src/ap/ieee802_11.c

   1 /*
   2  * hostapd / IEEE 802.11 Management
   3  * Copyright (c) 2002-2013, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #ifndef CONFIG_NATIVE_WINDOWS
  12
  13 #include "utils/common.h"
  14 #include "utils/eloop.h"
  15 #include "crypto/crypto.h"
  16 #include "crypto/sha256.h"
  17 #include "crypto/random.h"
  18 #include "common/ieee802_11_defs.h"
  19 #include "common/ieee802_11_common.h"
  20 #include "common/wpa_ctrl.h"
  21 #include "common/sae.h"
  22 #include "radius/radius.h"
  23 #include "radius/radius_client.h"
  24 #include "p2p/p2p.h"
  25 #include "wps/wps.h"
  26 #include "hostapd.h"
  27 #include "beacon.h"
  28 #include "ieee802_11_auth.h"
  29 #include "sta_info.h"
  30 #include "ieee802_1x.h"
  31 #include "wpa_auth.h"
  32 #include "wmm.h"
  33 #include "ap_list.h"
  34 #include "accounting.h"
  35 #include "ap_config.h"
  36 #include "ap_mlme.h"
  37 #include "p2p_hostapd.h"
  38 #include "ap_drv_ops.h"
  39 #include "wnm_ap.h"
  40 #include "ieee802_11.h"
  41
  42
  43 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
  44 {
  45         u8 *pos = eid;
  46         int i, num, count;
  47
  48         if (hapd->iface->current_rates == NULL)
  49                 return eid;
  50
  51         *pos++ = WLAN_EID_SUPP_RATES;
  52         num = hapd->iface->num_rates;
  53         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
  54                 num++;
  55         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
  56                 num++;
  57         if (num > 8) {
  58                 /* rest of the rates are encoded in Extended supported
  59                  * rates element */
  60                 num = 8;
  61         }
  62
  63         *pos++ = num;
  64         count = 0;
  65         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
  66              i++) {
  67                 count++;
  68                 *pos = hapd->iface->current_rates[i].rate / 5;
  69                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  70                         *pos |= 0x80;
  71                 pos++;
  72         }
  73
  74         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
  75                 count++;
  76                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
  77         }
  78
  79         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
  80                 count++;
  81                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
  82         }
  83
  84         return pos;
  85 }
  86
  87
  88 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
  89 {
  90         u8 *pos = eid;
  91         int i, num, count;
  92
  93         if (hapd->iface->current_rates == NULL)
  94                 return eid;
  95
  96         num = hapd->iface->num_rates;
  97         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
  98                 num++;
  99         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
 100                 num++;
 101         if (num <= 8)
 102                 return eid;
 103         num -= 8;
 104
 105         *pos++ = WLAN_EID_EXT_SUPP_RATES;
 106         *pos++ = num;
 107         count = 0;
 108         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
 109              i++) {
 110                 count++;
 111                 if (count <= 8)
 112                         continue; /* already in SuppRates IE */
 113                 *pos = hapd->iface->current_rates[i].rate / 5;
 114                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
 115                         *pos |= 0x80;
 116                 pos++;
 117         }
 118
 119         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
 120                 count++;
 121                 if (count > 8)
 122                         *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
 123         }
 124
 125         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
 126                 count++;
 127                 if (count > 8)
 128                         *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
 129         }
 130
 131         return pos;
 132 }
 133
 134
 135 u16 hostapd_own_capab_info(struct hostapd_data *hapd, struct sta_info *sta,
 136                            int probe)
 137 {
 138         int capab = WLAN_CAPABILITY_ESS;
 139         int privacy;
 140
 141         if (hapd->iface->num_sta_no_short_preamble == 0 &&
 142             hapd->iconf->preamble == SHORT_PREAMBLE)
 143                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 144
 145         privacy = hapd->conf->ssid.wep.keys_set;
 146
 147         if (hapd->conf->ieee802_1x &&
 148             (hapd->conf->default_wep_key_len ||
 149              hapd->conf->individual_wep_key_len))
 150                 privacy = 1;
 151
 152         if (hapd->conf->wpa)
 153                 privacy = 1;
 154
 155         if (sta) {
 156                 int policy, def_klen;
 157                 if (probe && sta->ssid_probe) {
 158                         policy = sta->ssid_probe->security_policy;
 159                         def_klen = sta->ssid_probe->wep.default_len;
 160                 } else {
 161                         policy = sta->ssid->security_policy;
 162                         def_klen = sta->ssid->wep.default_len;
 163                 }
 164                 privacy = policy != SECURITY_PLAINTEXT;
 165                 if (policy == SECURITY_IEEE_802_1X && def_klen == 0)
 166                         privacy = 0;
 167         }
 168
 169         if (privacy)
 170                 capab |= WLAN_CAPABILITY_PRIVACY;
 171
 172         if (hapd->iface->current_mode &&
 173             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
 174             hapd->iface->num_sta_no_short_slot_time == 0)
 175                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 176
 177         return capab;
 178 }
 179
 180
 181 void ieee802_11_print_ssid(char *buf, const u8 *ssid, u8 len)
 182 {
 183         int i;
 184         if (len > HOSTAPD_MAX_SSID_LEN)
 185                 len = HOSTAPD_MAX_SSID_LEN;
 186         for (i = 0; i < len; i++) {
 187                 if (ssid[i] >= 32 && ssid[i] < 127)
 188                         buf[i] = ssid[i];
 189                 else
 190                         buf[i] = '.';
 191         }
 192         buf[len] = '\0';
 193 }
 194
 195
 196 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
 197                            u16 auth_transaction, const u8 *challenge,
 198                            int iswep)
 199 {
 200         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 201                        HOSTAPD_LEVEL_DEBUG,
 202                        "authentication (shared key, transaction %d)",
 203                        auth_transaction);
 204
 205         if (auth_transaction == 1) {
 206                 if (!sta->challenge) {
 207                         /* Generate a pseudo-random challenge */
 208                         u8 key[8];
 209                         struct os_time now;
 210                         int r;
 211                         sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
 212                         if (sta->challenge == NULL)
 213                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 214
 215                         os_get_time(&now);
 216                         r = os_random();
 217                         os_memcpy(key, &now.sec, 4);
 218                         os_memcpy(key + 4, &r, 4);
 219                         rc4_skip(key, sizeof(key), 0,
 220                                  sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
 221                 }
 222                 return 0;
 223         }
 224
 225         if (auth_transaction != 3)
 226                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 227
 228         /* Transaction 3 */
 229         if (!iswep || !sta->challenge || !challenge ||
 230             os_memcmp(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) {
 231                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 232                                HOSTAPD_LEVEL_INFO,
 233                                "shared key authentication - invalid "
 234                                "challenge-response");
 235                 return WLAN_STATUS_CHALLENGE_FAIL;
 236         }
 237
 238         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 239                        HOSTAPD_LEVEL_DEBUG,
 240                        "authentication OK (shared key)");
 241 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 242         /* Station will be marked authenticated if it ACKs the
 243          * authentication reply. */
 244 #else
 245         sta->flags |= WLAN_STA_AUTH;
 246         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 247 #endif
 248         os_free(sta->challenge);
 249         sta->challenge = NULL;
 250
 251         return 0;
 252 }
 253
 254
 255 static void send_auth_reply(struct hostapd_data *hapd,
 256                             const u8 *dst, const u8 *bssid,
 257                             u16 auth_alg, u16 auth_transaction, u16 resp,
 258                             const u8 *ies, size_t ies_len)
 259 {
 260         struct ieee80211_mgmt *reply;
 261         u8 *buf;
 262         size_t rlen;
 263
 264         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
 265         buf = os_zalloc(rlen);
 266         if (buf == NULL)
 267                 return;
 268
 269         reply = (struct ieee80211_mgmt *) buf;
 270         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 271                                             WLAN_FC_STYPE_AUTH);
 272         os_memcpy(reply->da, dst, ETH_ALEN);
 273         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 274         os_memcpy(reply->bssid, bssid, ETH_ALEN);
 275
 276         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 277         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 278         reply->u.auth.status_code = host_to_le16(resp);
 279
 280         if (ies && ies_len)
 281                 os_memcpy(reply->u.auth.variable, ies, ies_len);
 282
 283         wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
 284                    " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
 285                    MAC2STR(dst), auth_alg, auth_transaction,
 286                    resp, (unsigned long) ies_len);
 287         if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
 288                 wpa_printf(MSG_INFO, "send_auth_reply: send");
 289
 290         os_free(buf);
 291 }
 292
 293
 294 #ifdef CONFIG_IEEE80211R
 295 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
 296                                   u16 auth_transaction, u16 status,
 297                                   const u8 *ies, size_t ies_len)
 298 {
 299         struct hostapd_data *hapd = ctx;
 300         struct sta_info *sta;
 301
 302         send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT, auth_transaction,
 303                         status, ies, ies_len);
 304
 305         if (status != WLAN_STATUS_SUCCESS)
 306                 return;
 307
 308         sta = ap_get_sta(hapd, dst);
 309         if (sta == NULL)
 310                 return;
 311
 312         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 313                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 314         sta->flags |= WLAN_STA_AUTH;
 315         mlme_authenticate_indication(hapd, sta);
 316 }
 317 #endif /* CONFIG_IEEE80211R */
 318
 319
 320 #ifdef CONFIG_SAE
 321
 322 static struct wpabuf * auth_process_sae_commit(struct hostapd_data *hapd,
 323                                                struct sta_info *sta)
 324 {
 325         struct wpabuf *buf;
 326
 327         if (hapd->conf->ssid.wpa_passphrase == NULL) {
 328                 wpa_printf(MSG_DEBUG, "SAE: No password available");
 329                 return NULL;
 330         }
 331
 332         if (sae_prepare_commit(hapd->own_addr, sta->addr,
 333                                (u8 *) hapd->conf->ssid.wpa_passphrase,
 334                                os_strlen(hapd->conf->ssid.wpa_passphrase),
 335                                sta->sae) < 0) {
 336                 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
