Home | History | Annotate | Line # | Download | only in wpa_supplicant
mbo.c revision 1.1.1.3.8.1
      1 /*
      2  * wpa_supplicant - MBO
      3  *
      4  * Copyright(c) 2015 Intel Deutschland GmbH
      5  * Contact Information:
      6  * Intel Linux Wireless <ilw (at) linux.intel.com>
      7  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
      8  *
      9  * This software may be distributed under the terms of the BSD license.
     10  * See README for more details.
     11  */
     12 
     13 #include "utils/includes.h"
     14 
     15 #include "utils/common.h"
     16 #include "common/ieee802_11_defs.h"
     17 #include "common/gas.h"
     18 #include "rsn_supp/wpa.h"
     19 #include "config.h"
     20 #include "wpa_supplicant_i.h"
     21 #include "driver_i.h"
     22 #include "bss.h"
     23 #include "scan.h"
     24 
     25 /* type + length + oui + oui type */
     26 #define MBO_IE_HEADER 6
     27 
     28 
     29 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
     30 {
     31 	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
     32 		return -1;
     33 
     34 	/* Only checking the validity of the channel and oper_class */
     35 	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
     36 		return -1;
     37 
     38 	return 0;
     39 }
     40 
     41 
     42 const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
     43 {
     44 	const u8 *mbo;
     45 	u8 ie_len = mbo_ie[1];
     46 
     47 	if (ie_len < MBO_IE_HEADER - 2)
     48 		return NULL;
     49 	mbo = mbo_ie + MBO_IE_HEADER;
     50 
     51 	return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
     52 }
     53 
     54 
     55 const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
     56 				 enum mbo_attr_id attr)
     57 {
     58 	const u8 *mbo_ie;
     59 
     60 	mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
     61 	if (!mbo_ie)
     62 		return NULL;
     63 
     64 	return mbo_attr_from_mbo_ie(mbo_ie, attr);
     65 }
     66 
     67 
     68 static const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss,
     69 					enum mbo_attr_id attr, bool beacon)
     70 {
     71 	const u8 *mbo, *end;
     72 
     73 	if (!bss)
     74 		return NULL;
     75 
     76 	if (beacon)
     77 		mbo = wpa_bss_get_vendor_ie_beacon(bss, MBO_IE_VENDOR_TYPE);
     78 	else
     79 		mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
     80 	if (!mbo)
     81 		return NULL;
     82 
     83 	end = mbo + 2 + mbo[1];
     84 	mbo += MBO_IE_HEADER;
     85 
     86 	return get_ie(mbo, end - mbo, attr);
     87 }
     88 
     89 
     90 const u8 * wpas_mbo_check_assoc_disallow(struct wpa_bss *bss)
     91 {
     92 	const u8 *assoc_disallow;
     93 
     94 	assoc_disallow = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_ASSOC_DISALLOW,
     95 					       bss->beacon_newer);
     96 	if (assoc_disallow && assoc_disallow[1] >= 1)
     97 		return assoc_disallow;
     98 
     99 	return NULL;
    100 }
    101 
    102 
    103 void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
    104 			struct wpa_ssid *ssid)
    105 {
    106 	const u8 *rsne, *mbo, *oce;
    107 	struct wpa_ie_data ie;
    108 
    109 	wpa_s->disable_mbo_oce = 0;
    110 	if (!bss)
    111 		return;
    112 	mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND, false);
    113 	oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND, false);
    114 	if (!mbo && !oce)
    115 		return;
    116 	if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
    117 		return; /* STA-CFON is not required to enable PMF */
    118 	rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
    119 	if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
    120 		return; /* AP is not using RSN */
    121 
    122 	if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
    123 		wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
    124 	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
    125 		wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
    126 	if (wpa_s->disable_mbo_oce)
    127 		wpa_printf(MSG_INFO,
    128 			   "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
    129 }
    130 
    131 
    132 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
    133 					     struct wpabuf *mbo,
    134 					     u8 start, u8 end)
    135 {
    136 	u8 i;
    137 
    138 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
    139 
    140 	for (i = start; i < end; i++)
    141 		wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
    142 
    143 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
