OSDN Git Service

Accumulative patch from commit dc013f1e37df3462085cf01a13f0c432f146ad7a
[android-x86/external-wpa_supplicant_8.git] / wpa_supplicant / interworking.c
index 7b5b20e..b8a8bb2 100644 (file)
@@ -13,6 +13,7 @@
 #include "common/gas.h"
 #include "common/wpa_ctrl.h"
 #include "utils/pcsc_funcs.h"
+#include "utils/eloop.h"
 #include "drivers/driver.h"
 #include "eap_common/eap_defs.h"
 #include "eap_peer/eap.h"
@@ -52,6 +53,18 @@ static void interworking_reconnect(struct wpa_supplicant *wpa_s)
        }
        wpa_s->disconnected = 0;
        wpa_s->reassociate = 1;
+
+       if (wpa_s->last_scan_res_used > 0) {
+               struct os_time now;
+               os_get_time(&now);
+               if (now.sec - wpa_s->last_scan.sec <= 5) {
+                       wpa_printf(MSG_DEBUG, "Interworking: Old scan results "
+                                  "are fresh - connect without new scan");
+                       if (wpas_select_network_from_last_scan(wpa_s) >= 0)
+                               return;
+               }
+       }
+
        wpa_supplicant_req_scan(wpa_s, 0, 0);
 }
 
@@ -96,27 +109,108 @@ static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
 }
 
 
+static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
+{
+       struct wpa_cred *cred;
+
+       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
+               if (cred->roaming_consortium_len)
+                       return 1;
+       }
+       return 0;
+}
+
+
+static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
+{
+       struct wpa_cred *cred;
+
+       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
+               if (cred->pcsc || cred->imsi)
+                       return 1;
+       }
+       return 0;
+}
+
+
+static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
+{
+       struct wpa_cred *cred;
+
+       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
+               if (cred->pcsc || cred->imsi)
+                       continue;
+               if (!cred->eap_method)
+                       return 1;
+               if (cred->realm && cred->roaming_consortium_len == 0)
+                       return 1;
+       }
+       return 0;
+}
+
+
+static int cred_with_domain(struct wpa_supplicant *wpa_s)
+{
+       struct wpa_cred *cred;
+
+       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
+               if (cred->domain || cred->pcsc || cred->imsi)
+                       return 1;
+       }
+       return 0;
+}
+
+
+static int additional_roaming_consortiums(struct wpa_bss *bss)
+{
+       const u8 *ie;
+       ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
+       if (ie == NULL || ie[1] == 0)
+               return 0;
+       return ie[2]; /* Number of ANQP OIs */
+}
+
+
+static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
+{
+       struct wpa_supplicant *wpa_s = eloop_ctx;
+       interworking_next_anqp_fetch(wpa_s);
+}
+
+
 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
                                      struct wpa_bss *bss)
 {
        struct wpabuf *buf;
        int ret = 0;
        int res;
-       u16 info_ids[] = {
-               ANQP_CAPABILITY_LIST,
-               ANQP_VENUE_NAME,
-               ANQP_NETWORK_AUTH_TYPE,
-               ANQP_ROAMING_CONSORTIUM,
-               ANQP_IP_ADDR_TYPE_AVAILABILITY,
-               ANQP_NAI_REALM,
-               ANQP_3GPP_CELLULAR_NETWORK,
-               ANQP_DOMAIN_NAME
-       };
+       u16 info_ids[8];
+       size_t num_info_ids = 0;
        struct wpabuf *extra = NULL;
+       int all = wpa_s->fetch_all_anqp;
 
        wpa_printf(MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
                   MAC2STR(bss->bssid));
 
+       info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
+       if (all) {
+               info_ids[num_info_ids++] = ANQP_VENUE_NAME;
+               info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
+       }
+       if (all || (cred_with_roaming_consortium(wpa_s) &&
+                   additional_roaming_consortiums(bss)))
+               info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
+       if (all)
+               info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
+       if (all || cred_with_nai_realm(wpa_s))
+               info_ids[num_info_ids++] = ANQP_NAI_REALM;
+       if (all || cred_with_3gpp(wpa_s))
+               info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
+       if (all || cred_with_domain(wpa_s))
+               info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
+       wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
+                   (u8 *) info_ids, num_info_ids * 2);
+
 #ifdef CONFIG_HS20
        if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
                u8 *len_pos;
@@ -131,16 +225,18 @@ static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
                wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
                wpabuf_put_u8(extra, 0); /* Reserved */
                wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
-               wpabuf_put_u8(extra, HS20_STYPE_OPERATOR_FRIENDLY_NAME);
-               wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
-               wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
-               wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
+               if (all) {
+                       wpabuf_put_u8(extra,
+                                     HS20_STYPE_OPERATOR_FRIENDLY_NAME);
+                       wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
+                       wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
+                       wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
+               }
                gas_anqp_set_element_len(extra, len_pos);
        }
 #endif /* CONFIG_HS20 */
 
