www.project-moonshot.org Git - mech_eap.orig/blob - src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2010, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  *
  13  * Alternatively, this software may be distributed under the terms of BSD
  14  * license.
  15  *
  16  * See README and COPYING for more details.
  17  */
  18
  19 #include "includes.h"
  20 #include <sys/ioctl.h>
  21 #include <net/if.h>
  22 #include <netlink/genl/genl.h>
  23 #include <netlink/genl/family.h>
  24 #include <netlink/genl/ctrl.h>
  25 #include <netpacket/packet.h>
  26 #include <linux/filter.h>
  27 #include "nl80211_copy.h"
  28
  29 #include "common.h"
  30 #include "eloop.h"
  31 #include "common/ieee802_11_defs.h"
  32 #include "netlink.h"
  33 #include "linux_ioctl.h"
  34 #include "radiotap.h"
  35 #include "radiotap_iter.h"
  36 #include "rfkill.h"
  37 #include "driver.h"
  38
  39 #ifdef CONFIG_LIBNL20
  40 /* libnl 2.0 compatibility code */
  41 #define nl_handle nl_sock
  42 #define nl_handle_alloc_cb nl_socket_alloc_cb
  43 #define nl_handle_destroy nl_socket_free
  44 #endif /* CONFIG_LIBNL20 */
  45
  46
  47 #ifndef IFF_LOWER_UP
  48 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
  49 #endif
  50 #ifndef IFF_DORMANT
  51 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
  52 #endif
  53
  54 #ifndef IF_OPER_DORMANT
  55 #define IF_OPER_DORMANT 5
  56 #endif
  57 #ifndef IF_OPER_UP
  58 #define IF_OPER_UP 6
  59 #endif
  60
  61 struct i802_bss {
  62         struct wpa_driver_nl80211_data *drv;
  63         struct i802_bss *next;
  64         int ifindex;
  65         char ifname[IFNAMSIZ + 1];
  66         unsigned int beacon_set:1;
  67 };
  68
  69 struct wpa_driver_nl80211_data {
  70         void *ctx;
  71         struct netlink_data *netlink;
  72         int ioctl_sock; /* socket for ioctl() use */
  73         char brname[IFNAMSIZ];
  74         int ifindex;
  75         int if_removed;
  76         int if_disabled;
  77         struct rfkill_data *rfkill;
  78         struct wpa_driver_capa capa;
  79         int has_capability;
  80
  81         int operstate;
  82
  83         int scan_complete_events;
  84
  85         struct nl_handle *nl_handle;
  86         struct nl_handle *nl_handle_event;
  87         struct nl_cache *nl_cache;
  88         struct nl_cache *nl_cache_event;
  89         struct nl_cb *nl_cb;
  90         struct genl_family *nl80211;
  91
  92         u8 auth_bssid[ETH_ALEN];
  93         u8 bssid[ETH_ALEN];
  94         int associated;
  95         u8 ssid[32];
  96         size_t ssid_len;
  97         int nlmode;
  98         int ap_scan_as_station;
  99         unsigned int assoc_freq;
 100
 101         int monitor_sock;
 102         int monitor_ifidx;
 103         int probe_req_report;
 104         int disable_11b_rates;
 105
 106         unsigned int pending_remain_on_chan:1;
 107         unsigned int added_bridge:1;
 108         unsigned int added_if_into_bridge:1;
 109
 110         u64 remain_on_chan_cookie;
 111         u64 send_action_cookie;
 112
 113         struct wpa_driver_scan_filter *filter_ssids;
 114         size_t num_filter_ssids;
 115
 116         struct i802_bss first_bss;
 117
 118 #ifdef HOSTAPD
 119         int eapol_sock; /* socket for EAPOL frames */
 120
 121         int default_if_indices[16];
 122         int *if_indices;
 123         int num_if_indices;
 124
 125         int last_freq;
 126         int last_freq_ht;
 127 #endif /* HOSTAPD */
 128 };
 129
 130
 131 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 132                                             void *timeout_ctx);
 133 static int wpa_driver_nl80211_set_mode(void *priv, int mode);
 134 static int
 135 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 136 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 137                                    const u8 *addr, int cmd, u16 reason_code,
 138                                    int local_state_change);
 139 static void nl80211_remove_monitor_interface(
 140         struct wpa_driver_nl80211_data *drv);
 141
 142 #ifdef HOSTAPD
 143 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 144 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 145 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 146 static int wpa_driver_nl80211_if_remove(void *priv,
 147                                         enum wpa_driver_if_type type,
 148                                         const char *ifname);
 149 #else /* HOSTAPD */
 150 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 151 {
 152         return 0;
 153 }
 154 #endif /* HOSTAPD */
 155
 156 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 157 static void wpa_driver_nl80211_probe_req_report_timeout(void *eloop_ctx,
 158                                                         void *timeout_ctx);
 159 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 160                                      int ifindex, int disabled);
 161
 162
 163 /* nl80211 code */
 164 static int ack_handler(struct nl_msg *msg, void *arg)
 165 {
 166         int *err = arg;
 167         *err = 0;
 168         return NL_STOP;
 169 }
 170
 171 static int finish_handler(struct nl_msg *msg, void *arg)
 172 {
 173         int *ret = arg;
 174         *ret = 0;
 175         return NL_SKIP;
 176 }
 177
 178 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 179                          void *arg)
 180 {
 181         int *ret = arg;
 182         *ret = err->error;
 183         return NL_SKIP;
 184 }
 185
 186
 187 static int no_seq_check(struct nl_msg *msg, void *arg)
 188 {
 189         return NL_OK;
 190 }
 191
 192
 193 static int send_and_recv(struct wpa_driver_nl80211_data *drv,
 194                          struct nl_handle *nl_handle, struct nl_msg *msg,
 195                          int (*valid_handler)(struct nl_msg *, void *),
 196                          void *valid_data)
 197 {
 198         struct nl_cb *cb;
 199         int err = -ENOMEM;
 200
 201         cb = nl_cb_clone(drv->nl_cb);
 202         if (!cb)
 203                 goto out;
 204
 205         err = nl_send_auto_complete(nl_handle, msg);
 206         if (err < 0)
 207                 goto out;
 208
 209         err = 1;
 210
 211         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 212         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 213         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 214
 215         if (valid_handler)
 216                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 217                           valid_handler, valid_data);
 218
 219         while (err > 0)
 220                 nl_recvmsgs(nl_handle, cb);
 221  out:
 222         nl_cb_put(cb);
 223         nlmsg_free(msg);
 224         return err;
 225 }
 226
 227
 228 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 229                               struct nl_msg *msg,
 230                               int (*valid_handler)(struct nl_msg *, void *),
 231                               void *valid_data)
 232 {
 233         return send_and_recv(drv, drv->nl_handle, msg, valid_handler,
 234                              valid_data);
 235 }
 236
 237
 238 struct family_data {
 239         const char *group;
 240         int id;
 241 };
 242
 243
 244 static int family_handler(struct nl_msg *msg, void *arg)
 245 {
 246         struct family_data *res = arg;
 247         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 248         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 249         struct nlattr *mcgrp;
 250         int i;
 251
 252         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 253                   genlmsg_attrlen(gnlh, 0), NULL);
 254         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 255                 return NL_SKIP;
 256
 257         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 258                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 259                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 260                           nla_len(mcgrp), NULL);
 261                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 262                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 263                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 264                                res->group,
 265                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 266                         continue;
 267                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 268                 break;
 269         };
 270
 271         return NL_SKIP;
 272 }
 273
 274
 275 static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv,
 276                                const char *family, const char *group)
 277 {
 278         struct nl_msg *msg;
 279         int ret = -1;
 280         struct family_data res = { group, -ENOENT };
 281
 282         msg = nlmsg_alloc();
 283         if (!msg)
 284                 return -ENOMEM;
 285         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"),
 286                     0, 0, CTRL_CMD_GETFAMILY, 0);
 287         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 288
 289         ret = send_and_recv_msgs(drv, msg, family_handler, &res);
 290         msg = NULL;
 291         if (ret == 0)
 292                 ret = res.id;
 293
 294 nla_put_failure:
 295         nlmsg_free(msg);
 296         return ret;
 297 }
 298
 299
 300 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 301 {
 302         struct i802_bss *bss = priv;
 303         struct wpa_driver_nl80211_data *drv = bss->drv;
 304         if (!drv->associated)
 305                 return -1;
 306         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 307         return 0;
 308 }
 309
 310
 311 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 312 {
 313         struct i802_bss *bss = priv;
 314         struct wpa_driver_nl80211_data *drv = bss->drv;
 315         if (!drv->associated)
 316                 return -1;
 317         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 318         return drv->ssid_len;
 319 }
 320
 321
 322 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 323                                           char *buf, size_t len, int del)
 324 {
 325         union wpa_event_data event;
 326
 327         os_memset(&event, 0, sizeof(event));
 328         if (len > sizeof(event.interface_status.ifname))
 329                 len = sizeof(event.interface_status.ifname) - 1;
 330         os_memcpy(event.interface_status.ifname, buf, len);
 331         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 332                 EVENT_INTERFACE_ADDED;
 333
 334         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 335                    del ? "DEL" : "NEW",
 336                    event.interface_status.ifname,
 337                    del ? "removed" : "added");
 338
 339         if (os_strcmp(drv->first_bss.ifname, event.interface_status.ifname) == 0) {
 340                 if (del)
 341                         drv->if_removed = 1;
 342                 else
 343                         drv->if_removed = 0;
 344         }
 345
 346         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 347 }
 348
 349
 350 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 351                                          u8 *buf, size_t len)
 352 {
 353         int attrlen, rta_len;
 354         struct rtattr *attr;
 355
 356         attrlen = len;
 357         attr = (struct rtattr *) buf;
 358
 359         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 360         while (RTA_OK(attr, attrlen)) {
 361                 if (attr->rta_type == IFLA_IFNAME) {
 362                         if (os_strcmp(((char *) attr) + rta_len, drv->first_bss.ifname)
 363                             == 0)
 364                                 return 1;
 365                         else
 366                                 break;
 367                 }
 368                 attr = RTA_NEXT(attr, attrlen);
 369         }
 370
 371         return 0;
 372 }
 373
 374
 375 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 376                                           int ifindex, u8 *buf, size_t len)
 377 {
 378         if (drv->ifindex == ifindex)
 379                 return 1;
 380
 381         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 382                 drv->first_bss.ifindex = if_nametoindex(drv->first_bss.ifname);
 383                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 384                            "interface");
 385                 wpa_driver_nl80211_finish_drv_init(drv);
 386                 return 1;
 387         }
 388
 389         return 0;
 390 }
 391
 392
 393 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 394                                                  struct ifinfomsg *ifi,
 395                                                  u8 *buf, size_t len)
 396 {
 397         struct wpa_driver_nl80211_data *drv = ctx;
 398         int attrlen, rta_len;
 399         struct rtattr *attr;
 400         u32 brid = 0;
 401
 402         if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, buf, len) &&
 403             !have_ifidx(drv, ifi->ifi_index)) {
 404                 wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign "
 405                            "ifindex %d", ifi->ifi_index);
 406                 return;
 407         }
 408
 409         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 410                    "(%s%s%s%s)",
 411                    drv->operstate, ifi->ifi_flags,
 412                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 413                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 414                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 415                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 416
 417         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 418                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
 419                 drv->if_disabled = 1;
 420                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_DISABLED, NULL);
 421         }
 422
 423         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 424                 wpa_printf(MSG_DEBUG, "nl80211: Interface up");
 425                 drv->if_disabled = 0;
 426                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED, NULL);
 427         }
 428
 429         /*
 430          * Some drivers send the association event before the operup event--in
 431          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 432          * fails. This will hit us when wpa_supplicant does not need to do
 433          * IEEE 802.1X authentication
 434          */
 435         if (drv->operstate == 1 &&
 436             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 437             !(ifi->ifi_flags & IFF_RUNNING))
 438                 netlink_send_oper_ifla(drv->netlink, drv->ifindex,
 439                                        -1, IF_OPER_UP);
 440
 441         attrlen = len;
 442         attr = (struct rtattr *) buf;
 443         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 444         while (RTA_OK(attr, attrlen)) {
 445                 if (attr->rta_type == IFLA_IFNAME) {
 446                         wpa_driver_nl80211_event_link(
 447                                 drv,
 448                                 ((char *) attr) + rta_len,
 449                                 attr->rta_len - rta_len, 0);
 450                 } else if (attr->rta_type == IFLA_MASTER)
 451                         brid = nla_get_u32((struct nlattr *) attr);
 452                 attr = RTA_NEXT(attr, attrlen);
 453         }
 454
 455 #ifdef HOSTAPD
 456         if (ifi->ifi_family == AF_BRIDGE && brid) {
 457                 /* device has been added to bridge */
 458                 char namebuf[IFNAMSIZ];
 459                 if_indextoname(brid, namebuf);
 460                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
 461                            brid, namebuf);
 462                 add_ifidx(drv, brid);
 463         }
 464 #endif /* HOSTAPD */
 465 }
 466
 467
 468 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
 469                                                  struct ifinfomsg *ifi,
 470                                                  u8 *buf, size_t len)
 471 {
 472         struct wpa_driver_nl80211_data *drv = ctx;
 473         int attrlen, rta_len;
 474         struct rtattr *attr;
 475         u32 brid = 0;
 476
 477         attrlen = len;
 478         attr = (struct rtattr *) buf;
 479
 480         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 481         while (RTA_OK(attr, attrlen)) {
 482                 if (attr->rta_type == IFLA_IFNAME) {
 483                         wpa_driver_nl80211_event_link(
 484                                 drv,
 485                                 ((char *) attr) + rta_len,
 486                                 attr->rta_len - rta_len, 1);
 487                 } else if (attr->rta_type == IFLA_MASTER)
 488                         brid = nla_get_u32((struct nlattr *) attr);
 489                 attr = RTA_NEXT(attr, attrlen);
 490         }
 491
 492 #ifdef HOSTAPD
 493         if (ifi->ifi_family == AF_BRIDGE && brid) {
 494                 /* device has been removed from bridge */
 495                 char namebuf[IFNAMSIZ];
 496                 if_indextoname(brid, namebuf);
 497                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
 498                            "%s", brid, namebuf);
 499                 del_ifidx(drv, brid);
 500         }
 501 #endif /* HOSTAPD */
 502 }
 503
 504
 505 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
 506                             const u8 *frame, size_t len)
 507 {
 508         const struct ieee80211_mgmt *mgmt;
 509         union wpa_event_data event;
 510
 511         mgmt = (const struct ieee80211_mgmt *) frame;
 512         if (len < 24 + sizeof(mgmt->u.auth)) {
 513                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 514                            "frame");
 515                 return;
 516         }
 517
 518         os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
 519         os_memset(&event, 0, sizeof(event));
 520         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
 521         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
 522         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
 523         if (len > 24 + sizeof(mgmt->u.auth)) {
 524                 event.auth.ies = mgmt->u.auth.variable;
 525                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
 526         }
 527
 528         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
 529 }
 530
 531
 532 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
 533                             const u8 *frame, size_t len)
 534 {
 535         const struct ieee80211_mgmt *mgmt;
 536         union wpa_event_data event;
 537         u16 status;
 538
 539         mgmt = (const struct ieee80211_mgmt *) frame;
 540         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
 541                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 542                            "frame");
 543                 return;
 544         }
 545
 546         status = le_to_host16(mgmt->u.assoc_resp.status_code);
 547         if (status != WLAN_STATUS_SUCCESS) {
 548                 os_memset(&event, 0, sizeof(event));
 549                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 550                         event.assoc_reject.resp_ies =
 551                                 (u8 *) mgmt->u.assoc_resp.variable;
 552                         event.assoc_reject.resp_ies_len =
 553                                 len - 24 - sizeof(mgmt->u.assoc_resp);
 554                 }
 555                 event.assoc_reject.status_code = status;
 556
 557                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
 558                 return;
 559         }
 560
 561         drv->associated = 1;
 562         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
 563
 564         os_memset(&event, 0, sizeof(event));
 565         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 566                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
 567                 event.assoc_info.resp_ies_len =
 568                         len - 24 - sizeof(mgmt->u.assoc_resp);
 569         }
 570
 571         event.assoc_info.freq = drv->assoc_freq;
 572
 573         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
 574 }
 575
 576
 577 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
 578                                enum nl80211_commands cmd, struct nlattr *status,
 579                                struct nlattr *addr, struct nlattr *req_ie,
 580                                struct nlattr *resp_ie)
 581 {
 582         union wpa_event_data event;
 583
 584         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
 585                 /*
 586                  * Avoid reporting two association events that would confuse
 587                  * the core code.
 588                  */
 589                 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
 590                            "when using userspace SME", cmd);
 591                 return;
 592         }
 593
 594         os_memset(&event, 0, sizeof(event));
 595         if (cmd == NL80211_CMD_CONNECT &&
 596             nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
 597                 if (resp_ie) {
 598                         event.assoc_reject.resp_ies = nla_data(resp_ie);
 599                         event.assoc_reject.resp_ies_len = nla_len(resp_ie);
 600                 }
 601                 event.assoc_reject.status_code = nla_get_u16(status);
 602                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
 603                 return;
 604         }
 605
 606         drv->associated = 1;
 607         if (addr)
 608                 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
 609
 610         if (req_ie) {
 611                 event.assoc_info.req_ies = nla_data(req_ie);
 612                 event.assoc_info.req_ies_len = nla_len(req_ie);
 613         }
 614         if (resp_ie) {
 615                 event.assoc_info.resp_ies = nla_data(resp_ie);
 616                 event.assoc_info.resp_ies_len = nla_len(resp_ie);
 617         }
 618
 619         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
 620 }
 621
 622
 623 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
 624                                enum nl80211_commands cmd, struct nlattr *addr)
 625 {
 626         union wpa_event_data event;
 627         enum wpa_event_type ev;
 628
 629         if (nla_len(addr) != ETH_ALEN)
 630                 return;
 631
 632         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
 633                    cmd, MAC2STR((u8 *) nla_data(addr)));
 634
 635         if (cmd == NL80211_CMD_AUTHENTICATE)
 636                 ev = EVENT_AUTH_TIMED_OUT;
 637         else if (cmd == NL80211_CMD_ASSOCIATE)
 638                 ev = EVENT_ASSOC_TIMED_OUT;
 639         else
 640                 return;
 641
 642         os_memset(&event, 0, sizeof(event));
 643         os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
 644         wpa_supplicant_event(drv->ctx, ev, &event);
 645 }
 646
 647
 648 static void mlme_event_action(struct wpa_driver_nl80211_data *drv,
 649                               struct nlattr *freq, const u8 *frame, size_t len)
 650 {
 651         const struct ieee80211_mgmt *mgmt;
 652         union wpa_event_data event;
 653         u16 fc, stype;
 654
 655         mgmt = (const struct ieee80211_mgmt *) frame;
 656         if (len < 24) {
 657                 wpa_printf(MSG_DEBUG, "nl80211: Too short action frame");
 658                 return;
 659         }
 660
 661         fc = le_to_host16(mgmt->frame_control);
 662         stype = WLAN_FC_GET_STYPE(fc);
 663
 664         os_memset(&event, 0, sizeof(event));
 665         event.rx_action.da = mgmt->da;
 666         event.rx_action.sa = mgmt->sa;
 667         event.rx_action.bssid = mgmt->bssid;
 668         event.rx_action.category = mgmt->u.action.category;
 669         event.rx_action.data = &mgmt->u.action.category + 1;
 670         event.rx_action.len = frame + len - event.rx_action.data;
 671         if (freq)
 672                 event.rx_action.freq = nla_get_u32(freq);
 673         wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
 674 }
 675
 676
 677 static void mlme_event_action_tx_status(struct wpa_driver_nl80211_data *drv,
 678                                         struct nlattr *cookie, const u8 *frame,
 679                                         size_t len, struct nlattr *ack)
 680 {
 681         union wpa_event_data event;
 682         const struct ieee80211_hdr *hdr;
 683         u16 fc;
 684         u64 cookie_val;
 685
 686         if (!cookie)
 687                 return;
 688
 689         cookie_val = nla_get_u64(cookie);
 690         wpa_printf(MSG_DEBUG, "nl80211: Action TX status: cookie=0%llx%s "
 691                    "(ack=%d)",
 692                    (long long unsigned int) cookie_val,
 693                    cookie_val == drv->send_action_cookie ?
