[thirdparty/hostap.git] / wpa_supplicant / mbo.c

/*
 * wpa_supplicant - MBO
 *
 * Copyright(c) 2015 Intel Deutschland GmbH
 * Contact Information:
 * Intel Linux Wireless <ilw@linux.intel.com>
 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#include "utils/includes.h"

#include "utils/common.h"
#include "common/ieee802_11_defs.h"
#include "common/gas.h"
#include "config.h"
#include "wpa_supplicant_i.h"
#include "driver_i.h"
#include "bss.h"
#include "scan.h"

/* type + length + oui + oui type */
#define MBO_IE_HEADER 6


static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
{
	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
		return -1;

	/* Only checking the validity of the channel and oper_class */
	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
		return -1;

	return 0;
}


const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
{
	const u8 *mbo, *end;

	if (!bss)
		return NULL;

	mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
	if (!mbo)
		return NULL;

	end = mbo + 2 + mbo[1];
	mbo += MBO_IE_HEADER;

	return get_ie(mbo, end - mbo, attr);
}


static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
					     struct wpabuf *mbo,
					     u8 start, u8 end)
{
	u8 i;

	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);

	for (i = start; i < end; i++)
		wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);

	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
}


static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
					struct wpabuf *mbo, u8 start, u8 end)
{
	size_t size = end - start + 3;

	if (size + 2 > wpabuf_tailroom(mbo))
		return;

	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
	wpabuf_put_u8(mbo, size); /* Length */

	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
}


static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
{
	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
	wpabuf_put_u8(mbo, len); /* Length */
	wpabuf_put_be24(mbo, OUI_WFA);
	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
}


static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
					      struct wpabuf *mbo, u8 start,
					      u8 end)
{
	size_t size = end - start + 7;

	if (size + 2 > wpabuf_tailroom(mbo))
		return;

	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
}


static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
					 struct wpabuf *mbo, int subelement)
{
	u8 i, start = 0;
	struct wpa_mbo_non_pref_channel *start_pref;

	if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
		if (subelement)
			wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
		return;
	}
	start_pref = &wpa_s->non_pref_chan[0];

	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
		struct wpa_mbo_non_pref_channel *non_pref = NULL;

		if (i < wpa_s->non_pref_chan_num)
			non_pref = &wpa_s->non_pref_chan[i];
		if (!non_pref ||
		    non_pref->oper_class != start_pref->oper_class ||
		    non_pref->reason != start_pref->reason ||
		    non_pref->preference != start_pref->preference) {
			if (subelement)
				wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
								  start, i);
			else
				wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
							    i);

			if (!non_pref)
				return;

			start = i;
			start_pref = non_pref;
		}
	}
}


int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len)
{
	struct wpabuf *mbo;
	int res;

	if (len < MBO_IE_HEADER + 3 + 7)
		return 0;

	/* Leave room for the MBO IE header */
	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
	if (!mbo)
		return 0;

	/* Add non-preferred channels attribute */
	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);

	/*
	 * Send cellular capabilities attribute even if AP does not advertise
	 * cellular capabilities.
	 */
	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
	wpabuf_put_u8(mbo, 1);
	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);

	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
	if (!res)
		wpa_printf(MSG_ERROR, "Failed to add MBO IE");

	wpabuf_free(mbo);
	return res;
}


static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
					   const u8 *data, size_t len)
{
	struct wpabuf *buf;
	int res;

	/*
	 * Send WNM-Notification Request frame only in case of a change in
	 * non-preferred channels list during association, if the AP supports
	 * MBO.
	 */
	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
		return;

	buf = wpabuf_alloc(4 + len);
	if (!buf)
		return;

	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
	wpa_s->mbo_wnm_token++;
	if (wpa_s->mbo_wnm_token == 0)
		wpa_s->mbo_wnm_token++;
	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */

	wpabuf_put_data(buf, data, len);