-       buf = anqp_build_req(info_ids, sizeof(info_ids) / sizeof(info_ids[0]),
-                            extra);
+       buf = anqp_build_req(info_ids, num_info_ids, extra);
        wpabuf_free(extra);
        if (buf == NULL)
                return -1;
@@ -150,6 +246,8 @@ static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
        if (res < 0) {
                wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
                ret = -1;
+               eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
+                                      NULL);
        } else
                wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
                           "%u", res);
@@ -428,13 +526,18 @@ static int nai_realm_cred_username(struct nai_realm_eap *eap)
                return 0;
        }
 
-       if (eap->method == EAP_TYPE_PEAP &&
-           eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
-               return 0;
+       if (eap->method == EAP_TYPE_PEAP) {
+               if (eap->inner_method &&
+                   eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
+                       return 0;
+               if (!eap->inner_method &&
+                   eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL)
+                       return 0;
+       }
 
        if (eap->method == EAP_TYPE_TTLS) {
                if (eap->inner_method == 0 && eap->inner_non_eap == 0)
-                       return 0;
+                       return 1; /* Assume TTLS/MSCHAPv2 is used */
                if (eap->inner_method &&
                    eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
                        return 0;
@@ -629,9 +732,12 @@ static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
 #endif /* INTERWORKING_3GPP */
 
 
-static int interworking_set_hs20_params(struct wpa_ssid *ssid)
+static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
+                                       struct wpa_ssid *ssid)
 {
-       if (wpa_config_set(ssid, "key_mgmt", "WPA-EAP", 0) < 0)
+       if (wpa_config_set(ssid, "key_mgmt",
+                          wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
+                          "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP", 0) < 0)
                return -1;
        if (wpa_config_set(ssid, "proto", "RSN", 0) < 0)
                return -1;
@@ -648,8 +754,11 @@ static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
        struct wpa_cred *cred;
        struct wpa_ssid *ssid;
        const u8 *ie;
+       int eap_type;
+       int res;
+       char prefix;
 
-       if (bss->anqp_3gpp == NULL)
+       if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
                return -1;
 
        for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
@@ -680,7 +789,7 @@ static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
 #ifdef PCSC_FUNCS
        compare:
 #endif /* PCSC_FUNCS */
-               if (plmn_id_match(bss->anqp_3gpp, imsi, mnc_len))
+               if (plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len))
                        break;
        }
        if (cred == NULL)
@@ -695,6 +804,7 @@ static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
        ssid = wpa_config_add_network(wpa_s->conf);
        if (ssid == NULL)
                return -1;
+       ssid->parent_cred = cred;
 
        wpas_notify_network_added(wpa_s, ssid);
        wpa_config_set_network_defaults(ssid);
@@ -706,17 +816,43 @@ static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
        os_memcpy(ssid->ssid, ie + 2, ie[1]);
        ssid->ssid_len = ie[1];
 
-       if (interworking_set_hs20_params(ssid) < 0)
+       if (interworking_set_hs20_params(wpa_s, ssid) < 0)
                goto fail;
 
-       /* TODO: figure out whether to use EAP-SIM, EAP-AKA, or EAP-AKA' */
-       if (wpa_config_set(ssid, "eap", "SIM", 0) < 0) {
-               wpa_printf(MSG_DEBUG, "EAP-SIM not supported");
+       eap_type = EAP_TYPE_SIM;
+       if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
+               eap_type = EAP_TYPE_AKA;
+       if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
+               if (cred->eap_method[0].method == EAP_TYPE_SIM ||
+                   cred->eap_method[0].method == EAP_TYPE_AKA ||
+                   cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
+                       eap_type = cred->eap_method[0].method;
+       }
+
+       switch (eap_type) {
+       case EAP_TYPE_SIM:
+               prefix = '1';
+               res = wpa_config_set(ssid, "eap", "SIM", 0);
+               break;
+       case EAP_TYPE_AKA:
+               prefix = '0';
+               res = wpa_config_set(ssid, "eap", "AKA", 0);
+               break;
+       case EAP_TYPE_AKA_PRIME:
+               prefix = '6';
+               res = wpa_config_set(ssid, "eap", "AKA'", 0);
+               break;
+       default:
+               res = -1;
+               break;
+       }
+       if (res < 0) {
+               wpa_printf(MSG_DEBUG, "Selected EAP method (%d) not supported",
+                          eap_type);
                goto fail;
        }
-       if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
-               wpa_config_set(ssid, "eap", "AKA", 0);
-       if (!cred->pcsc && set_root_nai(ssid, cred->imsi, '1') < 0) {
+
+       if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
                wpa_printf(MSG_DEBUG, "Failed to set Root NAI");
                goto fail;
        }
@@ -827,6 +963,24 @@ static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
 }
 
