/src/hostap/wpa_supplicant/robust_av.c

Source
/*
 * wpa_supplicant - Robust AV procedures
 * Copyright (c) 2020, The Linux Foundation
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#include "utils/includes.h"
#include "utils/common.h"
#include "utils/eloop.h"
#include "common/wpa_ctrl.h"
#include "common/ieee802_11_common.h"
#include "wpa_supplicant_i.h"
#include "driver_i.h"
#include "bss.h"


#define SCS_RESP_TIMEOUT 1
#define DSCP_REQ_TIMEOUT 5


void wpas_populate_mscs_descriptor_ie(struct robust_av_data *robust_av,
              struct wpabuf *buf)
{
  u8 *len, *len1;

  /* MSCS descriptor element */
  wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
  len = wpabuf_put(buf, 1);
  wpabuf_put_u8(buf, WLAN_EID_EXT_MSCS_DESCRIPTOR);
  wpabuf_put_u8(buf, robust_av->request_type);
  wpabuf_put_u8(buf, robust_av->up_bitmap);
  wpabuf_put_u8(buf, robust_av->up_limit);
  wpabuf_put_le32(buf, robust_av->stream_timeout);

  if (robust_av->request_type != SCS_REQ_REMOVE) {
    /* TCLAS mask element */
    wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
    len1 = wpabuf_put(buf, 1);
    wpabuf_put_u8(buf, WLAN_EID_EXT_TCLAS_MASK);

    /* Frame classifier */
    wpabuf_put_data(buf, robust_av->frame_classifier,
        robust_av->frame_classifier_len);
    *len1 = (u8 *) wpabuf_put(buf, 0) - len1 - 1;
  }

  *len = (u8 *) wpabuf_put(buf, 0) - len - 1;
}


static int wpas_populate_type4_classifier(struct type4_params *type4_param,
            struct wpabuf *buf)
{
  /* classifier parameters */
  wpabuf_put_u8(buf, type4_param->classifier_mask);
  if (type4_param->ip_version == IPV4) {
    wpabuf_put_u8(buf, IPV4); /* IP version */
    wpabuf_put_data(buf, &type4_param->ip_params.v4.src_ip.s_addr,
        4);
    wpabuf_put_data(buf, &type4_param->ip_params.v4.dst_ip.s_addr,
        4);
    wpabuf_put_be16(buf, type4_param->ip_params.v4.src_port);
    wpabuf_put_be16(buf, type4_param->ip_params.v4.dst_port);
    wpabuf_put_u8(buf, type4_param->ip_params.v4.dscp);
    wpabuf_put_u8(buf, type4_param->ip_params.v4.protocol);
    wpabuf_put_u8(buf, 0); /* Reserved octet */
  } else {
    wpabuf_put_u8(buf, IPV6);
    wpabuf_put_data(buf, &type4_param->ip_params.v6.src_ip.s6_addr,
        16);
    wpabuf_put_data(buf, &type4_param->ip_params.v6.dst_ip.s6_addr,
        16);
    wpabuf_put_be16(buf, type4_param->ip_params.v6.src_port);
    wpabuf_put_be16(buf, type4_param->ip_params.v6.dst_port);
    wpabuf_put_u8(buf, type4_param->ip_params.v6.dscp);
    wpabuf_put_u8(buf, type4_param->ip_params.v6.next_header);
    wpabuf_put_data(buf, type4_param->ip_params.v6.flow_label, 3);
  }

  return 0;
}


static int wpas_populate_type10_classifier(struct type10_params *type10_param,
             struct wpabuf *buf)
{
  /* classifier parameters */
  wpabuf_put_u8(buf, type10_param->prot_instance);
  wpabuf_put_u8(buf, type10_param->prot_number);
  wpabuf_put_data(buf, type10_param->filter_value,
      type10_param->filter_len);
  wpabuf_put_data(buf, type10_param->filter_mask,
      type10_param->filter_len);
  return 0;
}


static bool tclas_elem_required(const struct qos_characteristics *qos_elem)
{
  if (!qos_elem || !qos_elem->available)
    return true;

  if (qos_elem->direction == SCS_DIRECTION_DOWN)
    return true;

  return false;
}


static int wpas_populate_scs_descriptor_ie(struct scs_desc_elem *desc_elem,
             struct wpabuf *buf,
             bool allow_scs_traffic_desc)
{
  u8 *len, *len1;
  struct tclas_element *tclas_elem;
  unsigned int i;
  struct qos_characteristics *qos_elem;
  u32 control_info = 0;

  /* SCS Descriptor element */
  wpabuf_put_u8(buf, WLAN_EID_SCS_DESCRIPTOR);
  len = wpabuf_put(buf, 1);
  wpabuf_put_u8(buf, desc_elem->scs_id);
  wpabuf_put_u8(buf, desc_elem->request_type);
  if (desc_elem->request_type == SCS_REQ_REMOVE)
    goto end;

  if (!tclas_elem_required(&desc_elem->qos_char_elem))
    goto skip_tclas_elem;

  if (desc_elem->intra_access_priority || desc_elem->scs_up_avail) {
    wpabuf_put_u8(buf, WLAN_EID_INTRA_ACCESS_CATEGORY_PRIORITY);
    wpabuf_put_u8(buf, 1);
    wpabuf_put_u8(buf, desc_elem->intra_access_priority);
  }

  tclas_elem = desc_elem->tclas_elems;

  if (!tclas_elem)
    return -1;

  for (i = 0; i < desc_elem->num_tclas_elem; i++, tclas_elem++) {
    int ret;

    /* TCLAS element */
    wpabuf_put_u8(buf, WLAN_EID_TCLAS);
    len1 = wpabuf_put(buf, 1);
    wpabuf_put_u8(buf, 255); /* User Priority: not compared */
    /* Frame Classifier */
    wpabuf_put_u8(buf, tclas_elem->classifier_type);
    /* Frame classifier parameters */
    switch (tclas_elem->classifier_type) {
    case 4:
      ret = wpas_populate_type4_classifier(
        &tclas_elem->frame_classifier.type4_param,
        buf);
      break;
    case 10:
      ret = wpas_populate_type10_classifier(
        &tclas_elem->frame_classifier.type10_param,
        buf);
      break;
    default:
      return -1;
    }

    if (ret == -1) {
      wpa_printf(MSG_ERROR,
           "Failed to populate frame classifier");
      return -1;
    }

    *len1 = (u8 *) wpabuf_put(buf, 0) - len1 - 1;
  }

  if (desc_elem->num_tclas_elem > 1) {
    /* TCLAS Processing element */
    wpabuf_put_u8(buf, WLAN_EID_TCLAS_PROCESSING);
    wpabuf_put_u8(buf, 1);
    wpabuf_put_u8(buf, desc_elem->tclas_processing);
  }

skip_tclas_elem:
  if (allow_scs_traffic_desc && desc_elem->qos_char_elem.available) {
    qos_elem = &desc_elem->qos_char_elem;
    /* Element ID, Length, and Element ID Extension */
    wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
    len1 = wpabuf_put(buf, 1);
    wpabuf_put_u8(buf, WLAN_EID_EXT_QOS_CHARACTERISTICS);

    /* Remove invalid mask bits */

    /* Medium Time is applicable only for direct link */
    if ((qos_elem->mask & SCS_QOS_BIT_MEDIUM_TIME) &&
        qos_elem->direction != SCS_DIRECTION_DIRECT)
      qos_elem->mask &= ~SCS_QOS_BIT_MEDIUM_TIME;

    /* Service Start Time LinkID is valid only when Service Start
     * Time is present.
     */
    if ((qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME_LINKID) &&
        !(qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME))
      qos_elem->mask &=
        ~SCS_QOS_BIT_SERVICE_START_TIME_LINKID;

