[thirdparty/hostap.git] / wpa_supplicant / mbo.c

/*
 * wpa_supplicant - MBO
 *
 * Copyright(c) 2015 Intel Deutschland GmbH
 * Contact Information:
 * Intel Linux Wireless <ilw@linux.intel.com>
 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#include "utils/includes.h"

#include "utils/common.h"
#include "common/ieee802_11_defs.h"
#include "common/gas.h"
#include "rsn_supp/wpa.h"
#include "config.h"
#include "wpa_supplicant_i.h"
#include "driver_i.h"
#include "bss.h"
#include "scan.h"

/* type + length + oui + oui type */
#define MBO_IE_HEADER 6


static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
{
	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
		return -1;

	/* Only checking the validity of the channel and oper_class */
	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
		return -1;

	return 0;
}


const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
{
	const u8 *mbo;
	u8 ie_len = mbo_ie[1];

	if (ie_len < MBO_IE_HEADER - 2)
		return NULL;
	mbo = mbo_ie + MBO_IE_HEADER;

	return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
}


const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
				 enum mbo_attr_id attr)
{
	const u8 *mbo_ie;

	mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
	if (!mbo_ie)
		return NULL;

	return mbo_attr_from_mbo_ie(mbo_ie, attr);
}


const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
{
	const u8 *mbo, *end;

	if (!bss)
		return NULL;

	mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
	if (!mbo)
		return NULL;

	end = mbo + 2 + mbo[1];
	mbo += MBO_IE_HEADER;

	return get_ie(mbo, end - mbo, attr);
}


void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
			struct wpa_ssid *ssid)
{
	const u8 *rsne, *mbo, *oce;
	struct wpa_ie_data ie;

	wpa_s->disable_mbo_oce = 0;
	if (!bss)
		return;
	mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND);
	oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND);
	if (!mbo && !oce)
		return;
	if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
		return; /* STA-CFON is not required to enable PMF */
	rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
	if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
		return; /* AP is not using RSN */

	if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
		wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
		wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
	if (wpa_s->disable_mbo_oce)
		wpa_printf(MSG_INFO,
			   "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
}


static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
					     struct wpabuf *mbo,
					     u8 start, u8 end)
{
	u8 i;

	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);

	for (i = start; i < end; i++)
		wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);

	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
}


static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
{
	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
	wpabuf_put_u8(mbo, size); /* Length */
}


static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
					struct wpabuf *mbo, u8 start, u8 end)
{
	size_t size = end - start + 3;

	if (size + 2 > wpabuf_tailroom(mbo))
		return;

	wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
}


static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
{
	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
	wpabuf_put_u8(mbo, len); /* Length */
	wpabuf_put_be24(mbo, OUI_WFA);
	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
}


static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
					      struct wpabuf *mbo, u8 start,
					      u8 end)
{
	size_t size = end - start + 7;

	if (size + 2 > wpabuf_tailroom(mbo))
		return;

	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
}


static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
					 struct wpabuf *mbo, int subelement)
{
	u8 i, start = 0;
	struct wpa_mbo_non_pref_channel *start_pref;

	if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
		if (subelement)
			wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
		else
			wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
		return;
	}
	start_pref = &wpa_s->non_pref_chan[0];

	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
		struct wpa_mbo_non_pref_channel *non_pref = NULL;

		if (i < wpa_s->non_pref_chan_num)
			non_pref = &wpa_s->non_pref_chan[i];
		if (!non_pref ||
		    non_pref->oper_class != start_pref->oper_class ||
		    non_pref->reason != start_pref->reason ||
		    non_pref->preference != start_pref->preference) {
			if (subelement)
				wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
								  start, i);
			else
				wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
							    i);

			if (!non_pref)
				return;

			start = i;
			start_pref = non_pref;
		}
	}
}


int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len,
		int add_oce_capa)
{
	struct wpabuf *mbo;
	int res;

	if (len < MBO_IE_HEADER + 3 + 7 +
	    ((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
		return 0;

	/* Leave room for the MBO IE header */
	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
	if (!mbo)
		return 0;

	/* Add non-preferred channels attribute */
	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);

	/*
	 * Send cellular capabilities attribute even if AP does not advertise
	 * cellular capabilities.
	 */
	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
	wpabuf_put_u8(mbo, 1);
	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);

