src/ap/ieee802_11.c

   1 /*
   2  * hostapd / IEEE 802.11 Management
   3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #ifndef CONFIG_NATIVE_WINDOWS
  12
  13 #include "utils/common.h"
  14 #include "utils/eloop.h"
  15 #include "crypto/crypto.h"
  16 #include "drivers/driver.h"
  17 #include "common/ieee802_11_defs.h"
  18 #include "common/ieee802_11_common.h"
  19 #include "common/wpa_ctrl.h"
  20 #include "radius/radius.h"
  21 #include "radius/radius_client.h"
  22 #include "p2p/p2p.h"
  23 #include "wps/wps.h"
  24 #include "hostapd.h"
  25 #include "beacon.h"
  26 #include "ieee802_11_auth.h"
  27 #include "sta_info.h"
  28 #include "ieee802_1x.h"
  29 #include "wpa_auth.h"
  30 #include "wmm.h"
  31 #include "ap_list.h"
  32 #include "accounting.h"
  33 #include "ap_config.h"
  34 #include "ap_mlme.h"
  35 #include "p2p_hostapd.h"
  36 #include "ap_drv_ops.h"
  37 #include "ieee802_11.h"
  38
  39
  40 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
  41 {
  42         u8 *pos = eid;
  43         int i, num, count;
  44
  45         if (hapd->iface->current_rates == NULL)
  46                 return eid;
  47
  48         *pos++ = WLAN_EID_SUPP_RATES;
  49         num = hapd->iface->num_rates;
  50         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
  51                 num++;
  52         if (num > 8) {
  53                 /* rest of the rates are encoded in Extended supported
  54                  * rates element */
  55                 num = 8;
  56         }
  57
  58         *pos++ = num;
  59         count = 0;
  60         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
  61              i++) {
  62                 count++;
  63                 *pos = hapd->iface->current_rates[i].rate / 5;
  64                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  65                         *pos |= 0x80;
  66                 pos++;
  67         }
  68
  69         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
  70             hapd->iface->num_rates < 8)
  71                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
  72
  73         return pos;
  74 }
  75
  76
  77 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
  78 {
  79         u8 *pos = eid;
  80         int i, num, count;
  81
  82         if (hapd->iface->current_rates == NULL)
  83                 return eid;
  84
  85         num = hapd->iface->num_rates;
  86         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
  87                 num++;
  88         if (num <= 8)
  89                 return eid;
  90         num -= 8;
  91
  92         *pos++ = WLAN_EID_EXT_SUPP_RATES;
  93         *pos++ = num;
  94         count = 0;
  95         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
  96              i++) {
  97                 count++;
  98                 if (count <= 8)
  99                         continue; /* already in SuppRates IE */
 100                 *pos = hapd->iface->current_rates[i].rate / 5;
 101                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
 102                         *pos |= 0x80;
 103                 pos++;
 104         }
 105
 106         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
 107             hapd->iface->num_rates >= 8)
 108                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
 109
 110         return pos;
 111 }
 112
 113
 114 u16 hostapd_own_capab_info(struct hostapd_data *hapd, struct sta_info *sta,
 115                            int probe)
 116 {
 117         int capab = WLAN_CAPABILITY_ESS;
 118         int privacy;
 119
 120         if (hapd->iface->num_sta_no_short_preamble == 0 &&
 121             hapd->iconf->preamble == SHORT_PREAMBLE)
 122                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 123
 124         privacy = hapd->conf->ssid.wep.keys_set;
 125
 126         if (hapd->conf->ieee802_1x &&
 127             (hapd->conf->default_wep_key_len ||
 128              hapd->conf->individual_wep_key_len))
 129                 privacy = 1;
 130
 131         if (hapd->conf->wpa)
 132                 privacy = 1;
 133
 134         if (sta) {
 135                 int policy, def_klen;
 136                 if (probe && sta->ssid_probe) {
 137                         policy = sta->ssid_probe->security_policy;
 138                         def_klen = sta->ssid_probe->wep.default_len;
 139                 } else {
 140                         policy = sta->ssid->security_policy;
 141                         def_klen = sta->ssid->wep.default_len;
 142                 }
 143                 privacy = policy != SECURITY_PLAINTEXT;
 144                 if (policy == SECURITY_IEEE_802_1X && def_klen == 0)
 145                         privacy = 0;
 146         }
 147
 148         if (privacy)
 149                 capab |= WLAN_CAPABILITY_PRIVACY;
 150
 151         if (hapd->iface->current_mode &&
 152             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
 153             hapd->iface->num_sta_no_short_slot_time == 0)
 154                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 155
 156         return capab;
 157 }
 158
 159
 160 void ieee802_11_print_ssid(char *buf, const u8 *ssid, u8 len)
 161 {
 162         int i;
 163         if (len > HOSTAPD_MAX_SSID_LEN)
 164                 len = HOSTAPD_MAX_SSID_LEN;
 165         for (i = 0; i < len; i++) {
 166                 if (ssid[i] >= 32 && ssid[i] < 127)
 167                         buf[i] = ssid[i];
 168                 else
 169                         buf[i] = '.';
 170         }
 171         buf[len] = '\0';
 172 }
 173
 174
 175 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
 176                            u16 auth_transaction, const u8 *challenge,
 177                            int iswep)
 178 {
 179         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 180                        HOSTAPD_LEVEL_DEBUG,
 181                        "authentication (shared key, transaction %d)",
 182                        auth_transaction);
 183
 184         if (auth_transaction == 1) {
 185                 if (!sta->challenge) {
 186                         /* Generate a pseudo-random challenge */
 187                         u8 key[8];
 188                         struct os_time now;
 189                         int r;
 190                         sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
 191                         if (sta->challenge == NULL)
 192                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 193
 194                         os_get_time(&now);
 195                         r = os_random();
 196                         os_memcpy(key, &now.sec, 4);
 197                         os_memcpy(key + 4, &r, 4);
 198                         rc4_skip(key, sizeof(key), 0,
 199                                  sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
 200                 }
 201                 return 0;
 202         }
 203
 204         if (auth_transaction != 3)
 205                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 206
 207         /* Transaction 3 */
 208         if (!iswep || !sta->challenge || !challenge ||
 209             os_memcmp(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) {
 210                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 211                                HOSTAPD_LEVEL_INFO,
 212                                "shared key authentication - invalid "
 213                                "challenge-response");
 214                 return WLAN_STATUS_CHALLENGE_FAIL;
 215         }
 216
 217         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 218                        HOSTAPD_LEVEL_DEBUG,
 219                        "authentication OK (shared key)");
 220 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 221         /* Station will be marked authenticated if it ACKs the
 222          * authentication reply. */
 223 #else
 224         sta->flags |= WLAN_STA_AUTH;
 225         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 226 #endif
 227         os_free(sta->challenge);
 228         sta->challenge = NULL;
 229
 230         return 0;
 231 }
 232
 233
 234 static void send_auth_reply(struct hostapd_data *hapd,
 235                             const u8 *dst, const u8 *bssid,
 236                             u16 auth_alg, u16 auth_transaction, u16 resp,
 237                             const u8 *ies, size_t ies_len)
 238 {
 239         struct ieee80211_mgmt *reply;
 240         u8 *buf;
 241         size_t rlen;
 242
 243         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
 244         buf = os_zalloc(rlen);
 245         if (buf == NULL)
 246                 return;
 247
 248         reply = (struct ieee80211_mgmt *) buf;
 249         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 250                                             WLAN_FC_STYPE_AUTH);
 251         os_memcpy(reply->da, dst, ETH_ALEN);
 252         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 253         os_memcpy(reply->bssid, bssid, ETH_ALEN);
 254
 255         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 256         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 257         reply->u.auth.status_code = host_to_le16(resp);
 258
 259         if (ies && ies_len)
 260                 os_memcpy(reply->u.auth.variable, ies, ies_len);
 261
 262         wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
 263                    " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
 264                    MAC2STR(dst), auth_alg, auth_transaction,
 265                    resp, (unsigned long) ies_len);
 266         if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
 267                 perror("send_auth_reply: send");
 268
 269         os_free(buf);
 270 }
 271
 272
 273 #ifdef CONFIG_IEEE80211R
 274 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
 275                                   u16 auth_transaction, u16 status,
 276                                   const u8 *ies, size_t ies_len)
 277 {
 278         struct hostapd_data *hapd = ctx;
 279         struct sta_info *sta;
 280
 281         send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT, auth_transaction,
 282                         status, ies, ies_len);
 283
 284         if (status != WLAN_STATUS_SUCCESS)
 285                 return;
 286
 287         sta = ap_get_sta(hapd, dst);
 288         if (sta == NULL)
 289                 return;
 290
 291         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 292                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 293         sta->flags |= WLAN_STA_AUTH;
 294         mlme_authenticate_indication(hapd, sta);
 295 }
 296 #endif /* CONFIG_IEEE80211R */
 297
 298
 299 #ifdef CONFIG_SAE
 300
 301 static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
 302                                              struct sta_info *sta)
 303 {
 304         struct wpabuf *buf;