 694                    " (match)" : " (unknown)", ack != NULL);
 695         if (cookie_val != drv->send_action_cookie)
 696                 return;
 697
 698         hdr = (const struct ieee80211_hdr *) frame;
 699         fc = le_to_host16(hdr->frame_control);
 700
 701         os_memset(&event, 0, sizeof(event));
 702         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
 703         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
 704         event.tx_status.dst = hdr->addr1;
 705         event.tx_status.data = frame;
 706         event.tx_status.data_len = len;
 707         event.tx_status.ack = ack != NULL;
 708         wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
 709 }
 710
 711
 712 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
 713                                        enum wpa_event_type type,
 714                                        const u8 *frame, size_t len)
 715 {
 716         const struct ieee80211_mgmt *mgmt;
 717         union wpa_event_data event;
 718         const u8 *bssid = NULL;
 719         u16 reason_code = 0;
 720
 721         mgmt = (const struct ieee80211_mgmt *) frame;
 722         if (len >= 24) {
 723                 bssid = mgmt->bssid;
 724
 725                 if (drv->associated != 0 &&
 726                     os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
 727                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
 728                         /*
 729                          * We have presumably received this deauth as a
 730                          * response to a clear_state_mismatch() outgoing
 731                          * deauth.  Don't let it take us offline!
 732                          */
 733                         wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
 734                                    "from Unknown BSSID " MACSTR " -- ignoring",
 735                                    MAC2STR(bssid));
 736                         return;
 737                 }
 738         }
 739
 740         drv->associated = 0;
 741         os_memset(&event, 0, sizeof(event));
 742
 743         /* Note: Same offset for Reason Code in both frame subtypes */
 744         if (len >= 24 + sizeof(mgmt->u.deauth))
 745                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
 746
 747         if (type == EVENT_DISASSOC) {
 748                 event.disassoc_info.addr = bssid;
 749                 event.disassoc_info.reason_code = reason_code;
 750         } else {
 751                 event.deauth_info.addr = bssid;
 752                 event.deauth_info.reason_code = reason_code;
 753         }
 754
 755         wpa_supplicant_event(drv->ctx, type, &event);
 756 }
 757
 758
 759 static void mlme_event(struct wpa_driver_nl80211_data *drv,
 760                        enum nl80211_commands cmd, struct nlattr *frame,
 761                        struct nlattr *addr, struct nlattr *timed_out,
 762                        struct nlattr *freq, struct nlattr *ack,
 763                        struct nlattr *cookie)
 764 {
 765         if (timed_out && addr) {
 766                 mlme_timeout_event(drv, cmd, addr);
 767                 return;
 768         }
 769
 770         if (frame == NULL) {
 771                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
 772                            "data", cmd);
 773                 return;
 774         }
 775
 776         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
 777         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
 778                     nla_data(frame), nla_len(frame));
 779
 780         switch (cmd) {
 781         case NL80211_CMD_AUTHENTICATE:
 782                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
 783                 break;
 784         case NL80211_CMD_ASSOCIATE:
 785                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
 786                 break;
 787         case NL80211_CMD_DEAUTHENTICATE:
 788                 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
 789                                            nla_data(frame), nla_len(frame));
 790                 break;
 791         case NL80211_CMD_DISASSOCIATE:
 792                 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
 793                                            nla_data(frame), nla_len(frame));
 794                 break;
 795         case NL80211_CMD_ACTION:
 796                 mlme_event_action(drv, freq, nla_data(frame), nla_len(frame));
 797                 break;
 798         case NL80211_CMD_ACTION_TX_STATUS:
 799                 mlme_event_action_tx_status(drv, cookie, nla_data(frame),
 800                                             nla_len(frame), ack);
 801                 break;
 802         default:
 803                 break;
 804         }
 805 }
 806
 807
 808 static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv,
 809                                            struct nlattr *tb[])
 810 {
 811         union wpa_event_data data;
 812
 813         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
 814         os_memset(&data, 0, sizeof(data));
 815         if (tb[NL80211_ATTR_MAC]) {
 816                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
 817                             nla_data(tb[NL80211_ATTR_MAC]),
 818                             nla_len(tb[NL80211_ATTR_MAC]));
 819                 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
 820         }
 821         if (tb[NL80211_ATTR_KEY_SEQ]) {
 822                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
 823                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
 824                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
 825         }
 826         if (tb[NL80211_ATTR_KEY_TYPE]) {
 827                 enum nl80211_key_type key_type =
 828                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
 829                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
 830                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
 831                         data.michael_mic_failure.unicast = 1;
 832         } else
 833                 data.michael_mic_failure.unicast = 1;
 834
 835         if (tb[NL80211_ATTR_KEY_IDX]) {
 836                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
 837                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
 838         }
 839
 840         wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
 841 }
 842
 843
 844 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
 845                                  struct nlattr *tb[])
 846 {
 847         if (tb[NL80211_ATTR_MAC] == NULL) {
 848                 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
 849                            "event");
 850                 return;
 851         }
 852         os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
 853         drv->associated = 1;
 854         wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
 855                    MAC2STR(drv->bssid));
 856
 857         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
 858 }
 859
 860
 861 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
 862                                          int cancel_event, struct nlattr *tb[])
 863 {
 864         unsigned int freq, chan_type, duration;
 865         union wpa_event_data data;
 866         u64 cookie;
 867
 868         if (tb[NL80211_ATTR_WIPHY_FREQ])
 869                 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
 870         else
 871                 freq = 0;
 872
 873         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
 874                 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 875         else
 876                 chan_type = 0;
 877
 878         if (tb[NL80211_ATTR_DURATION])
 879                 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
 880         else
 881                 duration = 0;
 882
 883         if (tb[NL80211_ATTR_COOKIE])
 884                 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
 885         else
 886                 cookie = 0;
 887
 888         wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
 889                    "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
 890                    cancel_event, freq, chan_type, duration,
 891                    (long long unsigned int) cookie,
 892                    cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
 893
 894         if (cookie != drv->remain_on_chan_cookie)
 895                 return; /* not for us */
 896
 897         drv->pending_remain_on_chan = !cancel_event;
 898
 899         os_memset(&data, 0, sizeof(data));
 900         data.remain_on_channel.freq = freq;
 901         data.remain_on_channel.duration = duration;
 902         wpa_supplicant_event(drv->ctx, cancel_event ?
 903                              EVENT_CANCEL_REMAIN_ON_CHANNEL :
 904                              EVENT_REMAIN_ON_CHANNEL, &data);
 905 }
 906
 907
 908 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
 909                             struct nlattr *tb[])
 910 {
 911         union wpa_event_data event;
 912         struct nlattr *nl;
 913         int rem;
 914         struct scan_info *info;
 915 #define MAX_REPORT_FREQS 50
 916         int freqs[MAX_REPORT_FREQS];
 917         int num_freqs = 0;
 918
 919         os_memset(&event, 0, sizeof(event));
 920         info = &event.scan_info;
 921         info->aborted = aborted;
 922
 923         if (tb[NL80211_ATTR_SCAN_SSIDS]) {
 924                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
 925                         struct wpa_driver_scan_ssid *s =
 926                                 &info->ssids[info->num_ssids];
 927                         s->ssid = nla_data(nl);
 928                         s->ssid_len = nla_len(nl);
 929                         info->num_ssids++;
 930                         if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
 931                                 break;
 932                 }
 933         }
 934         if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
 935                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
 936                 {
 937                         freqs[num_freqs] = nla_get_u32(nl);
 938                         num_freqs++;
 939                         if (num_freqs == MAX_REPORT_FREQS - 1)
 940                                 break;
 941                 }
 942                 info->freqs = freqs;
 943                 info->num_freqs = num_freqs;
 944         }
 945         wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
 946 }
 947
 948
 949 static int get_link_signal(struct nl_msg *msg, void *arg)
 950 {
 951         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 952         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 953         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
 954         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
 955                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
 956         };
 957         int *sig = arg;
 958
 959         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 960                   genlmsg_attrlen(gnlh, 0), NULL);
 961         if (!tb[NL80211_ATTR_STA_INFO] ||
 962             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
 963                              tb[NL80211_ATTR_STA_INFO], policy))
 964                 return NL_SKIP;
 965         if (!sinfo[NL80211_STA_INFO_SIGNAL])
 966                 return NL_SKIP;
 967
 968         *sig = (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
 969         return NL_SKIP;
 970 }
 971
 972
 973 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
 974                                    int *sig)
 975 {
 976         struct nl_msg *msg;
 977
 978         *sig = -9999;
 979
 980         msg = nlmsg_alloc();
 981         if (!msg)
 982                 return -ENOMEM;
 983
 984         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 985                     0, NL80211_CMD_GET_STATION, 0);
 986
 987         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 988         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
 989
 990         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
 991  nla_put_failure:
 992         return -ENOBUFS;
 993 }
 994
 995
 996 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
 997                               struct nlattr *tb[])
 998 {
 999         static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
1000                 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
1001                 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
1002                 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
1003         };
1004         struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
1005         enum nl80211_cqm_rssi_threshold_event event;
1006         union wpa_event_data ed;
1007         int sig, res;
1008
1009         if (tb[NL80211_ATTR_CQM] == NULL ||
1010             nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
1011                              cqm_policy)) {
1012                 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
1013                 return;
1014         }
1015
1016         if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
1017                 return;
1018         event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
1019
1020         os_memset(&ed, 0, sizeof(ed));
1021
1022         if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
1023                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1024                            "event: RSSI high");
1025                 ed.signal_change.above_threshold = 1;
1026         } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
1027                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1028                            "event: RSSI low");
1029                 ed.signal_change.above_threshold = 0;
1030         } else
1031                 return;
1032
1033         res = nl80211_get_link_signal(drv, &sig);
1034         if (res == 0) {
1035                 ed.signal_change.current_signal = sig;
1036                 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm", sig);
1037         }
1038
1039         wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
1040 }
1041
1042
1043 static int process_event(struct nl_msg *msg, void *arg)
1044 {
1045         struct wpa_driver_nl80211_data *drv = arg;
1046         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1047         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1048         union wpa_event_data data;
1049
1050         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1051                   genlmsg_attrlen(gnlh, 0), NULL);
1052
1053         if (tb[NL80211_ATTR_IFINDEX]) {
1054                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1055                 if (ifindex != drv->ifindex && !have_ifidx(drv, ifindex)) {
1056                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
1057                                    " for foreign interface (ifindex %d)",
1058                                    gnlh->cmd, ifindex);
1059                         return NL_SKIP;
1060                 }
1061         }
1062
1063         if (drv->ap_scan_as_station &&
1064             (gnlh->cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
1065              gnlh->cmd == NL80211_CMD_SCAN_ABORTED)) {
1066                 wpa_driver_nl80211_set_mode(&drv->first_bss,
1067                                             IEEE80211_MODE_AP);
1068                 drv->ap_scan_as_station = 0;
1069         }
1070
1071         switch (gnlh->cmd) {
1072         case NL80211_CMD_TRIGGER_SCAN:
1073                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger");
1074                 break;
1075         case NL80211_CMD_NEW_SCAN_RESULTS:
1076                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
1077                 drv->scan_complete_events = 1;
1078                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
1079                                      drv->ctx);
1080                 send_scan_event(drv, 0, tb);
1081                 break;
1082         case NL80211_CMD_SCAN_ABORTED:
1083                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
1084                 /*
1085                  * Need to indicate that scan results are available in order
1086                  * not to make wpa_supplicant stop its scanning.
1087                  */
1088                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
1089                                      drv->ctx);
1090                 send_scan_event(drv, 1, tb);
1091                 break;
1092         case NL80211_CMD_AUTHENTICATE:
1093         case NL80211_CMD_ASSOCIATE:
1094         case NL80211_CMD_DEAUTHENTICATE:
1095         case NL80211_CMD_DISASSOCIATE:
1096         case NL80211_CMD_ACTION:
1097         case NL80211_CMD_ACTION_TX_STATUS:
1098                 mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME],
1099                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
1100                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
1101                            tb[NL80211_ATTR_COOKIE]);
1102                 break;
1103         case NL80211_CMD_CONNECT:
1104         case NL80211_CMD_ROAM:
1105                 mlme_event_connect(drv, gnlh->cmd,
1106                                    tb[NL80211_ATTR_STATUS_CODE],
1107                                    tb[NL80211_ATTR_MAC],
1108                                    tb[NL80211_ATTR_REQ_IE],
1109                                    tb[NL80211_ATTR_RESP_IE]);
1110                 break;
1111         case NL80211_CMD_DISCONNECT:
1112                 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1113                         /*
1114                          * Avoid reporting two disassociation events that could
1115                          * confuse the core code.
1116                          */
1117                         wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1118                                    "event when using userspace SME");
1119                         break;
1120                 }
1121                 drv->associated = 0;
1122                 os_memset(&data, 0, sizeof(data));
1123                 if (tb[NL80211_ATTR_REASON_CODE])
1124                         data.disassoc_info.reason_code =
1125                                 nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
1126                 wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, &data);
1127                 break;
1128         case NL80211_CMD_MICHAEL_MIC_FAILURE:
1129                 mlme_event_michael_mic_failure(drv, tb);
1130                 break;
1131         case NL80211_CMD_JOIN_IBSS:
1132                 mlme_event_join_ibss(drv, tb);
1133                 break;
1134         case NL80211_CMD_REMAIN_ON_CHANNEL:
1135                 mlme_event_remain_on_channel(drv, 0, tb);
1136                 break;
1137         case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
1138                 mlme_event_remain_on_channel(drv, 1, tb);
1139                 break;
1140         case NL80211_CMD_NOTIFY_CQM:
1141                 nl80211_cqm_event(drv, tb);
1142                 break;
1143         default:
1144                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
1145                            "(cmd=%d)", gnlh->cmd);
1146                 break;
1147         }
1148
1149         return NL_SKIP;
1150 }
1151
1152
1153 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1154                                              void *sock_ctx)
1155 {
1156         struct nl_cb *cb;
1157         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1158
1159         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
1160
1161         cb = nl_cb_clone(drv->nl_cb);
1162         if (!cb)
1163                 return;
1164         nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
1165         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
1166         nl_recvmsgs(drv->nl_handle_event, cb);
1167         nl_cb_put(cb);
1168 }
1169
1170
1171 /**
1172  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1173  * @priv: driver_nl80211 private data
1174  * @alpha2_arg: country to which to switch to
1175  * Returns: 0 on success, -1 on failure
1176  *
1177  * This asks nl80211 to set the regulatory domain for given
1178  * country ISO / IEC alpha2.
1179  */
1180 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1181 {
1182         struct i802_bss *bss = priv;
1183         struct wpa_driver_nl80211_data *drv = bss->drv;
1184         char alpha2[3];
1185         struct nl_msg *msg;
1186
1187         msg = nlmsg_alloc();
1188         if (!msg)
1189                 return -ENOMEM;
1190
1191         alpha2[0] = alpha2_arg[0];
1192         alpha2[1] = alpha2_arg[1];
1193         alpha2[2] = '\0';
1194
1195         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1196                     0, NL80211_CMD_REQ_SET_REG, 0);
1197
1198         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
1199         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1200                 return -EINVAL;
1201         return 0;
1202 nla_put_failure:
1203         return -EINVAL;
1204 }
1205
1206
1207 #ifndef HOSTAPD
1208 struct wiphy_info_data {
1209         int max_scan_ssids;
1210         int ap_supported;
1211         int auth_supported;
1212         int connect_supported;
1213 };
1214
1215
1216 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
1217 {
1218         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1219         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1220         struct wiphy_info_data *info = arg;
1221
1222         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1223                   genlmsg_attrlen(gnlh, 0), NULL);
1224
1225         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
1226                 info->max_scan_ssids =
1227                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
1228
1229         if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
1230                 struct nlattr *nl_mode;
1231                 int i;
1232                 nla_for_each_nested(nl_mode,
1233                                     tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
1234                         if (nl_mode->nla_type == NL80211_IFTYPE_AP) {
1235                                 info->ap_supported = 1;
1236                                 break;
1237                         }
1238                 }
1239         }
1240
1241         if (tb[NL80211_ATTR_SUPPORTED_COMMANDS]) {
1242                 struct nlattr *nl_cmd;
1243                 int i;
1244
1245                 nla_for_each_nested(nl_cmd,
1246                                     tb[NL80211_ATTR_SUPPORTED_COMMANDS], i) {
1247                         u32 cmd = nla_get_u32(nl_cmd);
1248                         if (cmd == NL80211_CMD_AUTHENTICATE)
1249                                 info->auth_supported = 1;
1250                         else if (cmd == NL80211_CMD_CONNECT)
1251                                 info->connect_supported = 1;
1252                 }
1253         }
1254
1255         return NL_SKIP;
1256 }
1257
1258
1259 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
1260                                        struct wiphy_info_data *info)
1261 {
1262         struct nl_msg *msg;
1263
1264         os_memset(info, 0, sizeof(*info));
1265         msg = nlmsg_alloc();
1266         if (!msg)
1267                 return -1;
1268
1269         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1270                     0, NL80211_CMD_GET_WIPHY, 0);
1271
1272         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->first_bss.ifindex);
1273
1274         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
1275                 return 0;
1276         msg = NULL;
1277 nla_put_failure:
1278         nlmsg_free(msg);
1279         return -1;
1280 }
1281
1282
1283 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
1284 {
1285         struct wiphy_info_data info;
1286         if (wpa_driver_nl80211_get_info(drv, &info))
1287                 return -1;
1288         drv->has_capability = 1;
1289         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
1290         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1291                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
1292                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1293                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1294         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
1295                 WPA_DRIVER_CAPA_ENC_WEP104 |
1296                 WPA_DRIVER_CAPA_ENC_TKIP |
1297                 WPA_DRIVER_CAPA_ENC_CCMP;
1298         drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
1299                 WPA_DRIVER_AUTH_SHARED |
1300                 WPA_DRIVER_AUTH_LEAP;
1301
1302         drv->capa.max_scan_ssids = info.max_scan_ssids;
1303         if (info.ap_supported)
1304                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1305
1306         if (info.auth_supported)
1307                 drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
1308         else if (!info.connect_supported) {
1309                 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
1310                            "authentication/association or connect commands");
1311                 return -1;
1312         }
1313
1314         drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
1315         drv->capa.max_remain_on_chan = 5000;
1316
1317         return 0;
1318 }
1319 #endif /* HOSTAPD */
1320
1321
1322 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
1323 {
1324         int ret;
1325
1326         /* Initialize generic netlink and nl80211 */
1327
1328         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1329         if (drv->nl_cb == NULL) {
1330                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1331                            "callbacks");
1332                 goto err1;
1333         }
1334
1335         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
1336         if (drv->nl_handle == NULL) {
1337                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1338                            "callbacks");
1339                 goto err2;
1340         }
1341
1342         drv->nl_handle_event = nl_handle_alloc_cb(drv->nl_cb);
1343         if (drv->nl_handle_event == NULL) {
1344                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1345                            "callbacks (event)");
1346                 goto err2b;
1347         }
1348
1349         if (genl_connect(drv->nl_handle)) {
1350                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
1351                            "netlink");
1352                 goto err3;
1353         }
1354
1355         if (genl_connect(drv->nl_handle_event)) {
1356                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
1357                            "netlink (event)");
1358                 goto err3;
1359         }
1360
1361 #ifdef CONFIG_LIBNL20
1362         if (genl_ctrl_alloc_cache(drv->nl_handle, &drv->nl_cache) < 0) {
1363                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1364                            "netlink cache");
1365                 goto err3;
1366         }
1367         if (genl_ctrl_alloc_cache(drv->nl_handle_event, &drv->nl_cache_event) <
1368             0) {
1369                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1370                            "netlink cache (event)");
1371                 goto err3b;
1372         }
1373 #else /* CONFIG_LIBNL20 */
1374         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
1375         if (drv->nl_cache == NULL) {
1376                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1377                            "netlink cache");
1378                 goto err3;
1379         }
1380         drv->nl_cache_event = genl_ctrl_alloc_cache(drv->nl_handle_event);
1381         if (drv->nl_cache_event == NULL) {
1382                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1383                            "netlink cache (event)");
1384                 goto err3b;
1385         }
1386 #endif /* CONFIG_LIBNL20 */
1387
1388         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
1389         if (drv->nl80211 == NULL) {
1390                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1391                            "found");
1392                 goto err4;
1393         }
1394
1395         ret = nl_get_multicast_id(drv, "nl80211", "scan");
1396         if (ret >= 0)
1397                 ret = nl_socket_add_membership(drv->nl_handle_event, ret);
1398         if (ret < 0) {
1399                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1400                            "membership for scan events: %d (%s)",
1401                            ret, strerror(-ret));
1402                 goto err4;
1403         }
1404
1405         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
1406         if (ret >= 0)
1407                 ret = nl_socket_add_membership(drv->nl_handle_event, ret);
1408         if (ret < 0) {
1409                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1410                            "membership for mlme events: %d (%s)",
1411                            ret, strerror(-ret));
1412                 goto err4;
1413         }
1414
1415         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_event),
1416                                  wpa_driver_nl80211_event_receive, drv, NULL);
1417
1418         return 0;
1419
1420 err4:
1421         nl_cache_free(drv->nl_cache_event);
1422 err3b:
1423         nl_cache_free(drv->nl_cache);
1424 err3:
1425         nl_handle_destroy(drv->nl_handle_event);
1426 err2b:
1427         nl_handle_destroy(drv->nl_handle);
1428 err2:
1429         nl_cb_put(drv->nl_cb);
1430 err1:
1431         return -1;
1432 }
1433
1434
1435 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1436 {
1437         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1438         /*
1439          * This may be for any interface; use ifdown event to disable
1440          * interface.
