1 /* 2 * Interworking (IEEE 802.11u) 3 * Copyright (c) 2011-2013, Qualcomm Atheros, Inc. 4 * Copyright (c) 2011-2014, Jouni Malinen <j (at) w1.fi> 5 * 6 * This software may be distributed under the terms of the BSD license. 7 * See README for more details. 8 */ 9 10 #include "includes.h" 11 12 #include "common.h" 13 #include "common/ieee802_11_defs.h" 14 #include "common/gas.h" 15 #include "common/wpa_ctrl.h" 16 #include "utils/pcsc_funcs.h" 17 #include "utils/eloop.h" 18 #include "drivers/driver.h" 19 #include "eap_common/eap_defs.h" 20 #include "eap_peer/eap.h" 21 #include "eap_peer/eap_methods.h" 22 #include "eapol_supp/eapol_supp_sm.h" 23 #include "rsn_supp/wpa.h" 24 #include "wpa_supplicant_i.h" 25 #include "config.h" 26 #include "config_ssid.h" 27 #include "bss.h" 28 #include "scan.h" 29 #include "notify.h" 30 #include "driver_i.h" 31 #include "gas_query.h" 32 #include "hs20_supplicant.h" 33 #include "interworking.h" 34 35 36 #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC) 37 #define INTERWORKING_3GPP 38 #else 39 #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC) 40 #define INTERWORKING_3GPP 41 #else 42 #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC) 43 #define INTERWORKING_3GPP 44 #endif 45 #endif 46 #endif 47 48 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s); 49 static struct wpa_cred * interworking_credentials_available_realm( 50 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw, 51 int *excluded); 52 static struct wpa_cred * interworking_credentials_available_3gpp( 53 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw, 54 int *excluded); 55 56 57 static int cred_prio_cmp(const struct wpa_cred *a, const struct wpa_cred *b) 58 { 59 if (a->priority > b->priority) 60 return 1; 61 if (a->priority < b->priority) 62 return -1; 63 if (a->provisioning_sp == NULL || b->provisioning_sp == NULL || 64 os_strcmp(a->provisioning_sp, b->provisioning_sp) != 0) 65 return 0; 66 if (a->sp_priority < b->sp_priority) 67 return 1; 68 if (a->sp_priority > b->sp_priority) 69 return -1; 70 return 0; 71 } 72 73 74 static void interworking_reconnect(struct wpa_supplicant *wpa_s) 75 { 76 unsigned int tried; 77 78 if (wpa_s->wpa_state >= WPA_AUTHENTICATING) { 79 wpa_supplicant_cancel_sched_scan(wpa_s); 80 wpa_s->own_disconnect_req = 1; 81 wpa_supplicant_deauthenticate(wpa_s, 82 WLAN_REASON_DEAUTH_LEAVING); 83 } 84 wpa_s->disconnected = 0; 85 wpa_s->reassociate = 1; 86 tried = wpa_s->interworking_fast_assoc_tried; 87 wpa_s->interworking_fast_assoc_tried = 1; 88 89 if (!tried && wpa_supplicant_fast_associate(wpa_s) >= 0) 90 return; 91 92 wpa_s->interworking_fast_assoc_tried = 0; 93 wpa_supplicant_req_scan(wpa_s, 0, 0); 94 } 95 96 97 static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids, 98 struct wpabuf *extra) 99 { 100 struct wpabuf *buf; 101 size_t i; 102 u8 *len_pos; 103 104 buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 + 105 (extra ? wpabuf_len(extra) : 0)); 106 if (buf == NULL) 107 return NULL; 108 109 if (num_ids > 0) { 110 len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST); 111 for (i = 0; i < num_ids; i++) 112 wpabuf_put_le16(buf, info_ids[i]); 113 gas_anqp_set_element_len(buf, len_pos); 114 } 115 if (extra) 116 wpabuf_put_buf(buf, extra); 117 118 gas_anqp_set_len(buf); 119 120 return buf; 121 } 122 123 124 static void interworking_anqp_resp_cb(void *ctx, const u8 *dst, 125 u8 dialog_token, 126 enum gas_query_result result, 127 const struct wpabuf *adv_proto, 128 const struct wpabuf *resp, 129 u16 status_code) 130 { 131 struct wpa_supplicant *wpa_s = ctx; 132 133 wpa_printf(MSG_DEBUG, "ANQP: Response callback dst=" MACSTR 134 " dialog_token=%u result=%d status_code=%u", 135 MAC2STR(dst), dialog_token, result, status_code); 136 anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp, 137 status_code); 138 interworking_next_anqp_fetch(wpa_s); 139 } 140 141 142 static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s) 143 { 144 struct wpa_cred *cred; 145 146 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 147 if (cred->num_home_ois) 148 return 1; 149 if (cred->num_required_home_ois) 150 return 1; 151 if (cred->num_roaming_consortiums) 152 return 1; 153 } 154 return 0; 155 } 156 157 158 static int cred_with_3gpp(struct wpa_supplicant *wpa_s) 159 { 160 struct wpa_cred *cred; 161 162 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 163 if (cred->pcsc || cred->imsi) 164 return 1; 165 } 166 return 0; 167 } 168 169 170 static int cred_with_nai_realm(struct wpa_supplicant *wpa_s) 171 { 172 struct wpa_cred *cred; 173 174 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 175 if (cred->pcsc || cred->imsi) 176 continue; 177 if (!cred->eap_method) 178 return 1; 179 if (cred->realm) 180 return 1; 181 } 182 return 0; 183 } 184 185 186 static int cred_with_domain(struct wpa_supplicant *wpa_s) 187 { 188 struct wpa_cred *cred; 189 190 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 191 if (cred->domain || cred->pcsc || cred->imsi || 192 cred->roaming_partner) 193 return 1; 194 } 195 return 0; 196 } 197 198 199 #ifdef CONFIG_HS20 200 201 static int cred_with_min_backhaul(struct wpa_supplicant *wpa_s) 202 { 203 struct wpa_cred *cred; 204 205 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 206 if (cred->min_dl_bandwidth_home || 207 cred->min_ul_bandwidth_home || 208 cred->min_dl_bandwidth_roaming || 209 cred->min_ul_bandwidth_roaming) 210 return 1; 211 } 212 return 0; 213 } 214 215 216 static int cred_with_conn_capab(struct wpa_supplicant *wpa_s) 217 { 218 struct wpa_cred *cred; 219 220 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 221 if (cred->num_req_conn_capab) 222 return 1; 223 } 224 return 0; 225 } 226 227 #endif /* CONFIG_HS20 */ 228 229 230 static int additional_roaming_consortiums(struct wpa_bss *bss) 231 { 232 const u8 *ie; 233 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM); 234 if (ie == NULL || ie[1] == 0) 235 return 0; 236 return ie[2]; /* Number of ANQP OIs */ 237 } 238 239 240 static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx) 241 { 242 struct wpa_supplicant *wpa_s = eloop_ctx; 243 interworking_next_anqp_fetch(wpa_s); 244 } 245 246 247 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s, 248 struct wpa_bss *bss) 249 { 250 struct wpabuf *buf; 251 int ret = 0; 252 int res; 253 u16 info_ids[8]; 254 size_t num_info_ids = 0; 255 struct wpabuf *extra = NULL; 256 int all = wpa_s->fetch_all_anqp; 257 258 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR, 259 MAC2STR(bss->bssid)); 260 wpa_s->interworking_gas_bss = bss; 261 262 info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST; 263 if (all) { 264 info_ids[num_info_ids++] = ANQP_VENUE_NAME; 265 info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE; 266 } 267 if (all || (cred_with_roaming_consortium(wpa_s) && 268 additional_roaming_consortiums(bss))) 269 info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM; 270 if (all) 271 info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY; 272 if (all || cred_with_nai_realm(wpa_s)) 273 info_ids[num_info_ids++] = ANQP_NAI_REALM; 274 if (all || cred_with_3gpp(wpa_s)) { 275 info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK; 276 wpa_supplicant_scard_init(wpa_s, NULL); 277 } 278 if (all || cred_with_domain(wpa_s)) 279 info_ids[num_info_ids++] = ANQP_DOMAIN_NAME; 280 wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info", 281 (u8 *) info_ids, num_info_ids * 2); 282 283 #ifdef CONFIG_HS20 284 if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) { 285 u8 *len_pos; 286 287 extra = wpabuf_alloc(100); 288 if (!extra) 289 return -1; 290 291 len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC); 292 wpabuf_put_be24(extra, OUI_WFA); 293 wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE); 294 wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST); 295 wpabuf_put_u8(extra, 0); /* Reserved */ 296 wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST); 297 if (all) 298 wpabuf_put_u8(extra, 299 HS20_STYPE_OPERATOR_FRIENDLY_NAME); 300 if (all || cred_with_min_backhaul(wpa_s)) 301 wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS); 302 if (all || cred_with_conn_capab(wpa_s)) 303 wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY); 304 if (all) 305 wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS); 306 if (all) { 307 wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_LIST); 308 wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_NAI_LIST); 309 } 310 gas_anqp_set_element_len(extra, len_pos); 311 } 312 #endif /* CONFIG_HS20 */ 313 314 buf = anqp_build_req(info_ids, num_info_ids, extra); 315 wpabuf_free(extra); 316 if (buf == NULL) 317 return -1; 318 319 res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, 0, 0, buf, 320 interworking_anqp_resp_cb, wpa_s); 321 if (res < 0) { 322 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request"); 323 wpabuf_free(buf); 324 ret = -1; 325 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s, 326 NULL); 327 } else 328 wpa_msg(wpa_s, MSG_DEBUG, 329 "ANQP: Query started with dialog token %u", res); 330 331 return ret; 332 } 333 334 335 struct nai_realm_eap { 336 u8 method; 337 u8 inner_method; 338 enum nai_realm_eap_auth_inner_non_eap inner_non_eap; 339 u8 cred_type; 340 u8 tunneled_cred_type; 341 }; 342 343 struct nai_realm { 344 u8 encoding; 345 char *realm; 346 u8 eap_count; 347 struct nai_realm_eap *eap; 348 }; 349 350 351 static void nai_realm_free(struct nai_realm *realms, u16 count) 352 { 353 u16 i; 354 355 if (realms == NULL) 356 return; 357 for (i = 0; i < count; i++) { 358 os_free(realms[i].eap); 359 os_free(realms[i].realm); 360 } 361 os_free(realms); 362 } 363 364 365 static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos, 366 const u8 *end) 367 { 368 u8 elen, auth_count, a; 369 const u8 *e_end; 370 371 if (end - pos < 3) { 372 wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields"); 373 return NULL; 374 } 375 376 elen = *pos++; 377 if (elen > end - pos || elen < 2) { 378 wpa_printf(MSG_DEBUG, "No room for EAP Method subfield"); 379 return NULL; 380 } 381 e_end = pos + elen; 382 e->method = *pos++; 383 auth_count = *pos++; 384 wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u", 385 elen, e->method, auth_count); 386 387 for (a = 0; a < auth_count; a++) { 388 u8 id, len; 389 390 if (end - pos < 2) { 391 wpa_printf(MSG_DEBUG, 392 "No room for Authentication Parameter subfield header"); 393 return NULL; 394 } 395 396 id = *pos++; 397 len = *pos++; 398 if (len > end - pos) { 399 wpa_printf(MSG_DEBUG, 400 "No room for Authentication Parameter subfield"); 401 return NULL; 402 } 403 404 switch (id) { 405 case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH: 406 if (len < 1) 407 break; 408 e->inner_non_eap = *pos; 409 if (e->method != EAP_TYPE_TTLS) 410 break; 411 switch (*pos) { 412 case NAI_REALM_INNER_NON_EAP_PAP: 413 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP"); 414 break; 415 case NAI_REALM_INNER_NON_EAP_CHAP: 416 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP"); 417 break; 418 case NAI_REALM_INNER_NON_EAP_MSCHAP: 419 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP"); 420 break; 421 case NAI_REALM_INNER_NON_EAP_MSCHAPV2: 422 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2"); 423 break; 424 default: 425 wpa_printf(MSG_DEBUG, 426 "Unsupported EAP-TTLS inner method %u", 427 *pos); 428 break; 429 } 430 break; 431 case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD: 432 if (len < 1) 433 break; 434 e->inner_method = *pos; 435 wpa_printf(MSG_DEBUG, "Inner EAP method: %u", 436 e->inner_method); 437 break; 438 case NAI_REALM_EAP_AUTH_CRED_TYPE: 439 if (len < 1) 440 break; 441 e->cred_type = *pos; 442 wpa_printf(MSG_DEBUG, "Credential Type: %u", 443 e->cred_type); 444 break; 445 case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE: 