	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
				  wpa_s->own_addr, wpa_s->bssid,
				  wpabuf_head(buf), wpabuf_len(buf), 0);
	if (res < 0)
		wpa_printf(MSG_DEBUG,
			   "Failed to send WNM-Notification Request frame with non-preferred channel list");

	wpabuf_free(buf);
}


static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
{
	struct wpabuf *buf;

	buf = wpabuf_alloc(512);
	if (!buf)
		return;

	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
				       wpabuf_len(buf));
	wpabuf_free(buf);
}


static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
				   struct wpa_mbo_non_pref_channel *b)
{
	return a->oper_class == b->oper_class && a->chan == b->chan;
}


/*
 * wpa_non_pref_chan_cmp - Compare two channels for sorting
 *
 * In MBO IE non-preferred channel subelement we can put many channels in an
 * attribute if they are in the same operating class and have the same
 * preference and reason. To make it easy for the functions that build
 * the IE attributes and WNM Request subelements, save the channels sorted
 * by their oper_class and reason.
 */
static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
{
	const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;

	if (a->oper_class != b->oper_class)
		return a->oper_class - b->oper_class;
	if (a->reason != b->reason)
		return a->reason - b->reason;
	return a->preference - b->preference;
}


int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
				  const char *non_pref_chan)
{
	char *cmd, *token, *context = NULL;
	struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
	size_t num = 0, size = 0;
	unsigned i;

	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
		   non_pref_chan ? non_pref_chan : "N/A");

	/*
	 * The shortest channel configuration is 7 characters - 3 colons and
	 * 4 values.
	 */
	if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
		goto update;

	cmd = os_strdup(non_pref_chan);
	if (!cmd)
		return -1;

	while ((token = str_token(cmd, " ", &context))) {
		struct wpa_mbo_non_pref_channel *chan;
		int ret;
		unsigned int _oper_class;
		unsigned int _chan;
		unsigned int _preference;
		unsigned int _reason;

		if (num == size) {
			size = size ? size * 2 : 1;
			tmp_chans = os_realloc_array(chans, size,
						     sizeof(*chans));
			if (!tmp_chans) {
				wpa_printf(MSG_ERROR,
					   "Couldn't reallocate non_pref_chan");
				goto fail;
			}
			chans = tmp_chans;
		}

		chan = &chans[num];

		ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
			     &_chan, &_preference, &_reason);
		if (ret != 4 ||
		    _oper_class > 255 || _chan > 255 ||
		    _preference > 255 || _reason > 65535 ) {
			wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
				   token);
			goto fail;
		}
		chan->oper_class = _oper_class;
		chan->chan = _chan;
		chan->preference = _preference;
		chan->reason = _reason;

		if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
						    chan->chan, chan->reason)) {
			wpa_printf(MSG_ERROR,
				   "Invalid non_pref_chan: oper class %d chan %d reason %d",
				   chan->oper_class, chan->chan, chan->reason);
			goto fail;
		}

		for (i = 0; i < num; i++)
			if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
				break;
		if (i != num) {
			wpa_printf(MSG_ERROR,
				   "oper class %d chan %d is duplicated",
				   chan->oper_class, chan->chan);
			goto fail;
		}

		num++;
	}

	os_free(cmd);

	if (chans) {
		qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
		      wpa_non_pref_chan_cmp);
	}

update:
	os_free(wpa_s->non_pref_chan);
	wpa_s->non_pref_chan = chans;
	wpa_s->non_pref_chan_num = num;
	wpas_mbo_non_pref_chan_changed(wpa_s);

	return 0;

fail:
	os_free(chans);
	os_free(cmd);
	return -1;
}


void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
{
	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
	wpabuf_put_u8(ie, 7);
	wpabuf_put_be24(ie, OUI_WFA);
	wpabuf_put_u8(ie, MBO_OUI_TYPE);