 337                 return NULL;
 338         }
 339
 340         if (sae_process_commit(sta->sae) < 0) {
 341                 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer commit");
 342                 return NULL;
 343         }
 344
 345         buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN);
 346         if (buf == NULL)
 347                 return NULL;
 348         sae_write_commit(sta->sae, buf, NULL);
 349
 350         return buf;
 351 }
 352
 353
 354 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
 355                                               struct sta_info *sta)
 356 {
 357         struct wpabuf *buf;
 358
 359         buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
 360         if (buf == NULL)
 361                 return NULL;
 362
 363         sae_write_confirm(sta->sae, buf);
 364
 365         return buf;
 366 }
 367
 368
 369 static int use_sae_anti_clogging(struct hostapd_data *hapd)
 370 {
 371         struct sta_info *sta;
 372         unsigned int open = 0;
 373
 374         if (hapd->conf->sae_anti_clogging_threshold == 0)
 375                 return 1;
 376
 377         for (sta = hapd->sta_list; sta; sta = sta->next) {
 378                 if (!sta->sae)
 379                         continue;
 380                 if (sta->sae->state != SAE_COMMITTED &&
 381                     sta->sae->state != SAE_CONFIRMED)
 382                         continue;
 383                 open++;
 384                 if (open >= hapd->conf->sae_anti_clogging_threshold)
 385                         return 1;
 386         }
 387
 388         return 0;
 389 }
 390
 391
 392 static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
 393                            const u8 *token, size_t token_len)
 394 {
 395         u8 mac[SHA256_MAC_LEN];
 396
 397         if (token_len != SHA256_MAC_LEN)
 398                 return -1;
 399         if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
 400                         addr, ETH_ALEN, mac) < 0 ||
 401             os_memcmp(token, mac, SHA256_MAC_LEN) != 0)
 402                 return -1;
 403
 404         return 0;
 405 }
 406
 407
 408 static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
 409                                             const u8 *addr)
 410 {
 411         struct wpabuf *buf;
 412         u8 *token;
 413         struct os_reltime now;
 414
 415         os_get_reltime(&now);
 416         if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
 417             os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) {
 418                 if (random_get_bytes(hapd->sae_token_key,
 419                                      sizeof(hapd->sae_token_key)) < 0)
 420                         return NULL;
 421                 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
 422                             hapd->sae_token_key, sizeof(hapd->sae_token_key));
 423                 hapd->last_sae_token_key_update = now;
 424         }
 425
 426         buf = wpabuf_alloc(SHA256_MAC_LEN);
 427         if (buf == NULL)
 428                 return NULL;
 429
 430         token = wpabuf_put(buf, SHA256_MAC_LEN);
 431         hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
 432                     addr, ETH_ALEN, token);
 433
 434         return buf;
 435 }
 436
 437
 438 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
 439                             const struct ieee80211_mgmt *mgmt, size_t len,
 440                             u8 auth_transaction)
 441 {
 442         u16 resp = WLAN_STATUS_SUCCESS;
 443         struct wpabuf *data = NULL;
 444
 445         if (!sta->sae) {
 446                 if (auth_transaction != 1)
 447                         return;
 448                 sta->sae = os_zalloc(sizeof(*sta->sae));
 449                 if (sta->sae == NULL)
 450                         return;
 451                 sta->sae->state = SAE_NOTHING;
 452         }
 453
 454         if (auth_transaction == 1) {
 455                 const u8 *token = NULL;
 456                 size_t token_len = 0;
 457                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 458                                HOSTAPD_LEVEL_DEBUG,
 459                                "start SAE authentication (RX commit)");
 460                 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
 461                                         ((const u8 *) mgmt) + len -
 462                                         mgmt->u.auth.variable, &token,
 463                                         &token_len, hapd->conf->sae_groups);
 464                 if (token && check_sae_token(hapd, sta->addr, token, token_len)
 465                     < 0) {
 466                         wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
 467                                    "incorrect token from " MACSTR,
 468                                    MAC2STR(sta->addr));
 469                         return;
 470                 }
 471
 472                 if (resp == WLAN_STATUS_SUCCESS) {
 473                         if (!token && use_sae_anti_clogging(hapd)) {
 474                                 wpa_printf(MSG_DEBUG, "SAE: Request anti-"
 475                                            "clogging token from " MACSTR,
 476                                            MAC2STR(sta->addr));
 477                                 data = auth_build_token_req(hapd, sta->addr);
 478                                 resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
 479                         } else {
 480                                 data = auth_process_sae_commit(hapd, sta);
 481                                 if (data == NULL)
 482                                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 483                                 else
 484                                         sta->sae->state = SAE_COMMITTED;
 485                         }
 486                 }
 487         } else if (auth_transaction == 2) {
 488                 if (sta->sae->state != SAE_COMMITTED) {
 489                         hostapd_logger(hapd, sta->addr,
 490                                        HOSTAPD_MODULE_IEEE80211,
 491                                        HOSTAPD_LEVEL_DEBUG,
 492                                        "SAE confirm before commit");
 493                         resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 494                 }
 495                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 496                                HOSTAPD_LEVEL_DEBUG,
 497                                "SAE authentication (RX confirm)");
 498                 if (sae_check_confirm(sta->sae, mgmt->u.auth.variable,
 499                                        ((u8 *) mgmt) + len -
 500                                        mgmt->u.auth.variable) < 0) {
 501                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 502                 } else {
 503                         resp = WLAN_STATUS_SUCCESS;
 504                         sta->flags |= WLAN_STA_AUTH;
 505                         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 506                         sta->auth_alg = WLAN_AUTH_SAE;
 507                         mlme_authenticate_indication(hapd, sta);
 508
 509                         data = auth_build_sae_confirm(hapd, sta);
 510                         if (data == NULL)
 511                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 512                         else {
 513                                 sta->sae->state = SAE_ACCEPTED;
 514                                 sae_clear_temp_data(sta->sae);
 515                         }
 516                 }
 517         } else {
 518                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 519                                HOSTAPD_LEVEL_DEBUG,
 520                                "unexpected SAE authentication transaction %u",
 521                                auth_transaction);
 522                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 523         }
 524
 525         sta->auth_alg = WLAN_AUTH_SAE;
 526
 527         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
 528                         auth_transaction, resp,
 529                         data ? wpabuf_head(data) : (u8 *) "",
 530                         data ? wpabuf_len(data) : 0);
 531         wpabuf_free(data);
 532 }
 533 #endif /* CONFIG_SAE */
 534
 535
 536 static void handle_auth(struct hostapd_data *hapd,
 537                         const struct ieee80211_mgmt *mgmt, size_t len)
 538 {
 539         u16 auth_alg, auth_transaction, status_code;
 540         u16 resp = WLAN_STATUS_SUCCESS;
 541         struct sta_info *sta = NULL;
 542         int res;
 543         u16 fc;
 544         const u8 *challenge = NULL;
 545         u32 session_timeout, acct_interim_interval;
 546         int vlan_id = 0;
 547         struct hostapd_sta_wpa_psk_short *psk = NULL;
 548         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 549         size_t resp_ies_len = 0;
 550         char *identity = NULL;
 551         char *radius_cui = NULL;
 552
 553         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 554                 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
 555                            (unsigned long) len);
 556                 return;
 557         }
 558
 559 #ifdef CONFIG_TESTING_OPTIONS
 560         if (hapd->iconf->ignore_auth_probability > 0.0d &&
 561             drand48() < hapd->iconf->ignore_auth_probability) {
 562                 wpa_printf(MSG_INFO,
 563                            "TESTING: ignoring auth frame from " MACSTR,
 564                            MAC2STR(mgmt->sa));
 565                 return;
 566         }
 567 #endif /* CONFIG_TESTING_OPTIONS */
 568
 569         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 570         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 571         status_code = le_to_host16(mgmt->u.auth.status_code);
 572         fc = le_to_host16(mgmt->frame_control);
 573
 574         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 575             2 + WLAN_AUTH_CHALLENGE_LEN &&
 576             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 577             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 578                 challenge = &mgmt->u.auth.variable[2];
 579
 580         wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
 581                    "auth_transaction=%d status_code=%d wep=%d%s",
 582                    MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 583                    status_code, !!(fc & WLAN_FC_ISWEP),
 584                    challenge ? " challenge" : "");
 585
 586         if (hapd->tkip_countermeasures) {
 587                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 588                 goto fail;
 589         }
 590
 591         if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
 592                auth_alg == WLAN_AUTH_OPEN) ||
 593 #ifdef CONFIG_IEEE80211R
 594               (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
 595                auth_alg == WLAN_AUTH_FT) ||
 596 #endif /* CONFIG_IEEE80211R */
 597 #ifdef CONFIG_SAE
 598               (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
 599                auth_alg == WLAN_AUTH_SAE) ||
 600 #endif /* CONFIG_SAE */
 601               ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
 602                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 603                 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
 604                            auth_alg);
 605                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 606                 goto fail;
 607         }
 608
 609         if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
 610               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
 611                 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
 612                            auth_transaction);
 613                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 614                 goto fail;
 615         }
 616
 617         if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
 618                 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