446 if (len < 1) 447 break; 448 e->tunneled_cred_type = *pos; 449 wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential " 450 "Type: %u", e->tunneled_cred_type); 451 break; 452 default: 453 wpa_printf(MSG_DEBUG, "Unsupported Authentication " 454 "Parameter: id=%u len=%u", id, len); 455 wpa_hexdump(MSG_DEBUG, "Authentication Parameter " 456 "Value", pos, len); 457 break; 458 } 459 460 pos += len; 461 } 462 463 return e_end; 464 } 465 466 467 static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos, 468 const u8 *end) 469 { 470 u16 len; 471 const u8 *f_end; 472 u8 realm_len, e; 473 474 if (end - pos < 4) { 475 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data " 476 "fixed fields"); 477 return NULL; 478 } 479 480 len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */ 481 pos += 2; 482 if (len > end - pos || len < 3) { 483 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data " 484 "(len=%u; left=%u)", 485 len, (unsigned int) (end - pos)); 486 return NULL; 487 } 488 f_end = pos + len; 489 490 r->encoding = *pos++; 491 realm_len = *pos++; 492 if (realm_len > f_end - pos) { 493 wpa_printf(MSG_DEBUG, "No room for NAI Realm " 494 "(len=%u; left=%u)", 495 realm_len, (unsigned int) (f_end - pos)); 496 return NULL; 497 } 498 wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len); 499 r->realm = dup_binstr(pos, realm_len); 500 if (r->realm == NULL) 501 return NULL; 502 pos += realm_len; 503 504 if (f_end - pos < 1) { 505 wpa_printf(MSG_DEBUG, "No room for EAP Method Count"); 506 return NULL; 507 } 508 r->eap_count = *pos++; 509 wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count); 510 if (r->eap_count * 3 > f_end - pos) { 511 wpa_printf(MSG_DEBUG, "No room for EAP Methods"); 512 return NULL; 513 } 514 r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap)); 515 if (r->eap == NULL) 516 return NULL; 517 518 for (e = 0; e < r->eap_count; e++) { 519 pos = nai_realm_parse_eap(&r->eap[e], pos, f_end); 520 if (pos == NULL) 521 return NULL; 522 } 523 524 return f_end; 525 } 526 527 528 static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count) 529 { 530 struct nai_realm *realm; 531 const u8 *pos, *end; 532 u16 i, num; 533 size_t left; 534 535 if (anqp == NULL) 536 return NULL; 537 left = wpabuf_len(anqp); 538 if (left < 2) 539 return NULL; 540 541 pos = wpabuf_head_u8(anqp); 542 end = pos + left; 543 num = WPA_GET_LE16(pos); 544 wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num); 545 pos += 2; 546 left -= 2; 547 548 if (num > left / 5) { 549 wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not " 550 "enough data (%u octets) for that many realms", 551 num, (unsigned int) left); 552 return NULL; 553 } 554 555 realm = os_calloc(num, sizeof(struct nai_realm)); 556 if (realm == NULL) 557 return NULL; 558 559 for (i = 0; i < num; i++) { 560 pos = nai_realm_parse_realm(&realm[i], pos, end); 561 if (pos == NULL) { 562 nai_realm_free(realm, num); 563 return NULL; 564 } 565 } 566 567 *count = num; 568 return realm; 569 } 570 571 572 static int nai_realm_match(struct nai_realm *realm, const char *home_realm) 573 { 574 char *tmp, *pos, *end; 575 int match = 0; 576 577 if (realm->realm == NULL || home_realm == NULL) 578 return 0; 579 580 if (os_strchr(realm->realm, ';') == NULL) 581 return os_strcasecmp(realm->realm, home_realm) == 0; 582 583 tmp = os_strdup(realm->realm); 584 if (tmp == NULL) 585 return 0; 586 587 pos = tmp; 588 while (*pos) { 589 end = os_strchr(pos, ';'); 590 if (end) 591 *end = '\0'; 592 if (os_strcasecmp(pos, home_realm) == 0) { 593 match = 1; 594 break; 595 } 596 if (end == NULL) 597 break; 598 pos = end + 1; 599 } 600 601 os_free(tmp); 602 603 return match; 604 } 605 606 607 static int nai_realm_cred_username(struct wpa_supplicant *wpa_s, 608 struct nai_realm_eap *eap) 609 { 610 if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) { 611 wpa_msg(wpa_s, MSG_DEBUG, 612 "nai-realm-cred-username: EAP method not supported: %d", 613 eap->method); 614 return 0; /* method not supported */ 615 } 616 617 if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP && 618 eap->method != EAP_TYPE_FAST) { 619 /* Only tunneled methods with username/password supported */ 620 wpa_msg(wpa_s, MSG_DEBUG, 621 "nai-realm-cred-username: Method: %d is not TTLS, PEAP, or FAST", 622 eap->method); 623 return 0; 624 } 625 626 if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) { 627 if (eap->inner_method && 628 eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) { 629 wpa_msg(wpa_s, MSG_DEBUG, 630 "nai-realm-cred-username: PEAP/FAST: Inner method not supported: %d", 631 eap->inner_method); 632 return 0; 633 } 634 if (!eap->inner_method && 635 eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) { 636 wpa_msg(wpa_s, MSG_DEBUG, 637 "nai-realm-cred-username: MSCHAPv2 not supported"); 638 return 0; 639 } 640 } 641 642 if (eap->method == EAP_TYPE_TTLS) { 643 if (eap->inner_method == 0 && eap->inner_non_eap == 0) 644 return 1; /* Assume TTLS/MSCHAPv2 is used */ 645 if (eap->inner_method && 646 eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) { 647 wpa_msg(wpa_s, MSG_DEBUG, 648 "nai-realm-cred-username: TTLS, but inner not supported: %d", 649 eap->inner_method); 650 return 0; 651 } 652 if (eap->inner_non_eap && 653 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP && 654 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP && 655 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP && 656 eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) { 657 wpa_msg(wpa_s, MSG_DEBUG, 658 "nai-realm-cred-username: TTLS, inner-non-eap not supported: %d", 659 eap->inner_non_eap); 660 return 0; 661 } 662 } 663 664 if (eap->inner_method && 665 eap->inner_method != EAP_TYPE_GTC && 666 eap->inner_method != EAP_TYPE_MSCHAPV2) { 667 wpa_msg(wpa_s, MSG_DEBUG, 668 "nai-realm-cred-username: inner-method not GTC or MSCHAPv2: %d", 669 eap->inner_method); 670 return 0; 671 } 672 673 return 1; 674 } 675 676 677 static int nai_realm_cred_cert(struct wpa_supplicant *wpa_s, 678 struct nai_realm_eap *eap) 679 { 680 if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) { 681 wpa_msg(wpa_s, MSG_DEBUG, 682 "nai-realm-cred-cert: Method not supported: %d", 683 eap->method); 684 return 0; /* method not supported */ 685 } 686 687 if (eap->method != EAP_TYPE_TLS) { 688 /* Only EAP-TLS supported for credential authentication */ 689 wpa_msg(wpa_s, MSG_DEBUG, 690 "nai-realm-cred-cert: Method not TLS: %d", 691 eap->method); 692 return 0; 693 } 694 695 return 1; 696 } 697 698 699 static struct nai_realm_eap * nai_realm_find_eap(struct wpa_supplicant *wpa_s, 700 struct wpa_cred *cred, 701 struct nai_realm *realm) 702 { 703 u8 e; 704 705 if (cred->username == NULL || 706 cred->username[0] == '\0' || 707 ((cred->password == NULL || 708 cred->password[0] == '\0') && 709 (cred->private_key == NULL || 710 cred->private_key[0] == '\0') && 711 (!cred->key_id || cred->key_id[0] == '\0'))) { 712 wpa_msg(wpa_s, MSG_DEBUG, 713 "nai-realm-find-eap: incomplete cred info: username: %s password: %s private_key: %s key_id: %s", 714 cred->username ? cred->username : "NULL", 715 cred->password ? cred->password : "NULL", 716 cred->private_key ? cred->private_key : "NULL", 717 cred->key_id ? cred->key_id : "NULL"); 718 return NULL; 719 } 720 721 for (e = 0; e < realm->eap_count; e++) { 722 struct nai_realm_eap *eap = &realm->eap[e]; 723 if (cred->password && cred->password[0] && 724 nai_realm_cred_username(wpa_s, eap)) 725 return eap; 726 if (((cred->private_key && cred->private_key[0]) || 727 (cred->key_id && cred->key_id[0])) && 728 nai_realm_cred_cert(wpa_s, eap)) 729 return eap; 730 } 731 732 return NULL; 733 } 734 735 736 #ifdef INTERWORKING_3GPP 737 738 static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len) 739 { 740 u8 plmn[3], plmn2[3]; 741 const u8 *pos, *end; 742 u8 udhl; 743 744 /* 745 * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network 746 * operator is allowed to include only two digits of the MNC, so allow 747 * matches based on both two and three digit MNC assumptions. Since some 748 * SIM/USIM cards may not expose MNC length conveniently, we may be 749 * provided the default MNC length 3 here and as such, checking with MNC 750 * length 2 is justifiable even though 3GPP TS 24.234 does not mention 751 * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used 752 * with otherwise matching values would not be good idea in general, so 753 * this should not result in selecting incorrect networks. 754 */ 755 /* Match with 3 digit MNC */ 756 plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4); 757 plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4); 758 plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4); 759 /* Match with 2 digit MNC */ 760 plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4); 761 plmn2[1] = (imsi[2] - '0') | 0xf0; 762 plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4); 763 764 if (anqp == NULL) 765 return 0; 766 pos = wpabuf_head_u8(anqp); 767 end = pos + wpabuf_len(anqp); 768 if (end - pos < 2) 769 return 0; 770 if (*pos != 0) { 771 wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos); 772 return 0; 773 } 774 pos++; 775 udhl = *pos++; 776 if (udhl > end - pos) { 777 wpa_printf(MSG_DEBUG, "Invalid UDHL"); 778 return 0; 779 } 780 end = pos + udhl; 781 782 wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)", 783 plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2], 784 imsi, mnc_len); 785 786 while (end - pos >= 2) { 787 u8 iei, len; 788 const u8 *l_end; 789 iei = *pos++; 790 len = *pos++ & 0x7f; 791 if (len > end - pos) 792 break; 793 l_end = pos + len; 794 795 if (iei == 0 && len > 0) { 796 /* PLMN List */ 797 u8 num, i; 798 wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element", 799 pos, len); 800 num = *pos++; 801 for (i = 0; i < num; i++) { 802 if (l_end - pos < 3) 803 break; 804 if (os_memcmp(pos, plmn, 3) == 0 || 805 os_memcmp(pos, plmn2, 3) == 0) 806 return 1; /* Found matching PLMN */ 807 pos += 3; 808 } 809 } else { 810 wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element", 811 pos, len); 812 } 813 814 pos = l_end; 815 } 816 817 return 0; 818 } 819 820 821 static int build_root_nai(char *nai, size_t nai_len, const char *imsi, 822 size_t mnc_len, char prefix) 823 { 824 const char *sep, *msin; 825 char *end, *pos; 826 size_t msin_len, plmn_len; 827 828 /* 829 * TS 23.003, Clause 14 (3GPP to WLAN Interworking) 830 * Root NAI: 831 * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org 832 * <MNC> is zero-padded to three digits in case two-digit MNC is used 833 */ 834 835 if (imsi == NULL || os_strlen(imsi) > 16) { 836 wpa_printf(MSG_DEBUG, "No valid IMSI available"); 837 return -1; 838 } 839 sep = os_strchr(imsi, '-'); 840 if (sep) { 841 plmn_len = sep - imsi; 842 msin = sep + 1; 843 } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) { 844 plmn_len = 3 + mnc_len; 845 msin = imsi + plmn_len; 846 } else 847 return -1; 848 if (plmn_len != 5 && plmn_len != 6) 849 return -1; 850 msin_len = os_strlen(msin); 851 852 pos = nai; 853 end = nai + nai_len; 854 if (prefix) 855 *pos++ = prefix; 856 os_memcpy(pos, imsi, plmn_len); 857 pos += plmn_len; 858 os_memcpy(pos, msin, msin_len); 859 pos += msin_len; 860 pos += os_snprintf(pos, end - pos, "@wlan.mnc"); 861 if (plmn_len == 5) { 862 *pos++ = '0'; 863 *pos++ = imsi[3]; 864 *pos++ = imsi[4]; 865 } else { 866 *pos++ = imsi[3]; 867 *pos++ = imsi[4]; 868 *pos++ = imsi[5]; 869 } 870 os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org", 871 imsi[0], imsi[1], imsi[2]); 872 873 return 0; 874 } 875 876 877 static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix) 878 { 879 char nai[100]; 880 if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0) 881 return -1; 882 return