 305
 306         buf = wpabuf_alloc(2);
 307         if (buf == NULL)
 308                 return NULL;
 309
 310         wpabuf_put_le16(buf, 19); /* Finite Cyclic Group */
 311         /* TODO: Anti-Clogging Token (if requested) */
 312         /* TODO: Scalar */
 313         /* TODO: Element */
 314
 315         return buf;
 316 }
 317
 318
 319 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
 320                                               struct sta_info *sta)
 321 {
 322         struct wpabuf *buf;
 323
 324         buf = wpabuf_alloc(2);
 325         if (buf == NULL)
 326                 return NULL;
 327
 328         wpabuf_put_le16(buf, sta->sae_send_confirm);
 329         sta->sae_send_confirm++;
 330         /* TODO: Confirm */
 331
 332         return buf;
 333 }
 334
 335
 336 static u16 handle_sae_commit(struct hostapd_data *hapd, struct sta_info *sta,
 337                              const u8 *data, size_t len)
 338 {
 339         wpa_hexdump(MSG_DEBUG, "SAE commit fields", data, len);
 340
 341         /* Check Finite Cyclic Group */
 342         if (len < 2)
 343                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 344         if (WPA_GET_LE16(data) != 19) {
 345                 wpa_printf(MSG_DEBUG, "SAE: Unsupported Finite Cyclic Group %u",
 346                            WPA_GET_LE16(data));
 347                 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
 348         }
 349
 350         return WLAN_STATUS_SUCCESS;
 351 }
 352
 353
 354 static u16 handle_sae_confirm(struct hostapd_data *hapd, struct sta_info *sta,
 355                               const u8 *data, size_t len)
 356 {
 357         u16 rc;
 358
 359         wpa_hexdump(MSG_DEBUG, "SAE confirm fields", data, len);
 360
 361         if (len < 2)
 362                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 363         rc = WPA_GET_LE16(data);
 364         wpa_printf(MSG_DEBUG, "SAE: peer-send-confirm %u", rc);
 365
 366         return WLAN_STATUS_SUCCESS;
 367 }
 368
 369
 370 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
 371                             const struct ieee80211_mgmt *mgmt, size_t len,
 372                             u8 auth_transaction)
 373 {
 374         u16 resp = WLAN_STATUS_SUCCESS;
 375         struct wpabuf *data;
 376
 377         if (auth_transaction == 1) {
 378                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 379                                HOSTAPD_LEVEL_DEBUG,
 380                                "start SAE authentication (RX commit)");
 381                 resp = handle_sae_commit(hapd, sta, mgmt->u.auth.variable,
 382                                          ((u8 *) mgmt) + len -
 383                                          mgmt->u.auth.variable);
 384                 if (resp == WLAN_STATUS_SUCCESS)
 385                         sta->sae_state = SAE_COMMIT;
 386         } else if (auth_transaction == 2) {
 387                 if (sta->sae_state != SAE_COMMIT) {
 388                         hostapd_logger(hapd, sta->addr,
 389                                        HOSTAPD_MODULE_IEEE80211,
 390                                        HOSTAPD_LEVEL_DEBUG,
 391                                        "SAE confirm before commit");
 392                         resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 393                 }
 394                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 395                                HOSTAPD_LEVEL_DEBUG,
 396                                "SAE authentication (RX confirm)");
 397                 resp = handle_sae_confirm(hapd, sta, mgmt->u.auth.variable,
 398                                           ((u8 *) mgmt) + len -
 399                                           mgmt->u.auth.variable);
 400                 if (resp == WLAN_STATUS_SUCCESS) {
 401                         sta->flags |= WLAN_STA_AUTH;
 402                         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 403                         sta->auth_alg = WLAN_AUTH_SAE;
 404                         mlme_authenticate_indication(hapd, sta);
 405                 }
 406         } else {
 407                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 408                                HOSTAPD_LEVEL_DEBUG,
 409                                "unexpected SAE authentication transaction %u",
 410                                auth_transaction);
 411                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 412         }
 413
 414         sta->auth_alg = WLAN_AUTH_SAE;
 415
 416         if (resp == WLAN_STATUS_SUCCESS) {
 417                 if (auth_transaction == 1)
 418                         data = auth_build_sae_commit(hapd, sta);
 419                 else
 420                         data = auth_build_sae_confirm(hapd, sta);
 421                 if (data == NULL)
 422                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 423         } else
 424                 data = NULL;
 425
 426         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
 427                         auth_transaction, resp,
 428                         data ? wpabuf_head(data) : (u8 *) "",
 429                         data ? wpabuf_len(data) : 0);
 430         wpabuf_free(data);
 431 }
 432 #endif /* CONFIG_SAE */
 433
 434
 435 static void handle_auth(struct hostapd_data *hapd,
 436                         const struct ieee80211_mgmt *mgmt, size_t len)
 437 {
 438         u16 auth_alg, auth_transaction, status_code;
 439         u16 resp = WLAN_STATUS_SUCCESS;
 440         struct sta_info *sta = NULL;
 441         int res;
 442         u16 fc;
 443         const u8 *challenge = NULL;
 444         u32 session_timeout, acct_interim_interval;
 445         int vlan_id = 0;
 446         u8 psk[PMK_LEN];
 447         int has_psk = 0;
 448         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 449         size_t resp_ies_len = 0;
 450         char *identity = NULL;
 451         char *radius_cui = NULL;
 452
 453         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 454                 printf("handle_auth - too short payload (len=%lu)\n",
 455                        (unsigned long) len);
 456                 return;
 457         }
 458
 459         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 460         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 461         status_code = le_to_host16(mgmt->u.auth.status_code);
 462         fc = le_to_host16(mgmt->frame_control);
 463
 464         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 465             2 + WLAN_AUTH_CHALLENGE_LEN &&
 466             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 467             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 468                 challenge = &mgmt->u.auth.variable[2];
 469
 470         wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
 471                    "auth_transaction=%d status_code=%d wep=%d%s",
 472                    MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 473                    status_code, !!(fc & WLAN_FC_ISWEP),
 474                    challenge ? " challenge" : "");
 475
 476         if (hapd->tkip_countermeasures) {
 477                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 478                 goto fail;
 479         }
 480
 481         if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
 482                auth_alg == WLAN_AUTH_OPEN) ||
 483 #ifdef CONFIG_IEEE80211R
 484               (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
 485                auth_alg == WLAN_AUTH_FT) ||
 486 #endif /* CONFIG_IEEE80211R */
 487 #ifdef CONFIG_SAE
 488               (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
 489                auth_alg == WLAN_AUTH_SAE) ||
 490 #endif /* CONFIG_SAE */
 491               ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
 492                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 493                 printf("Unsupported authentication algorithm (%d)\n",
 494                        auth_alg);
 495                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 496                 goto fail;
 497         }
 498
 499         if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
 500               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
 501                 printf("Unknown authentication transaction number (%d)\n",
 502                        auth_transaction);
 503                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 504                 goto fail;
 505         }
 506
 507         if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
 508                 printf("Station " MACSTR " not allowed to authenticate.\n",
 509                        MAC2STR(mgmt->sa));
 510                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 511                 goto fail;
 512         }
 513
 514         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
 515                                       &session_timeout,
 516                                       &acct_interim_interval, &vlan_id,
 517                                       psk, &has_psk, &identity, &radius_cui);
 518
 519         if (res == HOSTAPD_ACL_REJECT) {
 520                 printf("Station " MACSTR " not allowed to authenticate.\n",
 521                        MAC2STR(mgmt->sa));
 522                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 523                 goto fail;
 524         }
 525         if (res == HOSTAPD_ACL_PENDING) {
 526                 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
 527                            " waiting for an external authentication",
 528                            MAC2STR(mgmt->sa));
 529                 /* Authentication code will re-send the authentication frame
 530                  * after it has received (and cached) information from the
 531                  * external source. */
 532                 return;
 533         }
 534
 535         sta = ap_sta_add(hapd, mgmt->sa);
 536         if (!sta) {
 537                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 538                 goto fail;
 539         }
 540
 541         if (vlan_id > 0) {
 542                 if (hostapd_get_vlan_id_ifname(hapd->conf->vlan,
 543                                                vlan_id) == NULL) {
 544                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 545                                        HOSTAPD_LEVEL_INFO, "Invalid VLAN ID "
 546                                        "%d received from RADIUS server",
 547                                        vlan_id);
 548                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 549                         goto fail;
 550                 }
 551                 sta->vlan_id = vlan_id;
 552                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 553                                HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