 619                            MAC2STR(mgmt->sa));
 620                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 621                 goto fail;
 622         }
 623
 624         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
 625                                       &session_timeout,
 626                                       &acct_interim_interval, &vlan_id,
 627                                       &psk, &identity, &radius_cui);
 628
 629         if (res == HOSTAPD_ACL_REJECT) {
 630                 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
 631                            MAC2STR(mgmt->sa));
 632                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 633                 goto fail;
 634         }
 635         if (res == HOSTAPD_ACL_PENDING) {
 636                 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
 637                            " waiting for an external authentication",
 638                            MAC2STR(mgmt->sa));
 639                 /* Authentication code will re-send the authentication frame
 640                  * after it has received (and cached) information from the
 641                  * external source. */
 642                 return;
 643         }
 644
 645         sta = ap_sta_add(hapd, mgmt->sa);
 646         if (!sta) {
 647                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 648                 goto fail;
 649         }
 650
 651         if (vlan_id > 0) {
 652                 if (!hostapd_vlan_id_valid(hapd->conf->vlan, vlan_id)) {
 653                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 654                                        HOSTAPD_LEVEL_INFO, "Invalid VLAN ID "
 655                                        "%d received from RADIUS server",
 656                                        vlan_id);
 657                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 658                         goto fail;
 659                 }
 660                 sta->vlan_id = vlan_id;
 661                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 662                                HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
 663         }
 664
 665         hostapd_free_psk_list(sta->psk);
 666         if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
 667                 sta->psk = psk;
 668                 psk = NULL;
 669         } else {
 670                 sta->psk = NULL;
 671         }
 672
 673         sta->identity = identity;
 674         identity = NULL;
 675         sta->radius_cui = radius_cui;
 676         radius_cui = NULL;
 677
 678         sta->flags &= ~WLAN_STA_PREAUTH;
 679         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 680
 681         if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
 682                 sta->acct_interim_interval = acct_interim_interval;
 683         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
 684                 ap_sta_session_timeout(hapd, sta, session_timeout);
 685         else
 686                 ap_sta_no_session_timeout(hapd, sta);
 687
 688         switch (auth_alg) {
 689         case WLAN_AUTH_OPEN:
 690                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 691                                HOSTAPD_LEVEL_DEBUG,
 692                                "authentication OK (open system)");
 693 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 694                 /* Station will be marked authenticated if it ACKs the
 695                  * authentication reply. */
 696 #else
 697                 sta->flags |= WLAN_STA_AUTH;
 698                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 699                 sta->auth_alg = WLAN_AUTH_OPEN;
 700                 mlme_authenticate_indication(hapd, sta);
 701 #endif
 702                 break;
 703         case WLAN_AUTH_SHARED_KEY:
 704                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
 705                                        fc & WLAN_FC_ISWEP);
 706                 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
 707                 mlme_authenticate_indication(hapd, sta);
 708                 if (sta->challenge && auth_transaction == 1) {
 709                         resp_ies[0] = WLAN_EID_CHALLENGE;
 710                         resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
 711                         os_memcpy(resp_ies + 2, sta->challenge,
 712                                   WLAN_AUTH_CHALLENGE_LEN);
 713                         resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
 714                 }
 715                 break;
 716 #ifdef CONFIG_IEEE80211R
 717         case WLAN_AUTH_FT:
 718                 sta->auth_alg = WLAN_AUTH_FT;
 719                 if (sta->wpa_sm == NULL)
 720                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 721                                                         sta->addr, NULL);
 722                 if (sta->wpa_sm == NULL) {
 723                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
 724                                    "state machine");
 725                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 726                         goto fail;
 727                 }
 728                 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
 729                                     auth_transaction, mgmt->u.auth.variable,
 730                                     len - IEEE80211_HDRLEN -
 731                                     sizeof(mgmt->u.auth),
 732                                     handle_auth_ft_finish, hapd);
 733                 /* handle_auth_ft_finish() callback will complete auth. */
 734                 return;
 735 #endif /* CONFIG_IEEE80211R */
 736 #ifdef CONFIG_SAE
 737         case WLAN_AUTH_SAE:
 738                 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction);
 739                 return;
 740 #endif /* CONFIG_SAE */
 741         }
 742
 743  fail:
 744         os_free(identity);
 745         os_free(radius_cui);
 746         hostapd_free_psk_list(psk);
 747
 748         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
 749                         auth_transaction + 1, resp, resp_ies, resp_ies_len);
 750 }
 751
 752
 753 static int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
 754 {
 755         int i, j = 32, aid;
 756
 757         /* get a unique AID */
 758         if (sta->aid > 0) {
 759                 wpa_printf(MSG_DEBUG, "  old AID %d", sta->aid);
 760                 return 0;
 761         }
 762
 763         for (i = 0; i < AID_WORDS; i++) {
 764                 if (hapd->sta_aid[i] == (u32) -1)
 765                         continue;
 766                 for (j = 0; j < 32; j++) {
 767                         if (!(hapd->sta_aid[i] & BIT(j)))
 768                                 break;
 769                 }
 770                 if (j < 32)
 771                         break;
 772         }
 773         if (j == 32)
 774                 return -1;
 775         aid = i * 32 + j + 1;
 776         if (aid > 2007)
 777                 return -1;
 778
 779         sta->aid = aid;
 780         hapd->sta_aid[i] |= BIT(j);
 781         wpa_printf(MSG_DEBUG, "  new AID %d", sta->aid);
 782         return 0;
 783 }
 784
 785
 786 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
 787                       const u8 *ssid_ie, size_t ssid_ie_len)
 788 {
 789         if (ssid_ie == NULL)
 790                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 791
 792         if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
 793             os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
 794                 char ssid_txt[33];
 795                 ieee802_11_print_ssid(ssid_txt, ssid_ie, ssid_ie_len);
 796                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 797                                HOSTAPD_LEVEL_INFO,
 798                                "Station tried to associate with unknown SSID "
 799                                "'%s'", ssid_txt);
 800                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 801         }
 802
 803         return WLAN_STATUS_SUCCESS;
 804 }
 805
 806
 807 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
 808                      const u8 *wmm_ie, size_t wmm_ie_len)
 809 {
 810         sta->flags &= ~WLAN_STA_WMM;
 811         sta->qosinfo = 0;
 812         if (wmm_ie && hapd->conf->wmm_enabled) {
 813                 struct wmm_information_element *wmm;
 814
 815                 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
 816                         hostapd_logger(hapd, sta->addr,
 817                                        HOSTAPD_MODULE_WPA,
 818                                        HOSTAPD_LEVEL_DEBUG,
 819                                        "invalid WMM element in association "
 820                                        "request");
 821                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 822                 }
 823
 824                 sta->flags |= WLAN_STA_WMM;
 825                 wmm = (struct wmm_information_element *) wmm_ie;
 826                 sta->qosinfo = wmm->qos_info;
 827         }
 828         return WLAN_STATUS_SUCCESS;
 829 }
 830
 831
 832 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
 833                            struct ieee802_11_elems *elems)
 834 {
 835         if (!elems->supp_rates) {
 836                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 837                                HOSTAPD_LEVEL_DEBUG,
 838                                "No supported rates element in AssocReq");
 839                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 840         }
 841
 842         if (elems->supp_rates_len + elems->ext_supp_rates_len >
 843             sizeof(sta->supported_rates)) {
 844                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 845                                HOSTAPD_LEVEL_DEBUG,
 846                                "Invalid supported rates element length %d+%d",
 847                                elems->supp_rates_len,
 848                                elems->ext_supp_rates_len);
 849                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 850         }
 851
 852         sta->supported_rates_len = merge_byte_arrays(
 853                 sta->supported_rates, sizeof(sta->supported_rates),
 854                 elems->supp_rates, elems->supp_rates_len,
 855                 elems->ext_supp_rates, elems->ext_supp_rates_len);
 856
 857         return WLAN_STATUS_SUCCESS;
 858 }
 859
 860
 861 static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
 862                            const u8 *ext_capab_ie, size_t ext_capab_ie_len)
 863 {
 864 #ifdef CONFIG_INTERWORKING
 865         /* check for QoS Map support */
 866         if (ext_capab_ie_len >= 5) {
 867                 if (ext_capab_ie[4] & 0x01)
 868                         sta->qos_map_enabled = 1;
 869         }
 870 #endif /* CONFIG_INTERWORKING */
 871
 872         return WLAN_STATUS_SUCCESS;
 873 }
 874
 875
 876 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
 877                            const u8 *ies, size_t ies_len, int reassoc)
 878 {
 879         struct ieee802_11_elems elems;
 880         u16 resp;
 881         const u8 *wpa_ie;
 882         size_t wpa_ie_len;
 883         const u8 *p2p_dev_addr = NULL;
 884
 885         if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
 886                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 887                                HOSTAPD_LEVEL_INFO, "Station sent an invalid "
 888                                "association request");
 889                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 890         }
 891
 892         resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
 893         if (resp != WLAN_STATUS_SUCCESS)
 894                 return resp;
 895         resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
 896         if (resp != WLAN_STATUS_SUCCESS)
 897                 return resp;
 898         resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
 899         if (resp != WLAN_STATUS_SUCCESS)
 900                 return resp;
 901         resp = copy_supp_rates(hapd, sta, &elems);
