Line data Source code
1 : /*
2 : * Copyright (c) 2009, Atheros Communications, Inc.
3 : * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
4 : *
5 : * This software may be distributed under the terms of the BSD license.
6 : * See README for more details.
7 : */
8 :
9 : #include "includes.h"
10 : #include <sys/stat.h>
11 :
12 : #include "common.h"
13 : #include "eloop.h"
14 : #include "common/ieee802_11_common.h"
15 : #include "common/ieee802_11_defs.h"
16 : #include "common/gas.h"
17 : #include "common/wpa_ctrl.h"
18 : #include "rsn_supp/wpa.h"
19 : #include "wpa_supplicant_i.h"
20 : #include "driver_i.h"
21 : #include "config.h"
22 : #include "scan.h"
23 : #include "bss.h"
24 : #include "blacklist.h"
25 : #include "gas_query.h"
26 : #include "interworking.h"
27 : #include "hs20_supplicant.h"
28 :
29 :
30 : #define OSU_MAX_ITEMS 10
31 :
32 : struct osu_lang_string {
33 : char lang[4];
34 : char text[253];
35 : };
36 :
37 : struct osu_icon {
38 : u16 width;
39 : u16 height;
40 : char lang[4];
41 : char icon_type[256];
42 : char filename[256];
43 : unsigned int id;
44 : unsigned int failed:1;
45 : };
46 :
47 : struct osu_provider {
48 : u8 bssid[ETH_ALEN];
49 : u8 osu_ssid[32];
50 : u8 osu_ssid_len;
51 : char server_uri[256];
52 : u32 osu_methods; /* bit 0 = OMA-DM, bit 1 = SOAP-XML SPP */
53 : char osu_nai[256];
54 : struct osu_lang_string friendly_name[OSU_MAX_ITEMS];
55 : size_t friendly_name_count;
56 : struct osu_lang_string serv_desc[OSU_MAX_ITEMS];
57 : size_t serv_desc_count;
58 : struct osu_icon icon[OSU_MAX_ITEMS];
59 : size_t icon_count;
60 : };
61 :
62 :
63 764 : void wpas_hs20_add_indication(struct wpabuf *buf, int pps_mo_id)
64 : {
65 : u8 conf;
66 :
67 764 : wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
68 764 : wpabuf_put_u8(buf, pps_mo_id >= 0 ? 7 : 5);
69 764 : wpabuf_put_be24(buf, OUI_WFA);
70 764 : wpabuf_put_u8(buf, HS20_INDICATION_OUI_TYPE);
71 764 : conf = HS20_VERSION;
72 764 : if (pps_mo_id >= 0)
73 91 : conf |= HS20_PPS_MO_ID_PRESENT;
74 764 : wpabuf_put_u8(buf, conf);
75 764 : if (pps_mo_id >= 0)
76 91 : wpabuf_put_le16(buf, pps_mo_id);
77 764 : }
78 :
79 :
80 2555 : int is_hs20_network(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
81 : struct wpa_bss *bss)
82 : {
83 2555 : if (!wpa_s->conf->hs20 || !ssid)
84 1831 : return 0;
85 :
86 724 : if (ssid->parent_cred)
87 90 : return 1;
88 :
89 634 : if (bss && !wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE))
90 632 : return 0;
91 :
92 : /*
93 : * This may catch some non-Hotspot 2.0 cases, but it is safer to do that
94 : * than cause Hotspot 2.0 connections without indication element getting
95 : * added. Non-Hotspot 2.0 APs should ignore the unknown vendor element.
96 : */
97 :
98 2 : if (!(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X))
99 1 : return 0;
100 1 : if (!(ssid->pairwise_cipher & WPA_CIPHER_CCMP))
101 0 : return 0;
102 1 : if (ssid->proto != WPA_PROTO_RSN)
103 0 : return 0;
104 :
105 1 : return 1;
106 : }
107 :
108 :
109 91 : int hs20_get_pps_mo_id(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
110 : {
111 : struct wpa_cred *cred;
112 :
113 91 : if (ssid == NULL)
114 0 : return 0;
115 :
116 91 : if (ssid->update_identifier)
117 1 : return ssid->update_identifier;
118 :
119 90 : if (ssid->parent_cred == NULL)
120 0 : return 0;
121 :
122 94 : for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
123 94 : if (ssid->parent_cred == cred)
124 90 : return cred->update_identifier;
125 : }
126 :
127 0 : return 0;
128 : }
129 :
130 :
131 9 : void hs20_put_anqp_req(u32 stypes, const u8 *payload, size_t payload_len,
132 : struct wpabuf *buf)
133 : {
134 : u8 *len_pos;
135 :
136 9 : if (buf == NULL)
137 9 : return;
138 :
139 9 : len_pos = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