1441          */
1442 }
1443
1444
1445 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1446 {
1447         struct wpa_driver_nl80211_data *drv = ctx;
1448         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1449         if (linux_set_iface_flags(drv->ioctl_sock, drv->first_bss.ifname, 1)) {
1450                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1451                            "after rfkill unblock");
1452                 return;
1453         }
1454         /* rtnetlink ifup handler will report interface as enabled */
1455 }
1456
1457
1458 /**
1459  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1460  * @ctx: context to be used when calling wpa_supplicant functions,
1461  * e.g., wpa_supplicant_event()
1462  * @ifname: interface name, e.g., wlan0
1463  * Returns: Pointer to private data, %NULL on failure
1464  */
1465 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
1466 {
1467         struct wpa_driver_nl80211_data *drv;
1468         struct netlink_config *cfg;
1469         struct rfkill_config *rcfg;
1470         struct i802_bss *bss;
1471
1472         drv = os_zalloc(sizeof(*drv));
1473         if (drv == NULL)
1474                 return NULL;
1475         drv->ctx = ctx;
1476         bss = &drv->first_bss;
1477         bss->drv = drv;
1478         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1479         drv->monitor_ifidx = -1;
1480         drv->monitor_sock = -1;
1481         drv->ioctl_sock = -1;
1482
1483         if (wpa_driver_nl80211_init_nl(drv)) {
1484                 os_free(drv);
1485                 return NULL;
1486         }
1487
1488         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1489         if (drv->ioctl_sock < 0) {
1490                 perror("socket(PF_INET,SOCK_DGRAM)");
1491                 goto failed;
1492         }
1493
1494         cfg = os_zalloc(sizeof(*cfg));
1495         if (cfg == NULL)
1496                 goto failed;
1497         cfg->ctx = drv;
1498         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
1499         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
1500         drv->netlink = netlink_init(cfg);
1501         if (drv->netlink == NULL) {
1502                 os_free(cfg);
1503                 goto failed;
1504         }
1505
1506         rcfg = os_zalloc(sizeof(*rcfg));
1507         if (rcfg == NULL)
1508                 goto failed;
1509         rcfg->ctx = drv;
1510         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
1511         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1512         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1513         drv->rfkill = rfkill_init(rcfg);
1514         if (drv->rfkill == NULL) {
1515                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1516                 os_free(rcfg);
1517         }
1518
1519         if (wpa_driver_nl80211_finish_drv_init(drv))
1520                 goto failed;
1521
1522         return bss;
1523
1524 failed:
1525         rfkill_deinit(drv->rfkill);
1526         netlink_deinit(drv->netlink);
1527         if (drv->ioctl_sock >= 0)
1528                 close(drv->ioctl_sock);
1529
1530         genl_family_put(drv->nl80211);
1531         nl_cache_free(drv->nl_cache);
1532         nl_handle_destroy(drv->nl_handle);
1533         nl_cb_put(drv->nl_cb);
1534         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event));
1535
1536         os_free(drv);
1537         return NULL;
1538 }
1539
1540
1541 static int nl80211_register_action_frame(struct wpa_driver_nl80211_data *drv,
1542                                          const u8 *match, size_t match_len)
1543 {
1544         struct nl_msg *msg;
1545         int ret = -1;
1546
1547         msg = nlmsg_alloc();
1548         if (!msg)
1549                 return -1;
1550
1551         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1552                     NL80211_CMD_REGISTER_ACTION, 0);
1553
1554         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1555         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
1556
1557         ret = send_and_recv(drv, drv->nl_handle_event, msg, NULL, NULL);
1558         msg = NULL;
1559         if (ret) {
1560                 wpa_printf(MSG_DEBUG, "nl80211: Register Action command "
1561                            "failed: ret=%d (%s)", ret, strerror(-ret));
1562                 wpa_hexdump(MSG_DEBUG, "nl80211: Register Action match",
1563                             match, match_len);
1564                 goto nla_put_failure;
1565         }
1566         ret = 0;
1567 nla_put_failure:
1568         nlmsg_free(msg);
1569         return ret;
1570 }
1571
1572
1573 static int nl80211_register_action_frames(struct wpa_driver_nl80211_data *drv)
1574 {
1575         /* FT Action frames */
1576         if (nl80211_register_action_frame(drv, (u8 *) "\x06", 1) < 0)
1577                 return -1;
1578         else
1579                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1580                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1581
1582         return 0;
1583 }
1584
1585
1586 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
1587 {
1588         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
1589 }
1590
1591
1592 static int
1593 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
1594 {
1595         struct i802_bss *bss = &drv->first_bss;
1596         int send_rfkill_event = 0;
1597
1598         drv->ifindex = if_nametoindex(bss->ifname);
1599         drv->first_bss.ifindex = drv->ifindex;
1600
1601 #ifndef HOSTAPD
1602         if (wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_INFRA) < 0) {
1603                 wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
1604                            "use managed mode");
1605         }
1606
1607         if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
1608                 if (rfkill_is_blocked(drv->rfkill)) {
1609                         wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
1610                                    "interface '%s' due to rfkill",
1611                                    bss->ifname);
1612                         drv->if_disabled = 1;
1613                         send_rfkill_event = 1;
1614                 } else {
1615                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
1616                                    "interface '%s' UP", bss->ifname);
1617                         return -1;
1618                 }
1619         }
1620
1621         if (wpa_driver_nl80211_capa(drv))
1622                 return -1;
1623
1624         netlink_send_oper_ifla(drv->netlink, drv->ifindex,
1625                                1, IF_OPER_DORMANT);
1626 #endif /* HOSTAPD */
1627
1628         if (nl80211_register_action_frames(drv) < 0) {
1629                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
1630                            "frame processing - ignore for now");
1631                 /*
1632                  * Older kernel versions did not support this, so ignore the
1633                  * error for now. Some functionality may not be available
1634                  * because of this.
1635                  */
1636         }
1637
1638         if (send_rfkill_event) {
1639                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
1640                                        drv, drv->ctx);
1641         }
1642
1643         return 0;
1644 }
1645
1646
1647 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
1648 {
1649         struct nl_msg *msg;
1650
1651         msg = nlmsg_alloc();
1652         if (!msg)
1653                 return -ENOMEM;
1654
1655         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1656                     0, NL80211_CMD_DEL_BEACON, 0);
1657         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1658
1659         return send_and_recv_msgs(drv, msg, NULL, NULL);
1660  nla_put_failure:
1661         return -ENOBUFS;
1662 }
1663
1664
1665 /**
1666  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
1667  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1668  *
1669  * Shut down driver interface and processing of driver events. Free
1670  * private data buffer if one was allocated in wpa_driver_nl80211_init().
1671  */
1672 static void wpa_driver_nl80211_deinit(void *priv)
1673 {
1674         struct i802_bss *bss = priv;
1675         struct wpa_driver_nl80211_data *drv = bss->drv;
1676
1677         if (drv->added_if_into_bridge) {
1678                 if (linux_br_del_if(drv->ioctl_sock, drv->brname, bss->ifname)
1679                     < 0)
1680                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
1681                                    "interface %s from bridge %s: %s",
1682                                    bss->ifname, drv->brname, strerror(errno));
1683         }
1684         if (drv->added_bridge) {
1685                 if (linux_br_del(drv->ioctl_sock, drv->brname) < 0)
1686                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
1687                                    "bridge %s: %s",
1688                                    drv->brname, strerror(errno));
1689         }
1690
1691         nl80211_remove_monitor_interface(drv);
1692
1693         if (drv->nlmode == NL80211_IFTYPE_AP)
1694                 wpa_driver_nl80211_del_beacon(drv);
1695
1696 #ifdef HOSTAPD
1697         if (drv->last_freq_ht) {
1698                 /* Clear HT flags from the driver */
1699                 struct hostapd_freq_params freq;
1700                 os_memset(&freq, 0, sizeof(freq));
1701                 freq.freq = drv->last_freq;
1702                 i802_set_freq(priv, &freq);
1703         }
1704
1705         if (drv->eapol_sock >= 0) {
1706                 eloop_unregister_read_sock(drv->eapol_sock);
1707                 close(drv->eapol_sock);
1708         }
1709
1710         if (drv->if_indices != drv->default_if_indices)
1711                 os_free(drv->if_indices);
1712 #endif /* HOSTAPD */
1713
1714         if (drv->disable_11b_rates)
1715                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
1716
1717         netlink_send_oper_ifla(drv->netlink, drv->ifindex, 0, IF_OPER_UP);
1718         netlink_deinit(drv->netlink);
1719         rfkill_deinit(drv->rfkill);
1720
1721         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1722
1723         (void) linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0);
1724         wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_INFRA);
1725
1726         if (drv->ioctl_sock >= 0)
1727                 close(drv->ioctl_sock);
1728
1729         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event));
1730         genl_family_put(drv->nl80211);
1731         nl_cache_free(drv->nl_cache);
1732         nl_cache_free(drv->nl_cache_event);
1733         nl_handle_destroy(drv->nl_handle);
1734         nl_handle_destroy(drv->nl_handle_event);
1735         nl_cb_put(drv->nl_cb);
1736
1737         eloop_cancel_timeout(wpa_driver_nl80211_probe_req_report_timeout,
1738                              drv, NULL);
1739
1740         os_free(drv->filter_ssids);
1741
1742         os_free(drv);
1743 }
1744
1745
1746 /**
1747  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
1748  * @eloop_ctx: Driver private data
1749  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
1750  *
1751  * This function can be used as registered timeout when starting a scan to
1752  * generate a scan completed event if the driver does not report this.
1753  */
1754 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1755 {
1756         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1757         if (drv->ap_scan_as_station) {
1758                 wpa_driver_nl80211_set_mode(&drv->first_bss,
1759                                             IEEE80211_MODE_AP);
1760                 drv->ap_scan_as_station = 0;
1761         }
1762         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
1763         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
1764 }
1765
1766
1767 /**
1768  * wpa_driver_nl80211_scan - Request the driver to initiate scan
1769  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1770  * @params: Scan parameters
1771  * Returns: 0 on success, -1 on failure
1772  */
1773 static int wpa_driver_nl80211_scan(void *priv,
1774                                    struct wpa_driver_scan_params *params)
1775 {
1776         struct i802_bss *bss = priv;
1777         struct wpa_driver_nl80211_data *drv = bss->drv;
1778         int ret = 0, timeout;
1779         struct nl_msg *msg, *ssids, *freqs;
1780         size_t i;
1781
1782         msg = nlmsg_alloc();
1783         ssids = nlmsg_alloc();
1784         freqs = nlmsg_alloc();
1785         if (!msg || !ssids || !freqs) {
1786                 nlmsg_free(msg);
1787                 nlmsg_free(ssids);
1788                 nlmsg_free(freqs);
1789                 return -1;
1790         }
1791
1792         os_free(drv->filter_ssids);
1793         drv->filter_ssids = params->filter_ssids;
1794         params->filter_ssids = NULL;
1795         drv->num_filter_ssids = params->num_filter_ssids;
1796
1797         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1798                     NL80211_CMD_TRIGGER_SCAN, 0);
1799
1800         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1801
1802         for (i = 0; i < params->num_ssids; i++) {
1803                 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
1804                                   params->ssids[i].ssid,
1805                                   params->ssids[i].ssid_len);
1806                 NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len,
1807                         params->ssids[i].ssid);
1808         }
1809         if (params->num_ssids)
1810                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
1811
1812         if (params->extra_ies) {
1813                 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1814                                   params->extra_ies, params->extra_ies_len);
1815                 NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len,
1816                         params->extra_ies);
1817         }
1818
1819         if (params->freqs) {
1820                 for (i = 0; params->freqs[i]; i++) {
1821                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
1822                                    "MHz", params->freqs[i]);
1823                         NLA_PUT_U32(freqs, i + 1, params->freqs[i]);
1824                 }
1825                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
1826         }
1827
1828         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1829         msg = NULL;
1830         if (ret) {
1831                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
1832                            "(%s)", ret, strerror(-ret));
1833 #ifdef HOSTAPD
1834                 if (drv->nlmode == NL80211_IFTYPE_AP) {
1835                         /*
1836                          * mac80211 does not allow scan requests in AP mode, so
1837                          * try to do this in station mode.
1838                          */
1839                         if (wpa_driver_nl80211_set_mode(bss,
1840                                                         IEEE80211_MODE_INFRA))
1841                                 goto nla_put_failure;
1842
1843                         if (wpa_driver_nl80211_scan(drv, params)) {
1844                                 wpa_driver_nl80211_set_mode(bss,
1845                                                             IEEE80211_MODE_AP);
1846                                 goto nla_put_failure;
1847                         }
1848
1849                         /* Restore AP mode when processing scan results */
1850                         drv->ap_scan_as_station = 1;
1851                         ret = 0;
1852                 } else
1853                         goto nla_put_failure;
1854 #else /* HOSTAPD */
1855                 goto nla_put_failure;
1856 #endif /* HOSTAPD */
1857         }
1858
1859         /* Not all drivers generate "scan completed" wireless event, so try to
1860          * read results after a timeout. */
1861         timeout = 10;
1862         if (drv->scan_complete_events) {
1863                 /*
1864                  * The driver seems to deliver events to notify when scan is
1865                  * complete, so use longer timeout to avoid race conditions
1866                  * with scanning and following association request.