    144 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
    145 }
    146 
    147 
    148 static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
    149 {
    150 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
    151 	wpabuf_put_u8(mbo, size); /* Length */
    152 }
    153 
    154 
    155 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
    156 					struct wpabuf *mbo, u8 start, u8 end)
    157 {
    158 	size_t size = end - start + 3;
    159 
    160 	if (size + 2 > wpabuf_tailroom(mbo))
    161 		return;
    162 
    163 	wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
    164 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
    165 }
    166 
    167 
    168 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
    169 {
    170 	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
    171 	wpabuf_put_u8(mbo, len); /* Length */
    172 	wpabuf_put_be24(mbo, OUI_WFA);
    173 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
    174 }
    175 
    176 
    177 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
    178 					      struct wpabuf *mbo, u8 start,
    179 					      u8 end)
    180 {
    181 	size_t size = end - start + 7;
    182 
    183 	if (size + 2 > wpabuf_tailroom(mbo))
    184 		return;
    185 
    186 	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
    187 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
    188 }
    189 
    190 
    191 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
    192 					 struct wpabuf *mbo, int subelement)
    193 {
    194 	u8 i, start = 0;
    195 	struct wpa_mbo_non_pref_channel *start_pref;
    196 
    197 	if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
    198 		if (subelement)
    199 			wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
    200 		else
    201 			wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
    202 		return;
    203 	}
    204 	start_pref = &wpa_s->non_pref_chan[0];
    205 
    206 	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
    207 		struct wpa_mbo_non_pref_channel *non_pref = NULL;
    208 
    209 		if (i < wpa_s->non_pref_chan_num)
    210 			non_pref = &wpa_s->non_pref_chan[i];
    211 		if (!non_pref ||
    212 		    non_pref->oper_class != start_pref->oper_class ||
    213 		    non_pref->reason != start_pref->reason ||
    214 		    non_pref->preference != start_pref->preference) {
    215 			if (subelement)
    216 				wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
    217 								  start, i);
    218 			else
    219 				wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
    220 							    i);
    221 
    222 			if (!non_pref)
    223 				return;
    224 
    225 			start = i;
    226 			start_pref = non_pref;
    227 		}
    228 	}
    229 }
    230 
    231 
    232 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len,
    233 		int add_oce_capa)
    234 {
    235 	struct wpabuf *mbo;
    236 	int res;
    237 
    238 	if (len < MBO_IE_HEADER + 3 + 7 +
    239 	    ((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
    240 		return 0;
    241 
    242 	/* Leave room for the MBO IE header */
    243 	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
    244 	if (!mbo)
    245 		return 0;
    246 
    247 	/* Add non-preferred channels attribute */
    248 	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
    249 
    250 	/*
    251 	 * Send cellular capabilities attribute even if AP does not advertise
    252 	 * cellular capabilities.
    253 	 */
    254 	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
    255 	wpabuf_put_u8(mbo, 1);
    256 	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
    257 
    258 	/* Add OCE capability indication attribute if OCE is enabled */
    259 	if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
    260 		wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
    261 		wpabuf_put_u8(mbo, 1);
    262 		wpabuf_put_u8(mbo, OCE_RELEASE);
    263 	}
    264 
    265 	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
    266 	if (!res)
    267 		wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");
    268 
    269 	wpabuf_free(mbo);
    270 	return res;
    271 }
    272 
    273 
    274 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
    275 					   const u8 *data, size_t len)
    276 {
    277 	struct wpabuf *buf;
    278 	int res;
    279 
    280 	/*
    281 	 * Send WNM-Notification Request frame only in case of a change in
    282 	 * non-preferred channels list during association, if the AP supports
    283 	 * MBO.