140 9 : wpabuf_put_be24(buf, OUI_WFA);
141 9 : wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
142 9 : if (stypes == BIT(HS20_STYPE_NAI_HOME_REALM_QUERY)) {
143 4 : wpabuf_put_u8(buf, HS20_STYPE_NAI_HOME_REALM_QUERY);
144 4 : wpabuf_put_u8(buf, 0); /* Reserved */
145 4 : if (payload)
146 4 : wpabuf_put_data(buf, payload, payload_len);
147 5 : } else if (stypes == BIT(HS20_STYPE_ICON_REQUEST)) {
148 3 : wpabuf_put_u8(buf, HS20_STYPE_ICON_REQUEST);
149 3 : wpabuf_put_u8(buf, 0); /* Reserved */
150 3 : if (payload)
151 3 : wpabuf_put_data(buf, payload, payload_len);
152 : } else {
153 : u8 i;
154 2 : wpabuf_put_u8(buf, HS20_STYPE_QUERY_LIST);
155 2 : wpabuf_put_u8(buf, 0); /* Reserved */
156 66 : for (i = 0; i < 32; i++) {
157 64 : if (stypes & BIT(i))
158 4 : wpabuf_put_u8(buf, i);
159 : }
160 : }
161 9 : gas_anqp_set_element_len(buf, len_pos);
162 :
163 9 : gas_anqp_set_len(buf);
164 : }
165 :
166 :
167 8 : struct wpabuf * hs20_build_anqp_req(u32 stypes, const u8 *payload,
168 : size_t payload_len)
169 : {
170 : struct wpabuf *buf;
171 :
172 8 : buf = gas_anqp_build_initial_req(0, 100 + payload_len);
173 8 : if (buf == NULL)
174 0 : return NULL;
175 :
176 8 : hs20_put_anqp_req(stypes, payload, payload_len, buf);
177 :
178 8 : return buf;
179 : }
180 :
181 :
182 8 : int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
183 : const u8 *payload, size_t payload_len)
184 : {
185 : struct wpabuf *buf;
186 8 : int ret = 0;
187 : int freq;
188 : struct wpa_bss *bss;
189 : int res;
190 :
191 8 : freq = wpa_s->assoc_freq;
192 8 : bss = wpa_bss_get_bssid(wpa_s, dst);
193 8 : if (bss) {
194 8 : wpa_bss_anqp_unshare_alloc(bss);
195 8 : freq = bss->freq;
196 : }
197 8 : if (freq <= 0)
198 0 : return -1;
199 :
200 48 : wpa_printf(MSG_DEBUG, "HS20: ANQP Query Request to " MACSTR " for "
201 48 : "subtypes 0x%x", MAC2STR(dst), stypes);
202 :
203 8 : buf = hs20_build_anqp_req(stypes, payload, payload_len);
204 8 : if (buf == NULL)
205 0 : return -1;
206 :
207 8 : res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
208 8 : if (res < 0) {
209 0 : wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
210 0 : wpabuf_free(buf);
211 0 : ret = -1;
212 : } else
213 8 : wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
214 : "%u", res);
215 :
216 8 : return ret;
217 : }
218 :
219 :
220 3 : static void hs20_set_osu_access_permission(const char *osu_dir,
221 : const char *fname)
222 : {
223 : struct stat statbuf;
224 :
225 : /* Get OSU directory information */
226 3 : if (stat(osu_dir, &statbuf) < 0) {
227 0 : wpa_printf(MSG_WARNING, "Cannot stat the OSU directory %s",
228 : osu_dir);
229 0 : return;
230 : }
231 :
232 3 : if (chmod(fname, statbuf.st_mode) < 0) {
233 0 : wpa_printf(MSG_WARNING,
234 : "Cannot change the permissions for %s", fname);
235 0 : return;
236 : }
237 :
238 3 : if (chown(fname, statbuf.st_uid, statbuf.st_gid) < 0) {
239 0 : wpa_printf(MSG_WARNING, "Cannot change the ownership for %s",
240 : fname);
241 : }
242 : }
243 :
244 3 : static int hs20_process_icon_binary_file(struct wpa_supplicant *wpa_s,
245 : const u8 *sa, const u8 *pos,
246 : size_t slen)
247 : {
248 : char fname[256];
249 : int png;
250 : FILE *f;
251 : u16 data_len;
252 :
253 18 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR " Icon Binary File",
254 18 : MAC2STR(sa));
255 :
256 3 : if (slen < 4) {
257 0 : wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
258 : "value from " MACSTR, MAC2STR(sa));
259 0 : return -1;
260 : }
261 :
262 3 : wpa_printf(MSG_DEBUG, "HS 2.0: Download Status Code %u", *pos);
263 3 : if (*pos != 0)
264 0 : return -1;
265 3 : pos++;
266 3 : slen--;
267 :
268 3 : if ((size_t) 1 + pos[0] > slen) {
269 0 : wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
270 : "value from " MACSTR, MAC2STR(sa));
271 0 : return -1;
272 : }