1867                  */
1868                 timeout = 30;
1869         }
1870         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
1871                    "seconds", ret, timeout);
1872         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1873         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
1874                                drv, drv->ctx);
1875
1876 nla_put_failure:
1877         nlmsg_free(ssids);
1878         nlmsg_free(msg);
1879         nlmsg_free(freqs);
1880         return ret;
1881 }
1882
1883
1884 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
1885 {
1886         const u8 *end, *pos;
1887
1888         if (ies == NULL)
1889                 return NULL;
1890
1891         pos = ies;
1892         end = ies + ies_len;
1893
1894         while (pos + 1 < end) {
1895                 if (pos + 2 + pos[1] > end)
1896                         break;
1897                 if (pos[0] == ie)
1898                         return pos;
1899                 pos += 2 + pos[1];
1900         }
1901
1902         return NULL;
1903 }
1904
1905
1906 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
1907                                  const u8 *ie, size_t ie_len)
1908 {
1909         const u8 *ssid;
1910         size_t i;
1911
1912         if (drv->filter_ssids == NULL)
1913                 return 0;
1914
1915         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
1916         if (ssid == NULL)
1917                 return 1;
1918
1919         for (i = 0; i < drv->num_filter_ssids; i++) {
1920                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
1921                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
1922                     0)
1923                         return 0;
1924         }
1925
1926         return 1;
1927 }
1928
1929
1930 struct nl80211_bss_info_arg {
1931         struct wpa_driver_nl80211_data *drv;
1932         struct wpa_scan_results *res;
1933 };
1934
1935 static int bss_info_handler(struct nl_msg *msg, void *arg)
1936 {
1937         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1938         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1939         struct nlattr *bss[NL80211_BSS_MAX + 1];
1940         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1941                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
1942                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1943                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1944                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1945                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1946                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
1947                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1948                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1949                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
1950                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
1951                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
1952         };
1953         struct nl80211_bss_info_arg *_arg = arg;
1954         struct wpa_scan_results *res = _arg->res;
1955         struct wpa_scan_res **tmp;
1956         struct wpa_scan_res *r;
1957         const u8 *ie, *beacon_ie;
1958         size_t ie_len, beacon_ie_len;
1959         u8 *pos;
1960
1961         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1962                   genlmsg_attrlen(gnlh, 0), NULL);
1963         if (!tb[NL80211_ATTR_BSS])
1964                 return NL_SKIP;
1965         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
1966                              bss_policy))
1967                 return NL_SKIP;
1968         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
1969                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1970                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1971         } else {
1972                 ie = NULL;
1973                 ie_len = 0;
1974         }
1975         if (bss[NL80211_BSS_BEACON_IES]) {
1976                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
1977                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
1978         } else {
1979                 beacon_ie = NULL;
1980                 beacon_ie_len = 0;
1981         }
1982
1983         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
1984                                   ie ? ie_len : beacon_ie_len))
1985                 return NL_SKIP;
1986
1987         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
1988         if (r == NULL)
1989                 return NL_SKIP;
1990         if (bss[NL80211_BSS_BSSID])
1991                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
1992                           ETH_ALEN);
1993         if (bss[NL80211_BSS_FREQUENCY])
1994                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1995         if (bss[NL80211_BSS_BEACON_INTERVAL])
1996                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
1997         if (bss[NL80211_BSS_CAPABILITY])
1998                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1999         r->flags |= WPA_SCAN_NOISE_INVALID;
2000         if (bss[NL80211_BSS_SIGNAL_MBM]) {
2001                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
2002                 r->level /= 100; /* mBm to dBm */
2003                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
2004         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
2005                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
2006                 r->flags |= WPA_SCAN_LEVEL_INVALID;
2007         } else
2008                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
2009         if (bss[NL80211_BSS_TSF])
2010                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
2011         if (bss[NL80211_BSS_SEEN_MS_AGO])
2012                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
2013         r->ie_len = ie_len;
2014         pos = (u8 *) (r + 1);
2015         if (ie) {
2016                 os_memcpy(pos, ie, ie_len);
2017                 pos += ie_len;
2018         }
2019         r->beacon_ie_len = beacon_ie_len;
2020         if (beacon_ie)
2021                 os_memcpy(pos, beacon_ie, beacon_ie_len);
2022
2023         if (bss[NL80211_BSS_STATUS]) {
2024                 enum nl80211_bss_status status;
2025                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2026                 switch (status) {
2027                 case NL80211_BSS_STATUS_AUTHENTICATED:
2028                         r->flags |= WPA_SCAN_AUTHENTICATED;
2029                         break;
2030                 case NL80211_BSS_STATUS_ASSOCIATED:
2031                         r->flags |= WPA_SCAN_ASSOCIATED;
2032                         break;
2033                 default:
2034                         break;
2035                 }
2036         }
2037
2038         tmp = os_realloc(res->res,
2039                          (res->num + 1) * sizeof(struct wpa_scan_res *));
2040         if (tmp == NULL) {
2041                 os_free(r);
2042                 return NL_SKIP;
2043         }
2044         tmp[res->num++] = r;
2045         res->res = tmp;
2046
2047         return NL_SKIP;
2048 }
2049
2050
2051 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
2052                                  const u8 *addr)
2053 {
2054         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
2055                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
2056                            "mismatch (" MACSTR ")", MAC2STR(addr));
2057                 wpa_driver_nl80211_mlme(drv, addr,
2058                                         NL80211_CMD_DEAUTHENTICATE,
2059                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
2060         }
2061 }
2062
2063
2064 static void wpa_driver_nl80211_check_bss_status(
2065         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
2066 {
2067         size_t i;
2068
2069         for (i = 0; i < res->num; i++) {
2070                 struct wpa_scan_res *r = res->res[i];
2071                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
2072                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2073                                    "indicates BSS status with " MACSTR
2074                                    " as authenticated",
2075                                    MAC2STR(r->bssid));
2076                         if (drv->nlmode == NL80211_IFTYPE_STATION &&
2077                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
2078                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
2079                             0) {
2080                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
2081                                            " in local state (auth=" MACSTR
2082                                            " assoc=" MACSTR ")",
2083                                            MAC2STR(drv->auth_bssid),
2084                                            MAC2STR(drv->bssid));
2085                                 clear_state_mismatch(drv, r->bssid);
2086                         }
2087                 }
2088
2089                 if (r->flags & WPA_SCAN_ASSOCIATED) {
2090                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2091                                    "indicate BSS status with " MACSTR
2092                                    " as associated",
2093                                    MAC2STR(r->bssid));
2094                         if (drv->nlmode == NL80211_IFTYPE_STATION &&
2095                             !drv->associated) {
2096                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
2097                                            "(not associated) does not match "
2098                                            "with BSS state");
2099                                 clear_state_mismatch(drv, r->bssid);
2100                         } else if (drv->nlmode == NL80211_IFTYPE_STATION &&
2101                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
2102                                    0) {
2103                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
2104                                            "(associated with " MACSTR ") does "
2105                                            "not match with BSS state",
2106                                            MAC2STR(drv->bssid));
2107                                 clear_state_mismatch(drv, r->bssid);
2108                                 clear_state_mismatch(drv, drv->bssid);
2109                         }
2110                 }
2111         }
2112 }
2113
2114
2115 static void wpa_scan_results_free(struct wpa_scan_results *res)
2116 {
2117         size_t i;
2118
2119         if (res == NULL)
2120                 return;
2121
2122         for (i = 0; i < res->num; i++)
2123                 os_free(res->res[i]);
2124         os_free(res->res);
2125         os_free(res);
2126 }
2127
2128
2129 static struct wpa_scan_results *
2130 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
2131 {
2132         struct nl_msg *msg;
2133         struct wpa_scan_results *res;
2134         int ret;
2135         struct nl80211_bss_info_arg arg;
2136
2137         res = os_zalloc(sizeof(*res));
2138         if (res == NULL)
2139                 return NULL;
2140         msg = nlmsg_alloc();
2141         if (!msg)
2142                 goto nla_put_failure;
2143
2144         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
2145                     NL80211_CMD_GET_SCAN, 0);
2146         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2147
2148         arg.drv = drv;
2149         arg.res = res;
2150         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
2151         msg = NULL;
2152         if (ret == 0) {
2153                 wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)",
2154                            (unsigned long) res->num);
2155                 return res;
2156         }
2157         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
2158                    "(%s)", ret, strerror(-ret));
2159 nla_put_failure:
2160         nlmsg_free(msg);
2161         wpa_scan_results_free(res);
2162         return NULL;
2163 }
2164
2165
2166 /**
2167  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
2168  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
2169  * Returns: Scan results on success, -1 on failure
2170  */
2171 static struct wpa_scan_results *
2172 wpa_driver_nl80211_get_scan_results(void *priv)
2173 {
2174         struct i802_bss *bss = priv;
2175         struct wpa_driver_nl80211_data *drv = bss->drv;
2176         struct wpa_scan_results *res;
2177
2178         res = nl80211_get_scan_results(drv);
2179         if (res)
2180                 wpa_driver_nl80211_check_bss_status(drv, res);
2181         return res;
2182 }
2183
2184
2185 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
2186 {
2187         struct wpa_scan_results *res;
2188         size_t i;
2189
2190         res = nl80211_get_scan_results(drv);
2191         if (res == NULL) {
2192                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
2193                 return;
2194         }
2195
2196         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
2197         for (i = 0; i < res->num; i++) {
2198                 struct wpa_scan_res *r = res->res[i];
2199                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
2200                            (int) i, (int) res->num, MAC2STR(r->bssid),
2201                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
2202                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
2203         }
2204
2205         wpa_scan_results_free(res);
2206 }
2207
2208
2209 static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
2210                                       enum wpa_alg alg, const u8 *addr,
2211                                       int key_idx, int set_tx,
2212                                       const u8 *seq, size_t seq_len,
2213                                       const u8 *key, size_t key_len)
2214 {
2215         struct i802_bss *bss = priv;
2216         struct wpa_driver_nl80211_data *drv = bss->drv;
2217         int ifindex = if_nametoindex(ifname);
2218         struct nl_msg *msg;
2219         int ret;
2220
2221         wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d "
2222                    "set_tx=%d seq_len=%lu key_len=%lu",
2223                    __func__, ifindex, alg, addr, key_idx, set_tx,
2224                    (unsigned long) seq_len, (unsigned long) key_len);
2225
2226         msg = nlmsg_alloc();
2227         if (!msg)
2228                 return -ENOMEM;
2229
2230         if (alg == WPA_ALG_NONE) {
2231                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2232                             0, NL80211_CMD_DEL_KEY, 0);
2233         } else {
2234                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2235                             0, NL80211_CMD_NEW_KEY, 0);
2236                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
2237                 switch (alg) {
2238                 case WPA_ALG_WEP:
2239                         if (key_len == 5)
2240                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2241                                             WLAN_CIPHER_SUITE_WEP40);
2242                         else
2243                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2244                                             WLAN_CIPHER_SUITE_WEP104);
2245                         break;
2246                 case WPA_ALG_TKIP:
2247                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2248                                     WLAN_CIPHER_SUITE_TKIP);
2249                         break;
2250                 case WPA_ALG_CCMP:
2251                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2252                                     WLAN_CIPHER_SUITE_CCMP);
2253                         break;
2254                 case WPA_ALG_IGTK:
2255                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2256                                     WLAN_CIPHER_SUITE_AES_CMAC);
2257                         break;
2258                 default:
2259                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
2260                                    "algorithm %d", __func__, alg);
2261                         nlmsg_free(msg);
2262                         return -1;
2263                 }
2264         }
2265
2266         if (seq && seq_len)
2267                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
2268
2269         if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2270         {
2271                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
2272                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
2273         }
2274         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
2275         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
2276
2277         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2278         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
2279                 ret = 0;
2280         if (ret)
2281                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
2282                            ret, strerror(-ret));
2283
2284         /*
2285          * If we failed or don't need to set the default TX key (below),
2286          * we're done here.
2287          */
2288         if (ret || !set_tx || alg == WPA_ALG_NONE)
2289                 return ret;
2290 #ifdef HOSTAPD
2291         if (addr)
2292                 return ret;
2293 #else /* HOSTAPD */
2294         if (drv->nlmode == NL80211_IFTYPE_AP && addr)
2295                 return ret;
2296 #endif /* HOSTAPD */
2297
2298         msg = nlmsg_alloc();
2299         if (!msg)
2300                 return -ENOMEM;
2301
2302         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2303                     0, NL80211_CMD_SET_KEY, 0);
2304         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
2305         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
2306         if (alg == WPA_ALG_IGTK)
2307                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
2308         else
2309                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
2310
2311         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2312         if (ret == -ENOENT)
2313                 ret = 0;
2314         if (ret)
2315                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
2316                            "err=%d %s)", ret, strerror(-ret));
2317         return ret;
2318
2319 nla_put_failure:
2320         return -ENOBUFS;
2321 }
2322
2323
2324 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
2325                       int key_idx, int defkey,
2326                       const u8 *seq, size_t seq_len,
2327                       const u8 *key, size_t key_len)
2328 {
2329         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
2330         if (!key_attr)
2331                 return -1;
2332
2333         if (defkey && alg == WPA_ALG_IGTK)
2334                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
2335         else if (defkey)
2336                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
2337
2338         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
2339
2340         switch (alg) {
2341         case WPA_ALG_WEP:
2342                 if (key_len == 5)
2343                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
2344                                     WLAN_CIPHER_SUITE_WEP40);
2345                 else
2346                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
2347                                     WLAN_CIPHER_SUITE_WEP104);
2348                 break;
2349         case WPA_ALG_TKIP:
2350                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP);
2351                 break;
2352         case WPA_ALG_CCMP:
2353                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP);
2354                 break;
2355         case WPA_ALG_IGTK:
2356                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
2357                             WLAN_CIPHER_SUITE_AES_CMAC);
2358                 break;
2359         default:
2360                 wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
2361                            "algorithm %d", __func__, alg);
2362                 return -1;
2363         }
2364
2365         if (seq && seq_len)
2366                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
2367
2368         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
2369
2370         nla_nest_end(msg, key_attr);
2371
2372         return 0;
2373  nla_put_failure:
2374         return -1;
2375 }
2376
2377
2378 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
2379                                  struct nl_msg *msg)
2380 {
2381         int i, privacy = 0;
2382         struct nlattr *nl_keys, *nl_key;
2383
2384         for (i = 0; i < 4; i++) {
2385                 if (!params->wep_key[i])
2386                         continue;
2387                 privacy = 1;
2388                 break;
2389         }
2390         if (!privacy)
2391                 return 0;
2392
2393         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
2394
2395         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
2396         if (!nl_keys)
2397                 goto nla_put_failure;
2398
2399         for (i = 0; i < 4; i++) {
2400                 if (!params->wep_key[i])
2401                         continue;
2402
2403                 nl_key = nla_nest_start(msg, i);
2404                 if (!nl_key)
2405                         goto nla_put_failure;
2406
2407                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
2408                         params->wep_key[i]);
2409                 if (params->wep_key_len[i] == 5)
2410                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
2411                                     WLAN_CIPHER_SUITE_WEP40);
2412                 else
2413                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
2414                                     WLAN_CIPHER_SUITE_WEP104);
2415
2416                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
2417
2418                 if (i == params->wep_tx_keyidx)
2419                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
2420
2421                 nla_nest_end(msg, nl_key);
2422         }
2423         nla_nest_end(msg, nl_keys);
2424
2425         return 0;
2426
2427 nla_put_failure:
2428         return -ENOBUFS;
2429 }
2430
2431
2432 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
2433                                    const u8 *addr, int cmd, u16 reason_code,
2434                                    int local_state_change)
2435 {
2436         int ret = -1;
2437         struct nl_msg *msg;
2438
2439         msg = nlmsg_alloc();
2440         if (!msg)
2441                 return -1;
2442
2443         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0);
2444
2445         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2446         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
2447         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
2448         if (local_state_change)
2449                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
2450
2451         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2452         msg = NULL;
2453         if (ret) {
2454                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2455                            "(%s)", ret, strerror(-ret));
2456                 goto nla_put_failure;
2457         }
2458         ret = 0;
2459
2460 nla_put_failure:
2461         nlmsg_free(msg);
2462         return ret;
2463 }
2464
2465
2466 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
2467                                          const u8 *addr, int reason_code)
2468 {
2469         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
2470                    __func__, MAC2STR(addr), reason_code);
2471         drv->associated = 0;
2472         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISCONNECT,
2473                                        reason_code, 0);
2474 }
2475
2476
2477 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
2478                                              int reason_code)
2479 {
2480         struct i802_bss *bss = priv;
2481         struct wpa_driver_nl80211_data *drv = bss->drv;
2482         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2483                 return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
2484         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
2485                    __func__, MAC2STR(addr), reason_code);
2486         drv->associated = 0;
2487         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
2488                                        reason_code, 0);
2489 }
2490
2491
2492 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
2493                                            int reason_code)
2494 {
2495         struct i802_bss *bss = priv;
2496         struct wpa_driver_nl80211_data *drv = bss->drv;
2497         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2498                 return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
2499         wpa_printf(MSG_DEBUG, "%s", __func__);
2500         drv->associated = 0;
2501         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
2502                                        reason_code, 0);
2503 }
2504
2505
2506 static int wpa_driver_nl80211_authenticate(
2507         void *priv, struct wpa_driver_auth_params *params)
2508 {
2509         struct i802_bss *bss = priv;
2510         struct wpa_driver_nl80211_data *drv = bss->drv;
2511         int ret = -1, i;
2512         struct nl_msg *msg;
2513         enum nl80211_auth_type type;
2514         int count = 0;
2515
2516         drv->associated = 0;
2517         os_memset(drv->auth_bssid, 0, ETH_ALEN);
2518         /* FIX: IBSS mode */
2519         if (drv->nlmode != NL80211_IFTYPE_STATION)
2520                 wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA);
2521
2522         if (wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA) < 0)
2523                 return -1;
2524
2525 retry:
2526         msg = nlmsg_alloc();
2527         if (!msg)
2528                 return -1;
2529
2530         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
2531                    drv->ifindex);
2532
2533         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2534                     NL80211_CMD_AUTHENTICATE, 0);
2535
2536         for (i = 0; i < 4; i++) {
2537                 if (!params->wep_key[i])
2538                         continue;
2539                 wpa_driver_nl80211_set_key(bss->ifname, priv, WPA_ALG_WEP,
2540                                            NULL, i,
2541                                            i == params->wep_tx_keyidx, NULL, 0,
2542                                            params->wep_key[i],
2543                                            params->wep_key_len[i]);
2544                 if (params->wep_tx_keyidx != i)
2545                         continue;
2546                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
2547                                params->wep_key[i], params->wep_key_len[i])) {
2548                         nlmsg_free(msg);
2549                         return -1;
2550                 }
2551         }
2552
2553         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2554         if (params->bssid) {
2555                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2556                            MAC2STR(params->bssid));
2557                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
2558         }
2559         if (params->freq) {
2560                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2561                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
2562         }
2563         if (params->ssid) {
2564                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2565                                   params->ssid, params->ssid_len);
2566                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
2567                         params->ssid);
2568         }
2569         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
2570         if (params->ie)
2571                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
2572         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
2573                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2574         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
2575                 type = NL80211_AUTHTYPE_SHARED_KEY;
2576         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
2577                 type = NL80211_AUTHTYPE_NETWORK_EAP;
2578         else if (params->auth_alg & WPA_AUTH_ALG_FT)
2579                 type = NL80211_AUTHTYPE_FT;
2580         else
2581                 goto nla_put_failure;
2582         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
2583         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
2584         if (params->local_state_change) {
2585                 wpa_printf(MSG_DEBUG, "  * Local state change only");
2586                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
2587         }
2588
2589         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2590         msg = NULL;
2591         if (ret) {
2592                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2593                            "(%s)", ret, strerror(-ret));
2594                 count++;
2595                 if (ret == -EALREADY && count == 1 && params->bssid &&
2596                     !params->local_state_change) {
2597                         /*
2598                          * mac80211 does not currently accept new
2599                          * authentication if we are already authenticated. As a
2600                          * workaround, force deauthentication and try again.
2601                          */
2602                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
2603                                    "after forced deauthentication");
2604                         wpa_driver_nl80211_deauthenticate(
2605                                 bss, params->bssid,
2606                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
2607                         nlmsg_free(msg);
2608                         goto retry;
2609                 }
2610                 goto nla_put_failure;
2611         }
2612         ret = 0;
2613         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
2614                    "successfully");
2615
2616 nla_put_failure:
2617         nlmsg_free(msg);
2618         return ret;
2619 }
2620
2621
2622 struct phy_info_arg {
2623         u16 *num_modes;
2624         struct hostapd_hw_modes *modes;
2625 };
2626
2627 static int phy_info_handler(struct nl_msg *msg, void *arg)
2628 {
2629         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
2630         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2631         struct phy_info_arg *phy_info = arg;
2632
2633         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
2634
2635         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
2636         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
2637                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
2638                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
2639                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
2640                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
2641                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
2642                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
2643         };
2644
2645         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
2646         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
2647                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
2648                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
2649         };
2650
2651         struct nlattr *nl_band;
2652         struct nlattr *nl_freq;
2653         struct nlattr *nl_rate;
2654         int rem_band, rem_freq, rem_rate;
2655         struct hostapd_hw_modes *mode;
2656         int idx, mode_is_set;
2657
2658         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2659                   genlmsg_attrlen(gnlh, 0), NULL);
2660
2661         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
2662                 return NL_SKIP;
2663
2664         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
2665                 mode = os_realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode));
2666                 if (!mode)
2667                         return NL_SKIP;
2668                 phy_info->modes = mode;
2669
2670                 mode_is_set = 0;
2671
2672                 mode = &phy_info->modes[*(phy_info->num_modes)];
2673                 memset(mode, 0, sizeof(*mode));
2674                 *(phy_info->num_modes) += 1;
2675
2676                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
2677                           nla_len(nl_band), NULL);
2678
2679                 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) {
2680                         mode->ht_capab = nla_get_u16(
2681                                 tb_band[NL80211_BAND_ATTR_HT_CAPA]);
2682                 }
2683
2684                 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) {
2685                         mode->a_mpdu_params |= nla_get_u8(
2686                                 tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) &
2687                                 0x03;
2688                 }
2689
2690                 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) {
2691                         mode->a_mpdu_params |= nla_get_u8(
2692                                 tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) <<
2693                                 2;
2694                 }
2695
2696                 if (tb_band[NL80211_BAND_ATTR_HT_MCS_SET] &&
2697                     nla_len(tb_band[NL80211_BAND_ATTR_HT_MCS_SET])) {
2698                         u8 *mcs;
2699                         mcs = nla_data(tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
2700                         os_memcpy(mode->mcs_set, mcs, 16);
2701                 }
2702
2703                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
2704                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
2705                                   nla_len(nl_freq), freq_policy);
2706                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
2707                                 continue;
2708                         mode->num_channels++;
2709                 }
2710
2711                 mode->channels = os_zalloc(mode->num_channels * sizeof(struct hostapd_channel_data));
2712                 if (!mode->channels)
2713                         return NL_SKIP;
2714
2715                 idx = 0;
2716
2717                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
2718                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
2719                                   nla_len(nl_freq), freq_policy);
2720                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
2721                                 continue;
2722
2723                         mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
2724                         mode->channels[idx].flag = 0;
2725
2726                         if (!mode_is_set) {
2727                                 /* crude heuristic */
2728                                 if (mode->channels[idx].freq < 4000)
2729                                         mode->mode = HOSTAPD_MODE_IEEE80211B;
2730                                 else
2731                                         mode->mode = HOSTAPD_MODE_IEEE80211A;
2732                                 mode_is_set = 1;
2733                         }
2734
2735                         /* crude heuristic */
2736                         if (mode->channels[idx].freq < 4000)
2737                                 if (mode->channels[idx].freq == 2484)
2738                                         mode->channels[idx].chan = 14;
2739                                 else
2740                                         mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
2741                         else
2742                                 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
2743
2744                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
2745                                 mode->channels[idx].flag |=
2746                                         HOSTAPD_CHAN_DISABLED;
2747                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
2748                                 mode->channels[idx].flag |=
2749                                         HOSTAPD_CHAN_PASSIVE_SCAN;
2750                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
2751                                 mode->channels[idx].flag |=
2752                                         HOSTAPD_CHAN_NO_IBSS;
2753                         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
2754                                 mode->channels[idx].flag |=
2755                                         HOSTAPD_CHAN_RADAR;
2756
2757                         if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
2758                             !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
2759                                 mode->channels[idx].max_tx_power =
2760                                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
2761
2762                         idx++;
2763                 }
2764
2765                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
2766                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
2767                                   nla_len(nl_rate), rate_policy);
2768                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
2769                                 continue;
2770                         mode->num_rates++;
2771                 }
2772
2773                 mode->rates = os_zalloc(mode->num_rates * sizeof(int));
2774                 if (!mode->rates)
2775                         return NL_SKIP;
2776
2777                 idx = 0;
2778
2779                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
2780                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
2781                                   nla_len(nl_rate), rate_policy);
2782                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
2783                                 continue;
2784                         mode->rates[idx] = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
2785
2786                         /* crude heuristic */
2787                         if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
2788                             mode->rates[idx] > 200)
2789                                 mode->mode = HOSTAPD_MODE_IEEE80211G;
2790
2791                         idx++;
2792                 }
2793         }
2794
2795         return NL_SKIP;
2796 }
2797
2798 static struct hostapd_hw_modes *
2799 wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes)
2800 {
2801         u16 m;
2802         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
2803         int i, mode11g_idx = -1;
2804
2805         /* If only 802.11g mode is included, use it to construct matching
2806          * 802.11b mode data. */
2807
2808         for (m = 0; m < *num_modes; m++) {
2809                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
2810                         return modes; /* 802.11b already included */
2811                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
2812                         mode11g_idx = m;
2813         }
2814
2815         if (mode11g_idx < 0)
2816                 return modes; /* 2.4 GHz band not supported at all */
2817
2818         nmodes = os_realloc(modes, (*num_modes + 1) * sizeof(*nmodes));
2819         if (nmodes == NULL)
2820                 return modes; /* Could not add 802.11b mode */
2821
2822         mode = &nmodes[*num_modes];
2823         os_memset(mode, 0, sizeof(*mode));
2824         (*num_modes)++;
2825         modes = nmodes;
2826
2827         mode->mode = HOSTAPD_MODE_IEEE80211B;
2828
2829         mode11g = &modes[mode11g_idx];
2830         mode->num_channels = mode11g->num_channels;
2831         mode->channels = os_malloc(mode11g->num_channels *
2832                                    sizeof(struct hostapd_channel_data));
2833         if (mode->channels == NULL) {
2834                 (*num_modes)--;
2835                 return modes; /* Could not add 802.11b mode */
2836         }
2837         os_memcpy(mode->channels, mode11g->channels,
2838                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
2839
2840         mode->num_rates = 0;
2841         mode->rates = os_malloc(4 * sizeof(int));
2842         if (mode->rates == NULL) {
2843                 os_free(mode->channels);
2844                 (*num_modes)--;
2845                 return modes; /* Could not add 802.11b mode */
2846         }
2847
2848         for (i = 0; i < mode11g->num_rates; i++) {
2849                 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
2850                     mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
2851                         continue;
2852                 mode->rates[mode->num_rates] = mode11g->rates[i];
2853                 mode->num_rates++;
2854                 if (mode->num_rates == 4)
2855                         break;
2856         }
2857
2858         if (mode->num_rates == 0) {
2859                 os_free(mode->channels);
2860                 os_free(mode->rates);
2861                 (*num_modes)--;
2862                 return modes; /* No 802.11b rates */
2863         }
2864
2865         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
2866                    "information");
2867
2868         return modes;
2869 }
2870
2871
2872 static struct hostapd_hw_modes *
2873 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
2874 {
2875         struct i802_bss *bss = priv;
2876         struct wpa_driver_nl80211_data *drv = bss->drv;
2877         struct nl_msg *msg;
2878         struct phy_info_arg result = {
2879                 .num_modes = num_modes,
2880                 .modes = NULL,
2881         };
2882
2883         *num_modes = 0;
2884         *flags = 0;
2885
2886         msg = nlmsg_alloc();
2887         if (!msg)
2888                 return NULL;
2889
2890         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2891                     0, NL80211_CMD_GET_WIPHY, 0);
2892
2893         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2894
2895         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0)
2896                 return wpa_driver_nl80211_add_11b(result.modes, num_modes);
2897  nla_put_failure:
2898         return NULL;
2899 }
2900
2901
2902 static int wpa_driver_nl80211_send_frame(struct wpa_driver_nl80211_data *drv,
2903                                          const void *data, size_t len,
2904                                          int encrypt)
2905 {
2906         __u8 rtap_hdr[] = {
2907                 0x00, 0x00, /* radiotap version */
2908                 0x0e, 0x00, /* radiotap length */
2909                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
2910                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
2911                 0x00,       /* padding */
2912                 0x00, 0x00, /* RX and TX flags to indicate that */
2913                 0x00, 0x00, /* this is the injected frame directly */
2914         };
2915         struct iovec iov[2] = {
2916                 {
2917                         .iov_base = &rtap_hdr,
2918                         .iov_len = sizeof(rtap_hdr),
2919                 },
2920                 {
2921                         .iov_base = (void *) data,
2922                         .iov_len = len,
2923                 }
2924         };
2925         struct msghdr msg = {
2926                 .msg_name = NULL,
2927                 .msg_namelen = 0,
2928                 .msg_iov = iov,
2929                 .msg_iovlen = 2,
2930                 .msg_control = NULL,
2931                 .msg_controllen = 0,
2932                 .msg_flags = 0,
2933         };
2934
2935         if (encrypt)
2936                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
2937
2938         return sendmsg(drv->monitor_sock, &msg, 0);
2939 }
2940
2941
2942 static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
2943                                         size_t data_len)
2944 {
2945         struct i802_bss *bss = priv;
2946         struct wpa_driver_nl80211_data *drv = bss->drv;
2947         struct ieee80211_mgmt *mgmt;
2948         int encrypt = 1;
2949         u16 fc;
2950
2951         mgmt = (struct ieee80211_mgmt *) data;
2952         fc = le_to_host16(mgmt->frame_control);
2953
2954         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
2955             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
2956                 /*
2957                  * Only one of the authentication frame types is encrypted.