    /* IEEE P802.11be/D4.0, 9.4.2.316 QoS Characteristics element,
     * Figure 9-1001av (Control Info field format)
     */
    control_info = ((u32) qos_elem->direction <<
        EHT_QOS_CONTROL_INFO_DIRECTION_OFFSET);
    control_info |= ((u32) desc_elem->intra_access_priority <<
         EHT_QOS_CONTROL_INFO_TID_OFFSET);
    control_info |= ((u32) desc_elem->intra_access_priority <<
         EHT_QOS_CONTROL_INFO_USER_PRIORITY_OFFSET);
    control_info |= ((u32) qos_elem->mask <<
         EHT_QOS_CONTROL_INFO_PRESENCE_MASK_OFFSET);

    /* Control Info */
    wpabuf_put_le32(buf, control_info);
    /* Minimum Service Interval */
    wpabuf_put_le32(buf, qos_elem->min_si);
    /* Maximum Service Interval */
    wpabuf_put_le32(buf, qos_elem->max_si);
    /* Minimum Data Rate */
    wpabuf_put_le24(buf, qos_elem->min_data_rate);
    /* Delay Bound */
    wpabuf_put_le24(buf, qos_elem->delay_bound);

    /* Maximum MSDU Size */
    if (qos_elem->mask & SCS_QOS_BIT_MAX_MSDU_SIZE)
      wpabuf_put_le16(buf, qos_elem->max_msdu_size);
    /* Start Service Time */
    if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME)
      wpabuf_put_le32(buf, qos_elem->service_start_time);
    /* Service Start Time LinkID */
    if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME_LINKID)
      wpabuf_put_u8(buf,
              qos_elem->service_start_time_link_id);
    /* Mean Data Rate */
    if (qos_elem->mask & SCS_QOS_BIT_MEAN_DATA_RATE)
      wpabuf_put_le24(buf, qos_elem->mean_data_rate);
    /* Delayed Bounded Burst Size */
    if (qos_elem->mask & SCS_QOS_BIT_DELAYED_BOUNDED_BURST_SIZE)
      wpabuf_put_le32(buf, qos_elem->burst_size);
    /* MSDU Lifetime */
    if (qos_elem->mask & SCS_QOS_BIT_MSDU_LIFETIME)
      wpabuf_put_le16(buf, qos_elem->msdu_lifetime);
    /* MSDU Delivery Info */
    if (qos_elem->mask & SCS_QOS_BIT_MSDU_DELIVERY_INFO)
      wpabuf_put_u8(buf, qos_elem->msdu_delivery_info);
    /* Medium Time */
    if (qos_elem->mask & SCS_QOS_BIT_MEDIUM_TIME)
      wpabuf_put_le16(buf, qos_elem->medium_time);

    *len1 = (u8 *) wpabuf_put(buf, 0) - len1 - 1;
  }

end:
  *len = (u8 *) wpabuf_put(buf, 0) - len - 1;
  return 0;
}


static int populate_type10_classifier_data(const struct tclas_element *src,
             struct tclas_element *dst,
             unsigned int num_tclas_elem)
{
  struct type10_params *t10_param;
  unsigned int i;
  size_t filter_len;

  if (!src)
    return 0;

  if (!dst)
    return -1;

  for (i = 0; i < num_tclas_elem; i++, src++, dst++) {
    if (src->classifier_type != 10)
      continue;

    filter_len = src->frame_classifier.type10_param.filter_len;
    if (!filter_len)
      continue;

    t10_param = &dst->frame_classifier.type10_param;
    t10_param->filter_value = os_memdup(
      src->frame_classifier.type10_param.filter_value,
      filter_len);
    if (!t10_param->filter_value)
      return -1;

    t10_param->filter_mask = os_memdup(
      src->frame_classifier.type10_param.filter_mask,
      filter_len);
    if (!t10_param->filter_mask) {
      os_free(t10_param->filter_value);
      t10_param->filter_value = NULL;
      return -1;
    }

    t10_param->filter_len = filter_len;
  }

  return 0;
}


int wpas_send_mscs_req(struct wpa_supplicant *wpa_s)
{
  struct wpabuf *buf;
  size_t buf_len;
  int ret;

  if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid)
    return 0;

  if (!wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS)) {
    wpa_dbg(wpa_s, MSG_INFO,
      "AP does not support MSCS - could not send MSCS Req");
    return -1;
  }

  if (!wpa_s->mscs_setup_done &&
      wpa_s->robust_av.request_type != SCS_REQ_ADD) {
    wpa_msg(wpa_s, MSG_INFO,
      "MSCS: Failed to send MSCS Request: request type invalid");
    return -1;
  }

  buf_len = 3 + /* Action frame header */
      3 + /* MSCS descriptor IE header */
      1 + /* Request type */
      2 + /* User priority control */
      4 + /* Stream timeout */
      3 + /* TCLAS Mask IE header */
      wpa_s->robust_av.frame_classifier_len;

  buf = wpabuf_alloc(buf_len);
  if (!buf) {
    wpa_printf(MSG_ERROR, "Failed to allocate MSCS req");
    return -1;
  }

  wpabuf_put_u8(buf, WLAN_ACTION_ROBUST_AV_STREAMING);
  wpabuf_put_u8(buf, ROBUST_AV_MSCS_REQ);
  wpa_s->robust_av.dialog_token++;
  wpabuf_put_u8(buf, wpa_s->robust_av.dialog_token);

  /* MSCS descriptor element */
  wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, buf);

  wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", buf);
  ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
          wpa_s->own_addr, wpa_s->bssid,
          wpabuf_head(buf), wpabuf_len(buf), 0);
  if (ret < 0)
    wpa_dbg(wpa_s, MSG_INFO, "MSCS: Failed to send MSCS Request");

  wpabuf_free(buf);
  return ret;
}


static size_t tclas_elem_len(const struct tclas_element *elem)
{
  size_t buf_len = 0;

  buf_len += 2 +  /* TCLAS element header */
    1 + /* User Priority */
    1 ; /* Classifier Type */

  if (elem->classifier_type == 4) {
    enum ip_version ip_ver;

    buf_len += 1 +  /* Classifier mask */
      1 + /* IP version */
      1 + /* user priority */
      2 + /* src_port */
      2 + /* dst_port */
      1 ; /* dscp */
    ip_ver = elem->frame_classifier.type4_param.ip_version;
    if (ip_ver == IPV4) {
      buf_len += 4 +  /* src_ip */
        4 + /* dst_ip */
        1 + /* protocol */
        1 ;  /* Reserved */
    } else if (ip_ver == IPV6) {
      buf_len += 16 +  /* src_ip */
        16 +  /* dst_ip */
        1  +  /* next_header */
        3  ;  /* flow_label */
    } else {
      wpa_printf(MSG_ERROR, "%s: Incorrect IP version %d",
           __func__, ip_ver);
      return 0;
    }
  } else if (elem->classifier_type == 10) {
    buf_len += 1 +  /* protocol instance */
      1 + /* protocol number */
      2 * elem->frame_classifier.type10_param.filter_len;
  } else {
    wpa_printf(MSG_ERROR, "%s: Incorrect classifier type %u",
         __func__, elem->classifier_type);
    return 0;
  }

  return buf_len;
}


static size_t qos_char_len(const struct qos_characteristics *qos_elem)
{
  size_t buf_len = 0;

  buf_len += 1 +  /* Element ID */
    1 + /* Length */
    1 + /* Element ID Extension */
    4 + /* Control Info */
    4 + /* Minimum Service Interval */
    4 + /* Maximum Service Interval */
    3 + /* Minimum Data Rate */
    3;  /* Delay Bound */

  if (qos_elem->mask & SCS_QOS_BIT_MAX_MSDU_SIZE)
    buf_len += 2;  /* Maximum MSDU Size */