273 3 : wpa_hexdump_ascii(MSG_DEBUG, "Icon Type", pos + 1, pos[0]);
274 3 : png = os_strncasecmp((char *) pos + 1, "image/png", 9) == 0;
275 3 : slen -= 1 + pos[0];
276 3 : pos += 1 + pos[0];
277 :
278 3 : if (slen < 2) {
279 0 : wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
280 : "value from " MACSTR, MAC2STR(sa));
281 0 : return -1;
282 : }
283 3 : data_len = WPA_GET_LE16(pos);
284 3 : pos += 2;
285 3 : slen -= 2;
286 :
287 3 : if (data_len > slen) {
288 0 : wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
289 : "value from " MACSTR, MAC2STR(sa));
290 0 : return -1;
291 : }
292 :
293 3 : wpa_printf(MSG_DEBUG, "Icon Binary Data: %u bytes", data_len);
294 3 : if (wpa_s->conf->osu_dir == NULL)
295 1 : return -1;
296 :
297 2 : wpa_s->osu_icon_id++;
298 2 : if (wpa_s->osu_icon_id == 0)
299 0 : wpa_s->osu_icon_id++;
300 4 : snprintf(fname, sizeof(fname), "%s/osu-icon-%u.%s",
301 2 : wpa_s->conf->osu_dir, wpa_s->osu_icon_id,
302 : png ? "png" : "icon");
303 2 : f = fopen(fname, "wb");
304 2 : if (f == NULL)
305 0 : return -1;
306 :
307 2 : hs20_set_osu_access_permission(wpa_s->conf->osu_dir, fname);
308 :
309 2 : if (fwrite(pos, slen, 1, f) != 1) {
310 0 : fclose(f);
311 0 : unlink(fname);
312 0 : return -1;
313 : }
314 2 : fclose(f);
315 :
316 2 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP-ICON %s", fname);
317 2 : return 0;
318 : }
319 :
320 :
321 2 : static void hs20_continue_icon_fetch(void *eloop_ctx, void *sock_ctx)
322 : {
323 2 : struct wpa_supplicant *wpa_s = eloop_ctx;
324 2 : if (wpa_s->fetch_osu_icon_in_progress)
325 2 : hs20_next_osu_icon(wpa_s);
326 2 : }
327 :
328 :
329 2 : static void hs20_osu_icon_fetch_result(struct wpa_supplicant *wpa_s, int res)
330 : {
331 : size_t i, j;
332 : struct os_reltime now, tmp;
333 : int dur;
334 :
335 2 : os_get_reltime(&now);
336 2 : os_reltime_sub(&now, &wpa_s->osu_icon_fetch_start, &tmp);
337 2 : dur = tmp.sec * 1000 + tmp.usec / 1000;
338 2 : wpa_printf(MSG_DEBUG, "HS 2.0: Icon fetch dur=%d ms res=%d",
339 : dur, res);
340 :
341 3 : for (i = 0; i < wpa_s->osu_prov_count; i++) {
342 3 : struct osu_provider *osu = &wpa_s->osu_prov[i];
343 8 : for (j = 0; j < osu->icon_count; j++) {
344 3 : struct osu_icon *icon = &osu->icon[j];
345 3 : if (icon->id || icon->failed)
346 1 : continue;
347 2 : if (res < 0)
348 0 : icon->failed = 1;
349 : else
350 2 : icon->id = wpa_s->osu_icon_id;
351 4 : return;
352 : }
353 : }
354 : }
355 :
356 :
357 248 : void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,
358 : struct wpa_bss *bss, const u8 *sa,
359 : const u8 *data, size_t slen)
360 : {
361 248 : const u8 *pos = data;
362 : u8 subtype;
363 248 : struct wpa_bss_anqp *anqp = NULL;
364 : int ret;
365 :
366 248 : if (slen < 2)
367 248 : return;
368 :
369 248 : if (bss)
370 248 : anqp = bss->anqp;
371 :
372 248 : subtype = *pos++;
373 248 : slen--;
374 :
375 248 : pos++; /* Reserved */
376 248 : slen--;
377 :
378 248 : switch (subtype) {
379 : case HS20_STYPE_CAPABILITY_LIST:
380 1038 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
381 1038 : " HS Capability List", MAC2STR(sa));
382 173 : wpa_hexdump_ascii(MSG_DEBUG, "HS Capability List", pos, slen);
383 173 : if (anqp) {
384 173 : wpabuf_free(anqp->hs20_capability_list);
385 173 : anqp->hs20_capability_list =
386 173 : wpabuf_alloc_copy(pos, slen);
387 : }
388 173 : break;
389 : case HS20_STYPE_OPERATOR_FRIENDLY_NAME:
390 30 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
391 30 : " Operator Friendly Name", MAC2STR(sa));
392 5 : wpa_hexdump_ascii(MSG_DEBUG, "oper friendly name", pos, slen);
393 5 : if (anqp) {
394 5 : wpabuf_free(anqp->hs20_operator_friendly_name);
395 5 : anqp->hs20_operator_friendly_name =
396 5 : wpabuf_alloc_copy(pos, slen);
397 : }
398 5 : break;
399 : case HS20_STYPE_WAN_METRICS:
400 36 : wpa_hexdump(MSG_DEBUG, "WAN Metrics", pos, slen);
401 36 : if (slen < 13) {
402 0 : wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short WAN "
403 : "Metrics value from " MACSTR, MAC2STR(sa));
404 0 : break;
405 : }
406 360 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
407 216 : " WAN Metrics %02x:%u:%u:%u:%u:%u", MAC2STR(sa),
408 36 : pos[0], WPA_GET_LE32(pos + 1), WPA_GET_LE32(pos + 5),
409 108 : pos[9], pos[10], WPA_GET_LE16(pos + 11));
410 36 : if (anqp) {
411 36 : wpabuf_free(anqp->hs20_wan_metrics);
412 36 : anqp->hs20_wan_metrics = wpabuf_alloc_copy(pos, slen);
413 : }
414 36 : break;
415 : case HS20_STYPE_CONNECTION_CAPABILITY:
416 120 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
417 120 : " Connection Capability", MAC2STR(sa));
418 20 : wpa_hexdump_ascii(MSG_DEBUG, "conn capability", pos, slen);
419 20 : if (anqp) {
420 20 : wpabuf_free(anqp->hs20_connection_capability);
421 20 : anqp->hs20_connection_capability =
422 20 : wpabuf_alloc_copy(pos, slen);
423 : }
424 20 : break;
425 : case HS20_STYPE_OPERATING_CLASS:
426 54 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
427 54 : " Operating Class", MAC2STR(sa));
428 9 : wpa_hexdump_ascii(MSG_DEBUG, "Operating Class", pos, slen);
429 9 : if (anqp) {
430 9 : wpabuf_free(anqp->hs20_operating_class);
431 9 : anqp->hs20_operating_class =
432 9 : wpabuf_alloc_copy(pos, slen);
433 : }
434 9 : break;
435 : case HS20_STYPE_OSU_PROVIDERS_LIST:
436 12 : wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
437 12 : " OSU Providers list", MAC2STR(sa));
438 2 : wpa_s->num_prov_found++;
439 2 : if (anqp) {
440 2 : wpabuf_free(anqp->hs20_osu_providers_list);
441 2 : anqp->hs20_osu_providers_list =
442 2 : wpabuf_alloc_copy(pos, slen);
443 : }
444 2 : break;
445 : case HS20_STYPE_ICON_BINARY_FILE:
446 3 : ret = hs20_process_icon_binary_file(wpa_s, sa, pos, slen);
447 3 : if (wpa_s->fetch_osu_icon_in_progress) {
448 2 : hs20_osu_icon_fetch_result(wpa_s, ret);
449 2 : eloop_cancel_timeout(hs20_continue_icon_fetch,
450 : wpa_s, NULL);
451 2 : eloop_register_timeout(0, 0, hs20_continue_icon_fetch,
452 : wpa_s, NULL);
453 : }
454 3 : break;
455 : default:
456 0 : wpa_printf(MSG_DEBUG, "HS20: Unsupported subtype %u", subtype);
457 0 : break;
458 : }
459 : }
460 :
461 :
462 189 : void hs20_notify_parse_done(struct wpa_supplicant *wpa_s)
463 : {
464 189 : if (!wpa_s->fetch_osu_icon_in_progress)
465 187 : return;
466 2 : if (eloop_is_timeout_registered(hs20_continue_icon_fetch, wpa_s, NULL))
467 2 : return;
468 : /*
469 : * We are going through icon fetch, but no icon response was received.
470 : * Assume this means the current AP could not provide an answer to avoid
471 : * getting stuck in fetch iteration.
472 : */
473 0 : hs20_icon_fetch_failed(wpa_s);
474 : }
475 :
476 :
477 2 : static void hs20_free_osu_prov_entry(struct osu_provider *prov)
478 : {
479 2 : }
480 :
481 :
482 290 : void hs20_free_osu_prov(struct wpa_supplicant *wpa_s)
483 : {
484 : size_t i;
485 292 : for (i = 0; i < wpa_s->osu_prov_count; i++)
486 2 : hs20_free_osu_prov_entry(&wpa_s->osu_prov[i]);
487 290 : os_free(wpa_s->osu_prov);
488 290 : wpa_s->osu_prov = NULL;
489 290 : wpa_s->osu_prov_count = 0;
490 290 : }
491 :
492 :
493 1 : static void hs20_osu_fetch_done(struct wpa_supplicant *wpa_s)
494 : {
495 : char fname[256];
496 : FILE *f;
497 : size_t i, j;
498 :
499 1 : wpa_s->fetch_osu_info = 0;
500 1 : wpa_s->fetch_osu_icon_in_progress = 0;
501 :
502 1 : if (wpa_s->conf->osu_dir == NULL) {
503 0 : hs20_free_osu_prov(wpa_s);
504 0 : wpa_s->fetch_anqp_in_progress = 0;
505 0 : return;
506 : }
507 :
508 1 : snprintf(fname, sizeof(fname), "%s/osu-providers.txt",
509 1 : wpa_s->conf->osu_dir);
510 1 : f = fopen(fname, "w");
511 1 : if (f == NULL) {
512 0 : hs20_free_osu_prov(wpa_s);
513 0 : return;
