wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "wpa.h"
  24 #include "drivers/driver.h"
  25 #include "ieee802_11_defs.h"
  26 #include "mlme.h"
  27
  28
  29 /* Timeouts and intervals in milliseconds */
  30 #define IEEE80211_AUTH_TIMEOUT (200)
  31 #define IEEE80211_AUTH_MAX_TRIES 3
  32 #define IEEE80211_ASSOC_TIMEOUT (200)
  33 #define IEEE80211_ASSOC_MAX_TRIES 3
  34 #define IEEE80211_MONITORING_INTERVAL (2000)
  35 #define IEEE80211_PROBE_INTERVAL (60000)
  36 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  37 #define IEEE80211_SCAN_INTERVAL (2000)
  38 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  39 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  40
  41 #define IEEE80211_PROBE_DELAY (33)
  42 #define IEEE80211_CHANNEL_TIME (33)
  43 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  44 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  45 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  46 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  47
  48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  49
  50
  51 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  52
  53
  54 struct ieee80211_sta_bss {
  55         struct ieee80211_sta_bss *next;
  56         struct ieee80211_sta_bss *hnext;
  57
  58         u8 bssid[ETH_ALEN];
  59         u8 ssid[MAX_SSID_LEN];
  60         size_t ssid_len;
  61         u16 capability; /* host byte order */
  62         int hw_mode;
  63         int channel;
  64         int freq;
  65         int rssi;
  66         u8 *ie;
  67         size_t ie_len;
  68         u8 *wpa_ie;
  69         size_t wpa_ie_len;
  70         u8 *rsn_ie;
  71         size_t rsn_ie_len;
  72         u8 *wmm_ie;
  73         size_t wmm_ie_len;
  74         u8 *mdie;
  75         size_t mdie_len;
  76 #define IEEE80211_MAX_SUPP_RATES 32
  77         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  78         size_t supp_rates_len;
  79         int beacon_int;
  80         u64 timestamp;
  81
  82         int probe_resp;
  83         struct os_time last_update;
  84 };
  85
  86
  87 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  88                                      const u8 *dst,
  89                                      const u8 *ssid, size_t ssid_len);
  90 static struct ieee80211_sta_bss *
  91 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  92 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  93 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  94 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  95 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  96
  97
  98 /* Parsed Information Elements */
  99 struct ieee802_11_elems {
 100         u8 *ssid;
 101         u8 ssid_len;
 102         u8 *supp_rates;
 103         u8 supp_rates_len;
 104         u8 *fh_params;
 105         u8 fh_params_len;
 106         u8 *ds_params;
 107         u8 ds_params_len;
 108         u8 *cf_params;
 109         u8 cf_params_len;
 110         u8 *tim;
 111         u8 tim_len;
 112         u8 *ibss_params;
 113         u8 ibss_params_len;
 114         u8 *challenge;
 115         u8 challenge_len;
 116         u8 *wpa;
 117         u8 wpa_len;
 118         u8 *rsn;
 119         u8 rsn_len;
 120         u8 *erp_info;
 121         u8 erp_info_len;
 122         u8 *ext_supp_rates;
 123         u8 ext_supp_rates_len;
 124         u8 *wmm_info;
 125         u8 wmm_info_len;
 126         u8 *wmm_param;
 127         u8 wmm_param_len;
 128         u8 *mdie;
 129         u8 mdie_len;
 130         u8 *ftie;
 131         u8 ftie_len;
 132 };
 133
 134 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
 135
 136
 137 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 138                                        struct ieee802_11_elems *elems)
 139 {
 140         size_t left = len;
 141         u8 *pos = start;
 142         int unknown = 0;
 143
 144         os_memset(elems, 0, sizeof(*elems));
 145
 146         while (left >= 2) {
 147                 u8 id, elen;
 148
 149                 id = *pos++;
 150                 elen = *pos++;
 151                 left -= 2;
 152
 153                 if (elen > left) {
 154 #if 0
 155                         wpa_printf(MSG_MSGDUMP, "MLME: IEEE 802.11 element "
 156                                    "parse failed (id=%d elen=%d left=%d)",
 157                                    id, elen, left);
 158 #endif
 159                         return ParseFailed;
 160                 }
 161
 162                 switch (id) {
 163                 case WLAN_EID_SSID:
 164                         elems->ssid = pos;
 165                         elems->ssid_len = elen;
 166                         break;
 167                 case WLAN_EID_SUPP_RATES:
 168                         elems->supp_rates = pos;
 169                         elems->supp_rates_len = elen;
 170                         break;
 171                 case WLAN_EID_FH_PARAMS:
 172                         elems->fh_params = pos;
 173                         elems->fh_params_len = elen;
 174                         break;
 175                 case WLAN_EID_DS_PARAMS:
 176                         elems->ds_params = pos;
 177                         elems->ds_params_len = elen;
 178                         break;
 179                 case WLAN_EID_CF_PARAMS:
 180                         elems->cf_params = pos;
 181                         elems->cf_params_len = elen;
 182                         break;
 183                 case WLAN_EID_TIM:
 184                         elems->tim = pos;
 185                         elems->tim_len = elen;
 186                         break;
 187                 case WLAN_EID_IBSS_PARAMS:
 188                         elems->ibss_params = pos;
 189                         elems->ibss_params_len = elen;
 190                         break;
 191                 case WLAN_EID_CHALLENGE:
 192                         elems->challenge = pos;
 193                         elems->challenge_len = elen;
 194                         break;
 195                 case WLAN_EID_VENDOR_SPECIFIC:
 196                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 197                             pos[2] == 0xf2) {
 198                                 /* Microsoft OUI (00:50:F2) */
 199                                 if (pos[3] == 1) {
 200                                         /* OUI Type 1 - WPA IE */
 201                                         elems->wpa = pos;
 202                                         elems->wpa_len = elen;
 203                                 } else if (elen >= 5 && pos[3] == 2) {
 204                                         if (pos[4] == 0) {
 205                                                 elems->wmm_info = pos;
 206                                                 elems->wmm_info_len = elen;
 207                                         } else if (pos[4] == 1) {
 208                                                 elems->wmm_param = pos;
 209                                                 elems->wmm_param_len = elen;
 210                                         }
 211                                 }
 212                         }
 213                         break;
 214                 case WLAN_EID_RSN:
 215                         elems->rsn = pos;
 216                         elems->rsn_len = elen;
 217                         break;
 218                 case WLAN_EID_ERP_INFO:
 219                         elems->erp_info = pos;
 220                         elems->erp_info_len = elen;
 221                         break;
 222                 case WLAN_EID_EXT_SUPP_RATES:
 223                         elems->ext_supp_rates = pos;
 224                         elems->ext_supp_rates_len = elen;
 225                         break;
 226                 case WLAN_EID_MOBILITY_DOMAIN:
 227                         elems->mdie = pos;
 228                         elems->mdie_len = elen;
 229                         break;
 230                 case WLAN_EID_FAST_BSS_TRANSITION:
 231                         elems->ftie = pos;
 232                         elems->ftie_len = elen;
 233                         break;
 234                 default:
 235 #if 0
 236                         wpa_printf(MSG_MSGDUMP "MLME: IEEE 802.11 element "
 237                                    "parse ignored unknown element (id=%d "
 238                                    "elen=%d)", id, elen);
 239 #endif
 240                         unknown++;
 241                         break;
 242                 }
 243
 244                 left -= elen;
 245                 pos += elen;
 246         }
 247
 248         if (left)
 249                 return ParseFailed;
 250
 251         return unknown ? ParseUnknown : ParseOK;
 252 }
 253
 254
 255 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 256                                      wpa_hw_mode phymode, int chan,
 257                                      int freq)
 258 {
 259         size_t i;
 260         struct wpa_hw_modes *mode;
 261
 262         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 263                 mode = &wpa_s->mlme.modes[i];
 264                 if (mode->mode == phymode) {
 265                         wpa_s->mlme.curr_rates = mode->rates;
 266                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 267                         break;
 268                 }
 269         }
 270
 271         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 272 }
 273
 274
 275
 276 #if 0 /* FIX */
 277 static int ecw2cw(int ecw)
 278 {
 279         int cw = 1;
 280         while (ecw > 0) {
 281                 cw <<= 1;
 282                 ecw--;
 283         }
 284         return cw - 1;
 285 }
 286 #endif
 287
 288
 289 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 290                                      u8 *wmm_param, size_t wmm_param_len)
 291 {
 292         size_t left;
 293         int count;
 294         u8 *pos;
 295
 296         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 297                 return;
 298         count = wmm_param[6] & 0x0f;
 299         if (count == wpa_s->mlme.wmm_last_param_set)
 300                 return;
 301         wpa_s->mlme.wmm_last_param_set = count;
 302
 303         pos = wmm_param + 8;
 304         left = wmm_param_len - 8;
 305
 306 #if 0 /* FIX */
 307         wmm_acm = 0;
 308         for (; left >= 4; left -= 4, pos += 4) {
 309                 int aci = (pos[0] >> 5) & 0x03;
 310                 int acm = (pos[0] >> 4) & 0x01;
 311                 int queue;
 312
 313                 switch (aci) {
 314                 case 1:
 315                         queue = IEEE80211_TX_QUEUE_DATA3;
 316                         if (acm)
 317                                 wmm_acm |= BIT(1) | BIT(2);
 318                         break;
 319                 case 2:
 320                         queue = IEEE80211_TX_QUEUE_DATA1;
 321                         if (acm)
 322                                 wmm_acm |= BIT(4) | BIT(5);
 323                         break;
 324                 case 3:
 325                         queue = IEEE80211_TX_QUEUE_DATA0;
 326                         if (acm)
 327                                 wmm_acm |= BIT(6) | BIT(7);
 328                         break;
 329                 case 0:
 330                 default:
 331                         queue = IEEE80211_TX_QUEUE_DATA2;
 332                         if (acm)
 333                                 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
 334                         break;
 335                 }
 336
 337                 params.aifs = pos[0] & 0x0f;
 338                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 339                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 340                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 341                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 342                 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
 343                            "aifs=%d cWmin=%d cWmax=%d burst=%d",
 344                            queue, aci, acm, params.aifs, params.cw_min,
 345                            params.cw_max, params.burst_time);
 346                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 347                  * AC for now) */
 348                 if (local->hw->conf_tx(local->mdev, queue, &params)) {
 349                         wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
 350                                    "parameters for queue %d", queue);
 351                 }
 352         }
 353 #endif
 354 }
 355
 356
 357 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 358 {
 359         if (wpa_s->mlme.associated == assoc && !assoc)
 360                 return;
 361
 362         wpa_s->mlme.associated = assoc;
 363
 364         if (assoc) {
 365                 union wpa_event_data data;
 366                 os_memset(&data, 0, sizeof(data));
 367                 wpa_s->mlme.prev_bssid_set = 1;
 368                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 369                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 370                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 371                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 372                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 373                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 374         } else {
 375                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 376         }
 377         os_get_time(&wpa_s->mlme.last_probe);
 378 }
 379
 380
 381 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 382                             size_t len)
 383 {
 384         return wpa_drv_send_mlme(wpa_s, buf, len);
 385 }
 386
 387
 388 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 389                                 int transaction, u8 *extra, size_t extra_len,
 390                                 int encrypt)
 391 {
 392         u8 *buf;
 393         size_t len;
 394         struct ieee80211_mgmt *mgmt;
 395
 396         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 397         if (buf == NULL) {
 398                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 399                            "auth frame");
 400                 return;
 401         }
 402
 403         mgmt = (struct ieee80211_mgmt *) buf;
 404         len = 24 + 6;
 405         os_memset(mgmt, 0, 24 + 6);
 406         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 407                                            WLAN_FC_STYPE_AUTH);
 408         if (encrypt)
 409                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 410         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 411         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 412         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 413         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 414         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 415         wpa_s->mlme.auth_transaction = transaction + 1;