 554         }
 555
 556         if (has_psk && hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
 557                 os_free(sta->psk);
 558                 sta->psk = os_malloc(PMK_LEN);
 559                 if (sta->psk)
 560                         os_memcpy(sta->psk, psk, PMK_LEN);
 561         } else {
 562                 os_free(sta->psk);
 563                 sta->psk = NULL;
 564         }
 565
 566         sta->identity = identity;
 567         identity = NULL;
 568         sta->radius_cui = radius_cui;
 569         radius_cui = NULL;
 570
 571         sta->flags &= ~WLAN_STA_PREAUTH;
 572         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 573
 574         if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
 575                 sta->acct_interim_interval = acct_interim_interval;
 576         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
 577                 ap_sta_session_timeout(hapd, sta, session_timeout);
 578         else
 579                 ap_sta_no_session_timeout(hapd, sta);
 580
 581         switch (auth_alg) {
 582         case WLAN_AUTH_OPEN:
 583                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 584                                HOSTAPD_LEVEL_DEBUG,
 585                                "authentication OK (open system)");
 586 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 587                 /* Station will be marked authenticated if it ACKs the
 588                  * authentication reply. */
 589 #else
 590                 sta->flags |= WLAN_STA_AUTH;
 591                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 592                 sta->auth_alg = WLAN_AUTH_OPEN;
 593                 mlme_authenticate_indication(hapd, sta);
 594 #endif
 595                 break;
 596         case WLAN_AUTH_SHARED_KEY:
 597                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
 598                                        fc & WLAN_FC_ISWEP);
 599                 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
 600                 mlme_authenticate_indication(hapd, sta);
 601                 if (sta->challenge && auth_transaction == 1) {
 602                         resp_ies[0] = WLAN_EID_CHALLENGE;
 603                         resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
 604                         os_memcpy(resp_ies + 2, sta->challenge,
 605                                   WLAN_AUTH_CHALLENGE_LEN);
 606                         resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
 607                 }
 608                 break;
 609 #ifdef CONFIG_IEEE80211R
 610         case WLAN_AUTH_FT:
 611                 sta->auth_alg = WLAN_AUTH_FT;
 612                 if (sta->wpa_sm == NULL)
 613                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 614                                                         sta->addr);
 615                 if (sta->wpa_sm == NULL) {
 616                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
 617                                    "state machine");
 618                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 619                         goto fail;
 620                 }
 621                 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
 622                                     auth_transaction, mgmt->u.auth.variable,
 623                                     len - IEEE80211_HDRLEN -
 624                                     sizeof(mgmt->u.auth),
 625                                     handle_auth_ft_finish, hapd);
 626                 /* handle_auth_ft_finish() callback will complete auth. */
 627                 return;
 628 #endif /* CONFIG_IEEE80211R */
 629 #ifdef CONFIG_SAE
 630         case WLAN_AUTH_SAE:
 631                 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction);
 632                 return;
 633 #endif /* CONFIG_SAE */
 634         }
 635
 636  fail:
 637         os_free(identity);
 638         os_free(radius_cui);
 639
 640         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
 641                         auth_transaction + 1, resp, resp_ies, resp_ies_len);
 642 }
 643
 644
 645 static int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
 646 {
 647         int i, j = 32, aid;
 648
 649         /* get a unique AID */
 650         if (sta->aid > 0) {
 651                 wpa_printf(MSG_DEBUG, "  old AID %d", sta->aid);
 652                 return 0;
 653         }
 654
 655         for (i = 0; i < AID_WORDS; i++) {
 656                 if (hapd->sta_aid[i] == (u32) -1)
 657                         continue;
 658                 for (j = 0; j < 32; j++) {
 659                         if (!(hapd->sta_aid[i] & BIT(j)))
 660                                 break;
 661                 }
 662                 if (j < 32)
 663                         break;
 664         }
 665         if (j == 32)
 666                 return -1;
 667         aid = i * 32 + j + 1;
 668         if (aid > 2007)
 669                 return -1;
 670
 671         sta->aid = aid;
 672         hapd->sta_aid[i] |= BIT(j);
 673         wpa_printf(MSG_DEBUG, "  new AID %d", sta->aid);
 674         return 0;
 675 }
 676
 677
 678 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
 679                       const u8 *ssid_ie, size_t ssid_ie_len)
 680 {
 681         if (ssid_ie == NULL)
 682                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 683
 684         if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
 685             os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
 686                 char ssid_txt[33];
 687                 ieee802_11_print_ssid(ssid_txt, ssid_ie, ssid_ie_len);
 688                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 689                                HOSTAPD_LEVEL_INFO,
 690                                "Station tried to associate with unknown SSID "
 691                                "'%s'", ssid_txt);
 692                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 693         }
 694
 695         return WLAN_STATUS_SUCCESS;
 696 }
 697
 698
 699 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
 700                      const u8 *wmm_ie, size_t wmm_ie_len)
 701 {
 702         sta->flags &= ~WLAN_STA_WMM;
 703         sta->qosinfo = 0;
 704         if (wmm_ie && hapd->conf->wmm_enabled) {
 705                 struct wmm_information_element *wmm;
 706
 707                 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
 708                         hostapd_logger(hapd, sta->addr,
 709                                        HOSTAPD_MODULE_WPA,
 710                                        HOSTAPD_LEVEL_DEBUG,
 711                                        "invalid WMM element in association "
 712                                        "request");
 713                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 714                 }
 715
 716                 sta->flags |= WLAN_STA_WMM;
 717                 wmm = (struct wmm_information_element *) wmm_ie;
 718                 sta->qosinfo = wmm->qos_info;
 719         }
 720         return WLAN_STATUS_SUCCESS;
 721 }
 722
 723
 724 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
 725                            struct ieee802_11_elems *elems)
 726 {
 727         if (!elems->supp_rates) {
 728                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 729                                HOSTAPD_LEVEL_DEBUG,
 730                                "No supported rates element in AssocReq");
 731                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 732         }
 733
 734         if (elems->supp_rates_len + elems->ext_supp_rates_len >
 735             sizeof(sta->supported_rates)) {
 736                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 737                                HOSTAPD_LEVEL_DEBUG,
 738                                "Invalid supported rates element length %d+%d",
 739                                elems->supp_rates_len,
 740                                elems->ext_supp_rates_len);
 741                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 742         }
 743
 744         sta->supported_rates_len = merge_byte_arrays(
 745                 sta->supported_rates, sizeof(sta->supported_rates),
 746                 elems->supp_rates, elems->supp_rates_len,
 747                 elems->ext_supp_rates, elems->ext_supp_rates_len);
 748
 749         return WLAN_STATUS_SUCCESS;
 750 }
 751
 752
 753 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
 754                            const u8 *ies, size_t ies_len, int reassoc)
 755 {
 756         struct ieee802_11_elems elems;
 757         u16 resp;
 758         const u8 *wpa_ie;
 759         size_t wpa_ie_len;
 760
 761         if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
 762                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 763                                HOSTAPD_LEVEL_INFO, "Station sent an invalid "
 764                                "association request");
 765                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 766         }
 767
 768         resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
 769         if (resp != WLAN_STATUS_SUCCESS)
 770                 return resp;
 771         resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
 772         if (resp != WLAN_STATUS_SUCCESS)
 773                 return resp;
 774         resp = copy_supp_rates(hapd, sta, &elems);
 775         if (resp != WLAN_STATUS_SUCCESS)
 776                 return resp;
 777 #ifdef CONFIG_IEEE80211N
 778         resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities,
 779                                  elems.ht_capabilities_len);
 780         if (resp != WLAN_STATUS_SUCCESS)
 781                 return resp;
 782         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
 783             !(sta->flags & WLAN_STA_HT)) {
 784                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 785                                HOSTAPD_LEVEL_INFO, "Station does not support "
 786                                "mandatory HT PHY - reject association");
 787                 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
 788         }
 789 #endif /* CONFIG_IEEE80211N */
 790
 791 #ifdef CONFIG_IEEE80211AC
 792         resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities,
 793                                   elems.vht_capabilities_len);
 794         if (resp != WLAN_STATUS_SUCCESS)
 795                 return resp;
 796         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
 797             !(sta->flags & WLAN_STA_VHT)) {
 798                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 799                                HOSTAPD_LEVEL_INFO, "Station does not support "
 800                                "mandatory VHT PHY - reject association");