 902         if (resp != WLAN_STATUS_SUCCESS)
 903                 return resp;
 904 #ifdef CONFIG_IEEE80211N
 905         resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities,
 906                                  elems.ht_capabilities_len);
 907         if (resp != WLAN_STATUS_SUCCESS)
 908                 return resp;
 909         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
 910             !(sta->flags & WLAN_STA_HT)) {
 911                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 912                                HOSTAPD_LEVEL_INFO, "Station does not support "
 913                                "mandatory HT PHY - reject association");
 914                 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
 915         }
 916 #endif /* CONFIG_IEEE80211N */
 917
 918 #ifdef CONFIG_IEEE80211AC
 919         resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities,
 920                                   elems.vht_capabilities_len);
 921         if (resp != WLAN_STATUS_SUCCESS)
 922                 return resp;
 923         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
 924             !(sta->flags & WLAN_STA_VHT)) {
 925                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 926                                HOSTAPD_LEVEL_INFO, "Station does not support "
 927                                "mandatory VHT PHY - reject association");
 928                 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
 929         }
 930 #endif /* CONFIG_IEEE80211AC */
 931
 932 #ifdef CONFIG_P2P
 933         if (elems.p2p) {
 934                 wpabuf_free(sta->p2p_ie);
 935                 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
 936                                                           P2P_IE_VENDOR_TYPE);
 937                 if (sta->p2p_ie)
 938                         p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
 939         } else {
 940                 wpabuf_free(sta->p2p_ie);
 941                 sta->p2p_ie = NULL;
 942         }
 943 #endif /* CONFIG_P2P */
 944
 945         if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
 946                 wpa_ie = elems.rsn_ie;
 947                 wpa_ie_len = elems.rsn_ie_len;
 948         } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
 949                    elems.wpa_ie) {
 950                 wpa_ie = elems.wpa_ie;
 951                 wpa_ie_len = elems.wpa_ie_len;
 952         } else {
 953                 wpa_ie = NULL;
 954                 wpa_ie_len = 0;
 955         }
 956
 957 #ifdef CONFIG_WPS
 958         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
 959         if (hapd->conf->wps_state && elems.wps_ie) {
 960                 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
 961                            "Request - assume WPS is used");
 962                 sta->flags |= WLAN_STA_WPS;
 963                 wpabuf_free(sta->wps_ie);
 964                 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
 965                                                           WPS_IE_VENDOR_TYPE);
 966                 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
 967                         wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
 968                         sta->flags |= WLAN_STA_WPS2;
 969                 }
 970                 wpa_ie = NULL;
 971                 wpa_ie_len = 0;
 972                 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
 973                         wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
 974                                    "(Re)Association Request - reject");
 975                         return WLAN_STATUS_INVALID_IE;
 976                 }
 977         } else if (hapd->conf->wps_state && wpa_ie == NULL) {
 978                 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
 979                            "(Re)Association Request - possible WPS use");
 980                 sta->flags |= WLAN_STA_MAYBE_WPS;
 981         } else
 982 #endif /* CONFIG_WPS */
 983         if (hapd->conf->wpa && wpa_ie == NULL) {
 984                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 985                                HOSTAPD_LEVEL_INFO,
 986                                "No WPA/RSN IE in association request");
 987                 return WLAN_STATUS_INVALID_IE;
 988         }
 989
 990         if (hapd->conf->wpa && wpa_ie) {
 991                 int res;
 992                 wpa_ie -= 2;
 993                 wpa_ie_len += 2;
 994                 if (sta->wpa_sm == NULL)
 995                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 996                                                         sta->addr,
 997                                                         p2p_dev_addr);
 998                 if (sta->wpa_sm == NULL) {
 999                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1000                                    "state machine");
1001                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1002                 }
1003                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
1004                                           wpa_ie, wpa_ie_len,
1005                                           elems.mdie, elems.mdie_len);
1006                 if (res == WPA_INVALID_GROUP)
1007                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1008                 else if (res == WPA_INVALID_PAIRWISE)
1009                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1010                 else if (res == WPA_INVALID_AKMP)
1011                         resp = WLAN_STATUS_AKMP_NOT_VALID;
1012                 else if (res == WPA_ALLOC_FAIL)
1013                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1014 #ifdef CONFIG_IEEE80211W
1015                 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1016                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1017                 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
1018                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1019 #endif /* CONFIG_IEEE80211W */
1020                 else if (res == WPA_INVALID_MDIE)
1021                         resp = WLAN_STATUS_INVALID_MDIE;
1022                 else if (res != WPA_IE_OK)
1023                         resp = WLAN_STATUS_INVALID_IE;
1024                 if (resp != WLAN_STATUS_SUCCESS)
1025                         return resp;
1026 #ifdef CONFIG_IEEE80211W
1027                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1028                     sta->sa_query_count > 0)
1029                         ap_check_sa_query_timeout(hapd, sta);
1030                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1031                     (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
1032                         /*
1033                          * STA has already been associated with MFP and SA
1034                          * Query timeout has not been reached. Reject the
1035                          * association attempt temporarily and start SA Query,
1036                          * if one is not pending.
1037                          */
1038
1039                         if (sta->sa_query_count == 0)
1040                                 ap_sta_start_sa_query(hapd, sta);
1041
1042                         return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
1043                 }
1044
1045                 if (wpa_auth_uses_mfp(sta->wpa_sm))
1046                         sta->flags |= WLAN_STA_MFP;
1047                 else
1048                         sta->flags &= ~WLAN_STA_MFP;
1049 #endif /* CONFIG_IEEE80211W */
1050
1051 #ifdef CONFIG_IEEE80211R
1052                 if (sta->auth_alg == WLAN_AUTH_FT) {
1053                         if (!reassoc) {
1054                                 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
1055                                            "to use association (not "
1056                                            "re-association) with FT auth_alg",
1057                                            MAC2STR(sta->addr));
1058                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1059                         }
1060
1061                         resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
1062                                                        ies_len);
1063                         if (resp != WLAN_STATUS_SUCCESS)
1064                                 return resp;
1065                 }
1066 #endif /* CONFIG_IEEE80211R */
1067
1068 #ifdef CONFIG_SAE
1069                 if (wpa_auth_uses_sae(sta->wpa_sm) &&
1070                     sta->auth_alg != WLAN_AUTH_SAE) {
1071                         wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
1072                                    "SAE AKM after non-SAE auth_alg %u",
1073                                    MAC2STR(sta->addr), sta->auth_alg);
1074                         return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1075                 }
1076 #endif /* CONFIG_SAE */
1077
1078 #ifdef CONFIG_IEEE80211N
1079                 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
1080                     wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
1081                         hostapd_logger(hapd, sta->addr,
1082                                        HOSTAPD_MODULE_IEEE80211,
1083                                        HOSTAPD_LEVEL_INFO,
1084                                        "Station tried to use TKIP with HT "
1085                                        "association");
1086                         return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1087                 }
1088 #endif /* CONFIG_IEEE80211N */
1089         } else
1090                 wpa_auth_sta_no_wpa(sta->wpa_sm);
1091
1092 #ifdef CONFIG_P2P
1093         p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
1094 #endif /* CONFIG_P2P */
1095
1096 #ifdef CONFIG_HS20
1097         wpabuf_free(sta->hs20_ie);
1098         if (elems.hs20 && elems.hs20_len > 4) {
1099                 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
1100                                                  elems.hs20_len - 4);
1101         } else
1102                 sta->hs20_ie = NULL;
1103 #endif /* CONFIG_HS20 */
1104
1105         return WLAN_STATUS_SUCCESS;
1106 }
1107
1108
1109 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
1110                         u16 reason_code)
1111 {
1112         int send_len;
1113         struct ieee80211_mgmt reply;
1114
1115         os_memset(&reply, 0, sizeof(reply));
1116         reply.frame_control =
1117                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
1118         os_memcpy(reply.da, addr, ETH_ALEN);
1119         os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
1120         os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
1121
1122         send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
1123         reply.u.deauth.reason_code = host_to_le16(reason_code);
1124
1125         if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
1126                 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
1127                            strerror(errno));
1128 }
1129
1130
1131 static void send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
1132                             u16 status_code, int reassoc, const u8 *ies,
1133                             size_t ies_len)
1134 {
1135         int send_len;
1136         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
1137         struct ieee80211_mgmt *reply;
1138         u8 *p;
1139
1140         os_memset(buf, 0, sizeof(buf));
1141         reply = (struct ieee80211_mgmt *) buf;
1142         reply->frame_control =
1143                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1144                              (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
1145                               WLAN_FC_STYPE_ASSOC_RESP));
1146         os_memcpy(reply->da, sta->addr, ETH_ALEN);
1147         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
1148         os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
1149
1150         send_len = IEEE80211_HDRLEN;
1151         send_len += sizeof(reply->u.assoc_resp);
