xref: /freebsd/contrib/wpa/wpa_supplicant/mbo.c (revision 53bb5613a8a15363718b6e6de8d965bf9a2c5469)
1 /*
2  * wpa_supplicant - MBO
3  *
4  * Copyright(c) 2015 Intel Deutschland GmbH
5  * Contact Information:
6  * Intel Linux Wireless <ilw@linux.intel.com>
7  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
8  *
9  * This software may be distributed under the terms of the BSD license.
10  * See README for more details.
11  */
12 
13 #include "utils/includes.h"
14 
15 #include "utils/common.h"
16 #include "common/ieee802_11_defs.h"
17 #include "common/gas.h"
18 #include "rsn_supp/wpa.h"
19 #include "config.h"
20 #include "wpa_supplicant_i.h"
21 #include "driver_i.h"
22 #include "bss.h"
23 #include "scan.h"
24 
25 /* type + length + oui + oui type */
26 #define MBO_IE_HEADER 6
27 
28 
29 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
30 {
31 	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
32 		return -1;
33 
34 	/* Only checking the validity of the channel and oper_class */
35 	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
36 		return -1;
37 
38 	return 0;
39 }
40 
41 
42 const u8 * mbo_attr_from_mbo_ie(const u8 *mbo_ie, enum mbo_attr_id attr)
43 {
44 	const u8 *mbo;
45 	u8 ie_len = mbo_ie[1];
46 
47 	if (ie_len < MBO_IE_HEADER - 2)
48 		return NULL;
49 	mbo = mbo_ie + MBO_IE_HEADER;
50 
51 	return get_ie(mbo, 2 + ie_len - MBO_IE_HEADER, attr);
52 }
53 
54 
55 const u8 * mbo_get_attr_from_ies(const u8 *ies, size_t ies_len,
56 				 enum mbo_attr_id attr)
57 {
58 	const u8 *mbo_ie;
59 
60 	mbo_ie = get_vendor_ie(ies, ies_len, MBO_IE_VENDOR_TYPE);
61 	if (!mbo_ie)
62 		return NULL;
63 
64 	return mbo_attr_from_mbo_ie(mbo_ie, attr);
65 }
66 
67 
68 static const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss,
69 					enum mbo_attr_id attr, bool beacon)
70 {
71 	const u8 *mbo, *end;
72 
73 	if (!bss)
74 		return NULL;
75 
76 	if (beacon)
77 		mbo = wpa_bss_get_vendor_ie_beacon(bss, MBO_IE_VENDOR_TYPE);
78 	else
79 		mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
80 	if (!mbo)
81 		return NULL;
82 
83 	end = mbo + 2 + mbo[1];
84 	mbo += MBO_IE_HEADER;
85 
86 	return get_ie(mbo, end - mbo, attr);
87 }
88 
89 
90 const u8 * wpas_mbo_check_assoc_disallow(struct wpa_bss *bss)
91 {
92 	const u8 *assoc_disallow;
93 
94 	assoc_disallow = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_ASSOC_DISALLOW,
95 					       bss->beacon_newer);
96 	if (assoc_disallow && assoc_disallow[1] >= 1)
97 		return assoc_disallow;
98 
99 	return NULL;
100 }
101 
102 
103 void wpas_mbo_check_pmf(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
104 			struct wpa_ssid *ssid)
105 {
106 	const u8 *rsne, *mbo, *oce;
107 	struct wpa_ie_data ie;
108 
109 	wpa_s->disable_mbo_oce = 0;
110 	if (!bss)
111 		return;
112 	mbo = wpas_mbo_get_bss_attr(bss, MBO_ATTR_ID_AP_CAPA_IND, false);
113 	oce = wpas_mbo_get_bss_attr(bss, OCE_ATTR_ID_CAPA_IND, false);
114 	if (!mbo && !oce)
115 		return;
116 	if (oce && oce[1] >= 1 && (oce[2] & OCE_IS_STA_CFON))
117 		return; /* STA-CFON is not required to enable PMF */
118 	rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
119 	if (!rsne || wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ie) < 0)
120 		return; /* AP is not using RSN */
121 
122 	if (!(ie.capabilities & WPA_CAPABILITY_MFPC))
123 		wpa_s->disable_mbo_oce = 1; /* AP uses RSN without PMF */
124 	if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
125 		wpa_s->disable_mbo_oce = 1; /* STA uses RSN without PMF */
126 	if (wpa_s->disable_mbo_oce)
127 		wpa_printf(MSG_INFO,
128 			   "MBO: Disable MBO/OCE due to misbehaving AP not having enabled PMF");
129 }
130 
131 
132 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
133 					     struct wpabuf *mbo,
134 					     u8 start, u8 end)
135 {
136 	u8 i;
137 
138 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
139 
140 	for (i = start; i < end; i++)
141 		wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
142 
143 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