 801                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 802         }
 803 #endif /* CONFIG_IEEE80211AC */
 804
 805         if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
 806                 wpa_ie = elems.rsn_ie;
 807                 wpa_ie_len = elems.rsn_ie_len;
 808         } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
 809                    elems.wpa_ie) {
 810                 wpa_ie = elems.wpa_ie;
 811                 wpa_ie_len = elems.wpa_ie_len;
 812         } else {
 813                 wpa_ie = NULL;
 814                 wpa_ie_len = 0;
 815         }
 816
 817 #ifdef CONFIG_WPS
 818         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
 819         if (hapd->conf->wps_state && elems.wps_ie) {
 820                 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
 821                            "Request - assume WPS is used");
 822                 sta->flags |= WLAN_STA_WPS;
 823                 wpabuf_free(sta->wps_ie);
 824                 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
 825                                                           WPS_IE_VENDOR_TYPE);
 826                 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
 827                         wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
 828                         sta->flags |= WLAN_STA_WPS2;
 829                 }
 830                 wpa_ie = NULL;
 831                 wpa_ie_len = 0;
 832                 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
 833                         wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
 834                                    "(Re)Association Request - reject");
 835                         return WLAN_STATUS_INVALID_IE;
 836                 }
 837         } else if (hapd->conf->wps_state && wpa_ie == NULL) {
 838                 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
 839                            "(Re)Association Request - possible WPS use");
 840                 sta->flags |= WLAN_STA_MAYBE_WPS;
 841         } else
 842 #endif /* CONFIG_WPS */
 843         if (hapd->conf->wpa && wpa_ie == NULL) {
 844                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 845                                HOSTAPD_LEVEL_INFO,
 846                                "No WPA/RSN IE in association request");
 847                 return WLAN_STATUS_INVALID_IE;
 848         }
 849
 850         if (hapd->conf->wpa && wpa_ie) {
 851                 int res;
 852                 wpa_ie -= 2;
 853                 wpa_ie_len += 2;
 854                 if (sta->wpa_sm == NULL)
 855                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 856                                                         sta->addr);
 857                 if (sta->wpa_sm == NULL) {
 858                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
 859                                    "state machine");
 860                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 861                 }
 862                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
 863                                           wpa_ie, wpa_ie_len,
 864                                           elems.mdie, elems.mdie_len);
 865                 if (res == WPA_INVALID_GROUP)
 866                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 867                 else if (res == WPA_INVALID_PAIRWISE)
 868                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
 869                 else if (res == WPA_INVALID_AKMP)
 870                         resp = WLAN_STATUS_AKMP_NOT_VALID;
 871                 else if (res == WPA_ALLOC_FAIL)
 872                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 873 #ifdef CONFIG_IEEE80211W
 874                 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
 875                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
 876                 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
 877                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
 878 #endif /* CONFIG_IEEE80211W */
 879                 else if (res == WPA_INVALID_MDIE)
 880                         resp = WLAN_STATUS_INVALID_MDIE;
 881                 else if (res != WPA_IE_OK)
 882                         resp = WLAN_STATUS_INVALID_IE;
 883                 if (resp != WLAN_STATUS_SUCCESS)
 884                         return resp;
 885 #ifdef CONFIG_IEEE80211W
 886                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 887                     sta->sa_query_count > 0)
 888                         ap_check_sa_query_timeout(hapd, sta);
 889                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 890                     (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
 891                         /*
 892                          * STA has already been associated with MFP and SA
 893                          * Query timeout has not been reached. Reject the
 894                          * association attempt temporarily and start SA Query,
 895                          * if one is not pending.
 896                          */
 897
 898                         if (sta->sa_query_count == 0)
 899                                 ap_sta_start_sa_query(hapd, sta);
 900
 901                         return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
 902                 }
 903
 904                 if (wpa_auth_uses_mfp(sta->wpa_sm))
 905                         sta->flags |= WLAN_STA_MFP;
 906                 else
 907                         sta->flags &= ~WLAN_STA_MFP;
 908 #endif /* CONFIG_IEEE80211W */
 909
 910 #ifdef CONFIG_IEEE80211R
 911                 if (sta->auth_alg == WLAN_AUTH_FT) {
 912                         if (!reassoc) {
 913                                 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
 914                                            "to use association (not "
 915                                            "re-association) with FT auth_alg",
 916                                            MAC2STR(sta->addr));
 917                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 918                         }
 919
 920                         resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
 921                                                        ies_len);
 922                         if (resp != WLAN_STATUS_SUCCESS)
 923                                 return resp;
 924                 }
 925 #endif /* CONFIG_IEEE80211R */
 926
 927 #ifdef CONFIG_SAE
 928                 if (wpa_auth_uses_sae(sta->wpa_sm) &&
 929                     sta->auth_alg != WLAN_AUTH_SAE) {
 930                         wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
 931                                    "SAE AKM after non-SAE auth_alg %u",
 932                                    MAC2STR(sta->addr), sta->auth_alg);
 933                         return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 934                 }
 935 #endif /* CONFIG_SAE */
 936
 937 #ifdef CONFIG_IEEE80211N
 938                 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
 939                     wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
 940                         hostapd_logger(hapd, sta->addr,
 941                                        HOSTAPD_MODULE_IEEE80211,
 942                                        HOSTAPD_LEVEL_INFO,
 943                                        "Station tried to use TKIP with HT "
 944                                        "association");
 945                         return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
 946                 }
 947 #endif /* CONFIG_IEEE80211N */
 948         } else
 949                 wpa_auth_sta_no_wpa(sta->wpa_sm);
 950
 951 #ifdef CONFIG_P2P
 952         if (elems.p2p) {
 953                 wpabuf_free(sta->p2p_ie);
 954                 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
 955                                                           P2P_IE_VENDOR_TYPE);
 956
 957         } else {
 958                 wpabuf_free(sta->p2p_ie);
 959                 sta->p2p_ie = NULL;
 960         }
 961
 962         p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
 963 #endif /* CONFIG_P2P */
 964
 965 #ifdef CONFIG_HS20
 966         wpabuf_free(sta->hs20_ie);
 967         if (elems.hs20 && elems.hs20_len > 4) {
 968                 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
 969                                                  elems.hs20_len - 4);
 970         } else
 971                 sta->hs20_ie = NULL;
 972 #endif /* CONFIG_HS20 */
 973
 974         return WLAN_STATUS_SUCCESS;
 975 }
 976
 977
 978 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
 979                         u16 reason_code)
 980 {
 981         int send_len;
 982         struct ieee80211_mgmt reply;
 983
 984         os_memset(&reply, 0, sizeof(reply));
 985         reply.frame_control =
 986                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
 987         os_memcpy(reply.da, addr, ETH_ALEN);
 988         os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
 989         os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
 990
 991         send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
 992         reply.u.deauth.reason_code = host_to_le16(reason_code);
 993
 994         if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
 995                 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
 996                            strerror(errno));
 997 }
 998
 999
1000 static void send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
1001                             u16 status_code, int reassoc, const u8 *ies,
1002                             size_t ies_len)
1003 {
1004         int send_len;
1005         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
1006         struct ieee80211_mgmt *reply;
1007         u8 *p;
1008
1009         os_memset(buf, 0, sizeof(buf));
1010         reply = (struct ieee80211_mgmt *) buf;
1011         reply->frame_control =
1012                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1013                              (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
1014                               WLAN_FC_STYPE_ASSOC_RESP));
1015         os_memcpy(reply->da, sta->addr, ETH_ALEN);
1016         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
1017         os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
1018
1019         send_len = IEEE80211_HDRLEN;
1020         send_len += sizeof(reply->u.assoc_resp);
1021         reply->u.assoc_resp.capab_info =
1022                 host_to_le16(hostapd_own_capab_info(hapd, sta, 0));
1023         reply->u.assoc_resp.status_code = host_to_le16(status_code);
1024         reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0)
1025                                                | BIT(14) | BIT(15));