 416         mgmt->u.auth.status_code = host_to_le16(0);
 417         if (extra) {
 418                 os_memcpy(buf + len, extra, extra_len);
 419                 len += extra_len;
 420         }
 421
 422         ieee80211_sta_tx(wpa_s, buf, len);
 423         os_free(buf);
 424 }
 425
 426
 427 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 428 {
 429         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 430         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 431                                ieee80211_sta_timer, wpa_s, NULL);
 432 }
 433
 434
 435 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 436 {
 437         u8 *extra;
 438         size_t extra_len;
 439
 440         wpa_s->mlme.auth_tries++;
 441         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 442                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 443                            " timed out", MAC2STR(wpa_s->bssid));
 444                 return;
 445         }
 446
 447         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 448         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 449                    MAC2STR(wpa_s->bssid));
 450
 451         extra = NULL;
 452         extra_len = 0;
 453
 454 #ifdef CONFIG_IEEE80211R
 455         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 456              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 457             wpa_s->mlme.ft_ies) {
 458                 struct ieee80211_sta_bss *bss;
 459                 struct rsn_mdie *mdie = NULL;
 460                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 461                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 462                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 463                 if (mdie &&
 464                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 465                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 466                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 467                                    "over-the-air");
 468                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 469                         extra = wpa_s->mlme.ft_ies;
 470                         extra_len = wpa_s->mlme.ft_ies_len;
 471                 }
 472         }
 473 #endif /* CONFIG_IEEE80211R */
 474
 475         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 476
 477         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 478 }
 479
 480
 481 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 482 {
 483         struct ieee80211_mgmt *mgmt;
 484         u8 *pos, *ies, *buf;
 485         int i, len;
 486         u16 capab;
 487         struct ieee80211_sta_bss *bss;
 488         int wmm = 0;
 489         size_t blen, buflen;
 490
 491         if (wpa_s->mlme.curr_rates == NULL) {
 492                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 493                 return;
 494         }
 495
 496         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 497                 wpa_s->mlme.ssid_len;
 498 #ifdef CONFIG_IEEE80211R
 499         if (wpa_s->mlme.ft_ies)
 500                 buflen += wpa_s->mlme.ft_ies_len;
 501 #endif /* CONFIG_IEEE80211R */
 502         buf = os_malloc(buflen);
 503         if (buf == NULL) {
 504                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 505                            "assoc frame");
 506                 return;
 507         }
 508         blen = 0;
 509
 510         capab = wpa_s->mlme.capab;
 511         if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
 512                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 513                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 514         }
 515         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 516         if (bss) {
 517                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 518                         capab |= WLAN_CAPABILITY_PRIVACY;
 519                 if (bss->wmm_ie) {
 520                         wmm = 1;
 521                 }
 522         }
 523
 524         mgmt = (struct ieee80211_mgmt *) buf;
 525         blen += 24;
 526         os_memset(mgmt, 0, 24);
 527         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 528         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 529         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 530
 531         if (wpa_s->mlme.prev_bssid_set) {
 532                 blen += 10;
 533                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 534                                                    WLAN_FC_STYPE_REASSOC_REQ);
 535                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 536                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 537                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 538                           wpa_s->mlme.prev_bssid,
 539                           ETH_ALEN);
 540         } else {
 541                 blen += 4;
 542                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 543                                                    WLAN_FC_STYPE_ASSOC_REQ);
 544                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 545                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 546         }
 547
 548         /* SSID */
 549         ies = pos = buf + blen;
 550         blen += 2 + wpa_s->mlme.ssid_len;
 551         *pos++ = WLAN_EID_SSID;
 552         *pos++ = wpa_s->mlme.ssid_len;
 553         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 554
 555         len = wpa_s->mlme.num_curr_rates;
 556         if (len > 8)
 557                 len = 8;
 558         pos = buf + blen;
 559         blen += len + 2;
 560         *pos++ = WLAN_EID_SUPP_RATES;
 561         *pos++ = len;
 562         for (i = 0; i < len; i++) {
 563                 int rate = wpa_s->mlme.curr_rates[i].rate;
 564                 *pos++ = (u8) (rate / 5);
 565         }
 566
 567         if (wpa_s->mlme.num_curr_rates > len) {
 568                 pos = buf + blen;
 569                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 570                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 571                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 572                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
 573                         int rate = wpa_s->mlme.curr_rates[i].rate;
 574                         *pos++ = (u8) (rate / 5);
 575                 }
 576         }
 577
 578         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 579                 pos = buf + blen;
 580                 blen += wpa_s->mlme.extra_ie_len;
 581                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 582         }
 583
 584 #ifdef CONFIG_IEEE80211R
 585         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 586              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 587             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 588             bss && bss->mdie &&
 589             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 590             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 591                 pos = buf + blen;
 592                 blen += 2 + sizeof(struct rsn_mdie);
 593                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 594                 *pos++ = sizeof(struct rsn_mdie);
 595                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 596                 pos += MOBILITY_DOMAIN_ID_LEN;
 597                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 598         }
 599
 600         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 601              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 602             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 603                 pos = buf + blen;
 604                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 605                 pos += wpa_s->mlme.ft_ies_len;
 606                 blen += wpa_s->mlme.ft_ies_len;
 607         }
 608 #endif /* CONFIG_IEEE80211R */
 609
 610         if (wmm && wpa_s->mlme.wmm_enabled) {
 611                 pos = buf + blen;
 612                 blen += 9;
 613                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 614                 *pos++ = 7; /* len */
 615                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 616                 *pos++ = 0x50;
 617                 *pos++ = 0xf2;
 618                 *pos++ = 2; /* WME */
 619                 *pos++ = 0; /* WME info */
 620                 *pos++ = 1; /* WME ver */
 621                 *pos++ = 0;
 622         }
 623
 624         os_free(wpa_s->mlme.assocreq_ies);
 625         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 626         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 627         if (wpa_s->mlme.assocreq_ies) {
 628                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 629                           wpa_s->mlme.assocreq_ies_len);
 630         }
 631
 632         ieee80211_sta_tx(wpa_s, buf, blen);
 633         os_free(buf);
 634 }
 635
 636
 637 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 638 {
 639         u8 *buf;
 640         size_t len;
 641         struct ieee80211_mgmt *mgmt;
 642
 643         buf = os_zalloc(sizeof(*mgmt));
 644         if (buf == NULL) {
 645                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 646                            "deauth frame");
 647                 return;
 648         }
 649
 650         mgmt = (struct ieee80211_mgmt *) buf;
 651         len = 24;
 652         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 653         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 654         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 655         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 656                                            WLAN_FC_STYPE_DEAUTH);
 657         len += 2;
 658         mgmt->u.deauth.reason_code = host_to_le16(reason);
 659
 660         ieee80211_sta_tx(wpa_s, buf, len);
 661         os_free(buf);
 662 }
 663
 664
 665 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 666 {
 667         u8 *buf;
 668         size_t len;
 669         struct ieee80211_mgmt *mgmt;
 670
 671         buf = os_zalloc(sizeof(*mgmt));
 672         if (buf == NULL) {
 673                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 674                            "disassoc frame");
 675                 return;
 676         }
 677
 678         mgmt = (struct ieee80211_mgmt *) buf;
 679         len = 24;
 680         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 681         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 682         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 683         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 684                                            WLAN_FC_STYPE_DISASSOC);
 685         len += 2;
 686         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 687
 688         ieee80211_sta_tx(wpa_s, buf, len);
 689         os_free(buf);
 690 }
 691
 692
 693 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 694 {
 695         struct ieee80211_sta_bss *bss;
 696         int res = 0;
 697
 698         if (wpa_s->mlme.mixed_cell ||
 699             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 700                 return 0;
 701
 702         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 703         if (bss == NULL)
 704                 return 0;
 705
 706         if (ieee80211_sta_wep_configured(wpa_s) !=
 707             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 708                 res = 1;
 709
 710         return res;
 711 }
 712
 713
 714 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 715 {
 716         wpa_s->mlme.assoc_tries++;
 717         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 718                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 719                            " timed out", MAC2STR(wpa_s->bssid));
 720                 return;
 721         }
 722
 723         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 724         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 725                    MAC2STR(wpa_s->bssid));
 726         if (ieee80211_privacy_mismatch(wpa_s)) {
 727                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 728                            "configuration and mixed-cell disabled - abort "
 729                            "association");
 730                 return;
 731         }
 732
 733         ieee80211_send_assoc(wpa_s);
 734
 735         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 736 }
 737
 738
 739 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 740 {
 741         int disassoc;
 742
 743         /* TODO: start monitoring current AP signal quality and number of
 744          * missed beacons. Scan other channels every now and then and search
 745          * for better APs. */
 746         /* TODO: remove expired BSSes */
 747
 748         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 749
 750 #if 0 /* FIX */
 751         sta = sta_info_get(local, wpa_s->bssid);
 752         if (sta == NULL) {
 753                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 754                            MAC2STR(wpa_s->bssid));
 755                 disassoc = 1;
 756         } else {
 757                 disassoc = 0;
 758                 if (time_after(jiffies,
 759                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 760                         if (wpa_s->mlme.probereq_poll) {
 761                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 762                                            "current AP " MACSTR " - assume "
 763                                            "out of range",
 764                                            MAC2STR(wpa_s->bssid));
 765                                 disassoc = 1;
 766                         } else {
 767                                 ieee80211_send_probe_req(
 768                                         wpa_s->bssid,
 769                                         wpa_s->mlme.scan_ssid,
 770                                         wpa_s->mlme.scan_ssid_len);
 771                                 wpa_s->mlme.probereq_poll = 1;
 772                         }
 773                 } else {
 774                         wpa_s->mlme.probereq_poll = 0;
 775                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 776                                        IEEE80211_PROBE_INTERVAL)) {
 777                                 wpa_s->mlme.last_probe = jiffies;