  if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME) {
    buf_len += 4;  /* Service Start Time */
    if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME_LINKID)
      buf_len++; /* Service Start Time LinkID */
  }

  if (qos_elem->mask & SCS_QOS_BIT_MEAN_DATA_RATE)
    buf_len += 3;  /* Mean Data Rate */

  if (qos_elem->mask & SCS_QOS_BIT_DELAYED_BOUNDED_BURST_SIZE)
    buf_len += 4;  /* Delayed Bounded Burst Size */

  if (qos_elem->mask & SCS_QOS_BIT_MSDU_LIFETIME)
    buf_len += 2;  /* MSDU Lifetime */

  if (qos_elem->mask & SCS_QOS_BIT_MSDU_DELIVERY_INFO)
    buf_len++;  /* MSDU Delivery Info */

  if (qos_elem->mask & SCS_QOS_BIT_MEDIUM_TIME &&
      qos_elem->direction == SCS_DIRECTION_DIRECT)
    buf_len += 2;  /* Medium Time */

  return buf_len;
}


static struct wpabuf * allocate_scs_buf(struct scs_desc_elem *desc_elem,
          unsigned int num_scs_desc,
          bool allow_scs_traffic_desc)
{
  struct wpabuf *buf;
  size_t buf_len = 0;
  unsigned int i, j;

  buf_len = 3; /* Action frame header */

  for (i = 0; i < num_scs_desc; i++, desc_elem++) {
    struct tclas_element *tclas_elem;

    buf_len += 2 +  /* SCS descriptor IE header */
         1 +  /* SCSID */
         1 ;  /* Request type */

    if (desc_elem->request_type == SCS_REQ_REMOVE)
      continue;

    if (allow_scs_traffic_desc &&
        desc_elem->qos_char_elem.available)
      buf_len += qos_char_len(&desc_elem->qos_char_elem);

    if (!tclas_elem_required(&desc_elem->qos_char_elem))
      continue;

    if (desc_elem->intra_access_priority || desc_elem->scs_up_avail)
      buf_len += 3;

    tclas_elem = desc_elem->tclas_elems;
    if (!tclas_elem) {
      wpa_printf(MSG_ERROR, "%s: TCLAS element null",
           __func__);
      return NULL;
    }

    for (j = 0; j < desc_elem->num_tclas_elem; j++, tclas_elem++) {
      size_t elen;

      elen = tclas_elem_len(tclas_elem);
      if (elen == 0)
        return NULL;
      buf_len += elen;
    }

    if (desc_elem->num_tclas_elem > 1) {
      buf_len += 1 +  /* TCLAS Processing eid */
           1 +  /* length */
           1 ;  /* processing */
    }
  }

  buf = wpabuf_alloc(buf_len);
  if (!buf) {
    wpa_printf(MSG_ERROR, "Failed to allocate SCS req");
    return NULL;
  }

  return buf;
}


static void scs_cleanup_descriptors(struct active_scs_elem *scs_elem)
{
  if (!scs_elem)
    return;
  dl_list_del(&scs_elem->list);
  free_up_tclas_elem(&scs_elem->desc_elem);
  os_free(scs_elem);
}


static void scs_request_timer(void *eloop_ctx, void *timeout_ctx)
{
  struct wpa_supplicant *wpa_s = eloop_ctx;
  struct active_scs_elem *scs_desc, *prev;

  if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid)
    return;

  /* Once timeout is over, remove all SCS descriptors with no response */
  dl_list_for_each_safe(scs_desc, prev, &wpa_s->active_scs_ids,
            struct active_scs_elem, list) {
    u8 bssid[ETH_ALEN] = { 0 };
    const u8 *src;

    if (scs_desc->status == SCS_DESC_SUCCESS)
      continue;

    if (wpa_s->current_bss)
      src = wpa_s->current_bss->bssid;
    else
      src = bssid;

    wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCS_RESULT "bssid=" MACSTR
      " SCSID=%u status_code=timedout", MAC2STR(src),
      scs_desc->scs_id);

    wpa_printf(MSG_INFO, "%s: SCSID %d removed after timeout",
         __func__, scs_desc->scs_id);
    scs_cleanup_descriptors(scs_desc);
  }

  eloop_cancel_timeout(scs_request_timer, wpa_s, NULL);
  wpa_s->ongoing_scs_req = false;
}


static int _wpa_send_scs_req(struct wpa_supplicant *wpa_s,
           struct scs_desc_elem *desc_elem,
           unsigned int num_scs_desc)
{
  struct wpabuf *buf = NULL;
  const struct ieee80211_eht_capabilities *eht;
  const u8 *eht_ie;
  int ret = -1;
  unsigned int i;
  bool allow_scs_traffic_desc = false;

  if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid ||
      !desc_elem)
    return -1;

  if (!wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_SCS)) {
    wpa_dbg(wpa_s, MSG_INFO,
      "AP does not support SCS - could not send SCS Request");
    return -1;
  }

  if (wpa_is_non_eht_scs_traffic_desc_supported(wpa_s->current_bss))
    allow_scs_traffic_desc = true;

  /* Allow SCS Traffic descriptor support for EHT connection */
  eht_ie = wpa_bss_get_ie_ext(wpa_s->current_bss,
            WLAN_EID_EXT_EHT_CAPABILITIES);
  if (wpa_s->connection_eht && eht_ie &&
      eht_ie[1] >= 1 + IEEE80211_EHT_CAPAB_MIN_LEN) {
    eht = (const struct ieee80211_eht_capabilities *) &eht_ie[3];
    if (le_to_host16(eht->mac_cap) & EHT_MACCAP_SCS_TRAFFIC_DESC)
      allow_scs_traffic_desc = true;
  }

  if (!allow_scs_traffic_desc && desc_elem->qos_char_elem.available) {
    wpa_dbg(wpa_s, MSG_INFO,
      "Connection does not support EHT/non-EHT SCS Traffic Description - could not send SCS Request with QoS Characteristics");
    return -1;
  }

  buf = allocate_scs_buf(desc_elem, num_scs_desc, allow_scs_traffic_desc);
  if (!buf)
    return -1;

  wpabuf_put_u8(buf, WLAN_ACTION_ROBUST_AV_STREAMING);
  wpabuf_put_u8(buf, ROBUST_AV_SCS_REQ);
  wpa_s->scs_dialog_token++;
  if (wpa_s->scs_dialog_token == 0)
    wpa_s->scs_dialog_token++;
  wpabuf_put_u8(buf, wpa_s->scs_dialog_token);

  for (i = 0; i < num_scs_desc; i++, desc_elem++) {
    /* SCS Descriptor element */
    if (wpas_populate_scs_descriptor_ie(desc_elem, buf,
                allow_scs_traffic_desc) < 0)
      goto end;
  }

  wpa_hexdump_buf(MSG_DEBUG, "SCS Request", buf);
  ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
          wpa_s->own_addr, wpa_s->bssid,
          wpabuf_head(buf), wpabuf_len(buf), 0);
  if (ret < 0) {
    wpa_dbg(wpa_s, MSG_ERROR, "SCS: Failed to send SCS Request");
    wpa_s->scs_dialog_token--;
    goto end;
  }

