;
  1256. wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR
  1257. " based on roaming consortium match", MAC2STR(bss->bssid));
  1258. if (already_connected(wpa_s, cred, bss)) {
  1259. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
  1260. MAC2STR(bss->bssid));
  1261. return wpa_s->current_ssid->id;
  1262. }
  1263. remove_duplicate_network(wpa_s, cred, bss);
  1264. ssid = wpa_config_add_network(wpa_s->conf);
  1265. if (ssid == NULL)
  1266. return -1;
  1267. ssid->parent_cred = cred;
  1268. wpas_notify_network_added(wpa_s, ssid);
  1269. wpa_config_set_network_defaults(ssid);
  1270. ssid->priority = cred->priority;
  1271. ssid->temporary = 1;
  1272. ssid->ssid = os_zalloc(bss->ssid_len + 1);
  1273. if (ssid->ssid == NULL)
  1274. goto fail;
  1275. os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
  1276. ssid->ssid_len = bss->ssid_len;
  1277. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  1278. goto fail;
  1279. if (cred->eap_method == NULL) {
  1280. wpa_msg(wpa_s, MSG_DEBUG,
  1281. "Interworking: No EAP method set for credential using roaming consortium");
  1282. goto fail;
  1283. }
  1284. if (interworking_set_eap_params(
  1285. ssid, cred,
  1286. cred->eap_method->vendor == EAP_VENDOR_IETF &&
  1287. cred->eap_method->method == EAP_TYPE_TTLS) < 0)
  1288. goto fail;
  1289. wpa_s->next_ssid = ssid;
  1290. wpa_config_update_prio_list(wpa_s->conf);
  1291. if (!only_add)
  1292. interworking_reconnect(wpa_s);
  1293. return ssid->id;
  1294. fail:
  1295. wpas_notify_network_removed(wpa_s, ssid);
  1296. wpa_config_remove_network(wpa_s->conf, ssid->id);
  1297. return -1;
  1298. }
  1299. static int interworking_connect_helper(struct wpa_supplicant *wpa_s,
  1300. struct wpa_bss *bss, int allow_excluded,
  1301. int only_add)
  1302. {
  1303. struct wpa_cred *cred, *cred_rc, *cred_3gpp;
  1304. struct wpa_ssid *ssid;
  1305. struct nai_realm *realm;
  1306. struct nai_realm_eap *eap = NULL;
  1307. u16 count, i;
  1308. char buf[100];
  1309. int excluded = 0, *excl = allow_excluded ? &excluded : NULL;
  1310. const char *name;
  1311. if (wpa_s->conf->cred == NULL || bss == NULL)
  1312. return -1;
  1313. if (disallowed_bssid(wpa_s, bss->bssid) ||
  1314. disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
  1315. wpa_msg(wpa_s, MSG_DEBUG,
  1316. "Interworking: Reject connection to disallowed BSS "
  1317. MACSTR, MAC2STR(bss->bssid));
  1318. return -1;
  1319. }
  1320. wpa_printf(MSG_DEBUG, "Interworking: Considering BSS " MACSTR
  1321. " for connection (allow_excluded=%d)",
  1322. MAC2STR(bss->bssid), allow_excluded);
  1323. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
  1324. /*
  1325. * We currently support only HS 2.0 networks and those are
  1326. * required to use WPA2-Enterprise.
  1327. */
  1328. wpa_msg(wpa_s, MSG_DEBUG,
  1329. "Interworking: Network does not use RSN");
  1330. return -1;
  1331. }
  1332. cred_rc = interworking_credentials_available_roaming_consortium(
  1333. wpa_s, bss, 0, excl);
  1334. if (cred_rc) {
  1335. wpa_msg(wpa_s, MSG_DEBUG,
  1336. "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d",
  1337. cred_rc->priority, cred_rc->sp_priority);
  1338. if (allow_excluded && excl && !(*excl))
  1339. excl = NULL;
  1340. }
  1341. cred = interworking_credentials_available_realm(wpa_s, bss, 0, excl);
  1342. if (cred) {
  1343. wpa_msg(wpa_s, MSG_DEBUG,
  1344. "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d",
  1345. cred->priority, cred->sp_priority);
  1346. if (allow_excluded && excl && !(*excl))
  1347. excl = NULL;
  1348. }
  1349. cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss, 0,
  1350. excl);
  1351. if (cred_3gpp) {
  1352. wpa_msg(wpa_s, MSG_DEBUG,
  1353. "Interworking: Highest 3GPP matching credential priority %d sp_priority %d",
  1354. cred_3gpp->priority, cred_3gpp->sp_priority);
  1355. if (allow_excluded && excl && !(*excl))
  1356. excl = NULL;
  1357. }
  1358. if (!cred_rc && !cred && !cred_3gpp) {
  1359. wpa_msg(wpa_s, MSG_DEBUG,
  1360. "Interworking: No full credential matches - consider options without BW(etc.) limits");
  1361. cred_rc = interworking_credentials_available_roaming_consortium(
  1362. wpa_s, bss, 1, excl);
  1363. if (cred_rc) {
  1364. wpa_msg(wpa_s, MSG_DEBUG,
  1365. "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d (ignore BW)",
  1366. cred_rc->priority, cred_rc->sp_priority);
  1367. if (allow_excluded && excl && !(*excl))
  1368. excl = NULL;
  1369. }
  1370. cred = interworking_credentials_available_realm(wpa_s, bss, 1,
  1371. excl);
  1372. if (cred) {
  1373. wpa_msg(wpa_s, MSG_DEBUG,
  1374. "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d (ignore BW)",
  1375. cred->priority, cred->sp_priority);
  1376. if (allow_excluded && excl && !(*excl))
  1377. excl = NULL;
  1378. }
  1379. cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss,
  1380. 1, excl);
  1381. if (cred_3gpp) {
  1382. wpa_msg(wpa_s, MSG_DEBUG,
  1383. "Interworking: Highest 3GPP matching credential priority %d sp_priority %d (ignore BW)",
  1384. cred_3gpp->priority, cred_3gpp->sp_priority);
  1385. if (allow_excluded && excl && !(*excl))
  1386. excl = NULL;
  1387. }
  1388. }
  1389. if (cred_rc &&
  1390. (cred == NULL || cred_prio_cmp(cred_rc, cred) >= 0) &&
  1391. (cred_3gpp == NULL || cred_prio_cmp(cred_rc, cred_3gpp) >= 0))
  1392. return interworking_connect_roaming_consortium(wpa_s, cred_rc,
  1393. bss, only_add);
  1394. if (cred_3gpp &&
  1395. (cred == NULL || cred_prio_cmp(cred_3gpp, cred) >= 0)) {
  1396. return interworking_connect_3gpp(wpa_s, cred_3gpp, bss,
  1397. only_add);
  1398. }
  1399. if (cred == NULL) {
  1400. wpa_msg(wpa_s, MSG_DEBUG,
  1401. "Interworking: No matching credentials found for "
  1402. MACSTR, MAC2STR(bss->bssid));
  1403. return -1;
  1404. }
  1405. realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
  1406. &count);
  1407. if (realm == NULL) {
  1408. wpa_msg(wpa_s, MSG_DEBUG,
  1409. "Interworking: Could not parse NAI Realm list from "
  1410. MACSTR, MAC2STR(bss->bssid));
  1411. return -1;
  1412. }
  1413. for (i = 0; i < count; i++) {