 
+static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
+{
+       size_t i;
+
+       if (!cred->excluded_ssid)
+               return 0;
+
+       for (i = 0; i < cred->num_excluded_ssid; i++) {
+               struct excluded_ssid *e = &cred->excluded_ssid[i];
+               if (bss->ssid_len == e->ssid_len &&
+                   os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
+                       return 1;
+       }
+
+       return 0;
+}
+
+
 static struct wpa_cred * interworking_credentials_available_roaming_consortium(
        struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 {
@@ -835,7 +989,8 @@ static struct wpa_cred * interworking_credentials_available_roaming_consortium(
 
        ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
 
-       if (ie == NULL && bss->anqp_roaming_consortium == NULL)
+       if (ie == NULL &&
+           (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
                return NULL;
 
        if (wpa_s->conf->cred == NULL)
@@ -845,11 +1000,17 @@ static struct wpa_cred * interworking_credentials_available_roaming_consortium(
                if (cred->roaming_consortium_len == 0)
                        continue;
 
-               if (!roaming_consortium_match(ie, bss->anqp_roaming_consortium,
+               if (!roaming_consortium_match(ie,
+                                             bss->anqp ?
+                                             bss->anqp->roaming_consortium :
+                                             NULL,
                                              cred->roaming_consortium,
                                              cred->roaming_consortium_len))
                        continue;
 
+               if (cred_excluded_ssid(cred, bss))
+                       continue;
+
                if (selected == NULL ||
                    selected->priority < cred->priority)
                        selected = cred;
@@ -925,6 +1086,17 @@ static int interworking_set_eap_params(struct wpa_ssid *ssid,
            wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
                return -1;
 
+#ifdef ANDROID
+       if (cred->private_key &&
+           os_strncmp(cred->private_key, "keystore://", 11) == 0) {
+               /* Use OpenSSL engine configuration for Android keystore */
+               if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
+                   wpa_config_set_quoted(ssid, "key_id",
+                                         cred->private_key + 11) < 0 ||
+                   wpa_config_set(ssid, "engine", "1", 0) < 0)
+                       return -1;
+       } else
+#endif /* ANDROID */
        if (cred->private_key && cred->private_key[0] &&
            wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
                return -1;
@@ -963,6 +1135,7 @@ static int interworking_connect_roaming_consortium(
        ssid = wpa_config_add_network(wpa_s->conf);
        if (ssid == NULL)
                return -1;
+       ssid->parent_cred = cred;
        wpas_notify_network_added(wpa_s, ssid);
        wpa_config_set_network_defaults(ssid);
        ssid->priority = cred->priority;
@@ -973,7 +1146,7 @@ static int interworking_connect_roaming_consortium(
        os_memcpy(ssid->ssid, ssid_ie + 2, ssid_ie[1]);
        ssid->ssid_len = ssid_ie[1];
 
-       if (interworking_set_hs20_params(ssid) < 0)
+       if (interworking_set_hs20_params(wpa_s, ssid) < 0)
                goto fail;
 
        if (cred->eap_method == NULL) {
@@ -1035,7 +1208,8 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
                return interworking_connect_roaming_consortium(wpa_s, cred,
                                                               bss, ie);
 
-       realm = nai_realm_parse(bss->anqp_nai_realm, &count);
+       realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
+                               &count);
        if (realm == NULL) {
                wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
                           "Realm list from " MACSTR, MAC2STR(bss->bssid));
@@ -1076,6 +1250,7 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
                nai_realm_free(realm, count);
                return -1;
        }
+       ssid->parent_cred = cred;
        wpas_notify_network_added(wpa_s, ssid);
        wpa_config_set_network_defaults(ssid);
        ssid->priority = cred->priority;
@@ -1086,7 +1261,7 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
        os_memcpy(ssid->ssid, ie + 2, ie[1]);
        ssid->ssid_len = ie[1];
 