  /*
   * Register a timeout after which this request will be removed from
   * the cache.
   */
  eloop_register_timeout(SCS_RESP_TIMEOUT, 0, scs_request_timer, wpa_s,
             NULL);
  wpa_s->ongoing_scs_req = true;

end:
  wpabuf_free(buf);
  return ret;
}


int wpas_scs_reconfigure(struct wpa_supplicant *wpa_s)
{
  struct scs_desc_elem *desc_elems, *desc_data, desc_elem;
  struct active_scs_elem *scs_desc;
  unsigned int num_scs_desc;
  unsigned int i;
  unsigned int num_tclas_elem;
  int ret = -1;

  if (!wpa_s->scs_reconfigure)
    return 0;

  num_scs_desc = dl_list_len(&wpa_s->active_scs_ids);
  if (!num_scs_desc)
    return 0;

  desc_elems = os_calloc(num_scs_desc, sizeof(struct scs_desc_elem));
  if (!desc_elems) {
    wpa_printf(MSG_ERROR, "SCS: Failed to allocate memory");
    return ret;
  }

  num_scs_desc = 0;
  dl_list_for_each(scs_desc, &wpa_s->active_scs_ids,
       struct active_scs_elem, list) {
    os_memcpy(&desc_elem, &scs_desc->desc_elem, sizeof(desc_elem));

    num_tclas_elem = scs_desc->desc_elem.num_tclas_elem;
    if (num_tclas_elem) {
      desc_elem.tclas_elems =
        os_memdup(scs_desc->desc_elem.tclas_elems,
            num_tclas_elem *
            sizeof(struct tclas_element));
      if (!desc_elem.tclas_elems)
        goto end;

      if (populate_type10_classifier_data(
            scs_desc->desc_elem.tclas_elems,
            desc_elem.tclas_elems,
            num_tclas_elem) < 0) {
        free_up_tclas_elem(&desc_elem);
        goto end;
      }
    }

    os_memcpy(&desc_elems[num_scs_desc], &desc_elem,
        sizeof(desc_elem));
    num_scs_desc++;
  }

  if (_wpa_send_scs_req(wpa_s, desc_elems, num_scs_desc) < 0) {
    wpa_printf(MSG_DEBUG,
         "SCS: Failed to reconfigure SCS requests - retain for next roaming");
  } else {
    dl_list_for_each(scs_desc, &wpa_s->active_scs_ids,
         struct active_scs_elem, list)
      scs_desc->status = SCS_DESC_SENT;
  }
  ret = 0;
end:
  wpa_s->scs_reconfigure = false;

  if (desc_elems) {
    desc_data = desc_elems;
    for (i = 0; i < num_scs_desc; i++, desc_data++) {
      if (desc_data->tclas_elems)
        free_up_tclas_elem(desc_data);
    }
    os_free(desc_elems);
  }

  return ret;
}


int wpas_send_scs_req(struct wpa_supplicant *wpa_s)
{
  struct scs_desc_elem *desc_elem = NULL;
  int ret = -1;
  unsigned int i;

  if (_wpa_send_scs_req(wpa_s, wpa_s->scs_robust_av_req.scs_desc_elems,
            wpa_s->scs_robust_av_req.num_scs_desc) < 0)
    goto end;

  desc_elem = wpa_s->scs_robust_av_req.scs_desc_elems;

  for (i = 0; i < wpa_s->scs_robust_av_req.num_scs_desc;
       i++, desc_elem++) {
    struct active_scs_elem *active_scs_elem;
    struct tclas_element *tclas_elem;
    unsigned int num_tclas_elem = desc_elem->num_tclas_elem;

    if (desc_elem->request_type != SCS_REQ_ADD)
      continue;

    active_scs_elem = os_zalloc(sizeof(struct active_scs_elem));
    if (!active_scs_elem)
      break;

    os_memcpy(&active_scs_elem->desc_elem, desc_elem,
        sizeof(struct scs_desc_elem));

    if (num_tclas_elem) {
      tclas_elem = os_memdup(desc_elem->tclas_elems,
                 num_tclas_elem *
                 sizeof(struct tclas_element));
      if (!tclas_elem) {
        os_free(active_scs_elem);
        goto end;
      }

      active_scs_elem->desc_elem.tclas_elems = tclas_elem;

      if (populate_type10_classifier_data(
            desc_elem->tclas_elems, tclas_elem,
            num_tclas_elem) < 0) {
        free_up_tclas_elem(&active_scs_elem->desc_elem);
        os_free(active_scs_elem);
        goto end;
      }
    }

    active_scs_elem->scs_id = desc_elem->scs_id;
    active_scs_elem->status = SCS_DESC_SENT;
    dl_list_add(&wpa_s->active_scs_ids, &active_scs_elem->list);
  }
  ret = 0; /* Success */

end:
  free_up_scs_desc(&wpa_s->scs_robust_av_req);
  return ret;
}


void free_up_tclas_elem(struct scs_desc_elem *elem)
{
  struct tclas_element *tclas_elems = elem->tclas_elems;
  unsigned int num_tclas_elem = elem->num_tclas_elem;
  struct tclas_element *tclas_data;
  unsigned int j;

  elem->tclas_elems = NULL;
  elem->num_tclas_elem = 0;

  if (!tclas_elems)
    return;

  tclas_data = tclas_elems;
  for (j = 0; j < num_tclas_elem; j++, tclas_data++) {
    if (tclas_data->classifier_type != 10)
      continue;

    os_free(tclas_data->frame_classifier.type10_param.filter_value);
    os_free(tclas_data->frame_classifier.type10_param.filter_mask);
  }

  os_free(tclas_elems);
}


void free_up_scs_desc(struct scs_robust_av_data *data)
{
  struct scs_desc_elem *desc_elems = data->scs_desc_elems;
  unsigned int num_scs_desc = data->num_scs_desc;
  struct scs_desc_elem *desc_data;
  unsigned int i;

  data->scs_desc_elems = NULL;
  data->num_scs_desc = 0;

  if (!desc_elems)
    return;

  desc_data = desc_elems;
  for (i = 0; i < num_scs_desc; i++, desc_data++) {
    if (desc_data->request_type == SCS_REQ_REMOVE ||
        !desc_data->tclas_elems)
      continue;

    free_up_tclas_elem(desc_data);
  }
  os_free(desc_elems);
}


/* Element ID Extension(1) + Request Type(1) + User Priority Control(2) +
 * Stream Timeout(4) */
#define MSCS_DESCRIPTOR_FIXED_LEN 8

static void wpas_parse_mscs_resp(struct wpa_supplicant *wpa_s,
         u16 status, const u8 *bssid,
         const u8 *mscs_desc_ie)
{
  struct robust_av_data robust_av;
  const u8 *pos;

  /* The MSCS Descriptor element is optional in the MSCS Response frame */
  if (!mscs_desc_ie)
    goto event_mscs_result;

  if (mscs_desc_ie[1] < MSCS_DESCRIPTOR_FIXED_LEN) {
    wpa_printf(MSG_INFO,
         "MSCS: Drop received frame: invalid MSCS Descriptor element length: %d",
         mscs_desc_ie[1]);
    return;
  }

  os_memset(&robust_av, 0, sizeof(struct robust_av_data));

  /* Skip Element ID, Length, and Element ID Extension */
  pos = &mscs_desc_ie[3];

  robust_av.request_type = *pos++;

  switch (robust_av.request_type) {
  case SCS_REQ_CHANGE:
    /*
     * Inform the suggested set of parameters that could be accepted
     * by the AP in response to a subsequent request by the station.
     */
    robust_av.up_bitmap = *pos++;
    robust_av.up_limit = *pos++ & 0x07;
    robust_av.stream_timeout = WPA_GET_LE32(pos);
    wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_MSCS_RESULT "bssid=" MACSTR
      " status_code=%u change up_bitmap=%u up_limit=%u stream_timeout=%u",
      MAC2STR(bssid), status, robust_av.up_bitmap,
      robust_av.up_limit, robust_av.stream_timeout);
    wpa_s->mscs_setup_done = false;
    return;
  case SCS_REQ_ADD:
    /*
     * This type is used in (Re)Association Response frame MSCS
     * Descriptor element if no change is required.
     */
    break;
  default:
    wpa_printf(MSG_INFO,
         "MSCS: Drop received frame with unknown Request Type: %u",
         robust_av.request_type);
    return;
  }

event_mscs_result:
  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_MSCS_RESULT "bssid=" MACSTR
    " status_code=%u", MAC2STR(bssid), status);
  wpa_s->mscs_setup_done = status == WLAN_STATUS_SUCCESS;
}


void wpas_handle_robust_av_recv_action(struct wpa_supplicant *wpa_s,
               const u8 *src, const u8 *buf, size_t len)
{
  u8 dialog_token;
  u16 status_code;
  const u8 *mscs_desc_ie;

  if (len < 3)
    return;

  dialog_token = *buf++;
  len--;