1026         /* Supported rates */
1027         p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
1028         /* Extended supported rates */
1029         p = hostapd_eid_ext_supp_rates(hapd, p);
1030
1031 #ifdef CONFIG_IEEE80211R
1032         if (status_code == WLAN_STATUS_SUCCESS) {
1033                 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
1034                  * Transition Information, RSN, [RIC Response] */
1035                 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
1036                                                 buf + sizeof(buf) - p,
1037                                                 sta->auth_alg, ies, ies_len);
1038         }
1039 #endif /* CONFIG_IEEE80211R */
1040
1041 #ifdef CONFIG_IEEE80211W
1042         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
1043                 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
1044 #endif /* CONFIG_IEEE80211W */
1045
1046 #ifdef CONFIG_IEEE80211N
1047         p = hostapd_eid_ht_capabilities(hapd, p);
1048         p = hostapd_eid_ht_operation(hapd, p);
1049 #endif /* CONFIG_IEEE80211N */
1050
1051 #ifdef CONFIG_IEEE80211AC
1052         p = hostapd_eid_vht_capabilities(hapd, p);
1053         p = hostapd_eid_vht_operation(hapd, p);
1054 #endif /* CONFIG_IEEE80211AC */
1055
1056         p = hostapd_eid_ext_capab(hapd, p);
1057         p = hostapd_eid_bss_max_idle_period(hapd, p);
1058
1059         if (sta->flags & WLAN_STA_WMM)
1060                 p = hostapd_eid_wmm(hapd, p);
1061
1062 #ifdef CONFIG_WPS
1063         if ((sta->flags & WLAN_STA_WPS) ||
1064             ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa)) {
1065                 struct wpabuf *wps = wps_build_assoc_resp_ie();
1066                 if (wps) {
1067                         os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
1068                         p += wpabuf_len(wps);
1069                         wpabuf_free(wps);
1070                 }
1071         }
1072 #endif /* CONFIG_WPS */
1073
1074 #ifdef CONFIG_P2P
1075         if (sta->p2p_ie) {
1076                 struct wpabuf *p2p_resp_ie;
1077                 enum p2p_status_code status;
1078                 switch (status_code) {
1079                 case WLAN_STATUS_SUCCESS:
1080                         status = P2P_SC_SUCCESS;
1081                         break;
1082                 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
1083                         status = P2P_SC_FAIL_LIMIT_REACHED;
1084                         break;
1085                 default:
1086                         status = P2P_SC_FAIL_INVALID_PARAMS;
1087                         break;
1088                 }
1089                 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
1090                 if (p2p_resp_ie) {
1091                         os_memcpy(p, wpabuf_head(p2p_resp_ie),
1092                                   wpabuf_len(p2p_resp_ie));
1093                         p += wpabuf_len(p2p_resp_ie);
1094                         wpabuf_free(p2p_resp_ie);
1095                 }
1096         }
1097 #endif /* CONFIG_P2P */
1098
1099 #ifdef CONFIG_P2P_MANAGER
1100         if (hapd->conf->p2p & P2P_MANAGE)
1101                 p = hostapd_eid_p2p_manage(hapd, p);
1102 #endif /* CONFIG_P2P_MANAGER */
1103
1104         send_len += p - reply->u.assoc_resp.variable;
1105
1106         if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0)
1107                 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
1108                            strerror(errno));
1109 }
1110
1111
1112 static void handle_assoc(struct hostapd_data *hapd,
1113                          const struct ieee80211_mgmt *mgmt, size_t len,
1114                          int reassoc)
1115 {
1116         u16 capab_info, listen_interval;
1117         u16 resp = WLAN_STATUS_SUCCESS;
1118         const u8 *pos;
1119         int left, i;
1120         struct sta_info *sta;
1121
1122         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
1123                                       sizeof(mgmt->u.assoc_req))) {
1124                 printf("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
1125                        "\n", reassoc, (unsigned long) len);
1126                 return;
1127         }
1128
1129         if (reassoc) {
1130                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
1131                 listen_interval = le_to_host16(
1132                         mgmt->u.reassoc_req.listen_interval);
1133                 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
1134                            " capab_info=0x%02x listen_interval=%d current_ap="
1135                            MACSTR,
1136                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1137                            MAC2STR(mgmt->u.reassoc_req.current_ap));
1138                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
1139                 pos = mgmt->u.reassoc_req.variable;
1140         } else {
1141                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
1142                 listen_interval = le_to_host16(
1143                         mgmt->u.assoc_req.listen_interval);
1144                 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
1145                            " capab_info=0x%02x listen_interval=%d",
1146                            MAC2STR(mgmt->sa), capab_info, listen_interval);
1147                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
1148                 pos = mgmt->u.assoc_req.variable;
1149         }
1150
1151         sta = ap_get_sta(hapd, mgmt->sa);
1152 #ifdef CONFIG_IEEE80211R
1153         if (sta && sta->auth_alg == WLAN_AUTH_FT &&
1154             (sta->flags & WLAN_STA_AUTH) == 0) {
1155                 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
1156                            "prior to authentication since it is using "
1157                            "over-the-DS FT", MAC2STR(mgmt->sa));
1158         } else
1159 #endif /* CONFIG_IEEE80211R */
1160         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
1161                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1162                                HOSTAPD_LEVEL_INFO, "Station tried to "
1163                                "associate before authentication "
1164                                "(aid=%d flags=0x%x)",
1165                                sta ? sta->aid : -1,
1166                                sta ? sta->flags : 0);
1167                 send_deauth(hapd, mgmt->sa,
1168                             WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
1169                 return;
1170         }
1171
1172         if (hapd->tkip_countermeasures) {
1173                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
1174                 goto fail;
1175         }
1176
1177         if (listen_interval > hapd->conf->max_listen_interval) {
1178                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1179                                HOSTAPD_LEVEL_DEBUG,
1180                                "Too large Listen Interval (%d)",
1181                                listen_interval);
1182                 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
1183                 goto fail;
1184         }
1185
1186         /* followed by SSID and Supported rates; and HT capabilities if 802.11n
1187          * is used */
1188         resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
1189         if (resp != WLAN_STATUS_SUCCESS)
1190                 goto fail;
1191
1192         if (hostapd_get_aid(hapd, sta) < 0) {
1193                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1194                                HOSTAPD_LEVEL_INFO, "No room for more AIDs");
1195                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1196                 goto fail;
1197         }
1198
1199         sta->capability = capab_info;
1200         sta->listen_interval = listen_interval;
1201
1202         if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
1203                 sta->flags |= WLAN_STA_NONERP;
1204         for (i = 0; i < sta->supported_rates_len; i++) {
1205                 if ((sta->supported_rates[i] & 0x7f) > 22) {
1206                         sta->flags &= ~WLAN_STA_NONERP;
1207                         break;
1208                 }
1209         }
1210         if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
1211                 sta->nonerp_set = 1;
1212                 hapd->iface->num_sta_non_erp++;
1213                 if (hapd->iface->num_sta_non_erp == 1)
1214                         ieee802_11_set_beacons(hapd->iface);
1215         }
1216
1217         if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
1218             !sta->no_short_slot_time_set) {
1219                 sta->no_short_slot_time_set = 1;
1220                 hapd->iface->num_sta_no_short_slot_time++;
1221                 if (hapd->iface->current_mode->mode ==
1222                     HOSTAPD_MODE_IEEE80211G &&
1223                     hapd->iface->num_sta_no_short_slot_time == 1)
1224                         ieee802_11_set_beacons(hapd->iface);
1225         }
1226
1227         if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1228                 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
1229         else
1230                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1231
1232         if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
1233             !sta->no_short_preamble_set) {
1234                 sta->no_short_preamble_set = 1;
1235                 hapd->iface->num_sta_no_short_preamble++;
1236                 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
1237                     && hapd->iface->num_sta_no_short_preamble == 1)
1238                         ieee802_11_set_beacons(hapd->iface);
1239         }
1240
1241 #ifdef CONFIG_IEEE80211N
1242         update_ht_state(hapd, sta);
1243 #endif /* CONFIG_IEEE80211N */
1244
1245         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1246                        HOSTAPD_LEVEL_DEBUG,
1247                        "association OK (aid %d)", sta->aid);
1248         /* Station will be marked associated, after it acknowledges AssocResp
1249          */
1250         sta->flags |= WLAN_STA_ASSOC_REQ_OK;
1251
1252 #ifdef CONFIG_IEEE80211W
1253         if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
1254                 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
1255                            "SA Query procedure", reassoc ? "re" : "");
1256                 /* TODO: Send a protected Disassociate frame to the STA using
1257                  * the old key and Reason Code "Previous Authentication no
1258                  * longer valid". Make sure this is only sent protected since
1259                  * unprotected frame would be received by the STA that is now
1260                  * trying to associate.