  1414. if (!nai_realm_match(&realm[i], cred->realm))
  1415. continue;
  1416. eap = nai_realm_find_eap(wpa_s, cred, &realm[i]);
  1417. if (eap)
  1418. break;
  1419. }
  1420. if (!eap) {
  1421. wpa_msg(wpa_s, MSG_DEBUG,
  1422. "Interworking: No matching credentials and EAP method found for "
  1423. MACSTR, MAC2STR(bss->bssid));
  1424. nai_realm_free(realm, count);
  1425. return -1;
  1426. }
  1427. wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR,
  1428. MAC2STR(bss->bssid));
  1429. if (already_connected(wpa_s, cred, bss)) {
  1430. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
  1431. MAC2STR(bss->bssid));
  1432. nai_realm_free(realm, count);
  1433. return 0;
  1434. }
  1435. remove_duplicate_network(wpa_s, cred, bss);
  1436. ssid = wpa_config_add_network(wpa_s->conf);
  1437. if (ssid == NULL) {
  1438. nai_realm_free(realm, count);
  1439. return -1;
  1440. }
  1441. ssid->parent_cred = cred;
  1442. wpas_notify_network_added(wpa_s, ssid);
  1443. wpa_config_set_network_defaults(ssid);
  1444. ssid->priority = cred->priority;
  1445. ssid->temporary = 1;
  1446. ssid->ssid = os_zalloc(bss->ssid_len + 1);
  1447. if (ssid->ssid == NULL)
  1448. goto fail;
  1449. os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
  1450. ssid->ssid_len = bss->ssid_len;
  1451. if (interworking_set_hs20_params(wpa_s, ssid) < 0)
  1452. goto fail;
  1453. if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
  1454. eap->method), 0) < 0)
  1455. goto fail;
  1456. switch (eap->method) {
  1457. case EAP_TYPE_TTLS:
  1458. if (eap->inner_method) {
  1459. os_snprintf(buf, sizeof(buf), "\"autheap=%s\"",
  1460. eap_get_name(EAP_VENDOR_IETF,
  1461. eap->inner_method));
  1462. if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
  1463. goto fail;
  1464. break;
  1465. }
  1466. switch (eap->inner_non_eap) {
  1467. case NAI_REALM_INNER_NON_EAP_PAP:
  1468. if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
  1469. 0)
  1470. goto fail;
  1471. break;
  1472. case NAI_REALM_INNER_NON_EAP_CHAP:
  1473. if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
  1474. < 0)
  1475. goto fail;
  1476. break;
  1477. case NAI_REALM_INNER_NON_EAP_MSCHAP:
  1478. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
  1479. 0) < 0)
  1480. goto fail;
  1481. break;
  1482. case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
  1483. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
  1484. 0) < 0)
  1485. goto fail;
  1486. break;
  1487. default:
  1488. /* EAP params were not set - assume TTLS/MSCHAPv2 */
  1489. if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
  1490. 0) < 0)
  1491. goto fail;
  1492. break;
  1493. }
  1494. break;
  1495. case EAP_TYPE_PEAP:
  1496. case EAP_TYPE_FAST:
  1497. if (wpa_config_set(ssid, "phase1", "\"fast_provisioning=2\"",
  1498. 0) < 0)
  1499. goto fail;
  1500. if (wpa_config_set(ssid, "pac_file",
  1501. "\"blob://pac_interworking\"", 0) < 0)
  1502. goto fail;
  1503. name = eap_get_name(EAP_VENDOR_IETF,
  1504. eap->inner_method ? eap->inner_method :
  1505. EAP_TYPE_MSCHAPV2);
  1506. if (name == NULL)
  1507. goto fail;
  1508. os_snprintf(buf, sizeof(buf), "\"auth=%s\"", name);
  1509. if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
  1510. goto fail;
  1511. break;
  1512. case EAP_TYPE_TLS:
  1513. break;
  1514. }
  1515. if (interworking_set_eap_params(ssid, cred,
  1516. eap->method == EAP_TYPE_TTLS) < 0)
  1517. goto fail;
  1518. nai_realm_free(realm, count);
  1519. wpa_s->next_ssid = ssid;
  1520. wpa_config_update_prio_list(wpa_s->conf);
  1521. if (!only_add)
  1522. interworking_reconnect(wpa_s);
  1523. return ssid->id;
  1524. fail:
  1525. wpas_notify_network_removed(wpa_s, ssid);
  1526. wpa_config_remove_network(wpa_s->conf, ssid->id);
  1527. nai_realm_free(realm, count);
  1528. return -1;
  1529. }
  1530. int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
  1531. int only_add)
  1532. {
  1533. return interworking_connect_helper(wpa_s, bss, 1, only_add);
  1534. }
  1535. #ifdef PCSC_FUNCS
  1536. static int interworking_pcsc_read_imsi(struct wpa_supplicant *wpa_s)
  1537. {
  1538. size_t len;
  1539. if (wpa_s->imsi[0] && wpa_s->mnc_len)
  1540. return 0;
  1541. len = sizeof(wpa_s->imsi) - 1;
  1542. if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
  1543. scard_deinit(wpa_s->scard);
  1544. wpa_s->scard = NULL;
  1545. wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
  1546. return -1;
  1547. }
  1548. wpa_s->imsi[len] = '\0';
  1549. wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
  1550. wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
  1551. wpa_s->imsi, wpa_s->mnc_len);
  1552. return 0;
  1553. }
  1554. #endif /* PCSC_FUNCS */
  1555. static struct wpa_cred * interworking_credentials_available_3gpp(
  1556. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  1557. int *excluded)
  1558. {
  1559. struct wpa_cred *selected = NULL;
  1560. #ifdef INTERWORKING_3GPP
  1561. struct wpa_cred *cred;
  1562. int ret;
  1563. int is_excluded = 0;
  1564. if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL) {
  1565. wpa_msg(wpa_s, MSG_DEBUG,
  1566. "interworking-avail-3gpp: not avail, anqp: %p anqp_3gpp: %p",
  1567. bss->anqp, bss->anqp ? bss->anqp->anqp_3gpp : NULL);
  1568. return NULL;
  1569. }
  1570. #ifdef CONFIG_EAP_PROXY
  1571. if (!wpa_s->imsi[0]) {
  1572. size_t len;
  1573. wpa_msg(wpa_s, MSG_DEBUG,
  1574. "Interworking: IMSI not available - try to read again through eap_proxy");
  1575. wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol,
  1576. wpa_s->imsi,
  1577. &len);
  1578. if (wpa_s->mnc_len > 0) {
  1579. wpa_s->imsi[len] = '\0';
  1580. wpa_msg(wpa_s, MSG_DEBUG,
  1581. "eap_proxy: IMSI %s (MNC length %d)",
  1582. wpa_s->imsi, wpa_s->mnc_len);
  1583. } else {
  1584. wpa_msg(wpa_s, MSG_DEBUG,
  1585. "eap_proxy: IMSI not available");
  1586. }
  1587. }
  1588. #endif /* CONFIG_EAP_PROXY */
  1589. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1590. char *sep;
  1591. const char *imsi;
  1592. int mnc_len;
  1593. char imsi_buf[16];
  1594. size_t msin_len;
  1595. #ifdef PCSC_FUNCS