1152         reply->u.assoc_resp.capab_info =
1153                 host_to_le16(hostapd_own_capab_info(hapd, sta, 0));
1154         reply->u.assoc_resp.status_code = host_to_le16(status_code);
1155         reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0)
1156                                                | BIT(14) | BIT(15));
1157         /* Supported rates */
1158         p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
1159         /* Extended supported rates */
1160         p = hostapd_eid_ext_supp_rates(hapd, p);
1161
1162 #ifdef CONFIG_IEEE80211R
1163         if (status_code == WLAN_STATUS_SUCCESS) {
1164                 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
1165                  * Transition Information, RSN, [RIC Response] */
1166                 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
1167                                                 buf + sizeof(buf) - p,
1168                                                 sta->auth_alg, ies, ies_len);
1169         }
1170 #endif /* CONFIG_IEEE80211R */
1171
1172 #ifdef CONFIG_IEEE80211W
1173         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
1174                 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
1175 #endif /* CONFIG_IEEE80211W */
1176
1177 #ifdef CONFIG_IEEE80211N
1178         p = hostapd_eid_ht_capabilities(hapd, p);
1179         p = hostapd_eid_ht_operation(hapd, p);
1180 #endif /* CONFIG_IEEE80211N */
1181
1182 #ifdef CONFIG_IEEE80211AC
1183         p = hostapd_eid_vht_capabilities(hapd, p);
1184         p = hostapd_eid_vht_operation(hapd, p);
1185 #endif /* CONFIG_IEEE80211AC */
1186
1187         p = hostapd_eid_ext_capab(hapd, p);
1188         p = hostapd_eid_bss_max_idle_period(hapd, p);
1189         if (sta->qos_map_enabled)
1190                 p = hostapd_eid_qos_map_set(hapd, p);
1191
1192         if (sta->flags & WLAN_STA_WMM)
1193                 p = hostapd_eid_wmm(hapd, p);
1194
1195 #ifdef CONFIG_WPS
1196         if ((sta->flags & WLAN_STA_WPS) ||
1197             ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa)) {
1198                 struct wpabuf *wps = wps_build_assoc_resp_ie();
1199                 if (wps) {
1200                         os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
1201                         p += wpabuf_len(wps);
1202                         wpabuf_free(wps);
1203                 }
1204         }
1205 #endif /* CONFIG_WPS */
1206
1207 #ifdef CONFIG_P2P
1208         if (sta->p2p_ie) {
1209                 struct wpabuf *p2p_resp_ie;
1210                 enum p2p_status_code status;
1211                 switch (status_code) {
1212                 case WLAN_STATUS_SUCCESS:
1213                         status = P2P_SC_SUCCESS;
1214                         break;
1215                 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
1216                         status = P2P_SC_FAIL_LIMIT_REACHED;
1217                         break;
1218                 default:
1219                         status = P2P_SC_FAIL_INVALID_PARAMS;
1220                         break;
1221                 }
1222                 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
1223                 if (p2p_resp_ie) {
1224                         os_memcpy(p, wpabuf_head(p2p_resp_ie),
1225                                   wpabuf_len(p2p_resp_ie));
1226                         p += wpabuf_len(p2p_resp_ie);
1227                         wpabuf_free(p2p_resp_ie);
1228                 }
1229         }
1230 #endif /* CONFIG_P2P */
1231
1232 #ifdef CONFIG_P2P_MANAGER
1233         if (hapd->conf->p2p & P2P_MANAGE)
1234                 p = hostapd_eid_p2p_manage(hapd, p);
1235 #endif /* CONFIG_P2P_MANAGER */
1236
1237         send_len += p - reply->u.assoc_resp.variable;
1238
1239         if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0)
1240                 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
1241                            strerror(errno));
1242 }
1243
1244
1245 static void handle_assoc(struct hostapd_data *hapd,
1246                          const struct ieee80211_mgmt *mgmt, size_t len,
1247                          int reassoc)
1248 {
1249         u16 capab_info, listen_interval;
1250         u16 resp = WLAN_STATUS_SUCCESS;
1251         const u8 *pos;
1252         int left, i;
1253         struct sta_info *sta;
1254
1255         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
1256                                       sizeof(mgmt->u.assoc_req))) {
1257                 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
1258                            reassoc, (unsigned long) len);
1259                 return;
1260         }
1261
1262 #ifdef CONFIG_TESTING_OPTIONS
1263         if (reassoc) {
1264                 if (hapd->iconf->ignore_reassoc_probability > 0.0d &&
1265                     drand48() < hapd->iconf->ignore_reassoc_probability) {
1266                         wpa_printf(MSG_INFO,
1267                                    "TESTING: ignoring reassoc request from "
1268                                    MACSTR, MAC2STR(mgmt->sa));
1269                         return;
1270                 }
1271         } else {
1272                 if (hapd->iconf->ignore_assoc_probability > 0.0d &&
1273                     drand48() < hapd->iconf->ignore_assoc_probability) {
1274                         wpa_printf(MSG_INFO,
1275                                    "TESTING: ignoring assoc request from "
1276                                    MACSTR, MAC2STR(mgmt->sa));
1277                         return;
1278                 }
1279         }
1280 #endif /* CONFIG_TESTING_OPTIONS */
1281
1282         if (reassoc) {
1283                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
1284                 listen_interval = le_to_host16(
1285                         mgmt->u.reassoc_req.listen_interval);
1286                 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
1287                            " capab_info=0x%02x listen_interval=%d current_ap="
1288                            MACSTR,
1289                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1290                            MAC2STR(mgmt->u.reassoc_req.current_ap));
1291                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
1292                 pos = mgmt->u.reassoc_req.variable;
1293         } else {
1294                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
1295                 listen_interval = le_to_host16(
1296                         mgmt->u.assoc_req.listen_interval);
1297                 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
1298                            " capab_info=0x%02x listen_interval=%d",
1299                            MAC2STR(mgmt->sa), capab_info, listen_interval);
1300                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
1301                 pos = mgmt->u.assoc_req.variable;
1302         }
1303
1304         sta = ap_get_sta(hapd, mgmt->sa);
1305 #ifdef CONFIG_IEEE80211R
1306         if (sta && sta->auth_alg == WLAN_AUTH_FT &&
1307             (sta->flags & WLAN_STA_AUTH) == 0) {
1308                 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
1309                            "prior to authentication since it is using "
1310                            "over-the-DS FT", MAC2STR(mgmt->sa));
1311         } else
1312 #endif /* CONFIG_IEEE80211R */
1313         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
1314                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1315                                HOSTAPD_LEVEL_INFO, "Station tried to "
1316                                "associate before authentication "
1317                                "(aid=%d flags=0x%x)",
1318                                sta ? sta->aid : -1,
1319                                sta ? sta->flags : 0);
1320                 send_deauth(hapd, mgmt->sa,
1321                             WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
1322                 return;
1323         }
1324
1325         if (hapd->tkip_countermeasures) {
1326                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
1327                 goto fail;
1328         }
1329
1330         if (listen_interval > hapd->conf->max_listen_interval) {
1331                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1332                                HOSTAPD_LEVEL_DEBUG,
1333                                "Too large Listen Interval (%d)",
1334                                listen_interval);
1335                 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
1336                 goto fail;
1337         }
1338
1339         /* followed by SSID and Supported rates; and HT capabilities if 802.11n
1340          * is used */
1341         resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
1342         if (resp != WLAN_STATUS_SUCCESS)
1343                 goto fail;
1344
1345         if (hostapd_get_aid(hapd, sta) < 0) {
1346                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1347                                HOSTAPD_LEVEL_INFO, "No room for more AIDs");
1348                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1349                 goto fail;
1350         }
1351
1352         sta->capability = capab_info;
1353         sta->listen_interval = listen_interval;
1354
1355         if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
1356                 sta->flags |= WLAN_STA_NONERP;
1357         for (i = 0; i < sta->supported_rates_len; i++) {
1358                 if ((sta->supported_rates[i] & 0x7f) > 22) {
1359                         sta->flags &= ~WLAN_STA_NONERP;
1360                         break;
1361                 }
1362         }
1363         if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
1364                 sta->nonerp_set = 1;
1365                 hapd->iface->num_sta_non_erp++;
1366                 if (hapd->iface->num_sta_non_erp == 1)
1367                         ieee802_11_set_beacons(hapd->iface);
1368         }
1369
1370         if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
1371             !sta->no_short_slot_time_set) {
1372                 sta->no_short_slot_time_set = 1;
1373                 hapd->iface->num_sta_no_short_slot_time++;
1374                 if (hapd->iface->current_mode->mode ==
1375                     HOSTAPD_MODE_IEEE80211G &&
1376                     hapd->iface->num_sta_no_short_slot_time == 1)
1377                         ieee802_11_set_beacons(hapd->iface);
1378         }
1379
1380         if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1381                 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
1382         else
1383                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1384
1385         if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
1386             !sta->no_short_preamble_set) {
1387                 sta->no_short_preamble_set = 1;
1388                 hapd->iface->num_sta_no_short_preamble++;
1389                 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
1390                     && hapd->iface->num_sta_no_short_preamble == 1)
1391                         ieee802_11_set_beacons(hapd->iface);
1392         }
1393
1394 #ifdef CONFIG_IEEE80211N
1395         update_ht_state(hapd, sta);
1396 #endif /* CONFIG_IEEE80211N */
1397
1398         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1399                        HOSTAPD_LEVEL_DEBUG,
1400                        "association OK (aid %d)", sta->aid);
1401         /* Station will be marked associated, after it acknowledges AssocResp
1402          */
1403         sta->flags |= WLAN_STA_ASSOC_REQ_OK;
1404
1405 #ifdef CONFIG_IEEE80211W
1406         if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
1407                 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
1408                            "SA Query procedure", reassoc ? "re" : "");
1409                 /* TODO: Send a protected Disassociate frame to the STA using
1410                  * the old key and Reason Code "Previous Authentication no
1411                  * longer valid". Make sure this is only sent protected since
1412                  * unprotected frame would be received by the STA that is now
1413                  * trying to associate.