  /* AP sets dialog token to 0 for unsolicited response */
  if (!dialog_token && !wpa_s->mscs_setup_done) {
    wpa_printf(MSG_INFO,
         "MSCS: Drop unsolicited received frame: inactive");
    return;
  }

  if (dialog_token && dialog_token != wpa_s->robust_av.dialog_token) {
    wpa_printf(MSG_INFO,
         "MSCS: Drop received frame due to dialog token mismatch: received:%u expected:%u",
         dialog_token, wpa_s->robust_av.dialog_token);
    return;
  }

  status_code = WPA_GET_LE16(buf);
  buf += 2;
  len -= 2;

  mscs_desc_ie = get_ie_ext(buf, len, WLAN_EID_EXT_MSCS_DESCRIPTOR);
  wpas_parse_mscs_resp(wpa_s, status_code, src, mscs_desc_ie);
}


void wpas_handle_assoc_resp_mscs(struct wpa_supplicant *wpa_s, const u8 *bssid,
         const u8 *ies, size_t ies_len)
{
  const u8 *mscs_desc_ie, *mscs_status;
  u16 status;

  /* Process optional MSCS Status subelement when MSCS IE is in
   * (Re)Association Response frame */
  if (!ies || ies_len == 0 || !wpa_s->robust_av.valid_config)
    return;

  mscs_desc_ie = get_ie_ext(ies, ies_len, WLAN_EID_EXT_MSCS_DESCRIPTOR);
  if (!mscs_desc_ie || mscs_desc_ie[1] <= MSCS_DESCRIPTOR_FIXED_LEN)
    return;

  /* Subelements start after element header and fixed fields */
  mscs_status = get_ie(&mscs_desc_ie[2 + MSCS_DESCRIPTOR_FIXED_LEN],
           mscs_desc_ie[1] - MSCS_DESCRIPTOR_FIXED_LEN,
           MCSC_SUBELEM_STATUS);
  if (!mscs_status || mscs_status[1] < 2)
    return;

  status = WPA_GET_LE16(mscs_status + 2);

  wpas_parse_mscs_resp(wpa_s, status, bssid, mscs_desc_ie);
}


static void wpas_wait_for_dscp_req_timer(void *eloop_ctx, void *timeout_ctx)
{
  struct wpa_supplicant *wpa_s = eloop_ctx;

  /* Once timeout is over, reset wait flag and allow sending DSCP query */
  wpa_printf(MSG_DEBUG,
       "QM: Wait time over for sending DSCP request - allow DSCP query");
  wpa_s->wait_for_dscp_req = 0;
  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_wait end");
}


void wpas_handle_assoc_resp_qos_mgmt(struct wpa_supplicant *wpa_s,
             const u8 *ies, size_t ies_len)
{
  const u8 *wfa_capa;

  wpa_s->connection_dscp = 0;
  if (wpa_s->wait_for_dscp_req)
    eloop_cancel_timeout(wpas_wait_for_dscp_req_timer, wpa_s, NULL);

  if (!ies || ies_len == 0 || !wpa_s->enable_dscp_policy_capa)
    return;

  wfa_capa = get_vendor_ie(ies, ies_len, WFA_CAPA_IE_VENDOR_TYPE);
  if (!wfa_capa || wfa_capa[1] < 6 || wfa_capa[6] < 1 ||
      !(wfa_capa[7] & WFA_CAPA_QM_DSCP_POLICY))
    return; /* AP does not enable QM DSCP Policy */

  wpa_s->connection_dscp = 1;
  wpa_s->wait_for_dscp_req = !!(wfa_capa[7] &
              WFA_CAPA_QM_UNSOLIC_DSCP);
  if (!wpa_s->wait_for_dscp_req)
    return;

  /* Register a timeout after which dscp query can be sent to AP. */
  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_wait start");
  eloop_register_timeout(DSCP_REQ_TIMEOUT, 0,
             wpas_wait_for_dscp_req_timer, wpa_s, NULL);
}


void wpas_handle_robust_av_scs_recv_action(struct wpa_supplicant *wpa_s,
             const u8 *src, const u8 *buf,
             size_t len)
{
  u8 dialog_token;
  unsigned int i, count;
  struct active_scs_elem *scs_desc, *prev;

  if (len < 2)
    return;
  if (!wpa_s->ongoing_scs_req) {
    wpa_printf(MSG_INFO,
         "SCS: Drop received response due to no ongoing request");
    return;
  }

  dialog_token = *buf++;
  len--;
  if (dialog_token != wpa_s->scs_dialog_token) {
    wpa_printf(MSG_INFO,
         "SCS: Drop received frame due to dialog token mismatch: received:%u expected:%u",
         dialog_token, wpa_s->scs_dialog_token);
    return;
  }

  /* This Count field does not exist in the IEEE Std 802.11-2020
   * definition of the SCS Response frame. However, it was accepted to
   * be added into REVme per REVme/D0.0 CC35 CID 49 (edits in document
   * 11-21-0688-07). */
  count = *buf++;
  len--;
  if (count == 0 || count * 3 > len) {
    wpa_printf(MSG_INFO,
         "SCS: Drop received frame due to invalid count: %u (remaining %zu octets)",
         count, len);
    return;
  }

  for (i = 0; i < count; i++) {
    u8 id;
    u16 status;
    bool scs_desc_found = false;

    id = *buf++;
    status = WPA_GET_LE16(buf);
    buf += 2;
    len -= 3;

    dl_list_for_each(scs_desc, &wpa_s->active_scs_ids,
         struct active_scs_elem, list) {
      if (id == scs_desc->scs_id) {
        scs_desc_found = true;
        break;
      }
    }

    if (!scs_desc_found) {
      wpa_printf(MSG_INFO, "SCS: SCS ID invalid %u", id);
      continue;
    }

    if (status == WLAN_STATUS_SUCCESS)
      scs_desc->status = SCS_DESC_SUCCESS;
    else
      scs_cleanup_descriptors(scs_desc);

    wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCS_RESULT "bssid=" MACSTR
      " SCSID=%u status_code=%u", MAC2STR(src), id, status);
  }

  eloop_cancel_timeout(scs_request_timer, wpa_s, NULL);
  wpa_s->ongoing_scs_req = false;

  dl_list_for_each_safe(scs_desc, prev, &wpa_s->active_scs_ids,
            struct active_scs_elem, list) {
    if (scs_desc->status != SCS_DESC_SUCCESS) {
      wpa_msg(wpa_s, MSG_INFO,
        WPA_EVENT_SCS_RESULT "bssid=" MACSTR
        " SCSID=%u status_code=response_not_received",
        MAC2STR(src), scs_desc->scs_id);
      scs_cleanup_descriptors(scs_desc);
    }
  }
}


static void wpas_clear_active_scs_ids(struct wpa_supplicant *wpa_s)
{
  struct active_scs_elem *scs_elem;

  while ((scs_elem = dl_list_first(&wpa_s->active_scs_ids,
           struct active_scs_elem, list))) {
    scs_cleanup_descriptors(scs_elem);
  }
}


void wpas_scs_deinit(struct wpa_supplicant *wpa_s)
{
  free_up_scs_desc(&wpa_s->scs_robust_av_req);
  wpa_s->scs_dialog_token = 0;
  wpas_clear_active_scs_ids(wpa_s);
  eloop_cancel_timeout(scs_request_timer, wpa_s, NULL);
  wpa_s->ongoing_scs_req = false;
  wpa_s->scs_reconfigure = false;
}