  1596. if (cred->pcsc && wpa_s->scard) {
  1597. if (interworking_pcsc_read_imsi(wpa_s) < 0)
  1598. continue;
  1599. imsi = wpa_s->imsi;
  1600. mnc_len = wpa_s->mnc_len;
  1601. goto compare;
  1602. }
  1603. #endif /* PCSC_FUNCS */
  1604. #ifdef CONFIG_EAP_PROXY
  1605. if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
  1606. imsi = wpa_s->imsi;
  1607. mnc_len = wpa_s->mnc_len;
  1608. goto compare;
  1609. }
  1610. #endif /* CONFIG_EAP_PROXY */
  1611. if (cred->imsi == NULL || !cred->imsi[0] ||
  1612. (!wpa_s->conf->external_sim &&
  1613. (cred->milenage == NULL || !cred->milenage[0])))
  1614. continue;
  1615. sep = os_strchr(cred->imsi, '-');
  1616. if (sep == NULL ||
  1617. (sep - cred->imsi != 5 && sep - cred->imsi != 6))
  1618. continue;
  1619. mnc_len = sep - cred->imsi - 3;
  1620. os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len);
  1621. sep++;
  1622. msin_len = os_strlen(cred->imsi);
  1623. if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1)
  1624. msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1;
  1625. os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len);
  1626. imsi_buf[3 + mnc_len + msin_len] = '\0';
  1627. imsi = imsi_buf;
  1628. #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
  1629. compare:
  1630. #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
  1631. wpa_msg(wpa_s, MSG_DEBUG,
  1632. "Interworking: Parsing 3GPP info from " MACSTR,
  1633. MAC2STR(bss->bssid));
  1634. ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
  1635. wpa_msg(wpa_s, MSG_DEBUG, "PLMN match %sfound",
  1636. ret ? "" : "not ");
  1637. if (ret) {
  1638. if (cred_no_required_oi_match(cred, bss))
  1639. continue;
  1640. if (!ignore_bw &&
  1641. cred_below_min_backhaul(wpa_s, cred, bss))
  1642. continue;
  1643. if (!ignore_bw &&
  1644. cred_over_max_bss_load(wpa_s, cred, bss))
  1645. continue;
  1646. if (!ignore_bw &&
  1647. cred_conn_capab_missing(wpa_s, cred, bss))
  1648. continue;
  1649. if (cred_excluded_ssid(cred, bss)) {
  1650. if (excluded == NULL)
  1651. continue;
  1652. if (selected == NULL) {
  1653. selected = cred;
  1654. is_excluded = 1;
  1655. }
  1656. } else {
  1657. if (selected == NULL || is_excluded ||
  1658. cred_prio_cmp(selected, cred) < 0) {
  1659. selected = cred;
  1660. is_excluded = 0;
  1661. }
  1662. }
  1663. }
  1664. }
  1665. if (excluded)
  1666. *excluded = is_excluded;
  1667. #endif /* INTERWORKING_3GPP */
  1668. return selected;
  1669. }
  1670. static struct wpa_cred * interworking_credentials_available_realm(
  1671. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  1672. int *excluded)
  1673. {
  1674. struct wpa_cred *cred, *selected = NULL;
  1675. struct nai_realm *realm;
  1676. u16 count, i;
  1677. int is_excluded = 0;
  1678. if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
  1679. return NULL;
  1680. if (wpa_s->conf->cred == NULL)
  1681. return NULL;
  1682. wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
  1683. MACSTR, MAC2STR(bss->bssid));
  1684. realm = nai_realm_parse(bss->anqp->nai_realm, &count);
  1685. if (realm == NULL) {
  1686. wpa_msg(wpa_s, MSG_DEBUG,
  1687. "Interworking: Could not parse NAI Realm list from "
  1688. MACSTR, MAC2STR(bss->bssid));
  1689. return NULL;
  1690. }
  1691. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1692. if (cred->realm == NULL)
  1693. continue;
  1694. for (i = 0; i < count; i++) {
  1695. if (!nai_realm_match(&realm[i], cred->realm))
  1696. continue;
  1697. if (nai_realm_find_eap(wpa_s, cred, &realm[i])) {
  1698. if (cred_no_required_oi_match(cred, bss))
  1699. continue;
  1700. if (!ignore_bw &&
  1701. cred_below_min_backhaul(wpa_s, cred, bss))
  1702. continue;
  1703. if (!ignore_bw &&
  1704. cred_over_max_bss_load(wpa_s, cred, bss))
  1705. continue;
  1706. if (!ignore_bw &&
  1707. cred_conn_capab_missing(wpa_s, cred, bss))
  1708. continue;
  1709. if (cred_excluded_ssid(cred, bss)) {
  1710. if (excluded == NULL)
  1711. continue;
  1712. if (selected == NULL) {
  1713. selected = cred;
  1714. is_excluded = 1;
  1715. }
  1716. } else {
  1717. if (selected == NULL || is_excluded ||
  1718. cred_prio_cmp(selected, cred) < 0)
  1719. {
  1720. selected = cred;
  1721. is_excluded = 0;
  1722. }
  1723. }
  1724. break;
  1725. } else {
  1726. wpa_msg(wpa_s, MSG_DEBUG,
  1727. "Interworking: realm-find-eap returned false");
  1728. }
  1729. }
  1730. }
  1731. nai_realm_free(realm, count);
  1732. if (excluded)
  1733. *excluded = is_excluded;
  1734. return selected;
  1735. }
  1736. static struct wpa_cred * interworking_credentials_available_helper(
  1737. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw,
  1738. int *excluded)
  1739. {
  1740. struct wpa_cred *cred, *cred2;
  1741. int excluded1, excluded2;
  1742. if (disallowed_bssid(wpa_s, bss->bssid) ||
  1743. disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) {
  1744. wpa_printf(MSG_DEBUG, "Interworking: Ignore disallowed BSS "
  1745. MACSTR, MAC2STR(bss->bssid));
  1746. return NULL;
  1747. }
  1748. cred = interworking_credentials_available_realm(wpa_s, bss, ignore_bw,
  1749. &excluded1);
  1750. cred2 = interworking_credentials_available_3gpp(wpa_s, bss, ignore_bw,
  1751. &excluded2);
  1752. if (cred && cred2 &&
  1753. (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
  1754. cred = cred2;
  1755. excluded1 = excluded2;
  1756. }
  1757. if (!cred) {
  1758. cred = cred2;
  1759. excluded1 = excluded2;
  1760. }
  1761. cred2 = interworking_credentials_available_roaming_consortium(
  1762. wpa_s, bss, ignore_bw, &excluded2);
  1763. if (cred && cred2 &&
  1764. (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) {
  1765. cred = cred2;
  1766. excluded1 = excluded2;
  1767. }
  1768. if (!cred) {
  1769. cred = cred2;
  1770. excluded1 = excluded2;
  1771. }
  1772. if (excluded)
  1773. *excluded = excluded1;
  1774. return cred;
  1775. }
  1776. static struct wpa_cred * interworking_credentials_available(
  1777. struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int *excluded)
  1778. {
  1779. struct wpa_cred *cred;
  1780. if (excluded)
  1781. *excluded = 0;