 778                                 ieee80211_send_probe_req(wpa_s->bssid,
 779                                                          wpa_s->mlme.ssid,
 780                                                          wpa_s->mlme.ssid_len);
 781                         }
 782                 }
 783                 sta_info_release(local, sta);
 784         }
 785 #else
 786         disassoc = 0;
 787 #endif
 788         if (disassoc) {
 789                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 790                 ieee80211_reschedule_timer(wpa_s,
 791                                            IEEE80211_MONITORING_INTERVAL +
 792                                            30000);
 793         } else {
 794                 ieee80211_reschedule_timer(wpa_s,
 795                                            IEEE80211_MONITORING_INTERVAL);
 796         }
 797 }
 798
 799
 800 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 801                                      const u8 *dst,
 802                                      const u8 *ssid, size_t ssid_len)
 803 {
 804         u8 *buf;
 805         size_t len;
 806         struct ieee80211_mgmt *mgmt;
 807         u8 *pos, *supp_rates;
 808         u8 *esupp_rates = NULL;
 809         int i;
 810
 811         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 812         if (buf == NULL) {
 813                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 814                            "probe request");
 815                 return;
 816         }
 817
 818         mgmt = (struct ieee80211_mgmt *) buf;
 819         len = 24;
 820         os_memset(mgmt, 0, 24);
 821         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 822                                            WLAN_FC_STYPE_PROBE_REQ);
 823         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 824         if (dst) {
 825                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 826                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 827         } else {
 828                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 829                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 830         }
 831         pos = buf + len;
 832         len += 2 + ssid_len;
 833         *pos++ = WLAN_EID_SSID;
 834         *pos++ = ssid_len;
 835         os_memcpy(pos, ssid, ssid_len);
 836
 837         supp_rates = buf + len;
 838         len += 2;
 839         supp_rates[0] = WLAN_EID_SUPP_RATES;
 840         supp_rates[1] = 0;
 841         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 842                 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
 843                 if (!(rate->flags & WPA_RATE_SUPPORTED))
 844                         continue;
 845                 if (esupp_rates) {
 846                         pos = buf + len;
 847                         len++;
 848                         esupp_rates[1]++;
 849                 } else if (supp_rates[1] == 8) {
 850                         esupp_rates = pos;
 851                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 852                         esupp_rates[1] = 1;
 853                         pos = &esupp_rates[2];
 854                 } else {
 855                         pos = buf + len;
 856                         len++;
 857                         supp_rates[1]++;
 858                 }
 859                 *pos++ = rate->rate / 5;
 860         }
 861
 862         if (wpa_s->mlme.extra_probe_ie) {
 863                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 864                           wpa_s->mlme.extra_probe_ie_len);
 865                 len += wpa_s->mlme.extra_probe_ie_len;
 866         }
 867
 868         ieee80211_sta_tx(wpa_s, buf, len);
 869         os_free(buf);
 870 }
 871
 872
 873 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 874 {
 875 #if 0 /* FIX */
 876         if (sdata == NULL || sdata->default_key == NULL ||
 877             sdata->default_key->alg != ALG_WEP)
 878                 return 0;
 879         return 1;
 880 #else
 881         return 0;
 882 #endif
 883 }
 884
 885
 886 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 887 {
 888         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 889         wpa_s->mlme.authenticated = 1;
 890         ieee80211_associate(wpa_s);
 891 }
 892
 893
 894 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 895                                      struct ieee80211_mgmt *mgmt,
 896                                      size_t len,
 897                                      struct ieee80211_rx_status *rx_status)
 898 {
 899         u8 *pos;
 900         struct ieee802_11_elems elems;
 901
 902         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 903         pos = mgmt->u.auth.variable;
 904         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 905             == ParseFailed) {
 906                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 907                 return;
 908         }
 909         if (elems.challenge == NULL) {
 910                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 911                            "auth frame");
 912                 return;
 913         }
 914         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 915                             elems.challenge_len + 2, 1);
 916 }
 917
 918
 919 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 920                                    struct ieee80211_mgmt *mgmt,
 921                                    size_t len,
 922                                    struct ieee80211_rx_status *rx_status)
 923 {
 924         struct wpa_ssid *ssid = wpa_s->current_ssid;
 925         u16 auth_alg, auth_transaction, status_code;
 926         int adhoc;
 927
 928         adhoc = ssid && ssid->mode == 1;
 929
 930         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 931                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 932                            "from " MACSTR ", but not in authenticate state - "
 933                            "ignored", MAC2STR(mgmt->sa));
 934                 return;
 935         }
 936
 937         if (len < 24 + 6) {
 938                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 939                            "frame received from " MACSTR " - ignored",
 940                            (unsigned long) len, MAC2STR(mgmt->sa));
 941                 return;
 942         }
 943
 944         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 945                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 946                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 947                            ") - ignored",
 948                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 949                 return;
 950         }
 951
 952         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 953                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 954                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 955                            ") - ignored",
 956                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 957                 return;
 958         }
 959
 960         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 961         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 962         status_code = le_to_host16(mgmt->u.auth.status_code);
 963
 964         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 965                    " (alg=%d transaction=%d status=%d)",
 966                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 967
 968         if (adhoc) {
 969                 /* IEEE 802.11 standard does not require authentication in IBSS
 970                  * networks and most implementations do not seem to use it.
 971                  * However, try to reply to authentication attempts if someone
 972                  * has actually implemented this.
 973                  * TODO: Could implement shared key authentication. */
 974                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 975                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 976                                    "authentication frame (alg=%d "
 977                                    "transaction=%d)",
 978                                    auth_alg, auth_transaction);
 979                         return;
 980                 }
 981                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 982         }
 983
 984         if (auth_alg != wpa_s->mlme.auth_alg ||
 985             auth_transaction != wpa_s->mlme.auth_transaction) {
 986                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 987                            "(alg=%d transaction=%d)",
 988                            auth_alg, auth_transaction);
 989                 return;
 990         }
 991
 992         if (status_code != WLAN_STATUS_SUCCESS) {
 993                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 994                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
 995                            status_code);
 996                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 997                         const int num_algs = 3;
 998                         u8 algs[num_algs];
 999                         int i, pos;
1000                         algs[0] = algs[1] = algs[2] = 0xff;
1001                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
1002                                 algs[0] = WLAN_AUTH_OPEN;
1003                         if (wpa_s->mlme.auth_algs &
1004                             IEEE80211_AUTH_ALG_SHARED_KEY)
1005                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1006                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
1007                                 algs[2] = WLAN_AUTH_LEAP;
1008                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
1009                                 pos = 0;
1010                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
1011                                 pos = 1;
1012                         else
1013                                 pos = 2;
1014                         for (i = 0; i < num_algs; i++) {
1015                                 pos++;
1016                                 if (pos >= num_algs)
1017                                         pos = 0;
1018                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
1019                                     algs[pos] == 0xff)
1020                                         continue;
1021                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1022                                     !ieee80211_sta_wep_configured(wpa_s))
1023                                         continue;
1024                                 wpa_s->mlme.auth_alg = algs[pos];
1025                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
1026                                            "for next try",
1027                                            wpa_s->mlme.auth_alg);
1028                                 break;
1029                         }
1030                 }
1031                 return;
1032         }
1033
1034         switch (wpa_s->mlme.auth_alg) {
1035         case WLAN_AUTH_OPEN:
1036         case WLAN_AUTH_LEAP:
1037                 ieee80211_auth_completed(wpa_s);
1038                 break;
1039         case WLAN_AUTH_SHARED_KEY:
1040                 if (wpa_s->mlme.auth_transaction == 4)
1041                         ieee80211_auth_completed(wpa_s);
1042                 else
1043                         ieee80211_auth_challenge(wpa_s, mgmt, len,
1044                                                  rx_status);
1045                 break;
1046 #ifdef CONFIG_IEEE80211R
1047         case WLAN_AUTH_FT:
1048         {
1049                 union wpa_event_data data;
1050                 os_memset(&data, 0, sizeof(data));
1051                 data.ft_ies.ies = mgmt->u.auth.variable;
1052                 data.ft_ies.ies_len = len -
1053                         (mgmt->u.auth.variable - (u8 *) mgmt);
1054                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
1055                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1056                 ieee80211_auth_completed(wpa_s);
1057                 break;
1058         }
1059 #endif /* CONFIG_IEEE80211R */
1060         }
1061 }
1062
1063
1064 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
1065                                      struct ieee80211_mgmt *mgmt,
1066                                      size_t len,
1067                                      struct ieee80211_rx_status *rx_status)
1068 {
1069         u16 reason_code;
1070
1071         if (len < 24 + 2) {
1072                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
1073                            "frame received from " MACSTR " - ignored",
1074                            (unsigned long) len, MAC2STR(mgmt->sa));
1075                 return;
1076         }
1077
1078         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1079                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
1080                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1081                            ") - ignored",
1082                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1083                 return;
1084         }
1085
1086         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1087
1088         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
1089                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1090
1091         if (wpa_s->mlme.authenticated)
1092                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
1093
1094         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
1095             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
1096             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1097                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
1098                 ieee80211_reschedule_timer(wpa_s,
1099                                            IEEE80211_RETRY_AUTH_INTERVAL);
1100         }
1101
1102         ieee80211_set_associated(wpa_s, 0);
1103         wpa_s->mlme.authenticated = 0;
1104 }
1105
1106
1107 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
1108                                        struct ieee80211_mgmt *mgmt,
1109                                        size_t len,
1110                                        struct ieee80211_rx_status *rx_status)
1111 {
1112         u16 reason_code;
1113
1114         if (len < 24 + 2) {
1115                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
1116                            "frame received from " MACSTR " - ignored",
1117                            (unsigned long) len, MAC2STR(mgmt->sa));
1118                 return;