static int write_ipv4_info(char *pos, int total_len,
         const struct ipv4_params *v4,
         u8 classifier_mask)
{
  int res, rem_len;
  char addr[INET_ADDRSTRLEN];

  rem_len = total_len;

  if (classifier_mask & BIT(1)) {
    if (!inet_ntop(AF_INET, &v4->src_ip, addr, INET_ADDRSTRLEN)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set IPv4 source address");
      return -1;
    }

    res = os_snprintf(pos, rem_len, " src_ip=%s", addr);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(2)) {
    if (!inet_ntop(AF_INET, &v4->dst_ip, addr, INET_ADDRSTRLEN)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set IPv4 destination address");
      return -1;
    }

    res = os_snprintf(pos, rem_len, " dst_ip=%s", addr);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(3)) {
    res = os_snprintf(pos, rem_len, " src_port=%d", v4->src_port);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(4)) {
    res = os_snprintf(pos, rem_len, " dst_port=%d", v4->dst_port);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(6)) {
    res = os_snprintf(pos, rem_len, " protocol=%d", v4->protocol);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  return total_len - rem_len;
}


static int write_ipv6_info(char *pos, int total_len,
         const struct ipv6_params *v6,
         u8 classifier_mask)
{
  int res, rem_len;
  char addr[INET6_ADDRSTRLEN];

  rem_len = total_len;

  if (classifier_mask & BIT(1)) {
    if (!inet_ntop(AF_INET6, &v6->src_ip, addr, INET6_ADDRSTRLEN)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set IPv6 source addr");
      return -1;
    }

    res = os_snprintf(pos, rem_len, " src_ip=%s", addr);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(2)) {
    if (!inet_ntop(AF_INET6, &v6->dst_ip, addr, INET6_ADDRSTRLEN)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set IPv6 destination addr");
      return -1;
    }

    res = os_snprintf(pos, rem_len, " dst_ip=%s", addr);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(3)) {
    res = os_snprintf(pos, rem_len, " src_port=%d", v6->src_port);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(4)) {
    res = os_snprintf(pos, rem_len, " dst_port=%d", v6->dst_port);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  if (classifier_mask & BIT(6)) {
    res = os_snprintf(pos, rem_len, " protocol=%d",
          v6->next_header);
    if (os_snprintf_error(rem_len, res))
      return -1;

    pos += res;
    rem_len -= res;
  }

  return total_len - rem_len;
}


struct dscp_policy_data {
  u8 policy_id;
  u8 req_type;
  u8 dscp;
  bool dscp_info;
  const u8 *frame_classifier;
  u8 frame_classifier_len;
  struct type4_params type4_param;
  const u8 *domain_name;
  u8 domain_name_len;
  u16 start_port;
  u16 end_port;
  bool port_range_info;
};


static int set_frame_classifier_type4_ipv4(struct dscp_policy_data *policy)
{
  u8 classifier_mask;
  const u8 *frame_classifier = policy->frame_classifier;
  struct type4_params *type4_param = &policy->type4_param;

  if (policy->frame_classifier_len < 18) {
    wpa_printf(MSG_ERROR,
         "QM: Received IPv4 frame classifier with insufficient length %d",
         policy->frame_classifier_len);
    return -1;
  }

  classifier_mask = frame_classifier[1];

  /* Classifier Mask - bit 1 = Source IP Address */
  if (classifier_mask & BIT(1)) {
    type4_param->classifier_mask |= BIT(1);
    os_memcpy(&type4_param->ip_params.v4.src_ip,
        &frame_classifier[3], 4);
  }

  /* Classifier Mask - bit 2 = Destination IP Address */
  if (classifier_mask & BIT(2)) {
    if (policy->domain_name) {
      wpa_printf(MSG_ERROR,
           "QM: IPv4: Both domain name and destination IP address not expected");
      return -1;
    }

    type4_param->classifier_mask |= BIT(2);
    os_memcpy(&type4_param->ip_params.v4.dst_ip,
        &frame_classifier[7], 4);
  }

  /* Classifier Mask - bit 3 = Source Port */
  if (classifier_mask & BIT(3)) {
    type4_param->classifier_mask |= BIT(3);
    type4_param->ip_params.v4.src_port =
      WPA_GET_BE16(&frame_classifier[11]);
  }

  /* Classifier Mask - bit 4 = Destination Port */
  if (classifier_mask & BIT(4)) {
    if (policy->port_range_info) {
      wpa_printf(MSG_ERROR,
           "QM: IPv4: Both port range and destination port not expected");
      return -1;
    }

    type4_param->classifier_mask |= BIT(4);
    type4_param->ip_params.v4.dst_port =
      WPA_GET_BE16(&frame_classifier[13]);
  }

  /* Classifier Mask - bit 5 = DSCP (ignored) */

  /* Classifier Mask - bit 6 = Protocol */
  if (classifier_mask & BIT(6)) {
    type4_param->classifier_mask |= BIT(6);
    type4_param->ip_params.v4.protocol = frame_classifier[16];
  }

  return 0;
}


static int set_frame_classifier_type4_ipv6(struct dscp_policy_data *policy)
{
  u8 classifier_mask;
  const u8 *frame_classifier = policy->frame_classifier;
  struct type4_params *type4_param = &policy->type4_param;

  if (policy->frame_classifier_len < 44) {
    wpa_printf(MSG_ERROR,
         "QM: Received IPv6 frame classifier with insufficient length %d",
         policy->frame_classifier_len);
    return -1;
  }

  classifier_mask = frame_classifier[1];

  /* Classifier Mask - bit 1 = Source IP Address */
  if (classifier_mask & BIT(1)) {
    type4_param->classifier_mask |= BIT(1);
    os_memcpy(&type4_param->ip_params.v6.src_ip,
        &frame_classifier[3], 16);
  }

  /* Classifier Mask - bit 2 = Destination IP Address */
  if (classifier_mask & BIT(2)) {
    if (policy->domain_name) {
      wpa_printf(MSG_ERROR,
           "QM: IPv6: Both domain name and destination IP address not expected");
      return -1;
    }
    type4_param->classifier_mask |= BIT(2);
    os_memcpy(&type4_param->ip_params.v6.dst_ip,
        &frame_classifier[19], 16);
  }

  /* Classifier Mask - bit 3 = Source Port */
  if (classifier_mask & BIT(3)) {
    type4_param->classifier_mask |= BIT(3);
    type4_param->ip_params.v6.src_port =
        WPA_GET_BE16(&frame_classifier[35]);
  }

  /* Classifier Mask - bit 4 = Destination Port */
  if (classifier_mask & BIT(4)) {
    if (policy->port_range_info) {
      wpa_printf(MSG_ERROR,
           "IPv6: Both port range and destination port not expected");
      return -1;
    }

    type4_param->classifier_mask |= BIT(4);
    type4_param->ip_params.v6.dst_port =
        WPA_GET_BE16(&frame_classifier[37]);
  }

  /* Classifier Mask - bit 5 = DSCP (ignored) */

  /* Classifier Mask - bit 6 = Next Header */
  if (classifier_mask & BIT(6)) {
    type4_param->classifier_mask |= BIT(6);
    type4_param->ip_params.v6.next_header = frame_classifier[40];
  }

  return 0;
}


static int wpas_set_frame_classifier_params(struct dscp_policy_data *policy)
{
  const u8 *frame_classifier = policy->frame_classifier;
  u8 frame_classifier_len = policy->frame_classifier_len;

  if (frame_classifier_len < 3) {
    wpa_printf(MSG_ERROR,
         "QM: Received frame classifier with insufficient length %d",
         frame_classifier_len);
    return -1;
  }