  1782. cred = interworking_credentials_available_helper(wpa_s, bss, 0,
  1783. excluded);
  1784. if (cred)
  1785. return cred;
  1786. return interworking_credentials_available_helper(wpa_s, bss, 1,
  1787. excluded);
  1788. }
  1789. int domain_name_list_contains(struct wpabuf *domain_names,
  1790. const char *domain, int exact_match)
  1791. {
  1792. const u8 *pos, *end;
  1793. size_t len;
  1794. len = os_strlen(domain);
  1795. pos = wpabuf_head(domain_names);
  1796. end = pos + wpabuf_len(domain_names);
  1797. while (pos + 1 < end) {
  1798. if (pos + 1 + pos[0] > end)
  1799. break;
  1800. wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
  1801. pos + 1, pos[0]);
  1802. if (pos[0] == len &&
  1803. os_strncasecmp(domain, (const char *) (pos + 1), len) == 0)
  1804. return 1;
  1805. if (!exact_match && pos[0] > len && pos[pos[0] - len] == '.') {
  1806. const char *ap = (const char *) (pos + 1);
  1807. int offset = pos[0] - len;
  1808. if (os_strncasecmp(domain, ap + offset, len) == 0)
  1809. return 1;
  1810. }
  1811. pos += 1 + pos[0];
  1812. }
  1813. return 0;
  1814. }
  1815. int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
  1816. struct wpa_cred *cred,
  1817. struct wpabuf *domain_names)
  1818. {
  1819. size_t i;
  1820. int ret = -1;
  1821. #ifdef INTERWORKING_3GPP
  1822. char nai[100], *realm;
  1823. char *imsi = NULL;
  1824. int mnc_len = 0;
  1825. if (cred->imsi)
  1826. imsi = cred->imsi;
  1827. #ifdef PCSC_FUNCS
  1828. else if (cred->pcsc && wpa_s->scard) {
  1829. if (interworking_pcsc_read_imsi(wpa_s) < 0)
  1830. return -1;
  1831. imsi = wpa_s->imsi;
  1832. mnc_len = wpa_s->mnc_len;
  1833. }
  1834. #endif /* PCSC_FUNCS */
  1835. #ifdef CONFIG_EAP_PROXY
  1836. else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
  1837. imsi = wpa_s->imsi;
  1838. mnc_len = wpa_s->mnc_len;
  1839. }
  1840. #endif /* CONFIG_EAP_PROXY */
  1841. if (domain_names &&
  1842. imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
  1843. realm = os_strchr(nai, '@');
  1844. if (realm)
  1845. realm++;
  1846. wpa_msg(wpa_s, MSG_DEBUG,
  1847. "Interworking: Search for match with SIM/USIM domain %s",
  1848. realm);
  1849. if (realm &&
  1850. domain_name_list_contains(domain_names, realm, 1))
  1851. return 1;
  1852. if (realm)
  1853. ret = 0;
  1854. }
  1855. #endif /* INTERWORKING_3GPP */
  1856. if (domain_names == NULL || cred->domain == NULL)
  1857. return ret;
  1858. for (i = 0; i < cred->num_domain; i++) {
  1859. wpa_msg(wpa_s, MSG_DEBUG,
  1860. "Interworking: Search for match with home SP FQDN %s",
  1861. cred->domain[i]);
  1862. if (domain_name_list_contains(domain_names, cred->domain[i], 1))
  1863. return 1;
  1864. }
  1865. return 0;
  1866. }
  1867. static int interworking_home_sp(struct wpa_supplicant *wpa_s,
  1868. struct wpabuf *domain_names)
  1869. {
  1870. struct wpa_cred *cred;
  1871. if (domain_names == NULL || wpa_s->conf->cred == NULL)
  1872. return -1;
  1873. for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
  1874. int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
  1875. if (res)
  1876. return res;
  1877. }
  1878. return 0;
  1879. }
  1880. static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
  1881. {
  1882. struct wpa_bss *bss;
  1883. struct wpa_ssid *ssid;
  1884. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1885. for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
  1886. if (wpas_network_disabled(wpa_s, ssid) ||
  1887. ssid->mode != WPAS_MODE_INFRA)
  1888. continue;
  1889. if (ssid->ssid_len != bss->ssid_len ||
  1890. os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
  1891. 0)
  1892. continue;
  1893. /*
  1894. * TODO: Consider more accurate matching of security
  1895. * configuration similarly to what is done in events.c
  1896. */
  1897. return 1;
  1898. }
  1899. }
  1900. return 0;
  1901. }
  1902. static int roaming_partner_match(struct wpa_supplicant *wpa_s,
  1903. struct roaming_partner *partner,
  1904. struct wpabuf *domain_names)
  1905. {
  1906. wpa_printf(MSG_DEBUG, "Interworking: Comparing roaming_partner info fqdn='%s' exact_match=%d priority=%u country='%s'",
  1907. partner->fqdn, partner->exact_match, partner->priority,
  1908. partner->country);
  1909. wpa_hexdump_ascii(MSG_DEBUG, "Interworking: Domain names",
  1910. wpabuf_head(domain_names),
  1911. wpabuf_len(domain_names));
  1912. if (!domain_name_list_contains(domain_names, partner->fqdn,
  1913. partner->exact_match))
  1914. return 0;
  1915. /* TODO: match Country */
  1916. return 1;
  1917. }
  1918. static u8 roaming_prio(struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
  1919. struct wpa_bss *bss)
  1920. {
  1921. size_t i;
  1922. if (bss->anqp == NULL || bss->anqp->domain_name == NULL) {
  1923. wpa_printf(MSG_DEBUG, "Interworking: No ANQP domain name info -> use default roaming partner priority 128");
  1924. return 128; /* cannot check preference with domain name */
  1925. }
  1926. if (interworking_home_sp_cred(wpa_s, cred, bss->anqp->domain_name) > 0)
  1927. {
  1928. wpa_printf(MSG_DEBUG, "Interworking: Determined to be home SP -> use maximum preference 0 as roaming partner priority");
  1929. return 0; /* max preference for home SP network */
  1930. }
  1931. for (i = 0; i < cred->num_roaming_partner; i++) {
  1932. if (roaming_partner_match(wpa_s, &cred->roaming_partner[i],
  1933. bss->anqp->domain_name)) {
  1934. wpa_printf(MSG_DEBUG, "Interworking: Roaming partner preference match - priority %u",
  1935. cred->roaming_partner[i].priority);
  1936. return cred->roaming_partner[i].priority;
  1937. }
  1938. }
  1939. wpa_printf(MSG_DEBUG, "Interworking: No roaming partner preference match - use default roaming partner priority 128");
  1940. return 128;
  1941. }
  1942. static struct wpa_bss * pick_best_roaming_partner(struct wpa_supplicant *wpa_s,
  1943. struct wpa_bss *selected,
  1944. struct wpa_cred *cred)
  1945. {
  1946. struct wpa_bss *bss;
  1947. u8 best_prio, prio;
  1948. struct wpa_cred *cred2;
  1949. /*
  1950. * Check if any other BSS is operated by a more preferred roaming
  1951. * partner.