	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
	wpabuf_put_u8(ie, 1);
	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
}


void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
			   size_t len)
{
	const u8 *pos, *cell_pref = NULL, *reason = NULL;
	u8 id, elen;
	u16 disallowed_sec = 0;

	if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
	    mbo_ie[3] != MBO_OUI_TYPE)
		return;

	pos = mbo_ie + 4;
	len -= 4;

	while (len >= 2) {
		id = *pos++;
		elen = *pos++;
		len -= 2;

		if (elen > len)
			goto fail;

		switch (id) {
		case MBO_ATTR_ID_CELL_DATA_PREF:
			if (elen != 1)
				goto fail;

			if (wpa_s->conf->mbo_cell_capa ==
			    MBO_CELL_CAPA_AVAILABLE)
				cell_pref = pos;
			else
				wpa_printf(MSG_DEBUG,
					   "MBO: Station does not support Cellular data connection");
			break;
		case MBO_ATTR_ID_TRANSITION_REASON:
			if (elen != 1)
				goto fail;

			reason = pos;
			break;
		case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
			if (elen != 2)
				goto fail;

			if (wpa_s->wnm_mode &
			    WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
				wpa_printf(MSG_DEBUG,
					   "MBO: Unexpected association retry delay, BSS is terminating");
				goto fail;
			} else if (wpa_s->wnm_mode &
				   WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
				disallowed_sec = WPA_GET_LE16(pos);
			} else {
				wpa_printf(MSG_DEBUG,
					   "MBO: Association retry delay attribute not in disassoc imminent mode");
			}

			break;
		case MBO_ATTR_ID_AP_CAPA_IND:
		case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
		case MBO_ATTR_ID_CELL_DATA_CAPA:
		case MBO_ATTR_ID_ASSOC_DISALLOW:
		case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
			wpa_printf(MSG_DEBUG,
				   "MBO: Attribute %d should not be included in BTM Request frame",
				   id);
			break;
		default:
			wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
				   id);
			return;
		}

		pos += elen;
		len -= elen;
	}

	if (cell_pref)
		wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
			*cell_pref);

	if (reason)
		wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
			*reason);

	if (disallowed_sec && wpa_s->current_bss)
		wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
				     disallowed_sec);

	return;
fail:
	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
		   id, elen, len);
}


size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
				    size_t len,
				    enum mbo_transition_reject_reason reason)
{
	u8 reject_attr[3];

	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
	reject_attr[1] = 1;
	reject_attr[2] = reason;

	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
}


void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
{
	u8 cell_capa[7];

	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
		wpa_printf(MSG_DEBUG,
			   "MBO: Cellular capability already set to %u",
			   mbo_cell_capa);
		return;
	}

	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;

	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
	cell_capa[1] = 5; /* Length */
	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
	cell_capa[6] = mbo_cell_capa;

	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
	wpa_supplicant_set_default_scan_ies(wpa_s);
}


struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
				   struct wpa_bss *bss)
{
	struct wpabuf *anqp_buf;
	u8 *len_pos;

	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
		wpa_printf(MSG_INFO, "MBO: " MACSTR
			   " does not support MBO - cannot request MBO ANQP elements from it",
			   MAC2STR(bss->bssid));
		return NULL;
	}

	anqp_buf = wpabuf_alloc(10);
	if (!anqp_buf)
		return NULL;

	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
	wpabuf_put_be24(anqp_buf, OUI_WFA);
	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);

	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_CELL_CONN_PREF);
	gas_anqp_set_element_len(anqp_buf, len_pos);