1261                  */
1262         }
1263 #endif /* CONFIG_IEEE80211W */
1264
1265         if (reassoc) {
1266                 os_memcpy(sta->previous_ap, mgmt->u.reassoc_req.current_ap,
1267                           ETH_ALEN);
1268         }
1269
1270         if (sta->last_assoc_req)
1271                 os_free(sta->last_assoc_req);
1272         sta->last_assoc_req = os_malloc(len);
1273         if (sta->last_assoc_req)
1274                 os_memcpy(sta->last_assoc_req, mgmt, len);
1275
1276         /* Make sure that the previously registered inactivity timer will not
1277          * remove the STA immediately. */
1278         sta->timeout_next = STA_NULLFUNC;
1279
1280  fail:
1281         send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
1282 }
1283
1284
1285 static void handle_disassoc(struct hostapd_data *hapd,
1286                             const struct ieee80211_mgmt *mgmt, size_t len)
1287 {
1288         struct sta_info *sta;
1289
1290         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
1291                 printf("handle_disassoc - too short payload (len=%lu)\n",
1292                        (unsigned long) len);
1293                 return;
1294         }
1295
1296         wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
1297                    MAC2STR(mgmt->sa),
1298                    le_to_host16(mgmt->u.disassoc.reason_code));
1299
1300         sta = ap_get_sta(hapd, mgmt->sa);
1301         if (sta == NULL) {
1302                 printf("Station " MACSTR " trying to disassociate, but it "
1303                        "is not associated.\n", MAC2STR(mgmt->sa));
1304                 return;
1305         }
1306
1307         ap_sta_set_authorized(hapd, sta, 0);
1308         sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
1309         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
1310         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1311                        HOSTAPD_LEVEL_INFO, "disassociated");
1312         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1313         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1314         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
1315          * authenticated. */
1316         accounting_sta_stop(hapd, sta);
1317         ieee802_1x_free_station(sta);
1318         hostapd_drv_sta_remove(hapd, sta->addr);
1319
1320         if (sta->timeout_next == STA_NULLFUNC ||
1321             sta->timeout_next == STA_DISASSOC) {
1322                 sta->timeout_next = STA_DEAUTH;
1323                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1324                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
1325                                        hapd, sta);
1326         }
1327
1328         mlme_disassociate_indication(
1329                 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
1330 }
1331
1332
1333 static void handle_deauth(struct hostapd_data *hapd,
1334                           const struct ieee80211_mgmt *mgmt, size_t len)
1335 {
1336         struct sta_info *sta;
1337
1338         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
1339                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
1340                         "payload (len=%lu)", (unsigned long) len);
1341                 return;
1342         }
1343
1344         wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
1345                 " reason_code=%d",
1346                 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
1347
1348         sta = ap_get_sta(hapd, mgmt->sa);
1349         if (sta == NULL) {
1350                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
1351                         "to deauthenticate, but it is not authenticated",
1352                         MAC2STR(mgmt->sa));
1353                 return;
1354         }
1355
1356         ap_sta_set_authorized(hapd, sta, 0);
1357         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
1358                         WLAN_STA_ASSOC_REQ_OK);
1359         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1360         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1361                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
1362         mlme_deauthenticate_indication(
1363                 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
1364         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1365         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1366         ap_free_sta(hapd, sta);
1367 }
1368
1369
1370 static void handle_beacon(struct hostapd_data *hapd,
1371                           const struct ieee80211_mgmt *mgmt, size_t len,
1372                           struct hostapd_frame_info *fi)
1373 {
1374         struct ieee802_11_elems elems;
1375
1376         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
1377                 printf("handle_beacon - too short payload (len=%lu)\n",
1378                        (unsigned long) len);
1379                 return;
1380         }
1381
1382         (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
1383                                       len - (IEEE80211_HDRLEN +
1384                                              sizeof(mgmt->u.beacon)), &elems,
1385                                       0);
1386
1387         ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
1388 }
1389
1390
1391 #ifdef CONFIG_IEEE80211W
1392
1393 static void hostapd_sa_query_action(struct hostapd_data *hapd,
1394                                     const struct ieee80211_mgmt *mgmt,
1395                                     size_t len)
1396 {
1397         const u8 *end;
1398
1399         end = mgmt->u.action.u.sa_query_resp.trans_id +
1400                 WLAN_SA_QUERY_TR_ID_LEN;
1401         if (((u8 *) mgmt) + len < end) {
1402                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
1403                            "frame (len=%lu)", (unsigned long) len);
1404                 return;
1405         }
1406
1407         ieee802_11_sa_query_action(hapd, mgmt->sa,
1408                                    mgmt->u.action.u.sa_query_resp.action,
1409                                    mgmt->u.action.u.sa_query_resp.trans_id);
1410 }
1411
1412
1413 static int robust_action_frame(u8 category)
1414 {
1415         return category != WLAN_ACTION_PUBLIC &&
1416                 category != WLAN_ACTION_HT;
1417 }
1418 #endif /* CONFIG_IEEE80211W */
1419
1420
1421 static void handle_action(struct hostapd_data *hapd,
1422                           const struct ieee80211_mgmt *mgmt, size_t len)
1423 {
1424 #if defined(CONFIG_IEEE80211W) || defined(CONFIG_IEEE80211R)
1425         struct sta_info *sta;
1426         sta = ap_get_sta(hapd, mgmt->sa);
1427 #endif /* CONFIG_IEEE80211W || CONFIG_IEEE80211R */
1428
1429         if (len < IEEE80211_HDRLEN + 1) {
1430                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1431                                HOSTAPD_LEVEL_DEBUG,
1432                                "handle_action - too short payload (len=%lu)",
1433                                (unsigned long) len);
1434                 return;
1435         }
1436
1437 #ifdef CONFIG_IEEE80211W
1438         if (sta && (sta->flags & WLAN_STA_MFP) &&
1439             !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
1440               robust_action_frame(mgmt->u.action.category))) {
1441                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1442                                HOSTAPD_LEVEL_DEBUG,
1443                                "Dropped unprotected Robust Action frame from "
1444                                "an MFP STA");
1445                 return;
1446         }
1447 #endif /* CONFIG_IEEE80211W */
1448
1449         switch (mgmt->u.action.category) {
1450 #ifdef CONFIG_IEEE80211R
1451         case WLAN_ACTION_FT:
1452         {
1453                 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
1454                         wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored FT Action "
1455                                    "frame from unassociated STA " MACSTR,
1456                                    MAC2STR(mgmt->sa));
1457                         return;
1458                 }
1459
1460                 if (wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
1461                                      len - IEEE80211_HDRLEN))
1462                         break;
1463
1464                 return;
1465         }
1466 #endif /* CONFIG_IEEE80211R */
1467         case WLAN_ACTION_WMM:
1468                 hostapd_wmm_action(hapd, mgmt, len);
1469                 return;
1470 #ifdef CONFIG_IEEE80211W
1471         case WLAN_ACTION_SA_QUERY:
1472                 hostapd_sa_query_action(hapd, mgmt, len);
1473                 return;
1474 #endif /* CONFIG_IEEE80211W */
1475         case WLAN_ACTION_PUBLIC:
1476                 if (hapd->public_action_cb) {
1477                         hapd->public_action_cb(hapd->public_action_cb_ctx,
1478                                                (u8 *) mgmt, len,
1479                                                hapd->iface->freq);
1480                         return;
1481                 }
1482                 break;
1483         case WLAN_ACTION_VENDOR_SPECIFIC:
1484                 if (hapd->vendor_action_cb) {
1485                         if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
1486                                                    (u8 *) mgmt, len,
1487                                                    hapd->iface->freq) == 0)
1488                                 return;
1489                 }
1490                 break;
1491         }
1492
1493         hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1494                        HOSTAPD_LEVEL_DEBUG,
1495                        "handle_action - unknown action category %d or invalid "
1496                        "frame",
1497                        mgmt->u.action.category);
1498         if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
1499             !(mgmt->sa[0] & 0x01)) {
1500                 struct ieee80211_mgmt *resp;
1501
1502                 /*
1503                  * IEEE 802.11-REVma/D9.0 - 7.3.1.11
1504                  * Return the Action frame to the source without change
1505                  * except that MSB of the Category set to 1.