  1952. */
  1953. best_prio = roaming_prio(wpa_s, cred, selected);
  1954. wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for selected BSS "
  1955. MACSTR " (cred=%d)", best_prio, MAC2STR(selected->bssid),
  1956. cred->id);
  1957. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  1958. if (bss == selected)
  1959. continue;
  1960. cred2 = interworking_credentials_available(wpa_s, bss, NULL);
  1961. if (!cred2)
  1962. continue;
  1963. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN))
  1964. continue;
  1965. prio = roaming_prio(wpa_s, cred2, bss);
  1966. wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for BSS "
  1967. MACSTR " (cred=%d)", prio, MAC2STR(bss->bssid),
  1968. cred2->id);
  1969. if (prio < best_prio) {
  1970. int bh1, bh2, load1, load2, conn1, conn2;
  1971. bh1 = cred_below_min_backhaul(wpa_s, cred, selected);
  1972. load1 = cred_over_max_bss_load(wpa_s, cred, selected);
  1973. conn1 = cred_conn_capab_missing(wpa_s, cred, selected);
  1974. bh2 = cred_below_min_backhaul(wpa_s, cred2, bss);
  1975. load2 = cred_over_max_bss_load(wpa_s, cred2, bss);
  1976. conn2 = cred_conn_capab_missing(wpa_s, cred2, bss);
  1977. wpa_printf(MSG_DEBUG, "Interworking: old: %d %d %d new: %d %d %d",
  1978. bh1, load1, conn1, bh2, load2, conn2);
  1979. if (bh1 || load1 || conn1 || !(bh2 || load2 || conn2)) {
  1980. wpa_printf(MSG_DEBUG, "Interworking: Better roaming partner " MACSTR " selected", MAC2STR(bss->bssid));
  1981. best_prio = prio;
  1982. selected = bss;
  1983. }
  1984. }
  1985. }
  1986. return selected;
  1987. }
  1988. static void interworking_select_network(struct wpa_supplicant *wpa_s)
  1989. {
  1990. struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
  1991. struct wpa_bss *selected2 = NULL, *selected2_home = NULL;
  1992. unsigned int count = 0;
  1993. const char *type;
  1994. int res;
  1995. struct wpa_cred *cred, *selected_cred = NULL;
  1996. struct wpa_cred *selected_home_cred = NULL;
  1997. struct wpa_cred *selected2_cred = NULL;
  1998. struct wpa_cred *selected2_home_cred = NULL;
  1999. wpa_s->network_select = 0;
  2000. wpa_printf(MSG_DEBUG, "Interworking: Select network (auto_select=%d)",
  2001. wpa_s->auto_select);
  2002. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  2003. int excluded = 0;
  2004. int bh, bss_load, conn_capab;
  2005. cred = interworking_credentials_available(wpa_s, bss,
  2006. &excluded);
  2007. if (!cred)
  2008. continue;
  2009. if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
  2010. /*
  2011. * We currently support only HS 2.0 networks and those
  2012. * are required to use WPA2-Enterprise.
  2013. */
  2014. wpa_msg(wpa_s, MSG_DEBUG,
  2015. "Interworking: Credential match with " MACSTR
  2016. " but network does not use RSN",
  2017. MAC2STR(bss->bssid));
  2018. continue;
  2019. }
  2020. if (!excluded)
  2021. count++;
  2022. res = interworking_home_sp(wpa_s, bss->anqp ?
  2023. bss->anqp->domain_name : NULL);
  2024. if (res > 0)
  2025. type = "home";
  2026. else if (res == 0)
  2027. type = "roaming";
  2028. else
  2029. type = "unknown";
  2030. bh = cred_below_min_backhaul(wpa_s, cred, bss);
  2031. bss_load = cred_over_max_bss_load(wpa_s, cred, bss);
  2032. conn_capab = cred_conn_capab_missing(wpa_s, cred, bss);
  2033. wpa_msg(wpa_s, MSG_INFO, "%s" MACSTR " type=%s%s%s%s id=%d priority=%d sp_priority=%d",
  2034. excluded ? INTERWORKING_BLACKLISTED : INTERWORKING_AP,
  2035. MAC2STR(bss->bssid), type,
  2036. bh ? " below_min_backhaul=1" : "",
  2037. bss_load ? " over_max_bss_load=1" : "",
  2038. conn_capab ? " conn_capab_missing=1" : "",
  2039. cred->id, cred->priority, cred->sp_priority);
  2040. if (excluded)
  2041. continue;
  2042. if (wpa_s->auto_select ||
  2043. (wpa_s->conf->auto_interworking &&
  2044. wpa_s->auto_network_select)) {
  2045. if (bh || bss_load || conn_capab) {
  2046. if (selected2_cred == NULL ||
  2047. cred_prio_cmp(cred, selected2_cred) > 0) {
  2048. wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2");
  2049. selected2 = bss;
  2050. selected2_cred = cred;
  2051. }
  2052. if (res > 0 &&
  2053. (selected2_home_cred == NULL ||
  2054. cred_prio_cmp(cred, selected2_home_cred) >
  2055. 0)) {
  2056. wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2_home");
  2057. selected2_home = bss;
  2058. selected2_home_cred = cred;
  2059. }
  2060. } else {
  2061. if (selected_cred == NULL ||
  2062. cred_prio_cmp(cred, selected_cred) > 0) {
  2063. wpa_printf(MSG_DEBUG, "Interworking: Mark as selected");
  2064. selected = bss;
  2065. selected_cred = cred;
  2066. }
  2067. if (res > 0 &&
  2068. (selected_home_cred == NULL ||
  2069. cred_prio_cmp(cred, selected_home_cred) >
  2070. 0)) {
  2071. wpa_printf(MSG_DEBUG, "Interworking: Mark as selected_home");
  2072. selected_home = bss;
  2073. selected_home_cred = cred;
  2074. }
  2075. }
  2076. }
  2077. }
  2078. if (selected_home && selected_home != selected &&
  2079. selected_home_cred &&
  2080. (selected_cred == NULL ||
  2081. cred_prio_cmp(selected_home_cred, selected_cred) >= 0)) {
  2082. /* Prefer network operated by the Home SP */
  2083. wpa_printf(MSG_DEBUG, "Interworking: Overrided selected with selected_home");
  2084. selected = selected_home;
  2085. selected_cred = selected_home_cred;
  2086. }
  2087. if (!selected) {
  2088. if (selected2_home) {
  2089. wpa_printf(MSG_DEBUG, "Interworking: Use home BSS with BW limit mismatch since no other network could be selected");
  2090. selected = selected2_home;
  2091. selected_cred = selected2_home_cred;
  2092. } else if (selected2) {
  2093. wpa_printf(MSG_DEBUG, "Interworking: Use visited BSS with BW limit mismatch since no other network could be selected");
  2094. selected = selected2;
  2095. selected_cred = selected2_cred;
  2096. }
  2097. }
  2098. if (count == 0) {
  2099. /*
  2100. * No matching network was found based on configured
  2101. * credentials. Check whether any of the enabled network blocks
  2102. * have matching APs.