2958                  * In order for static WEP encryption to work properly (i.e.,
2959                  * to not encrypt the frame), we need to tell mac80211 about
2960                  * the frames that must not be encrypted.
2961                  */
2962                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2963                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
2964                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
2965                         encrypt = 0;
2966         }
2967
2968         return wpa_driver_nl80211_send_frame(drv, data, data_len, encrypt);
2969 }
2970
2971
2972 static int wpa_driver_nl80211_set_beacon(void *priv,
2973                                          const u8 *head, size_t head_len,
2974                                          const u8 *tail, size_t tail_len,
2975                                          int dtim_period, int beacon_int)
2976 {
2977         struct i802_bss *bss = priv;
2978         struct wpa_driver_nl80211_data *drv = bss->drv;
2979         struct nl_msg *msg;
2980         u8 cmd = NL80211_CMD_NEW_BEACON;
2981         int ret;
2982         int beacon_set;
2983         int ifindex = if_nametoindex(bss->ifname);
2984
2985         beacon_set = bss->beacon_set;
2986
2987         msg = nlmsg_alloc();
2988         if (!msg)
2989                 return -ENOMEM;
2990
2991         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
2992                    beacon_set);
2993         if (beacon_set)
2994                 cmd = NL80211_CMD_SET_BEACON;
2995
2996         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2997                     0, cmd, 0);
2998         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
2999         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
3000         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
3001         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, beacon_int);
3002         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
3003
3004         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3005         if (ret) {
3006                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
3007                            ret, strerror(-ret));
3008         } else {
3009                 bss->beacon_set = 1;
3010         }
3011         return ret;
3012  nla_put_failure:
3013         return -ENOBUFS;
3014 }
3015
3016
3017 static int wpa_driver_nl80211_set_freq(struct wpa_driver_nl80211_data *drv,
3018                                        int freq, int ht_enabled,
3019                                        int sec_channel_offset)
3020 {
3021         struct nl_msg *msg;
3022         int ret;
3023
3024         msg = nlmsg_alloc();
3025         if (!msg)
3026                 return -1;
3027
3028         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3029                     NL80211_CMD_SET_WIPHY, 0);
3030
3031         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3032         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
3033         if (ht_enabled) {
3034                 switch (sec_channel_offset) {
3035                 case -1:
3036                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3037                                     NL80211_CHAN_HT40MINUS);
3038                         break;
3039                 case 1:
3040                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3041                                     NL80211_CHAN_HT40PLUS);
3042                         break;
3043                 default:
3044                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3045                                     NL80211_CHAN_HT20);
3046                         break;
3047                 }
3048         }
3049
3050         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3051         if (ret == 0)
3052                 return 0;
3053         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
3054                    "%d (%s)", freq, ret, strerror(-ret));
3055 nla_put_failure:
3056         return -1;
3057 }
3058
3059
3060 static int wpa_driver_nl80211_sta_add(void *priv,
3061                                       struct hostapd_sta_add_params *params)
3062 {
3063         struct i802_bss *bss = priv;
3064         struct wpa_driver_nl80211_data *drv = bss->drv;
3065         struct nl_msg *msg;
3066         int ret = -ENOBUFS;
3067
3068         msg = nlmsg_alloc();
3069         if (!msg)
3070                 return -ENOMEM;
3071
3072         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3073                     0, NL80211_CMD_NEW_STATION, 0);
3074
3075         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
3076         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
3077         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
3078         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
3079                 params->supp_rates);
3080         NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3081                     params->listen_interval);
3082         if (params->ht_capabilities) {
3083                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
3084                         sizeof(*params->ht_capabilities),
3085                         params->ht_capabilities);
3086         }
3087
3088         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3089         if (ret)
3090                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_NEW_STATION "
3091                            "result: %d (%s)", ret, strerror(-ret));
3092         if (ret == -EEXIST)
3093                 ret = 0;
3094  nla_put_failure:
3095         return ret;
3096 }
3097
3098
3099 static int wpa_driver_nl80211_sta_remove(void *priv, const u8 *addr)
3100 {
3101         struct i802_bss *bss = priv;
3102         struct wpa_driver_nl80211_data *drv = bss->drv;
3103         struct nl_msg *msg;
3104         int ret;
3105
3106         msg = nlmsg_alloc();
3107         if (!msg)
3108                 return -ENOMEM;
3109
3110         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3111                     0, NL80211_CMD_DEL_STATION, 0);
3112
3113         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3114                     if_nametoindex(bss->ifname));
3115         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3116
3117         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3118         if (ret == -ENOENT)
3119                 return 0;
3120         return ret;
3121  nla_put_failure:
3122         return -ENOBUFS;
3123 }
3124
3125
3126 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
3127                                  int ifidx)
3128 {
3129         struct nl_msg *msg;
3130
3131         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
3132
3133 #ifdef HOSTAPD
3134         /* stop listening for EAPOL on this interface */
3135         del_ifidx(drv, ifidx);
3136 #endif /* HOSTAPD */
3137
3138         msg = nlmsg_alloc();
3139         if (!msg)
3140                 goto nla_put_failure;
3141
3142         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3143                     0, NL80211_CMD_DEL_INTERFACE, 0);
3144         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
3145
3146         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
3147                 return;
3148  nla_put_failure:
3149         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
3150 }
3151
3152
3153 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
3154                                      const char *ifname,
3155                                      enum nl80211_iftype iftype,
3156                                      const u8 *addr, int wds)
3157 {
3158         struct nl_msg *msg, *flags = NULL;
3159         int ifidx;
3160         int ret = -ENOBUFS;
3161
3162         msg = nlmsg_alloc();
3163         if (!msg)
3164                 return -1;
3165
3166         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3167                     0, NL80211_CMD_NEW_INTERFACE, 0);
3168         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3169         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
3170         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
3171
3172         if (iftype == NL80211_IFTYPE_MONITOR) {
3173                 int err;
3174
3175                 flags = nlmsg_alloc();
3176                 if (!flags)
3177                         goto nla_put_failure;
3178
3179                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
3180
3181                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
3182
3183                 nlmsg_free(flags);
3184
3185                 if (err)
3186                         goto nla_put_failure;
3187         } else if (wds) {
3188                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
3189         }
3190
3191         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3192         if (ret) {
3193  nla_put_failure:
3194                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
3195                            ifname, ret, strerror(-ret));
3196                 return ret;
3197         }
3198
3199         ifidx = if_nametoindex(ifname);
3200         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
3201                    ifname, ifidx);
3202
3203         if (ifidx <= 0)
3204                 return -1;
3205
3206 #ifdef HOSTAPD
3207         /* start listening for EAPOL on this interface */
3208         add_ifidx(drv, ifidx);
3209 #endif /* HOSTAPD */
3210
3211         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
3212             linux_set_ifhwaddr(drv->ioctl_sock, ifname, addr)) {
3213                 nl80211_remove_iface(drv, ifidx);
3214                 return -1;
3215         }
3216
3217         return ifidx;
3218 }
3219
3220
3221 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
3222                                 const char *ifname, enum nl80211_iftype iftype,
3223                                 const u8 *addr, int wds)
3224 {
3225         int ret;
3226
3227         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds);
3228
3229         /* if error occured and interface exists already */
3230         if (ret == -ENFILE && if_nametoindex(ifname)) {
3231                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
3232
3233                 /* Try to remove the interface that was already there. */
3234                 nl80211_remove_iface(drv, if_nametoindex(ifname));
3235
3236                 /* Try to create the interface again */
3237                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
3238                                                 wds);
3239         }
3240
3241         if (ret >= 0 && drv->disable_11b_rates)
3242                 nl80211_disable_11b_rates(drv, ret, 1);
3243
3244         return ret;
3245 }
3246
3247
3248 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
3249 {
3250         struct ieee80211_hdr *hdr;
3251         u16 fc;
3252         union wpa_event_data event;
3253
3254         hdr = (struct ieee80211_hdr *) buf;
3255         fc = le_to_host16(hdr->frame_control);
3256
3257         os_memset(&event, 0, sizeof(event));
3258         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
3259         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
3260         event.tx_status.dst = hdr->addr1;
3261         event.tx_status.data = buf;
3262         event.tx_status.data_len = len;
3263         event.tx_status.ack = ok;
3264         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
3265 }
3266
3267
3268 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
3269                              u8 *buf, size_t len)
3270 {
3271         union wpa_event_data event;
3272         os_memset(&event, 0, sizeof(event));
3273         event.rx_from_unknown.frame = buf;
3274         event.rx_from_unknown.len = len;
3275         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
3276 }
3277
3278
3279 static void handle_frame(struct wpa_driver_nl80211_data *drv,
3280                          u8 *buf, size_t len, int datarate, int ssi_signal)
3281 {
3282         struct ieee80211_hdr *hdr;
3283         u16 fc;
3284         union wpa_event_data event;
3285
3286         hdr = (struct ieee80211_hdr *) buf;
3287         fc = le_to_host16(hdr->frame_control);
3288
3289         switch (WLAN_FC_GET_TYPE(fc)) {
3290         case WLAN_FC_TYPE_MGMT:
3291                 os_memset(&event, 0, sizeof(event));
3292                 event.rx_mgmt.frame = buf;
3293                 event.rx_mgmt.frame_len = len;
3294                 event.rx_mgmt.datarate = datarate;
3295                 event.rx_mgmt.ssi_signal = ssi_signal;
3296                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
3297                 break;
3298         case WLAN_FC_TYPE_CTRL:
3299                 /* can only get here with PS-Poll frames */
3300                 wpa_printf(MSG_DEBUG, "CTRL");
3301                 from_unknown_sta(drv, buf, len);
3302                 break;
3303         case WLAN_FC_TYPE_DATA:
3304                 from_unknown_sta(drv, buf, len);
3305                 break;
3306         }
3307 }
3308
3309
3310 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
3311 {
3312         struct wpa_driver_nl80211_data *drv = eloop_ctx;
3313         int len;
3314         unsigned char buf[3000];
3315         struct ieee80211_radiotap_iterator iter;
3316         int ret;
3317         int datarate = 0, ssi_signal = 0;
3318         int injected = 0, failed = 0, rxflags = 0;
3319
3320         len = recv(sock, buf, sizeof(buf), 0);
3321         if (len < 0) {
3322                 perror("recv");
3323                 return;
3324         }
3325
3326         if (drv->nlmode == NL80211_IFTYPE_STATION && !drv->probe_req_report) {
3327                 wpa_printf(MSG_DEBUG, "nl80211: Ignore monitor interface "
3328                            "frame since Probe Request reporting is disabled");
3329                 return;
3330         }
3331
3332         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
3333                 printf("received invalid radiotap frame\n");
3334                 return;
3335         }
3336
3337         while (1) {
3338                 ret = ieee80211_radiotap_iterator_next(&iter);
3339                 if (ret == -ENOENT)
3340                         break;
3341                 if (ret) {
3342                         printf("received invalid radiotap frame (%d)\n", ret);
3343                         return;
3344                 }
3345                 switch (iter.this_arg_index) {
3346                 case IEEE80211_RADIOTAP_FLAGS:
3347                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
3348                                 len -= 4;
3349                         break;
3350                 case IEEE80211_RADIOTAP_RX_FLAGS:
3351                         rxflags = 1;
3352                         break;
3353                 case IEEE80211_RADIOTAP_TX_FLAGS:
3354                         injected = 1;
3355                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
3356                                         IEEE80211_RADIOTAP_F_TX_FAIL;
3357                         break;
3358                 case IEEE80211_RADIOTAP_DATA_RETRIES:
3359                         break;
3360                 case IEEE80211_RADIOTAP_CHANNEL:
3361                         /* TODO: convert from freq/flags to channel number */
3362                         break;
3363                 case IEEE80211_RADIOTAP_RATE:
3364                         datarate = *iter.this_arg * 5;
3365                         break;
3366                 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
3367                         ssi_signal = *iter.this_arg;
3368                         break;
3369                 }
3370         }
3371
3372         if (rxflags && injected)
3373                 return;
3374
3375         if (!injected)
3376                 handle_frame(drv, buf + iter.max_length,
3377                              len - iter.max_length, datarate, ssi_signal);
3378         else
3379                 handle_tx_callback(drv->ctx, buf + iter.max_length,
3380                                    len - iter.max_length, !failed);
3381 }
3382
3383
3384 /*
3385  * we post-process the filter code later and rewrite
3386  * this to the offset to the last instruction
3387  */
3388 #define PASS    0xFF
3389 #define FAIL    0xFE
3390
3391 static struct sock_filter msock_filter_insns[] = {
3392         /*
3393          * do a little-endian load of the radiotap length field
3394          */
3395         /* load lower byte into A */
3396         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
3397         /* put it into X (== index register) */
3398         BPF_STMT(BPF_MISC| BPF_TAX, 0),
3399         /* load upper byte into A */
3400         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
3401         /* left-shift it by 8 */
3402         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
3403         /* or with X */
3404         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
3405         /* put result into X */
3406         BPF_STMT(BPF_MISC| BPF_TAX, 0),
3407
3408         /*
3409          * Allow management frames through, this also gives us those
3410          * management frames that we sent ourselves with status
3411          */
3412         /* load the lower byte of the IEEE 802.11 frame control field */
3413         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
3414         /* mask off frame type and version */
3415         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
3416         /* accept frame if it's both 0, fall through otherwise */
3417         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
3418
3419         /*
3420          * TODO: add a bit to radiotap RX flags that indicates
3421          * that the sending station is not associated, then
3422          * add a filter here that filters on our DA and that flag
3423          * to allow us to deauth frames to that bad station.
3424          *
3425          * Not a regression -- we didn't do it before either.
3426          */
3427
3428 #if 0
3429         /*
3430          * drop non-data frames
3431          */
3432         /* load the lower byte of the frame control field */
3433         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
3434         /* mask off QoS bit */
3435         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
3436         /* drop non-data frames */
3437         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
3438 #endif
3439         /* load the upper byte of the frame control field */
3440         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
3441         /* mask off toDS/fromDS */
3442         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
3443         /* accept WDS frames */
3444         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
3445
3446         /*
3447          * add header length to index
3448          */
3449         /* load the lower byte of the frame control field */
3450         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
3451         /* mask off QoS bit */
3452         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
3453         /* right shift it by 6 to give 0 or 2 */
3454         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
3455         /* add data frame header length */
3456         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
3457         /* add index, was start of 802.11 header */
3458         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
3459         /* move to index, now start of LL header */
3460         BPF_STMT(BPF_MISC | BPF_TAX, 0),
3461
3462         /*
3463          * Accept empty data frames, we use those for
3464          * polling activity.