	/* Add OCE capability indication attribute if OCE is enabled */
	if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
		wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
		wpabuf_put_u8(mbo, 1);
		wpabuf_put_u8(mbo, OCE_RELEASE);
	}

	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
	if (!res)
		wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");

	wpabuf_free(mbo);
	return res;
}


static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
					   const u8 *data, size_t len)
{
	struct wpabuf *buf;
	int res;

	/*
	 * Send WNM-Notification Request frame only in case of a change in
	 * non-preferred channels list during association, if the AP supports
	 * MBO.
	 */
	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
		return;

	buf = wpabuf_alloc(4 + len);
	if (!buf)
		return;

	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
	wpa_s->mbo_wnm_token++;
	if (wpa_s->mbo_wnm_token == 0)
		wpa_s->mbo_wnm_token++;
	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */

	wpabuf_put_data(buf, data, len);

	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
				  wpa_s->own_addr, wpa_s->bssid,
				  wpabuf_head(buf), wpabuf_len(buf), 0);
	if (res < 0)
		wpa_printf(MSG_DEBUG,
			   "Failed to send WNM-Notification Request frame with non-preferred channel list");

	wpabuf_free(buf);
}


static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
{
	struct wpabuf *buf;

	buf = wpabuf_alloc(512);
	if (!buf)
		return;

	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
				       wpabuf_len(buf));
	wpas_update_mbo_connect_params(wpa_s);
	wpabuf_free(buf);
}


static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
				   struct wpa_mbo_non_pref_channel *b)
{
	return a->oper_class == b->oper_class && a->chan == b->chan;
}


/*
 * wpa_non_pref_chan_cmp - Compare two channels for sorting
 *
 * In MBO IE non-preferred channel subelement we can put many channels in an
 * attribute if they are in the same operating class and have the same
 * preference and reason. To make it easy for the functions that build
 * the IE attributes and WNM Request subelements, save the channels sorted
 * by their oper_class and reason.
 */
static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
{
	const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;

	if (a->oper_class != b->oper_class)
		return (int) a->oper_class - (int) b->oper_class;
	if (a->reason != b->reason)
		return (int) a->reason - (int) b->reason;
	return (int) a->preference - (int) b->preference;
}


int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
				  const char *non_pref_chan)
{
	char *cmd, *token, *context = NULL;
	struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
	size_t num = 0, size = 0;
	unsigned i;

	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
		   non_pref_chan ? non_pref_chan : "N/A");

	/*
	 * The shortest channel configuration is 7 characters - 3 colons and
	 * 4 values.
	 */
	if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
		goto update;

	cmd = os_strdup(non_pref_chan);
	if (!cmd)
		return -1;

	while ((token = str_token(cmd, " ", &context))) {
		struct wpa_mbo_non_pref_channel *chan;
		int ret;
		unsigned int _oper_class;
		unsigned int _chan;
		unsigned int _preference;
		unsigned int _reason;

		if (num == size) {
			size = size ? size * 2 : 1;
			tmp_chans = os_realloc_array(chans, size,
						     sizeof(*chans));
			if (!tmp_chans) {
				wpa_printf(MSG_ERROR,
					   "Couldn't reallocate non_pref_chan");
				goto fail;
			}
			chans = tmp_chans;
		}

		chan = &chans[num];

		ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
			     &_chan, &_preference, &_reason);
		if (ret != 4 ||
		    _oper_class > 255 || _chan > 255 ||
		    _preference > 255 || _reason > 65535 ) {
			wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
				   token);
			goto fail;
		}
		chan->oper_class = _oper_class;
		chan->chan = _chan;
		chan->preference = _preference;
		chan->reason = _reason;

		if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
						    chan->chan, chan->reason)) {
			wpa_printf(MSG_ERROR,
				   "Invalid non_pref_chan: oper class %d chan %d reason %d",
				   chan->oper_class, chan->chan, chan->reason);
			goto fail;
		}

		for (i = 0; i < num; i++)
			if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
				break;
		if (i != num) {
			wpa_printf(MSG_ERROR,
				   "oper class %d chan %d is duplicated",
				   chan->oper_class, chan->chan);
			goto fail;
		}

		num++;
	}

	os_free(cmd);

	if (chans) {
		qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
		      wpa_non_pref_chan_cmp);
	}

update:
	os_free(wpa_s->non_pref_chan);
	wpa_s->non_pref_chan = chans;
	wpa_s->non_pref_chan_num = num;
	wpas_mbo_non_pref_chan_changed(wpa_s);

	return 0;

fail:
	os_free(chans);
	os_free(cmd);
	return -1;
}


void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
{
	u8 *len;

