This is a parser for the WFA OWE Transition element. For now the optional band/channel bytes will not be parsed as hostapd does not yet support these and would also require the 802.11 appendix E-1 to be added to IWD. Because of this OWE Transition networks are assumed to be on the same channel as their open counterpart. --- src/ie.c | 43 +++++++++++++++++++++++++++++++++++++++++++ src/ie.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/src/ie.c b/src/ie.c index 1ce1d8a5..286b6a49 100644 --- a/src/ie.c +++ b/src/ie.c @@ -1343,6 +1343,8 @@ bool is_ie_wfa_ie(const uint8_t *data, uint8_t len, uint8_t oi_type) return false; else if (oi_type == IE_WFA_OI_HS20_INDICATION && len != 5 && len != 7) return false; + else if (oi_type == IE_WFA_OI_OWE_TRANSITION && len < 12) + return false; else if (len < 4) /* OI not handled, but at least check length */ return false; @@ -2492,3 +2494,44 @@ int ie_parse_network_cost(const void *data, size_t len, *flags = l_get_le16(ie + 8); return 0; } + +int ie_parse_owe_transition(const void *data, size_t len, uint8_t *bssid, + char ssid[33]) +{ + const uint8_t *ie = data; + size_t slen; + + if (len < 14 || ie[0] != IE_TYPE_VENDOR_SPECIFIC) + return -ENOMSG; + + if (!is_ie_wfa_ie(ie + 2, len - 2, IE_WFA_OI_OWE_TRANSITION)) + return -ENOMSG; + + slen = l_get_u8(ie + 12); + if (slen > 32) + return -ENOMSG; + + /* + * WFA OWE Specification 2.3.1 + * + * "Band Info and Channel Info are optional fields. If configured, + * both fields shall be included in an OWE Transition Mode element" + * + * TODO: Support Band/Channel bytes: + * For the time being the OWE transition AP is assumed to be on the same + * channel as the open AP. This means there should be no band/channel + * bytes at the end of the IE. Currently hostapd has no support for this + * so it can be skipped. In addition 802.11 Appendix E-1 needs to be + * encoded as a table to map Country/operating class to channels to make + * any sense of it. + */ + if (len != slen + 13) + return -ENOMSG; + + memcpy(bssid, ie + 6, 6); + + memcpy(ssid, ie + 13, slen); + ssid[slen] = '\0'; + + return 0; +} diff --git a/src/ie.h b/src/ie.h index 4e1c5433..fdd7f34c 100644 --- a/src/ie.h +++ b/src/ie.h @@ -630,3 +630,6 @@ void ie_build_fils_ip_addr_response( int ie_parse_network_cost(const void *data, size_t len, uint16_t *flags, uint16_t *level); + +int ie_parse_owe_transition(const void *data, size_t len, uint8_t *bssid, + char ssid[33]); -- 2.31.1

The ssid parameter was used for direct probe responses for finding hidden networks. OWE transition will be added which requires a hidden OWE network. IWD will need to automatically hidden scan for one or multiple of these networks and doing so in separate scans would be hard to manage. To prep for this the ssid scan parameter is being changed to a string list which can contain many SSIDs to probe for. --- src/p2p.c | 7 +++++-- src/scan.c | 12 ++++++++---- src/scan.h | 2 +- src/station.c | 11 ++++++++--- 4 files changed, 22 insertions(+), 10 deletions(-) diff --git a/src/p2p.c b/src/p2p.c index 3328271b..dd78e044 100644 --- a/src/p2p.c +++ b/src/p2p.c @@ -1977,10 +1977,11 @@ static void p2p_provision_scan_start(struct p2p_device *dev) { struct scan_parameters params = {}; uint8_t buf[256]; + const char *ssids[2] = { dev->go_group_id.ssid, NULL }; params.flush = true; params.no_cck_rates = true; - params.ssid = dev->go_group_id.ssid; + params.ssids = ssids; params.extra_ie = p2p_build_scan_ies(dev, buf, sizeof(buf), &params.extra_ie_size); L_WARN_ON(!params.extra_ie); @@ -3773,6 +3774,7 @@ static bool p2p_device_scan_start(struct p2p_device *dev) struct scan_parameters params = {}; uint8_t buf[256]; unsigned int i; + const char *ssids[2] = { 0 }; wiphy_get_reg_domain_country(dev->wiphy, (char *) dev->listen_country); dev->listen_country[2] = 4; /* Table E-4 */ @@ -3783,7 +3785,8 @@ static bool p2p_device_scan_start(struct p2p_device *dev) L_WARN_ON(!params.extra_ie); params.flush = true; /* P2P Wildcard