wpa_config_set_quoted(ssid, "identity", nai); 883 } 884 885 #endif /* INTERWORKING_3GPP */ 886 887 888 static int already_connected(struct wpa_supplicant *wpa_s, 889 struct wpa_cred *cred, struct wpa_bss *bss) 890 { 891 struct wpa_ssid *ssid, *sel_ssid; 892 struct wpa_bss *selected; 893 894 if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL) 895 return 0; 896 897 ssid = wpa_s->current_ssid; 898 if (ssid->parent_cred != cred) 899 return 0; 900 901 if (ssid->ssid_len != bss->ssid_len || 902 os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0) 903 return 0; 904 905 sel_ssid = NULL; 906 selected = wpa_supplicant_pick_network(wpa_s, &sel_ssid); 907 if (selected && sel_ssid && sel_ssid->priority > ssid->priority) 908 return 0; /* higher priority network in scan results */ 909 910 return 1; 911 } 912 913 914 static void remove_duplicate_network(struct wpa_supplicant *wpa_s, 915 struct wpa_cred *cred, 916 struct wpa_bss *bss) 917 { 918 struct wpa_ssid *ssid; 919 920 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) { 921 if (ssid->parent_cred != cred) 922 continue; 923 if (ssid->ssid_len != bss->ssid_len || 924 os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0) 925 continue; 926 927 break; 928 } 929 930 if (ssid == NULL) 931 return; 932 933 wpa_printf(MSG_DEBUG, "Interworking: Remove duplicate network entry for the same credential"); 934 935 if (ssid == wpa_s->current_ssid) { 936 wpa_sm_set_config(wpa_s->wpa, NULL); 937 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL); 938 wpa_s->own_disconnect_req = 1; 939 wpa_supplicant_deauthenticate(wpa_s, 940 WLAN_REASON_DEAUTH_LEAVING); 941 } 942 943 wpas_notify_network_removed(wpa_s, ssid); 944 wpa_config_remove_network(wpa_s->conf, ssid->id); 945 } 946 947 948 static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s, 949 struct wpa_ssid *ssid) 950 { 951 const char *key_mgmt = NULL; 952 #ifdef CONFIG_IEEE80211R 953 int res; 954 struct wpa_driver_capa capa; 955 956 res = wpa_drv_get_capa(wpa_s, &capa); 957 if (res == 0 && capa.key_mgmt_iftype[WPA_IF_STATION] & 958 WPA_DRIVER_CAPA_KEY_MGMT_FT) { 959 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ? 960 "WPA-EAP WPA-EAP-SHA256 FT-EAP" : 961 "WPA-EAP FT-EAP"; 962 } 963 #endif /* CONFIG_IEEE80211R */ 964 965 if (!key_mgmt) 966 key_mgmt = wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ? 967 "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP"; 968 if (wpa_config_set(ssid, "key_mgmt", key_mgmt, 0) < 0 || 969 wpa_config_set(ssid, "proto", "RSN", 0) < 0 || 970 wpa_config_set(ssid, "ieee80211w", 971 wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_REQUIRED ? 972 "2" : "1", 0) < 0 || 973 wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0) 974 return -1; 975 return 0; 976 } 977 978 979 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s, 980 struct wpa_cred *cred, 981 struct wpa_bss *bss, int only_add) 982 { 983 #ifdef INTERWORKING_3GPP 984 struct wpa_ssid *ssid; 985 int eap_type; 986 int res; 987 char prefix; 988 989 if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL) 990 return -1; 991 992 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR 993 " (3GPP)", MAC2STR(bss->bssid)); 994 995 if (already_connected(wpa_s, cred, bss)) { 996 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR, 997 MAC2STR(bss->bssid)); 998 return wpa_s->current_ssid->id; 999 } 1000 1001 remove_duplicate_network(wpa_s, cred, bss); 1002 1003 ssid = wpa_config_add_network(wpa_s->conf); 1004 if (ssid == NULL) 1005 return -1; 1006 ssid->parent_cred = cred; 1007 1008 wpas_notify_network_added(wpa_s, ssid); 1009 wpa_config_set_network_defaults(ssid); 1010 ssid->priority = cred->priority; 1011 ssid->temporary = 1; 1012 ssid->ssid = os_zalloc(bss->ssid_len + 1); 1013 if (ssid->ssid == NULL) 1014 goto fail; 1015 os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len); 1016 ssid->ssid_len = bss->ssid_len; 1017 ssid->eap.sim_num = cred->sim_num; 1018 1019 if (interworking_set_hs20_params(wpa_s, ssid) < 0) 1020 goto fail; 1021 1022 eap_type = EAP_TYPE_SIM; 1023 if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard)) 1024 eap_type = EAP_TYPE_AKA; 1025 if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) { 1026 if (cred->eap_method[0].method == EAP_TYPE_SIM || 1027 cred->eap_method[0].method == EAP_TYPE_AKA || 1028 cred->eap_method[0].method == EAP_TYPE_AKA_PRIME) 1029 eap_type = cred->eap_method[0].method; 1030 } 1031 1032 switch (eap_type) { 1033 case EAP_TYPE_SIM: 1034 prefix = '1'; 1035 res = wpa_config_set(ssid, "eap", "SIM", 0); 1036 break; 1037 case EAP_TYPE_AKA: 1038 prefix = '0'; 1039 res = wpa_config_set(ssid, "eap", "AKA", 0); 1040 break; 1041 case EAP_TYPE_AKA_PRIME: 1042 prefix = '6'; 1043 res = wpa_config_set(ssid, "eap", "AKA'", 0); 1044 break; 1045 default: 1046 res = -1; 1047 break; 1048 } 1049 if (res < 0) { 1050 wpa_msg(wpa_s, MSG_DEBUG, 1051 "Selected EAP method (%d) not supported", eap_type); 1052 goto fail; 1053 } 1054 1055 if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) { 1056 wpa_msg(wpa_s, MSG_DEBUG, "Failed to set Root NAI"); 1057 goto fail; 1058 } 1059 1060 if (cred->milenage && cred->milenage[0]) { 1061 if (wpa_config_set_quoted(ssid, "password", 1062 cred->milenage) < 0) 1063 goto fail; 1064 } else if (cred->pcsc) { 1065 if (wpa_config_set_quoted(ssid, "pcsc", "") < 0) 1066 goto fail; 1067 if (wpa_s->conf->pcsc_pin && 1068 wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin) 1069 < 0) 1070 goto fail; 1071 } 1072 1073 if (cred->imsi_privacy_cert && cred->imsi_privacy_cert[0]) { 1074 if (wpa_config_set_quoted(ssid, "imsi_privacy_cert", 1075 cred->imsi_privacy_cert) < 0) 1076 goto fail; 1077 } 1078 1079 if (cred->imsi_privacy_attr && cred->imsi_privacy_attr[0]) { 1080 if (wpa_config_set_quoted(ssid, "imsi_privacy_attr", 1081 cred->imsi_privacy_attr) < 0) 1082 goto fail; 1083 } 1084 1085 wpa_s->next_ssid = ssid; 1086 wpa_config_update_prio_list(wpa_s->conf); 1087 if (!only_add) 1088 interworking_reconnect(wpa_s); 1089 1090 return ssid->id; 1091 1092 fail: 1093 wpas_notify_network_removed(wpa_s, ssid); 1094 wpa_config_remove_network(wpa_s->conf, ssid->id); 1095 #endif /* INTERWORKING_3GPP */ 1096 return -1; 1097 } 1098 1099 1100 static int oi_element_match(const u8 *ie, const u8 *oi, size_t oi_len) 1101 { 1102 const u8 *pos, *end; 1103 u8 lens; 1104 1105 if (ie == NULL) 1106 return 0; 1107 1108 pos = ie + 2; 1109 end = ie + 2 + ie[1]; 1110 1111 /* Roaming Consortium element: 1112 * Number of ANQP OIs 1113 * OI #1 and #2 lengths 1114 * OI #1, [OI #2], [OI #3] 1115 */ 1116 1117 if (end - pos < 2) 1118 return 0; 1119 1120 pos++; /* skip Number of ANQP OIs */ 1121 lens = *pos++; 1122 if ((lens & 0x0f) + (lens >> 4) > end - pos) 1123 return 0; 1124 1125 if ((lens & 0x0f) == oi_len && os_memcmp(pos, oi, oi_len) == 0) 1126 return 1; 1127 pos += lens & 0x0f; 1128 1129 if ((lens >> 4) == oi_len && os_memcmp(pos, oi, oi_len) == 0) 1130 return 1; 1131 pos += lens >> 4; 1132 1133 if (pos < end && (size_t) (end - pos) == oi_len && 1134 os_memcmp(pos, oi, oi_len) == 0) 1135 return 1; 1136 1137 return 0; 1138 } 1139 1140 1141 static int oi_anqp_match(const struct wpabuf *anqp, const u8 *oi, 1142 size_t oi_len) 1143 { 1144 const u8 *pos, *end; 1145 u8 len; 1146 1147 if (anqp == NULL) 1148 return 0; 1149 1150 pos = wpabuf_head(anqp); 1151 end = pos + wpabuf_len(anqp); 1152 1153 /* Set of <OI Length, OI> duples */ 1154 while (pos < end) { 1155 len = *pos++; 1156 if (len > end - pos) 1157 break; 1158 if (len == oi_len && os_memcmp(pos, oi, oi_len) == 0) 1159 return 1; 1160 pos += len; 1161 } 1162 1163 return 0; 1164 } 1165 1166 1167 static int oi_match(const u8 *ie, const struct wpabuf *anqp, 1168 const u8 *oi, size_t oi_len) 1169 { 1170 return oi_element_match(ie, oi, oi_len) || 1171 oi_anqp_match(anqp, oi, oi_len); 1172 } 1173 1174 1175 static int cred_home_ois_match(const u8 *ie, const struct wpabuf *anqp, 1176 const struct wpa_cred *cred) { 1177 unsigned int i; 1178 1179 /* There's a match if at least one of the home OI matches. */ 1180 for (i = 0; i < cred->num_home_ois; i++) { 1181 if (oi_match(ie, anqp, cred->home_ois[i], 1182 cred->home_ois_len[i])) 1183 return 1; 1184 } 1185 1186 return 0; 1187 } 1188 1189 1190 static int cred_roaming_consortiums_match(const u8 *ie, 1191 const struct wpabuf *anqp, 1192 const struct wpa_cred *cred) 1193 { 1194 unsigned int i; 1195 1196 for (i = 0; i < cred->num_roaming_consortiums; i++) { 1197 if (oi_match(ie, anqp, cred->roaming_consortiums[i], 1198 cred->roaming_consortiums_len[i])) 1199 return 1; 1200 } 1201 1202 return 0; 1203 } 1204 1205 1206 static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss) 1207 { 1208 const u8 *ie; 1209 unsigned int i; 1210 1211 if (cred->num_required_home_ois == 0) 1212 return 0; 1213 1214 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM); 1215 1216 if (ie == NULL && 1217 (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL)) 1218 return 1; 1219 1220 /* According to Passpoint specification, there must be a match for 1221 * each required home OI provided. */ 1222 for (i = 0; i < cred->num_required_home_ois; i++) { 1223 if (!oi_match(ie, bss->anqp ? 1224 bss->anqp->roaming_consortium : NULL, 1225 cred->required_home_ois[i], 1226 cred->required_home_ois_len[i])) 1227 return 1; 1228 } 1229 return 0; 1230 } 1231 1232 1233 static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss) 1234 { 1235 size_t i; 1236 1237 if (!cred->excluded_ssid) 1238 return 0; 1239 1240 for (i = 0; i < cred->num_excluded_ssid; i++) { 1241 struct excluded_ssid *e = &cred->excluded_ssid[i]; 1242 if (bss->ssid_len == e->ssid_len && 1243 os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0) 1244 return 1; 1245 } 1246 1247 return 0; 1248 } 1249 1250 1251 static int cred_below_min_backhaul(struct wpa_supplicant *wpa_s, 1252 struct wpa_cred *cred, struct wpa_bss *bss) 1253 { 1254 #ifdef CONFIG_HS20 1255 int res; 1256 unsigned int dl_bandwidth, ul_bandwidth; 1257 const u8 *wan; 1258 u8 wan_info, dl_load, ul_load; 1259 u16 lmd; 1260 u32 ul_speed, dl_speed; 1261 1262 if (!cred->min_dl_bandwidth_home && 1263 !cred->min_ul_bandwidth_home && 1264 !cred->min_dl_bandwidth_roaming && 1265 !cred->min_ul_bandwidth_roaming) 1266 return 0; /* No bandwidth constraint specified */ 1267 1268 if (bss->anqp == NULL || bss->anqp->hs20_wan_metrics == NULL) 1269 return 0; /* No WAN Metrics known - ignore constraint */ 1270 1271 wan = wpabuf_head(bss->anqp->hs20_wan_metrics); 1272 wan_info = wan[0]; 1273 if (wan_info & BIT(3)) 1274 return 1; /* WAN link at capacity */ 1275 lmd = WPA_GET_LE16(wan + 11); 1276 if (lmd == 0) 1277 return 0; /* Downlink/Uplink Load was not measured */ 1278 dl_speed = WPA_GET_LE32(wan + 1); 1279 ul_speed = WPA_GET_LE32(wan + 5); 1280 dl_load = wan[9]; 1281 ul_load = wan[10]; 1282 1283 if (dl_speed >= 0xffffff) 1284 dl_bandwidth = dl_speed / 255 * (255 - dl_load); 1285 else 1286 dl_bandwidth = dl_speed * (255 - dl_load) / 255; 1287 1288 if (ul_speed >= 0xffffff) 1289 ul_bandwidth = ul_speed / 255 * (255 - ul_load); 1290 else 1291 ul_bandwidth = ul_speed * (255 - ul_load) / 255; 1292 1293 res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ? 1294 bss->anqp->domain_name : NULL); 1295 if (res > 0) { 1296 if (cred->min_dl_bandwidth_home > dl_bandwidth) 1297 return 1; 1298 if (cred->min_ul_bandwidth_home > ul_bandwidth) 1299 return 1; 1300 } else { 1301 if (cred->min_dl_bandwidth_roaming > dl_bandwidth) 1302 return 1; 1303 if (cred->min_ul_bandwidth_roaming > ul_bandwidth) 1304 return 1; 1305 } 1306 #endif /* CONFIG_HS20 */ 1307 1308 return 0; 1309 } 1310 1311 1312 static int cred_over_max_bss_load(struct wpa_supplicant *wpa_s, 1313 struct wpa_cred *cred, struct wpa_bss *bss) 1314 { 1315 const u8 *ie; 1316 int res; 1317 1318 if (!cred->max_bss_load) 1319 return 0; /* No BSS Load constraint specified */ 1320 1321 ie = wpa_bss_get_ie(bss, WLAN_EID_BSS_LOAD); 1322 if (ie == NULL || ie[1] < 3) 1323 return 0; /* No BSS Load advertised */ 1324 1325 res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ? 