144 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
145 }
146 
147 
148 static void wpas_mbo_non_pref_chan_attr_hdr(struct wpabuf *mbo, size_t size)
149 {
150 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
151 	wpabuf_put_u8(mbo, size); /* Length */
152 }
153 
154 
155 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
156 					struct wpabuf *mbo, u8 start, u8 end)
157 {
158 	size_t size = end - start + 3;
159 
160 	if (size + 2 > wpabuf_tailroom(mbo))
161 		return;
162 
163 	wpas_mbo_non_pref_chan_attr_hdr(mbo, size);
164 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
165 }
166 
167 
168 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
169 {
170 	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
171 	wpabuf_put_u8(mbo, len); /* Length */
172 	wpabuf_put_be24(mbo, OUI_WFA);
173 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
174 }
175 
176 
177 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
178 					      struct wpabuf *mbo, u8 start,
179 					      u8 end)
180 {
181 	size_t size = end - start + 7;
182 
183 	if (size + 2 > wpabuf_tailroom(mbo))
184 		return;
185 
186 	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
187 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
188 }
189 
190 
191 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
192 					 struct wpabuf *mbo, int subelement)
193 {
194 	u8 i, start = 0;
195 	struct wpa_mbo_non_pref_channel *start_pref;
196 
197 	if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
198 		if (subelement)
199 			wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
200 		else
201 			wpas_mbo_non_pref_chan_attr_hdr(mbo, 0);
202 		return;
203 	}
204 	start_pref = &wpa_s->non_pref_chan[0];
205 
206 	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
207 		struct wpa_mbo_non_pref_channel *non_pref = NULL;
208 
209 		if (i < wpa_s->non_pref_chan_num)
210 			non_pref = &wpa_s->non_pref_chan[i];
211 		if (!non_pref ||
212 		    non_pref->oper_class != start_pref->oper_class ||
213 		    non_pref->reason != start_pref->reason ||
214 		    non_pref->preference != start_pref->preference) {
215 			if (subelement)
216 				wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
217 								  start, i);
218 			else
219 				wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
220 							    i);
221 
222 			if (!non_pref)
223 				return;
224 
225 			start = i;
226 			start_pref = non_pref;
227 		}
228 	}
229 }
230 
231 
232 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len,
233 		int add_oce_capa)
234 {
235 	struct wpabuf *mbo;
236 	int res;
237 
238 	if (len < MBO_IE_HEADER + 3 + 7 +
239 	    ((wpa_s->enable_oce & OCE_STA) ? 3 : 0))
240 		return 0;
241 
242 	/* Leave room for the MBO IE header */
243 	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
244 	if (!mbo)
245 		return 0;
246 
247 	/* Add non-preferred channels attribute */
248 	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
249 
250 	/*
251 	 * Send cellular capabilities attribute even if AP does not advertise
252 	 * cellular capabilities.
253 	 */
254 	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
255 	wpabuf_put_u8(mbo, 1);
256 	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
257 
258 	/* Add OCE capability indication attribute if OCE is enabled */
259 	if ((wpa_s->enable_oce & OCE_STA) && add_oce_capa) {
260 		wpabuf_put_u8(mbo, OCE_ATTR_ID_CAPA_IND);
261 		wpabuf_put_u8(mbo, 1);
262 		wpabuf_put_u8(mbo, OCE_RELEASE);
263 	}
264 
265 	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
266 	if (!res)
267 		wpa_printf(MSG_ERROR, "Failed to add MBO/OCE IE");
268 
269 	wpabuf_free(mbo);
270 	return res;
271 }
272 
273 
274 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
275 					   const u8 *data, size_t len)
276 {
277 	struct wpabuf *buf;
278 	int res;
279 
280 	/*
281 	 * Send WNM-Notification Request frame only in case of a change in
282 	 * non-preferred channels list during association, if the AP supports
283 	 * MBO.