514 : }
515 :
516 1 : hs20_set_osu_access_permission(wpa_s->conf->osu_dir, fname);
517 :
518 3 : for (i = 0; i < wpa_s->osu_prov_count; i++) {
519 2 : struct osu_provider *osu = &wpa_s->osu_prov[i];
520 2 : if (i > 0)
521 1 : fprintf(f, "\n");
522 14 : fprintf(f, "OSU-PROVIDER " MACSTR "\n"
523 : "uri=%s\n"
524 : "methods=%08x\n",
525 12 : MAC2STR(osu->bssid), osu->server_uri, osu->osu_methods);
526 2 : if (osu->osu_ssid_len) {
527 4 : fprintf(f, "osu_ssid=%s\n",
528 2 : wpa_ssid_txt(osu->osu_ssid,
529 2 : osu->osu_ssid_len));
530 : }
531 2 : if (osu->osu_nai[0])
532 1 : fprintf(f, "osu_nai=%s\n", osu->osu_nai);
533 6 : for (j = 0; j < osu->friendly_name_count; j++) {
534 4 : fprintf(f, "friendly_name=%s:%s\n",
535 4 : osu->friendly_name[j].lang,
536 4 : osu->friendly_name[j].text);
537 : }
538 6 : for (j = 0; j < osu->serv_desc_count; j++) {
539 4 : fprintf(f, "desc=%s:%s\n",
540 4 : osu->serv_desc[j].lang,
541 4 : osu->serv_desc[j].text);
542 : }
543 4 : for (j = 0; j < osu->icon_count; j++) {
544 2 : struct osu_icon *icon = &osu->icon[j];
545 2 : if (icon->failed)
546 0 : continue; /* could not fetch icon */
547 4 : fprintf(f, "icon=%u:%u:%u:%s:%s:%s\n",
548 4 : icon->id, icon->width, icon->height, icon->lang,
549 2 : icon->icon_type, icon->filename);
550 : }
551 : }
552 1 : fclose(f);
553 1 : hs20_free_osu_prov(wpa_s);
554 :
555 1 : wpa_msg(wpa_s, MSG_INFO, "OSU provider fetch completed");
556 1 : wpa_s->fetch_anqp_in_progress = 0;
557 : }
558 :
559 :
560 3 : void hs20_next_osu_icon(struct wpa_supplicant *wpa_s)
561 : {
562 : size_t i, j;
563 :
564 3 : wpa_printf(MSG_DEBUG, "HS 2.0: Ready to fetch next icon");
565 :
566 6 : for (i = 0; i < wpa_s->osu_prov_count; i++) {
567 5 : struct osu_provider *osu = &wpa_s->osu_prov[i];
568 8 : for (j = 0; j < osu->icon_count; j++) {
569 5 : struct osu_icon *icon = &osu->icon[j];
570 5 : if (icon->id || icon->failed)
571 3 : continue;
572 :
573 14 : wpa_printf(MSG_DEBUG, "HS 2.0: Try to fetch icon '%s' "
574 2 : "from " MACSTR, icon->filename,
575 12 : MAC2STR(osu->bssid));
576 2 : os_get_reltime(&wpa_s->osu_icon_fetch_start);
577 4 : if (hs20_anqp_send_req(wpa_s, osu->bssid,
578 : BIT(HS20_STYPE_ICON_REQUEST),
579 2 : (u8 *) icon->filename,
580 2 : os_strlen(icon->filename)) < 0) {
581 0 : icon->failed = 1;
582 0 : continue;
583 : }
584 5 : return;
585 : }
586 : }
587 :
588 1 : wpa_printf(MSG_DEBUG, "HS 2.0: No more icons to fetch");
589 1 : hs20_osu_fetch_done(wpa_s);
590 : }
591 :
592 :
593 2 : static void hs20_osu_add_prov(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
594 : const u8 *osu_ssid, u8 osu_ssid_len,
595 : const u8 *pos, size_t len)
596 : {
597 : struct osu_provider *prov;
598 2 : const u8 *end = pos + len;
599 : u16 len2;
600 : const u8 *pos2;
601 : u8 uri_len, osu_method_len, osu_nai_len;
602 :
603 2 : wpa_hexdump(MSG_DEBUG, "HS 2.0: Parsing OSU Provider", pos, len);
604 2 : prov = os_realloc_array(wpa_s->osu_prov,
605 2 : wpa_s->osu_prov_count + 1,
606 : sizeof(*prov));
607 2 : if (prov == NULL)
608 0 : return;
609 2 : wpa_s->osu_prov = prov;
610 2 : prov = &prov[wpa_s->osu_prov_count];
611 2 : os_memset(prov, 0, sizeof(*prov));
612 :
613 2 : os_memcpy(prov->bssid, bss->bssid, ETH_ALEN);
614 2 : os_memcpy(prov->osu_ssid, osu_ssid, osu_ssid_len);
615 2 : prov->osu_ssid_len = osu_ssid_len;
616 :
617 : /* OSU Friendly Name Length */
618 2 : if (pos + 2 > end) {
619 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
620 : "Friendly Name Length");
621 0 : return;
622 : }
623 2 : len2 = WPA_GET_LE16(pos);
624 2 : pos += 2;
625 2 : if (len2 > end - pos) {
626 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
627 : "Friendly Name Duples");
628 0 : return;
629 : }
630 2 : pos2 = pos;
631 2 : pos += len2;
632 :
633 : /* OSU Friendly Name Duples */