	return anqp_buf;
}
Commit	Line	Data
92c6e2e3 DS	1	/*
	2	* wpa_supplicant - MBO
	3	*
	4	* Copyright(c) 2015 Intel Deutschland GmbH
	5	* Contact Information:
	6	* Intel Linux Wireless <ilw@linux.intel.com>
	7	* Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
	8	*
	9	* This software may be distributed under the terms of the BSD license.
	10	* See README for more details.
	11	*/
	12
	13	#include "utils/includes.h"
	14
	15	#include "utils/common.h"
	16	#include "common/ieee802_11_defs.h"
8f479174	17	#include "common/gas.h"
92c6e2e3 DS	18	#include "config.h"
	19	#include "wpa_supplicant_i.h"
	20	#include "driver_i.h"
	21	#include "bss.h"
cc9985d1	22	#include "scan.h"
92c6e2e3 DS	23
	24	/* type + length + oui + oui type */
	25	#define MBO_IE_HEADER 6
	26
	27
	28	static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
	29	{
	30	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
	31	return -1;
	32
	33	/* Only checking the validity of the channel and oper_class */
	34	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
	35	return -1;
	36
	37	return 0;
	38	}
	39
	40
cb06cf34 DS	41	const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
	42	{
	43	const u8 mbo, end;
	44
	45	if (!bss)
	46	return NULL;
	47
	48	mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
	49	if (!mbo)
	50	return NULL;
	51
	52	end = mbo + 2 + mbo[1];
	53	mbo += MBO_IE_HEADER;
	54
	55	return get_ie(mbo, end - mbo, attr);
	56	}
	57
	58
92c6e2e3 DS	59	static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
	60	struct wpabuf *mbo,
	61	u8 start, u8 end)
	62	{
	63	u8 i;
	64
	65	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
	66
	67	for (i = start; i < end; i++)
	68	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
	69
	70	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
	71	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
92c6e2e3 DS	72	}
	73
	74
	75	static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
	76	struct wpabuf *mbo, u8 start, u8 end)
	77	{
4a83d4b6	78	size_t size = end - start + 3;
92c6e2e3 DS	79
	80	if (size + 2 > wpabuf_tailroom(mbo))
	81	return;
	82
	83	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
	84	wpabuf_put_u8(mbo, size); /* Length */
	85
	86	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
	87	}
	88
	89
2d5b8614 DS	90	static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
	91	{
	92	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
	93	wpabuf_put_u8(mbo, len); /* Length */
	94	wpabuf_put_be24(mbo, OUI_WFA);
	95	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
	96	}
	97
	98
	99	static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
	100	struct wpabuf *mbo, u8 start,
	101	u8 end)
	102	{
4a83d4b6	103	size_t size = end - start + 7;
2d5b8614 DS	104
	105	if (size + 2 > wpabuf_tailroom(mbo))
	106	return;
	107
	108	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
	109	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
	110	}
	111
92c6e2e3	112
2d5b8614 DS	113	static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
2d5b8614 DS	114	struct wpabuf *mbo, int subelement)
92c6e2e3 DS	115	{
	116	u8 i, start = 0;
	117	struct wpa_mbo_non_pref_channel *start_pref;
	118
2d5b8614 DS	119	if (!wpa_s->non_pref_chan \|\| !wpa_s->non_pref_chan_num) {
	120	if (subelement)
	121	wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
92c6e2e3	122	return;
2d5b8614	123	}
92c6e2e3 DS	124	start_pref = &wpa_s->non_pref_chan[0];
	125
	126	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
	127	struct wpa_mbo_non_pref_channel *non_pref = NULL;
	128
	129	if (i < wpa_s->non_pref_chan_num)
	130	non_pref = &wpa_s->non_pref_chan[i];
	131	if (!non_pref \|\|
	132	non_pref->oper_class != start_pref->oper_class \|\|
	133	non_pref->reason != start_pref->reason \|\|
92c6e2e3	134	non_pref->preference != start_pref->preference) {