1119         }
1120
1121         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1122                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
1123                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1124                            ") - ignored",
1125                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1126                 return;
1127         }
1128
1129         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
1130
1131         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
1132                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1133
1134         if (wpa_s->mlme.associated)
1135                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
1136
1137         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1138                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
1139                 ieee80211_reschedule_timer(wpa_s,
1140                                            IEEE80211_RETRY_AUTH_INTERVAL);
1141         }
1142
1143         ieee80211_set_associated(wpa_s, 0);
1144 }
1145
1146
1147 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1148                                    struct ieee802_11_elems *elems)
1149 {
1150 #ifdef CONFIG_IEEE80211R
1151         const u8 *mobility_domain = NULL;
1152         const u8 *r0kh_id = NULL;
1153         size_t r0kh_id_len = 0;
1154         const u8 *r1kh_id = NULL;
1155         struct rsn_ftie *hdr;
1156         const u8 *pos, *end;
1157
1158         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1159                 mobility_domain = elems->mdie;
1160         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1161                 end = elems->ftie + elems->ftie_len;
1162                 hdr = (struct rsn_ftie *) elems->ftie;
1163                 pos = (const u8 *) (hdr + 1);
1164                 while (pos + 1 < end) {
1165                         if (pos + 2 + pos[1] > end)
1166                                 break;
1167                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1168                             pos[1] == FT_R1KH_ID_LEN)
1169                                 r1kh_id = pos + 2;
1170                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1171                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1172                                 r0kh_id = pos + 2;
1173                                 r0kh_id_len = pos[1];
1174                         }
1175                         pos += 2 + pos[1];
1176                 }
1177         }
1178         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1179                                     r0kh_id_len, r1kh_id);
1180 #else /* CONFIG_IEEE80211R */
1181         return 0;
1182 #endif /* CONFIG_IEEE80211R */
1183 }
1184
1185
1186 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1187                                          struct ieee80211_mgmt *mgmt,
1188                                          size_t len,
1189                                          struct ieee80211_rx_status *rx_status,
1190                                          int reassoc)
1191 {
1192         u8 rates[32];
1193         size_t rates_len;
1194         u16 capab_info, status_code, aid;
1195         struct ieee802_11_elems elems;
1196         u8 *pos;
1197
1198         /* AssocResp and ReassocResp have identical structure, so process both
1199          * of them in this function. */
1200
1201         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1202                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1203                            MACSTR ", but not in associate state - ignored",
1204                            MAC2STR(mgmt->sa));
1205                 return;
1206         }
1207
1208         if (len < 24 + 6) {
1209                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1210                            "frame received from " MACSTR " - ignored",
1211                            (unsigned long) len, MAC2STR(mgmt->sa));
1212                 return;
1213         }
1214
1215         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1216                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1217                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1218                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1219                 return;
1220         }
1221
1222         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1223         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1224         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1225         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1226                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1227                            "not set", aid);
1228         aid &= ~(BIT(15) | BIT(14));
1229
1230         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1231                    " (capab=0x%x status=%d aid=%d)",
1232                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1233                    capab_info, status_code, aid);
1234
1235         if (status_code != WLAN_STATUS_SUCCESS) {
1236                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1237                            status_code);
1238                 return;
1239         }
1240
1241         pos = mgmt->u.assoc_resp.variable;
1242         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1243             == ParseFailed) {
1244                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1245                 return;
1246         }
1247
1248         if (elems.supp_rates == NULL) {
1249                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1250                            "AssocResp");
1251                 return;
1252         }
1253
1254         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1255                 if (!reassoc) {
1256                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1257                                    "association, not reassociation, response "
1258                                    "with FT");
1259                         return;
1260                 }
1261                 if (wpa_ft_validate_reassoc_resp(
1262                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1263                             mgmt->sa) < 0) {
1264                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1265                                    "Resp failed");
1266                         return;
1267                 }
1268         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1269                 return;
1270
1271         wpa_printf(MSG_DEBUG, "MLME: associated");
1272         wpa_s->mlme.aid = aid;
1273         wpa_s->mlme.ap_capab = capab_info;
1274
1275         os_free(wpa_s->mlme.assocresp_ies);
1276         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1277         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1278         if (wpa_s->mlme.assocresp_ies) {
1279                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1280                           wpa_s->mlme.assocresp_ies_len);
1281         }
1282
1283         ieee80211_set_associated(wpa_s, 1);
1284
1285         rates_len = elems.supp_rates_len;
1286         if (rates_len > sizeof(rates))
1287                 rates_len = sizeof(rates);
1288         os_memcpy(rates, elems.supp_rates, rates_len);
1289         if (elems.ext_supp_rates) {
1290                 size_t _len = elems.ext_supp_rates_len;
1291                 if (_len > sizeof(rates) - rates_len)
1292                         _len = sizeof(rates) - rates_len;
1293                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1294                 rates_len += _len;
1295         }
1296
1297         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1298                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1299                            "netstack");
1300         }
1301         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1302             0) {
1303                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1304                            "netstack");
1305         }
1306
1307         /* Remove STA entry before adding a new one just in case to avoid
1308          * problems with existing configuration (e.g., keys). */
1309         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1310         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1311                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1312                            "netstack");
1313         }
1314
1315 #if 0 /* FIX? */
1316         sta->assoc_ap = 1;
1317
1318         if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1319                 sta->flags |= WLAN_STA_WME;
1320                 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1321                                          elems.wmm_param_len);
1322         }
1323 #endif
1324
1325         ieee80211_associated(wpa_s);
1326 }
1327
1328
1329 /* Caller must hold local->sta_bss_lock */
1330 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1331                                      struct ieee80211_sta_bss *bss)
1332 {
1333         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1334         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1335 }
1336
1337
1338 /* Caller must hold local->sta_bss_lock */
1339 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1340                                      struct ieee80211_sta_bss *bss)
1341 {
1342         struct ieee80211_sta_bss *b, *prev = NULL;
1343         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1344         while (b) {
1345                 if (b == bss) {
1346                         if (prev == NULL) {
1347                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1348                                         = bss->hnext;
1349                         } else {
1350                                 prev->hnext = bss->hnext;
1351                         }
1352                         break;
1353                 }
1354                 prev = b;
1355                 b = b->hnext;
1356         }
1357 }
1358
1359
1360 static struct ieee80211_sta_bss *
1361 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1362 {
1363         struct ieee80211_sta_bss *bss;
1364
1365         bss = os_zalloc(sizeof(*bss));
1366         if (bss == NULL)
1367                 return NULL;
1368         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1369
1370         /* TODO: order by RSSI? */
1371         bss->next = wpa_s->mlme.sta_bss_list;
1372         wpa_s->mlme.sta_bss_list = bss;
1373         __ieee80211_bss_hash_add(wpa_s, bss);
1374         return bss;
1375 }
1376
1377
1378 static struct ieee80211_sta_bss *
1379 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1380 {
1381         struct ieee80211_sta_bss *bss;
1382
1383         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1384         while (bss) {
1385                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1386                         break;
1387                 bss = bss->hnext;
1388         }
1389         return bss;
1390 }
1391
1392
1393 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1394                                struct ieee80211_sta_bss *bss)
1395 {
1396         __ieee80211_bss_hash_del(wpa_s, bss);
1397         os_free(bss->ie);
1398         os_free(bss->wpa_ie);
1399         os_free(bss->rsn_ie);
1400         os_free(bss->wmm_ie);
1401         os_free(bss->mdie);
1402         os_free(bss);
1403 }
1404
1405
1406 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1407 {
1408         struct ieee80211_sta_bss *bss, *prev;
1409
1410         bss = wpa_s->mlme.sta_bss_list;
1411         wpa_s->mlme.sta_bss_list = NULL;
1412         while (bss) {
1413                 prev = bss;
1414                 bss = bss->next;
1415                 ieee80211_bss_free(wpa_s, prev);
1416         }
1417 }
1418
1419
1420 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1421                                struct ieee80211_mgmt *mgmt,
1422                                size_t len,
1423                                struct ieee80211_rx_status *rx_status,
1424                                int beacon)
1425 {
1426         struct ieee802_11_elems elems;
1427         size_t baselen;
1428         int channel, invalid = 0, clen;
1429         struct ieee80211_sta_bss *bss;
1430         u64 timestamp;
1431         u8 *pos, *ie_pos;
1432         size_t ie_len;
1433
1434         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1435                 return; /* ignore ProbeResp to foreign address */
1436
1437 #if 0
1438         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1439                    beacon ? "Beacon" : "Probe Response",
1440                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1441 #endif
1442
1443         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1444         if (baselen > len)
1445                 return;
1446
1447         pos = mgmt->u.beacon.timestamp;
1448         timestamp = WPA_GET_LE64(pos);
1449
1450 #if 0 /* FIX */
1451         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1452             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1453 #ifdef IEEE80211_IBSS_DEBUG
1454                 static unsigned long last_tsf_debug = 0;
1455                 u64 tsf;
1456                 if (local->hw->get_tsf)
1457                         tsf = local->hw->get_tsf(local->mdev);
1458                 else
1459                         tsf = -1LLU;
1460                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1461                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1462                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1463                                    "@%ld",
1464                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1465                                    tsf, timestamp, tsf - timestamp, jiffies);
1466                         last_tsf_debug = jiffies;
1467                 }
1468 #endif /* IEEE80211_IBSS_DEBUG */
1469         }
1470 #endif
1471
1472         ie_pos = mgmt->u.beacon.variable;
1473         ie_len = len - baselen;
1474         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems) == ParseFailed)
1475                 invalid = 1;
1476
1477 #if 0 /* FIX */
1478         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1479             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1480             (sta = sta_info_get(local, mgmt->sa))) {
1481                 struct ieee80211_rate *rates;
1482                 size_t num_rates;
1483                 u32 supp_rates, prev_rates;
1484                 int i, j, oper_mode;
1485
1486                 rates = local->curr_rates;
1487                 num_rates = local->num_curr_rates;
1488                 oper_mode = wpa_s->mlme.sta_scanning ?