1414                  */
1415         }
1416 #endif /* CONFIG_IEEE80211W */
1417
1418         if (reassoc) {
1419                 os_memcpy(sta->previous_ap, mgmt->u.reassoc_req.current_ap,
1420                           ETH_ALEN);
1421         }
1422
1423         if (sta->last_assoc_req)
1424                 os_free(sta->last_assoc_req);
1425         sta->last_assoc_req = os_malloc(len);
1426         if (sta->last_assoc_req)
1427                 os_memcpy(sta->last_assoc_req, mgmt, len);
1428
1429         /* Make sure that the previously registered inactivity timer will not
1430          * remove the STA immediately. */
1431         sta->timeout_next = STA_NULLFUNC;
1432
1433  fail:
1434         send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
1435 }
1436
1437
1438 static void handle_disassoc(struct hostapd_data *hapd,
1439                             const struct ieee80211_mgmt *mgmt, size_t len)
1440 {
1441         struct sta_info *sta;
1442
1443         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
1444                 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
1445                            (unsigned long) len);
1446                 return;
1447         }
1448
1449         wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
1450                    MAC2STR(mgmt->sa),
1451                    le_to_host16(mgmt->u.disassoc.reason_code));
1452
1453         sta = ap_get_sta(hapd, mgmt->sa);
1454         if (sta == NULL) {
1455                 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
1456                            MAC2STR(mgmt->sa));
1457                 return;
1458         }
1459
1460         ap_sta_set_authorized(hapd, sta, 0);
1461         sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
1462         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
1463         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1464                        HOSTAPD_LEVEL_INFO, "disassociated");
1465         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1466         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1467         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
1468          * authenticated. */
1469         accounting_sta_stop(hapd, sta);
1470         ieee802_1x_free_station(sta);
1471         hostapd_drv_sta_remove(hapd, sta->addr);
1472
1473         if (sta->timeout_next == STA_NULLFUNC ||
1474             sta->timeout_next == STA_DISASSOC) {
1475                 sta->timeout_next = STA_DEAUTH;
1476                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1477                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
1478                                        hapd, sta);
1479         }
1480
1481         mlme_disassociate_indication(
1482                 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
1483 }
1484
1485
1486 static void handle_deauth(struct hostapd_data *hapd,
1487                           const struct ieee80211_mgmt *mgmt, size_t len)
1488 {
1489         struct sta_info *sta;
1490
1491         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
1492                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
1493                         "payload (len=%lu)", (unsigned long) len);
1494                 return;
1495         }
1496
1497         wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
1498                 " reason_code=%d",
1499                 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
1500
1501         sta = ap_get_sta(hapd, mgmt->sa);
1502         if (sta == NULL) {
1503                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
1504                         "to deauthenticate, but it is not authenticated",
1505                         MAC2STR(mgmt->sa));
1506                 return;
1507         }
1508
1509         ap_sta_set_authorized(hapd, sta, 0);
1510         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
1511                         WLAN_STA_ASSOC_REQ_OK);
1512         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1513         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1514                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
1515         mlme_deauthenticate_indication(
1516                 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
1517         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1518         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1519         ap_free_sta(hapd, sta);
1520 }
1521
1522
1523 static void handle_beacon(struct hostapd_data *hapd,
1524                           const struct ieee80211_mgmt *mgmt, size_t len,
1525                           struct hostapd_frame_info *fi)
1526 {
1527         struct ieee802_11_elems elems;
1528
1529         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
1530                 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
1531                            (unsigned long) len);
1532                 return;
1533         }
1534
1535         (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
1536                                       len - (IEEE80211_HDRLEN +
1537                                              sizeof(mgmt->u.beacon)), &elems,
1538                                       0);
1539
1540         ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
1541 }
1542
1543
1544 #ifdef CONFIG_IEEE80211W
1545
1546 static void hostapd_sa_query_action(struct hostapd_data *hapd,
1547                                     const struct ieee80211_mgmt *mgmt,
1548                                     size_t len)
1549 {
1550         const u8 *end;
1551
1552         end = mgmt->u.action.u.sa_query_resp.trans_id +
1553                 WLAN_SA_QUERY_TR_ID_LEN;
1554         if (((u8 *) mgmt) + len < end) {
1555                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
1556                            "frame (len=%lu)", (unsigned long) len);
1557                 return;
1558         }
1559
1560         ieee802_11_sa_query_action(hapd, mgmt->sa,
1561                                    mgmt->u.action.u.sa_query_resp.action,
1562                                    mgmt->u.action.u.sa_query_resp.trans_id);
1563 }
1564
1565
1566 static int robust_action_frame(u8 category)
1567 {
1568         return category != WLAN_ACTION_PUBLIC &&
1569                 category != WLAN_ACTION_HT;
1570 }
1571 #endif /* CONFIG_IEEE80211W */
1572
1573
1574 #ifdef CONFIG_WNM
1575 static void hostapd_wnm_action(struct hostapd_data *hapd, struct sta_info *sta,
1576                                const struct ieee80211_mgmt *mgmt,
1577                                size_t len)
1578 {
1579         struct rx_action action;
1580         if (len < IEEE80211_HDRLEN + 2)
1581                 return;
1582         os_memset(&action, 0, sizeof(action));
1583         action.da = mgmt->da;
1584         action.sa = mgmt->sa;
1585         action.bssid = mgmt->bssid;
1586         action.category = mgmt->u.action.category;
1587         action.data = (const u8 *) &mgmt->u.action.u.wnm_sleep_req.action;
1588         action.len = len - IEEE80211_HDRLEN - 1;
1589         action.freq = hapd->iface->freq;
1590         ieee802_11_rx_wnm_action_ap(hapd, &action);
1591 }
1592 #endif /* CONFIG_WNM */
1593
1594
1595 static void handle_action(struct hostapd_data *hapd,
1596                           const struct ieee80211_mgmt *mgmt, size_t len)
1597 {
1598         struct sta_info *sta;
1599         sta = ap_get_sta(hapd, mgmt->sa);
1600
1601         if (len < IEEE80211_HDRLEN + 1) {
1602                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1603                                HOSTAPD_LEVEL_DEBUG,
1604                                "handle_action - too short payload (len=%lu)",
1605                                (unsigned long) len);
1606                 return;
1607         }
1608
1609         if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
1610             (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
1611                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
1612                            "frame (category=%u) from unassociated STA " MACSTR,
1613                            MAC2STR(mgmt->sa), mgmt->u.action.category);
1614                 return;
1615         }
1616
1617 #ifdef CONFIG_IEEE80211W
1618         if (sta && (sta->flags & WLAN_STA_MFP) &&
1619             !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
1620               robust_action_frame(mgmt->u.action.category))) {
1621                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1622                                HOSTAPD_LEVEL_DEBUG,
1623                                "Dropped unprotected Robust Action frame from "
1624                                "an MFP STA");
1625                 return;
1626         }
1627 #endif /* CONFIG_IEEE80211W */
1628
1629         switch (mgmt->u.action.category) {
1630 #ifdef CONFIG_IEEE80211R
1631         case WLAN_ACTION_FT:
1632                 if (wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
1633                                      len - IEEE80211_HDRLEN))
1634                         break;
1635                 return;
1636 #endif /* CONFIG_IEEE80211R */
1637         case WLAN_ACTION_WMM:
1638                 hostapd_wmm_action(hapd, mgmt, len);
1639                 return;
1640 #ifdef CONFIG_IEEE80211W
1641         case WLAN_ACTION_SA_QUERY:
1642                 hostapd_sa_query_action(hapd, mgmt, len);
1643                 return;
1644 #endif /* CONFIG_IEEE80211W */
1645 #ifdef CONFIG_WNM
1646         case WLAN_ACTION_WNM:
1647                 hostapd_wnm_action(hapd, sta, mgmt, len);
1648                 return;
1649 #endif /* CONFIG_WNM */
1650         case WLAN_ACTION_PUBLIC:
1651                 if (hapd->public_action_cb) {
1652                         hapd->public_action_cb(hapd->public_action_cb_ctx,
1653                                                (u8 *) mgmt, len,
1654                                                hapd->iface->freq);
1655                 }
1656                 if (hapd->public_action_cb2) {
1657                         hapd->public_action_cb2(hapd->public_action_cb2_ctx,
1658                                                 (u8 *) mgmt, len,
1659                                                 hapd->iface->freq);
1660                 }
1661                 if (hapd->public_action_cb || hapd->public_action_cb2)
1662                         return;
1663                 break;
1664         case WLAN_ACTION_VENDOR_SPECIFIC:
1665                 if (hapd->vendor_action_cb) {
1666                         if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
1667                                                    (u8 *) mgmt, len,
1668                                                    hapd->iface->freq) == 0)
1669                                 return;
1670                 }
1671                 break;
1672         }
1673
1674         hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1675                        HOSTAPD_LEVEL_DEBUG,
1676                        "handle_action - unknown action category %d or invalid "
1677                        "frame",
1678                        mgmt->u.action.category);
1679         if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
1680             !(mgmt->sa[0] & 0x01)) {
1681                 struct ieee80211_mgmt *resp;
1682
1683                 /*
1684                  * IEEE 802.11-REVma/D9.0 - 7.3.1.11
1685                  * Return the Action frame to the source without change
1686                  * except that MSB of the Category set to 1.