-       if (interworking_set_hs20_params(ssid) < 0)
+       if (interworking_set_hs20_params(wpa_s, ssid) < 0)
                goto fail;
 
        if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
@@ -1124,11 +1299,20 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
                                           0) < 0)
                                goto fail;
                        break;
+               default:
+                       /* EAP params were not set - assume TTLS/MSCHAPv2 */
+                       if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
+                                          0) < 0)
+                               goto fail;
+                       break;
                }
                break;
        case EAP_TYPE_PEAP:
                os_snprintf(buf, sizeof(buf), "\"auth=%s\"",
-                           eap_get_name(EAP_VENDOR_IETF, eap->inner_method));
+                           eap_get_name(EAP_VENDOR_IETF,
+                                        eap->inner_method ?
+                                        eap->inner_method :
+                                        EAP_TYPE_MSCHAPV2));
                if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
                        goto fail;
                break;
@@ -1162,7 +1346,7 @@ static struct wpa_cred * interworking_credentials_available_3gpp(
        int ret;
 
 #ifdef INTERWORKING_3GPP
-       if (bss->anqp_3gpp == NULL)
+       if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
                return NULL;
 
        for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
@@ -1195,9 +1379,11 @@ static struct wpa_cred * interworking_credentials_available_3gpp(
 #endif /* PCSC_FUNCS */
                wpa_printf(MSG_DEBUG, "Interworking: Parsing 3GPP info from "
                           MACSTR, MAC2STR(bss->bssid));
-               ret = plmn_id_match(bss->anqp_3gpp, imsi, mnc_len);
+               ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
                wpa_printf(MSG_DEBUG, "PLMN match %sfound", ret ? "" : "not ");
                if (ret) {
+                       if (cred_excluded_ssid(cred, bss))
+                               continue;
                        if (selected == NULL ||
                            selected->priority < cred->priority)
                                selected = cred;
@@ -1215,7 +1401,7 @@ static struct wpa_cred * interworking_credentials_available_realm(
        struct nai_realm *realm;
        u16 count, i;
 
-       if (bss->anqp_nai_realm == NULL)
+       if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
                return NULL;
 
        if (wpa_s->conf->cred == NULL)
@@ -1223,7 +1409,7 @@ static struct wpa_cred * interworking_credentials_available_realm(
 
        wpa_printf(MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
                   MACSTR, MAC2STR(bss->bssid));
-       realm = nai_realm_parse(bss->anqp_nai_realm, &count);
+       realm = nai_realm_parse(bss->anqp->nai_realm, &count);
        if (realm == NULL) {
                wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
                           "Realm list from " MACSTR, MAC2STR(bss->bssid));
@@ -1238,6 +1424,8 @@ static struct wpa_cred * interworking_credentials_available_realm(
                        if (!nai_realm_match(&realm[i], cred->realm))
                                continue;
                        if (nai_realm_find_eap(cred, &realm[i])) {
+                               if (cred_excluded_ssid(cred, bss))
+                                       continue;
                                if (selected == NULL ||
                                    selected->priority < cred->priority)
                                        selected = cred;
@@ -1302,48 +1490,61 @@ static int domain_name_list_contains(struct wpabuf *domain_names,
 }
 
 
-static int interworking_home_sp(struct wpa_supplicant *wpa_s,
-                               struct wpabuf *domain_names)
+int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
+                             struct wpa_cred *cred,
+                             struct wpabuf *domain_names)
 {
-       struct wpa_cred *cred;
 #ifdef INTERWORKING_3GPP
        char nai[100], *realm;
+
+       char *imsi = NULL;
+       int mnc_len = 0;
+       if (cred->imsi)
+               imsi = cred->imsi;
+#ifdef CONFIG_PCSC
+       else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
+                wpa_s->scard && wpa_s->imsi[0]) {
+               imsi = wpa_s->imsi;
+               mnc_len = wpa_s->mnc_len;
+       }
+#endif /* CONFIG_PCSC */
+       if (domain_names &&
+           imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
+               realm = os_strchr(nai, '@');
+               if (realm)
+                       realm++;
+               wpa_printf(MSG_DEBUG, "Interworking: Search for match "
+                          "with SIM/USIM domain %s", realm);
+               if (realm &&
+                   domain_name_list_contains(domain_names, realm))
+                       return 1;
+       }
 #endif /* INTERWORKING_3GPP */
 
