xref: /freebsd/contrib/wpa/wpa_supplicant/mbo.c (revision 19261079b74319502c6ffa1249920079f0f69a72)
1 /*
2  * wpa_supplicant - MBO
3  *
4  * Copyright(c) 2015 Intel Deutschland GmbH
5  * Contact Information:
6  * Intel Linux Wireless <ilw@linux.intel.com>
7  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
8  *
9  * This software may be distributed under the terms of the BSD license.
10  * See README for more details.
11  */
12 
13 #include "utils/includes.h"
14 
15 #include "utils/common.h"
16 #include "common/ieee802_11_defs.h"
17 #include "common/gas.h"
18 #include "rsn_supp/wpa.h"
19 #include "config.h"
20 #include "wpa_supplicant_i.h"
21 #include "driver_i.h"
22 #include "bss.h"
23 #include "scan.h"
24 
25 /* type + length + oui + oui type */
26 #define MBO_IE_HEADER 6
27 
28 
29 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
30 {
31 	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
32 		return -1;
33 
34 	/* Only checking the validity of the channel and oper_class */
35 	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
36 		return -1;
37 
38 	return 0;
39 }
40 
41 
42 const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
43 {
44 	const u8 *mbo;
45 	u8 ie_len = mbo_ie[1];
46 
47 	if (ie_len < MBO_IE_HEADER - 2)
48 		return NULL;
49 	mbo = mbo_ie + MBO_IE_HEADER;
50 
51 	return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
52 }
53 
54 
55 const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
56 				 enum mbo_attr_id attr)
57 {
58 	const u8 *mbo_ie;
59 
60 	mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
61 	if (!mbo_ie)
62 		return NULL;
63 
64 	return mbo_attr_from_mbo_ie(mbo_ie, attr);
65 }
66 
67 
68 const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
69 {
70 	const u8 *mbo, *end;
71 
72 	if (!bss)
73 		return NULL;
74 
75 	mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
76 	if (!mbo)
77 		return NULL;
78 
79 	end = mbo + 2 + mbo[1];
80 	mbo += MBO_IE_HEADER;
81 
82 	return get_ie(mbo, end - mbo, attr);
83 }
84 
85 
86 void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
87 			struct wpa_ssid *ssid)
88 {
89 	const u8 *rsne, *mbo, *oce;
90 	struct wpa_ie_data ie;
91 
92 	wpa_s->disable_mbo_oce = 0;
93 	if (!bss)
94 		return;
95 	mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND);
96 	oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND);
97 	if (!mbo && !oce)
98 		return;
99 	if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
100 		return; /* STA-CFON is not required to enable PMF */
101 	rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
102 	if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
103 		return; /* AP is not using RSN */
104 
105 	if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
106 		wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
107 	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
108 		wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
109 	if (wpa_s->disable_mbo_oce)
110 		wpa_printf(MSG_INFO,
111 			   "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
112 }
113 
114 
115 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
116 					     struct wpabuf *mbo,
117 					     u8 start, u8 end)
118 {
119 	u8 i;
120 
121 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
122 
123 	for (i = start; i < end; i++)
124 		wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
125 
126 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
127 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
128 }
129 
130 
131 static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
132 {
133 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
134 	wpabuf_put_u8(mbo, size); /* Length */
135 }
136 
137 
138 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
139 					struct wpabuf *mbo, u8 start, u8 end)
140 {
141 	size_t size = end - start + 3;
142 
143 	if (size + 2 > wpabuf_tailroom(mbo))
144 		return;
145 
146 	wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
147 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
148 }
149 
150 
151 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
152 {
153 	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
154 	wpabuf_put_u8(mbo, len); /* Length */
155 	wpabuf_put_be24(mbo, OUI_WFA);
156 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
157 }
158 
159 
160 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
161 					      struct wpabuf *mbo, u8 start,
162 					      u8 end)
163 {
164 	size_t size = end - start + 7;
165 
166 	if (size + 2 > wpabuf_tailroom(mbo))
167 		return;
168 
169 	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
170 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
171 }
172 
173 
174 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
175 					 struct wpabuf *mbo, int subelement)
176 {
177 	u8 i, start = 0;
178 	struct wpa_mbo_non_pref_channel *start_pref;
179 
180 	if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
181 		if (subelement)
182 			wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
183 		else
184 			wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
185 		return;
186 	}
187 	start_pref = &wpa_s->non_pref_chan[0];
188 
189 	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
190 		struct wpa_mbo_non_pref_channel *non_pref = NULL;
191 
192 		if (i < wpa_s->non_pref_chan_num)
193 			non_pref = &wpa_s->non_pref_chan[i];
194 		if (!non_pref ||
195 		    non_pref->oper_class != start_pref->oper_class ||
196 		    non_pref->reason != start_pref->reason ||
197 		    non_pref->preference != start_pref->preference) {
198 			if (subelement)
199 				wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
200 								  start, i);
201 			else
202 				wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
203 							    i);
204 
205 			if (!non_pref)
206 				return;
207 
208 			start = i;
209 			start_pref = non_pref;
210 		}
211 	}
212 }
213 
214 
215 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len,
216 		int add_oce_capa)
217 {
218 	struct wpabuf *mbo;
219 	int res;
220 
221 	if (len < MBO_IE_HEADER + 3 + 7 +
222 	    ((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
223 		return 0;
224 
225 	/* Leave room for the MBO IE header */
226 	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
227 	if (!mbo)
228 		return 0;
229 
230 	/* Add non-preferred channels attribute */
231 	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
232 
233 	/*
234 	 * Send cellular capabilities attribute even if AP does not advertise
235 	 * cellular capabilities.