1326 bss->anqp->domain_name : NULL); 1327 if (res <= 0) 1328 return 0; /* Not a home network */ 1329 1330 return ie[4] > cred->max_bss_load; 1331 } 1332 1333 1334 #ifdef CONFIG_HS20 1335 1336 static int has_proto_match(const u8 *pos, const u8 *end, u8 proto) 1337 { 1338 while (end - pos >= 4) { 1339 if (pos[0] == proto && pos[3] == 1 /* Open */) 1340 return 1; 1341 pos += 4; 1342 } 1343 1344 return 0; 1345 } 1346 1347 1348 static int has_proto_port_match(const u8 *pos, const u8 *end, u8 proto, 1349 u16 port) 1350 { 1351 while (end - pos >= 4) { 1352 if (pos[0] == proto && WPA_GET_LE16(&pos[1]) == port && 1353 pos[3] == 1 /* Open */) 1354 return 1; 1355 pos += 4; 1356 } 1357 1358 return 0; 1359 } 1360 1361 #endif /* CONFIG_HS20 */ 1362 1363 1364 static int cred_conn_capab_missing(struct wpa_supplicant *wpa_s, 1365 struct wpa_cred *cred, struct wpa_bss *bss) 1366 { 1367 #ifdef CONFIG_HS20 1368 int res; 1369 const u8 *capab, *end; 1370 unsigned int i, j; 1371 int *ports; 1372 1373 if (!cred->num_req_conn_capab) 1374 return 0; /* No connection capability constraint specified */ 1375 1376 if (bss->anqp == NULL || bss->anqp->hs20_connection_capability == NULL) 1377 return 0; /* No Connection Capability known - ignore constraint 1378 */ 1379 1380 res = interworking_home_sp_cred(wpa_s, cred, bss->anqp ? 1381 bss->anqp->domain_name : NULL); 1382 if (res > 0) 1383 return 0; /* No constraint in home network */ 1384 1385 capab = wpabuf_head(bss->anqp->hs20_connection_capability); 1386 end = capab + wpabuf_len(bss->anqp->hs20_connection_capability); 1387 1388 for (i = 0; i < cred->num_req_conn_capab; i++) { 1389 ports = cred->req_conn_capab_port[i]; 1390 if (!ports) { 1391 if (!has_proto_match(capab, end, 1392 cred->req_conn_capab_proto[i])) 1393 return 1; 1394 } else { 1395 for (j = 0; ports[j] > -1; j++) { 1396 if (!has_proto_port_match( 1397 capab, end, 1398 cred->req_conn_capab_proto[i], 1399 ports[j])) 1400 return 1; 1401 } 1402 } 1403 } 1404 #endif /* CONFIG_HS20 */ 1405 1406 return 0; 1407 } 1408 1409 1410 static struct wpa_cred * interworking_credentials_available_roaming_consortium( 1411 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw, 1412 int *excluded) 1413 { 1414 struct wpa_cred *cred, *selected = NULL; 1415 const u8 *ie; 1416 const struct wpabuf *anqp; 1417 int is_excluded = 0; 1418 1419 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM); 1420 anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL; 1421 1422 if (!ie && !anqp) 1423 return NULL; 1424 1425 if (wpa_s->conf->cred == NULL) 1426 return NULL; 1427 1428 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 1429 if (cred->num_home_ois == 0 && 1430 cred->num_required_home_ois == 0 && 1431 cred->num_roaming_consortiums == 0) 1432 continue; 1433 1434 if (!cred->eap_method) 1435 continue; 1436 1437 /* If there's required home OIs, there must be a match for each 1438 * required OI (see Passpoint v3.2 - 9.1.2 - RequiredHomeOI). */ 1439 if (cred->num_required_home_ois > 0 && 1440 cred_no_required_oi_match(cred, bss)) 1441 continue; 1442 1443 if (!cred_home_ois_match(ie, anqp, cred) && 1444 !cred_roaming_consortiums_match(ie, anqp, cred)) 1445 continue; 1446 1447 if (!ignore_bw && cred_below_min_backhaul(wpa_s, cred, bss)) 1448 continue; 1449 if (!ignore_bw && cred_over_max_bss_load(wpa_s, cred, bss)) 1450 continue; 1451 if (!ignore_bw && cred_conn_capab_missing(wpa_s, cred, bss)) 1452 continue; 1453 if (cred_excluded_ssid(cred, bss)) { 1454 if (excluded == NULL) 1455 continue; 1456 if (selected == NULL) { 1457 selected = cred; 1458 is_excluded = 1; 1459 } 1460 } else { 1461 if (selected == NULL || is_excluded || 1462 cred_prio_cmp(selected, cred) < 0) { 1463 selected = cred; 1464 is_excluded = 0; 1465 } 1466 } 1467 } 1468 1469 if (excluded) 1470 *excluded = is_excluded; 1471 1472 return selected; 1473 } 1474 1475 1476 static int interworking_set_eap_params(struct wpa_ssid *ssid, 1477 struct wpa_cred *cred, int ttls) 1478 { 1479 if (cred->eap_method) { 1480 ttls = cred->eap_method->vendor == EAP_VENDOR_IETF && 1481 cred->eap_method->method == EAP_TYPE_TTLS; 1482 1483 os_free(ssid->eap.eap_methods); 1484 ssid->eap.eap_methods = 1485 os_malloc(sizeof(struct eap_method_type) * 2); 1486 if (ssid->eap.eap_methods == NULL) 1487 return -1; 1488 os_memcpy(ssid->eap.eap_methods, cred->eap_method, 1489 sizeof(*cred->eap_method)); 1490 ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF; 1491 ssid->eap.eap_methods[1].method = EAP_TYPE_NONE; 1492 } 1493 1494 if (ttls && cred->username && cred->username[0]) { 1495 const char *pos; 1496 char *anon; 1497 /* Use anonymous NAI in Phase 1 */ 1498 pos = os_strchr(cred->username, '@'); 1499 if (pos) { 1500 size_t buflen = 9 + os_strlen(pos) + 1; 1501 anon = os_malloc(buflen); 1502 if (anon == NULL) 1503 return -1; 1504 os_snprintf(anon, buflen, "anonymous%s", pos); 1505 } else if (cred->realm) { 1506 size_t buflen = 10 + os_strlen(cred->realm) + 1; 1507 anon = os_malloc(buflen); 1508 if (anon == NULL) 1509 return -1; 1510 os_snprintf(anon, buflen, "anonymous@%s", cred->realm); 1511 } else { 1512 anon = os_strdup("anonymous"); 1513 if (anon == NULL) 1514 return -1; 1515 } 1516 if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) < 1517 0) { 1518 os_free(anon); 1519 return -1; 1520 } 1521 os_free(anon); 1522 } 1523 1524 if (!ttls && cred->username && cred->username[0] && cred->realm && 1525 !os_strchr(cred->username, '@')) { 1526 char *id; 1527 size_t buflen; 1528 int res; 1529 1530 buflen = os_strlen(cred->username) + 1 + 1531 os_strlen(cred->realm) + 1; 1532 1533 id = os_malloc(buflen); 1534 if (!id) 1535 return -1; 1536 os_snprintf(id, buflen, "%s@%s", cred->username, cred->realm); 1537 res = wpa_config_set_quoted(ssid, "identity", id); 1538 os_free(id); 1539 if (res < 0) 1540 return -1; 1541 } else if (cred->username && cred->username[0] && 1542 wpa_config_set_quoted(ssid, "identity", cred->username) < 0) 1543 return -1; 1544 1545 if (cred->password && cred->password[0]) { 1546 if (cred->ext_password && 1547 wpa_config_set(ssid, "password", cred->password, 0) < 0) 1548 return -1; 1549 if (!cred->ext_password && 1550 wpa_config_set_quoted(ssid, "password", cred->password) < 1551 0) 1552 return -1; 1553 } 1554 1555 if (cred->client_cert && cred->client_cert[0] && 1556 wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0) 1557 return -1; 1558 1559 #ifdef ANDROID 1560 if (cred->private_key && 1561 os_strncmp(cred->private_key, "keystore://", 11) == 0) { 1562 /* Use OpenSSL engine configuration for Android keystore */ 1563 if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 || 1564 wpa_config_set_quoted(ssid, "key_id", 1565 cred->private_key + 11) < 0 || 1566 wpa_config_set(ssid, "engine", "1", 0) < 0) 1567 return -1; 1568 } else 1569 #endif /* ANDROID */ 1570 if (cred->private_key && cred->private_key[0] && 1571 wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0) 1572 return -1; 1573 1574 if (cred->private_key_passwd && cred->private_key_passwd[0] && 1575 wpa_config_set_quoted(ssid, "private_key_passwd", 1576 cred->private_key_passwd) < 0) 1577 return -1; 1578 1579 if (cred->ca_cert_id && cred->ca_cert_id[0] && 1580 wpa_config_set_quoted(ssid, "ca_cert_id", cred->ca_cert_id) < 0) 1581 return -1; 1582 1583 if (cred->cert_id && cred->cert_id[0] && 1584 wpa_config_set_quoted(ssid, "cert_id", cred->cert_id) < 0) 1585 return -1; 1586 1587 if (cred->key_id && cred->key_id[0] && 1588 wpa_config_set_quoted(ssid, "key_id", cred->key_id) < 0) 1589 return -1; 1590 1591 if (cred->engine_id && cred->engine_id[0] && 1592 wpa_config_set_quoted(ssid, "engine_id", cred->engine_id) < 0) 1593 return -1; 1594 1595 ssid->eap.cert.engine = cred->engine; 1596 1597 if (cred->phase1) { 1598 os_free(ssid->eap.phase1); 1599 ssid->eap.phase1 = os_strdup(cred->phase1); 1600 } 1601 if (cred->phase2) { 1602 os_free(ssid->eap.phase2); 1603 ssid->eap.phase2 = os_strdup(cred->phase2); 1604 } 1605 1606 if (cred->ca_cert && cred->ca_cert[0] && 1607 wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0) 1608 return -1; 1609 1610 if (cred->domain_suffix_match && cred->domain_suffix_match[0] && 1611 wpa_config_set_quoted(ssid, "domain_suffix_match", 1612 cred->domain_suffix_match) < 0) 1613 return -1; 1614 1615 ssid->eap.cert.ocsp = cred->ocsp; 1616 1617 return 0; 1618 } 1619 1620 1621 static int interworking_connect_roaming_consortium( 1622 struct wpa_supplicant *wpa_s, struct wpa_cred *cred, 1623 struct wpa_bss *bss, int only_add) 1624 { 1625 struct wpa_ssid *ssid; 1626 const u8 *ie; 1627 const struct wpabuf *anqp; 1628 unsigned int i; 1629 1630 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR 1631 " based on roaming consortium match", MAC2STR(bss->bssid)); 1632 1633 if (already_connected(wpa_s, cred, bss)) { 1634 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR, 1635 MAC2STR(bss->bssid)); 1636 return wpa_s->current_ssid->id; 1637 } 1638 1639 remove_duplicate_network(wpa_s, cred, bss); 1640 1641 ssid = wpa_config_add_network(wpa_s->conf); 1642 if (ssid == NULL) 1643 return -1; 1644 ssid->parent_cred = cred; 1645 wpas_notify_network_added(wpa_s, ssid); 1646 wpa_config_set_network_defaults(ssid); 1647 ssid->priority = cred->priority; 1648 ssid->temporary = 1; 1649 ssid->ssid = os_zalloc(bss->ssid_len + 1); 1650 if (ssid->ssid == NULL) 1651 goto fail; 1652 os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len); 1653 ssid->ssid_len = bss->ssid_len; 1654 1655 if (interworking_set_hs20_params(wpa_s, ssid) < 0) 1656 goto fail; 1657 1658 ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM); 1659 anqp = bss->anqp ? bss->anqp->roaming_consortium : NULL; 1660 for (i = 0; (ie || anqp) && i < cred->num_roaming_consortiums; i++) { 1661 if (!oi_match(ie, anqp, cred->roaming_consortiums[i], 1662 cred->roaming_consortiums_len[i])) 1663 continue; 1664 1665 ssid->roaming_consortium_selection = 1666 os_malloc(cred->roaming_consortiums_len[i]); 1667 if (!ssid->roaming_consortium_selection) 1668 goto fail; 1669 os_memcpy(ssid->roaming_consortium_selection, 1670 cred->roaming_consortiums[i], 1671 cred->roaming_consortiums_len[i]); 1672 ssid->roaming_consortium_selection_len = 1673 cred->roaming_consortiums_len[i]; 1674 break; 1675 } 1676 1677 if (cred->eap_method == NULL) { 1678 wpa_msg(wpa_s, MSG_DEBUG, 1679 "Interworking: No EAP method set for credential using roaming consortium"); 1680 goto fail; 1681 } 1682 1683 if (interworking_set_eap_params( 1684 ssid, cred, 1685 cred->eap_method->vendor == EAP_VENDOR_IETF && 1686 cred->eap_method->method == EAP_TYPE_TTLS) < 0) 1687 goto fail; 1688 1689 wpa_s->next_ssid = ssid; 1690 wpa_config_update_prio_list(wpa_s->conf); 1691 if (!only_add) 1692 interworking_reconnect(wpa_s); 1693 1694 return ssid->id; 1695 1696 fail: 1697 wpas_notify_network_removed(wpa_s, ssid); 1698 wpa_config_remove_network(wpa_s->conf, ssid->id); 1699 return -1; 1700 } 1701 1702 1703 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss, 1704 int only_add) 1705 { 1706 struct wpa_cred *cred, *cred_rc, *cred_3gpp; 1707 struct wpa_ssid *ssid; 1708 struct nai_realm *realm; 1709 struct nai_realm_eap *eap = NULL; 1710 u16 count, i; 1711 char buf[100]; 1712 int excluded = 0, *excl = &excluded; 1713 const char *name; 1714 1715 if (wpa_s->conf->cred == NULL || bss == NULL) 1716 return -1; 1717 if (disallowed_bssid(wpa_s, bss->bssid) || 1718 disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) { 1719 wpa_msg(wpa_s, MSG_DEBUG, 1720 "Interworking: Reject connection to disallowed BSS " 1721 MACSTR, MAC2STR(bss->bssid)); 1722 return -1; 1723 } 1724 1725 wpa_printf(MSG_DEBUG, "Interworking: Considering BSS " MACSTR 1726 " for connection", 1727 MAC2STR(bss->bssid)); 1728 1729 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) { 1730 /* 1731 * We currently support only HS 2.0 networks and those are 1732 * required to use WPA2-Enterprise. 