	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
	len = wpabuf_put(ie, 1);

	wpabuf_put_be24(ie, OUI_WFA);
	wpabuf_put_u8(ie, MBO_OUI_TYPE);

	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
	wpabuf_put_u8(ie, 1);
	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
	if (wpa_s->enable_oce & OCE_STA) {
		wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
		wpabuf_put_u8(ie, 1);
		wpabuf_put_u8(ie, OCE_RELEASE);
	}
	*len = (u8 *) wpabuf_put(ie, 0) - len - 1;
}


void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
			   size_t len)
{
	const u8 *pos, *cell_pref = NULL;
	u8 id, elen;
	u16 disallowed_sec = 0;

	if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
	    mbo_ie[3] != MBO_OUI_TYPE)
		return;

	pos = mbo_ie + 4;
	len -= 4;

	while (len >= 2) {
		id = *pos++;
		elen = *pos++;
		len -= 2;

		if (elen > len)
			goto fail;

		switch (id) {
		case MBO_ATTR_ID_CELL_DATA_PREF:
			if (elen != 1)
				goto fail;

			if (wpa_s->conf->mbo_cell_capa ==
			    MBO_CELL_CAPA_AVAILABLE)
				cell_pref = pos;
			else
				wpa_printf(MSG_DEBUG,
					   "MBO: Station does not support Cellular data connection");
			break;
		case MBO_ATTR_ID_TRANSITION_REASON:
			if (elen != 1)
				goto fail;

			wpa_s->wnm_mbo_trans_reason_present = 1;
			wpa_s->wnm_mbo_transition_reason = *pos;
			break;
		case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
			if (elen != 2)
				goto fail;

			if (wpa_s->wnm_mode &
			    WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
				wpa_printf(MSG_DEBUG,
					   "MBO: Unexpected association retry delay, BSS is terminating");
				goto fail;
			} else if (wpa_s->wnm_mode &
				   WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
				disallowed_sec = WPA_GET_LE16(pos);
				wpa_printf(MSG_DEBUG,
					   "MBO: Association retry delay: %u",
					   disallowed_sec);
			} else {
				wpa_printf(MSG_DEBUG,
					   "MBO: Association retry delay attribute not in disassoc imminent mode");
			}

			break;
		case MBO_ATTR_ID_AP_CAPA_IND:
		case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
		case MBO_ATTR_ID_CELL_DATA_CAPA:
		case MBO_ATTR_ID_ASSOC_DISALLOW:
		case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
			wpa_printf(MSG_DEBUG,
				   "MBO: Attribute %d should not be included in BTM Request frame",
				   id);
			break;
		default:
			wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
				   id);
			return;
		}

		pos += elen;
		len -= elen;
	}

	if (cell_pref)
		wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
			*cell_pref);

	if (wpa_s->wnm_mbo_trans_reason_present)
		wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
			wpa_s->wnm_mbo_transition_reason);

	if (disallowed_sec && wpa_s->current_bss)
		wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
				     disallowed_sec, 0);

	return;
fail:
	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
		   id, elen, len);
}


size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
				    size_t len,
				    enum mbo_transition_reject_reason reason)
{
	u8 reject_attr[3];

	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
	reject_attr[1] = 1;
	reject_attr[2] = reason;

	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
}


void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
{
	u8 cell_capa[7];

	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
		wpa_printf(MSG_DEBUG,
			   "MBO: Cellular capability already set to %u",
			   mbo_cell_capa);
		return;
	}

	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;

	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
	cell_capa[1] = 5; /* Length */
	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
	cell_capa[6] = mbo_cell_capa;

	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
	wpa_supplicant_set_default_scan_ies(wpa_s);
	wpas_update_mbo_connect_params(wpa_s);
}


struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
				   struct wpa_bss *bss, u32 mbo_subtypes)
{
	struct wpabuf *anqp_buf;
	u8 *len_pos;
	u8 i;

	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
		wpa_printf(MSG_INFO, "MBO: " MACSTR
			   " does not support MBO - cannot request MBO ANQP elements from it",
			   MAC2STR(bss->bssid));
		return NULL;
	}

	/* Allocate size for the maximum case - all MBO subtypes are set */
	anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
	if (!anqp_buf)
		return NULL;