236 	 */
237 	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
238 	wpabuf_put_u8(mbo, 1);
239 	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
240 
241 	/* Add OCE capability indication attribute if OCE is enabled */
242 	if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
243 		wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
244 		wpabuf_put_u8(mbo, 1);
245 		wpabuf_put_u8(mbo, OCE_RELEASE);
246 	}
247 
248 	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
249 	if (!res)
250 		wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");
251 
252 	wpabuf_free(mbo);
253 	return res;
254 }
255 
256 
257 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
258 					   const u8 *data, size_t len)
259 {
260 	struct wpabuf *buf;
261 	int res;
262 
263 	/*
264 	 * Send WNM-Notification Request frame only in case of a change in
265 	 * non-preferred channels list during association, if the AP supports
266 	 * MBO.
267 	 */
268 	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
269 	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
270 		return;
271 
272 	buf = wpabuf_alloc(4 + len);
273 	if (!buf)
274 		return;
275 
276 	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
277 	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
278 	wpa_s->mbo_wnm_token++;
279 	if (wpa_s->mbo_wnm_token == 0)
280 		wpa_s->mbo_wnm_token++;
281 	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
282 	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
283 
284 	wpabuf_put_data(buf, data, len);
285 
286 	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
287 				  wpa_s->own_addr, wpa_s->bssid,
288 				  wpabuf_head(buf), wpabuf_len(buf), 0);
289 	if (res < 0)
290 		wpa_printf(MSG_DEBUG,
291 			   "Failed to send WNM-Notification Request frame with non-preferred channel list");
292 
293 	wpabuf_free(buf);
294 }
295 
296 
297 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
298 {
299 	struct wpabuf *buf;
300 
301 	buf = wpabuf_alloc(512);
302 	if (!buf)
303 		return;
304 
305 	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
306 	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
307 				       wpabuf_len(buf));
308 	wpas_update_mbo_connect_params(wpa_s);
309 	wpabuf_free(buf);
310 }
311 
312 
313 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
314 				   struct wpa_mbo_non_pref_channel *b)
315 {
316 	return a->oper_class == b->oper_class && a->chan == b->chan;
317 }
318 
319 
320 /*
321  * wpa_non_pref_chan_cmp - Compare two channels for sorting
322  *
323  * In MBO IE non-preferred channel subelement we can put many channels in an
324  * attribute if they are in the same operating class and have the same
325  * preference and reason. To make it easy for the functions that build
326  * the IE attributes and WNM Request subelements, save the channels sorted
327  * by their oper_class and reason.
328  */
329 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
330 {
331 	const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
332 
333 	if (a->oper_class != b->oper_class)
334 		return (int) a->oper_class - (int) b->oper_class;
335 	if (a->reason != b->reason)
336 		return (int) a->reason - (int) b->reason;
337 	return (int) a->preference - (int) b->preference;
338 }
339 
340 
341 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
342 				  const char *non_pref_chan)
343 {
344 	char *cmd, *token, *context = NULL;
345 	struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
346 	size_t num = 0, size = 0;
347 	unsigned i;
348 
349 	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
350 		   non_pref_chan ? non_pref_chan : "N/A");
351 
352 	/*
353 	 * The shortest channel configuration is 7 characters - 3 colons and
354 	 * 4 values.