1489                         local->scan_oper_phymode : local->conf.phymode;
1490                 for (i = 0; i < local->hw->num_modes; i++) {
1491                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1492                         if (oper_mode == mode->mode) {
1493                                 rates = mode->rates;
1494                                 num_rates = mode->num_rates;
1495                                 break;
1496                         }
1497                 }
1498
1499                 supp_rates = 0;
1500                 for (i = 0; i < elems.supp_rates_len +
1501                              elems.ext_supp_rates_len; i++) {
1502                         u8 rate = 0;
1503                         int own_rate;
1504                         if (i < elems.supp_rates_len)
1505                                 rate = elems.supp_rates[i];
1506                         else if (elems.ext_supp_rates)
1507                                 rate = elems.ext_supp_rates
1508                                         [i - elems.supp_rates_len];
1509                         own_rate = 5 * (rate & 0x7f);
1510                         if (oper_mode == MODE_ATHEROS_TURBO)
1511                                 own_rate *= 2;
1512                         for (j = 0; j < num_rates; j++)
1513                                 if (rates[j].rate == own_rate)
1514                                         supp_rates |= BIT(j);
1515                 }
1516
1517                 prev_rates = sta->supp_rates;
1518                 sta->supp_rates &= supp_rates;
1519                 if (sta->supp_rates == 0) {
1520                         /* No matching rates - this should not really happen.
1521                          * Make sure that at least one rate is marked
1522                          * supported to avoid issues with TX rate ctrl. */
1523                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1524                 }
1525                 if (sta->supp_rates != prev_rates) {
1526                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1527                                    "for " MACSTR " based on beacon info "
1528                                    "(0x%x & 0x%x -> 0x%x)",
1529                                    MAC2STR(sta->addr), prev_rates,
1530                                    supp_rates, sta->supp_rates);
1531                 }
1532                 sta_info_release(local, sta);
1533         }
1534 #endif
1535
1536         if (elems.ssid == NULL)
1537                 return;
1538
1539         if (elems.ds_params && elems.ds_params_len == 1)
1540                 channel = elems.ds_params[0];
1541         else
1542                 channel = rx_status->channel;
1543
1544         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1545         if (bss == NULL) {
1546                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1547                 if (bss == NULL)
1548                         return;
1549         } else {
1550 #if 0
1551                 /* TODO: order by RSSI? */
1552                 spin_lock_bh(&local->sta_bss_lock);
1553                 list_move_tail(&bss->list, &local->sta_bss_list);
1554                 spin_unlock_bh(&local->sta_bss_lock);
1555 #endif
1556         }
1557
1558         if (bss->probe_resp && beacon) {
1559                 /* Do not allow beacon to override data from Probe Response. */
1560                 return;
1561         }
1562
1563         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1564         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1565
1566         if (bss->ie == NULL || bss->ie_len < ie_len) {
1567                 os_free(bss->ie);
1568                 bss->ie = os_malloc(ie_len);
1569         }
1570         if (bss->ie) {
1571                 os_memcpy(bss->ie, ie_pos, ie_len);
1572                 bss->ie_len = ie_len;
1573         }
1574
1575         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1576                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1577                 bss->ssid_len = elems.ssid_len;
1578         }
1579
1580         bss->supp_rates_len = 0;
1581         if (elems.supp_rates) {
1582                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1583                 if (clen > elems.supp_rates_len)
1584                         clen = elems.supp_rates_len;
1585                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1586                           elems.supp_rates, clen);
1587                 bss->supp_rates_len += clen;
1588         }
1589         if (elems.ext_supp_rates) {
1590                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1591                 if (clen > elems.ext_supp_rates_len)
1592                         clen = elems.ext_supp_rates_len;
1593                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1594                           elems.ext_supp_rates, clen);
1595                 bss->supp_rates_len += clen;
1596         }
1597
1598         if (elems.wpa &&
1599             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_len ||
1600              os_memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1601                 os_free(bss->wpa_ie);
1602                 bss->wpa_ie = os_malloc(elems.wpa_len + 2);
1603                 if (bss->wpa_ie) {
1604                         os_memcpy(bss->wpa_ie, elems.wpa - 2,
1605                                   elems.wpa_len + 2);
1606                         bss->wpa_ie_len = elems.wpa_len + 2;
1607                 } else
1608                         bss->wpa_ie_len = 0;
1609         } else if (!elems.wpa && bss->wpa_ie) {
1610                 os_free(bss->wpa_ie);
1611                 bss->wpa_ie = NULL;
1612                 bss->wpa_ie_len = 0;
1613         }
1614
1615         if (elems.rsn &&
1616             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_len ||
1617              os_memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1618                 os_free(bss->rsn_ie);
1619                 bss->rsn_ie = os_malloc(elems.rsn_len + 2);
1620                 if (bss->rsn_ie) {
1621                         os_memcpy(bss->rsn_ie, elems.rsn - 2,
1622                                   elems.rsn_len + 2);
1623                         bss->rsn_ie_len = elems.rsn_len + 2;
1624                 } else
1625                         bss->rsn_ie_len = 0;
1626         } else if (!elems.rsn && bss->rsn_ie) {
1627                 os_free(bss->rsn_ie);
1628                 bss->rsn_ie = NULL;
1629                 bss->rsn_ie_len = 0;
1630         }
1631
1632         if (elems.wmm_param &&
1633             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_param_len ||
1634              os_memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1635                 os_free(bss->wmm_ie);
1636                 bss->wmm_ie = os_malloc(elems.wmm_param_len + 2);
1637                 if (bss->wmm_ie) {
1638                         os_memcpy(bss->wmm_ie, elems.wmm_param - 2,
1639                                   elems.wmm_param_len + 2);
1640                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1641                 } else
1642                         bss->wmm_ie_len = 0;
1643         } else if (!elems.wmm_param && bss->wmm_ie) {
1644                 os_free(bss->wmm_ie);
1645                 bss->wmm_ie = NULL;
1646                 bss->wmm_ie_len = 0;
1647         }
1648
1649 #ifdef CONFIG_IEEE80211R
1650         if (elems.mdie &&
1651             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1652              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1653                 os_free(bss->mdie);
1654                 bss->mdie = os_malloc(elems.mdie_len + 2);
1655                 if (bss->mdie) {
1656                         os_memcpy(bss->mdie, elems.mdie - 2,
1657                                   elems.mdie_len + 2);
1658                         bss->mdie_len = elems.mdie_len + 2;
1659                 } else
1660                         bss->mdie_len = 0;
1661         } else if (!elems.mdie && bss->mdie) {
1662                 os_free(bss->mdie);
1663                 bss->mdie = NULL;
1664                 bss->mdie_len = 0;
1665         }
1666 #endif /* CONFIG_IEEE80211R */
1667
1668         bss->hw_mode = wpa_s->mlme.phymode;
1669         bss->channel = channel;
1670         bss->freq = wpa_s->mlme.freq;
1671         if (channel != wpa_s->mlme.channel &&
1672             (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1673              wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1674             channel >= 1 && channel <= 14) {
1675                 static const int freq_list[] = {
1676                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1677                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1678                 };
1679                 /* IEEE 802.11g/b mode can receive packets from neighboring
1680                  * channels, so map the channel into frequency. */
1681                 bss->freq = freq_list[channel - 1];
1682         }
1683         bss->timestamp = timestamp;
1684         os_get_time(&bss->last_update);
1685         bss->rssi = rx_status->ssi;
1686         if (!beacon)
1687                 bss->probe_resp++;
1688 }
1689
1690
1691 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1692                                          struct ieee80211_mgmt *mgmt,
1693                                          size_t len,
1694                                          struct ieee80211_rx_status *rx_status)
1695 {
1696         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1697 }
1698
1699
1700 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1701                                      struct ieee80211_mgmt *mgmt,
1702                                      size_t len,
1703                                      struct ieee80211_rx_status *rx_status)
1704 {
1705         int use_protection;
1706         size_t baselen;
1707         struct ieee802_11_elems elems;
1708
1709         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1710
1711         if (!wpa_s->mlme.associated ||
1712             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1713                 return;
1714
1715         /* Process beacon from the current BSS */
1716         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1717         if (baselen > len)
1718                 return;
1719
1720         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1721                                    &elems) == ParseFailed)
1722                 return;
1723
1724         use_protection = 0;
1725         if (elems.erp_info && elems.erp_info_len >= 1) {
1726                 use_protection =
1727                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1728         }
1729
1730         if (use_protection != !!wpa_s->mlme.use_protection) {
1731                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1732                            ")",
1733                            use_protection ? "enabled" : "disabled",
1734                            MAC2STR(wpa_s->bssid));
1735                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1736                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1737         }
1738
1739         if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1740                 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1741                                          elems.wmm_param_len);
1742         }
1743 }
1744
1745
1746 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1747                                         struct ieee80211_mgmt *mgmt,
1748                                         size_t len,
1749                                         struct ieee80211_rx_status *rx_status)
1750 {
1751         int tx_last_beacon, adhoc;
1752 #if 0 /* FIX */
1753         struct ieee80211_mgmt *resp;
1754 #endif
1755         u8 *pos, *end;
1756         struct wpa_ssid *ssid = wpa_s->current_ssid;
1757
1758         adhoc = ssid && ssid->mode == 1;
1759
1760         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1761             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1762                 return;
1763
1764 #if 0 /* FIX */
1765         if (local->hw->tx_last_beacon)
1766                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1767         else
1768 #endif
1769                 tx_last_beacon = 1;
1770
1771 #ifdef IEEE80211_IBSS_DEBUG
1772         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1773                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1774                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1775                    MAC2STR(mgmt->bssid), tx_last_beacon);
1776 #endif /* IEEE80211_IBSS_DEBUG */
1777
1778         if (!tx_last_beacon)
1779                 return;
1780
1781         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1782             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1783                 return;
1784
1785         end = ((u8 *) mgmt) + len;
1786         pos = mgmt->u.probe_req.variable;
1787         if (pos[0] != WLAN_EID_SSID ||
1788             pos + 2 + pos[1] > end) {
1789                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1790                            MACSTR, MAC2STR(mgmt->sa));
1791                 return;
1792         }
1793         if (pos[1] != 0 &&
1794             (pos[1] != wpa_s->mlme.ssid_len ||
1795              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1796         {
1797                 /* Ignore ProbeReq for foreign SSID */
1798                 return;
1799         }
1800
1801 #if 0 /* FIX */
1802         /* Reply with ProbeResp */
1803         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1804         if (skb == NULL)
1805                 return;
1806
1807         resp = (struct ieee80211_mgmt *) skb->data;
1808         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1809 #ifdef IEEE80211_IBSS_DEBUG
1810         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1811                    MAC2STR(resp->da));
1812 #endif /* IEEE80211_IBSS_DEBUG */
1813         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1814 #endif
1815 }
1816
1817
1818 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1819                                         struct ieee80211_mgmt *mgmt,
1820                                         size_t len,
1821                                         struct ieee80211_rx_status *rx_status)
1822 {
1823         union wpa_event_data data;
1824         u16 status;
1825         u8 *sta_addr, *target_ap_addr;
1826
1827         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1828                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1829                 return;
1830         }
1831
1832         /*
1833          * Only FT Action Response is needed for now since reservation
1834          * protocol is not supported.