	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
	wpabuf_put_be24(anqp_buf, OUI_WFA);
	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);

	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);

	/* The first valid MBO subtype is 1 */
	for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
		if (mbo_subtypes & BIT(i))
			wpabuf_put_u8(anqp_buf, i);
	}

	gas_anqp_set_element_len(anqp_buf, len_pos);

	return anqp_buf;
}


void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
			    struct wpa_bss *bss, const u8 *sa,
			    const u8 *data, size_t slen)
{
	const u8 *pos = data;
	u8 subtype;

	if (slen < 1)
		return;

	subtype = *pos++;
	slen--;

	switch (subtype) {
	case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
		if (slen < 1)
			break;
		wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
			" cell_conn_pref=%u", MAC2STR(sa), *pos);
		break;
	default:
		wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
			   subtype);
		break;
	}
}
Commit	Line	Data
92c6e2e3 DS	1	/*
	2	* wpa_supplicant - MBO
	3	*
	4	* Copyright(c) 2015 Intel Deutschland GmbH
	5	* Contact Information:
	6	* Intel Linux Wireless <ilw@linux.intel.com>
	7	* Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
	8	*
	9	* This software may be distributed under the terms of the BSD license.
	10	* See README for more details.
	11	*/
	12
	13	#include "utils/includes.h"
	14
	15	#include "utils/common.h"
	16	#include "common/ieee802_11_defs.h"
8f479174	17	#include "common/gas.h"
2e06cef8	18	#include "rsn_supp/wpa.h"
92c6e2e3 DS	19	#include "config.h"
	20	#include "wpa_supplicant_i.h"
	21	#include "driver_i.h"
	22	#include "bss.h"
cc9985d1	23	#include "scan.h"
92c6e2e3 DS	24
	25	/* type + length + oui + oui type */
	26	#define MBO_IE_HEADER 6
	27
	28
	29	static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
	30	{
	31	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
	32	return -1;
	33
	34	/* Only checking the validity of the channel and oper_class */
	35	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
	36	return -1;
	37
	38	return 0;
	39	}
	40
	41
077232f6 BL	42	const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
	43	{
	44	const u8 *mbo;
	45	u8 ie_len = mbo_ie[1];
	46
	47	if (ie_len < MBO_IE_HEADER - 2)
	48	return NULL;
	49	mbo = mbo_ie + MBO_IE_HEADER;
	50
	51	return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
	52	}
	53
	54
19677b77 BL	55	const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
	56	enum mbo_attr_id attr)
	57	{
	58	const u8 *mbo_ie;
	59
	60	mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
	61	if (!mbo_ie)
	62	return NULL;
	63
	64	return mbo_attr_from_mbo_ie(mbo_ie, attr);
	65	}
	66
	67
cb06cf34 DS	68	const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
	69	{
	70	const u8 mbo, end;
	71
	72	if (!bss)
	73	return NULL;
	74
	75	mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
	76	if (!mbo)
	77	return NULL;
	78
	79	end = mbo + 2 + mbo[1];
	80	mbo += MBO_IE_HEADER;
	81
	82	return get_ie(mbo, end - mbo, attr);
	83	}
	84
	85
2e06cef8 VK	86	void wpas_mbo_check_pmf(struct wpa_supplicant wpa_s, struct wpa_bss bss,
	87	struct wpa_ssid *ssid)
	88	{
	89	const u8 rsne, mbo, *oce;
	90	struct wpa_ie_data ie;
	91
	92	wpa_s->disable_mbo_oce = 0;
	93	if (!bss)
	94	return;
	95	mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND);
	96	oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND);
	97	if (!mbo && !oce)
	98	return;
	99	if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
	100	return; /* STA-CFON is not required to enable PMF */
	101	rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
	102	if (!rsne \|\| wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
	103	return; /* AP is not using RSN */
	104
	105	if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
	106	wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
	107	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
	108	wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
	109	if (wpa_s->disable_mbo_oce)
	110	wpa_printf(MSG_INFO,
	111	"MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
	112	}
	113
	114