1733 */ 1734 wpa_msg(wpa_s, MSG_DEBUG, 1735 "Interworking: Network does not use RSN"); 1736 return -1; 1737 } 1738 1739 cred_rc = interworking_credentials_available_roaming_consortium( 1740 wpa_s, bss, 0, excl); 1741 if (cred_rc) { 1742 wpa_msg(wpa_s, MSG_DEBUG, 1743 "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d", 1744 cred_rc->priority, cred_rc->sp_priority); 1745 if (excl && !(*excl)) 1746 excl = NULL; 1747 } 1748 1749 cred = interworking_credentials_available_realm(wpa_s, bss, 0, excl); 1750 if (cred) { 1751 wpa_msg(wpa_s, MSG_DEBUG, 1752 "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d", 1753 cred->priority, cred->sp_priority); 1754 if (excl && !(*excl)) 1755 excl = NULL; 1756 } 1757 1758 cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss, 0, 1759 excl); 1760 if (cred_3gpp) { 1761 wpa_msg(wpa_s, MSG_DEBUG, 1762 "Interworking: Highest 3GPP matching credential priority %d sp_priority %d", 1763 cred_3gpp->priority, cred_3gpp->sp_priority); 1764 if (excl && !(*excl)) 1765 excl = NULL; 1766 } 1767 1768 if (!cred_rc && !cred && !cred_3gpp) { 1769 wpa_msg(wpa_s, MSG_DEBUG, 1770 "Interworking: No full credential matches - consider options without BW(etc.) limits"); 1771 cred_rc = interworking_credentials_available_roaming_consortium( 1772 wpa_s, bss, 1, excl); 1773 if (cred_rc) { 1774 wpa_msg(wpa_s, MSG_DEBUG, 1775 "Interworking: Highest roaming consortium matching credential priority %d sp_priority %d (ignore BW)", 1776 cred_rc->priority, cred_rc->sp_priority); 1777 if (excl && !(*excl)) 1778 excl = NULL; 1779 } 1780 1781 cred = interworking_credentials_available_realm(wpa_s, bss, 1, 1782 excl); 1783 if (cred) { 1784 wpa_msg(wpa_s, MSG_DEBUG, 1785 "Interworking: Highest NAI Realm list matching credential priority %d sp_priority %d (ignore BW)", 1786 cred->priority, cred->sp_priority); 1787 if (excl && !(*excl)) 1788 excl = NULL; 1789 } 1790 1791 cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss, 1792 1, excl); 1793 if (cred_3gpp) { 1794 wpa_msg(wpa_s, MSG_DEBUG, 1795 "Interworking: Highest 3GPP matching credential priority %d sp_priority %d (ignore BW)", 1796 cred_3gpp->priority, cred_3gpp->sp_priority); 1797 if (excl && !(*excl)) 1798 excl = NULL; 1799 } 1800 } 1801 1802 if (cred_rc && 1803 (cred == NULL || cred_prio_cmp(cred_rc, cred) >= 0) && 1804 (cred_3gpp == NULL || cred_prio_cmp(cred_rc, cred_3gpp) >= 0)) 1805 return interworking_connect_roaming_consortium(wpa_s, cred_rc, 1806 bss, only_add); 1807 1808 if (cred_3gpp && 1809 (cred == NULL || cred_prio_cmp(cred_3gpp, cred) >= 0)) { 1810 return interworking_connect_3gpp(wpa_s, cred_3gpp, bss, 1811 only_add); 1812 } 1813 1814 if (cred == NULL) { 1815 wpa_msg(wpa_s, MSG_DEBUG, 1816 "Interworking: No matching credentials found for " 1817 MACSTR, MAC2STR(bss->bssid)); 1818 return -1; 1819 } 1820 1821 realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL, 1822 &count); 1823 if (realm == NULL) { 1824 wpa_msg(wpa_s, MSG_DEBUG, 1825 "Interworking: Could not parse NAI Realm list from " 1826 MACSTR, MAC2STR(bss->bssid)); 1827 return -1; 1828 } 1829 1830 for (i = 0; i < count; i++) { 1831 if (!nai_realm_match(&realm[i], cred->realm)) 1832 continue; 1833 eap = nai_realm_find_eap(wpa_s, cred, &realm[i]); 1834 if (eap) 1835 break; 1836 } 1837 1838 if (!eap) { 1839 wpa_msg(wpa_s, MSG_DEBUG, 1840 "Interworking: No matching credentials and EAP method found for " 1841 MACSTR, MAC2STR(bss->bssid)); 1842 nai_realm_free(realm, count); 1843 return -1; 1844 } 1845 1846 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Connect with " MACSTR, 1847 MAC2STR(bss->bssid)); 1848 1849 if (already_connected(wpa_s, cred, bss)) { 1850 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR, 1851 MAC2STR(bss->bssid)); 1852 nai_realm_free(realm, count); 1853 return 0; 1854 } 1855 1856 remove_duplicate_network(wpa_s, cred, bss); 1857 1858 ssid = wpa_config_add_network(wpa_s->conf); 1859 if (ssid == NULL) { 1860 nai_realm_free(realm, count); 1861 return -1; 1862 } 1863 ssid->parent_cred = cred; 1864 wpas_notify_network_added(wpa_s, ssid); 1865 wpa_config_set_network_defaults(ssid); 1866 ssid->priority = cred->priority; 1867 ssid->temporary = 1; 1868 ssid->ssid = os_zalloc(bss->ssid_len + 1); 1869 if (ssid->ssid == NULL) 1870 goto fail; 1871 os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len); 1872 ssid->ssid_len = bss->ssid_len; 1873 1874 if (interworking_set_hs20_params(wpa_s, ssid) < 0) 1875 goto fail; 1876 1877 if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF, 1878 eap->method), 0) < 0) 1879 goto fail; 1880 1881 switch (eap->method) { 1882 case EAP_TYPE_TTLS: 1883 if (eap->inner_method) { 1884 name = eap_get_name(EAP_VENDOR_IETF, eap->inner_method); 1885 if (!name) 1886 goto fail; 1887 os_snprintf(buf, sizeof(buf), "\"autheap=%s\"", name); 1888 if (wpa_config_set(ssid, "phase2", buf, 0) < 0) 1889 goto fail; 1890 break; 1891 } 1892 switch (eap->inner_non_eap) { 1893 case NAI_REALM_INNER_NON_EAP_PAP: 1894 if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) < 1895 0) 1896 goto fail; 1897 break; 1898 case NAI_REALM_INNER_NON_EAP_CHAP: 1899 if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0) 1900 < 0) 1901 goto fail; 1902 break; 1903 case NAI_REALM_INNER_NON_EAP_MSCHAP: 1904 if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"", 1905 0) < 0) 1906 goto fail; 1907 break; 1908 case NAI_REALM_INNER_NON_EAP_MSCHAPV2: 1909 if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"", 1910 0) < 0) 1911 goto fail; 1912 break; 1913 default: 1914 /* EAP params were not set - assume TTLS/MSCHAPv2 */ 1915 if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"", 1916 0) < 0) 1917 goto fail; 1918 break; 1919 } 1920 break; 1921 case EAP_TYPE_PEAP: 1922 case EAP_TYPE_FAST: 1923 if (wpa_config_set(ssid, "phase1", "\"fast_provisioning=2\"", 1924 0) < 0) 1925 goto fail; 1926 if (wpa_config_set(ssid, "pac_file", 1927 "\"blob://pac_interworking\"", 0) < 0) 1928 goto fail; 1929 name = eap_get_name(EAP_VENDOR_IETF, 1930 eap->inner_method ? eap->inner_method : 1931 EAP_TYPE_MSCHAPV2); 1932 if (name == NULL) 1933 goto fail; 1934 os_snprintf(buf, sizeof(buf), "\"auth=%s\"", name); 1935 if (wpa_config_set(ssid, "phase2", buf, 0) < 0) 1936 goto fail; 1937 break; 1938 case EAP_TYPE_TLS: 1939 break; 1940 } 1941 1942 if (interworking_set_eap_params(ssid, cred, 1943 eap->method == EAP_TYPE_TTLS) < 0) 1944 goto fail; 1945 1946 nai_realm_free(realm, count); 1947 1948 wpa_s->next_ssid = ssid; 1949 wpa_config_update_prio_list(wpa_s->conf); 1950 if (!only_add) 1951 interworking_reconnect(wpa_s); 1952 1953 return ssid->id; 1954 1955 fail: 1956 wpas_notify_network_removed(wpa_s, ssid); 1957 wpa_config_remove_network(wpa_s->conf, ssid->id); 1958 nai_realm_free(realm, count); 1959 return -1; 1960 } 1961 1962 1963 #ifdef PCSC_FUNCS 1964 static int interworking_pcsc_read_imsi(struct wpa_supplicant *wpa_s) 1965 { 1966 size_t len; 1967 1968 if (wpa_s->imsi[0] && wpa_s->mnc_len) 1969 return 0; 1970 1971 len = sizeof(wpa_s->imsi) - 1; 1972 if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) { 1973 scard_deinit(wpa_s->scard); 1974 wpa_s->scard = NULL; 1975 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI"); 1976 return -1; 1977 } 1978 wpa_s->imsi[len] = '\0'; 1979 wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard); 1980 wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)", 1981 wpa_s->imsi, wpa_s->mnc_len); 1982 1983 return 0; 1984 } 1985 #endif /* PCSC_FUNCS */ 1986 1987 1988 static struct wpa_cred * interworking_credentials_available_3gpp( 1989 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw, 1990 int *excluded) 1991 { 1992 struct wpa_cred *selected = NULL; 1993 #ifdef INTERWORKING_3GPP 1994 struct wpa_cred *cred; 1995 int ret; 1996 int is_excluded = 0; 1997 1998 if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL) { 1999 wpa_msg(wpa_s, MSG_DEBUG, 2000 "interworking-avail-3gpp: not avail, anqp: %p anqp_3gpp: %p", 2001 bss->anqp, bss->anqp ? bss->anqp->anqp_3gpp : NULL); 2002 return NULL; 2003 } 2004 2005 #ifdef CONFIG_EAP_PROXY 2006 if (!wpa_s->imsi[0]) { 2007 size_t len; 2008 wpa_msg(wpa_s, MSG_DEBUG, 2009 "Interworking: IMSI not available - try to read again through eap_proxy"); 2010 wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, -1, 2011 wpa_s->imsi, 2012 &len); 2013 if (wpa_s->mnc_len > 0) { 2014 wpa_s->imsi[len] = '\0'; 2015 wpa_msg(wpa_s, MSG_DEBUG, 2016 "eap_proxy: IMSI %s (MNC length %d)", 2017 wpa_s->imsi, wpa_s->mnc_len); 2018 } else { 2019 wpa_msg(wpa_s, MSG_DEBUG, 2020 "eap_proxy: IMSI not available"); 2021 } 2022 } 2023 #endif /* CONFIG_EAP_PROXY */ 2024 2025 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 2026 char *sep; 2027 const char *imsi; 2028 int mnc_len; 2029 char imsi_buf[16]; 2030 size_t msin_len; 2031 2032 #ifdef PCSC_FUNCS 2033 if (cred->pcsc && wpa_s->scard) { 2034 if (interworking_pcsc_read_imsi(wpa_s) < 0) 2035 continue; 2036 imsi = wpa_s->imsi; 2037 mnc_len = wpa_s->mnc_len; 2038 goto compare; 2039 } 2040 #endif /* PCSC_FUNCS */ 2041 #ifdef CONFIG_EAP_PROXY 2042 if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) { 2043 imsi = wpa_s->imsi; 2044 mnc_len = wpa_s->mnc_len; 2045 goto compare; 2046 } 2047 #endif /* CONFIG_EAP_PROXY */ 2048 2049 if (cred->imsi == NULL || !cred->imsi[0] || 2050 (!wpa_s->conf->external_sim && 2051 (cred->milenage == NULL || !cred->milenage[0]))) 2052 continue; 2053 2054 sep = os_strchr(cred->imsi, '-'); 2055 if (sep == NULL || 2056 (sep - cred->imsi != 5 && sep - cred->imsi != 6)) 2057 continue; 2058 mnc_len = sep - cred->imsi - 3; 2059 os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len); 2060 sep++; 2061 msin_len = os_strlen(cred->imsi); 2062 if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1) 2063 msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1; 2064 os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len); 2065 imsi_buf[3 + mnc_len + msin_len] = '\0'; 2066 imsi = imsi_buf; 2067 2068 #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY) 2069 compare: 2070 #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */ 2071 wpa_msg(wpa_s, MSG_DEBUG, 2072 "Interworking: Parsing 3GPP info from " MACSTR, 2073 MAC2STR(bss->bssid)); 2074 ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len); 2075 wpa_msg(wpa_s, MSG_DEBUG, "PLMN match %sfound", 2076 ret ? "" : "not "); 2077 if (ret) { 2078 if (cred_no_required_oi_match(cred, bss)) 2079 continue; 2080 if (!ignore_bw && 2081 cred_below_min_backhaul(wpa_s, cred, bss)) 2082 continue; 2083 if (!ignore_bw && 2084 cred_over_max_bss_load(wpa_s, cred, bss)) 2085 continue; 2086 if (!ignore_bw && 2087 cred_conn_capab_missing(wpa_s, cred, bss)) 2088 continue; 2089 if (cred_excluded_ssid(cred, bss)) { 2090 if (excluded == NULL) 2091 continue; 2092 if (selected == NULL) { 2093 selected = cred; 2094 is_excluded = 1; 2095 } 2096 } else { 2097 if (selected == NULL || is_excluded || 2098 cred_prio_cmp(selected, cred) < 0) { 2099 selected = cred; 2100 is_excluded = 0; 2101 } 2102 } 2103 } 2104 } 2105 2106 if (excluded) 2107 *excluded = is_excluded; 2108 #endif /* INTERWORKING_3GPP */ 2109 return selected; 2110 } 2111 2112 2113 static struct wpa_cred * interworking_credentials_available_realm( 2114 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw, 2115 int *excluded) 2116 { 2117 struct wpa_cred *cred, *selected = NULL; 2118 struct nai_realm *realm; 2119 u16 count, i; 2120 int is_excluded = 0; 2121 2122 if (bss->anqp == NULL || bss->anqp->nai_realm == NULL) 2123 return NULL; 2124 2125 if (wpa_s->conf->cred == NULL) 2126 return NULL; 2127 2128 wpa_msg(wpa_s, MSG_DEBUG, "Interworking: Parsing NAI Realm list from " 2129 MACSTR, MAC2STR(bss->bssid)); 2130 realm = nai_realm_parse(bss->anqp->nai_realm, &count); 2131 if (realm == NULL) { 2132 wpa_msg(wpa_s, MSG_DEBUG, 2133 "Interworking: Could not parse NAI Realm list from " 2134 MACSTR, MAC2STR(bss->bssid)); 2135 return NULL; 2136 } 2137 2138 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 2139 if (cred->realm == NULL) 2140 continue; 2141 2142 for (i = 0; i < count; i++) { 2143 if (!nai_realm_match(&realm[i], cred->realm)) 2144 continue; 2145 if (nai_realm_find_eap(wpa_s, cred, &realm[i])) { 2146 if (cred_no_required_oi_match(cred, bss)) 2147 continue; 2148 if (!ignore_bw && 2149 cred_below_min_backhaul(wpa_s, cred, bss)) 2150 continue; 2151 if (!ignore_bw && 2152 cred_over_max_bss_load(wpa_s, cred, bss)) 2153 continue; 2154 if (!ignore_bw && 2155 cred_conn_capab_missing(wpa_s, cred, bss)) 2156 continue; 2157 if (cred_excluded_ssid(cred, bss)) { 2158 if (excluded == NULL) 2159 continue; 2160 if (selected == NULL) { 2161 selected = cred; 2162 is_excluded = 1; 2163 } 2164 } else { 2165 if (selected == NULL || is_excluded || 2166 cred_prio_cmp(selected, cred) < 0) 2167 { 2168 selected = cred; 2169 is_excluded = 0; 2170 } 2171 } 2172 break; 2173 } else { 2174 wpa_msg(wpa_s, MSG_DEBUG, 2175 "Interworking: realm-find-eap returned false"); 2176 } 2177 } 2178 } 2179 2180 nai_realm_free(realm, count); 2181 2182 if (excluded) 2183 *excluded = is_excluded; 2184 2185 return selected; 2186 } 2187 2188 2189 static struct wpa_cred * interworking_credentials_available_helper( 2190 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int ignore_bw, 2191 int *excluded) 2192 { 2193 struct wpa_cred *cred, *cred2; 2194 int excluded1, excluded2 = 0; 2195 2196 if (disallowed_bssid(wpa_s, bss->bssid) || 2197 disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) { 2198 wpa_printf(MSG_DEBUG, "Interworking: Ignore disallowed BSS " 2199 MACSTR, MAC2STR(bss->bssid)); 2200 return NULL; 2201 } 2202 2203 cred = interworking_credentials_available_realm(wpa_s, bss, ignore_bw, 2204 &excluded1); 2205 cred2 = interworking_credentials_available_3gpp(wpa_s, bss, ignore_bw, 2206 &excluded2); 2207 if (cred && cred2 && 2208 (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) { 2209 cred = cred2; 2210 excluded1 = excluded2; 2211 } 2212 if (!cred) { 2213 cred = cred2; 2214 excluded1 = excluded2; 2215 } 2216 2217 cred2 = interworking_credentials_available_roaming_consortium( 2218 wpa_s, bss, ignore_bw, &excluded2); 2219 if (cred && cred2 && 2220 (cred_prio_cmp(cred2, cred) >= 0 || (!excluded2 && excluded1))) { 2221 cred = cred2; 2222 excluded1 = excluded2; 2223 } 2224 if (!cred) { 2225 cred = cred2; 2226 excluded1 = excluded2; 2227 } 2228 2229 if (excluded) 2230 *excluded = excluded1; 2231 return cred; 2232 } 2233 2234 2235 static struct wpa_cred * interworking_credentials_available( 2236 struct wpa_supplicant *wpa_s, struct wpa_bss *bss, int *excluded) 2237 { 2238 struct wpa_cred *cred; 2239 2240 if (excluded) 2241 *excluded = 0; 2242 cred = interworking_credentials_available_helper(wpa_s, bss, 0, 2243 excluded); 2244 if (cred) 2245 return cred; 2246 return interworking_credentials_available_helper(wpa_s, bss, 1, 2247 excluded); 2248 } 2249 2250 2251 int domain_name_list_contains(struct wpabuf *domain_names, 2252 const char *domain, int exact_match) 2253 { 2254 const u8 *pos, *end; 2255 size_t len; 2256 2257 len = os_strlen(domain); 2258 pos = wpabuf_head(domain_names); 2259 end = pos + wpabuf_len(domain_names); 2260 2261 while (end - pos > 1) { 2262 u8 elen; 2263 2264 elen = *pos++; 2265 if (elen > end - pos) 2266 break; 2267 2268 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name", 2269 pos, elen); 2270 if (elen == len && 2271 os_strncasecmp(domain, (const char *) pos, len) == 0) 2272 return 1; 2273 if (!exact_match && elen > len && pos[elen - len - 1] == '.') { 2274 const char *ap = (const char *) pos; 2275 int offset = elen - len; 2276 2277 if (os_strncasecmp(domain, ap + offset, len) == 0) 2278 return 1; 2279 } 2280 2281 pos += elen; 2282 } 2283 2284 return 0; 2285 } 2286 2287 2288 int interworking_home_sp_cred(struct wpa_supplicant *wpa_s, 2289 struct wpa_cred *cred, 2290 struct wpabuf *domain_names) 2291 { 2292 size_t i; 2293 int ret = -1; 2294 #ifdef INTERWORKING_3GPP 2295 char nai[100], *realm; 2296 2297 char *imsi = NULL; 2298 int mnc_len = 0; 2299 if (cred->imsi) 2300 imsi = cred->imsi; 2301 #ifdef PCSC_FUNCS 2302 else if (cred->pcsc && wpa_s->scard) { 2303 if (interworking_pcsc_read_imsi(wpa_s) < 0) 2304 return -1; 2305 imsi = wpa_s->imsi; 2306 mnc_len = wpa_s->mnc_len; 2307 } 2308 #endif /* PCSC_FUNCS */ 2309 #ifdef CONFIG_EAP_PROXY 2310 else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) { 2311 imsi = wpa_s->imsi; 2312 mnc_len = wpa_s->mnc_len; 2313 } 2314 #endif /* CONFIG_EAP_PROXY */ 2315 if (domain_names && 2316 imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) { 2317 realm = os_strchr(nai, '@'); 2318 if (realm) 2319 realm++; 2320 wpa_msg(wpa_s, MSG_DEBUG, 2321 "Interworking: Search for match with SIM/USIM domain %s", 2322 realm ? realm : "[NULL]"); 2323 if (realm && 2324 domain_name_list_contains(domain_names, realm, 1)) 2325 return 1; 2326 if (realm) 2327 ret = 0; 2328 } 2329 #endif /* INTERWORKING_3GPP */ 2330 2331 if (domain_names == NULL || cred->domain == NULL) 2332 return ret; 2333 2334 for (i = 0; i < cred->num_domain; i++) { 2335 wpa_msg(wpa_s, MSG_DEBUG, 2336 "Interworking: Search for match with home SP FQDN %s", 2337 cred->domain[i]); 2338 if (domain_name_list_contains(domain_names, cred->domain[i], 1)) 2339 return 1; 2340 } 2341 2342 return 0; 2343 } 2344 2345 2346 static int interworking_home_sp(struct wpa_supplicant *wpa_s, 2347 struct wpabuf *domain_names) 2348 { 2349 struct wpa_cred *cred; 2350 2351 if (domain_names == NULL || wpa_s->conf->cred == NULL) 2352 return -1; 2353 2354 for (cred = wpa_s->conf->cred; cred; cred = cred->next) { 2355 int res = interworking_home_sp_cred(wpa_s, cred, domain_names); 2356 if (res) 2357 return res; 2358 } 2359 2360 return 0; 2361 } 2362 2363 2364 static int interworking_find_network_match(struct wpa_supplicant *wpa_s) 2365 { 2366 struct wpa_bss *bss; 2367 struct wpa_ssid *ssid; 2368 2369 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 2370 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) { 2371 if (wpas_network_disabled(wpa_s, ssid) || 2372 ssid->mode != WPAS_MODE_INFRA) 2373 continue; 2374 if (ssid->ssid_len != bss->ssid_len || 2375 os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) != 2376 0) 2377 continue; 2378 /* 2379 * TODO: Consider more accurate matching of security 2380 * configuration similarly to what is done in events.c 2381 */ 2382 return 1; 2383 } 2384 } 2385 2386 return 0; 2387 } 2388 2389 2390 static int roaming_partner_match(struct wpa_supplicant *wpa_s, 2391 struct roaming_partner *partner, 2392 struct wpabuf *domain_names) 2393 { 2394 wpa_printf(MSG_DEBUG, "Interworking: Comparing roaming_partner info fqdn='%s' exact_match=%d priority=%u country='%s'", 2395 partner->fqdn, partner->exact_match, partner->priority, 2396 partner->country); 2397 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: Domain names", 2398 wpabuf_head(domain_names), 2399 wpabuf_len(domain_names)); 2400 if (!domain_name_list_contains(domain_names, partner->fqdn, 2401 partner->exact_match)) 2402 return 0; 2403 /* TODO: match Country */ 2404 return 1; 2405 } 2406 2407 2408 static u8 roaming_prio(struct wpa_supplicant *wpa_s, struct wpa_cred *cred, 2409 struct wpa_bss *bss) 2410 { 2411 size_t i; 2412 2413 if (bss->anqp == NULL || bss->anqp->domain_name == NULL) { 2414 wpa_printf(MSG_DEBUG, "Interworking: No ANQP domain name info -> use default roaming partner priority 128"); 2415 return 128; /* cannot check preference with domain name */ 2416 } 2417 2418 if (interworking_home_sp_cred(wpa_s, cred, bss->anqp->domain_name) > 0) 2419 { 2420 wpa_printf(MSG_DEBUG, "Interworking: Determined to be home SP -> use maximum preference 0 as roaming partner priority"); 2421 return 0; /* max preference for home SP network */ 2422 } 2423 2424 for (i = 0; i < cred->num_roaming_partner; i++) { 2425 if (roaming_partner_match(wpa_s, &cred->roaming_partner[i], 2426 bss->anqp->domain_name)) { 2427 wpa_printf(MSG_DEBUG, "Interworking: Roaming partner preference match - priority %u", 2428 cred->roaming_partner[i].priority); 2429 return cred->roaming_partner[i].priority; 2430 } 2431 } 2432 2433 wpa_printf(MSG_DEBUG, "Interworking: No roaming partner preference match - use default roaming partner priority 128"); 2434 return 128; 2435 } 2436 2437 2438 static struct wpa_bss * pick_best_roaming_partner(struct wpa_supplicant *wpa_s, 2439 struct wpa_bss *selected, 2440 struct wpa_cred *cred) 2441 { 2442 struct wpa_bss *bss; 2443 u8 best_prio, prio; 2444 struct wpa_cred *cred2; 2445 2446 /* 2447 * Check if any other BSS is operated by a more preferred roaming 2448 * partner. 2449 */ 2450 2451 best_prio = roaming_prio(wpa_s, cred, selected); 2452 wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for selected BSS " 2453 MACSTR " (cred=%d)", best_prio, MAC2STR(selected->bssid), 2454 cred->id); 2455 2456 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 2457 if (bss == selected) 2458 continue; 2459 cred2 = interworking_credentials_available(wpa_s, bss, NULL); 2460 if (!cred2) 2461 continue; 2462 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) 2463 continue; 2464 prio = roaming_prio(wpa_s, cred2, bss); 2465 wpa_printf(MSG_DEBUG, "Interworking: roaming_prio=%u for BSS " 2466 MACSTR " (cred=%d)", prio, MAC2STR(bss->bssid), 2467 cred2->id); 2468 if (prio < best_prio) { 2469 int bh1, bh2, load1, load2, conn1, conn2; 2470 bh1 = cred_below_min_backhaul(wpa_s, cred, selected); 2471 load1 = cred_over_max_bss_load(wpa_s, cred, selected); 2472 conn1 = cred_conn_capab_missing(wpa_s, cred, selected); 2473 bh2 = cred_below_min_backhaul(wpa_s, cred2, bss); 2474 load2 = cred_over_max_bss_load(wpa_s, cred2, bss); 2475 conn2 = cred_conn_capab_missing(wpa_s, cred2, bss); 2476 wpa_printf(MSG_DEBUG, "Interworking: old: %d %d %d new: %d %d %d", 2477 bh1, load1, conn1, bh2, load2, conn2); 2478 if (bh1 || load1 || conn1 || !(bh2 || load2 || conn2)) { 2479 wpa_printf(MSG_DEBUG, "Interworking: Better roaming partner " MACSTR " selected", MAC2STR(bss->bssid)); 2480 best_prio = prio; 2481 selected = bss; 2482 } 2483 } 2484 } 2485 2486 return selected; 2487 } 2488 2489 2490 static void interworking_select_network(struct wpa_supplicant *wpa_s) 2491 { 2492 struct wpa_bss *bss, *selected = NULL, *selected_home = NULL; 2493 struct wpa_bss *selected2 = NULL, *selected2_home = NULL; 2494 unsigned int count = 0; 2495 const char *type; 2496 int res; 2497 struct wpa_cred *cred, *selected_cred = NULL; 2498 struct wpa_cred *selected_home_cred = NULL; 2499 struct wpa_cred *selected2_cred = NULL; 2500 struct wpa_cred *selected2_home_cred = NULL; 2501 2502 wpa_s->network_select = 0; 2503 2504 wpa_printf(MSG_DEBUG, "Interworking: Select network (auto_select=%d)", 2505 wpa_s->auto_select); 2506 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 2507 int excluded = 0; 2508 int bh, bss_load, conn_capab; 2509 cred = interworking_credentials_available(wpa_s, bss, 2510 &excluded); 2511 if (!cred) 2512 continue; 2513 2514 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) { 2515 /* 2516 * We currently support only HS 2.0 networks and those 2517 * are required to use WPA2-Enterprise. 2518 */ 2519 wpa_msg(wpa_s, MSG_DEBUG, 2520 "Interworking: Credential match with " MACSTR 2521 " but network does not use RSN", 2522 MAC2STR(bss->bssid)); 2523 continue; 2524 } 2525 if (!excluded) 2526 count++; 2527 res = interworking_home_sp(wpa_s, bss->anqp ? 