  /* Only allowed Classifier Type: IP and higher layer parameters (4) */
  if (frame_classifier[0] != 4) {
    wpa_printf(MSG_ERROR,
         "QM: Received frame classifier with invalid classifier type %d",
         frame_classifier[0]);
    return -1;
  }

  /* Classifier Mask - bit 0 = Version */
  if (!(frame_classifier[1] & BIT(0))) {
    wpa_printf(MSG_ERROR,
         "QM: Received frame classifier without IP version");
    return -1;
  }

  /* Version (4 or 6) */
  if (frame_classifier[2] == 4) {
    if (set_frame_classifier_type4_ipv4(policy)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set IPv4 parameters");
      return -1;
    }

    policy->type4_param.ip_version = IPV4;
  } else if (frame_classifier[2] == 6) {
    if (set_frame_classifier_type4_ipv6(policy)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set IPv6 parameters");
      return -1;
    }

    policy->type4_param.ip_version = IPV6;
  } else {
    wpa_printf(MSG_ERROR,
         "QM: Received unknown IP version %d",
         frame_classifier[2]);
    return -1;
  }

  return 0;
}


static bool dscp_valid_domain_name(const char *str)
{
  if (!str[0])
    return false;

  while (*str) {
    if (is_ctrl_char(*str) || *str == ' ' || *str == '=')
      return false;
    str++;
  }

  return true;
}


static void wpas_add_dscp_policy(struct wpa_supplicant *wpa_s,
         struct dscp_policy_data *policy)
{
  int ip_ver = 0, res;
  char policy_str[1000], *pos;
  int len;

  if (!policy->frame_classifier && !policy->domain_name &&
      !policy->port_range_info) {
    wpa_printf(MSG_ERROR,
         "QM: Invalid DSCP policy - no attributes present");
    goto fail;
  }

  policy_str[0] = '\0';
  pos = policy_str;
  len = sizeof(policy_str);

  if (policy->frame_classifier) {
    struct type4_params *type4 = &policy->type4_param;

    if (wpas_set_frame_classifier_params(policy)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to set frame classifier parameters");
      goto fail;
    }

    if (type4->ip_version == IPV4)
      res = write_ipv4_info(pos, len, &type4->ip_params.v4,
                type4->classifier_mask);
    else
      res = write_ipv6_info(pos, len, &type4->ip_params.v6,
                type4->classifier_mask);

    if (res <= 0) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to write IP parameters");
      goto fail;
    }

    ip_ver = type4->ip_version;

    pos += res;
    len -= res;
  }

  if (policy->port_range_info) {
    res = os_snprintf(pos, len, " start_port=%u end_port=%u",
          policy->start_port, policy->end_port);
    if (os_snprintf_error(len, res)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to write port range attributes for policy id = %d",
           policy->policy_id);
      goto fail;
    }

    pos += res;
    len -= res;
  }

  if (policy->domain_name) {
    char domain_name_str[250];

    if (policy->domain_name_len >= sizeof(domain_name_str)) {
      wpa_printf(MSG_ERROR,
           "QM: Domain name length higher than max expected");
      goto fail;
    }
    os_memcpy(domain_name_str, policy->domain_name,
        policy->domain_name_len);
    domain_name_str[policy->domain_name_len] = '\0';
    if (!dscp_valid_domain_name(domain_name_str)) {
      wpa_printf(MSG_ERROR, "QM: Invalid domain name string");
      goto fail;
    }
    res = os_snprintf(pos, len, " domain_name=%s", domain_name_str);
    if (os_snprintf_error(len, res)) {
      wpa_printf(MSG_ERROR,
           "QM: Failed to write domain name attribute for policy id = %d",
           policy->policy_id);
      goto fail;
    }
  }

  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY
    "add policy_id=%u dscp=%u ip_version=%d%s",
    policy->policy_id, policy->dscp, ip_ver, policy_str);
  return;
fail:
  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "reject policy_id=%u",
    policy->policy_id);
}


void wpas_dscp_deinit(struct wpa_supplicant *wpa_s)
{
  wpa_printf(MSG_DEBUG, "QM: Clear all active DSCP policies");
  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "clear_all");
  wpa_s->dscp_req_dialog_token = 0;
  wpa_s->dscp_query_dialog_token = 0;
  wpa_s->connection_dscp = 0;
  if (wpa_s->wait_for_dscp_req) {
    wpa_s->wait_for_dscp_req = 0;
    eloop_cancel_timeout(wpas_wait_for_dscp_req_timer, wpa_s, NULL);
  }
}


static void wpas_fill_dscp_policy(struct dscp_policy_data *policy, u8 attr_id,
          u8 attr_len, const u8 *attr_data)
{
  switch (attr_id) {
  case QM_ATTR_PORT_RANGE:
    if (attr_len < 4) {
      wpa_printf(MSG_ERROR,
           "QM: Received Port Range attribute with insufficient length %d",
            attr_len);
      break;
    }
    policy->start_port = WPA_GET_BE16(attr_data);
    policy->end_port = WPA_GET_BE16(attr_data + 2);
    policy->port_range_info = true;
    break;
  case QM_ATTR_DSCP_POLICY:
    if (attr_len < 3) {
      wpa_printf(MSG_ERROR,
           "QM: Received DSCP Policy attribute with insufficient length %d",
           attr_len);
      return;
    }
    policy->policy_id = attr_data[0];
    policy->req_type = attr_data[1];
    policy->dscp = attr_data[2];
    policy->dscp_info = true;
    break;
  case QM_ATTR_TCLAS:
    if (attr_len < 1) {
      wpa_printf(MSG_ERROR,
           "QM: Received TCLAS attribute with insufficient length %d",
           attr_len);
      return;
    }
    policy->frame_classifier = attr_data;
    policy->frame_classifier_len = attr_len;
    break;
  case QM_ATTR_DOMAIN_NAME:
    if (attr_len < 1) {
      wpa_printf(MSG_ERROR,
           "QM: Received domain name attribute with insufficient length %d",
           attr_len);
      return;
    }
    policy->domain_name = attr_data;
    policy->domain_name_len = attr_len;
    break;
  default:
    wpa_printf(MSG_ERROR, "QM: Received invalid QoS attribute %d",
         attr_id);
    break;
  }
}


void wpas_handle_qos_mgmt_recv_action(struct wpa_supplicant *wpa_s,
              const u8 *src,
              const u8 *buf, size_t len)
{
  int rem_len;
  const u8 *qos_ie, *attr;
  int more, reset;

  if (!wpa_s->enable_dscp_policy_capa) {
    wpa_printf(MSG_ERROR,
         "QM: Ignore DSCP Policy frame since the capability is not enabled");
    return;
  }

  if (!pmf_in_use(wpa_s, src)) {
    wpa_printf(MSG_ERROR,
         "QM: Ignore DSCP Policy frame since PMF is not in use");
    return;
  }

  if (!wpa_s->connection_dscp) {
     wpa_printf(MSG_DEBUG,
          "QM: DSCP Policy capability not enabled for the current association - ignore QoS Management Action frames");
    return;
  }

  if (len < 1)
    return;

  /* Handle only DSCP Policy Request frame */
  if (buf[0] != QM_DSCP_POLICY_REQ) {
    wpa_printf(MSG_ERROR, "QM: Received unexpected QoS action frame %d",
         buf[0]);
    return;
  }

  if (len < 3) {
    wpa_printf(MSG_ERROR,
         "Received QoS Management DSCP Policy Request frame with invalid length %zu",
         len);
    return;
  }

  /* Clear wait_for_dscp_req on receiving first DSCP request from AP */
  if (wpa_s->wait_for_dscp_req) {
    wpa_s->wait_for_dscp_req = 0;
    eloop_cancel_timeout(wpas_wait_for_dscp_req_timer, wpa_s, NULL);
  }

  wpa_s->dscp_req_dialog_token = buf[1];
  more = buf[2] & DSCP_POLICY_CTRL_MORE;
  reset = buf[2] & DSCP_POLICY_CTRL_RESET;