284 	 */
285 	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
286 	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
287 		return;
288 
289 	buf = wpabuf_alloc(4 + len);
290 	if (!buf)
291 		return;
292 
293 	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
294 	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
295 	wpa_s->mbo_wnm_token++;
296 	if (wpa_s->mbo_wnm_token == 0)
297 		wpa_s->mbo_wnm_token++;
298 	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
299 	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
300 
301 	wpabuf_put_data(buf, data, len);
302 
303 	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
304 				  wpa_s->own_addr, wpa_s->bssid,
305 				  wpabuf_head(buf), wpabuf_len(buf), 0);
306 	if (res < 0)
307 		wpa_printf(MSG_DEBUG,
308 			   "Failed to send WNM-Notification Request frame with non-preferred channel list");
309 
310 	wpabuf_free(buf);
311 }
312 
313 
314 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
315 {
316 	struct wpabuf *buf;
317 
318 	buf = wpabuf_alloc(512);
319 	if (!buf)
320 		return;
321 
322 	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
323 	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
324 				       wpabuf_len(buf));
325 	wpas_update_mbo_connect_params(wpa_s);
326 	wpabuf_free(buf);
327 }
328 
329 
330 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
331 				   struct wpa_mbo_non_pref_channel *b)
332 {
333 	return a->oper_class == b->oper_class && a->chan == b->chan;
334 }
335 
336 
337 /*
338  * wpa_non_pref_chan_cmp - Compare two channels for sorting
339  *
340  * In MBO IE non-preferred channel subelement we can put many channels in an
341  * attribute if they are in the same operating class and have the same
342  * preference and reason. To make it easy for the functions that build
343  * the IE attributes and WNM Request subelements, save the channels sorted
344  * by their oper_class and reason.
345  */
346 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
347 {
348 	const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
349 
350 	if (a->oper_class != b->oper_class)
351 		return (int) a->oper_class - (int) b->oper_class;
352 	if (a->reason != b->reason)
353 		return (int) a->reason - (int) b->reason;
354 	return (int) a->preference - (int) b->preference;
355 }
356 
357 
358 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
359 				  const char *non_pref_chan)
360 {
361 	char *cmd, *token, *context = NULL;
362 	struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
363 	size_t num = 0, size = 0;
364 	unsigned i;
365 
366 	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
367 		   non_pref_chan ? non_pref_chan : "N/A");
368 
369 	/*
370 	 * The shortest channel configuration is 7 characters - 3 colons and
371 	 * 4 values.
372 	 */
373 	if (!non_pref_chan || os_strlen(non_pref_chan) < 7)
374 		goto update;
375 
376 	cmd = os_strdup(non_pref_chan);
377 	if (!cmd)
378 		return -1;
379 
380 	while ((token = str_token(cmd, " ", &context))) {
381 		struct wpa_mbo_non_pref_channel *chan;
382 		int ret;
383 		unsigned int _oper_class;
384 		unsigned int _chan;
385 		unsigned int _preference;
386 		unsigned int _reason;
387 
388 		if (num == size) {
389 			size = size ? size * 2 : 1;
390 			tmp_chans = os_realloc_array(chans, size,
391 						     sizeof(*chans));
392 			if (!tmp_chans) {
393 				wpa_printf(MSG_ERROR,
394 					   "Couldn't reallocate non_pref_chan");
395 				goto fail;
396 			}
397 			chans = tmp_chans;
398 		}
399 
400 		chan = &chans[num];
401 
402 		ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
403 			     &_chan, &_preference, &_reason);
404 		if (ret != 4 ||
405 		    _oper_class > 255 || _chan > 255 ||
406 		    _preference > 255 || _reason > 65535 ) {