355 	 */
356 	if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
357 		goto update;
358 
359 	cmd = os_strdup(non_pref_chan);
360 	if (!cmd)
361 		return -1;
362 
363 	while ((token = str_token(cmd, " ", &context))) {
364 		struct wpa_mbo_non_pref_channel *chan;
365 		int ret;
366 		unsigned int _oper_class;
367 		unsigned int _chan;
368 		unsigned int _preference;
369 		unsigned int _reason;
370 
371 		if (num == size) {
372 			size = size ? size * 2 : 1;
373 			tmp_chans = os_realloc_array(chans, size,
374 						     sizeof(*chans));
375 			if (!tmp_chans) {
376 				wpa_printf(MSG_ERROR,
377 					   "Couldn't reallocate non_pref_chan");
378 				goto fail;
379 			}
380 			chans = tmp_chans;
381 		}
382 
383 		chan = &chans[num];
384 
385 		ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
386 			     &_chan, &_preference, &_reason);
387 		if (ret != 4 ||
388 		    _oper_class > 255 || _chan > 255 ||
389 		    _preference > 255 || _reason > 65535 ) {
390 			wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
391 				   token);
392 			goto fail;
393 		}
394 		chan->oper_class = _oper_class;
395 		chan->chan = _chan;
396 		chan->preference = _preference;
397 		chan->reason = _reason;
398 
399 		if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
400 						    chan->chan, chan->reason)) {
401 			wpa_printf(MSG_ERROR,
402 				   "Invalid non_pref_chan: oper class %d chan %d reason %d",
403 				   chan->oper_class, chan->chan, chan->reason);
404 			goto fail;
405 		}
406 
407 		for (i = 0; i < num; i++)
408 			if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
409 				break;
410 		if (i != num) {
411 			wpa_printf(MSG_ERROR,
412 				   "oper class %d chan %d is duplicated",
413 				   chan->oper_class, chan->chan);
414 			goto fail;
415 		}
416 
417 		num++;
418 	}
419 
420 	os_free(cmd);
421 
422 	if (chans) {
423 		qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
424 		      wpa_non_pref_chan_cmp);
425 	}
426 
427 update:
428 	os_free(wpa_s->non_pref_chan);
429 	wpa_s->non_pref_chan = chans;
430 	wpa_s->non_pref_chan_num = num;
431 	wpas_mbo_non_pref_chan_changed(wpa_s);
432 
433 	return 0;
434 
435 fail:
436 	os_free(chans);
437 	os_free(cmd);
438 	return -1;
439 }
440 
441 
442 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
443 {
444 	u8 *len;
445 
446 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
447 	len = wpabuf_put(ie, 1);
448 
449 	wpabuf_put_be24(ie, OUI_WFA);
450 	wpabuf_put_u8(ie, MBO_OUI_TYPE);
451 
452 	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
453 	wpabuf_put_u8(ie, 1);
454 	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
455 	if (wpa_s->enable_oce & OCE_STA) {
456 		wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
457 		wpabuf_put_u8(ie, 1);
458 		wpabuf_put_u8(ie, OCE_RELEASE);
459 	}
460 	*len = (u8 *) wpabuf_put(ie, 0) - len - 1;
461 }
462 
463 
464 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
465 			   size_t len)
466 {
467 	const u8 *pos, *cell_pref = NULL;
468 	u8 id, elen;
469 	u16 disallowed_sec = 0;
470 
471 	if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
472 	    mbo_ie[3] != MBO_OUI_TYPE)
473 		return;
474 
475 	pos = mbo_ie + 4;
476 	len -= 4;
477 
478 	while (len >= 2) {
479 		id = *pos++;
480 		elen = *pos++;
481 		len -= 2;
482 
483 		if (elen > len)
484 			goto fail;
485 
486 		switch (id) {
487 		case MBO_ATTR_ID_CELL_DATA_PREF:
488 			if (elen != 1)
489 				goto fail;
490 
491 			if (wpa_s->conf->mbo_cell_capa ==
492 			    MBO_CELL_CAPA_AVAILABLE)
493 				cell_pref = pos;
494 			else
495 				wpa_printf(MSG_DEBUG,
496 					   "MBO: Station does not support Cellular data connection");
497 			break;
498 		case MBO_ATTR_ID_TRANSITION_REASON:
499 			if (elen != 1)
500 				goto fail;
501 
502 			wpa_s->wnm_mbo_trans_reason_present = 1;
503 			wpa_s->wnm_mbo_transition_reason = *pos;
504 			break;
505 		case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
506 			if (elen != 2)
507 				goto fail;
508 
509 			if (wpa_s->wnm_mode &
510 			    WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
511 				wpa_printf(MSG_DEBUG,
512 					   "MBO: Unexpected association retry delay, BSS is terminating");
513 				goto fail;
514 			} else if (wpa_s->wnm_mode &
515 				   WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