2d5b8614 DS	135	if (subelement)
	136	wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
	137	start, i);
	138	else
	139	wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
	140	i);
92c6e2e3 DS	141
	142	if (!non_pref)
	143	return;
	144
	145	start = i;
	146	start_pref = non_pref;
	147	}
	148	}
	149	}
	150
	151
	152	int wpas_mbo_ie(struct wpa_supplicant wpa_s, u8 buf, size_t len)
	153	{
	154	struct wpabuf *mbo;
	155	int res;
	156
c5d193d7	157	if (len < MBO_IE_HEADER + 3 + 7)
92c6e2e3 DS	158	return 0;
	159
	160	/* Leave room for the MBO IE header */
	161	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
	162	if (!mbo)
	163	return 0;
	164
	165	/* Add non-preferred channels attribute */
2d5b8614	166	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
92c6e2e3	167
c5d193d7 DS	168	/*
	169	* Send cellular capabilities attribute even if AP does not advertise
	170	* cellular capabilities.
	171	*/
	172	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
	173	wpabuf_put_u8(mbo, 1);
	174	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
	175
92c6e2e3 DS	176	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
	177	if (!res)
	178	wpa_printf(MSG_ERROR, "Failed to add MBO IE");
	179
	180	wpabuf_free(mbo);
	181	return res;
	182	}
	183
	184
016082e9 AS	185	static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
016082e9 AS	186	const u8 *data, size_t len)
2d5b8614 DS	187	{
	188	struct wpabuf *buf;
	189	int res;
	190
	191	/*
	192	* Send WNM-Notification Request frame only in case of a change in
	193	* non-preferred channels list during association, if the AP supports
	194	* MBO.
	195	*/
	196	if (wpa_s->wpa_state != WPA_COMPLETED \|\| !wpa_s->current_bss \|\|
	197	!wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
	198	return;
	199
016082e9	200	buf = wpabuf_alloc(4 + len);
2d5b8614 DS	201	if (!buf)
	202	return;
	203
	204	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
	205	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
	206	wpa_s->mbo_wnm_token++;
	207	if (wpa_s->mbo_wnm_token == 0)
	208	wpa_s->mbo_wnm_token++;
	209	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
	210	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
	211
016082e9	212	wpabuf_put_data(buf, data, len);
2d5b8614 DS	213
	214	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
	215	wpa_s->own_addr, wpa_s->bssid,
	216	wpabuf_head(buf), wpabuf_len(buf), 0);
	217	if (res < 0)
	218	wpa_printf(MSG_DEBUG,
	219	"Failed to send WNM-Notification Request frame with non-preferred channel list");
	220
	221	wpabuf_free(buf);
	222	}
	223
	224
016082e9 AS	225	static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
	226	{
	227	struct wpabuf *buf;
	228
	229	buf = wpabuf_alloc(512);
	230	if (!buf)
	231	return;
	232
	233	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
	234	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
	235	wpabuf_len(buf));
	236	wpabuf_free(buf);
	237	}
	238
	239
92c6e2e3 DS	240	static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
	241	struct wpa_mbo_non_pref_channel *b)
	242	{
	243	return a->oper_class == b->oper_class && a->chan == b->chan;
	244	}
	245
	246
	247	/*
	248	* wpa_non_pref_chan_cmp - Compare two channels for sorting
	249	*
	250	* In MBO IE non-preferred channel subelement we can put many channels in an
	251	* attribute if they are in the same operating class and have the same
4a83d4b6	252	* preference and reason. To make it easy for the functions that build
	253	* the IE attributes and WNM Request subelements, save the channels sorted
	254	* by their oper_class and reason.
92c6e2e3 DS	255	*/
	256	static int wpa_non_pref_chan_cmp(const void _a, const void _b)
	257	{
	258	const struct wpa_mbo_non_pref_channel a = _a, b = _b;
	259
	260	if (a->oper_class != b->oper_class)
	261	return a->oper_class - b->oper_class;