2528 bss->anqp->domain_name : NULL); 2529 if (res > 0) 2530 type = "home"; 2531 else if (res == 0) 2532 type = "roaming"; 2533 else 2534 type = "unknown"; 2535 bh = cred_below_min_backhaul(wpa_s, cred, bss); 2536 bss_load = cred_over_max_bss_load(wpa_s, cred, bss); 2537 conn_capab = cred_conn_capab_missing(wpa_s, cred, bss); 2538 wpas_notify_interworking_ap_added(wpa_s, bss, cred, excluded, 2539 type, bh, bss_load, 2540 conn_capab); 2541 if (excluded) 2542 continue; 2543 if (wpa_s->auto_select || 2544 (wpa_s->conf->auto_interworking && 2545 wpa_s->auto_network_select)) { 2546 if (bh || bss_load || conn_capab) { 2547 if (selected2_cred == NULL || 2548 cred_prio_cmp(cred, selected2_cred) > 0) { 2549 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2"); 2550 selected2 = bss; 2551 selected2_cred = cred; 2552 } 2553 if (res > 0 && 2554 (selected2_home_cred == NULL || 2555 cred_prio_cmp(cred, selected2_home_cred) > 2556 0)) { 2557 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected2_home"); 2558 selected2_home = bss; 2559 selected2_home_cred = cred; 2560 } 2561 } else { 2562 if (selected_cred == NULL || 2563 cred_prio_cmp(cred, selected_cred) > 0) { 2564 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected"); 2565 selected = bss; 2566 selected_cred = cred; 2567 } 2568 if (res > 0 && 2569 (selected_home_cred == NULL || 2570 cred_prio_cmp(cred, selected_home_cred) > 2571 0)) { 2572 wpa_printf(MSG_DEBUG, "Interworking: Mark as selected_home"); 2573 selected_home = bss; 2574 selected_home_cred = cred; 2575 } 2576 } 2577 } 2578 } 2579 2580 if (selected_home && selected_home != selected && 2581 selected_home_cred && 2582 (selected_cred == NULL || 2583 cred_prio_cmp(selected_home_cred, selected_cred) >= 0)) { 2584 /* Prefer network operated by the Home SP */ 2585 wpa_printf(MSG_DEBUG, "Interworking: Overrode selected with selected_home"); 2586 selected = selected_home; 2587 selected_cred = selected_home_cred; 2588 } 2589 2590 if (!selected) { 2591 if (selected2_home) { 2592 wpa_printf(MSG_DEBUG, "Interworking: Use home BSS with BW limit mismatch since no other network could be selected"); 2593 selected = selected2_home; 2594 selected_cred = selected2_home_cred; 2595 } else if (selected2) { 2596 wpa_printf(MSG_DEBUG, "Interworking: Use visited BSS with BW limit mismatch since no other network could be selected"); 2597 selected = selected2; 2598 selected_cred = selected2_cred; 2599 } 2600 } 2601 2602 if (count == 0) { 2603 /* 2604 * No matching network was found based on configured 2605 * credentials. Check whether any of the enabled network blocks 2606 * have matching APs. 2607 */ 2608 if (interworking_find_network_match(wpa_s)) { 2609 wpa_msg(wpa_s, MSG_DEBUG, 2610 "Interworking: Possible BSS match for enabled network configurations"); 2611 if (wpa_s->auto_select) { 2612 interworking_reconnect(wpa_s); 2613 return; 2614 } 2615 } 2616 2617 if (wpa_s->auto_network_select) { 2618 wpa_msg(wpa_s, MSG_DEBUG, 2619 "Interworking: Continue scanning after ANQP fetch"); 2620 wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval, 2621 0); 2622 return; 2623 } 2624 2625 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network " 2626 "with matching credentials found"); 2627 if (wpa_s->wpa_state == WPA_SCANNING) 2628 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); 2629 } 2630 2631 wpas_notify_interworking_select_done(wpa_s); 2632 2633 if (selected) { 2634 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR, 2635 MAC2STR(selected->bssid)); 2636 selected = pick_best_roaming_partner(wpa_s, selected, 2637 selected_cred); 2638 wpa_printf(MSG_DEBUG, "Interworking: Selected " MACSTR 2639 " (after best roaming partner selection)", 2640 MAC2STR(selected->bssid)); 2641 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_SELECTED MACSTR, 2642 MAC2STR(selected->bssid)); 2643 interworking_connect(wpa_s, selected, 0); 2644 } else if (wpa_s->wpa_state == WPA_SCANNING) 2645 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); 2646 } 2647 2648 2649 static struct wpa_bss_anqp * 2650 interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss) 2651 { 2652 struct wpa_bss *other; 2653 2654 if (is_zero_ether_addr(bss->hessid)) 2655 return NULL; /* Cannot be in the same homegenous ESS */ 2656 2657 dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) { 2658 if (other == bss) 2659 continue; 2660 if (other->anqp == NULL) 2661 continue; 2662 if (other->anqp->roaming_consortium == NULL && 2663 other->anqp->nai_realm == NULL && 2664 other->anqp->anqp_3gpp == NULL && 2665 other->anqp->domain_name == NULL) 2666 continue; 2667 if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED)) 2668 continue; 2669 if (!ether_addr_equal(bss->hessid, other->hessid)) 2670 continue; 2671 if (bss->ssid_len != other->ssid_len || 2672 os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0) 2673 continue; 2674 2675 wpa_msg(wpa_s, MSG_DEBUG, 2676 "Interworking: Share ANQP data with already fetched BSSID " 2677 MACSTR " and " MACSTR, 2678 MAC2STR(other->bssid), MAC2STR(bss->bssid)); 2679 other->anqp->users++; 2680 return other->anqp; 2681 } 2682 2683 return NULL; 2684 } 2685 2686 2687 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s) 2688 { 2689 struct wpa_bss *bss; 2690 int found = 0; 2691 2692 wpa_printf(MSG_DEBUG, "Interworking: next_anqp_fetch - " 2693 "fetch_anqp_in_progress=%d fetch_osu_icon_in_progress=%d", 2694 wpa_s->fetch_anqp_in_progress, 2695 wpa_s->fetch_osu_icon_in_progress); 2696 2697 if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress) { 2698 wpa_printf(MSG_DEBUG, "Interworking: Stop next-ANQP-fetch"); 2699 return; 2700 } 2701 2702 #ifdef CONFIG_HS20 2703 if (wpa_s->fetch_osu_icon_in_progress) { 2704 wpa_printf(MSG_DEBUG, "Interworking: Next icon (in progress)"); 2705 hs20_next_osu_icon(wpa_s); 2706 return; 2707 } 2708 #endif /* CONFIG_HS20 */ 2709 2710 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) { 2711 if (!(bss->caps & IEEE80211_CAP_ESS)) 2712 continue; 2713 if (!wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_INTERWORKING)) 2714 continue; /* AP does not support Interworking */ 2715 if (disallowed_bssid(wpa_s, bss->bssid) || 2716 disallowed_ssid(wpa_s, bss->ssid, bss->ssid_len)) 2717 continue; /* Disallowed BSS */ 2718 2719 if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) { 2720 if (bss->anqp == NULL) { 2721 bss->anqp = interworking_match_anqp_info(wpa_s, 2722 bss); 2723 if (bss->anqp) { 2724 /* Shared data already fetched */ 2725 continue; 2726 } 2727 bss->anqp = wpa_bss_anqp_alloc(); 2728 if (bss->anqp == NULL) 2729 break; 2730 } 2731 found++; 2732 bss->flags |= WPA_BSS_ANQP_FETCH_TRIED; 2733 wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for " 2734 MACSTR " (HESSID " MACSTR ")", 2735 MAC2STR(bss->bssid), MAC2STR(bss->hessid)); 2736 interworking_anqp_send_req(wpa_s, bss); 2737 break; 2738 } 2739 } 2740 2741 if (found == 0) { 2742 #ifdef CONFIG_HS20 2743 if (wpa_s->fetch_osu_info) { 2744 if (wpa_s->num_prov_found == 0 && 2745 wpa_s->fetch_osu_waiting_scan && 2746 wpa_s->num_osu_scans < 3) { 2747 wpa_printf(MSG_DEBUG, "HS 2.0: No OSU providers seen - try to scan again"); 2748 hs20_start_osu_scan(wpa_s); 2749 return; 2750 } 2751 wpa_printf(MSG_DEBUG, "Interworking: Next icon"); 2752 hs20_osu_icon_fetch(wpa_s); 2753 return; 2754 } 2755 #endif /* CONFIG_HS20 */ 2756 wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed"); 2757 wpa_s->fetch_anqp_in_progress = 0; 2758 if (wpa_s->network_select) 2759 interworking_select_network(wpa_s); 2760 } 2761 } 2762 2763 2764 void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s) 2765 { 2766 struct wpa_bss *bss; 2767 2768 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) 2769 bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED; 2770 2771 wpa_s->fetch_anqp_in_progress = 1; 2772 2773 /* 2774 * Start actual ANQP operation from eloop call to make sure the loop 2775 * does not end up using excessive recursion. 2776 */ 2777 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s, NULL); 2778 } 2779 2780 2781 int interworking_fetch_anqp(struct wpa_supplicant *wpa_s) 2782 { 2783 if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) 2784 return 0; 2785 2786 wpa_s->network_select = 0; 2787 wpa_s->fetch_all_anqp = 1; 2788 wpa_s->fetch_osu_info = 0; 2789 2790 interworking_start_fetch_anqp(wpa_s); 2791 2792 return 0; 2793 } 2794 2795 2796 void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s) 2797 { 2798 if (!wpa_s->fetch_anqp_in_progress) 2799 return; 2800 2801 wpa_s->fetch_anqp_in_progress = 0; 2802 } 2803 2804 2805 int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, int freq, 2806 u16 info_ids[], size_t num_ids, u32 subtypes, 2807 u32 mbo_subtypes) 2808 { 2809 struct wpabuf *buf; 2810 struct wpabuf *extra_buf = NULL; 2811 int ret = 0; 2812 struct wpa_bss *bss; 2813 int res; 2814 2815 bss = wpa_bss_get_bssid_latest(wpa_s, dst); 2816 if (!bss && !freq) { 2817 wpa_printf(MSG_WARNING, 2818 "ANQP: Cannot send query without BSS freq info"); 2819 return -1; 2820 } 2821 2822 if (bss) 2823 wpa_bss_anqp_unshare_alloc(bss); 2824 if (bss && !freq) 2825 freq = bss->freq; 2826 2827 wpa_msg(wpa_s, MSG_DEBUG, 2828 "ANQP: Query Request to " MACSTR " for %u id(s)", 2829 MAC2STR(dst), (unsigned int) num_ids); 2830 2831 #ifdef CONFIG_HS20 2832 if (subtypes != 0) { 2833 extra_buf = wpabuf_alloc(100); 2834 if (extra_buf == NULL) 2835 return -1; 2836 hs20_put_anqp_req(subtypes, NULL, 0, extra_buf); 2837 } 2838 #endif /* CONFIG_HS20 */ 2839 2840 #ifdef CONFIG_MBO 2841 if (mbo_subtypes) { 2842 struct wpabuf *mbo; 2843 2844 if (!bss) { 2845 wpa_printf(MSG_WARNING, 2846 "ANQP: Cannot send MBO query to unknown BSS " 2847 MACSTR, MAC2STR(dst)); 2848 wpabuf_free(extra_buf); 2849 return -1; 2850 } 2851 2852 mbo = mbo_build_anqp_buf(wpa_s, bss, mbo_subtypes); 2853 if (mbo) { 2854 if (wpabuf_resize(&extra_buf, wpabuf_len(mbo))) { 2855 wpabuf_free(extra_buf); 2856 wpabuf_free(mbo); 2857 return -1; 2858 } 2859 wpabuf_put_buf(extra_buf, mbo); 2860 wpabuf_free(mbo); 2861 } 2862 } 2863 #endif /* CONFIG_MBO */ 2864 2865 buf = anqp_build_req(info_ids, num_ids, extra_buf); 2866 wpabuf_free(extra_buf); 2867 if (buf == NULL) 2868 return -1; 2869 2870 res = gas_query_req(wpa_s->gas, dst, freq, 0, 0, buf, anqp_resp_cb, 2871 wpa_s); 2872 if (res < 0) { 2873 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Failed to send Query Request"); 2874 wpabuf_free(buf); 2875 ret = -1; 2876 } else { 2877 wpa_msg(wpa_s, MSG_DEBUG, 2878 "ANQP: Query started with dialog token %u", res); 2879 } 2880 2881 return ret; 2882 } 2883 2884 2885 static void anqp_add_extra(struct wpa_supplicant *wpa_s, 2886 struct wpa_bss_anqp *anqp, u16 info_id, 2887 const u8 *data, size_t slen, bool protected_response) 2888 { 2889 struct wpa_bss_anqp_elem *tmp, *elem = NULL; 2890 2891 if (!anqp) 2892 return; 2893 2894 dl_list_for_each(tmp, &anqp->anqp_elems, struct wpa_bss_anqp_elem, 2895 list) { 2896 if (tmp->infoid == info_id) { 2897 elem = tmp; 2898 break; 2899 } 2900 } 2901 2902 if (!elem) { 2903 elem = os_zalloc(sizeof(*elem)); 2904 if (!elem) 2905 return; 2906 elem->infoid = info_id; 2907 dl_list_add(&anqp->anqp_elems, &elem->list); 2908 } else { 2909 wpabuf_free(elem->payload); 2910 } 2911 2912 elem->protected_response = protected_response; 2913 elem->payload = wpabuf_alloc_copy(data, slen); 2914 if (!elem->payload) { 2915 dl_list_del(&elem->list); 2916 os_free(elem); 2917 } 2918 } 2919 2920 2921 static void interworking_parse_venue_url(struct wpa_supplicant *wpa_s, 2922 const u8 *data, size_t len) 2923 { 2924 const u8 *pos = data, *end = data + len; 2925 char url[255]; 2926 2927 while (end - pos >= 2) { 2928 u8 slen, num; 2929 2930 slen = *pos++; 2931 if (slen < 1 || slen > end - pos) { 2932 wpa_printf(MSG_DEBUG, 2933 "ANQP: Truncated