+       if (domain_names == NULL || cred->domain == NULL)
+               return 0;
+
+       wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
+                  "home SP FQDN %s", cred->domain);
+       if (domain_name_list_contains(domain_names, cred->domain))
+               return 1;
+
+       return 0;
+}
+
+
+static int interworking_home_sp(struct wpa_supplicant *wpa_s,
+                               struct wpabuf *domain_names)
+{
+       struct wpa_cred *cred;
+
        if (domain_names == NULL || wpa_s->conf->cred == NULL)
                return -1;
 
        for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
-#ifdef INTERWORKING_3GPP
-               char *imsi = NULL;
-               int mnc_len = 0;
-               if (cred->imsi)
-                       imsi = cred->imsi;
-               else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
-                        wpa_s->scard && wpa_s->imsi[0]) {
-                       imsi = wpa_s->imsi;
-                       mnc_len = wpa_s->mnc_len;
-               }
-               if (imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0)
-                   == 0) {
-                       realm = os_strchr(nai, '@');
-                       if (realm)
-                               realm++;
-                       wpa_printf(MSG_DEBUG, "Interworking: Search for match "
-                                  "with SIM/USIM domain %s", realm);
-                       if (realm &&
-                           domain_name_list_contains(domain_names, realm))
-                               return 1;
-               }
-#endif /* INTERWORKING_3GPP */
-
-               if (cred->domain == NULL)
-                       continue;
-
-               wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
-                          "home SP FQDN %s", cred->domain);
-               if (domain_name_list_contains(domain_names, cred->domain))
-                       return 1;
+               int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
+               if (res)
+                       return res;
        }
 
        return 0;
@@ -1402,7 +1603,8 @@ static void interworking_select_network(struct wpa_supplicant *wpa_s)
                        continue;
                }
                count++;
-               res = interworking_home_sp(wpa_s, bss->anqp_domain_name);
+               res = interworking_home_sp(wpa_s, bss->anqp ?
+                                          bss->anqp->domain_name : NULL);
                if (res > 0)
                        type = "home";
                else if (res == 0)
@@ -1465,13 +1667,50 @@ static void interworking_select_network(struct wpa_supplicant *wpa_s)
 }
 
 
+static struct wpa_bss_anqp *
+interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+{
+       struct wpa_bss *other;
+
+       if (is_zero_ether_addr(bss->hessid))
+               return NULL; /* Cannot be in the same homegenous ESS */
+
+       dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
+               if (other == bss)
+                       continue;
+               if (other->anqp == NULL)
+                       continue;
+               if (other->anqp->roaming_consortium == NULL &&
+                   other->anqp->nai_realm == NULL &&
+                   other->anqp->anqp_3gpp == NULL &&
+                   other->anqp->domain_name == NULL)
+                       continue;
+               if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
+                       continue;
+               if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
+                       continue;
+               if (bss->ssid_len != other->ssid_len ||
+                   os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
+                       continue;
+
+               wpa_printf(MSG_DEBUG, "Interworking: Share ANQP data with "
+                          "already fetched BSSID " MACSTR " and " MACSTR,
+                          MAC2STR(other->bssid), MAC2STR(bss->bssid));
+               other->anqp->users++;
+               return other->anqp;
+       }
+
+       return NULL;
+}
+
+
 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
 {
        struct wpa_bss *bss;
        int found = 0;
        const u8 *ie;
 
-       if (!wpa_s->fetch_anqp_in_progress)
+       if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress)
                return;
 
        dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
@@ -1482,6 +1721,17 @@ static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
                        continue; /* AP does not support Interworking */
 
                if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
+                       if (bss->anqp == NULL) {
+                               bss->anqp = interworking_match_anqp_info(wpa_s,
+                                                                        bss);
+                               if (bss->anqp) {
+                                       /* Shared data already fetched */
+                                       continue;
+                               }
+                               bss->anqp = wpa_bss_anqp_alloc();
+                               if (bss->anqp == NULL)
+                                       break;
+                       }
                        found++;
                        bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
                        wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
@@ -1518,6 +1768,7 @@ int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
                return 0;
 
        wpa_s->network_select = 0;
+       wpa_s->fetch_all_anqp = 1;
 
        interworking_start_fetch_anqp(wpa_s);
 