  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_start%s%s",
    reset ? " clear_all" : "", more ? " more" : "");

  qos_ie = buf + 3;
  rem_len = len - 3;
  while (rem_len > 2) {
    struct dscp_policy_data policy;
    int rem_attrs_len, ie_len;

    ie_len = 2 + qos_ie[1];
    if (rem_len < ie_len)
      break;

    if (rem_len < 6 || qos_ie[0] != WLAN_EID_VENDOR_SPECIFIC ||
        qos_ie[1] < 4 ||
        WPA_GET_BE32(&qos_ie[2]) != QM_IE_VENDOR_TYPE) {
      rem_len -= ie_len;
      qos_ie += ie_len;
      continue;
    }

    os_memset(&policy, 0, sizeof(struct dscp_policy_data));
    attr = qos_ie + 6;
    rem_attrs_len = qos_ie[1] - 4;

    while (rem_attrs_len > 2) {
      u8 attr_id, attr_len;

      attr_id = *attr++;
      attr_len = *attr++;
      rem_attrs_len -= 2;
      if (attr_len > rem_attrs_len)
        break;
      wpas_fill_dscp_policy(&policy, attr_id, attr_len, attr);
      rem_attrs_len -= attr_len;
      attr += attr_len;
    }

    rem_len -= ie_len;
    qos_ie += ie_len;

    if (!policy.dscp_info) {
      wpa_printf(MSG_ERROR,
           "QM: Received QoS IE without DSCP Policy attribute");
      continue;
    }

    if (policy.req_type == DSCP_POLICY_REQ_ADD)
      wpas_add_dscp_policy(wpa_s, &policy);
    else if (policy.req_type == DSCP_POLICY_REQ_REMOVE)
      wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY
        "remove policy_id=%u", policy.policy_id);
    else
      wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY
        "reject policy_id=%u", policy.policy_id);
  }

  wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_end");
}


int wpas_send_dscp_response(struct wpa_supplicant *wpa_s,
          struct dscp_resp_data *resp_data)
{
  struct wpabuf *buf = NULL;
  size_t buf_len;
  int ret = -1, i;
  u8 resp_control = 0;

  if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid) {
    wpa_printf(MSG_ERROR,
         "QM: Failed to send DSCP response - not connected to AP");
    return -1;
  }

  if (resp_data->solicited && !wpa_s->dscp_req_dialog_token) {
    wpa_printf(MSG_ERROR, "QM: No ongoing DSCP request");
    return -1;
  }

  if (!wpa_s->connection_dscp) {
    wpa_printf(MSG_ERROR,
         "QM: Failed to send DSCP response - DSCP capability not enabled for the current association");
    return -1;

  }

  buf_len = 1 + /* Category */
      3 + /* OUI */
      1 + /* OUI Type */
      1 + /* OUI Subtype */
      1 + /* Dialog Token */
      1 + /* Response Control */
      1 + /* Count */
      2 * resp_data->num_policies;  /* Status list */
  buf = wpabuf_alloc(buf_len);
  if (!buf) {
    wpa_printf(MSG_ERROR,
         "QM: Failed to allocate DSCP policy response");
    return -1;
  }

  wpabuf_put_u8(buf, WLAN_ACTION_VENDOR_SPECIFIC_PROTECTED);
  wpabuf_put_be24(buf, OUI_WFA);
  wpabuf_put_u8(buf, QM_ACTION_OUI_TYPE);
  wpabuf_put_u8(buf, QM_DSCP_POLICY_RESP);

  wpabuf_put_u8(buf, resp_data->solicited ?
          wpa_s->dscp_req_dialog_token : 0);

  if (resp_data->more)
    resp_control |= DSCP_POLICY_CTRL_MORE;
  if (resp_data->reset)
    resp_control |= DSCP_POLICY_CTRL_RESET;
  wpabuf_put_u8(buf, resp_control);

  wpabuf_put_u8(buf, resp_data->num_policies);
  for (i = 0; i < resp_data->num_policies; i++) {
    wpabuf_put_u8(buf, resp_data->policy[i].id);
    wpabuf_put_u8(buf, resp_data->policy[i].status);
  }

  wpa_hexdump_buf(MSG_MSGDUMP, "DSCP response frame: ", buf);
  ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
          wpa_s->own_addr, wpa_s->bssid,
          wpabuf_head(buf), wpabuf_len(buf), 0);
  if (ret < 0) {
    wpa_msg(wpa_s, MSG_INFO, "QM: Failed to send DSCP response");
    goto fail;
  }

  /*
   * Mark DSCP request complete whether response sent is solicited or
   * unsolicited
   */
  wpa_s->dscp_req_dialog_token = 0;

fail:
  wpabuf_free(buf);
  return ret;
}


int wpas_send_dscp_query(struct wpa_supplicant *wpa_s, const char *domain_name,
       size_t domain_name_length)
{
  struct wpabuf *buf = NULL;
  int ret, dscp_query_size;

  if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid)
    return -1;

  if (!wpa_s->connection_dscp) {
    wpa_printf(MSG_ERROR,
         "QM: Failed to send DSCP query - DSCP capability not enabled for the current association");
    return -1;
  }

  if (wpa_s->wait_for_dscp_req) {
    wpa_printf(MSG_INFO, "QM: Wait until AP sends a DSCP request");
    return -1;
  }

#define DOMAIN_NAME_OFFSET (4 /* OUI */ + 1 /* Attr Id */ + 1 /* Attr len */)

  if (domain_name_length > 255 - DOMAIN_NAME_OFFSET) {
    wpa_printf(MSG_ERROR, "QM: Too long domain name");
    return -1;
  }

  dscp_query_size = 1 + /* Category */
        4 + /* OUI Type */
        1 + /* OUI subtype */
        1; /* Dialog Token */
  if (domain_name && domain_name_length)
    dscp_query_size += 1 + /* Element ID */
      1 + /* IE Length */
      DOMAIN_NAME_OFFSET + domain_name_length;

  buf = wpabuf_alloc(dscp_query_size);
  if (!buf) {
    wpa_printf(MSG_ERROR, "QM: Failed to allocate DSCP query");
    return -1;
  }

  wpabuf_put_u8(buf, WLAN_ACTION_VENDOR_SPECIFIC_PROTECTED);
  wpabuf_put_be32(buf, QM_ACTION_VENDOR_TYPE);
  wpabuf_put_u8(buf, QM_DSCP_POLICY_QUERY);
  wpa_s->dscp_query_dialog_token++;
  if (wpa_s->dscp_query_dialog_token == 0)
    wpa_s->dscp_query_dialog_token++;
  wpabuf_put_u8(buf, wpa_s->dscp_query_dialog_token);

  if (domain_name && domain_name_length) {
    /* Domain Name attribute */
    wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
    wpabuf_put_u8(buf, DOMAIN_NAME_OFFSET + domain_name_length);
    wpabuf_put_be32(buf, QM_IE_VENDOR_TYPE);
    wpabuf_put_u8(buf, QM_ATTR_DOMAIN_NAME);
    wpabuf_put_u8(buf, domain_name_length);
    wpabuf_put_data(buf, domain_name, domain_name_length);
  }
#undef DOMAIN_NAME_OFFSET

  ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
          wpa_s->own_addr, wpa_s->bssid,
          wpabuf_head(buf), wpabuf_len(buf), 0);
  if (ret < 0) {
    wpa_dbg(wpa_s, MSG_ERROR, "QM: Failed to send DSCP query");
    wpa_s->dscp_query_dialog_token--;
  }

  wpabuf_free(buf);
  return ret;
}

Coverage Report

Created: 2025-11-03 06:51