92c6e2e3 DS	115	static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
	116	struct wpabuf *mbo,
	117	u8 start, u8 end)
	118	{
	119	u8 i;
	120
	121	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
	122
	123	for (i = start; i < end; i++)
	124	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
	125
	126	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
	127	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
92c6e2e3 DS	128	}
	129
	130
74f8e768 AB	131	static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
	132	{
	133	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
	134	wpabuf_put_u8(mbo, size); /* Length */
	135	}
	136
	137
92c6e2e3 DS	138	static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
	139	struct wpabuf *mbo, u8 start, u8 end)
	140	{
4a83d4b6	141	size_t size = end - start + 3;
92c6e2e3 DS	142
	143	if (size + 2 > wpabuf_tailroom(mbo))
	144	return;
	145
74f8e768	146	wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
92c6e2e3 DS	147	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
	148	}
	149
	150
2d5b8614 DS	151	static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
	152	{
	153	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
	154	wpabuf_put_u8(mbo, len); /* Length */
	155	wpabuf_put_be24(mbo, OUI_WFA);
	156	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
	157	}
	158
	159
	160	static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
	161	struct wpabuf *mbo, u8 start,
	162	u8 end)
	163	{
4a83d4b6	164	size_t size = end - start + 7;
2d5b8614 DS	165
	166	if (size + 2 > wpabuf_tailroom(mbo))
	167	return;
	168
	169	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
	170	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
	171	}
	172
92c6e2e3	173
2d5b8614 DS	174	static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
2d5b8614 DS	175	struct wpabuf *mbo, int subelement)
92c6e2e3 DS	176	{
	177	u8 i, start = 0;
	178	struct wpa_mbo_non_pref_channel *start_pref;
	179
2d5b8614 DS	180	if (!wpa_s->non_pref_chan \|\| !wpa_s->non_pref_chan_num) {
	181	if (subelement)
	182	wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
74f8e768 AB	183	else
74f8e768 AB	184	wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
92c6e2e3	185	return;
2d5b8614	186	}
92c6e2e3 DS	187	start_pref = &wpa_s->non_pref_chan[0];
	188
	189	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
	190	struct wpa_mbo_non_pref_channel *non_pref = NULL;
	191
	192	if (i < wpa_s->non_pref_chan_num)
	193	non_pref = &wpa_s->non_pref_chan[i];
	194	if (!non_pref \|\|
	195	non_pref->oper_class != start_pref->oper_class \|\|
	196	non_pref->reason != start_pref->reason \|\|
92c6e2e3	197	non_pref->preference != start_pref->preference) {
2d5b8614 DS	198	if (subelement)
	199	wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
	200	start, i);
	201	else
	202	wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
	203	i);
92c6e2e3 DS	204
	205	if (!non_pref)
	206	return;
	207
	208	start = i;
	209	start_pref = non_pref;
	210	}
	211	}
	212	}
	213
	214
077232f6 BL	215	int wpas_mbo_ie(struct wpa_supplicant wpa_s, u8 buf, size_t len,
077232f6 BL	216	int add_oce_capa)
92c6e2e3 DS	217	{
	218	struct wpabuf *mbo;
	219	int res;
	220
332aadb8 AP	221	if (len < MBO_IE_HEADER + 3 + 7 +
332aadb8 AP	222	((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
92c6e2e3 DS	223	return 0;
	224
	225	/* Leave room for the MBO IE header */
	226	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
	227	if (!mbo)
	228	return 0;
	229
	230	/* Add non-preferred channels attribute */
2d5b8614	231	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
92c6e2e3	232
c5d193d7 DS	233	/*
	234	* Send cellular capabilities attribute even if AP does not advertise
	235	* cellular capabilities.
	236	*/
	237	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
	238	wpabuf_put_u8(mbo, 1);
	239	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
	240
332aadb8	241	/* Add OCE capability indication attribute if OCE is enabled */
077232f6	242	if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
332aadb8 AP	243	wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
	244	wpabuf_put_u8(mbo, 1);