1687                  */
1688                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
1689                            "frame back to sender");
1690                 resp = os_malloc(len);
1691                 if (resp == NULL)
1692                         return;
1693                 os_memcpy(resp, mgmt, len);
1694                 os_memcpy(resp->da, resp->sa, ETH_ALEN);
1695                 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
1696                 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
1697                 resp->u.action.category |= 0x80;
1698
1699                 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
1700                         wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
1701                                    "Action frame");
1702                 }
1703                 os_free(resp);
1704         }
1705 }
1706
1707
1708 /**
1709  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
1710  * @hapd: hostapd BSS data structure (the BSS to which the management frame was
1711  * sent to)
1712  * @buf: management frame data (starting from IEEE 802.11 header)
1713  * @len: length of frame data in octets
1714  * @fi: meta data about received frame (signal level, etc.)
1715  *
1716  * Process all incoming IEEE 802.11 management frames. This will be called for
1717  * each frame received from the kernel driver through wlan#ap interface. In
1718  * addition, it can be called to re-inserted pending frames (e.g., when using
1719  * external RADIUS server as an MAC ACL).
1720  */
1721 void ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
1722                      struct hostapd_frame_info *fi)
1723 {
1724         struct ieee80211_mgmt *mgmt;
1725         int broadcast;
1726         u16 fc, stype;
1727
1728 #ifdef CONFIG_TESTING_OPTIONS
1729         if (hapd->ext_mgmt_frame_handling) {
1730                 size_t hex_len = 2 * len + 1;
1731                 char *hex = os_malloc(hex_len);
1732                 if (hex) {
1733                         wpa_snprintf_hex(hex, hex_len, buf, len);
1734                         wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex);
1735                         os_free(hex);
1736                 }
1737                 return;
1738         }
1739 #endif /* CONFIG_TESTING_OPTIONS */
1740
1741         if (len < 24)
1742                 return;
1743
1744         mgmt = (struct ieee80211_mgmt *) buf;
1745         fc = le_to_host16(mgmt->frame_control);
1746         stype = WLAN_FC_GET_STYPE(fc);
1747
1748         if (stype == WLAN_FC_STYPE_BEACON) {
1749                 handle_beacon(hapd, mgmt, len, fi);
1750                 return;
1751         }
1752
1753         broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
1754                 mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
1755                 mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
1756
1757         if (!broadcast &&
1758 #ifdef CONFIG_P2P
1759             /* Invitation responses can be sent with the peer MAC as BSSID */
1760             !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
1761               stype == WLAN_FC_STYPE_ACTION) &&
1762 #endif /* CONFIG_P2P */
1763             os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
1764                 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
1765                            MAC2STR(mgmt->bssid));
1766                 return;
1767         }
1768
1769
1770         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
1771                 handle_probe_req(hapd, mgmt, len, fi->ssi_signal);
1772                 return;
1773         }
1774
1775         if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
1776                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1777                                HOSTAPD_LEVEL_DEBUG,
1778                                "MGMT: DA=" MACSTR " not our address",
1779                                MAC2STR(mgmt->da));
1780                 return;
1781         }
1782
1783         switch (stype) {
1784         case WLAN_FC_STYPE_AUTH:
1785                 wpa_printf(MSG_DEBUG, "mgmt::auth");
1786                 handle_auth(hapd, mgmt, len);
1787                 break;
1788         case WLAN_FC_STYPE_ASSOC_REQ:
1789                 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
1790                 handle_assoc(hapd, mgmt, len, 0);
1791                 break;
1792         case WLAN_FC_STYPE_REASSOC_REQ:
1793                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
1794                 handle_assoc(hapd, mgmt, len, 1);
1795                 break;
1796         case WLAN_FC_STYPE_DISASSOC:
1797                 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
1798                 handle_disassoc(hapd, mgmt, len);
1799                 break;
1800         case WLAN_FC_STYPE_DEAUTH:
1801                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
1802                 handle_deauth(hapd, mgmt, len);
1803                 break;
1804         case WLAN_FC_STYPE_ACTION:
1805                 wpa_printf(MSG_DEBUG, "mgmt::action");
1806                 handle_action(hapd, mgmt, len);
1807                 break;
1808         default:
1809                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1810                                HOSTAPD_LEVEL_DEBUG,
1811                                "unknown mgmt frame subtype %d", stype);
1812                 break;
1813         }
1814 }
1815
1816
1817 static void handle_auth_cb(struct hostapd_data *hapd,
1818                            const struct ieee80211_mgmt *mgmt,
1819                            size_t len, int ok)
1820 {
1821         u16 auth_alg, auth_transaction, status_code;
1822         struct sta_info *sta;
1823
1824         if (!ok) {
1825                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1826                                HOSTAPD_LEVEL_NOTICE,
1827                                "did not acknowledge authentication response");
1828                 return;
1829         }
1830
1831         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1832                 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
1833                            (unsigned long) len);
1834                 return;
1835         }
1836
1837         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1838         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1839         status_code = le_to_host16(mgmt->u.auth.status_code);
1840
1841         sta = ap_get_sta(hapd, mgmt->da);
1842         if (!sta) {
1843                 wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found",
1844                            MAC2STR(mgmt->da));
1845                 return;
1846         }
1847
1848         if (status_code == WLAN_STATUS_SUCCESS &&
1849             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
1850              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
1851                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1852                                HOSTAPD_LEVEL_INFO, "authenticated");
1853                 sta->flags |= WLAN_STA_AUTH;
1854         }
1855 }
1856
1857
1858 static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
1859                                        struct sta_info *sta,
1860                                        char *ifname_wds)
1861 {
1862         int i;
1863         struct hostapd_ssid *ssid = sta->ssid;
1864
1865         if (hapd->conf->ieee802_1x || hapd->conf->wpa)
1866                 return;
1867
1868         for (i = 0; i < 4; i++) {
1869                 if (ssid->wep.key[i] &&
1870                     hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
1871                                         i == ssid->wep.idx, NULL, 0,
1872                                         ssid->wep.key[i], ssid->wep.len[i])) {
1873                         wpa_printf(MSG_WARNING,
1874                                    "Could not set WEP keys for WDS interface; %s",
1875                                    ifname_wds);
1876                         break;
1877                 }
1878         }
1879 }
1880
1881
1882 static void handle_assoc_cb(struct hostapd_data *hapd,
1883                             const struct ieee80211_mgmt *mgmt,
1884                             size_t len, int reassoc, int ok)
1885 {
1886         u16 status;
1887         struct sta_info *sta;
1888         int new_assoc = 1;
1889         struct ieee80211_ht_capabilities ht_cap;
1890         struct ieee80211_vht_capabilities vht_cap;
1891
1892         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
1893                                       sizeof(mgmt->u.assoc_resp))) {
1894                 wpa_printf(MSG_INFO, "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
1895                            reassoc, (unsigned long) len);
1896                 return;
1897         }
1898
1899         sta = ap_get_sta(hapd, mgmt->da);
1900         if (!sta) {
1901                 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
1902                            MAC2STR(mgmt->da));
1903                 return;
1904         }
1905
1906         if (!ok) {
1907                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1908                                HOSTAPD_LEVEL_DEBUG,
1909                                "did not acknowledge association response");
1910                 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
1911                 return;
1912         }
1913
1914         if (reassoc)
1915                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
1916         else
1917                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
1918
1919         if (status != WLAN_STATUS_SUCCESS)
1920                 goto fail;
1921
1922         /* Stop previous accounting session, if one is started, and allocate
1923          * new session id for the new session. */
1924         accounting_sta_stop(hapd, sta);
1925
1926         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1927                        HOSTAPD_LEVEL_INFO,
1928                        "associated (aid %d)",
1929                        sta->aid);
1930
1931         if (sta->flags & WLAN_STA_ASSOC)
1932                 new_assoc = 0;
1933         sta->flags |= WLAN_STA_ASSOC;
1934         sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
1935         if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa) ||
1936             sta->auth_alg == WLAN_AUTH_FT) {
1937                 /*
1938                  * Open, static WEP, or FT protocol; no separate authorization
1939                  * step.
1940                  */
1941                 ap_sta_set_authorized(hapd, sta, 1);
1942         }
1943
1944         if (reassoc)
1945                 mlme_reassociate_indication(hapd, sta);
1946         else
1947                 mlme_associate_indication(hapd, sta);
1948
1949 #ifdef CONFIG_IEEE80211W
1950         sta->sa_query_timed_out = 0;
1951 #endif /* CONFIG_IEEE80211W */
1952
1953         /*
1954          * Remove the STA entry in order to make sure the STA PS state gets
1955          * cleared and configuration gets updated in case of reassociation back
1956          * to the same AP.
1957          */
1958         hostapd_drv_sta_remove(hapd, sta->addr);
1959
1960 #ifdef CONFIG_IEEE80211N
1961         if (sta->flags & WLAN_STA_HT)
1962                 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
1963 #endif /* CONFIG_IEEE80211N */
1964 #ifdef CONFIG_IEEE80211AC
1965         if (sta->flags & WLAN_STA_VHT)
1966                 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
1967 #endif /* CONFIG_IEEE80211AC */
1968
1969         if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
1970                             sta->supported_rates, sta->supported_rates_len,
1971                             sta->listen_interval,
1972                             sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
1973                             sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
1974                             sta->flags, sta->qosinfo)) {
1975                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1976                                HOSTAPD_LEVEL_NOTICE,
1977                                "Could not add STA to kernel driver");
1978
1979                 ap_sta_disconnect(hapd, sta, sta->addr,
1980                                   WLAN_REASON_DISASSOC_AP_BUSY);
1981
1982                 goto fail;
1983         }
1984
1985         if (sta->flags & WLAN_STA_WDS) {
1986                 int ret;
1987                 char ifname_wds[IFNAMSIZ + 1];
1988
1989                 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
1990                                           sta->aid, 1);
1991                 if (!ret)
1992                         hostapd_set_wds_encryption(hapd, sta, ifname_wds);
1993         }
1994
1995         if (sta->eapol_sm == NULL) {
1996                 /*
1997                  * This STA does not use RADIUS server for EAP authentication,
1998                  * so bind it to the selected VLAN interface now, since the
1999                  * interface selection is not going to change anymore.