    284 	 */
    285 	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
    286 	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
    287 		return;
    288 
    289 	buf = wpabuf_alloc(4 + len);
    290 	if (!buf)
    291 		return;
    292 
    293 	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
    294 	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
    295 	wpa_s->mbo_wnm_token++;
    296 	if (wpa_s->mbo_wnm_token == 0)
    297 		wpa_s->mbo_wnm_token++;
    298 	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
    299 	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
    300 
    301 	wpabuf_put_data(buf, data, len);
    302 
    303 	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
    304 				  wpa_s->own_addr, wpa_s->bssid,
    305 				  wpabuf_head(buf), wpabuf_len(buf), 0);
    306 	if (res < 0)
    307 		wpa_printf(MSG_DEBUG,
    308 			   "Failed to send WNM-Notification Request frame with non-preferred channel list");
    309 
    310 	wpabuf_free(buf);
    311 }
    312 
    313 
    314 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
    315 {
    316 	struct wpabuf *buf;
    317 
    318 	buf = wpabuf_alloc(512);
    319 	if (!buf)
    320 		return;
    321 
    322 	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
    323 	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
    324 				       wpabuf_len(buf));
    325 	wpas_update_mbo_connect_params(wpa_s);
    326 	wpabuf_free(buf);
    327 }
    328 
    329 
    330 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
    331 				   struct wpa_mbo_non_pref_channel *b)
    332 {
    333 	return a->oper_class == b->oper_class && a->chan == b->chan;
    334 }
    335 
    336 
    337 /*
    338  * wpa_non_pref_chan_cmp - Compare two channels for sorting
    339  *
    340  * In MBO IE non-preferred channel subelement we can put many channels in an
    341  * attribute if they are in the same operating class and have the same
    342  * preference and reason. To make it easy for the functions that build
    343  * the IE attributes and WNM Request subelements, save the channels sorted
    344  * by their oper_class and reason.
    345  */
    346 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
    347 {
    348 	const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
    349 
    350 	if (a->oper_class != b->oper_class)
    351 		return (int) a->oper_class - (int) b->oper_class;
    352 	if (a->reason != b->reason)
    353 		return (int) a->reason - (int) b->reason;
    354 	return (int) a->preference - (int) b->preference;
    355 }
    356 
    357 
    358 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
    359 				  const char *non_pref_chan)
    360 {
    361 	char *cmd, *token, *context = NULL;
    362 	struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
    363 	size_t num = 0, size = 0;
    364 	unsigned i;
    365 
    366 	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
    367 		   non_pref_chan ? non_pref_chan : "N/A");
    368 
    369 	/*
    370 	 * The shortest channel configuration is 7 characters - 3 colons and
    371 	 * 4 values.
    372 	 */
    373 	if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
    374 		goto update;
    375 
    376 	cmd = os_strdup(non_pref_chan);
    377 	if (!cmd)
    378 		return -1;
    379 
    380 	while ((token = str_token(cmd, " ", &context))) {
    381 		struct wpa_mbo_non_pref_channel *chan;
    382 		int ret;
    383 		unsigned int _oper_class;
    384 		unsigned int _chan;
    385 		unsigned int _preference;
    386 		unsigned int _reason;
    387 
    388 		if (num == size) {
    389 			size = size ? size * 2 : 1;
    390 			tmp_chans = os_realloc_array(chans, size,
    391 						     sizeof(*chans));
    392 			if (!tmp_chans) {
    393 				wpa_printf(MSG_ERROR,
    394 					   "Couldn't reallocate non_pref_chan");
    395 				goto fail;
    396 			}
    397 			chans = tmp_chans;
    398 		}
    399 
    400 		chan = &chans[num];
    401 
    402 		ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
    403 			     &_chan, &_preference, &_reason);
    404 		if (ret != 4 ||
    405 		    _oper_class > 255 || _chan > 255 ||
    406 		    _preference > 255 || _reason > 65535 ) {
    407 			wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