1835          */
1836         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1837                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1838                            mgmt->u.action.u.ft_action_resp.action);
1839                 return;
1840         }
1841
1842         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1843         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1844         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1845         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1846                    " TargetAP " MACSTR " Status Code %d",
1847                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1848         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1849                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1850                            " in FT Action Response", MAC2STR(sta_addr));
1851                 return;
1852
1853         }
1854
1855         if (status) {
1856                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1857                            "failure (status code %d)", status);
1858                 /* TODO: report error to FT code(?) */
1859                 return;
1860         }
1861
1862         os_memset(&data, 0, sizeof(data));
1863         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1864         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1865                                      (u8 *) mgmt);
1866         data.ft_ies.ft_action = 1;
1867         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1868         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1869         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1870          * successfully */
1871         wpa_s->mlme.prev_bssid_set = 1;
1872         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1873         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1874         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1875         ieee80211_associate(wpa_s);
1876 }
1877
1878
1879 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1880                                      struct ieee80211_mgmt *mgmt,
1881                                      size_t len,
1882                                      struct ieee80211_rx_status *rx_status)
1883 {
1884         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1885
1886         if (len < 25)
1887                 return;
1888
1889         if (mgmt->u.action.category == WLAN_ACTION_FT)
1890                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1891         else
1892                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1893                            mgmt->u.action.category);
1894 }
1895
1896
1897 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
1898                                   const u8 *buf, size_t len,
1899                                   struct ieee80211_rx_status *rx_status)
1900 {
1901         struct ieee80211_mgmt *mgmt;
1902         u16 fc;
1903
1904         if (len < 24)
1905                 return;
1906
1907         mgmt = (struct ieee80211_mgmt *) buf;
1908         fc = le_to_host16(mgmt->frame_control);
1909
1910         switch (WLAN_FC_GET_STYPE(fc)) {
1911         case WLAN_FC_STYPE_PROBE_REQ:
1912                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
1913                 break;
1914         case WLAN_FC_STYPE_PROBE_RESP:
1915                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
1916                 break;
1917         case WLAN_FC_STYPE_BEACON:
1918                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1919                 break;
1920         case WLAN_FC_STYPE_AUTH:
1921                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
1922                 break;
1923         case WLAN_FC_STYPE_ASSOC_RESP:
1924                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
1925                 break;
1926         case WLAN_FC_STYPE_REASSOC_RESP:
1927                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
1928                 break;
1929         case WLAN_FC_STYPE_DEAUTH:
1930                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
1931                 break;
1932         case WLAN_FC_STYPE_DISASSOC:
1933                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
1934                 break;
1935         case WLAN_FC_STYPE_ACTION:
1936                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
1937                 break;
1938         default:
1939                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
1940                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
1941                 break;
1942         }
1943 }
1944
1945
1946 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
1947                                   const u8 *buf, size_t len,
1948                                   struct ieee80211_rx_status *rx_status)
1949 {
1950         struct ieee80211_mgmt *mgmt;
1951         u16 fc;
1952
1953         if (len < 24)
1954                 return;
1955
1956         mgmt = (struct ieee80211_mgmt *) buf;
1957         fc = le_to_host16(mgmt->frame_control);
1958
1959         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
1960                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
1961                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
1962                                                      len, rx_status);
1963                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
1964                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1965                 }
1966         }
1967 }
1968
1969
1970 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
1971 {
1972         int active = 0;
1973
1974 #if 0 /* FIX */
1975         list_for_each(ptr, &local->sta_list) {
1976                 sta = list_entry(ptr, struct sta_info, list);
1977                 if (sta->dev == dev &&
1978                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1979                                jiffies)) {
1980                         active++;
1981                         break;
1982                 }
1983         }
1984 #endif
1985
1986         return active;
1987 }
1988
1989
1990 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
1991 {
1992 #if 0 /* FIX */
1993         list_for_each_safe(ptr, n, &local->sta_list) {
1994                 sta = list_entry(ptr, struct sta_info, list);
1995                 if (time_after(jiffies, sta->last_rx +
1996                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1997                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
1998                                    MACSTR, MAC2STR(sta->addr));
1999                         sta_info_free(local, sta, 1);
2000                 }
2001         }
2002 #endif
2003 }
2004
2005
2006 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2007 {
2008         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2009
2010         ieee80211_sta_expire(wpa_s);
2011         if (ieee80211_sta_active_ibss(wpa_s))
2012                 return;
2013
2014         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2015                    "other IBSS networks with same SSID (merge)");
2016         ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2017 }
2018
2019
2020 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2021 {
2022         struct wpa_supplicant *wpa_s = eloop_ctx;
2023
2024         switch (wpa_s->mlme.state) {
2025         case IEEE80211_DISABLED:
2026                 break;
2027         case IEEE80211_AUTHENTICATE:
2028                 ieee80211_authenticate(wpa_s);
2029                 break;
2030         case IEEE80211_ASSOCIATE:
2031                 ieee80211_associate(wpa_s);
2032                 break;
2033         case IEEE80211_ASSOCIATED:
2034                 ieee80211_associated(wpa_s);
2035                 break;
2036         case IEEE80211_IBSS_SEARCH:
2037                 ieee80211_sta_find_ibss(wpa_s);
2038                 break;
2039         case IEEE80211_IBSS_JOINED:
2040                 ieee80211_sta_merge_ibss(wpa_s);
2041                 break;
2042         default:
2043                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2044                            wpa_s->mlme.state);
2045                 break;
2046         }
2047
2048         if (ieee80211_privacy_mismatch(wpa_s)) {
2049                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2050                            "and mixed-cell disabled - disassociate");
2051
2052                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2053                 ieee80211_set_associated(wpa_s, 0);
2054         }
2055 }
2056
2057
2058 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2059 {
2060         struct wpa_ssid *ssid = wpa_s->current_ssid;
2061         if (ssid && ssid->mode != 0)
2062                 return;
2063
2064 #if 0 /* FIX */
2065         if (local->hw->reset_tsf) {
2066                 /* Reset own TSF to allow time synchronization work. */
2067                 local->hw->reset_tsf(local->mdev);
2068         }
2069 #endif
2070
2071         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2072
2073
2074         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2075                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2076         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2077                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2078         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2079                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2080         else
2081                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2082         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2083                    wpa_s->mlme.auth_alg);
2084         wpa_s->mlme.auth_transaction = -1;
2085         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2086         ieee80211_authenticate(wpa_s);
2087 }
2088
2089
2090 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2091 {
2092 #if 0 /* FIX */
2093         int m, c;
2094
2095         for (m = 0; m < local->hw->num_modes; m++) {
2096                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2097                 if (mode->mode != local->conf.phymode)
2098                         continue;
2099                 for (c = 0; c < mode->num_channels; c++) {
2100                         struct ieee80211_channel *chan = &mode->channels[c];
2101                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2102                             chan->chan == local->conf.channel) {
2103                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2104                                         return 1;
2105                                 break;
2106                         }
2107                 }
2108         }
2109 #endif
2110
2111         return 0;
2112 }
2113
2114
2115 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2116                                    struct ieee80211_sta_bss *bss)
2117 {
2118         int res = 0, rates, done = 0;
2119         struct ieee80211_mgmt *mgmt;
2120 #if 0 /* FIX */
2121         struct ieee80211_tx_control control;
2122         struct ieee80211_rate *rate;
2123         struct rate_control_extra extra;
2124 #endif
2125         u8 *pos, *buf;
2126         size_t len;
2127
2128         /* Remove possible STA entries from other IBSS networks. */
2129 #if 0 /* FIX */
2130         sta_info_flush(local, NULL);
2131
2132         if (local->hw->reset_tsf) {
2133                 /* Reset own TSF to allow time synchronization work. */
2134                 local->hw->reset_tsf(local->mdev);
2135         }
2136 #endif
2137         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2138
2139 #if 0 /* FIX */
2140         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2141
2142         sdata->drop_unencrypted = bss->capability &
2143                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2144 #endif
2145
2146 #if 0 /* FIX */
2147         os_memset(&rq, 0, sizeof(rq));
2148         rq.m = bss->freq * 100000;
2149         rq.e = 1;
2150         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2151 #endif
2152
2153         if (!ieee80211_ibss_allowed(wpa_s)) {
2154 #if 0 /* FIX */
2155                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2156                            "(%d MHz)", local->conf.channel,
2157                            local->conf.freq);
2158 #endif
2159                 return -1;
2160         }
2161
2162         /* Set beacon template based on scan results */
2163         buf = os_malloc(400);
2164         len = 0;
2165         do {
2166                 if (buf == NULL)
2167                         break;
2168
2169                 mgmt = (struct ieee80211_mgmt *) buf;
2170                 len += 24 + sizeof(mgmt->u.beacon);
2171                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2172                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2173                                                    WLAN_FC_STYPE_BEACON);
2174                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2175                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2176                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2177 #if 0 /* FIX */
2178                 mgmt->u.beacon.beacon_int =
2179                         host_to_le16(local->conf.beacon_int);
2180 #endif
2181                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2182
2183                 pos = buf + len;
2184                 len += 2 + wpa_s->mlme.ssid_len;