SSID because we don't need legacy networks to reply */ - params.ssid = "DIRECT-"; + ssids[0] = "DIRECT-"; + params.ssids = ssids; /* * Must send probe requests at 6Mb/s, OFDM only. The no-CCK rates * flag forces the drivers to do exactly this for 2.4GHz frames. diff --git a/src/scan.c b/src/scan.c index 5e31c308..e74874be 100644 --- a/src/scan.c +++ b/src/scan.c @@ -539,10 +539,14 @@ static void scan_cmds_add(struct l_queue *cmds, struct scan_context *sc, l_genl_msg_enter_nested(cmd, NL80211_ATTR_SCAN_SSIDS); - if (params->ssid) { - /* direct probe request scan */ - l_genl_msg_append_attr(cmd, NL80211_ATTR_SSID, - strlen(params->ssid), params->ssid); + /* direct probe request scan */ + if (params->ssids) { + unsigned int i; + + for (i = 0; i < l_strv_length((char **)params->ssids); i++) + l_genl_msg_append_attr(cmd, NL80211_ATTR_SSID, + strlen(params->ssids[i]), + params->ssids[i]); l_genl_msg_leave_nested(cmd); l_queue_push_tail(cmds, cmd); diff --git a/src/scan.h b/src/scan.h index 23de472b..dc14d3e0 100644 --- a/src/scan.h +++ b/src/scan.h @@ -99,7 +99,7 @@ struct scan_parameters { bool randomize_mac_addr_hint : 1; bool no_cck_rates : 1; bool duration_mandatory : 1; - const char *ssid; /* Used for direct probe request */ + const char **ssids; /* Used for direct probe requests */ const uint8_t *source_mac; }; diff --git a/src/station.c b/src/station.c index ac741f5a..a6140766 100644 --- a/src/station.c +++ b/src/station.c @@ -2006,12 +2006,15 @@ static int station_roam_scan(struct station *station, struct scan_freq_set *freq_set) { struct scan_parameters params = { .freqs = freq_set, .flush = true }; + const char *ssids[2] = { 0 }; l_debug("ifindex: %u", netdev_get_ifindex(station->netdev)); - if (station->connected_network) + if (station->connected_network) { /* Use direct probe request */ - params.ssid = network_get_ssid(station->connected_network); + ssids[0] = network_get_ssid(station->connected_network); + params.ssids = ssids; + } if (!freq_set) station->roam_scan_full = true; @@ -2870,6 +2873,7 @@ static struct l_dbus_message *station_dbus_connect_hidden_network( .randomize_mac_addr_hint = false, }; const char *ssid; + const char *ssids[2] = { 0 }; struct network *network; l_debug(""); @@ -2916,7 +2920,8 @@ static struct l_dbus_message *station_dbus_connect_hidden_network( return dbus_error_not_hidden(message); } - params.ssid = ssid; + ssids[0] = ssid; + params.ssids = ssids; /* HW cannot randomize our MAC if connected */ if (!station->connected_bss) -- 2.31.1

This is being added to support OWE transition mode. For these type of networks the OWE BSS may contain a different SSID than that of the network, but the WFA spec requires this be hidden from the user. This means we need to set the handshake SSID based on the BSS rather than the network object. --- src/network.c | 5 ++--- src/network.h | 2 +- src/station.c | 2 +- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/src/network.c b/src/network.c index d81a201d..4a6cf3ae 100644 --- a/src/network.c +++ b/src/network.c @@ -465,7 +465,7 @@ static int network_set_handshake_secrets_psk(struct network *network, return 0; } -int network_handshake_setup(struct network *network, +int network_handshake_setup(struct network *network, struct scan_bss *bss, struct handshake_state *hs) { struct station *station = network->station; @@ -492,8 +492,7 @@ int network_handshake_setup(struct network *network, return -ENOTSUP; } - handshake_state_set_ssid(hs, (void *) network->ssid, - strlen(network->ssid)); + handshake_state_set_ssid(hs, bss->ssid, bss->ssid_len); if (settings && l_settings_get_uint(settings, "EAPoL", "ProtocolVersion", diff --git a/src/network.h b/src/network.h index 39375703..5451815b 100644 --- a/src/network.h +++ b/src/network.h @@ -50,7 +50,7 @@ bool network_set_psk(struct network *network, const uint8_t *psk); int network_set_transition_disable(struct network *network, const uint8_t *td, size_t len); -int network_handshake_setup(struct network *network, +int network_handshake_setup(struct network *network, struct scan_bss *bss, struct handshake_state *hs); void network_sync_settings(struct network *network); diff --git a/src/station.c b/src/station.c index a6140766..2846d3d2 100644 --- a/src/station.c +++ b/src/station.c @@ -935,7 +935,7 @@ static struct handshake_state *station_handshake_setup(struct station *station, handshake_state_set_authenticator_rsnxe(hs, bss->rsnxe); - if (network_handshake_setup(network, hs) < 0) + if (network_handshake_setup(network, bss, hs) < 0) goto not_supported; vendor_ies = network_info_get_extra_ies(info, bss, &iov_elems); -- 2.31.1

--- monitor/nlmon.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/monitor/nlmon.c b/monitor/nlmon.c index 1a26f553..177147c4 100644 --- a/monitor/nlmon.c +++ b/monitor/nlmon.c @@ -1009,6 +1009,21 @@ static void print_ipv4(unsigned int level, const char *label, addr[0], addr[1], addr[2], addr[3]); } +static void print_ie_wfa_owe_transition(unsigned int level, const char *label, + const void *data, uint16_t size) +{ + uint8_t bssid[6]; + char ssid[33]; + + if (ie_parse_owe_transition(data, size, bssid, ssid) < 0) { + print_attr(level + 1, "Error parsing"); + return; + } + + print_attr(level + 1, "BSSID: "MAC, MAC_STR(bssid)); + print_attr(level + 1, "SSID: %s", ssid); +} + static void print_ie_vendor(unsigned int level, const char *label, const void *data, uint16_t size) { @@ -1054,6 +1069,10 @@ static void print_ie_vendor(unsigned int level, const char *label, case 0x12: print_ie_rsn_suites(level + 1, label, data, size); return; + case 0x1c: + print_ie_wfa_owe_transition(level + 1, label, + data - 6, size + 6); + return; default: return; } -- 2.31.1

OWE Transition is described in the WiFi Alliance OWE Specification version 1.1. The idea behind it is to support both legacy devices without any concept of OWE as well as modern ones which support the OWE protocol. OWE is a somewhat special type of network. Where it advertises an RSN element but is still "open". This apparently confuses older devices so the OWE transition procedure was created. The idea is simple: have two BSS's, one open, and one as a hidden OWE network. Each network advertises a vendor IE which points to the other. A device sees the open network and can connect (legacy) or parse the IE, scan for the hidden OWE network, and connect to that instead. Care was taken to handle connections to hidden networks directly. The policy is being set that any hidden network with the WFA OWE IE is not connectable via ConnectHiddenNetwork(). These networks are special, and can only be connected to via the network object for the paired open network. When scan results come in from any source (DBus, quick, autoconnect) each BSS is checked for the OWE Transition IE. A few paths can be taken here when the IE is found: 1. The BSS is open. The BSSID in the IE is checked against the current scan results (excluding hidden networks). If a match is found we should already have the hidden OWE BSS and nothing else needs to be done (3). 2. The BSS is open. The BSSID in the IE is not found in the current scan results, and the open network also has no OWE BSS in it. Add this network to a list to scan for the hidden OWE BSS. 3. The BSS is not open and contains the OWE IE. This BSS will automatically get added to the network object and nothing else needs to be done. After processing and networks added to this hidden OWE scan list are processed. Each network should contain a single open BSS with the OWE IE. The SSID from the IEs are added to the scan parameters and the scan is started. The scan results should contain only the (previously hidden) OWE BSS's. These BSS's should contain the OWE IE which is used to look up the original open networks. If found the OWE BSS's are added to their respective networks. From here network.c can detect that this is an OWE transition network and connect to the OWE BSS rather than the open one. --- src/station.c | 309 