634 8 : while (pos2 + 4 <= pos && prov->friendly_name_count < OSU_MAX_ITEMS) {
635 : struct osu_lang_string *f;
636 4 : if (pos2 + 1 + pos2[0] > pos || pos2[0] < 3) {
637 0 : wpa_printf(MSG_DEBUG, "Invalid OSU Friendly Name");
638 0 : break;
639 : }
640 4 : f = &prov->friendly_name[prov->friendly_name_count++];
641 4 : os_memcpy(f->lang, pos2 + 1, 3);
642 4 : os_memcpy(f->text, pos2 + 1 + 3, pos2[0] - 3);
643 4 : pos2 += 1 + pos2[0];
644 : }
645 :
646 : /* OSU Server URI */
647 2 : if (pos + 1 > end) {
648 0 : wpa_printf(MSG_DEBUG,
649 : "HS 2.0: Not enough room for OSU Server URI length");
650 0 : return;
651 : }
652 2 : uri_len = *pos++;
653 2 : if (uri_len > end - pos) {
654 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Server "
655 : "URI");
656 0 : return;
657 : }
658 2 : os_memcpy(prov->server_uri, pos, uri_len);
659 2 : pos += uri_len;
660 :
661 : /* OSU Method list */
662 2 : if (pos + 1 > end) {
663 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Method "
664 : "list length");
665 0 : return;
666 : }
667 2 : osu_method_len = pos[0];
668 2 : if (osu_method_len > end - pos - 1) {
669 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Method "
670 : "list");
671 0 : return;
672 : }
673 2 : pos2 = pos + 1;
674 2 : pos += 1 + osu_method_len;
675 6 : while (pos2 < pos) {
676 2 : if (*pos2 < 32)
677 2 : prov->osu_methods |= BIT(*pos2);
678 2 : pos2++;
679 : }
680 :
681 : /* Icons Available Length */
682 2 : if (pos + 2 > end) {
683 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for Icons "
684 : "Available Length");
685 0 : return;
686 : }
687 2 : len2 = WPA_GET_LE16(pos);
688 2 : pos += 2;
689 2 : if (len2 > end - pos) {
690 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for Icons "
691 : "Available");
692 0 : return;
693 : }
694 2 : pos2 = pos;
695 2 : pos += len2;
696 :
697 : /* Icons Available */
698 6 : while (pos2 < pos) {
699 2 : struct osu_icon *icon = &prov->icon[prov->icon_count];
700 : u8 flen;
701 :
702 2 : if (pos2 + 2 + 2 + 3 + 1 + 1 > pos) {
703 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Invalid Icon Metadata");
704 0 : break;
705 : }
706 :
707 2 : icon->width = WPA_GET_LE16(pos2);
708 2 : pos2 += 2;
709 2 : icon->height = WPA_GET_LE16(pos2);
710 2 : pos2 += 2;
711 2 : os_memcpy(icon->lang, pos2, 3);
712 2 : pos2 += 3;
713 :
714 2 : flen = pos2[0];
715 2 : if (flen > pos - pos2 - 1) {
716 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon Type");
717 0 : break;
718 : }
719 2 : os_memcpy(icon->icon_type, pos2 + 1, flen);
720 2 : pos2 += 1 + flen;
721 :
722 2 : if (pos2 + 1 > pos) {
723 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon "
724 : "Filename length");
725 0 : break;
726 : }
727 2 : flen = pos2[0];
728 2 : if (flen > pos - pos2 - 1) {
729 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon "
730 : "Filename");
731 0 : break;
732 : }
733 2 : os_memcpy(icon->filename, pos2 + 1, flen);
734 2 : pos2 += 1 + flen;
735 :
736 2 : prov->icon_count++;
737 : }
738 :
739 : /* OSU_NAI */
740 2 : if (pos + 1 > end) {
741 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU_NAI");
742 0 : return;
743 : }
744 2 : osu_nai_len = pos[0];
745 2 : if (osu_nai_len > end - pos - 1) {
746 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU_NAI");
747 0 : return;
748 : }
749 2 : os_memcpy(prov->osu_nai, pos + 1, osu_nai_len);
750 2 : pos += 1 + osu_nai_len;
751 :
752 : /* OSU Service Description Length */
753 2 : if (pos + 2 > end) {
754 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
755 : "Service Description Length");
756 0 : return;
757 : }
758 2 : len2 = WPA_GET_LE16(pos);
759 2 : pos += 2;
760 2 : if (len2 > end - pos) {
761 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
762 : "Service Description Duples");
763 0 : return;
764 : }
765 2 : pos2 = pos;
766 2 : pos += len2;