2185                 *pos++ = WLAN_EID_SSID;
2186                 *pos++ = wpa_s->mlme.ssid_len;
2187                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2188
2189                 rates = bss->supp_rates_len;
2190                 if (rates > 8)
2191                         rates = 8;
2192                 pos = buf + len;
2193                 len += 2 + rates;
2194                 *pos++ = WLAN_EID_SUPP_RATES;
2195                 *pos++ = rates;
2196                 os_memcpy(pos, bss->supp_rates, rates);
2197
2198                 pos = buf + len;
2199                 len += 2 + 1;
2200                 *pos++ = WLAN_EID_DS_PARAMS;
2201                 *pos++ = 1;
2202                 *pos++ = bss->channel;
2203
2204                 pos = buf + len;
2205                 len += 2 + 2;
2206                 *pos++ = WLAN_EID_IBSS_PARAMS;
2207                 *pos++ = 2;
2208                 /* FIX: set ATIM window based on scan results */
2209                 *pos++ = 0;
2210                 *pos++ = 0;
2211
2212                 if (bss->supp_rates_len > 8) {
2213                         rates = bss->supp_rates_len - 8;
2214                         pos = buf + len;
2215                         len += 2 + rates;
2216                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2217                         *pos++ = rates;
2218                         os_memcpy(pos, &bss->supp_rates[8], rates);
2219                 }
2220
2221 #if 0 /* FIX */
2222                 os_memset(&control, 0, sizeof(control));
2223                 control.pkt_type = PKT_PROBE_RESP;
2224                 os_memset(&extra, 0, sizeof(extra));
2225                 extra.endidx = local->num_curr_rates;
2226                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2227                 if (rate == NULL) {
2228                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2229                                    "rate for IBSS beacon");
2230                         break;
2231                 }
2232                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2233                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2234                         rate->val2 : rate->val;
2235                 control.antenna_sel = local->conf.antenna_sel;
2236                 control.power_level = local->conf.power_level;
2237                 control.no_ack = 1;
2238                 control.retry_limit = 1;
2239                 control.rts_cts_duration = 0;
2240 #endif
2241
2242 #if 0 /* FIX */
2243                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2244                 if (wpa_s->mlme.probe_resp) {
2245                         mgmt = (struct ieee80211_mgmt *)
2246                                 wpa_s->mlme.probe_resp->data;
2247                         mgmt->frame_control =
2248                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2249                                              WLAN_FC_STYPE_PROBE_RESP);
2250                 } else {
2251                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2252                                    "ProbeResp template for IBSS");
2253                 }
2254
2255                 if (local->hw->beacon_update &&
2256                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2257                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2258                                    "template based on scan results");
2259                         skb = NULL;
2260                 }
2261
2262                 rates = 0;
2263                 for (i = 0; i < bss->supp_rates_len; i++) {
2264                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2265                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2266                                 rate *= 2;
2267                         for (j = 0; j < local->num_curr_rates; j++)
2268                                 if (local->curr_rates[j].rate == rate)
2269                                         rates |= BIT(j);
2270                 }
2271                 wpa_s->mlme.supp_rates_bits = rates;
2272 #endif
2273                 done = 1;
2274         } while (0);
2275
2276         os_free(buf);
2277         if (!done) {
2278                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2279                            "template");
2280         }
2281
2282         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2283         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2284
2285         return res;
2286 }
2287
2288
2289 #if 0 /* FIX */
2290 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2291 {
2292         struct ieee80211_sta_bss *bss;
2293         u8 bssid[ETH_ALEN], *pos;
2294         int i;
2295
2296 #if 0
2297         /* Easier testing, use fixed BSSID. */
2298         os_memset(bssid, 0xfe, ETH_ALEN);
2299 #else
2300         /* Generate random, not broadcast, locally administered BSSID. Mix in
2301          * own MAC address to make sure that devices that do not have proper
2302          * random number generator get different BSSID. */
2303         os_get_random(bssid, ETH_ALEN);
2304         for (i = 0; i < ETH_ALEN; i++)
2305                 bssid[i] ^= wpa_s->own_addr[i];
2306         bssid[0] &= ~0x01;
2307         bssid[0] |= 0x02;
2308 #endif
2309
2310         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2311                    MACSTR "", MAC2STR(bssid));
2312
2313         bss = ieee80211_bss_add(wpa_s, bssid);
2314         if (bss == NULL)
2315                 return -ENOMEM;
2316
2317 #if 0 /* FIX */
2318         if (local->conf.beacon_int == 0)
2319                 local->conf.beacon_int = 100;
2320         bss->beacon_int = local->conf.beacon_int;
2321         bss->hw_mode = local->conf.phymode;
2322         bss->channel = local->conf.channel;
2323         bss->freq = local->conf.freq;
2324 #endif
2325         os_get_time(&bss->last_update);
2326         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2327 #if 0 /* FIX */
2328         if (sdata->default_key) {
2329                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2330         } else
2331                 sdata->drop_unencrypted = 0;
2332         bss->supp_rates_len = local->num_curr_rates;
2333 #endif
2334         pos = bss->supp_rates;
2335 #if 0 /* FIX */
2336         for (i = 0; i < local->num_curr_rates; i++) {
2337                 int rate = local->curr_rates[i].rate;
2338                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2339                         rate /= 2;
2340                 *pos++ = (u8) (rate / 5);
2341         }
2342 #endif
2343
2344         return ieee80211_sta_join_ibss(wpa_s, bss);
2345 }
2346 #endif
2347
2348
2349 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2350 {
2351         struct ieee80211_sta_bss *bss;
2352         int found = 0;
2353         u8 bssid[ETH_ALEN];
2354         int active_ibss;
2355         struct os_time now;
2356
2357         if (wpa_s->mlme.ssid_len == 0)
2358                 return -EINVAL;
2359
2360         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2361 #ifdef IEEE80211_IBSS_DEBUG
2362         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2363                    active_ibss);
2364 #endif /* IEEE80211_IBSS_DEBUG */
2365         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2366                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2367                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2368                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2369                         continue;
2370 #ifdef IEEE80211_IBSS_DEBUG
2371                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2372                            MAC2STR(bss->bssid));
2373 #endif /* IEEE80211_IBSS_DEBUG */
2374                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2375                 found = 1;
2376                 if (active_ibss ||
2377                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2378                         break;
2379         }
2380
2381 #ifdef IEEE80211_IBSS_DEBUG
2382         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2383                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2384 #endif /* IEEE80211_IBSS_DEBUG */
2385         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2386             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2387                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2388                            " based on configured SSID",
2389                            MAC2STR(bssid));
2390                 return ieee80211_sta_join_ibss(wpa_s, bss);
2391         }
2392 #ifdef IEEE80211_IBSS_DEBUG
2393         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2394 #endif /* IEEE80211_IBSS_DEBUG */
2395
2396         /* Selected IBSS not found in current scan results - try to scan */
2397         os_get_time(&now);
2398 #if 0 /* FIX */
2399         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2400             !ieee80211_sta_active_ibss(wpa_s)) {
2401                 ieee80211_reschedule_timer(wpa_s,
2402                                            IEEE80211_IBSS_MERGE_INTERVAL);
2403         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2404                               IEEE80211_SCAN_INTERVAL)) {
2405                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2406                            "to join");
2407                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2408                                               wpa_s->mlme.ssid_len);
2409         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2410                 int interval = IEEE80211_SCAN_INTERVAL;
2411
2412                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2413                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2414                         if (wpa_s->mlme.create_ibss &&
2415                             ieee80211_ibss_allowed(wpa_s))
2416                                 return ieee80211_sta_create_ibss(wpa_s);
2417                         if (wpa_s->mlme.create_ibss) {
2418                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2419                                            "on the configured channel %d "
2420                                            "(%d MHz)",
2421                                            local->conf.channel,
2422                                            local->conf.freq);
2423                         }
2424
2425                         /* No IBSS found - decrease scan interval and continue
2426                          * scanning. */
2427                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2428                 }
2429
2430                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2431                 ieee80211_reschedule_timer(wpa_s, interval);
2432                 return 0;
2433         }
2434 #endif
2435
2436         return 0;
2437 }
2438
2439
2440 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2441                            size_t *len)
2442 {
2443         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2444         *len = wpa_s->mlme.ssid_len;
2445         return 0;
2446 }
2447
2448
2449 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2450                             struct wpa_driver_associate_params *params)
2451 {
2452         struct ieee80211_sta_bss *bss;
2453
2454         wpa_s->mlme.bssid_set = 0;
2455         wpa_s->mlme.freq = params->freq;
2456         if (params->bssid) {
2457                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2458                 if (os_memcmp(params->bssid, "\x00\x00\x00\x00\x00\x00",
2459                               ETH_ALEN))
2460                         wpa_s->mlme.bssid_set = 1;
2461                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2462                 if (bss) {
2463                         wpa_s->mlme.phymode = bss->hw_mode;
2464                         wpa_s->mlme.channel = bss->channel;
2465                         wpa_s->mlme.freq = bss->freq;
2466                 }
2467         }
2468
2469 #if 0 /* FIX */
2470         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2471          * not defined. */
2472         if (local->hw->conf_tx) {
2473                 struct ieee80211_tx_queue_params qparam;
2474                 int i;
2475
2476                 os_memset(&qparam, 0, sizeof(qparam));
2477                 /* TODO: are these ok defaults for all hw_modes? */
2478                 qparam.aifs = 2;
2479                 qparam.cw_min =
2480                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2481                 qparam.cw_max = 1023;
2482                 qparam.burst_time = 0;
2483                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2484                 {
2485                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2486                                            &qparam);
2487                 }
2488                 /* IBSS uses different parameters for Beacon sending */
2489                 qparam.cw_min++;
2490                 qparam.cw_min *= 2;
2491                 qparam.cw_min--;
2492                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2493         }
2494 #endif
2495
2496         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2497             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2498                 wpa_s->mlme.prev_bssid_set = 0;
2499         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2500         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2501                   MAX_SSID_LEN - params->ssid_len);