407 			wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
408 				   token);
409 			goto fail;
410 		}
411 		chan->oper_class = _oper_class;
412 		chan->chan = _chan;
413 		chan->preference = _preference;
414 		chan->reason = _reason;
415 
416 		if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
417 						    chan->chan, chan->reason)) {
418 			wpa_printf(MSG_ERROR,
419 				   "Invalid non_pref_chan: oper class %d chan %d reason %d",
420 				   chan->oper_class, chan->chan, chan->reason);
421 			goto fail;
422 		}
423 
424 		for (i = 0; i < num; i++)
425 			if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
426 				break;
427 		if (i != num) {
428 			wpa_printf(MSG_ERROR,
429 				   "oper class %d chan %d is duplicated",
430 				   chan->oper_class, chan->chan);
431 			goto fail;
432 		}
433 
434 		num++;
435 	}
436 
437 	os_free(cmd);
438 
439 	if (chans) {
440 		qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
441 		      wpa_non_pref_chan_cmp);
442 	}
443 
444 update:
445 	os_free(wpa_s->non_pref_chan);
446 	wpa_s->non_pref_chan = chans;
447 	wpa_s->non_pref_chan_num = num;
448 	wpas_mbo_non_pref_chan_changed(wpa_s);
449 
450 	return 0;
451 
452 fail:
453 	os_free(chans);
454 	os_free(cmd);
455 	return -1;
456 }
457 
458 
459 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
460 {
461 	u8 *len;
462 
463 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
464 	len = wpabuf_put(ie, 1);
465 
466 	wpabuf_put_be24(ie, OUI_WFA);
467 	wpabuf_put_u8(ie, MBO_OUI_TYPE);
468 
469 	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
470 	wpabuf_put_u8(ie, 1);
471 	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
472 	if (wpa_s->enable_oce & OCE_STA) {
473 		wpabuf_put_u8(ie, OCE_ATTR_ID_CAPA_IND);
474 		wpabuf_put_u8(ie, 1);
475 		wpabuf_put_u8(ie, OCE_RELEASE);
476 	}
477 	*len = (u8 *) wpabuf_put(ie, 0) - len - 1;
478 }
479 
480 
481 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
482 			   size_t len)
483 {
484 	const u8 *pos, *cell_pref = NULL;
485 	u8 id, elen;
486 	u16 disallowed_sec = 0;
487 
488 	if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
489 	    mbo_ie[3] != MBO_OUI_TYPE)
490 		return;
491 
492 	pos = mbo_ie + 4;
493 	len -= 4;
494 
495 	while (len >= 2) {
496 		id = *pos++;
497 		elen = *pos++;
498 		len -= 2;
499 
500 		if (elen > len)
501 			goto fail;
502 
503 		switch (id) {
504 		case MBO_ATTR_ID_CELL_DATA_PREF:
505 			if (elen != 1)
506 				goto fail;
507 
508 			if (wpa_s->conf->mbo_cell_capa ==
509 			    MBO_CELL_CAPA_AVAILABLE)
510 				cell_pref = pos;
511 			else
512 				wpa_printf(MSG_DEBUG,
513 					   "MBO: Station does not support Cellular data connection");
514 			break;
515 		case MBO_ATTR_ID_TRANSITION_REASON:
516 			if (elen != 1)
517 				goto fail;
518 
519 			wpa_s->wnm_mbo_trans_reason_present = 1;
520 			wpa_s->wnm_mbo_transition_reason = *pos;
521 			break;
522 		case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
523 			if (elen != 2)
524 				goto fail;
525 
526 			if (wpa_s->wnm_mode &
527 			    WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
528 				wpa_printf(MSG_DEBUG,
529 					   "MBO: Unexpected association retry delay, BSS is terminating");
530 				goto fail;
531 			} else if (wpa_s->wnm_mode &
532 				   WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
533 				disallowed_sec = WPA_GET_LE16(pos);
534 				wpa_printf(MSG_DEBUG,
535 					   "MBO: Association retry delay: %u",
536 					   disallowed_sec);
537 			} else {
538 				wpa_printf(MSG_DEBUG,
539 					   "MBO: Association retry delay attribute not in disassoc imminent mode");
540 			}
541 
542 			break;
543 		case MBO_ATTR_ID_AP_CAPA_IND:
544 		case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
545 		case MBO_ATTR_ID_CELL_DATA_CAPA:
546 		case MBO_ATTR_ID_ASSOC_DISALLOW:
547 		case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
548 			wpa_printf(MSG_DEBUG,
549 				   "MBO: Attribute %d should not be included in BTM Request frame",
550 				   id);
551 			break;
552 		default:
553 			wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
554 				   id);
555 			return;
556 		}
557 
558 		pos += elen;
559 		len -= elen;
560 	}
561 
562 	if (cell_pref)
563 		wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
564 			*cell_pref);
565 
566 	if (wpa_s->wnm_mbo_trans_reason_present)
567 		wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
568 			wpa_s->wnm_mbo_transition_reason);
569 
570 	if (disallowed_sec && wpa_s->current_bss)
571 		wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
572 				     disallowed_sec, 0);
573 
574 	return;
575 fail:
576 	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
577 		   id, elen, len);
578 }
579 
580 
581 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
582 				    size_t len,
583 				    enum mbo_transition_reject_reason reason)
584 {
585 	u8 reject_attr[3];
586 
587 	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
588 	reject_attr[1] = 1;
589 	reject_attr[2] = reason;
590 
591 	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
592 }
593 
594 
595 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
596 {
597 	u8 cell_capa[7];
598 
599 	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
600 		wpa_printf(MSG_DEBUG,
601 			   "MBO: Cellular capability already set to %u",
602 			   mbo_cell_capa);
603 		return;
604 	}
605 
606 	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
607 
608 	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
609 	cell_capa[1] = 5; /* Length */
610 	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
611 	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
612 	cell_capa[6] = mbo_cell_capa;
613 
614 	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
615 	wpa_supplicant_set_default_scan_ies(wpa_s);
616 	wpas_update_mbo_connect_params(wpa_s);
617 }
618 
619 
620 struct wpabuf * mbo_build_anqp_buf(struct wpa_supplicant *wpa_s,
621 				   struct wpa_bss *bss, u32 mbo_subtypes)
622 {
623 	struct wpabuf *anqp_buf;
624 	u8 *len_pos;
625 	u8 i;
626 
627 	if (!wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE)) {
628 		wpa_printf(MSG_INFO, "MBO: " MACSTR
629 			   " does not support MBO - cannot request MBO ANQP elements from it",
630 			   MAC2STR(bss->bssid));
631 		return NULL;
632 	}
633 
634 	/* Allocate size for the maximum case - all MBO subtypes are set */
635 	anqp_buf = wpabuf_alloc(9 + MAX_MBO_ANQP_SUBTYPE);
636 	if (!anqp_buf)
637 		return NULL;
638 
639 	len_pos = gas_anqp_add_element(anqp_buf, ANQP_VENDOR_SPECIFIC);
640 	wpabuf_put_be24(anqp_buf, OUI_WFA);
641 	wpabuf_put_u8(anqp_buf, MBO_ANQP_OUI_TYPE);
642 
643 	wpabuf_put_u8(anqp_buf, MBO_ANQP_SUBTYPE_QUERY_LIST);
644 
645 	/* The first valid MBO subtype is 1 */
646 	for (i = 1; i <= MAX_MBO_ANQP_SUBTYPE; i++) {
647 		if (mbo_subtypes & BIT(i))
648 			wpabuf_put_u8(anqp_buf, i);
649 	}
650 
651 	gas_anqp_set_element_len(anqp_buf, len_pos);
652 
653 	return anqp_buf;
654 }
655 
656 
657 void mbo_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
658 			    struct wpa_bss *bss, const u8 *sa,
659 			    const u8 *data, size_t slen)
660 {
661 	const u8 *pos = data;
662 	u8 subtype;
663 
664 	if (slen < 1)
665 		return;
666 
667 	subtype = *pos++;
668 	slen--;
669 
670 	switch (subtype) {
671 	case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
672 		if (slen < 1)
673 			break;
674 		wpa_msg(wpa_s, MSG_INFO, RX_MBO_ANQP MACSTR
675 			" cell_conn_pref=%u", MAC2STR(sa), *pos);
676 		break;
677 	default:
678 		wpa_printf(MSG_DEBUG, "MBO: Unsupported ANQP subtype %u",
679 			   subtype);
680 		break;
681 	}
682 }
683