767 :
768 : /* OSU Service Description Duples */
769 8 : while (pos2 + 4 <= pos && prov->serv_desc_count < OSU_MAX_ITEMS) {
770 : struct osu_lang_string *f;
771 : u8 descr_len;
772 :
773 4 : descr_len = pos2[0];
774 4 : if (descr_len > pos - pos2 - 1 || descr_len < 3) {
775 0 : wpa_printf(MSG_DEBUG, "Invalid OSU Service "
776 : "Description");
777 0 : break;
778 : }
779 4 : f = &prov->serv_desc[prov->serv_desc_count++];
780 4 : os_memcpy(f->lang, pos2 + 1, 3);
781 4 : os_memcpy(f->text, pos2 + 1 + 3, descr_len - 3);
782 4 : pos2 += 1 + descr_len;
783 : }
784 :
785 12 : wpa_printf(MSG_DEBUG, "HS 2.0: Added OSU Provider through " MACSTR,
786 12 : MAC2STR(bss->bssid));
787 2 : wpa_s->osu_prov_count++;
788 : }
789 :
790 :
791 1 : void hs20_osu_icon_fetch(struct wpa_supplicant *wpa_s)
792 : {
793 : struct wpa_bss *bss;
794 : struct wpabuf *prov_anqp;
795 : const u8 *pos, *end;
796 : u16 len;
797 : const u8 *osu_ssid;
798 : u8 osu_ssid_len;
799 : u8 num_providers;
800 :
801 1 : hs20_free_osu_prov(wpa_s);
802 :
803 3 : dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
804 2 : if (bss->anqp == NULL)
805 0 : continue;
806 2 : prov_anqp = bss->anqp->hs20_osu_providers_list;
807 2 : if (prov_anqp == NULL)
808 0 : continue;
809 12 : wpa_printf(MSG_DEBUG, "HS 2.0: Parsing OSU Providers list from "
810 12 : MACSTR, MAC2STR(bss->bssid));
811 2 : wpa_hexdump_buf(MSG_DEBUG, "HS 2.0: OSU Providers list",
812 : prov_anqp);
813 2 : pos = wpabuf_head(prov_anqp);
814 2 : end = pos + wpabuf_len(prov_anqp);
815 :
816 : /* OSU SSID */
817 2 : if (pos + 1 > end)
818 0 : continue;
819 2 : if (pos + 1 + pos[0] > end) {
820 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for "
821 : "OSU SSID");
822 0 : continue;
823 : }
824 2 : osu_ssid_len = *pos++;
825 2 : if (osu_ssid_len > 32) {
826 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Invalid OSU SSID "
827 : "Length %u", osu_ssid_len);
828 0 : continue;
829 : }
830 2 : osu_ssid = pos;
831 2 : pos += osu_ssid_len;
832 :
833 2 : if (pos + 1 > end) {
834 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for "
835 : "Number of OSU Providers");
836 0 : continue;
837 : }
838 2 : num_providers = *pos++;
839 2 : wpa_printf(MSG_DEBUG, "HS 2.0: Number of OSU Providers: %u",
840 : num_providers);
841 :
842 : /* OSU Providers */
843 6 : while (pos + 2 < end && num_providers > 0) {
844 2 : num_providers--;
845 2 : len = WPA_GET_LE16(pos);
846 2 : pos += 2;
847 2 : if (len > (unsigned int) (end - pos))
848 0 : break;
849 2 : hs20_osu_add_prov(wpa_s, bss, osu_ssid,
850 : osu_ssid_len, pos, len);
851 2 : pos += len;
852 : }
853 :
854 2 : if (pos != end) {
855 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Ignored %d bytes of "
856 : "extra data after OSU Providers",
857 0 : (int) (end - pos));
858 : }
859 : }
860 :
861 1 : wpa_s->fetch_osu_icon_in_progress = 1;
862 1 : hs20_next_osu_icon(wpa_s);
863 1 : }
864 :
865 :
866 3 : static void hs20_osu_scan_res_handler(struct wpa_supplicant *wpa_s,
867 : struct wpa_scan_results *scan_res)
868 : {
869 3 : wpa_printf(MSG_DEBUG, "OSU provisioning fetch scan completed");
870 3 : if (!wpa_s->fetch_osu_waiting_scan) {
871 1 : wpa_printf(MSG_DEBUG, "OSU fetch have been canceled");
872 4 : return;
873 : }
874 2 : wpa_s->network_select = 0;
875 2 : wpa_s->fetch_all_anqp = 1;
876 2 : wpa_s->fetch_osu_info = 1;
877 2 : wpa_s->fetch_osu_icon_in_progress = 0;
878 :
879 2 : interworking_start_fetch_anqp(wpa_s);
880 : }
881 :
882 :
883 9 : int hs20_fetch_osu(struct wpa_supplicant *wpa_s)
884 : {
885 9 : if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
886 1 : wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
887 : "interface disabled");
888 1 : return -1;
889 : }
890 :
891 8 : if (wpa_s->scanning) {
892 2 : wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