	245	wpabuf_put_u8(mbo, OCE_RELEASE);
	246	}
	247
92c6e2e3 DS	248	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
92c6e2e3 DS	249	if (!res)
332aadb8	250	wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");
92c6e2e3 DS	251
	252	wpabuf_free(mbo);
	253	return res;
	254	}
	255
	256
016082e9 AS	257	static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
016082e9 AS	258	const u8 *data, size_t len)
2d5b8614 DS	259	{
	260	struct wpabuf *buf;
	261	int res;
	262
	263	/*
	264	* Send WNM-Notification Request frame only in case of a change in
	265	* non-preferred channels list during association, if the AP supports
	266	* MBO.
	267	*/
	268	if (wpa_s->wpa_state != WPA_COMPLETED \|\| !wpa_s->current_bss \|\|
	269	!wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
	270	return;
	271
016082e9	272	buf = wpabuf_alloc(4 + len);
2d5b8614 DS	273	if (!buf)
	274	return;
	275
	276	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
	277	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
	278	wpa_s->mbo_wnm_token++;
	279	if (wpa_s->mbo_wnm_token == 0)
	280	wpa_s->mbo_wnm_token++;
	281	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
	282	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
	283
016082e9	284	wpabuf_put_data(buf, data, len);
2d5b8614 DS	285
	286	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
	287	wpa_s->own_addr, wpa_s->bssid,
	288	wpabuf_head(buf), wpabuf_len(buf), 0);
	289	if (res < 0)
	290	wpa_printf(MSG_DEBUG,
	291	"Failed to send WNM-Notification Request frame with non-preferred channel list");
	292
	293	wpabuf_free(buf);
	294	}
	295
	296
016082e9 AS	297	static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
	298	{
	299	struct wpabuf *buf;
	300
	301	buf = wpabuf_alloc(512);
	302	if (!buf)
	303	return;
	304
	305	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
	306	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
	307	wpabuf_len(buf));
822c756e	308	wpas_update_mbo_connect_params(wpa_s);
016082e9 AS	309	wpabuf_free(buf);
	310	}
	311
	312
92c6e2e3 DS	313	static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
	314	struct wpa_mbo_non_pref_channel *b)
	315	{
	316	return a->oper_class == b->oper_class && a->chan == b->chan;
	317	}
	318
	319
	320	/*
	321	* wpa_non_pref_chan_cmp - Compare two channels for sorting
	322	*
	323	* In MBO IE non-preferred channel subelement we can put many channels in an
	324	* attribute if they are in the same operating class and have the same
4a83d4b6	325	* preference and reason. To make it easy for the functions that build
	326	* the IE attributes and WNM Request subelements, save the channels sorted
	327	* by their oper_class and reason.
92c6e2e3 DS	328	*/
	329	static int wpa_non_pref_chan_cmp(const void _a, const void _b)
	330	{
	331	const struct wpa_mbo_non_pref_channel a = _a, b = _b;
	332
	333	if (a->oper_class != b->oper_class)
2f7bc068	334	return (int) a->oper_class - (int) b->oper_class;
92c6e2e3	335	if (a->reason != b->reason)
2f7bc068 JM	336	return (int) a->reason - (int) b->reason;
2f7bc068 JM	337	return (int) a->preference - (int) b->preference;
92c6e2e3 DS	338	}
	339
	340
	341	int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
	342	const char *non_pref_chan)
	343	{
	344	char cmd, token, *context = NULL;
	345	struct wpa_mbo_non_pref_channel chans = NULL, tmp_chans;
	346	size_t num = 0, size = 0;
	347	unsigned i;
	348
	349	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
	350	non_pref_chan ? non_pref_chan : "N/A");
	351
	352	/*
dca4b503 AP	353	* The shortest channel configuration is 7 characters - 3 colons and
dca4b503 AP	354	* 4 values.
92c6e2e3	355	*/
dca4b503	356	if (!non_pref_chan \|\| os_strlen(non_pref_chan) < 7)
92c6e2e3 DS	357	goto update;
	358
	359	cmd = os_strdup(non_pref_chan);
	360	if (!cmd)
	361	return -1;
	362
	363	while ((token = str_token(cmd, " ", &context))) {
	364	struct wpa_mbo_non_pref_channel *chan;
	365	int ret;
	366	unsigned int _oper_class;
	367	unsigned int _chan;
	368	unsigned int _preference;
	369	unsigned int _reason;
92c6e2e3 DS	370
	371	if (num == size) {
	372	size = size ? size * 2 : 1;
	373	tmp_chans = os_realloc_array(chans, size,