1506                  */
1507                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
1508                            "frame back to sender");
1509                 resp = os_malloc(len);
1510                 if (resp == NULL)
1511                         return;
1512                 os_memcpy(resp, mgmt, len);
1513                 os_memcpy(resp->da, resp->sa, ETH_ALEN);
1514                 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
1515                 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
1516                 resp->u.action.category |= 0x80;
1517
1518                 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
1519                         wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
1520                                    "Action frame");
1521                 }
1522                 os_free(resp);
1523         }
1524 }
1525
1526
1527 /**
1528  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
1529  * @hapd: hostapd BSS data structure (the BSS to which the management frame was
1530  * sent to)
1531  * @buf: management frame data (starting from IEEE 802.11 header)
1532  * @len: length of frame data in octets
1533  * @fi: meta data about received frame (signal level, etc.)
1534  *
1535  * Process all incoming IEEE 802.11 management frames. This will be called for
1536  * each frame received from the kernel driver through wlan#ap interface. In
1537  * addition, it can be called to re-inserted pending frames (e.g., when using
1538  * external RADIUS server as an MAC ACL).
1539  */
1540 void ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
1541                      struct hostapd_frame_info *fi)
1542 {
1543         struct ieee80211_mgmt *mgmt;
1544         int broadcast;
1545         u16 fc, stype;
1546
1547         if (len < 24)
1548                 return;
1549
1550         mgmt = (struct ieee80211_mgmt *) buf;
1551         fc = le_to_host16(mgmt->frame_control);
1552         stype = WLAN_FC_GET_STYPE(fc);
1553
1554         if (stype == WLAN_FC_STYPE_BEACON) {
1555                 handle_beacon(hapd, mgmt, len, fi);
1556                 return;
1557         }
1558
1559         broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
1560                 mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
1561                 mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
1562
1563         if (!broadcast &&
1564 #ifdef CONFIG_P2P
1565             /* Invitation responses can be sent with the peer MAC as BSSID */
1566             !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
1567               stype == WLAN_FC_STYPE_ACTION) &&
1568 #endif /* CONFIG_P2P */
1569             os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
1570                 printf("MGMT: BSSID=" MACSTR " not our address\n",
1571                        MAC2STR(mgmt->bssid));
1572                 return;
1573         }
1574
1575
1576         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
1577                 handle_probe_req(hapd, mgmt, len, fi->ssi_signal);
1578                 return;
1579         }
1580
1581         if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
1582                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1583                                HOSTAPD_LEVEL_DEBUG,
1584                                "MGMT: DA=" MACSTR " not our address",
1585                                MAC2STR(mgmt->da));
1586                 return;
1587         }
1588
1589         switch (stype) {
1590         case WLAN_FC_STYPE_AUTH:
1591                 wpa_printf(MSG_DEBUG, "mgmt::auth");
1592                 handle_auth(hapd, mgmt, len);
1593                 break;
1594         case WLAN_FC_STYPE_ASSOC_REQ:
1595                 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
1596                 handle_assoc(hapd, mgmt, len, 0);
1597                 break;
1598         case WLAN_FC_STYPE_REASSOC_REQ:
1599                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
1600                 handle_assoc(hapd, mgmt, len, 1);
1601                 break;
1602         case WLAN_FC_STYPE_DISASSOC:
1603                 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
1604                 handle_disassoc(hapd, mgmt, len);
1605                 break;
1606         case WLAN_FC_STYPE_DEAUTH:
1607                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
1608                 handle_deauth(hapd, mgmt, len);
1609                 break;
1610         case WLAN_FC_STYPE_ACTION:
1611                 wpa_printf(MSG_DEBUG, "mgmt::action");
1612                 handle_action(hapd, mgmt, len);
1613                 break;
1614         default:
1615                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1616                                HOSTAPD_LEVEL_DEBUG,
1617                                "unknown mgmt frame subtype %d", stype);
1618                 break;
1619         }
1620 }
1621
1622
1623 static void handle_auth_cb(struct hostapd_data *hapd,
1624                            const struct ieee80211_mgmt *mgmt,
1625                            size_t len, int ok)
1626 {
1627         u16 auth_alg, auth_transaction, status_code;
1628         struct sta_info *sta;
1629
1630         if (!ok) {
1631                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1632                                HOSTAPD_LEVEL_NOTICE,
1633                                "did not acknowledge authentication response");
1634                 return;
1635         }
1636
1637         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1638                 printf("handle_auth_cb - too short payload (len=%lu)\n",
1639                        (unsigned long) len);
1640                 return;
1641         }
1642
1643         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1644         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1645         status_code = le_to_host16(mgmt->u.auth.status_code);
1646
1647         sta = ap_get_sta(hapd, mgmt->da);
1648         if (!sta) {
1649                 printf("handle_auth_cb: STA " MACSTR " not found\n",
1650                        MAC2STR(mgmt->da));
1651                 return;
1652         }
1653
1654         if (status_code == WLAN_STATUS_SUCCESS &&
1655             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
1656              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
1657                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1658                                HOSTAPD_LEVEL_INFO, "authenticated");
1659                 sta->flags |= WLAN_STA_AUTH;
1660         }
1661 }
1662
1663
1664 static void handle_assoc_cb(struct hostapd_data *hapd,
1665                             const struct ieee80211_mgmt *mgmt,
1666                             size_t len, int reassoc, int ok)
1667 {
1668         u16 status;
1669         struct sta_info *sta;
1670         int new_assoc = 1;
1671         struct ieee80211_ht_capabilities ht_cap;
1672
1673         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
1674                                       sizeof(mgmt->u.assoc_resp))) {
1675                 printf("handle_assoc_cb(reassoc=%d) - too short payload "
1676                        "(len=%lu)\n", reassoc, (unsigned long) len);
1677                 return;
1678         }
1679
1680         sta = ap_get_sta(hapd, mgmt->da);
1681         if (!sta) {
1682                 printf("handle_assoc_cb: STA " MACSTR " not found\n",
1683                        MAC2STR(mgmt->da));
1684                 return;
1685         }
1686
1687         if (!ok) {
1688                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1689                                HOSTAPD_LEVEL_DEBUG,
1690                                "did not acknowledge association response");
1691                 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
1692                 return;
1693         }
1694
1695         if (reassoc)
1696                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
1697         else
1698                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
1699
1700         if (status != WLAN_STATUS_SUCCESS)
1701                 goto fail;
1702
1703         /* Stop previous accounting session, if one is started, and allocate
1704          * new session id for the new session. */
1705         accounting_sta_stop(hapd, sta);
1706
1707         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1708                        HOSTAPD_LEVEL_INFO,
1709                        "associated (aid %d)",
1710                        sta->aid);
1711
1712         if (sta->flags & WLAN_STA_ASSOC)
1713                 new_assoc = 0;
1714         sta->flags |= WLAN_STA_ASSOC;
1715         if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa) ||
1716             sta->auth_alg == WLAN_AUTH_FT) {
1717                 /*
1718                  * Open, static WEP, or FT protocol; no separate authorization
1719                  * step.
1720                  */
1721                 ap_sta_set_authorized(hapd, sta, 1);
1722         }
1723
1724         if (reassoc)
1725                 mlme_reassociate_indication(hapd, sta);
1726         else
1727                 mlme_associate_indication(hapd, sta);
1728
1729 #ifdef CONFIG_IEEE80211W
1730         sta->sa_query_timed_out = 0;
1731 #endif /* CONFIG_IEEE80211W */
1732
1733         /*
1734          * Remove the STA entry in order to make sure the STA PS state gets
1735          * cleared and configuration gets updated in case of reassociation back
1736          * to the same AP.
1737          */
1738         hostapd_drv_sta_remove(hapd, sta->addr);
1739
1740 #ifdef CONFIG_IEEE80211N
1741         if (sta->flags & WLAN_STA_HT)
1742                 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
1743 #endif /* CONFIG_IEEE80211N */
1744
1745         if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
1746                             sta->supported_rates, sta->supported_rates_len,
1747                             sta->listen_interval,
1748                             sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
1749                             sta->flags, sta->qosinfo)) {
1750                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1751                                HOSTAPD_LEVEL_NOTICE,
1752                                "Could not add STA to kernel driver");
1753
1754                 ap_sta_disconnect(hapd, sta, sta->addr,
1755                                   WLAN_REASON_DISASSOC_AP_BUSY);
1756
1757                 goto fail;
1758         }
1759
1760         if (sta->flags & WLAN_STA_WDS)
1761                 hostapd_set_wds_sta(hapd, sta->addr, sta->aid, 1);
1762
1763         if (sta->eapol_sm == NULL) {
1764                 /*
1765                  * This STA does not use RADIUS server for EAP authentication,
1766                  * so bind it to the selected VLAN interface now, since the
1767                  * interface selection is not going to change anymore.