893 : "scanning");
894 2 : return -1;
895 : }
896 :
897 6 : if (wpa_s->conf->osu_dir == NULL) {
898 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
899 : "osu_dir not configured");
900 0 : return -1;
901 : }
902 :
903 6 : if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
904 6 : wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
905 : "fetch in progress (%d, %d)",
906 3 : wpa_s->fetch_anqp_in_progress,
907 3 : wpa_s->network_select);
908 3 : return -1;
909 : }
910 :
911 3 : wpa_msg(wpa_s, MSG_INFO, "Starting OSU provisioning information fetch");
912 3 : wpa_s->num_osu_scans = 0;
913 3 : wpa_s->num_prov_found = 0;
914 3 : hs20_start_osu_scan(wpa_s);
915 :
916 3 : return 0;
917 : }
918 :
919 :
920 3 : void hs20_start_osu_scan(struct wpa_supplicant *wpa_s)
921 : {
922 3 : wpa_s->fetch_osu_waiting_scan = 1;
923 3 : wpa_s->num_osu_scans++;
924 3 : wpa_s->scan_req = MANUAL_SCAN_REQ;
925 3 : wpa_s->scan_res_handler = hs20_osu_scan_res_handler;
926 3 : wpa_supplicant_req_scan(wpa_s, 0, 0);
927 3 : }
928 :
929 :
930 3343 : void hs20_cancel_fetch_osu(struct wpa_supplicant *wpa_s)
931 : {
932 3343 : wpa_printf(MSG_DEBUG, "Cancel OSU fetch");
933 3343 : interworking_stop_fetch_anqp(wpa_s);
934 3343 : wpa_s->fetch_osu_waiting_scan = 0;
935 3343 : wpa_s->network_select = 0;
936 3343 : wpa_s->fetch_osu_info = 0;
937 3343 : wpa_s->fetch_osu_icon_in_progress = 0;
938 3343 : }
939 :
940 :
941 0 : void hs20_icon_fetch_failed(struct wpa_supplicant *wpa_s)
942 : {
943 0 : hs20_osu_icon_fetch_result(wpa_s, -1);
944 0 : eloop_cancel_timeout(hs20_continue_icon_fetch, wpa_s, NULL);
945 0 : eloop_register_timeout(0, 0, hs20_continue_icon_fetch, wpa_s, NULL);
946 0 : }
947 :
948 :
949 4 : void hs20_rx_subscription_remediation(struct wpa_supplicant *wpa_s,
950 : const char *url, u8 osu_method)
951 : {
952 4 : if (url)
953 3 : wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION "%u %s",
954 : osu_method, url);
955 : else
956 1 : wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION);
957 4 : }
958 :
959 :
960 3 : void hs20_rx_deauth_imminent_notice(struct wpa_supplicant *wpa_s, u8 code,
961 : u16 reauth_delay, const char *url)
962 : {
963 3 : if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
964 0 : wpa_printf(MSG_DEBUG, "HS 2.0: Ignore deauthentication imminent notice since PMF was not enabled");
965 0 : return;
966 : }
967 :
968 3 : wpa_msg(wpa_s, MSG_INFO, HS20_DEAUTH_IMMINENT_NOTICE "%u %u %s",
969 : code, reauth_delay, url);
970 :
971 3 : if (code == HS20_DEAUTH_REASON_CODE_BSS) {
972 1 : wpa_printf(MSG_DEBUG, "HS 2.0: Add BSS to blacklist");
973 1 : wpa_blacklist_add(wpa_s, wpa_s->bssid);
974 : /* TODO: For now, disable full ESS since some drivers may not
975 : * support disabling per BSS. */
976 1 : if (wpa_s->current_ssid) {
977 : struct os_reltime now;
978 1 : os_get_reltime(&now);
979 2 : if (now.sec + reauth_delay <=
980 1 : wpa_s->current_ssid->disabled_until.sec)
981 0 : return;
982 1 : wpa_printf(MSG_DEBUG, "HS 2.0: Disable network for %u seconds (BSS)",
983 : reauth_delay);
984 2 : wpa_s->current_ssid->disabled_until.sec =
985 1 : now.sec + reauth_delay;
986 : }
987 : }
988 :
989 3 : if (code == HS20_DEAUTH_REASON_CODE_ESS && wpa_s->current_ssid) {
990 : struct os_reltime now;
991 2 : os_get_reltime(&now);
992 4 : if (now.sec + reauth_delay <=
993 2 : wpa_s->current_ssid->disabled_until.sec)
994 0 : return;
995 2 : wpa_printf(MSG_DEBUG, "HS 2.0: Disable network for %u seconds",
996 : reauth_delay);
997 4 : wpa_s->current_ssid->disabled_until.sec =
998 2 : now.sec + reauth_delay;
999 : }
1000 : }
1001 :
1002 :
1003 288 : void hs20_deinit(struct wpa_supplicant *wpa_s)
1004 : {
1005 288 : eloop_cancel_timeout(hs20_continue_icon_fetch, wpa_s, NULL);
1006 288 : hs20_free_osu_prov(wpa_s);
1007 288 : }
|