  2103. */
  2104. if (interworking_find_network_match(wpa_s)) {
  2105. wpa_msg(wpa_s, MSG_DEBUG,
  2106. "Interworking: Possible BSS match for enabled network configurations");
  2107. if (wpa_s->auto_select) {
  2108. interworking_reconnect(wpa_s);
  2109. return;
  2110. }
  2111. }
  2112. if (wpa_s->auto_network_select) {
  2113. wpa_msg(wpa_s, MSG_DEBUG,
  2114. "Interworking: Continue scanning after ANQP fetch");
  2115. wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
  2116. 0);
  2117. return;
  2118. }
  2119. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
  2120. "with matching credentials found");
  2121. }
  2122. if (selected) {
  2123. wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR,
  2124. MAC2STR(selected->bssid));
  2125. selected = pick_best_roaming_partner(wpa_s, selected,
  2126. selected_cred);
  2127. wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR
  2128. " (after best roaming partner selection)",
  2129. MAC2STR(selected->bssid));
  2130. wpa_msg(wpa_s, MSG_INFO, INTERWORKING_SELECTED MACSTR,
  2131. MAC2STR(selected->bssid));
  2132. interworking_connect(wpa_s, selected, 0);
  2133. }
  2134. }
  2135. static struct wpa_bss_anqp *
  2136. interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
  2137. {
  2138. struct wpa_bss *other;
  2139. if (is_zero_ether_addr(bss->hessid))
  2140. return NULL; /* Cannot be in the same homegenous ESS */
  2141. dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
  2142. if (other == bss)
  2143. continue;
  2144. if (other->anqp == NULL)
  2145. continue;
  2146. if (other->anqp->roaming_consortium == NULL &&
  2147. other->anqp->nai_realm == NULL &&
  2148. other->anqp->anqp_3gpp == NULL &&
  2149. other->anqp->domain_name == NULL)
  2150. continue;
  2151. if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
  2152. continue;
  2153. if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
  2154. continue;
  2155. if (bss->ssid_len != other->ssid_len ||
  2156. os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
  2157. continue;
  2158. wpa_msg(wpa_s, MSG_DEBUG,
  2159. "Interworking: Share ANQP data with already fetched BSSID "
  2160. MACSTR " and " MACSTR,
  2161. MAC2STR(other->bssid), MAC2STR(bss->bssid));
  2162. other->anqp->users++;
  2163. return other->anqp;
  2164. }
  2165. return NULL;
  2166. }
  2167. static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
  2168. {
  2169. struct wpa_bss *bss;
  2170. int found = 0;
  2171. const u8 *ie;
  2172. wpa_printf(MSG_DEBUG, "Interworking: next_anqp_fetch - "
  2173. "fetch_anqp_in_progress=%d fetch_osu_icon_in_progress=%d",
  2174. wpa_s->fetch_anqp_in_progress,
  2175. wpa_s->fetch_osu_icon_in_progress);
  2176. if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress) {
  2177. wpa_printf(MSG_DEBUG, "Interworking: Stop next-ANQP-fetch");
  2178. return;
  2179. }
  2180. if (wpa_s->fetch_osu_icon_in_progress) {
  2181. wpa_printf(MSG_DEBUG, "Interworking: Next icon (in progress)");
  2182. hs20_next_osu_icon(wpa_s);
  2183. return;
  2184. }
  2185. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
  2186. if (!(bss->caps & IEEE80211_CAP_ESS))
  2187. continue;
  2188. ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
  2189. if (ie == NULL || ie[1] < 4 || !(ie[5] & 0x80))
  2190. continue; /* AP does not support Interworking */
  2191. if (disallowed_bssid(wpa_s, bss->bssid) ||
  2192. disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len))
  2193. continue; /* Disallowed BSS */
  2194. if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
  2195. if (bss->anqp == NULL) {
  2196. bss->anqp = interworking_match_anqp_info(wpa_s,
  2197. bss);
  2198. if (bss->anqp) {
  2199. /* Shared data already fetched */
  2200. continue;
  2201. }
  2202. bss->anqp = wpa_bss_anqp_alloc();
  2203. if (bss->anqp == NULL)
  2204. break;
  2205. }
  2206. found++;
  2207. bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
  2208. wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
  2209. MACSTR, MAC2STR(bss->bssid));
  2210. interworking_anqp_send_req(wpa_s, bss);
  2211. break;
  2212. }
  2213. }
  2214. if (found == 0) {
  2215. if (wpa_s->fetch_osu_info) {
  2216. if (wpa_s->num_prov_found == 0 &&
  2217. wpa_s->fetch_osu_waiting_scan &&
  2218. wpa_s->num_osu_scans < 3) {
  2219. wpa_printf(MSG_DEBUG, "HS 2.0: No OSU providers seen - try to scan again");
  2220. hs20_start_osu_scan(wpa_s);
  2221. return;
  2222. }
  2223. wpa_printf(MSG_DEBUG, "Interworking: Next icon");
  2224. hs20_osu_icon_fetch(wpa_s);
  2225. return;
  2226. }
  2227. wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
  2228. wpa_s->fetch_anqp_in_progress = 0;
  2229. if (wpa_s->network_select)
  2230. interworking_select_network(wpa_s);
  2231. }
  2232. }
  2233. void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
  2234. {
  2235. struct wpa_bss *bss;
  2236. dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
  2237. bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
  2238. wpa_s->fetch_anqp_in_progress = 1;
  2239. /*
  2240. * Start actual ANQP operation from eloop call to make sure the loop
  2241. * does not end up using excessive recursion.