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 300 insertions(+), 9 deletions(-) diff --git a/src/station.c b/src/station.c index 8a28b9a8..b40b98aa 100644 --- a/src/station.c +++ b/src/station.c @@ -87,6 +87,8 @@ struct station { uint32_t dbus_scan_id; uint32_t quick_scan_id; uint32_t hidden_network_scan_id; + uint32_t owe_transition_scan_id; + struct l_queue* owe_network_list; /* Roaming related members */ struct timespec roam_min_time; @@ -361,6 +363,35 @@ static struct network *station_add_seen_bss(struct station *station, if (station_parse_bss_security(station, bss, &security) < 0) return NULL; + /* Hidden OWE transition network */ + if (security == SECURITY_NONE && bss->rsne && + !l_memeqzero(bss->owe_trans_bssid, 6)) { + /* + * WiFi Alliance OWE Specification v1.1 - Section 2.2.1: + * + * "2. An OWE AP shall use two different SSIDs, one for OWE + * and one for Open" + * + * "4. The OWE BSS shall include the OWE Transition Mode element + * in all Beacon and Probe Response frames to encapsulate + * the BSSID and SSID of the Open BSS" + * + * Meaning the hidden SSID should not match the SSID in the + * hidden network's OWE IE. Might as well restrict BSSID as well + * to be safe. + */ + if (!memcmp(bss->owe_trans_ssid, bss->ssid, bss->ssid_len)) + return NULL; + + if (!memcmp(bss->owe_trans_bssid, bss->addr, 6)) + return NULL; + + memcpy(ssid, bss->owe_trans_ssid, sizeof(bss->owe_trans_ssid)); + + l_debug("Found hidden OWE network, using %s for network lookup", + ssid); + } + path = iwd_network_get_path(station, ssid, security); network = l_hashmap_lookup(station->networks, path); @@ -625,6 +656,210 @@ static bool station_start_anqp(struct station *station, struct network *network, return true; } +static bool bss_match_bssid(const void *a, const void *b) +{ + const struct scan_bss *bss = a; + const uint8_t *bssid = b; + + return !memcmp(bss->addr, bssid, sizeof(bss->addr)); +} + +static bool network_match_ssid(const void *a, const void *b) +{ + const struct network *network = a; + const char *ssid = b; + + return !strcmp(network_get_ssid(network), ssid); +} + +static void foreach_owe_hidden_started(void *data, void *user_data) +{ + struct network *network = data; + + WATCHLIST_NOTIFY(&event_watches, station_event_watch_func_t, + STATION_EVENT_OWE_HIDDEN_STARTED, network); +} + +static void foreach_owe_hidden_finished(void *data) +{ + struct network *network = data; + + WATCHLIST_NOTIFY(&event_watches, station_event_watch_func_t, + STATION_EVENT_OWE_HIDDEN_FINISHED, network); +} + +static bool station_owe_transition_results(int err, struct l_queue *bss_list, + const struct scan_freq_set *freqs, + void *userdata) +{ + struct station *station = userdata; + struct scan_bss *bss; + + station_property_set_scanning(station, false); + + if (err) + return err == 0; + + /* + * Insert all BSS's into station/network BSS list but don't create a + * network for them. The idea here is for the user to connect to the + * open network and IWD will transition them to the OWE network + * automatically. + */ + while ((bss = l_queue_pop_head(bss_list))) { + struct network *network; + struct scan_bss *open; + + /* + * Don't parse the open BSS, hidden BSS, or BSS with + * no OWE Transition IE + */ + if (!bss->rsne || l_memeqzero(bss->owe_trans_bssid, 6) || + util_ssid_is_hidden(bss->ssid_len, bss->ssid)) + goto free; + + network = l_queue_find(station->owe_network_list, + network_match_ssid, + bss->owe_trans_ssid); + if (!network) { + l_warn("No open network %s found", bss->owe_trans_ssid); + goto free; + } + + /* + * Check if the Open network IE matches the BSS we have. If not + * don't add this BSS. We should always find an open network + * here since the lookup above succeeded, but just in case + * don't continue. + */ + open = network_bss_find_by_addr(network, bss->owe_trans_bssid); + if (!open) + goto free; + + if (memcmp(open->owe_trans_bssid, bss->addr, 6)) { + l_warn("BSS in results did not match Open OWE IE!"); + goto