3465          */
3466         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
3467         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
3468
3469         /*
3470          * Accept EAPOL frames
3471          */
3472         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
3473         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
3474         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
3475         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
3476
3477         /* keep these last two statements or change the code below */
3478         /* return 0 == "DROP" */
3479         BPF_STMT(BPF_RET | BPF_K, 0),
3480         /* return ~0 == "keep all" */
3481         BPF_STMT(BPF_RET | BPF_K, ~0),
3482 };
3483
3484 static struct sock_fprog msock_filter = {
3485         .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
3486         .filter = msock_filter_insns,
3487 };
3488
3489
3490 static int add_monitor_filter(int s)
3491 {
3492         int idx;
3493
3494         /* rewrite all PASS/FAIL jump offsets */
3495         for (idx = 0; idx < msock_filter.len; idx++) {
3496                 struct sock_filter *insn = &msock_filter_insns[idx];
3497
3498                 if (BPF_CLASS(insn->code) == BPF_JMP) {
3499                         if (insn->code == (BPF_JMP|BPF_JA)) {
3500                                 if (insn->k == PASS)
3501                                         insn->k = msock_filter.len - idx - 2;
3502                                 else if (insn->k == FAIL)
3503                                         insn->k = msock_filter.len - idx - 3;
3504                         }
3505
3506                         if (insn->jt == PASS)
3507                                 insn->jt = msock_filter.len - idx - 2;
3508                         else if (insn->jt == FAIL)
3509                                 insn->jt = msock_filter.len - idx - 3;
3510
3511                         if (insn->jf == PASS)
3512                                 insn->jf = msock_filter.len - idx - 2;
3513                         else if (insn->jf == FAIL)
3514                                 insn->jf = msock_filter.len - idx - 3;
3515                 }
3516         }
3517
3518         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
3519                        &msock_filter, sizeof(msock_filter))) {
3520                 perror("SO_ATTACH_FILTER");
3521                 return -1;
3522         }
3523
3524         return 0;
3525 }
3526
3527
3528 static void nl80211_remove_monitor_interface(
3529         struct wpa_driver_nl80211_data *drv)
3530 {
3531         if (drv->monitor_ifidx >= 0) {
3532                 nl80211_remove_iface(drv, drv->monitor_ifidx);
3533                 drv->monitor_ifidx = -1;
3534         }
3535         if (drv->monitor_sock >= 0) {
3536                 eloop_unregister_read_sock(drv->monitor_sock);
3537                 close(drv->monitor_sock);
3538                 drv->monitor_sock = -1;
3539         }
3540 }
3541
3542
3543 static int
3544 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
3545 {
3546         char buf[IFNAMSIZ];
3547         struct sockaddr_ll ll;
3548         int optval;
3549         socklen_t optlen;
3550
3551         snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss.ifname);
3552         buf[IFNAMSIZ - 1] = '\0';
3553
3554         drv->monitor_ifidx =
3555                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
3556                                      0);
3557
3558         if (drv->monitor_ifidx < 0)
3559                 return -1;
3560
3561         if (linux_set_iface_flags(drv->ioctl_sock, buf, 1))
3562                 goto error;
3563
3564         memset(&ll, 0, sizeof(ll));
3565         ll.sll_family = AF_PACKET;
3566         ll.sll_ifindex = drv->monitor_ifidx;
3567         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
3568         if (drv->monitor_sock < 0) {
3569                 perror("socket[PF_PACKET,SOCK_RAW]");
3570                 goto error;
3571         }
3572
3573         if (add_monitor_filter(drv->monitor_sock)) {
3574                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
3575                            "interface; do filtering in user space");
3576                 /* This works, but will cost in performance. */
3577         }
3578
3579         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
3580                 perror("monitor socket bind");
3581                 goto error;
3582         }
3583
3584         optlen = sizeof(optval);
3585         optval = 20;
3586         if (setsockopt
3587             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
3588                 perror("Failed to set socket priority");
3589                 goto error;
3590         }
3591
3592         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
3593                                      drv, NULL)) {
3594                 printf("Could not register monitor read socket\n");
3595                 goto error;
3596         }
3597
3598         return 0;
3599  error:
3600         nl80211_remove_monitor_interface(drv);
3601         return -1;
3602 }
3603
3604
3605 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
3606
3607 static int wpa_driver_nl80211_hapd_send_eapol(
3608         void *priv, const u8 *addr, const u8 *data,
3609         size_t data_len, int encrypt, const u8 *own_addr)
3610 {
3611         struct i802_bss *bss = priv;
3612         struct wpa_driver_nl80211_data *drv = bss->drv;
3613         struct ieee80211_hdr *hdr;
3614         size_t len;
3615         u8 *pos;
3616         int res;
3617 #if 0 /* FIX */
3618         int qos = sta->flags & WPA_STA_WMM;
3619 #else
3620         int qos = 0;
3621 #endif
3622
3623         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
3624                 data_len;
3625         hdr = os_zalloc(len);
3626         if (hdr == NULL) {
3627                 printf("malloc() failed for i802_send_data(len=%lu)\n",
3628                        (unsigned long) len);
3629                 return -1;
3630         }
3631
3632         hdr->frame_control =
3633                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
3634         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
3635         if (encrypt)
3636                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
3637 #if 0 /* To be enabled if qos determination is added above */
3638         if (qos) {
3639                 hdr->frame_control |=
3640                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
3641         }
3642 #endif
3643
3644         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
3645         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
3646         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
3647         pos = (u8 *) (hdr + 1);
3648
3649 #if 0 /* To be enabled if qos determination is added above */
3650         if (qos) {
3651                 /* add an empty QoS header if needed */
3652                 pos[0] = 0;
3653                 pos[1] = 0;
3654                 pos += 2;
3655         }
3656 #endif
3657
3658         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
3659         pos += sizeof(rfc1042_header);
3660         WPA_PUT_BE16(pos, ETH_P_PAE);
3661         pos += 2;
3662         memcpy(pos, data, data_len);
3663
3664         res = wpa_driver_nl80211_send_frame(drv, (u8 *) hdr, len, encrypt);
3665         if (res < 0) {
3666                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
3667                            "failed: %d (%s)",
3668                            (unsigned long) len, errno, strerror(errno));
3669         }
3670         os_free(hdr);
3671
3672         return res;
3673 }
3674
3675
3676 static u32 sta_flags_nl80211(int flags)
3677 {
3678         u32 f = 0;
3679
3680         if (flags & WPA_STA_AUTHORIZED)
3681                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3682         if (flags & WPA_STA_WMM)
3683                 f |= BIT(NL80211_STA_FLAG_WME);
3684         if (flags & WPA_STA_SHORT_PREAMBLE)
3685                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
3686         if (flags & WPA_STA_MFP)
3687                 f |= BIT(NL80211_STA_FLAG_MFP);
3688
3689         return f;
3690 }
3691
3692
3693 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
3694                                             int total_flags,
3695                                             int flags_or, int flags_and)
3696 {
3697         struct i802_bss *bss = priv;
3698         struct wpa_driver_nl80211_data *drv = bss->drv;
3699         struct nl_msg *msg, *flags = NULL;
3700         struct nl80211_sta_flag_update upd;
3701
3702         msg = nlmsg_alloc();
3703         if (!msg)
3704                 return -ENOMEM;
3705
3706         flags = nlmsg_alloc();
3707         if (!flags) {
3708                 nlmsg_free(msg);
3709                 return -ENOMEM;
3710         }
3711
3712         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3713                     0, NL80211_CMD_SET_STATION, 0);
3714
3715         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3716                     if_nametoindex(bss->ifname));
3717         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3718
3719         /*
3720          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
3721          * can be removed eventually.
3722          */
3723         if (total_flags & WPA_STA_AUTHORIZED)
3724                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
3725
3726         if (total_flags & WPA_STA_WMM)
3727                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
3728
3729         if (total_flags & WPA_STA_SHORT_PREAMBLE)
3730                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
3731
3732         if (total_flags & WPA_STA_MFP)
3733                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
3734
3735         if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
3736                 goto nla_put_failure;
3737
3738         os_memset(&upd, 0, sizeof(upd));
3739         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
3740         upd.set = sta_flags_nl80211(flags_or);
3741         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
3742
3743         nlmsg_free(flags);
3744
3745         return send_and_recv_msgs(drv, msg, NULL, NULL);
3746  nla_put_failure:
3747         nlmsg_free(flags);
3748         return -ENOBUFS;
3749 }
3750
3751
3752 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
3753                                  struct wpa_driver_associate_params *params)
3754 {
3755         if (wpa_driver_nl80211_set_mode(&drv->first_bss, params->mode) ||
3756             wpa_driver_nl80211_set_freq(drv, params->freq, 0, 0)) {
3757                 nl80211_remove_monitor_interface(drv);
3758                 return -1;
3759         }
3760
3761         /* TODO: setup monitor interface (and add code somewhere to remove this
3762          * when AP mode is stopped; associate with mode != 2 or drv_deinit) */
3763
3764         return 0;
3765 }
3766
3767
3768 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
3769 {
3770         struct nl_msg *msg;
3771         int ret = -1;
3772
3773         msg = nlmsg_alloc();
3774         if (!msg)
3775                 return -1;
3776
3777         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3778                     NL80211_CMD_LEAVE_IBSS, 0);
3779         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3780         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3781         msg = NULL;
3782         if (ret) {
3783                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
3784                            "(%s)", ret, strerror(-ret));
3785                 goto nla_put_failure;
3786         }
3787
3788         ret = 0;
3789         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
3790
3791 nla_put_failure:
3792         nlmsg_free(msg);
3793         return ret;
3794 }
3795
3796
3797 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
3798                                    struct wpa_driver_associate_params *params)
3799 {
3800         struct nl_msg *msg;
3801         int ret = -1;
3802         int count = 0;
3803
3804         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
3805
3806         if (wpa_driver_nl80211_set_mode(&drv->first_bss, params->mode)) {
3807                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
3808                            "IBSS mode");
3809                 return -1;
3810         }
3811
3812 retry:
3813         msg = nlmsg_alloc();
3814         if (!msg)
3815                 return -1;
3816
3817         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3818                     NL80211_CMD_JOIN_IBSS, 0);
3819         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3820
3821         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
3822                 goto nla_put_failure;
3823
3824         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3825                           params->ssid, params->ssid_len);
3826         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
3827                 params->ssid);
3828         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
3829         drv->ssid_len = params->ssid_len;
3830
3831         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3832         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
3833
3834         ret = nl80211_set_conn_keys(params, msg);
3835         if (ret)
3836                 goto nla_put_failure;
3837
3838         if (params->wpa_ie) {
3839                 wpa_hexdump(MSG_DEBUG,
3840                             "  * Extra IEs for Beacon/Probe Response frames",
3841                             params->wpa_ie, params->wpa_ie_len);
3842                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
3843                         params->wpa_ie);
3844         }
3845
3846         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3847         msg = NULL;
3848         if (ret) {
3849                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
3850                            ret, strerror(-ret));
3851                 count++;
3852                 if (ret == -EALREADY && count == 1) {
3853                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
3854                                    "forced leave");
3855                         nl80211_leave_ibss(drv);
3856                         nlmsg_free(msg);
3857                         goto retry;
3858                 }
3859
3860                 goto nla_put_failure;
3861         }
3862         ret = 0;
3863         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
3864
3865 nla_put_failure:
3866         nlmsg_free(msg);
3867         return ret;
3868 }
3869
3870
3871 static int wpa_driver_nl80211_connect(
3872         struct wpa_driver_nl80211_data *drv,
3873         struct wpa_driver_associate_params *params)
3874 {
3875         struct nl_msg *msg;
3876         enum nl80211_auth_type type;
3877         int ret = 0;
3878
3879         msg = nlmsg_alloc();
3880         if (!msg)
3881                 return -1;
3882
3883         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
3884         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3885                     NL80211_CMD_CONNECT, 0);
3886
3887         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3888         if (params->bssid) {
3889                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
3890                            MAC2STR(params->bssid));
3891                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
3892         }
3893         if (params->freq) {
3894                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3895                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
3896         }
3897         if (params->ssid) {
3898                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3899                                   params->ssid, params->ssid_len);
3900                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
3901                         params->ssid);
3902                 if (params->ssid_len > sizeof(drv->ssid))
3903                         goto nla_put_failure;
3904                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
3905                 drv->ssid_len = params->ssid_len;
3906         }
3907         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
3908         if (params->wpa_ie)
3909                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
3910                         params->wpa_ie);
3911
3912         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
3913                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3914         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
3915                 type = NL80211_AUTHTYPE_SHARED_KEY;
3916         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
3917                 type = NL80211_AUTHTYPE_NETWORK_EAP;
3918         else if (params->auth_alg & WPA_AUTH_ALG_FT)
3919                 type = NL80211_AUTHTYPE_FT;
3920         else
3921                 goto nla_put_failure;
3922
3923         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
3924         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
3925
3926         if (params->wpa_ie && params->wpa_ie_len) {
3927                 enum nl80211_wpa_versions ver;
3928
3929                 if (params->wpa_ie[0] == WLAN_EID_RSN)
3930                         ver = NL80211_WPA_VERSION_2;
3931                 else
3932                         ver = NL80211_WPA_VERSION_1;
3933
3934                 wpa_printf(MSG_DEBUG, "  * WPA Version %d", ver);
3935                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
3936         }
3937
3938         if (params->pairwise_suite != CIPHER_NONE) {
3939                 int cipher;
3940
3941                 switch (params->pairwise_suite) {
3942                 case CIPHER_WEP40:
3943                         cipher = WLAN_CIPHER_SUITE_WEP40;
3944                         break;
3945                 case CIPHER_WEP104:
3946                         cipher = WLAN_CIPHER_SUITE_WEP104;
3947                         break;
3948                 case CIPHER_CCMP:
3949                         cipher = WLAN_CIPHER_SUITE_CCMP;
3950                         break;
3951                 case CIPHER_TKIP:
3952                 default:
3953                         cipher = WLAN_CIPHER_SUITE_TKIP;
3954                         break;
3955                 }
3956                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
3957         }
3958
3959         if (params->group_suite != CIPHER_NONE) {
3960                 int cipher;
3961
3962                 switch (params->group_suite) {
3963                 case CIPHER_WEP40:
3964                         cipher = WLAN_CIPHER_SUITE_WEP40;
3965                         break;
3966                 case CIPHER_WEP104:
3967                         cipher = WLAN_CIPHER_SUITE_WEP104;
3968                         break;
3969                 case CIPHER_CCMP:
3970                         cipher = WLAN_CIPHER_SUITE_CCMP;
3971                         break;
3972                 case CIPHER_TKIP:
3973                 default:
3974                         cipher = WLAN_CIPHER_SUITE_TKIP;
3975                         break;
3976                 }
3977                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
3978         }
3979
3980         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
3981             params->key_mgmt_suite == KEY_MGMT_PSK) {
3982                 int mgmt = WLAN_AKM_SUITE_PSK;
3983
3984                 switch (params->key_mgmt_suite) {
3985                 case KEY_MGMT_802_1X:
3986                         mgmt = WLAN_AKM_SUITE_8021X;
3987                         break;
3988                 case KEY_MGMT_PSK:
3989                 default:
3990                         mgmt = WLAN_AKM_SUITE_PSK;
3991                         break;
3992                 }
3993                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
3994         }
3995
3996         ret = nl80211_set_conn_keys(params, msg);
3997         if (ret)
3998                 goto nla_put_failure;
3999
4000         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4001         msg = NULL;
4002         if (ret) {
4003                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
4004                            "(%s)", ret, strerror(-ret));
4005                 goto nla_put_failure;
4006         }
4007         ret = 0;
4008         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
4009
4010 nla_put_failure:
4011         nlmsg_free(msg);
4012         return ret;
4013
4014 }
4015
4016
4017 static int wpa_driver_nl80211_associate(
4018         void *priv, struct wpa_driver_associate_params *params)
4019 {
4020         struct i802_bss *bss = priv;
4021         struct wpa_driver_nl80211_data *drv = bss->drv;
4022         int ret = -1;
4023         struct nl_msg *msg;
4024
4025         if (params->mode == IEEE80211_MODE_AP)
4026                 return wpa_driver_nl80211_ap(drv, params);
4027
4028         if (params->mode == IEEE80211_MODE_IBSS)
4029                 return wpa_driver_nl80211_ibss(drv, params);
4030
4031         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
4032                 if (wpa_driver_nl80211_set_mode(priv, params->mode) < 0)
4033                         return -1;
4034                 return wpa_driver_nl80211_connect(drv, params);
4035         }
4036
4037         drv->associated = 0;
4038
4039         msg = nlmsg_alloc();
4040         if (!msg)
4041                 return -1;
4042
4043         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
4044                    drv->ifindex);
4045         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
4046                     NL80211_CMD_ASSOCIATE, 0);
4047
4048         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4049         if (params->bssid) {
4050                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4051                            MAC2STR(params->bssid));
4052                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
4053         }
4054         if (params->freq) {
4055                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
4056                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
4057                 drv->assoc_freq = params->freq;
4058         } else
4059                 drv->assoc_freq = 0;
4060         if (params->ssid) {
4061                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4062                                   params->ssid, params->ssid_len);
4063                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
4064                         params->ssid);
4065                 if (params->ssid_len > sizeof(drv->ssid))
4066                         goto nla_put_failure;
4067                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4068                 drv->ssid_len = params->ssid_len;
4069         }
4070         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
4071         if (params->wpa_ie)
4072                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
4073                         params->wpa_ie);
4074
4075 #ifdef CONFIG_IEEE80211W
4076         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
4077                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
4078 #endif /* CONFIG_IEEE80211W */
4079
4080         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
4081
4082         if (params->prev_bssid) {
4083                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
4084                            MAC2STR(params->prev_bssid));
4085                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
4086                         params->prev_bssid);
4087         }
4088
4089         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4090         msg = NULL;
4091         if (ret) {
4092                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
4093                            "(%s)", ret, strerror(-ret));
4094                 nl80211_dump_scan(drv);
4095                 goto nla_put_failure;
4096         }
4097         ret = 0;
4098         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
4099                    "successfully");
4100
4101 nla_put_failure:
4102         nlmsg_free(msg);
4103         return ret;
4104 }
4105
4106
4107 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
4108                             int ifindex, int mode)
4109 {
4110         struct nl_msg *msg;
4111         int ret = -ENOBUFS;
4112
4113         msg = nlmsg_alloc();
4114         if (!msg)
4115                 return -ENOMEM;
4116
4117         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4118                     0, NL80211_CMD_SET_INTERFACE, 0);
4119         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4120         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
4121
4122         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4123         if (!ret)
4124                 return 0;
4125 nla_put_failure:
4126         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
4127                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
4128         return ret;
4129 }
4130
4131
4132 static int wpa_driver_nl80211_set_mode(void *priv, int mode)
4133 {
4134         struct i802_bss *bss = priv;
4135         struct wpa_driver_nl80211_data *drv = bss->drv;
4136         int ret = -1;
4137         int nlmode;
4138         int i;
4139
4140         switch (mode) {
4141         case 0:
4142                 nlmode = NL80211_IFTYPE_STATION;
4143                 break;
4144         case 1:
4145                 nlmode = NL80211_IFTYPE_ADHOC;
4146                 break;
4147         case 2:
4148                 nlmode = NL80211_IFTYPE_AP;
4149                 break;
4150         default:
4151                 return -1;
4152         }
4153
4154         if (nl80211_set_mode(drv, drv->ifindex, nlmode) == 0) {
4155                 drv->nlmode = nlmode;
4156                 ret = 0;
4157                 goto done;
4158         }
4159
4160         if (nlmode == drv->nlmode) {
4161                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
4162                            "requested mode - ignore error");
4163                 ret = 0;
4164                 goto done; /* Already in the requested mode */
4165         }
4166
4167         /* mac80211 doesn't allow mode changes while the device is up, so
4168          * take the device down, try to set the mode again, and bring the
4169          * device back up.