  2242. */
  2243. eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s, NULL);
  2244. }
  2245. int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
  2246. {
  2247. if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
  2248. return 0;
  2249. wpa_s->network_select = 0;
  2250. wpa_s->fetch_all_anqp = 1;
  2251. wpa_s->fetch_osu_info = 0;
  2252. interworking_start_fetch_anqp(wpa_s);
  2253. return 0;
  2254. }
  2255. void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
  2256. {
  2257. if (!wpa_s->fetch_anqp_in_progress)
  2258. return;
  2259. wpa_s->fetch_anqp_in_progress = 0;
  2260. }
  2261. int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
  2262. u16 info_ids[], size_t num_ids, u32 subtypes)
  2263. {
  2264. struct wpabuf *buf;
  2265. struct wpabuf *hs20_buf = NULL;
  2266. int ret = 0;
  2267. int freq;
  2268. struct wpa_bss *bss;
  2269. int res;
  2270. freq = wpa_s->assoc_freq;
  2271. bss = wpa_bss_get_bssid(wpa_s, dst);
  2272. if (bss) {
  2273. wpa_bss_anqp_unshare_alloc(bss);
  2274. freq = bss->freq;
  2275. }
  2276. if (freq <= 0)
  2277. return -1;
  2278. wpa_msg(wpa_s, MSG_DEBUG,
  2279. "ANQP: Query Request to " MACSTR " for %u id(s)",
  2280. MAC2STR(dst), (unsigned int) num_ids);
  2281. #ifdef CONFIG_HS20
  2282. if (subtypes != 0) {
  2283. hs20_buf = wpabuf_alloc(100);
  2284. if (hs20_buf == NULL)
  2285. return -1;
  2286. hs20_put_anqp_req(subtypes, NULL, 0, hs20_buf);
  2287. }
  2288. #endif /* CONFIG_HS20 */
  2289. buf = anqp_build_req(info_ids, num_ids, hs20_buf);
  2290. wpabuf_free(hs20_buf);
  2291. if (buf == NULL)
  2292. return -1;
  2293. res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
  2294. if (res < 0) {
  2295. wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request");
  2296. wpabuf_free(buf);
  2297. ret = -1;
  2298. } else {
  2299. wpa_msg(wpa_s, MSG_DEBUG,
  2300. "ANQP: Query started with dialog token %u", res);
  2301. }
  2302. return ret;
  2303. }
  2304. static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
  2305. struct wpa_bss *bss, const u8 *sa,
  2306. u16 info_id,
  2307. const u8 *data, size_t slen)
  2308. {
  2309. const u8 *pos = data;
  2310. struct wpa_bss_anqp *anqp = NULL;
  2311. #ifdef CONFIG_HS20
  2312. u8 type;
  2313. #endif /* CONFIG_HS20 */
  2314. if (bss)
  2315. anqp = bss->anqp;
  2316. switch (info_id) {
  2317. case ANQP_CAPABILITY_LIST:
  2318. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2319. " ANQP Capability list", MAC2STR(sa));
  2320. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Capability list",
  2321. pos, slen);
  2322. if (anqp) {
  2323. wpabuf_free(anqp->capability_list);
  2324. anqp->capability_list = wpabuf_alloc_copy(pos, slen);
  2325. }
  2326. break;
  2327. case ANQP_VENUE_NAME:
  2328. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2329. " Venue Name", MAC2STR(sa));
  2330. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
  2331. if (anqp) {
  2332. wpabuf_free(anqp->venue_name);
  2333. anqp->venue_name = wpabuf_alloc_copy(pos, slen);
  2334. }
  2335. break;
  2336. case ANQP_NETWORK_AUTH_TYPE:
  2337. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2338. " Network Authentication Type information",
  2339. MAC2STR(sa));
  2340. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
  2341. "Type", pos, slen);
  2342. if (anqp) {
  2343. wpabuf_free(anqp->network_auth_type);
  2344. anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
  2345. }
  2346. break;
  2347. case ANQP_ROAMING_CONSORTIUM:
  2348. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2349. " Roaming Consortium list", MAC2STR(sa));
  2350. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
  2351. pos, slen);
  2352. if (anqp) {
  2353. wpabuf_free(anqp->roaming_consortium);
  2354. anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
  2355. }
  2356. break;
  2357. case ANQP_IP_ADDR_TYPE_AVAILABILITY:
  2358. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2359. " IP Address Type Availability information",
  2360. MAC2STR(sa));
  2361. wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
  2362. pos, slen);
  2363. if (anqp) {
  2364. wpabuf_free(anqp->ip_addr_type_availability);
  2365. anqp->ip_addr_type_availability =
  2366. wpabuf_alloc_copy(pos, slen);
  2367. }
  2368. break;
  2369. case ANQP_NAI_REALM:
  2370. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2371. " NAI Realm list", MAC2STR(sa));
  2372. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
  2373. if (anqp) {
  2374. wpabuf_free(anqp->nai_realm);
  2375. anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
  2376. }
  2377. break;
  2378. case ANQP_3GPP_CELLULAR_NETWORK:
  2379. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2380. " 3GPP Cellular Network information", MAC2STR(sa));
  2381. wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
  2382. pos, slen);
  2383. if (anqp) {
  2384. wpabuf_free(anqp->anqp_3gpp);
  2385. anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
  2386. }
  2387. break;
  2388. case ANQP_DOMAIN_NAME:
  2389. wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
  2390. " Domain Name list", MAC2STR(sa));
  2391. wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
  2392. if (anqp) {
  2393. wpabuf_free(anqp->domain_name);
  2394. anqp->domain_name = wpabuf_alloc_copy(pos, slen);
  2395. }
  2396. break;
  2397. case ANQP_VENDOR_SPECIFIC:
  2398. if (slen < 3)
  2399. return;
  2400. switch (WPA_GET_BE24(pos)) {
  2401. #ifdef CONFIG_HS20
  2402. case OUI_WFA:
  2403. pos += 3;
  2404. slen -= 3;
  2405. if (slen < 1)
  2406. return;
  2407. type = *pos++;
  2408. slen--;
  2409. switch (type) {
  2410. case HS20_ANQP_OUI_TYPE:
  2411. hs20_parse_rx_hs20_anqp_resp(wpa_s, bss, sa,
  2412. pos, slen);
  2413. break;
  2414. default:
  2415. wpa_msg(wpa_s, MSG_DEBUG,
  2416. "HS20: Unsupported ANQP vendor type %u",
  2417. type);
  2418. break;
  2419. }
  2420. break;
  2421. #endif /* CONFIG_HS20 */
  2422. default:
  2423. wpa_msg(wpa_s, MSG_DEBUG,
  2424. "Interworking: Unsupported vendor-specific ANQP OUI %06x",
  2425. WPA_GET_BE24(pos));
  2426. return;
  2427. }
  2428. break;
  2429. default:
  2430. wpa_msg(wpa_s, MSG_DEBUG,
  2431. "Interworking: Unsupported ANQP Info ID %u", info_id);
  2432. break;
  2433. }
  2434. }
  2435. void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
  2436. enum gas_query_result result,
  2437. const struct wpabuf *adv_proto,
  2438. const struct wpabuf *resp, u16 status_code)
  2439. {
  2440. struct wpa_supplicant *wpa_s = ctx;
  2441. const u8 *pos;
  2442. const u8 *end;
  2443. u16 info_id;
  2444. u16 slen;
  2445. struct wpa_bss *bss = NULL, *tmp;
  2446. const char *anqp_result = "SUCCESS";
  2447. wpa_printf(MSG_DEBUG, "Interworking: anqp_resp_cb dst=" MACSTR
  2448. " dialog_token=%u result=%d status_code=%u",
  2449. MAC2STR(dst), dialog_token, result, status_code);
  2450. if (result != GAS_QUERY_SUCCESS) {
  2451. if (wpa_s->fetch_osu_icon_in_progress)
  2452. hs20_icon_fetch_failed(wpa_s);
  2453. anqp_result = "FAILURE";
  2454. goto out;
  2455. }
  2456. pos = wpabuf_head(adv_proto);
  2457. if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
  2458. pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
  2459. wpa_msg(wpa_s, MSG_DEBUG,
  2460. "ANQP: Unexpected Advertisement Protocol in response");
  2461. if (wpa_s->fetch_osu_icon_in_progress)
  2462. hs20_icon_fetch_failed(wpa_s);
  2463. anqp_result = "INVALID_FRAME";
  2464. goto out;
  2465. }
  2466. /*
  2467. * If possible, select the BSS entry based on which BSS entry was used
  2468. * for the request. This can help in cases where multiple BSS entries
  2469. * may exist for the same AP.