free; + } + + l_debug("Adding OWE transition network "MAC" to %s", + MAC_STR(bss->addr), network_get_ssid(network)); + + l_queue_push_tail(station->bss_list, bss); + network_bss_add(network, bss); + + continue; + +free: + scan_bss_free(bss); + } + + l_queue_destroy(bss_list, NULL); + + return true; +} + +static void station_owe_transition_triggered(int err, void *user_data) +{ + struct station *station = user_data; + + if (err < 0) { + l_debug("OWE transition scan trigger failed: %i", err); + return; + } + + l_debug("OWE transition scan triggered for %s", + netdev_get_name(station->netdev)); + + station_property_set_scanning(station, true); +} + +static void station_owe_transition_destroy(void *userdata) +{ + struct station *station = userdata; + + /* + * Signal done to all networks. This needs to happen regardless of a + * successful hidden scan. + */ + l_queue_destroy(station->owe_network_list, foreach_owe_hidden_finished); + station->owe_network_list = NULL; + + station->owe_transition_scan_id = 0; + + /* + * Must resume autoconnect here regardless of an error since this logic + * was bypassed in station_set_scan_results + */ + l_queue_destroy(station->autoconnect_list, NULL); + station->autoconnect_list = l_queue_new(); + + if (station_is_autoconnecting(station)) { + station_network_foreach(station, network_add_foreach, station); + station_autoconnect_next(station); + } +} + +static void station_owe_transition_scan(struct station *station) +{ + struct scan_freq_set *freqs = NULL; + char **ssids = NULL; + const struct l_queue_entry *network_entry; + struct scan_parameters params = { + .flush = true, + .randomize_mac_addr_hint = false, + }; + + for (network_entry = l_queue_get_entries(station->owe_network_list); + network_entry; network_entry = network_entry->next) { + /* + * Using network_bss_select here should be safe. The network + * should not contain any hidden OWE networks yet. This is + * guaranteed by station_build_owe_scan. + */ + struct network *network = network_entry->data; + struct scan_bss *bss = network_bss_select(network, true); + + if (!ssids) + ssids = l_strv_new(); + + if (!freqs) + freqs = scan_freq_set_new(); + + ssids = l_strv_append(ssids, bss->owe_trans_ssid); + scan_freq_set_add(freqs, bss->frequency); + + l_debug("OWE transition network found (%s) "MAC, + bss->owe_trans_ssid, + MAC_STR(bss->owe_trans_bssid)); + } + + params.freqs = freqs; + params.ssids = (const char **)ssids; + + l_debug("Starting OWE transition scan"); + + station->owe_transition_scan_id = scan_active_full( + netdev_get_wdev_id(station->netdev), + &params, + station_owe_transition_triggered, + station_owe_transition_results, station, + station_owe_transition_destroy); + + scan_freq_set_free(freqs); + l_strv_free(ssids); + + if (station->owe_transition_scan_id) { + l_queue_foreach(station->owe_network_list, + foreach_owe_hidden_started, station); + return; + } + + l_error("Error scanning for hidden OWE networks"); + + l_queue_destroy(station->owe_network_list, NULL); + station->owe_network_list = NULL; +} + static bool bss_free_if_ssid_not_utf8(void *data, void *user_data) { struct scan_bss *bss = data; @@ -641,6 +876,52 @@ static bool bss_free_if_ssid_not_utf8(void *data, void *user_data) return true; } +static bool match_bssid_not_hidden(const void *a, const void *b) +{ + const struct scan_bss *bss = a; + const uint8_t *bssid = b; + + if (util_ssid_is_hidden(bss->ssid_len, bss->ssid)) + return false; + + return !memcmp(bss->addr, bssid, sizeof(bss->addr)); +} + +static void station_build_owe_scan(struct station *station, + struct l_queue *bss_list, + struct scan_bss *bss, + struct network *network) +{ + if (station->owe_transition_scan_id) + return; + + /* only want the open networks with WFA OWE IE */ + if (bss->rsne) + return; + + /* BSS already in network object */ + if (network_bss_find_by_addr(network, bss->owe_trans_bssid)) + return; + + /* + * If the BSSID of the Open OWE IE is in the results we + * are