4170          */
4171         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
4172                    "interface down");
4173         for (i = 0; i < 10; i++) {
4174                 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0) ==
4175                     0) {
4176                         /* Try to set the mode again while the interface is
4177                          * down */
4178                         ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
4179                         if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname,
4180                                                   1))
4181                                 ret = -1;
4182                         if (!ret)
4183                                 break;
4184                 } else
4185                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
4186                                    "interface down");
4187                 os_sleep(0, 100000);
4188         }
4189
4190         if (!ret) {
4191                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
4192                            "interface is down");
4193                 drv->nlmode = nlmode;
4194         }
4195
4196 done:
4197         if (!ret && nlmode == NL80211_IFTYPE_AP) {
4198                 /* Setup additional AP mode functionality if needed */
4199                 if (drv->monitor_ifidx < 0 &&
4200                     nl80211_create_monitor_interface(drv))
4201                         return -1;
4202         } else if (!ret && nlmode != NL80211_IFTYPE_AP) {
4203                 /* Remove additional AP mode functionality */
4204                 nl80211_remove_monitor_interface(drv);
4205                 bss->beacon_set = 0;
4206         }
4207
4208         if (ret)
4209                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
4210                            "from %d failed", nlmode, drv->nlmode);
4211
4212         return ret;
4213 }
4214
4215
4216 static int wpa_driver_nl80211_get_capa(void *priv,
4217                                        struct wpa_driver_capa *capa)
4218 {
4219         struct i802_bss *bss = priv;
4220         struct wpa_driver_nl80211_data *drv = bss->drv;
4221         if (!drv->has_capability)
4222                 return -1;
4223         os_memcpy(capa, &drv->capa, sizeof(*capa));
4224         return 0;
4225 }
4226
4227
4228 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
4229 {
4230         struct i802_bss *bss = priv;
4231         struct wpa_driver_nl80211_data *drv = bss->drv;
4232
4233         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
4234                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
4235         drv->operstate = state;
4236         return netlink_send_oper_ifla(drv->netlink, drv->ifindex, -1,
4237                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
4238 }
4239
4240
4241 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
4242 {
4243         struct i802_bss *bss = priv;
4244         struct wpa_driver_nl80211_data *drv = bss->drv;
4245         struct nl_msg *msg;
4246         struct nl80211_sta_flag_update upd;
4247
4248         msg = nlmsg_alloc();
4249         if (!msg)
4250                 return -ENOMEM;
4251
4252         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4253                     0, NL80211_CMD_SET_STATION, 0);
4254
4255         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4256                     if_nametoindex(bss->ifname));
4257         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
4258
4259         os_memset(&upd, 0, sizeof(upd));
4260         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
4261         if (authorized)
4262                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
4263         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
4264
4265         return send_and_recv_msgs(drv, msg, NULL, NULL);
4266  nla_put_failure:
4267         return -ENOBUFS;
4268 }
4269
4270
4271 #ifdef HOSTAPD
4272
4273 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
4274 {
4275         int i;
4276         int *old;
4277
4278         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
4279                    ifidx);
4280         for (i = 0; i < drv->num_if_indices; i++) {
4281                 if (drv->if_indices[i] == 0) {
4282                         drv->if_indices[i] = ifidx;
4283                         return;
4284                 }
4285         }
4286
4287         if (drv->if_indices != drv->default_if_indices)
4288                 old = drv->if_indices;
4289         else
4290                 old = NULL;
4291
4292         drv->if_indices = os_realloc(old,
4293                                      sizeof(int) * (drv->num_if_indices + 1));
4294         if (!drv->if_indices) {
4295                 if (!old)
4296                         drv->if_indices = drv->default_if_indices;
4297                 else
4298                         drv->if_indices = old;
4299                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
4300                            "interfaces");
4301                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
4302                 return;
4303         } else if (!old)
4304                 os_memcpy(drv->if_indices, drv->default_if_indices,
4305                           sizeof(drv->default_if_indices));
4306         drv->if_indices[drv->num_if_indices] = ifidx;
4307         drv->num_if_indices++;
4308 }
4309
4310
4311 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
4312 {
4313         int i;
4314
4315         for (i = 0; i < drv->num_if_indices; i++) {
4316                 if (drv->if_indices[i] == ifidx) {
4317                         drv->if_indices[i] = 0;
4318                         break;
4319                 }
4320         }
4321 }
4322
4323
4324 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
4325 {
4326         int i;
4327
4328         for (i = 0; i < drv->num_if_indices; i++)
4329                 if (drv->if_indices[i] == ifidx)
4330                         return 1;
4331
4332         return 0;
4333 }
4334
4335
4336 static inline int min_int(int a, int b)
4337 {
4338         if (a < b)
4339                 return a;
4340         return b;
4341 }
4342
4343
4344 static int get_key_handler(struct nl_msg *msg, void *arg)
4345 {
4346         struct nlattr *tb[NL80211_ATTR_MAX + 1];
4347         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4348
4349         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4350                   genlmsg_attrlen(gnlh, 0), NULL);
4351
4352         /*
4353          * TODO: validate the key index and mac address!
4354          * Otherwise, there's a race condition as soon as
4355          * the kernel starts sending key notifications.
4356          */
4357
4358         if (tb[NL80211_ATTR_KEY_SEQ])
4359                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
4360                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
4361         return NL_SKIP;
4362 }
4363
4364
4365 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
4366                            int idx, u8 *seq)
4367 {
4368         struct i802_bss *bss = priv;
4369         struct wpa_driver_nl80211_data *drv = bss->drv;
4370         struct nl_msg *msg;
4371
4372         msg = nlmsg_alloc();
4373         if (!msg)
4374                 return -ENOMEM;
4375
4376         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4377                     0, NL80211_CMD_GET_KEY, 0);
4378
4379         if (addr)
4380                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4381         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
4382         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
4383
4384         memset(seq, 0, 6);
4385
4386         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
4387  nla_put_failure:
4388         return -ENOBUFS;
4389 }
4390
4391
4392 static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates,
4393                               int mode)
4394 {
4395         struct i802_bss *bss = priv;
4396         struct wpa_driver_nl80211_data *drv = bss->drv;
4397         struct nl_msg *msg;
4398         u8 rates[NL80211_MAX_SUPP_RATES];
4399         u8 rates_len = 0;
4400         int i;
4401
4402         msg = nlmsg_alloc();
4403         if (!msg)
4404                 return -ENOMEM;
4405
4406         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
4407                     NL80211_CMD_SET_BSS, 0);
4408
4409         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
4410                 rates[rates_len++] = basic_rates[i] / 5;
4411
4412         NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
4413
4414         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
4415
4416         return send_and_recv_msgs(drv, msg, NULL, NULL);
4417  nla_put_failure:
4418         return -ENOBUFS;
4419 }
4420
4421 #endif /* HOSTAPD */
4422
4423
4424 /* Set kernel driver on given frequency (MHz) */
4425 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
4426 {
4427         struct i802_bss *bss = priv;
4428         struct wpa_driver_nl80211_data *drv = bss->drv;
4429         return wpa_driver_nl80211_set_freq(drv, freq->freq, freq->ht_enabled,
4430                                            freq->sec_channel_offset);
4431 }
4432
4433
4434 #ifdef HOSTAPD
4435
4436 static int i802_set_rts(void *priv, int rts)
4437 {
4438         struct i802_bss *bss = priv;
4439         struct wpa_driver_nl80211_data *drv = bss->drv;
4440         struct nl_msg *msg;
4441         int ret = -ENOBUFS;
4442         u32 val;
4443
4444         msg = nlmsg_alloc();
4445         if (!msg)
4446                 return -ENOMEM;
4447
4448         if (rts >= 2347)
4449                 val = (u32) -1;
4450         else
4451                 val = rts;
4452
4453         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4454                     0, NL80211_CMD_SET_WIPHY, 0);
4455         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4456         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
4457
4458         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4459         if (!ret)
4460                 return 0;
4461 nla_put_failure:
4462         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
4463                    "%d (%s)", rts, ret, strerror(-ret));
4464         return ret;
4465 }
4466
4467
4468 static int i802_set_frag(void *priv, int frag)
4469 {
4470         struct i802_bss *bss = priv;
4471         struct wpa_driver_nl80211_data *drv = bss->drv;
4472         struct nl_msg *msg;
4473         int ret = -ENOBUFS;
4474         u32 val;
4475
4476         msg = nlmsg_alloc();
4477         if (!msg)
4478                 return -ENOMEM;
4479
4480         if (frag >= 2346)
4481                 val = (u32) -1;
4482         else
4483                 val = frag;
4484
4485         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4486                     0, NL80211_CMD_SET_WIPHY, 0);
4487         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4488         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
4489
4490         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4491         if (!ret)
4492                 return 0;
4493 nla_put_failure:
4494         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
4495                    "%d: %d (%s)", frag, ret, strerror(-ret));
4496         return ret;
4497 }
4498
4499
4500 static int i802_flush(void *priv)
4501 {
4502         struct i802_bss *bss = priv;
4503         struct wpa_driver_nl80211_data *drv = bss->drv;
4504         struct nl_msg *msg;
4505
4506         msg = nlmsg_alloc();
4507         if (!msg)
4508                 return -1;
4509
4510         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4511                     0, NL80211_CMD_DEL_STATION, 0);
4512
4513         /*
4514          * XXX: FIX! this needs to flush all VLANs too
4515          */
4516         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4517                     if_nametoindex(bss->ifname));
4518
4519         return send_and_recv_msgs(drv, msg, NULL, NULL);
4520  nla_put_failure:
4521         return -ENOBUFS;
4522 }
4523
4524
4525 static int get_sta_handler(struct nl_msg *msg, void *arg)
4526 {
4527         struct nlattr *tb[NL80211_ATTR_MAX + 1];
4528         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4529         struct hostap_sta_driver_data *data = arg;
4530         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
4531         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
4532                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
4533                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
4534                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
4535                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
4536                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
4537         };
4538
4539         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4540                   genlmsg_attrlen(gnlh, 0), NULL);
4541
4542         /*
4543          * TODO: validate the interface and mac address!
4544          * Otherwise, there's a race condition as soon as
4545          * the kernel starts sending station notifications.
4546          */
4547
4548         if (!tb[NL80211_ATTR_STA_INFO]) {
4549                 wpa_printf(MSG_DEBUG, "sta stats missing!");
4550                 return NL_SKIP;
4551         }
4552         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
4553                              tb[NL80211_ATTR_STA_INFO],
4554                              stats_policy)) {
4555                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
4556                 return NL_SKIP;
4557         }
4558
4559         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
4560                 data->inactive_msec =
4561                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
4562         if (stats[NL80211_STA_INFO_RX_BYTES])
4563                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
4564         if (stats[NL80211_STA_INFO_TX_BYTES])
4565                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
4566         if (stats[NL80211_STA_INFO_RX_PACKETS])
4567                 data->rx_packets =
4568                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
4569         if (stats[NL80211_STA_INFO_TX_PACKETS])
4570                 data->tx_packets =
4571                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
4572
4573         return NL_SKIP;
4574 }
4575
4576 static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
4577                               const u8 *addr)
4578 {
4579         struct i802_bss *bss = priv;
4580         struct wpa_driver_nl80211_data *drv = bss->drv;
4581         struct nl_msg *msg;
4582
4583         os_memset(data, 0, sizeof(*data));
4584         msg = nlmsg_alloc();
4585         if (!msg)
4586                 return -ENOMEM;
4587
4588         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4589                     0, NL80211_CMD_GET_STATION, 0);
4590
4591         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4592         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
4593
4594         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
4595  nla_put_failure:
4596         return -ENOBUFS;
4597 }
4598
4599
4600 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
4601                                     int cw_min, int cw_max, int burst_time)
4602 {
4603         struct i802_bss *bss = priv;
4604         struct wpa_driver_nl80211_data *drv = bss->drv;
4605         struct nl_msg *msg;
4606         struct nlattr *txq, *params;
4607
4608         msg = nlmsg_alloc();
4609         if (!msg)
4610                 return -1;
4611
4612         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4613                     0, NL80211_CMD_SET_WIPHY, 0);
4614
4615         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
4616
4617         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
4618         if (!txq)
4619                 goto nla_put_failure;
4620
4621         /* We are only sending parameters for a single TXQ at a time */
4622         params = nla_nest_start(msg, 1);
4623         if (!params)
4624                 goto nla_put_failure;
4625
4626         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, queue);
4627         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
4628          * 32 usec, so need to convert the value here. */
4629         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
4630         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
4631         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
4632         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
4633
4634         nla_nest_end(msg, params);
4635
4636         nla_nest_end(msg, txq);
4637
4638         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
4639                 return 0;
4640  nla_put_failure:
4641         return -1;
4642 }
4643
4644
4645 static int i802_set_bss(void *priv, int cts, int preamble, int slot)
4646 {
4647         struct i802_bss *bss = priv;
4648         struct wpa_driver_nl80211_data *drv = bss->drv;
4649         struct nl_msg *msg;
4650
4651         msg = nlmsg_alloc();
4652         if (!msg)
4653                 return -ENOMEM;
4654
4655         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
4656                     NL80211_CMD_SET_BSS, 0);
4657
4658         if (cts >= 0)
4659                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
4660         if (preamble >= 0)
4661                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
4662         if (slot >= 0)
4663                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
4664
4665         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
4666
4667         return send_and_recv_msgs(drv, msg, NULL, NULL);
4668  nla_put_failure:
4669         return -ENOBUFS;
4670 }
4671
4672
4673 static int i802_set_cts_protect(void *priv, int value)
4674 {
4675         return i802_set_bss(priv, value, -1, -1);
4676 }
4677
4678
4679 static int i802_set_preamble(void *priv, int value)
4680 {
4681         return i802_set_bss(priv, -1, value, -1);
4682 }
4683
4684
4685 static int i802_set_short_slot_time(void *priv, int value)
4686 {
4687         return i802_set_bss(priv, -1, -1, value);
4688 }
4689
4690
4691 static int i802_set_sta_vlan(void *priv, const u8 *addr,
4692                              const char *ifname, int vlan_id)
4693 {
4694         struct i802_bss *bss = priv;
4695         struct wpa_driver_nl80211_data *drv = bss->drv;
4696         struct nl_msg *msg;
4697         int ret = -ENOBUFS;
4698
4699         msg = nlmsg_alloc();
4700         if (!msg)
4701                 return -ENOMEM;
4702
4703         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
4704                     0, NL80211_CMD_SET_STATION, 0);
4705
4706         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4707                     if_nametoindex(bss->ifname));
4708         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4709         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
4710                     if_nametoindex(ifname));
4711
4712         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4713         if (ret < 0) {
4714                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
4715                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
4716                            MAC2STR(addr), ifname, vlan_id, ret,
4717                            strerror(-ret));
4718         }
4719  nla_put_failure:
4720         return ret;
4721 }
4722
4723
4724 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val)
4725 {
4726         struct i802_bss *bss = priv;
4727         struct wpa_driver_nl80211_data *drv = bss->drv;
4728         char name[IFNAMSIZ + 1];
4729
4730         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
4731         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
4732                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
4733         if (val) {
4734                 if (nl80211_create_iface(drv, name, NL80211_IFTYPE_AP_VLAN,
4735                                          NULL, 1) < 0)
4736                         return -1;
4737                 linux_set_iface_flags(drv->ioctl_sock, name, 1);
4738                 return i802_set_sta_vlan(priv, addr, name, 0);
4739         } else {
4740                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
4741                 return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
4742                                                     name);
4743         }
4744 }
4745
4746
4747 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
4748 {
4749         struct wpa_driver_nl80211_data *drv = eloop_ctx;
4750         struct sockaddr_ll lladdr;
4751         unsigned char buf[3000];
4752         int len;
4753         socklen_t fromlen = sizeof(lladdr);
4754
4755         len = recvfrom(sock, buf, sizeof(buf), 0,
4756                        (struct sockaddr *)&lladdr, &fromlen);
4757         if (len < 0) {
4758                 perror("recv");
4759                 return;
4760         }
4761
4762         if (have_ifidx(drv, lladdr.sll_ifindex))
4763                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
4764 }
4765
4766
4767 static int i802_get_inact_sec(void *priv, const u8 *addr)
4768 {
4769         struct hostap_sta_driver_data data;
4770         int ret;
4771
4772         data.inactive_msec = (unsigned long) -1;
4773         ret = i802_read_sta_data(priv, &data, addr);
4774         if (ret || data.inactive_msec == (unsigned long) -1)
4775                 return -1;
4776         return data.inactive_msec / 1000;
4777 }
4778
4779
4780 static int i802_sta_clear_stats(void *priv, const u8 *addr)
4781 {
4782 #if 0
4783         /* TODO */
4784 #endif
4785         return 0;
4786 }
4787
4788
4789 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
4790                            int reason)
4791 {
4792         struct i802_bss *bss = priv;
4793         struct ieee80211_mgmt mgmt;
4794
4795         memset(&mgmt, 0, sizeof(mgmt));
4796         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
4797                                           WLAN_FC_STYPE_DEAUTH);
4798         memcpy(mgmt.da, addr, ETH_ALEN);
4799         memcpy(mgmt.sa, own_addr, ETH_ALEN);
4800         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
4801         mgmt.u.deauth.reason_code = host_to_le16(reason);
4802         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
4803                                             IEEE80211_HDRLEN +
4804                                             sizeof(mgmt.u.deauth));
4805 }
4806
4807
4808 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
4809                              int reason)
4810 {
4811         struct i802_bss *bss = priv;
4812         struct ieee80211_mgmt mgmt;
4813
4814         memset(&mgmt, 0, sizeof(mgmt));
4815         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
4816                                           WLAN_FC_STYPE_DISASSOC);
4817         memcpy(mgmt.da, addr, ETH_ALEN);
4818         memcpy(mgmt.sa, own_addr, ETH_ALEN);
4819         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
4820         mgmt.u.disassoc.reason_code = host_to_le16(reason);
4821         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
4822                                             IEEE80211_HDRLEN +
4823                                             sizeof(mgmt.u.disassoc));
4824 }
4825
4826
4827 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
4828                              const char *brname, const char *ifname)
4829 {
4830         int ifindex;
4831         char in_br[IFNAMSIZ];
4832
4833         os_strlcpy(drv->brname, brname, IFNAMSIZ);
4834         ifindex = if_nametoindex(brname);
4835         if (ifindex == 0) {
4836                 /*
4837                  * Bridge was configured, but the bridge device does
4838                  * not exist. Try to add it now.