	374	sizeof(*chans));
	375	if (!tmp_chans) {
	376	wpa_printf(MSG_ERROR,
	377	"Couldn't reallocate non_pref_chan");
	378	goto fail;
	379	}
	380	chans = tmp_chans;
	381	}
	382
	383	chan = &chans[num];
	384
4a83d4b6	385	ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
	386	&_chan, &_preference, &_reason);
	387	if (ret != 4 \|\|
92c6e2e3	388	_oper_class > 255 \|\| _chan > 255 \|\|
4a83d4b6	389	_preference > 255 \|\| _reason > 65535 ) {
92c6e2e3 DS	390	wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
	391	token);
	392	goto fail;
	393	}
	394	chan->oper_class = _oper_class;
	395	chan->chan = _chan;
	396	chan->preference = _preference;
	397	chan->reason = _reason;
92c6e2e3 DS	398
	399	if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
	400	chan->chan, chan->reason)) {
	401	wpa_printf(MSG_ERROR,
	402	"Invalid non_pref_chan: oper class %d chan %d reason %d",
	403	chan->oper_class, chan->chan, chan->reason);
	404	goto fail;
	405	}
	406
	407	for (i = 0; i < num; i++)
	408	if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
	409	break;
	410	if (i != num) {
	411	wpa_printf(MSG_ERROR,
	412	"oper class %d chan %d is duplicated",
	413	chan->oper_class, chan->chan);
	414	goto fail;
	415	}
	416
	417	num++;
	418	}
	419
	420	os_free(cmd);
	421
	422	if (chans) {
	423	qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
	424	wpa_non_pref_chan_cmp);
	425	}
	426
	427	update:
	428	os_free(wpa_s->non_pref_chan);
	429	wpa_s->non_pref_chan = chans;
	430	wpa_s->non_pref_chan_num = num;
016082e9	431	wpas_mbo_non_pref_chan_changed(wpa_s);
92c6e2e3 DS	432
	433	return 0;
	434
	435	fail:
	436	os_free(chans);
	437	os_free(cmd);
	438	return -1;
	439	}
c5d193d7 DS	440
	441
	442	void wpas_mbo_scan_ie(struct wpa_supplicant wpa_s, struct wpabuf ie)
	443	{
332aadb8 AP	444	u8 *len;
332aadb8 AP	445
c5d193d7	446	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
332aadb8 AP	447	len = wpabuf_put(ie, 1);
332aadb8 AP	448
c5d193d7 DS	449	wpabuf_put_be24(ie, OUI_WFA);
	450	wpabuf_put_u8(ie, MBO_OUI_TYPE);
	451
	452	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
	453	wpabuf_put_u8(ie, 1);
	454	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
332aadb8 AP	455	if (wpa_s->enable_oce & OCE_STA) {
	456	wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
	457	wpabuf_put_u8(ie, 1);
	458	wpabuf_put_u8(ie, OCE_RELEASE);
	459	}
	460	len = (u8 ) wpabuf_put(ie, 0) - len - 1;
c5d193d7	461	}
5e57ba25 AS	462
5e57ba25 AS	463
dd599908 AS	464	void wpas_mbo_ie_trans_req(struct wpa_supplicant wpa_s, const u8 mbo_ie,
	465	size_t len)
	466	{
af8bc24d	467	const u8 pos, cell_pref = NULL;
dd599908 AS	468	u8 id, elen;
	469	u16 disallowed_sec = 0;
	470
	471	if (len <= 4 \|\| WPA_GET_BE24(mbo_ie) != OUI_WFA \|\|
	472	mbo_ie[3] != MBO_OUI_TYPE)
	473	return;
	474
	475	pos = mbo_ie + 4;
	476	len -= 4;
	477
	478	while (len >= 2) {
	479	id = *pos++;
	480	elen = *pos++;
	481	len -= 2;
	482
	483	if (elen > len)
	484	goto fail;
	485
	486	switch (id) {
	487	case MBO_ATTR_ID_CELL_DATA_PREF:
	488	if (elen != 1)
	489	goto fail;
	490
	491	if (wpa_s->conf->mbo_cell_capa ==
	492	MBO_CELL_CAPA_AVAILABLE)
	493	cell_pref = pos;
	494	else
	495	wpa_printf(MSG_DEBUG,
	496	"MBO: Station does not support Cellular data connection");
	497	break;
	498	case MBO_ATTR_ID_TRANSITION_REASON:
	499	if (elen != 1)
	500	goto fail;
	501
af8bc24d KV	502	wpa_s->wnm_mbo_trans_reason_present = 1;
af8bc24d KV	503	wpa_s->wnm_mbo_transition_reason = *pos;
dd599908 AS	504	break;
	505	case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
	506	if (elen != 2)
	507	goto fail;
	508
	509	if (wpa_s->wnm_mode &
	510	WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
	511	wpa_printf(MSG_DEBUG,
	512	"MBO: Unexpected association retry delay, BSS is terminating");
	513	goto fail;
	514	} else if (wpa_s->wnm_mode &
	515	WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
	516	disallowed_sec = WPA_GET_LE16(pos);
b04854ce AP	517	wpa_printf(MSG_DEBUG,
	518	"MBO: Association retry delay: %u",
	519	disallowed_sec);
dd599908 AS	520	} else {
	521	wpa_printf(MSG_DEBUG,
	522	"MBO: Association retry delay attribute not in disassoc imminent mode");