  2470. */
  2471. dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
  2472. if (tmp == wpa_s->interworking_gas_bss &&
  2473. os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
  2474. bss = tmp;
  2475. break;
  2476. }
  2477. }
  2478. if (bss == NULL)
  2479. bss = wpa_bss_get_bssid(wpa_s, dst);
  2480. pos = wpabuf_head(resp);
  2481. end = pos + wpabuf_len(resp);
  2482. while (pos < end) {
  2483. unsigned int left = end - pos;
  2484. if (left < 4) {
  2485. wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Invalid element");
  2486. anqp_result = "INVALID_FRAME";
  2487. goto out_parse_done;
  2488. }
  2489. info_id = WPA_GET_LE16(pos);
  2490. pos += 2;
  2491. slen = WPA_GET_LE16(pos);
  2492. pos += 2;
  2493. left -= 4;
  2494. if (left < slen) {
  2495. wpa_msg(wpa_s, MSG_DEBUG,
  2496. "ANQP: Invalid element length for Info ID %u",
  2497. info_id);
  2498. anqp_result = "INVALID_FRAME";
  2499. goto out_parse_done;
  2500. }
  2501. interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
  2502. slen);
  2503. pos += slen;
  2504. }
  2505. out_parse_done:
  2506. hs20_notify_parse_done(wpa_s);
  2507. out:
  2508. wpa_msg(wpa_s, MSG_INFO, ANQP_QUERY_DONE "addr=" MACSTR " result=%s",
  2509. MAC2STR(dst), anqp_result);
  2510. }
  2511. static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
  2512. struct wpa_scan_results *scan_res)
  2513. {
  2514. wpa_msg(wpa_s, MSG_DEBUG,
  2515. "Interworking: Scan results available - start ANQP fetch");
  2516. interworking_start_fetch_anqp(wpa_s);
  2517. }
  2518. int interworking_select(struct wpa_supplicant *wpa_s, int auto_select,
  2519. int *freqs)
  2520. {
  2521. interworking_stop_fetch_anqp(wpa_s);
  2522. wpa_s->network_select = 1;
  2523. wpa_s->auto_network_select = 0;
  2524. wpa_s->auto_select = !!auto_select;
  2525. wpa_s->fetch_all_anqp = 0;
  2526. wpa_s->fetch_osu_info = 0;
  2527. wpa_msg(wpa_s, MSG_DEBUG,
  2528. "Interworking: Start scan for network selection");
  2529. wpa_s->scan_res_handler = interworking_scan_res_handler;
  2530. wpa_s->normal_scans = 0;
  2531. wpa_s->scan_req = MANUAL_SCAN_REQ;
  2532. os_free(wpa_s->manual_scan_freqs);
  2533. wpa_s->manual_scan_freqs = freqs;
  2534. wpa_s->after_wps = 0;
  2535. wpa_s->known_wps_freq = 0;
  2536. wpa_supplicant_req_scan(wpa_s, 0, 0);
  2537. return 0;
  2538. }
  2539. static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
  2540. enum gas_query_result result,
  2541. const struct wpabuf *adv_proto,
  2542. const struct wpabuf *resp, u16 status_code)
  2543. {
  2544. struct wpa_supplicant *wpa_s = ctx;
  2545. struct wpabuf *n;
  2546. wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
  2547. " dialog_token=%d status_code=%d resp_len=%d",
  2548. MAC2STR(addr), dialog_token, status_code,
  2549. resp ? (int) wpabuf_len(resp) : -1);
  2550. if (!resp)
  2551. return;
  2552. n = wpabuf_dup(resp);
  2553. if (n == NULL)
  2554. return;
  2555. wpabuf_free(wpa_s->prev_gas_resp);
  2556. wpa_s->prev_gas_resp = wpa_s->last_gas_resp;
  2557. os_memcpy(wpa_s->prev_gas_addr, wpa_s->last_gas_addr, ETH_ALEN);
  2558. wpa_s->prev_gas_dialog_token = wpa_s->last_gas_dialog_token;
  2559. wpa_s->last_gas_resp = n;
  2560. os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
  2561. wpa_s->last_gas_dialog_token = dialog_token;
  2562. }
  2563. int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
  2564. const struct wpabuf *adv_proto,
  2565. const struct wpabuf *query)
  2566. {
  2567. struct wpabuf *buf;
  2568. int ret = 0;
  2569. int freq;
  2570. struct wpa_bss *bss;
  2571. int res;
  2572. size_t len;
  2573. u8 query_resp_len_limit = 0;
  2574. freq = wpa_s->assoc_freq;
  2575. bss = wpa_bss_get_bssid(wpa_s, dst);
  2576. if (bss)
  2577. freq = bss->freq;
  2578. if (freq <= 0)
  2579. return -1;
  2580. wpa_msg(wpa_s, MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
  2581. MAC2STR(dst), freq);
  2582. wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
  2583. wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
  2584. len = 3 + wpabuf_len(adv_proto) + 2;
  2585. if (query)
  2586. len += wpabuf_len(query);
  2587. buf = gas_build_initial_req(0, len);
  2588. if (buf == NULL)
  2589. return -1;
  2590. /* Advertisement Protocol IE */
  2591. wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
  2592. wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
  2593. wpabuf_put_u8(buf, query_resp_len_limit & 0x7f);
  2594. wpabuf_put_buf(buf, adv_proto);
  2595. /* GAS Query */
  2596. if (query) {
  2597. wpabuf_put_le16(buf, wpabuf_len(query));
  2598. wpabuf_put_buf(buf, query);
  2599. } else
  2600. wpabuf_put_le16(buf, 0);
  2601. res = gas_query_req(wpa_s->gas, dst, freq, buf, gas_resp_cb, wpa_s);
  2602. if (res < 0) {
  2603. wpa_msg(wpa_s, MSG_DEBUG, "GAS: Failed to send Query Request");
  2604. wpabuf_free(buf);
  2605. ret = -1;
  2606. } else
  2607. wpa_msg(wpa_s, MSG_DEBUG,
  2608. "GAS: Query started with dialog token %u", res);
  2609. return ret;
  2610. }