	262	if (a->reason != b->reason)
	263	return a->reason - b->reason;
92c6e2e3 DS	264	return a->preference - b->preference;
	265	}
	266
	267
	268	int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
	269	const char *non_pref_chan)
	270	{
	271	char cmd, token, *context = NULL;
	272	struct wpa_mbo_non_pref_channel chans = NULL, tmp_chans;
	273	size_t num = 0, size = 0;
	274	unsigned i;
	275
	276	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
	277	non_pref_chan ? non_pref_chan : "N/A");
	278
	279	/*
dca4b503 AP	280	* The shortest channel configuration is 7 characters - 3 colons and
dca4b503 AP	281	* 4 values.
92c6e2e3	282	*/
dca4b503	283	if (!non_pref_chan \|\| os_strlen(non_pref_chan) < 7)
92c6e2e3 DS	284	goto update;
	285
	286	cmd = os_strdup(non_pref_chan);
	287	if (!cmd)
	288	return -1;
	289
	290	while ((token = str_token(cmd, " ", &context))) {
	291	struct wpa_mbo_non_pref_channel *chan;
	292	int ret;
	293	unsigned int _oper_class;
	294	unsigned int _chan;
	295	unsigned int _preference;
	296	unsigned int _reason;
92c6e2e3 DS	297
	298	if (num == size) {
	299	size = size ? size * 2 : 1;
	300	tmp_chans = os_realloc_array(chans, size,
	301	sizeof(*chans));
	302	if (!tmp_chans) {
	303	wpa_printf(MSG_ERROR,
	304	"Couldn't reallocate non_pref_chan");
	305	goto fail;
	306	}
	307	chans = tmp_chans;
	308	}
	309
	310	chan = &chans[num];
	311
4a83d4b6	312	ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
	313	&_chan, &_preference, &_reason);
	314	if (ret != 4 \|\|
92c6e2e3	315	_oper_class > 255 \|\| _chan > 255 \|\|
4a83d4b6	316	_preference > 255 \|\| _reason > 65535 ) {
92c6e2e3 DS	317	wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
	318	token);
	319	goto fail;
	320	}
	321	chan->oper_class = _oper_class;
	322	chan->chan = _chan;
	323	chan->preference = _preference;
	324	chan->reason = _reason;
92c6e2e3 DS	325
	326	if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
	327	chan->chan, chan->reason)) {
	328	wpa_printf(MSG_ERROR,
	329	"Invalid non_pref_chan: oper class %d chan %d reason %d",
	330	chan->oper_class, chan->chan, chan->reason);
	331	goto fail;
	332	}
	333
	334	for (i = 0; i < num; i++)
	335	if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
	336	break;
	337	if (i != num) {
	338	wpa_printf(MSG_ERROR,
	339	"oper class %d chan %d is duplicated",
	340	chan->oper_class, chan->chan);
	341	goto fail;
	342	}
	343
	344	num++;
	345	}
	346
	347	os_free(cmd);
	348
	349	if (chans) {
	350	qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
	351	wpa_non_pref_chan_cmp);
	352	}
	353
	354	update:
	355	os_free(wpa_s->non_pref_chan);
	356	wpa_s->non_pref_chan = chans;
	357	wpa_s->non_pref_chan_num = num;
016082e9	358	wpas_mbo_non_pref_chan_changed(wpa_s);
92c6e2e3 DS	359
	360	return 0;
	361
	362	fail:
	363	os_free(chans);
	364	os_free(cmd);
	365	return -1;
	366	}
c5d193d7 DS	367
	368
	369	void wpas_mbo_scan_ie(struct wpa_supplicant wpa_s, struct wpabuf ie)
	370	{
	371	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
	372	wpabuf_put_u8(ie, 7);
	373	wpabuf_put_be24(ie, OUI_WFA);
	374	wpabuf_put_u8(ie, MBO_OUI_TYPE);
	375
	376	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
	377	wpabuf_put_u8(ie, 1);
	378	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
	379	}
5e57ba25 AS	380
5e57ba25 AS	381
dd599908 AS	382	void wpas_mbo_ie_trans_req(struct wpa_supplicant wpa_s, const u8 mbo_ie,
	383	size_t len)
	384	{
	385	const u8 pos, cell_pref = NULL, *reason = NULL;
	386	u8 id, elen;
	387	u16 disallowed_sec = 0;
	388
	389	if (len <= 4 \|\| WPA_GET_BE24(mbo_ie) != OUI_WFA \|\|
	390	mbo_ie[3] != MBO_OUI_TYPE)
	391	return;
	392
	393	pos = mbo_ie + 4;
	394	len -= 4;
	395
	396	while (len >= 2) {
	397	id = *pos++;
	398	elen = *pos++;
	399	len -= 2;
	400
	401	if (elen > len)
	402	goto fail;
	403
	404	switch (id) {
	405	case MBO_ATTR_ID_CELL_DATA_PREF:
	406	if (elen != 1)
	407	goto fail;
	408
	409	if (wpa_s->conf->mbo_cell_capa ==
	410	MBO_CELL_CAPA_AVAILABLE)
	411	cell_pref = pos;
	412	else
	413	wpa_printf(MSG_DEBUG,
	414	"MBO: Station does not support Cellular data connection");
	415	break;
	416	case MBO_ATTR_ID_TRANSITION_REASON:
	417	if (elen != 1)
	418	goto fail;
	419
	420	reason = pos;
	421	break;
	422	case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
	423	if (elen != 2)
	424	goto fail;
	425
	426	if (wpa_s->wnm_mode &
	427	WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
	428	wpa_printf(MSG_DEBUG,
	429	"MBO: Unexpected association retry delay, BSS is terminating");
	430	goto fail;
	431	} else if (wpa_s->wnm_mode &
	432	WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
	433	disallowed_sec = WPA_GET_LE16(pos);
	434	} else {
	435	wpa_printf(MSG_DEBUG,
	436	"MBO: Association retry delay attribute not in disassoc imminent mode");
	437	}
	438
	439	break;
	440	case MBO_ATTR_ID_AP_CAPA_IND:
	441	case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
	442	case MBO_ATTR_ID_CELL_DATA_CAPA:
	443	case MBO_ATTR_ID_ASSOC_DISALLOW:
	444	case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
	445	wpa_printf(MSG_DEBUG,
446	"MBO: Attribute %d should not be included in BTM Request frame",
447	id);
448	break;
449	default:
450	wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
451	id);
452	return;
453	}
454
455	pos += elen;
456	len -= elen;
457	}
458
459	if (cell_pref)
460	wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
461	*cell_pref);
462
463	if (reason)
464	wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
465	*reason);
466
467	if (disallowed_sec && wpa_s->current_bss)
468	wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
469	disallowed_sec);
470
471	return;
472	fail:
473	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
474	id, elen, len);
475	}
c8082d2b AS	476
	477
	478	size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant wpa_s, u8 pos,
	479	size_t len,
	480	enum mbo_transition_reject_reason reason)
	481	{
	482	u8 reject_attr[3];
	483
	484	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
	485	reject_attr[1] = 1;
	486	reject_attr[2] = reason;
	487
	488	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
	489	}
016082e9 AS	490
	491
	492	void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
	493	{
	494	u8 cell_capa[7];
	495
	496	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
	497	wpa_printf(MSG_DEBUG,
	498	"MBO: Cellular capability already set to %u",
	499	mbo_cell_capa);
	500	return;
	501	}
	502
	503	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
	504
	505	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
	506	cell_capa[1] = 5; /* Length */
	507	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
	508	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
	509	cell_capa[6] = mbo_cell_capa;
	510
	511	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
cc9985d1	512	wpa_supplicant_set_default_scan_ies(wpa_s);
016082e9	513	}
8f479174	514
	515
	516	struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
	517	struct wpa_bss *bss)
	518	{
	519	struct wpabuf *anqp_buf;
	520	u8 *len_pos;
	521
	522	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
	523	wpa_printf(MSG_INFO, "MBO: " MACSTR
	524	" does not support MBO - cannot request MBO ANQP elements from it",
	525	MAC2STR(bss->bssid));
	526	return NULL;
	527	}
	528
	529	anqp_buf = wpabuf_alloc(10);
	530	if (!anqp_buf)
	531	return NULL;
	532
	533	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
	534	wpabuf_put_be24(anqp_buf, OUI_WFA);
	535	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
	536
	537	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_CELL_CONN_PREF);
	538	gas_anqp_set_element_len(anqp_buf, len_pos);
	539
	540	return anqp_buf;
	541	}