4839                  */
4840                 if (linux_br_add(drv->ioctl_sock, brname) < 0) {
4841                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
4842                                    "bridge interface %s: %s",
4843                                    brname, strerror(errno));
4844                         return -1;
4845                 }
4846                 drv->added_bridge = 1;
4847                 add_ifidx(drv, if_nametoindex(brname));
4848         }
4849
4850         if (linux_br_get(in_br, ifname) == 0) {
4851                 if (os_strcmp(in_br, brname) == 0)
4852                         return 0; /* already in the bridge */
4853
4854                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
4855                            "bridge %s", ifname, in_br);
4856                 if (linux_br_del_if(drv->ioctl_sock, in_br, ifname) < 0) {
4857                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
4858                                    "remove interface %s from bridge "
4859                                    "%s: %s",
4860                                    ifname, brname, strerror(errno));
4861                         return -1;
4862                 }
4863         }
4864
4865         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
4866                    ifname, brname);
4867         if (linux_br_add_if(drv->ioctl_sock, brname, ifname) < 0) {
4868                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
4869                            "into bridge %s: %s",
4870                            ifname, brname, strerror(errno));
4871                 return -1;
4872         }
4873         drv->added_if_into_bridge = 1;
4874
4875         return 0;
4876 }
4877
4878
4879 static void *i802_init(struct hostapd_data *hapd,
4880                        struct wpa_init_params *params)
4881 {
4882         struct wpa_driver_nl80211_data *drv;
4883         struct i802_bss *bss;
4884         size_t i;
4885         char brname[IFNAMSIZ];
4886         int ifindex, br_ifindex;
4887         int br_added = 0;
4888
4889         bss = wpa_driver_nl80211_init(hapd, params->ifname);
4890         if (bss == NULL)
4891                 return NULL;
4892
4893         drv = bss->drv;
4894         if (linux_br_get(brname, params->ifname) == 0) {
4895                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
4896                            params->ifname, brname);
4897                 br_ifindex = if_nametoindex(brname);
4898         } else {
4899                 brname[0] = '\0';
4900                 br_ifindex = 0;
4901         }
4902
4903         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
4904         drv->if_indices = drv->default_if_indices;
4905         for (i = 0; i < params->num_bridge; i++) {
4906                 if (params->bridge[i]) {
4907                         ifindex = if_nametoindex(params->bridge[i]);
4908                         if (ifindex)
4909                                 add_ifidx(drv, ifindex);
4910                         if (ifindex == br_ifindex)
4911                                 br_added = 1;
4912                 }
4913         }
4914         if (!br_added && br_ifindex &&
4915             (params->num_bridge == 0 || !params->bridge[0]))
4916                 add_ifidx(drv, br_ifindex);
4917
4918         /* start listening for EAPOL on the default AP interface */
4919         add_ifidx(drv, drv->ifindex);
4920
4921         if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0))
4922                 goto failed;
4923
4924         if (params->bssid) {
4925                 if (linux_set_ifhwaddr(drv->ioctl_sock, bss->ifname,
4926                                        params->bssid))
4927                         goto failed;
4928         }
4929
4930         if (wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_AP)) {
4931                 wpa_printf(MSG_ERROR, "nl80211: Failed to set interface %s "
4932                            "into AP mode", bss->ifname);
4933                 goto failed;
4934         }
4935
4936         if (params->num_bridge && params->bridge[0] &&
4937             i802_check_bridge(drv, params->bridge[0], params->ifname) < 0)
4938                 goto failed;
4939
4940         if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1))
4941                 goto failed;
4942
4943         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
4944         if (drv->eapol_sock < 0) {
4945                 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
4946                 goto failed;
4947         }
4948
4949         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
4950         {
4951                 printf("Could not register read socket for eapol\n");
4952                 goto failed;
4953         }
4954
4955         if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, params->own_addr))
4956                 goto failed;
4957
4958         return bss;
4959
4960 failed:
4961         nl80211_remove_monitor_interface(drv);
4962         if (drv->ioctl_sock >= 0)
4963                 close(drv->ioctl_sock);
4964
4965         genl_family_put(drv->nl80211);
4966         nl_cache_free(drv->nl_cache);
4967         nl_handle_destroy(drv->nl_handle);
4968         nl_cb_put(drv->nl_cb);
4969
4970         os_free(drv);
4971         return NULL;
4972 }
4973
4974
4975 static void i802_deinit(void *priv)
4976 {
4977         wpa_driver_nl80211_deinit(priv);
4978 }
4979
4980 #endif /* HOSTAPD */
4981
4982
4983 static enum nl80211_iftype wpa_driver_nl80211_if_type(
4984         enum wpa_driver_if_type type)
4985 {
4986         switch (type) {
4987         case WPA_IF_STATION:
4988                 return NL80211_IFTYPE_STATION;
4989         case WPA_IF_AP_VLAN:
4990                 return NL80211_IFTYPE_AP_VLAN;
4991         case WPA_IF_AP_BSS:
4992                 return NL80211_IFTYPE_AP;
4993         }
4994         return -1;
4995 }
4996
4997
4998 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
4999                                      const char *ifname, const u8 *addr,
5000                                      void *bss_ctx, void **drv_priv,
5001                                      char *force_ifname, u8 *if_addr)
5002 {
5003         struct i802_bss *bss = priv;
5004         struct wpa_driver_nl80211_data *drv = bss->drv;
5005         int ifidx;
5006 #ifdef HOSTAPD
5007         struct i802_bss *new_bss = NULL;
5008
5009         if (type == WPA_IF_AP_BSS) {
5010                 new_bss = os_zalloc(sizeof(*new_bss));
5011                 if (new_bss == NULL)
5012                         return -1;
5013         }
5014 #endif /* HOSTAPD */
5015
5016         if (addr)
5017                 os_memcpy(if_addr, addr, ETH_ALEN);
5018         ifidx = nl80211_create_iface(drv, ifname,
5019                                      wpa_driver_nl80211_if_type(type), addr,
5020                                      0);
5021         if (ifidx < 0) {
5022 #ifdef HOSTAPD
5023                 os_free(new_bss);
5024 #endif /* HOSTAPD */
5025                 return -1;
5026         }
5027
5028         if (!addr &&
5029             linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, if_addr) < 0)
5030                 return -1;
5031
5032 #ifdef HOSTAPD
5033         if (type == WPA_IF_AP_BSS) {
5034                 if (linux_set_iface_flags(drv->ioctl_sock, ifname, 1)) {
5035                         nl80211_remove_iface(drv, ifidx);
5036                         os_free(new_bss);
5037                         return -1;
5038                 }
5039                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
5040                 new_bss->ifindex = ifidx;
5041                 new_bss->drv = drv;
5042                 new_bss->next = drv->first_bss.next;
5043                 drv->first_bss.next = new_bss;
5044                 if (drv_priv)
5045                         *drv_priv = new_bss;
5046         }
5047 #endif /* HOSTAPD */
5048
5049         return 0;
5050 }
5051
5052
5053 static int wpa_driver_nl80211_if_remove(void *priv,
5054                                         enum wpa_driver_if_type type,
5055                                         const char *ifname)
5056 {
5057         struct i802_bss *bss = priv;
5058         struct wpa_driver_nl80211_data *drv = bss->drv;
5059         int ifindex = if_nametoindex(ifname);
5060
5061         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d",
5062                    __func__, type, ifname, ifindex);
5063         if (ifindex <= 0)
5064                 return -1;
5065         nl80211_remove_iface(drv, ifindex);
5066
5067 #ifdef HOSTAPD
5068         if (type != WPA_IF_AP_BSS)
5069                 return 0;
5070
5071         if (bss != &drv->first_bss) {
5072                 struct i802_bss *tbss = &drv->first_bss;
5073
5074                 while (tbss) {
5075                         if (tbss->next != bss)
5076                                 continue;
5077
5078                         tbss->next = bss->next;
5079                         os_free(bss);
5080                         break;
5081                 }
5082         }
5083 #endif /* HOSTAPD */
5084
5085         return 0;
5086 }
5087
5088
5089 static int cookie_handler(struct nl_msg *msg, void *arg)
5090 {
5091         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5092         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5093         u64 *cookie = arg;
5094         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5095                   genlmsg_attrlen(gnlh, 0), NULL);
5096         if (tb[NL80211_ATTR_COOKIE])
5097                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
5098         return NL_SKIP;
5099 }
5100
5101
5102 static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq,
5103                                           const u8 *dst, const u8 *src,
5104                                           const u8 *bssid,
5105                                           const u8 *data, size_t data_len)
5106 {
5107         struct i802_bss *bss = priv;
5108         struct wpa_driver_nl80211_data *drv = bss->drv;
5109         int ret = -1;
5110         struct nl_msg *msg;
5111         u8 *buf;
5112         struct ieee80211_hdr *hdr;
5113         u64 cookie;
5114
5115         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d)",
5116                    drv->ifindex);
5117
5118         buf = os_zalloc(24 + data_len);
5119         if (buf == NULL)
5120                 return ret;
5121         os_memcpy(buf + 24, data, data_len);
5122         hdr = (struct ieee80211_hdr *) buf;
5123         hdr->frame_control =
5124                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
5125         os_memcpy(hdr->addr1, dst, ETH_ALEN);
5126         os_memcpy(hdr->addr2, src, ETH_ALEN);
5127         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
5128
5129         if (drv->nlmode == NL80211_IFTYPE_AP) {
5130                 ret = wpa_driver_nl80211_send_mlme(priv, buf, 24 + data_len);
5131                 os_free(buf);
5132                 return ret;
5133         }
5134
5135         msg = nlmsg_alloc();
5136         if (!msg) {
5137                 os_free(buf);
5138                 return -1;
5139         }
5140
5141         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
5142                     NL80211_CMD_ACTION, 0);
5143
5144         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5145         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5146         NLA_PUT(msg, NL80211_ATTR_FRAME, 24 + data_len, buf);
5147         os_free(buf);
5148         buf = NULL;
5149
5150         cookie = 0;
5151         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
5152         msg = NULL;
5153         if (ret) {
5154                 wpa_printf(MSG_DEBUG, "nl80211: Action command failed: ret=%d "
5155                            "(%s)", ret, strerror(-ret));
5156                 goto nla_put_failure;
5157         }
5158         wpa_printf(MSG_DEBUG, "nl80211: Action TX command accepted; "
5159                    "cookie 0x%llx", (long long unsigned int) cookie);
5160         drv->send_action_cookie = cookie;
5161         ret = 0;
5162
5163 nla_put_failure:
5164         os_free(buf);
5165         nlmsg_free(msg);
5166         return ret;
5167 }
5168
5169
5170 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
5171                                                 unsigned int duration)
5172 {
5173         struct i802_bss *bss = priv;
5174         struct wpa_driver_nl80211_data *drv = bss->drv;
5175         struct nl_msg *msg;
5176         int ret;
5177         u64 cookie;
5178
5179         msg = nlmsg_alloc();
5180         if (!msg)
5181                 return -1;
5182
5183         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
5184                     NL80211_CMD_REMAIN_ON_CHANNEL, 0);
5185
5186         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5187         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5188         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5189
5190         cookie = 0;
5191         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
5192         if (ret == 0) {
5193                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
5194                            "0x%llx for freq=%u MHz duration=%u",
5195                            (long long unsigned int) cookie, freq, duration);
5196                 drv->remain_on_chan_cookie = cookie;
5197                 return 0;
5198         }
5199         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
5200                    "(freq=%d duration=%u): %d (%s)",
5201                    freq, duration, ret, strerror(-ret));
5202 nla_put_failure:
5203         return -1;
5204 }
5205
5206
5207 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
5208 {
5209         struct i802_bss *bss = priv;
5210         struct wpa_driver_nl80211_data *drv = bss->drv;
5211         struct nl_msg *msg;
5212         int ret;
5213
5214         if (!drv->pending_remain_on_chan) {
5215                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
5216                            "to cancel");
5217                 return -1;
5218         }
5219
5220         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
5221                    "0x%llx",
5222                    (long long unsigned int) drv->remain_on_chan_cookie);
5223
5224         msg = nlmsg_alloc();
5225         if (!msg)
5226                 return -1;
5227
5228         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
5229                     NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 0);
5230
5231         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5232         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
5233
5234         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5235         if (ret == 0)
5236                 return 0;
5237         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
5238                    "%d (%s)", ret, strerror(-ret));
5239 nla_put_failure:
5240         return -1;
5241 }
5242
5243
5244 static void wpa_driver_nl80211_probe_req_report_timeout(void *eloop_ctx,
5245                                                         void *timeout_ctx)
5246 {
5247         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5248         if (drv->monitor_ifidx < 0)
5249                 return; /* monitor interface already removed */
5250
5251         if (drv->nlmode != NL80211_IFTYPE_STATION)
5252                 return; /* not in station mode anymore */
5253
5254         if (drv->probe_req_report)
5255                 return; /* reporting enabled */
5256
5257         wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface due to no "
5258                    "Probe Request reporting needed anymore");
5259         nl80211_remove_monitor_interface(drv);
5260 }
5261
5262
5263 static int wpa_driver_nl80211_probe_req_report(void *priv, int report)
5264 {
5265         struct i802_bss *bss = priv;
5266         struct wpa_driver_nl80211_data *drv = bss->drv;
5267
5268         if (drv->nlmode != NL80211_IFTYPE_STATION) {
5269                 wpa_printf(MSG_DEBUG, "nl80211: probe_req_report control only "
5270                            "allowed in station mode (iftype=%d)",
5271                            drv->nlmode);
5272                 return -1;
5273         }
5274         drv->probe_req_report = report;
5275
5276         if (report) {
5277                 eloop_cancel_timeout(
5278                         wpa_driver_nl80211_probe_req_report_timeout,
5279                         drv, NULL);
5280                 if (drv->monitor_ifidx < 0 &&
5281                     nl80211_create_monitor_interface(drv))
5282                         return -1;
5283         } else {
5284                 /*
5285                  * It takes a while to remove the monitor interface, so try to
5286                  * avoid doing this if it is needed again shortly. Instead,
5287                  * schedule the interface to be removed later if no need for it
5288                  * is seen.
5289                  */
5290                 wpa_printf(MSG_DEBUG, "nl80211: Scheduling monitor interface "
5291                            "to be removed after 10 seconds of no use");
5292                 eloop_register_timeout(
5293                         10, 0, wpa_driver_nl80211_probe_req_report_timeout,
5294                         drv, NULL);
5295         }
5296
5297         return 0;
5298 }
5299
5300
5301 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
5302                                      int ifindex, int disabled)
5303 {
5304         struct nl_msg *msg;
5305         struct nlattr *bands, *band;
5306         int ret;
5307
5308         msg = nlmsg_alloc();
5309         if (!msg)
5310                 return -1;
5311
5312         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
5313                     NL80211_CMD_SET_TX_BITRATE_MASK, 0);
5314         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5315
5316         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
5317         if (!bands)
5318                 goto nla_put_failure;
5319
5320         /*
5321          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
5322          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
5323          * rates. All 5 GHz rates are left enabled.
5324          */
5325         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
5326         if (!band)
5327                 goto nla_put_failure;
5328         NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
5329                 "\x0c\x12\x18\x24\x30\x48\x60\x6c");
5330         nla_nest_end(msg, band);
5331
5332         nla_nest_end(msg, bands);
5333
5334         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5335         msg = NULL;
5336         if (ret) {
5337                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
5338                            "(%s)", ret, strerror(-ret));
5339         }
5340
5341         return ret;
5342
5343 nla_put_failure:
5344         nlmsg_free(msg);
5345         return -1;
5346 }
5347
5348
5349 static int wpa_driver_nl80211_disable_11b_rates(void *priv, int disabled)
5350 {
5351         struct i802_bss *bss = priv;
5352         struct wpa_driver_nl80211_data *drv = bss->drv;
5353         drv->disable_11b_rates = disabled;
5354         return nl80211_disable_11b_rates(drv, drv->ifindex, disabled);
5355 }
5356
5357
5358 static int wpa_driver_nl80211_deinit_ap(void *priv)
5359 {
5360         struct i802_bss *bss = priv;
5361         struct wpa_driver_nl80211_data *drv = bss->drv;
5362         if (drv->nlmode != NL80211_IFTYPE_AP)
5363                 return -1;
5364         wpa_driver_nl80211_del_beacon(drv);
5365         return wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA);
5366 }
5367
5368
5369 static void wpa_driver_nl80211_resume(void *priv)
5370 {
5371         struct i802_bss *bss = priv;
5372         struct wpa_driver_nl80211_data *drv = bss->drv;
5373         if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
5374                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on "
5375                            "resume event");
5376         }
5377 }
5378
5379
5380 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
5381                                   const u8 *ies, size_t ies_len)
5382 {
5383         struct i802_bss *bss = priv;
5384         struct wpa_driver_nl80211_data *drv = bss->drv;
5385         int ret;
5386         u8 *data, *pos;
5387         size_t data_len;
5388         u8 own_addr[ETH_ALEN];
5389
5390         if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, own_addr) < 0)
5391                 return -1;
5392
5393         if (action != 1) {
5394                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
5395                            "action %d", action);
5396                 return -1;
5397         }
5398
5399         /*
5400          * Action frame payload:
5401          * Category[1] = 6 (Fast BSS Transition)
5402          * Action[1] = 1 (Fast BSS Transition Request)
5403          * STA Address
5404          * Target AP Address
5405          * FT IEs
5406          */
5407
5408         data_len = 2 + 2 * ETH_ALEN + ies_len;
5409         data = os_malloc(data_len);
5410         if (data == NULL)
5411                 return -1;
5412         pos = data;
5413         *pos++ = 0x06; /* FT Action category */
5414         *pos++ = action;
5415         os_memcpy(pos, own_addr, ETH_ALEN);
5416         pos += ETH_ALEN;
5417         os_memcpy(pos, target_ap, ETH_ALEN);
5418         pos += ETH_ALEN;
5419         os_memcpy(pos, ies, ies_len);
5420
5421         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, drv->bssid,
5422                                              own_addr, drv->bssid,
5423                                              data, data_len);
5424         os_free(data);
5425
5426         return ret;
5427 }
5428
5429
5430 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
5431 {
5432         struct i802_bss *bss = priv;
5433         struct wpa_driver_nl80211_data *drv = bss->drv;
5434         struct nl_msg *msg, *cqm = NULL;
5435
5436         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
5437                    "hysteresis=%d", threshold, hysteresis);
5438
5439         msg = nlmsg_alloc();
5440         if (!msg)
5441                 return -1;
5442
5443         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
5444                     0, NL80211_CMD_SET_CQM, 0);
5445
5446         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
5447
5448         cqm = nlmsg_alloc();
5449         if (cqm == NULL)
5450                 return -1;
5451
5452         NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
5453         NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
5454         nla_put_nested(msg, NL80211_ATTR_CQM, cqm);
5455
5456         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5457                 return 0;
5458         msg = NULL;
5459
5460 nla_put_failure:
5461         if (cqm)
5462                 nlmsg_free(cqm);
5463         nlmsg_free(msg);
5464         return -1;
5465 }
5466
5467
5468 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
5469                               int encrypt)
5470 {
5471         struct i802_bss *bss = priv;
5472         struct wpa_driver_nl80211_data *drv = bss->drv;
5473         return wpa_driver_nl80211_send_frame(drv, data, data_len, encrypt);
5474 }
5475
5476
5477 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
5478         .name = "nl80211",
5479         .desc = "Linux nl80211/cfg80211",
5480         .get_bssid = wpa_driver_nl80211_get_bssid,
5481         .get_ssid = wpa_driver_nl80211_get_ssid,
5482         .set_key = wpa_driver_nl80211_set_key,
5483         .scan2 = wpa_driver_nl80211_scan,
5484         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
5485         .deauthenticate = wpa_driver_nl80211_deauthenticate,
5486         .disassociate = wpa_driver_nl80211_disassociate,
5487         .authenticate = wpa_driver_nl80211_authenticate,
5488         .associate = wpa_driver_nl80211_associate,
5489         .init = wpa_driver_nl80211_init,
5490         .deinit = wpa_driver_nl80211_deinit,
5491         .get_capa = wpa_driver_nl80211_get_capa,
5492         .set_operstate = wpa_driver_nl80211_set_operstate,
5493         .set_supp_port = wpa_driver_nl80211_set_supp_port,
5494         .set_country = wpa_driver_nl80211_set_country,
5495         .set_beacon = wpa_driver_nl80211_set_beacon,
5496         .if_add = wpa_driver_nl80211_if_add,
5497         .if_remove = wpa_driver_nl80211_if_remove,
5498         .send_mlme = wpa_driver_nl80211_send_mlme,
5499         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
5500         .sta_add = wpa_driver_nl80211_sta_add,
5501         .sta_remove = wpa_driver_nl80211_sta_remove,
5502         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
5503         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
5504 #ifdef HOSTAPD
5505         .hapd_init = i802_init,
5506         .hapd_deinit = i802_deinit,
5507         .get_seqnum = i802_get_seqnum,
5508         .flush = i802_flush,
5509         .read_sta_data = i802_read_sta_data,
5510         .sta_deauth = i802_sta_deauth,
5511         .sta_disassoc = i802_sta_disassoc,
5512         .get_inact_sec = i802_get_inact_sec,
5513         .sta_clear_stats = i802_sta_clear_stats,
5514         .set_rts = i802_set_rts,
5515         .set_frag = i802_set_frag,
5516         .set_rate_sets = i802_set_rate_sets,
5517         .set_cts_protect = i802_set_cts_protect,
5518         .set_preamble = i802_set_preamble,
5519         .set_short_slot_time = i802_set_short_slot_time,
5520         .set_tx_queue_params = i802_set_tx_queue_params,
5521         .set_sta_vlan = i802_set_sta_vlan,
5522         .set_wds_sta = i802_set_wds_sta,
5523 #endif /* HOSTAPD */
5524         .set_freq = i802_set_freq,
5525         .send_action = wpa_driver_nl80211_send_action,
5526         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
5527         .cancel_remain_on_channel =
5528         wpa_driver_nl80211_cancel_remain_on_channel,
5529         .probe_req_report = wpa_driver_nl80211_probe_req_report,
5530         .disable_11b_rates = wpa_driver_nl80211_disable_11b_rates,
5531         .deinit_ap = wpa_driver_nl80211_deinit_ap,
5532         .resume = wpa_driver_nl80211_resume,
5533         .send_ft_action = nl80211_send_ft_action,
5534         .signal_monitor = nl80211_signal_monitor,
5535         .send_frame = nl80211_send_frame,
5536 };