@@ -1545,8 +1796,10 @@ int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
 
        freq = wpa_s->assoc_freq;
        bss = wpa_bss_get_bssid(wpa_s, dst);
-       if (bss)
+       if (bss) {
+               wpa_bss_anqp_unshare_alloc(bss);
                freq = bss->freq;
+       }
        if (freq <= 0)
                return -1;
 
@@ -1576,10 +1829,14 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
 {
        const u8 *pos = data;
        struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);
+       struct wpa_bss_anqp *anqp = NULL;
 #ifdef CONFIG_HS20
        u8 type;
 #endif /* CONFIG_HS20 */
 
+       if (bss)
+               anqp = bss->anqp;
+
        switch (info_id) {
        case ANQP_CAPABILITY_LIST:
                wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
@@ -1589,9 +1846,9 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
                wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
                        " Venue Name", MAC2STR(sa));
                wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_venue_name);
-                       bss->anqp_venue_name = wpabuf_alloc_copy(pos, slen);
+               if (anqp) {
+                       wpabuf_free(anqp->venue_name);
+                       anqp->venue_name = wpabuf_alloc_copy(pos, slen);
                }
                break;
        case ANQP_NETWORK_AUTH_TYPE:
@@ -1600,10 +1857,9 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
                        MAC2STR(sa));
                wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
                                  "Type", pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_network_auth_type);
-                       bss->anqp_network_auth_type =
-                               wpabuf_alloc_copy(pos, slen);
+               if (anqp) {
+                       wpabuf_free(anqp->network_auth_type);
+                       anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
                }
                break;
        case ANQP_ROAMING_CONSORTIUM:
@@ -1611,10 +1867,9 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
                        " Roaming Consortium list", MAC2STR(sa));
                wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
                                  pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_roaming_consortium);
-                       bss->anqp_roaming_consortium =
-                               wpabuf_alloc_copy(pos, slen);
+               if (anqp) {
+                       wpabuf_free(anqp->roaming_consortium);
+                       anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
                }
                break;
        case ANQP_IP_ADDR_TYPE_AVAILABILITY:
@@ -1623,9 +1878,9 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
                        MAC2STR(sa));
                wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
                            pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_ip_addr_type_availability);
-                       bss->anqp_ip_addr_type_availability =
+               if (anqp) {
+                       wpabuf_free(anqp->ip_addr_type_availability);
+                       anqp->ip_addr_type_availability =
                                wpabuf_alloc_copy(pos, slen);
                }
                break;
@@ -1633,9 +1888,9 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
                wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
                        " NAI Realm list", MAC2STR(sa));
                wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_nai_realm);
-                       bss->anqp_nai_realm = wpabuf_alloc_copy(pos, slen);
+               if (anqp) {
+                       wpabuf_free(anqp->nai_realm);
+                       anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
                }
                break;
        case ANQP_3GPP_CELLULAR_NETWORK:
@@ -1643,18 +1898,18 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
                        " 3GPP Cellular Network information", MAC2STR(sa));
                wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
                                  pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_3gpp);
-                       bss->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
+               if (anqp) {
+                       wpabuf_free(anqp->anqp_3gpp);
+                       anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
                }
                break;
        case ANQP_DOMAIN_NAME:
                wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
                        " Domain Name list", MAC2STR(sa));
                wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
-               if (bss) {
-                       wpabuf_free(bss->anqp_domain_name);
-                       bss->anqp_domain_name = wpabuf_alloc_copy(pos, slen);
+               if (anqp) {
+                       wpabuf_free(anqp->domain_name);
+                       anqp->domain_name = wpabuf_alloc_copy(pos, slen);
                }
                break;
        case ANQP_VENDOR_SPECIFIC:
@@ -1760,10 +2015,11 @@ int interworking_select(struct wpa_supplicant *wpa_s, int auto_select)
        wpa_s->network_select = 1;
        wpa_s->auto_network_select = 0;
        wpa_s->auto_select = !!auto_select;
+       wpa_s->fetch_all_anqp = 0;
        wpa_printf(MSG_DEBUG, "Interworking: Start scan for network "
                   "selection");
        wpa_s->scan_res_handler = interworking_scan_res_handler;
-       wpa_s->scan_req = 2;
+       wpa_s->scan_req = MANUAL_SCAN_REQ;
        wpa_supplicant_req_scan(wpa_s, 0, 0);
 
        return 0;