Venue URL Duple field"); 2934 return; 2935 } 2936 2937 num = *pos++; 2938 os_memcpy(url, pos, slen - 1); 2939 url[slen - 1] = '\0'; 2940 wpa_msg(wpa_s, MSG_INFO, RX_VENUE_URL "%u %s", num, url); 2941 pos += slen - 1; 2942 } 2943 } 2944 2945 2946 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s, 2947 struct wpa_bss *bss, const u8 *sa, 2948 u16 info_id, 2949 const u8 *data, size_t slen, 2950 u8 dialog_token) 2951 { 2952 const u8 *pos = data; 2953 struct wpa_bss_anqp *anqp = NULL; 2954 u8 type; 2955 bool protected_response; 2956 2957 if (bss) 2958 anqp = bss->anqp; 2959 2960 switch (info_id) { 2961 case ANQP_CAPABILITY_LIST: 2962 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 2963 " ANQP Capability list", MAC2STR(sa)); 2964 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Capability list", 2965 pos, slen); 2966 if (anqp) { 2967 wpabuf_free(anqp->capability_list); 2968 anqp->capability_list = wpabuf_alloc_copy(pos, slen); 2969 } 2970 break; 2971 case ANQP_VENUE_NAME: 2972 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 2973 " Venue Name", MAC2STR(sa)); 2974 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen); 2975 if (anqp) { 2976 wpabuf_free(anqp->venue_name); 2977 anqp->venue_name = wpabuf_alloc_copy(pos, slen); 2978 } 2979 break; 2980 case ANQP_NETWORK_AUTH_TYPE: 2981 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 2982 " Network Authentication Type information", 2983 MAC2STR(sa)); 2984 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication " 2985 "Type", pos, slen); 2986 if (anqp) { 2987 wpabuf_free(anqp->network_auth_type); 2988 anqp->network_auth_type = wpabuf_alloc_copy(pos, slen); 2989 } 2990 break; 2991 case ANQP_ROAMING_CONSORTIUM: 2992 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 2993 " Roaming Consortium list", MAC2STR(sa)); 2994 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium", 2995 pos, slen); 2996 if (anqp) { 2997 wpabuf_free(anqp->roaming_consortium); 2998 anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen); 2999 } 3000 break; 3001 case ANQP_IP_ADDR_TYPE_AVAILABILITY: 3002 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 3003 " IP Address Type Availability information", 3004 MAC2STR(sa)); 3005 wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability", 3006 pos, slen); 3007 if (anqp) { 3008 wpabuf_free(anqp->ip_addr_type_availability); 3009 anqp->ip_addr_type_availability = 3010 wpabuf_alloc_copy(pos, slen); 3011 } 3012 break; 3013 case ANQP_NAI_REALM: 3014 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 3015 " NAI Realm list", MAC2STR(sa)); 3016 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen); 3017 if (anqp) { 3018 wpabuf_free(anqp->nai_realm); 3019 anqp->nai_realm = wpabuf_alloc_copy(pos, slen); 3020 } 3021 break; 3022 case ANQP_3GPP_CELLULAR_NETWORK: 3023 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 3024 " 3GPP Cellular Network information", MAC2STR(sa)); 3025 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network", 3026 pos, slen); 3027 if (anqp) { 3028 wpabuf_free(anqp->anqp_3gpp); 3029 anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen); 3030 } 3031 break; 3032 case ANQP_DOMAIN_NAME: 3033 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 3034 " Domain Name list", MAC2STR(sa)); 3035 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen); 3036 if (anqp) { 3037 wpabuf_free(anqp->domain_name); 3038 anqp->domain_name = wpabuf_alloc_copy(pos, slen); 3039 } 3040 break; 3041 #ifdef CONFIG_FILS 3042 case ANQP_FILS_REALM_INFO: 3043 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR 3044 " FILS Realm Information", MAC2STR(sa)); 3045 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: FILS Realm Information", 3046 pos, slen); 3047 if (anqp) { 3048 wpabuf_free(anqp->fils_realm_info); 3049 anqp->fils_realm_info = wpabuf_alloc_copy(pos, slen); 3050 } 3051 break; 3052 #endif /* CONFIG_FILS */ 3053 case ANQP_VENUE_URL: 3054 wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR " Venue URL", 3055 MAC2STR(sa)); 3056 protected_response = pmf_in_use(wpa_s, sa); 3057 anqp_add_extra(wpa_s, anqp, info_id, pos, slen, 3058 protected_response); 3059 3060 if (!protected_response) { 3061 wpa_printf(MSG_DEBUG, 3062 "ANQP: Ignore Venue URL since PMF was not enabled"); 3063 break; 3064 } 3065 interworking_parse_venue_url(wpa_s, pos, slen); 3066 break; 3067 case ANQP_VENDOR_SPECIFIC: 3068 if (slen < 3) 3069 return; 3070 3071 switch (WPA_GET_BE24(pos)) { 3072 case OUI_WFA: 3073 pos += 3; 3074 slen -= 3; 3075 3076 if (slen < 1) 3077 return; 3078 type = *pos++; 3079 slen--; 3080 3081 switch (type) { 3082 #ifdef CONFIG_HS20 3083 case HS20_ANQP_OUI_TYPE: 3084 hs20_parse_rx_hs20_anqp_resp(wpa_s, bss, sa, 3085 pos, slen, 3086 dialog_token); 3087 break; 3088 #endif /* CONFIG_HS20 */ 3089 #ifdef CONFIG_MBO 3090 case MBO_ANQP_OUI_TYPE: 3091 mbo_parse_rx_anqp_resp(wpa_s, bss, sa, 3092 pos, slen); 3093 break; 3094 #endif /* CONFIG_MBO */ 3095 default: 3096 wpa_msg(wpa_s, MSG_DEBUG, 3097 "ANQP: Unsupported ANQP vendor type %u", 3098 type); 3099 break; 3100 } 3101 break; 3102 default: 3103 wpa_msg(wpa_s, MSG_DEBUG, 3104 "Interworking: Unsupported vendor-specific ANQP OUI %06x", 3105 WPA_GET_BE24(pos)); 3106 return; 3107 } 3108 break; 3109 default: 3110 wpa_msg(wpa_s, MSG_DEBUG, 3111 "Interworking: Unsupported ANQP Info ID %u", info_id); 3112 anqp_add_extra(wpa_s, anqp, info_id, data, slen, 3113 pmf_in_use(wpa_s, sa)); 3114 break; 3115 } 3116 } 3117 3118 3119 void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token, 3120 enum gas_query_result result, 3121 const struct wpabuf *adv_proto, 3122 const struct wpabuf *resp, u16 status_code) 3123 { 3124 struct wpa_supplicant *wpa_s = ctx; 3125 const u8 *pos; 3126 const u8 *end; 3127 u16 info_id; 3128 u16 slen; 3129 struct wpa_bss *bss = NULL, *tmp; 3130 const char *anqp_result = "SUCCESS"; 3131 3132 wpa_printf(MSG_DEBUG, "Interworking: anqp_resp_cb dst=" MACSTR 3133 " dialog_token=%u result=%d status_code=%u", 3134 MAC2STR(dst), dialog_token, result, status_code); 3135 if (result != GAS_QUERY_SUCCESS) { 3136 #ifdef CONFIG_HS20 3137 if (wpa_s->fetch_osu_icon_in_progress) 3138 hs20_icon_fetch_failed(wpa_s); 3139 #endif /* CONFIG_HS20 */ 3140 anqp_result = "FAILURE"; 3141 goto out; 3142 } 3143 3144 pos = wpabuf_head(adv_proto); 3145 if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO || 3146 pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) { 3147 wpa_msg(wpa_s, MSG_DEBUG, 3148 "ANQP: Unexpected Advertisement Protocol in response"); 3149 #ifdef CONFIG_HS20 3150 if (wpa_s->fetch_osu_icon_in_progress) 3151 hs20_icon_fetch_failed(wpa_s); 3152 #endif /* CONFIG_HS20 */ 3153 anqp_result = "INVALID_FRAME"; 3154 goto out; 3155 } 3156 3157 /* 3158 * If possible, select the BSS entry based on which BSS entry was used 3159 * for the request. This can help in cases where multiple BSS entries 3160 * may exist for the same AP. 3161 */ 3162 dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) { 3163 if (tmp == wpa_s->interworking_gas_bss && 3164 ether_addr_equal(tmp->bssid, dst)) { 3165 bss = tmp; 3166 break; 3167 } 3168 } 3169 if (bss == NULL) 3170 bss = wpa_bss_get_bssid_latest(wpa_s, dst); 3171 3172 pos = wpabuf_head(resp); 3173 end = pos + wpabuf_len(resp); 3174 3175 while (pos < end) { 3176 unsigned int left = end - pos; 3177 3178 if (left < 4) { 3179 wpa_msg(wpa_s, MSG_DEBUG, "ANQP: Invalid element"); 3180 anqp_result = "INVALID_FRAME"; 3181 goto out_parse_done; 3182 } 3183 info_id = WPA_GET_LE16(pos); 3184 pos += 2; 3185 slen = WPA_GET_LE16(pos); 3186 pos += 2; 3187 left -= 4; 3188 if (left < slen) { 3189 wpa_msg(wpa_s, MSG_DEBUG, 3190 "ANQP: Invalid element length for Info ID %u", 3191 info_id); 3192 anqp_result = "INVALID_FRAME"; 3193 goto out_parse_done; 3194 } 3195 interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos, 3196 slen, dialog_token); 3197 pos += slen; 3198 } 3199 3200 out_parse_done: 3201 if (bss) 3202 wpas_notify_bss_anqp_changed(wpa_s, bss->id); 3203 #ifdef CONFIG_HS20 3204 hs20_notify_parse_done(wpa_s); 3205 #endif /* CONFIG_HS20 */ 3206 out: 3207 wpas_notify_anqp_query_done(wpa_s, dst, anqp_result); 3208 } 3209 3210 3211 static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s, 3212 struct wpa_scan_results *scan_res) 3213 { 3214 wpa_msg(wpa_s, MSG_DEBUG, 3215 "Interworking: Scan results available - start ANQP fetch"); 3216 interworking_start_fetch_anqp(wpa_s); 3217 } 3218 3219 3220 int interworking_select(struct wpa_supplicant *wpa_s, int auto_select, 3221 int *freqs) 3222 { 3223 interworking_stop_fetch_anqp(wpa_s); 3224 wpa_s->network_select = 1; 3225 wpa_s->auto_network_select = 0; 3226 wpa_s->auto_select = !!auto_select; 3227 wpa_s->fetch_all_anqp = 0; 3228 wpa_s->fetch_osu_info = 0; 3229 wpa_msg(wpa_s, MSG_DEBUG, 3230 "Interworking: Start scan for network selection"); 3231 wpa_s->scan_res_handler = interworking_scan_res_handler; 3232 wpa_s->normal_scans = 0; 3233 wpa_s->scan_req = MANUAL_SCAN_REQ; 3234 os_free(wpa_s->manual_scan_freqs); 3235 wpa_s->manual_scan_freqs = freqs; 3236 wpa_s->after_wps = 0; 3237 wpa_s->known_wps_freq = 0; 3238 wpa_supplicant_req_scan(wpa_s, 0, 0); 3239 3240 return 0; 3241 } 3242 3243 3244 static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token, 3245 enum gas_query_result result, 3246 const struct wpabuf *adv_proto, 3247 const struct wpabuf *resp, u16 status_code) 3248 { 3249 struct wpa_supplicant *wpa_s = ctx; 3250 struct wpabuf *n; 3251 3252 wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR 3253 " dialog_token=%d status_code=%d resp_len=%d", 3254 MAC2STR(addr), dialog_token, status_code, 3255 resp ? (int) wpabuf_len(resp) : -1); 3256 if (!resp) 3257 return; 3258 3259 n = wpabuf_dup(resp); 3260 if (n == NULL) 3261 return; 3262 wpabuf_free(wpa_s->prev_gas_resp); 3263 wpa_s->prev_gas_resp = wpa_s->last_gas_resp; 3264 os_memcpy(wpa_s->prev_gas_addr, wpa_s->last_gas_addr, ETH_ALEN); 3265 wpa_s->prev_gas_dialog_token = wpa_s->last_gas_dialog_token; 3266 wpa_s->last_gas_resp = n; 3267 os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN); 3268 wpa_s->last_gas_dialog_token = dialog_token; 3269 } 3270 3271 3272 int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst, 3273 const struct wpabuf *adv_proto, 3274 const struct wpabuf *query) 3275 { 3276 struct wpabuf *buf; 3277 int ret = 0; 3278 int freq; 3279 struct wpa_bss *bss; 3280 int res; 3281 size_t len; 3282 u8 query_resp_len_limit = 0; 3283 3284 freq = wpa_s->assoc_freq; 3285 bss = wpa_bss_get_bssid_latest(wpa_s, dst); 3286 if (bss) 3287 freq = bss->freq; 3288 if (freq <= 0) 3289 return -1; 3290 3291 wpa_msg(wpa_s, MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)", 3292 MAC2STR(dst), freq); 3293 wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto); 3294 wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query); 3295 3296 len = 3 + wpabuf_len(adv_proto) + 2; 3297 if (query) 3298 len += wpabuf_len(query); 3299 buf = gas_build_initial_req(0, len); 3300 if (buf == NULL) 3301 return -1; 3302 3303 /* Advertisement Protocol IE */ 3304 wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO); 3305 wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */ 3306 wpabuf_put_u8(buf, query_resp_len_limit & 0x7f); 3307 wpabuf_put_buf(buf, adv_proto); 3308 3309 /* GAS Query */ 3310 if (query) { 3311 wpabuf_put_le16(buf, wpabuf_len(query)); 3312 wpabuf_put_buf(buf, query); 3313 } else 3314 wpabuf_put_le16(buf, 0); 3315 3316 res = gas_query_req(wpa_s->gas, dst, freq, 0, 0, buf, gas_resp_cb, 3317 wpa_s); 3318 if (res < 0) { 3319 wpa_msg(wpa_s, MSG_DEBUG, "GAS: Failed to send Query Request"); 3320 wpabuf_free(buf); 3321 ret = -1; 3322 } else 3323 wpa_msg(wpa_s, MSG_DEBUG, 3324 "GAS: Query started with dialog token %u", res); 3325 3326 return ret; 3327 } 3328
Indexes created Thu Jun 25 00:25:11 UTC 2026