    408 				   token);
    409 			goto fail;
    410 		}
    411 		chan->oper_class = _oper_class;
    412 		chan->chan = _chan;
    413 		chan->preference = _preference;
    414 		chan->reason = _reason;
    415 
    416 		if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
    417 						    chan->chan, chan->reason)) {
    418 			wpa_printf(MSG_ERROR,
    419 				   "Invalid non_pref_chan: oper class %d chan %d reason %d",
    420 				   chan->oper_class, chan->chan, chan->reason);
    421 			goto fail;
    422 		}
    423 
    424 		for (i = 0; i < num; i++)
    425 			if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
    426 				break;
    427 		if (i != num) {
    428 			wpa_printf(MSG_ERROR,
    429 				   "oper class %d chan %d is duplicated",
    430 				   chan->oper_class, chan->chan);
    431 			goto fail;
    432 		}
    433 
    434 		num++;
    435 	}
    436 
    437 	os_free(cmd);
    438 
    439 	if (chans) {
    440 		qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
    441 		      wpa_non_pref_chan_cmp);
    442 	}
    443 
    444 update:
    445 	os_free(wpa_s->non_pref_chan);
    446 	wpa_s->non_pref_chan = chans;
    447 	wpa_s->non_pref_chan_num = num;
    448 	wpas_mbo_non_pref_chan_changed(wpa_s);
    449 
    450 	return 0;
    451 
    452 fail:
    453 	os_free(chans);
    454 	os_free(cmd);
    455 	return -1;
    456 }
    457 
    458 
    459 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
    460 {
    461 	u8 *len;
    462 
    463 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
    464 	len = wpabuf_put(ie, 1);
    465 
    466 	wpabuf_put_be24(ie, OUI_WFA);
    467 	wpabuf_put_u8(ie, MBO_OUI_TYPE);
    468 
    469 	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
    470 	wpabuf_put_u8(ie, 1);
    471 	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
    472 	if (wpa_s->enable_oce & OCE_STA) {
    473 		wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
    474 		wpabuf_put_u8(ie, 1);
    475 		wpabuf_put_u8(ie, OCE_RELEASE);
    476 	}
    477 	*len = (u8 *) wpabuf_put(ie, 0) - len - 1;
    478 }
    479 
    480 
    481 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
    482 			   size_t len)
    483 {
    484 	const u8 *pos, *cell_pref = NULL;
    485 	u8 id, elen;
    486 	u16 disallowed_sec = 0;
    487 
    488 	if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
    489 	    mbo_ie[3] != MBO_OUI_TYPE)
    490 		return;
    491 
    492 	pos = mbo_ie + 4;
    493 	len -= 4;
    494 
    495 	while (len >= 2) {
    496 		id = *pos++;
    497 		elen = *pos++;
    498 		len -= 2;
    499 
    500 		if (elen > len)
    501 			goto fail;
    502 
    503 		switch (id) {
    504 		case MBO_ATTR_ID_CELL_DATA_PREF:
    505 			if (elen != 1)
    506 				goto fail;
    507 
    508 			if (wpa_s->conf->mbo_cell_capa ==
    509 			    MBO_CELL_CAPA_AVAILABLE)
    510 				cell_pref = pos;
    511 			else
    512 				wpa_printf(MSG_DEBUG,
    513 					   "MBO: Station does not support Cellular data connection");
    514 			break;
    515 		case MBO_ATTR_ID_TRANSITION_REASON:
    516 			if (elen != 1)
    517 				goto fail;
    518 
    519 			wpa_s->wnm_mbo_trans_reason_present = 1;
    520 			wpa_s->wnm_mbo_transition_reason = *pos;
    521 			break;
    522 		case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
    523 			if (elen != 2)
    524 				goto fail;
    525 
    526 			if (wpa_s->wnm_mode &
    527 			    WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
    528 				wpa_printf(MSG_DEBUG,
    529 					   "MBO: Unexpected association retry delay, BSS is terminating");
    530 				goto fail;
    531 			} else if (wpa_s->wnm_mode &
    532 				   WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
    533 				disallowed_sec = WPA_GET_LE16(pos);
    534 				wpa_printf(MSG_DEBUG,
    535 					   "MBO: Association retry delay: %u",
    536 					   disallowed_sec);
    537 			} else {
    538 				wpa_printf(MSG_DEBUG,
    539 					   "MBO: Association retry delay attribute not in disassoc imminent mode");
    540 			}
    541 
    542 			break;
    543 		case MBO_ATTR_ID_AP_CAPA_IND:
    544 		case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
    545 		case MBO_ATTR_ID_CELL_DATA_CAPA:
    546 		case MBO_ATTR_ID_ASSOC_DISALLOW:
    547 		case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
    548 			wpa_printf(MSG_DEBUG,
    549 				   "MBO: Attribute %d should not be included in BTM Request frame",
    550 				   id);
    551 			break;
    552 		default:
    553 			wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
    554 				   id);
    555 			return;
    556 		}
    557 
    558 		pos += elen;
    559 		len -= elen;
    560 	}
    561 
    562 	if (cell_pref)
    563 		wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
    564 			*cell_pref);
    565 
    566 	if (wpa_s->wnm_mbo_trans_reason_present)
    567 		wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
    568 			wpa_s->wnm_mbo_transition_reason);
    569 
    570 	if (disallowed_sec && wpa_s->current_bss)
    571 		wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
    572 				     disallowed_sec, 0);
    573 
    574 	return;
    575 fail:
    576 	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
    577 		   id, elen, len);
    578 }
    579 
    580 
    581 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
    582 				    size_t len,
    583 				    enum mbo_transition_reject_reason reason)
    584 {
    585 	u8 reject_attr[3];
    586 
    587 	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
    588 	reject_attr[1] = 1;
    589 	reject_attr[2] = reason;
    590 
    591 	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
    592 }
    593 
    594 
    595 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
    596 {
    597 	u8 cell_capa[7];
    598 
    599 	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
    600 		wpa_printf(MSG_DEBUG,
    601 			   "MBO: Cellular capability already set to %u",
    602 			   mbo_cell_capa);
    603 		return;
    604 	}
    605 
    606 	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
    607 
    608 	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
    609 	cell_capa[1] = 5; /* Length */
    610 	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
    611 	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
    612 	cell_capa[6] = mbo_cell_capa;
    613 
    614 	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
    615 	wpa_supplicant_set_default_scan_ies(wpa_s);
    616 	wpas_update_mbo_connect_params(wpa_s);
    617 }
    618 
    619 
    620 struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
    621 				   struct wpa_bss *bss, u32 mbo_subtypes)
    622 {
    623 	struct wpabuf *anqp_buf;
    624 	u8 *len_pos;
    625 	u8 i;
    626 
    627 	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
    628 		wpa_printf(MSG_INFO, "MBO: " MACSTR
    629 			   " does not support MBO - cannot request MBO ANQP elements from it",
    630 			   MAC2STR(bss->bssid));
    631 		return NULL;
    632 	}
    633 
    634 	/* Allocate size for the maximum case - all MBO subtypes are set */
    635 	anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
    636 	if (!anqp_buf)
    637 		return NULL;
    638 
    639 	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
    640 	wpabuf_put_be24(anqp_buf, OUI_WFA);
    641 	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
    642 
    643 	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);
    644 
    645 	/* The first valid MBO subtype is 1 */
    646 	for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
    647 		if (mbo_subtypes & BIT(i))
    648 			wpabuf_put_u8(anqp_buf, i);
    649 	}
    650 
    651 	gas_anqp_set_element_len(anqp_buf, len_pos);
    652 
    653 	return anqp_buf;
    654 }
    655 
    656 
    657 void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
    658 			    struct wpa_bss *bss, const u8 *sa,
    659 			    const u8 *data, size_t slen)
    660 {
    661 	const u8 *pos = data;
    662 	u8 subtype;
    663 
    664 	if (slen < 1)
    665 		return;
    666 
    667 	subtype = *pos++;
    668 	slen--;
    669 
    670 	switch (subtype) {
    671 	case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
    672 		if (slen < 1)
    673 			break;
    674 		wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
    675 			" cell_conn_pref=%u", MAC2STR(sa), *pos);
    676 		break;
    677 	default:
    678 		wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
    679 			   subtype);
    680 		break;
    681 	}
    682 }
    683