done. station_add_seen_bss will add this to the + * network object. + * + * This is required if the Open BSS appears first in the + * new_bss_list and the OWE network hasn't had a chance + * to get added to the network. + */ + if (l_queue_find(bss_list, match_bssid_not_hidden, + bss->owe_trans_bssid)) + return; + + if (!station->owe_network_list) + station->owe_network_list = l_queue_new(); + + l_queue_push_tail(station->owe_network_list, network); +} + /* * Used when scan results were obtained; either from scan running * inside station module or scans running in other state machines, e.g. wsc @@ -701,13 +982,21 @@ void station_set_scan_results(struct station *station, if (station_start_anqp(station, network, bss)) wait_for_anqp = true; + + /* Network with OWE Transition IE */ + if (!l_memeqzero(bss->owe_trans_bssid, 6)) + station_build_owe_scan(station, new_bss_list, + bss, network); } + if (station->owe_network_list) + station_owe_transition_scan(station); + station->bss_list = new_bss_list; l_hashmap_foreach_remove(station->networks, process_network, station); - if (!wait_for_anqp && add_to_autoconnect) { + if (!wait_for_anqp && !station->owe_network_list && add_to_autoconnect) { station_network_foreach(station, network_add_foreach, station); station_autoconnect_next(station); } @@ -1650,14 +1939,6 @@ static void station_transition_reassociate(struct station *station, station_enter_state(station, STATION_STATE_ROAMING); } -static bool bss_match_bssid(const void *a, const void *b) -{ - const struct scan_bss *bss = a; - const uint8_t *bssid = b; - - return !memcmp(bss->addr, bssid, sizeof(bss->addr)); -} - static void station_preauthenticate_cb(struct netdev *netdev, enum netdev_result result, const uint8_t *pmk, void *user_data) @@ -2906,6 +3187,10 @@ static struct l_dbus_message *station_dbus_connect_hidden_network( l_queue_get_entries(station->hidden_bss_list_sorted); struct scan_bss *target = network_bss_select(network, true); + /* Treat OWE transition networks special */ + if (!l_memeqzero(target->owe_trans_bssid, 6)) + goto not_hidden; + for (; entry; entry = entry->next) { struct scan_bss *bss = entry->data; @@ -2917,6 +3202,7 @@ static struct l_dbus_message *station_dbus_connect_hidden_network( message); } +not_hidden: return dbus_error_not_hidden(message); } @@ -3678,9 +3964,14 @@ static void station_free(struct station *station) scan_cancel(netdev_get_wdev_id(station->netdev), station->hidden_network_scan_id); + if (station->owe_transition_scan_id) + scan_cancel(netdev_get_wdev_id(station->netdev), + station->owe_transition_scan_id); + station_roam_state_clear(station); l_queue_destroy(station->networks_sorted, NULL); + l_queue_destroy(station->owe_network_list, NULL); l_hashmap_destroy(station->networks, network_free); l_queue_destroy(station->bss_list, bss_free); l_queue_destroy(station->hidden_bss_list_sorted, NULL); -- 2.31.1

There isn't much control station has with how BSS's are inserted to a network object. The rank algorithm makes that decision. Because of this we could end up in a situation where the Open BSS is preferred over the OWE transition BSS. In attempt to better handle this any Open BSS in this type of network will not be chosen unless its the only candidate (e.g. no other BSSs, inability to connect with OWE, or an improperly configured network). --- src/network.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/network.c b/src/network.c index 48314a05..cda507b5 100644 --- a/src/network.c +++ b/src/network.c @@ -1130,6 +1130,14 @@ struct scan_bss *network_bss_select(struct network *network, if (!candidate) candidate = bss; + /* + * Do what we can to NOT connect to the Open BSS of an OWE + * transition network. This can still happen if this is the only + * BSS, or if the BSS's were improperly configured. + */ + if (!l_memeqzero(bss->owe_trans_bssid, 6) && !bss->rsne) + continue; + /* check if temporarily blacklisted */ if (l_queue_find(network->blacklist, match_bss, bss)) continue; -- 2.31.1