516 				disallowed_sec = WPA_GET_LE16(pos);
517 				wpa_printf(MSG_DEBUG,
518 					   "MBO: Association retry delay: %u",
519 					   disallowed_sec);
520 			} else {
521 				wpa_printf(MSG_DEBUG,
522 					   "MBO: Association retry delay attribute not in disassoc imminent mode");
523 			}
524 
525 			break;
526 		case MBO_ATTR_ID_AP_CAPA_IND:
527 		case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
528 		case MBO_ATTR_ID_CELL_DATA_CAPA:
529 		case MBO_ATTR_ID_ASSOC_DISALLOW:
530 		case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
531 			wpa_printf(MSG_DEBUG,
532 				   "MBO: Attribute %d should not be included in BTM Request frame",
533 				   id);
534 			break;
535 		default:
536 			wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
537 				   id);
538 			return;
539 		}
540 
541 		pos += elen;
542 		len -= elen;
543 	}
544 
545 	if (cell_pref)
546 		wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
547 			*cell_pref);
548 
549 	if (wpa_s->wnm_mbo_trans_reason_present)
550 		wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
551 			wpa_s->wnm_mbo_transition_reason);
552 
553 	if (disallowed_sec && wpa_s->current_bss)
554 		wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
555 				     disallowed_sec, 0);
556 
557 	return;
558 fail:
559 	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
560 		   id, elen, len);
561 }
562 
563 
564 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
565 				    size_t len,
566 				    enum mbo_transition_reject_reason reason)
567 {
568 	u8 reject_attr[3];
569 
570 	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
571 	reject_attr[1] = 1;
572 	reject_attr[2] = reason;
573 
574 	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
575 }
576 
577 
578 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
579 {
580 	u8 cell_capa[7];
581 
582 	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
583 		wpa_printf(MSG_DEBUG,
584 			   "MBO: Cellular capability already set to %u",
585 			   mbo_cell_capa);
586 		return;
587 	}
588 
589 	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
590 
591 	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
592 	cell_capa[1] = 5; /* Length */
593 	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
594 	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
595 	cell_capa[6] = mbo_cell_capa;
596 
597 	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
598 	wpa_supplicant_set_default_scan_ies(wpa_s);
599 	wpas_update_mbo_connect_params(wpa_s);
600 }
601 
602 
603 struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
604 				   struct wpa_bss *bss, u32 mbo_subtypes)
605 {
606 	struct wpabuf *anqp_buf;
607 	u8 *len_pos;
608 	u8 i;
609 
610 	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
611 		wpa_printf(MSG_INFO, "MBO: " MACSTR
612 			   " does not support MBO - cannot request MBO ANQP elements from it",
613 			   MAC2STR(bss->bssid));
614 		return NULL;
615 	}
616 
617 	/* Allocate size for the maximum case - all MBO subtypes are set */
618 	anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
619 	if (!anqp_buf)
620 		return NULL;
621 
622 	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
623 	wpabuf_put_be24(anqp_buf, OUI_WFA);
624 	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
625 
626 	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);
627 
628 	/* The first valid MBO subtype is 1 */
629 	for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
630 		if (mbo_subtypes & BIT(i))
631 			wpabuf_put_u8(anqp_buf, i);
632 	}
633 
634 	gas_anqp_set_element_len(anqp_buf, len_pos);
635 
636 	return anqp_buf;
637 }
638 
639 
640 void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
641 			    struct wpa_bss *bss, const u8 *sa,
642 			    const u8 *data, size_t slen)
643 {
644 	const u8 *pos = data;
645 	u8 subtype;
646 
647 	if (slen < 1)
648 		return;
649 
650 	subtype = *pos++;
651 	slen--;
652 
653 	switch (subtype) {
654 	case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
655 		if (slen < 1)
656 			break;
657 		wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
658 			" cell_conn_pref=%u", MAC2STR(sa), *pos);
659 		break;
660 	default:
661 		wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
662 			   subtype);
663 		break;
664 	}
665 }
666