2000                  */
2001                 if (ap_sta_bind_vlan(hapd, sta, 0) < 0)
2002                         goto fail;
2003         } else if (sta->vlan_id) {
2004                 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
2005                 if (ap_sta_bind_vlan(hapd, sta, 0) < 0)
2006                         goto fail;
2007         }
2008
2009         hostapd_set_sta_flags(hapd, sta);
2010
2011         if (sta->auth_alg == WLAN_AUTH_FT)
2012                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
2013         else
2014                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
2015         hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
2016
2017         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
2018
2019  fail:
2020         /* Copy of the association request is not needed anymore */
2021         if (sta->last_assoc_req) {
2022                 os_free(sta->last_assoc_req);
2023                 sta->last_assoc_req = NULL;
2024         }
2025 }
2026
2027
2028 static void handle_deauth_cb(struct hostapd_data *hapd,
2029                              const struct ieee80211_mgmt *mgmt,
2030                              size_t len, int ok)
2031 {
2032         struct sta_info *sta;
2033         if (mgmt->da[0] & 0x01)
2034                 return;
2035         sta = ap_get_sta(hapd, mgmt->da);
2036         if (!sta) {
2037                 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
2038                            " not found", MAC2STR(mgmt->da));
2039                 return;
2040         }
2041         if (ok)
2042                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
2043                            MAC2STR(sta->addr));
2044         else
2045                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2046                            "deauth", MAC2STR(sta->addr));
2047
2048         ap_sta_deauth_cb(hapd, sta);
2049 }
2050
2051
2052 static void handle_disassoc_cb(struct hostapd_data *hapd,
2053                                const struct ieee80211_mgmt *mgmt,
2054                                size_t len, int ok)
2055 {
2056         struct sta_info *sta;
2057         if (mgmt->da[0] & 0x01)
2058                 return;
2059         sta = ap_get_sta(hapd, mgmt->da);
2060         if (!sta) {
2061                 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
2062                            " not found", MAC2STR(mgmt->da));
2063                 return;
2064         }
2065         if (ok)
2066                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
2067                            MAC2STR(sta->addr));
2068         else
2069                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2070                            "disassoc", MAC2STR(sta->addr));
2071
2072         ap_sta_disassoc_cb(hapd, sta);
2073 }
2074
2075
2076 /**
2077  * ieee802_11_mgmt_cb - Process management frame TX status callback
2078  * @hapd: hostapd BSS data structure (the BSS from which the management frame
2079  * was sent from)
2080  * @buf: management frame data (starting from IEEE 802.11 header)
2081  * @len: length of frame data in octets
2082  * @stype: management frame subtype from frame control field
2083  * @ok: Whether the frame was ACK'ed
2084  */
2085 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
2086                         u16 stype, int ok)
2087 {
2088         const struct ieee80211_mgmt *mgmt;
2089         mgmt = (const struct ieee80211_mgmt *) buf;
2090
2091 #ifdef CONFIG_TESTING_OPTIONS
2092         if (hapd->ext_mgmt_frame_handling) {
2093                 wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-TX-STATUS stype=%u ok=%d",
2094                         stype, ok);
2095                 return;
2096         }
2097 #endif /* CONFIG_TESTING_OPTIONS */
2098
2099         switch (stype) {
2100         case WLAN_FC_STYPE_AUTH:
2101                 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
2102                 handle_auth_cb(hapd, mgmt, len, ok);
2103                 break;
2104         case WLAN_FC_STYPE_ASSOC_RESP:
2105                 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
2106                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
2107                 break;
2108         case WLAN_FC_STYPE_REASSOC_RESP:
2109                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
2110                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
2111                 break;
2112         case WLAN_FC_STYPE_PROBE_RESP:
2113                 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb");
2114                 break;
2115         case WLAN_FC_STYPE_DEAUTH:
2116                 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
2117                 handle_deauth_cb(hapd, mgmt, len, ok);
2118                 break;
2119         case WLAN_FC_STYPE_DISASSOC:
2120                 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
2121                 handle_disassoc_cb(hapd, mgmt, len, ok);
2122                 break;
2123         case WLAN_FC_STYPE_ACTION:
2124                 wpa_printf(MSG_DEBUG, "mgmt::action cb");
2125                 break;
2126         default:
2127                 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
2128                 break;
2129         }
2130 }
2131
2132
2133 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
2134 {
2135         /* TODO */
2136         return 0;
2137 }
2138
2139
2140 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
2141                            char *buf, size_t buflen)
2142 {
2143         /* TODO */
2144         return 0;
2145 }
2146
2147
2148 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
2149                        const u8 *buf, size_t len, int ack)
2150 {
2151         struct sta_info *sta;
2152         struct hostapd_iface *iface = hapd->iface;
2153
2154         sta = ap_get_sta(hapd, addr);
2155         if (sta == NULL && iface->num_bss > 1) {
2156                 size_t j;
2157                 for (j = 0; j < iface->num_bss; j++) {
2158                         hapd = iface->bss[j];
2159                         sta = ap_get_sta(hapd, addr);
2160                         if (sta)
2161                                 break;
2162                 }
2163         }
2164         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
2165                 return;
2166         if (sta->flags & WLAN_STA_PENDING_POLL) {
2167                 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
2168                            "activity poll", MAC2STR(sta->addr),
2169                            ack ? "ACKed" : "did not ACK");
2170                 if (ack)
2171                         sta->flags &= ~WLAN_STA_PENDING_POLL;
2172         }
2173
2174         ieee802_1x_tx_status(hapd, sta, buf, len, ack);
2175 }
2176
2177
2178 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
2179                              const u8 *data, size_t len, int ack)
2180 {
2181         struct sta_info *sta;
2182         struct hostapd_iface *iface = hapd->iface;
2183
2184         sta = ap_get_sta(hapd, dst);
2185         if (sta == NULL && iface->num_bss > 1) {
2186                 size_t j;
2187                 for (j = 0; j < iface->num_bss; j++) {
2188                         hapd = iface->bss[j];
2189                         sta = ap_get_sta(hapd, dst);
2190                         if (sta)
2191                                 break;
2192                 }
2193         }
2194         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
2195                 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
2196                            MACSTR " that is not currently associated",
2197                            MAC2STR(dst));
2198                 return;
2199         }
2200
2201         ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
2202 }
2203
2204
2205 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
2206 {
2207         struct sta_info *sta;
2208         struct hostapd_iface *iface = hapd->iface;
2209
2210         sta = ap_get_sta(hapd, addr);
2211         if (sta == NULL && iface->num_bss > 1) {
2212                 size_t j;
2213                 for (j = 0; j < iface->num_bss; j++) {
2214                         hapd = iface->bss[j];
2215                         sta = ap_get_sta(hapd, addr);
2216                         if (sta)
2217                                 break;
2218                 }
2219         }
2220         if (sta == NULL)
2221                 return;
2222         if (!(sta->flags & WLAN_STA_PENDING_POLL))
2223                 return;
2224
2225         wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
2226                    "activity poll", MAC2STR(sta->addr));
2227         sta->flags &= ~WLAN_STA_PENDING_POLL;
2228 }
2229
2230
2231 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
2232                                 int wds)
2233 {
2234         struct sta_info *sta;
2235
2236         sta = ap_get_sta(hapd, src);
2237         if (sta && (sta->flags & WLAN_STA_ASSOC)) {
2238                 if (!hapd->conf->wds_sta)
2239                         return;
2240
2241                 if (wds && !(sta->flags & WLAN_STA_WDS)) {
2242                         int ret;
2243                         char ifname_wds[IFNAMSIZ + 1];
2244
2245                         wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
2246                                    "STA " MACSTR " (aid %u)",
2247                                    MAC2STR(sta->addr), sta->aid);
2248                         sta->flags |= WLAN_STA_WDS;
2249                         ret = hostapd_set_wds_sta(hapd, ifname_wds,
2250                                                   sta->addr, sta->aid, 1);
2251                         if (!ret)
2252                                 hostapd_set_wds_encryption(hapd, sta,
2253                                                            ifname_wds);
2254                 }
2255                 return;
2256         }
2257
2258         wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
2259                    MACSTR, MAC2STR(src));
2260         if (src[0] & 0x01) {
2261                 /* Broadcast bit set in SA?! Ignore the frame silently. */
2262                 return;
2263         }
2264
2265         if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
2266                 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
2267                            "already been sent, but no TX status yet known - "
2268                            "ignore Class 3 frame issue with " MACSTR,
2269                            MAC2STR(src));
2270                 return;
2271         }
2272
2273         if (sta && (sta->flags & WLAN_STA_AUTH))
2274                 hostapd_drv_sta_disassoc(
2275                         hapd, src,
2276                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
2277         else
2278                 hostapd_drv_sta_deauth(
2279                         hapd, src,
2280                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
2281 }
2282
2283
2284 #endif /* CONFIG_NATIVE_WINDOWS */