1768                  */
1769                 if (ap_sta_bind_vlan(hapd, sta, 0) < 0)
1770                         goto fail;
1771         } else if (sta->vlan_id) {
1772                 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
1773                 if (ap_sta_bind_vlan(hapd, sta, 0) < 0)
1774                         goto fail;
1775         }
1776
1777         hostapd_set_sta_flags(hapd, sta);
1778
1779         if (sta->auth_alg == WLAN_AUTH_FT)
1780                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
1781         else
1782                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
1783         hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
1784
1785         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
1786
1787  fail:
1788         /* Copy of the association request is not needed anymore */
1789         if (sta->last_assoc_req) {
1790                 os_free(sta->last_assoc_req);
1791                 sta->last_assoc_req = NULL;
1792         }
1793 }
1794
1795
1796 static void handle_deauth_cb(struct hostapd_data *hapd,
1797                              const struct ieee80211_mgmt *mgmt,
1798                              size_t len, int ok)
1799 {
1800         struct sta_info *sta;
1801         if (mgmt->da[0] & 0x01)
1802                 return;
1803         sta = ap_get_sta(hapd, mgmt->da);
1804         if (!sta) {
1805                 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
1806                            " not found", MAC2STR(mgmt->da));
1807                 return;
1808         }
1809         if (ok)
1810                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
1811                            MAC2STR(sta->addr));
1812         else
1813                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
1814                            "deauth", MAC2STR(sta->addr));
1815
1816         ap_sta_deauth_cb(hapd, sta);
1817 }
1818
1819
1820 static void handle_disassoc_cb(struct hostapd_data *hapd,
1821                                const struct ieee80211_mgmt *mgmt,
1822                                size_t len, int ok)
1823 {
1824         struct sta_info *sta;
1825         if (mgmt->da[0] & 0x01)
1826                 return;
1827         sta = ap_get_sta(hapd, mgmt->da);
1828         if (!sta) {
1829                 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
1830                            " not found", MAC2STR(mgmt->da));
1831                 return;
1832         }
1833         if (ok)
1834                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
1835                            MAC2STR(sta->addr));
1836         else
1837                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
1838                            "disassoc", MAC2STR(sta->addr));
1839
1840         ap_sta_disassoc_cb(hapd, sta);
1841 }
1842
1843
1844 /**
1845  * ieee802_11_mgmt_cb - Process management frame TX status callback
1846  * @hapd: hostapd BSS data structure (the BSS from which the management frame
1847  * was sent from)
1848  * @buf: management frame data (starting from IEEE 802.11 header)
1849  * @len: length of frame data in octets
1850  * @stype: management frame subtype from frame control field
1851  * @ok: Whether the frame was ACK'ed
1852  */
1853 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
1854                         u16 stype, int ok)
1855 {
1856         const struct ieee80211_mgmt *mgmt;
1857         mgmt = (const struct ieee80211_mgmt *) buf;
1858
1859         switch (stype) {
1860         case WLAN_FC_STYPE_AUTH:
1861                 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
1862                 handle_auth_cb(hapd, mgmt, len, ok);
1863                 break;
1864         case WLAN_FC_STYPE_ASSOC_RESP:
1865                 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
1866                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
1867                 break;
1868         case WLAN_FC_STYPE_REASSOC_RESP:
1869                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
1870                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
1871                 break;
1872         case WLAN_FC_STYPE_PROBE_RESP:
1873                 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb");
1874                 break;
1875         case WLAN_FC_STYPE_DEAUTH:
1876                 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
1877                 handle_deauth_cb(hapd, mgmt, len, ok);
1878                 break;
1879         case WLAN_FC_STYPE_DISASSOC:
1880                 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
1881                 handle_disassoc_cb(hapd, mgmt, len, ok);
1882                 break;
1883         case WLAN_FC_STYPE_ACTION:
1884                 wpa_printf(MSG_DEBUG, "mgmt::action cb");
1885                 break;
1886         default:
1887                 printf("unknown mgmt cb frame subtype %d\n", stype);
1888                 break;
1889         }
1890 }
1891
1892
1893 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1894 {
1895         /* TODO */
1896         return 0;
1897 }
1898
1899
1900 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1901                            char *buf, size_t buflen)
1902 {
1903         /* TODO */
1904         return 0;
1905 }
1906
1907
1908 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
1909                        const u8 *buf, size_t len, int ack)
1910 {
1911         struct sta_info *sta;
1912         struct hostapd_iface *iface = hapd->iface;
1913
1914         sta = ap_get_sta(hapd, addr);
1915         if (sta == NULL && iface->num_bss > 1) {
1916                 size_t j;
1917                 for (j = 0; j < iface->num_bss; j++) {
1918                         hapd = iface->bss[j];
1919                         sta = ap_get_sta(hapd, addr);
1920                         if (sta)
1921                                 break;
1922                 }
1923         }
1924         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
1925                 return;
1926         if (sta->flags & WLAN_STA_PENDING_POLL) {
1927                 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
1928                            "activity poll", MAC2STR(sta->addr),
1929                            ack ? "ACKed" : "did not ACK");
1930                 if (ack)
1931                         sta->flags &= ~WLAN_STA_PENDING_POLL;
1932         }
1933
1934         ieee802_1x_tx_status(hapd, sta, buf, len, ack);
1935 }
1936
1937
1938 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
1939                              const u8 *data, size_t len, int ack)
1940 {
1941         struct sta_info *sta;
1942         struct hostapd_iface *iface = hapd->iface;
1943
1944         sta = ap_get_sta(hapd, dst);
1945         if (sta == NULL && iface->num_bss > 1) {
1946                 size_t j;
1947                 for (j = 0; j < iface->num_bss; j++) {
1948                         hapd = iface->bss[j];
1949                         sta = ap_get_sta(hapd, dst);
1950                         if (sta)
1951                                 break;
1952                 }
1953         }
1954         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
1955                 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
1956                            MACSTR " that is not currently associated",
1957                            MAC2STR(dst));
1958                 return;
1959         }
1960
1961         ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
1962 }
1963
1964
1965 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
1966 {
1967         struct sta_info *sta;
1968         struct hostapd_iface *iface = hapd->iface;
1969
1970         sta = ap_get_sta(hapd, addr);
1971         if (sta == NULL && iface->num_bss > 1) {
1972                 size_t j;
1973                 for (j = 0; j < iface->num_bss; j++) {
1974                         hapd = iface->bss[j];
1975                         sta = ap_get_sta(hapd, addr);
1976                         if (sta)
1977                                 break;
1978                 }
1979         }
1980         if (sta == NULL)
1981                 return;
1982         if (!(sta->flags & WLAN_STA_PENDING_POLL))
1983                 return;
1984
1985         wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
1986                    "activity poll", MAC2STR(sta->addr));
1987         sta->flags &= ~WLAN_STA_PENDING_POLL;
1988 }
1989
1990
1991 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
1992                                 int wds)
1993 {
1994         struct sta_info *sta;
1995
1996         sta = ap_get_sta(hapd, src);
1997         if (sta && (sta->flags & WLAN_STA_ASSOC)) {
1998                 if (!hapd->conf->wds_sta)
1999                         return;
2000
2001                 if (wds && !(sta->flags & WLAN_STA_WDS)) {
2002                         wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
2003                                    "STA " MACSTR " (aid %u)",
2004                                    MAC2STR(sta->addr), sta->aid);
2005                         sta->flags |= WLAN_STA_WDS;
2006                         hostapd_set_wds_sta(hapd, sta->addr, sta->aid, 1);
2007                 }
2008                 return;
2009         }
2010
2011         wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
2012                    MACSTR, MAC2STR(src));
2013         if (src[0] & 0x01) {
2014                 /* Broadcast bit set in SA?! Ignore the frame silently. */
2015                 return;
2016         }
2017
2018         if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
2019                 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
2020                            "already been sent, but no TX status yet known - "
2021                            "ignore Class 3 frame issue with " MACSTR,
2022                            MAC2STR(src));
2023                 return;
2024         }
2025
2026         if (sta && (sta->flags & WLAN_STA_AUTH))
2027                 hostapd_drv_sta_disassoc(
2028                         hapd, src,
2029                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
2030         else
2031                 hostapd_drv_sta_deauth(
2032                         hapd, src,
2033                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
2034 }
2035
2036
2037 #endif /* CONFIG_NATIVE_WINDOWS */