	523	}
	524
	525	break;
	526	case MBO_ATTR_ID_AP_CAPA_IND:
	527	case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
	528	case MBO_ATTR_ID_CELL_DATA_CAPA:
	529	case MBO_ATTR_ID_ASSOC_DISALLOW:
	530	case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
	531	wpa_printf(MSG_DEBUG,
	532	"MBO: Attribute %d should not be included in BTM Request frame",
	533	id);
	534	break;
	535	default:
	536	wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
	537	id);
	538	return;
	539	}
	540
	541	pos += elen;
	542	len -= elen;
	543	}
	544
	545	if (cell_pref)
	546	wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
	547	*cell_pref);
	548
af8bc24d	549	if (wpa_s->wnm_mbo_trans_reason_present)
dd599908	550	wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
af8bc24d	551	wpa_s->wnm_mbo_transition_reason);
dd599908 AS	552
	553	if (disallowed_sec && wpa_s->current_bss)
	554	wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
19677b77	555	disallowed_sec, 0);
dd599908 AS	556
	557	return;
	558	fail:
	559	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
	560	id, elen, len);
	561	}
c8082d2b AS	562
	563
	564	size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant wpa_s, u8 pos,
	565	size_t len,
	566	enum mbo_transition_reject_reason reason)
	567	{
	568	u8 reject_attr[3];
	569
	570	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
	571	reject_attr[1] = 1;
	572	reject_attr[2] = reason;
	573
	574	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
	575	}
016082e9 AS	576
	577
	578	void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
	579	{
	580	u8 cell_capa[7];
	581
	582	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
	583	wpa_printf(MSG_DEBUG,
	584	"MBO: Cellular capability already set to %u",
	585	mbo_cell_capa);
	586	return;
	587	}
	588
	589	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
	590
	591	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
	592	cell_capa[1] = 5; /* Length */
	593	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
	594	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
	595	cell_capa[6] = mbo_cell_capa;
	596
	597	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
cc9985d1	598	wpa_supplicant_set_default_scan_ies(wpa_s);
822c756e	599	wpas_update_mbo_connect_params(wpa_s);
016082e9	600	}
8f479174	601
	602
	603	struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
2316cb35	604	struct wpa_bss *bss, u32 mbo_subtypes)
8f479174	605	{
	606	struct wpabuf *anqp_buf;
	607	u8 *len_pos;
2316cb35	608	u8 i;
8f479174	609
	610	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
	611	wpa_printf(MSG_INFO, "MBO: " MACSTR
	612	" does not support MBO - cannot request MBO ANQP elements from it",
	613	MAC2STR(bss->bssid));
	614	return NULL;
	615	}
	616
2316cb35 AS	617	/* Allocate size for the maximum case - all MBO subtypes are set */
2316cb35 AS	618	anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
8f479174	619	if (!anqp_buf)
	620	return NULL;
	621
	622	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
	623	wpabuf_put_be24(anqp_buf, OUI_WFA);
	624	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
	625
2316cb35 AS	626	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);
	627
	628	/* The first valid MBO subtype is 1 */
	629	for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
	630	if (mbo_subtypes & BIT(i))
	631	wpabuf_put_u8(anqp_buf, i);
	632	}
	633
8f479174	634	gas_anqp_set_element_len(anqp_buf, len_pos);
	635
	636	return anqp_buf;
	637	}
34f28519 JM	638
	639
	640	void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
	641	struct wpa_bss bss, const u8 sa,
	642	const u8 *data, size_t slen)
	643	{
	644	const u8 *pos = data;
	645	u8 subtype;
	646
	647	if (slen < 1)
	648	return;
	649
	650	subtype = *pos++;
	651	slen--;
	652
	653	switch (subtype) {
	654	case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
	655	if (slen < 1)
	656	break;
	657	wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
	658	" cell_conn_pref=%u", MAC2STR(sa), *pos);
	659	break;
	660	default:
	661	wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
	662	subtype);
	663	break;
	664	}
	665	}