2502         wpa_s->mlme.ssid_len = params->ssid_len;
2503         wpa_s->mlme.ssid_set = 1;
2504
2505         os_free(wpa_s->mlme.extra_ie);
2506         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2507                 wpa_s->mlme.extra_ie = NULL;
2508                 wpa_s->mlme.extra_ie_len = 0;
2509         } else {
2510                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2511                 if (wpa_s->mlme.extra_ie == NULL) {
2512                         wpa_s->mlme.extra_ie_len = 0;
2513                         return -1;
2514                 }
2515                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2516                           params->wpa_ie_len);
2517                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2518         }
2519
2520         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2521
2522         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2523                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2524
2525         if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2526                 os_get_time(&wpa_s->mlme.ibss_join_req);
2527                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2528                 return ieee80211_sta_find_ibss(wpa_s);
2529         }
2530
2531         if (wpa_s->mlme.bssid_set)
2532                 ieee80211_sta_new_auth(wpa_s);
2533
2534         return 0;
2535 }
2536
2537
2538 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2539 {
2540         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2541         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2542         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2543 }
2544
2545
2546 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2547 {
2548         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2549         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2550         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2551         if (wpa_s->mlme.freq == 0)
2552                 return 0;
2553         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2554                                          wpa_s->mlme.channel,
2555                                          wpa_s->mlme.freq);
2556 }
2557
2558
2559 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2560 {
2561         size_t m;
2562         int c;
2563
2564         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2565                 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2566                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2567                         continue;
2568                 for (c = 0; c < mode->num_channels; c++) {
2569                         struct wpa_channel_data *chan = &mode->channels[c];
2570                         if (chan->flag & WPA_CHAN_W_SCAN &&
2571                             chan->chan == wpa_s->mlme.channel) {
2572                                 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2573                                         return 1;
2574                                 break;
2575                         }
2576                 }
2577         }
2578
2579         return 0;
2580 }
2581
2582
2583 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2584 {
2585         struct wpa_supplicant *wpa_s = eloop_ctx;
2586         struct wpa_hw_modes *mode;
2587         struct wpa_channel_data *chan;
2588         int skip = 0;
2589         int timeout = 0;
2590         struct wpa_ssid *ssid = wpa_s->current_ssid;
2591         int adhoc;
2592
2593         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2594                 return;
2595
2596         adhoc = ssid && ssid->mode == 1;
2597
2598         switch (wpa_s->mlme.scan_state) {
2599         case SCAN_SET_CHANNEL:
2600                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2601                 if (wpa_s->mlme.scan_hw_mode_idx >=
2602                     (int) wpa_s->mlme.num_modes ||
2603                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2604                      (int) wpa_s->mlme.num_modes
2605                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2606                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2607                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2608                                            "restore operational channel after "
2609                                            "scan");
2610                         }
2611                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2612                         wpa_s->mlme.sta_scanning = 0;
2613                         os_get_time(&wpa_s->mlme.last_scan_completed);
2614                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2615                         if (adhoc) {
2616                                 if (!wpa_s->mlme.bssid_set ||
2617                                     (wpa_s->mlme.state ==
2618                                      IEEE80211_IBSS_JOINED &&
2619                                      !ieee80211_sta_active_ibss(wpa_s)))
2620                                         ieee80211_sta_find_ibss(wpa_s);
2621                         }
2622                         return;
2623                 }
2624                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2625                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2626                 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2627                     (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2628                     (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2629                      mode->mode == WPA_MODE_IEEE80211B &&
2630                      wpa_s->mlme.scan_skip_11b))
2631                         skip = 1;
2632
2633                 if (!skip) {
2634                         wpa_printf(MSG_MSGDUMP,
2635                                    "MLME: scan channel %d (%d MHz)",
2636                                    chan->chan, chan->freq);
2637
2638                         wpa_s->mlme.channel = chan->chan;
2639                         wpa_s->mlme.freq = chan->freq;
2640                         wpa_s->mlme.phymode = mode->mode;
2641                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2642                                                       chan->chan, chan->freq))
2643                         {
2644                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2645                                            "channel %d (%d MHz) for scan",
2646                                            chan->chan, chan->freq);
2647                                 skip = 1;
2648                         }
2649                 }
2650
2651                 wpa_s->mlme.scan_channel_idx++;
2652                 if (wpa_s->mlme.scan_channel_idx >=
2653                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2654                     num_channels) {
2655                         wpa_s->mlme.scan_hw_mode_idx++;
2656                         wpa_s->mlme.scan_channel_idx = 0;
2657                 }
2658
2659                 if (skip) {
2660                         timeout = 0;
2661                         break;
2662                 }
2663
2664                 timeout = IEEE80211_PROBE_DELAY;
2665                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2666                 break;
2667         case SCAN_SEND_PROBE:
2668                 if (ieee80211_active_scan(wpa_s)) {
2669                         ieee80211_send_probe_req(wpa_s, NULL,
2670                                                  wpa_s->mlme.scan_ssid,
2671                                                  wpa_s->mlme.scan_ssid_len);
2672                         timeout = IEEE80211_CHANNEL_TIME;
2673                 } else {
2674                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2675                 }
2676                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2677                 break;
2678         }
2679
2680         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2681                                ieee80211_sta_scan_timer, wpa_s, NULL);
2682 }
2683
2684
2685 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2686                            size_t ssid_len)
2687 {
2688         if (ssid_len > MAX_SSID_LEN)
2689                 return -1;
2690
2691         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2692          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2693          * BSSID: MACAddress
2694          * SSID
2695          * ScanType: ACTIVE, PASSIVE
2696          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2697          *    a Probe frame during active scanning
2698          * ChannelList
2699          * MinChannelTime (>= ProbeDelay), in TU
2700          * MaxChannelTime: (>= MinChannelTime), in TU
2701          */
2702
2703          /* MLME-SCAN.confirm
2704           * BSSDescriptionSet
2705           * ResultCode: SUCCESS, INVALID_PARAMETERS
2706          */
2707
2708         /* TODO: if assoc, move to power save mode for the duration of the
2709          * scan */
2710
2711         if (wpa_s->mlme.sta_scanning)
2712                 return -1;
2713
2714         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2715
2716         ieee80211_sta_save_oper_chan(wpa_s);
2717
2718         wpa_s->mlme.sta_scanning = 1;
2719         /* TODO: stop TX queue? */
2720
2721         if (ssid) {
2722                 wpa_s->mlme.scan_ssid_len = ssid_len;
2723                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2724         } else
2725                 wpa_s->mlme.scan_ssid_len = 0;
2726         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2727                                         * supported */
2728         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2729         wpa_s->mlme.scan_hw_mode_idx = 0;
2730         wpa_s->mlme.scan_channel_idx = 0;
2731         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2732
2733         return 0;
2734 }
2735
2736
2737 struct wpa_scan_results *
2738 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2739 {
2740         size_t ap_num = 0;
2741         struct wpa_scan_results *res;
2742         struct wpa_scan_res *r;
2743         struct ieee80211_sta_bss *bss;
2744
2745         res = os_zalloc(sizeof(*res));
2746         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2747                 ap_num++;
2748         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2749         if (res->res == NULL) {
2750                 os_free(res);
2751                 return NULL;
2752         }
2753
2754         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2755                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2756                 if (r == NULL)
2757                         break;
2758                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2759                 r->freq = bss->freq;
2760                 r->beacon_int = bss->beacon_int;
2761                 r->caps = bss->capability;
2762                 r->level = bss->rssi;
2763                 r->tsf = bss->timestamp;
2764                 if (bss->ie) {
2765                         r->ie_len = bss->ie_len;
2766                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2767                 }
2768
2769                 res->res[res->num++] = r;
2770         }
2771
2772         return res;
2773 }
2774
2775
2776 #if 0 /* FIX */
2777 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2778                                          struct sk_buff *skb, u8 *bssid,
2779                                          u8 *addr)
2780 {
2781         struct ieee80211_local *local = dev->priv;
2782         struct list_head *ptr;
2783         struct sta_info *sta;
2784         struct wpa_supplicant *sta_dev = NULL;
2785
2786         /* TODO: Could consider removing the least recently used entry and
2787          * allow new one to be added. */
2788         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2789                 if (net_ratelimit()) {
2790                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2791                                    "STA entry " MACSTR, MAC2STR(addr));
2792                 }
2793                 return NULL;
2794         }
2795
2796         spin_lock_bh(&local->sub_if_lock);
2797         list_for_each(ptr, &local->sub_if_list) {
2798                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2799                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2800                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2801                         sta_dev = sdata->dev;
2802                         break;
2803                 }
2804         }
2805         spin_unlock_bh(&local->sub_if_lock);
2806
2807         if (sta_dev == NULL)
2808                 return NULL;
2809
2810         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2811                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2812
2813         sta = sta_info_add(wpa_s, addr);
2814         if (sta == NULL) {
2815                 return NULL;
2816         }
2817
2818         sta->dev = sta_dev;
2819         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2820
2821         rate_control_rate_init(local, sta);
2822
2823         return sta; /* caller will call sta_info_release() */
2824 }
2825 #endif
2826
2827
2828 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2829 {
2830         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2831
2832         ieee80211_send_deauth(wpa_s, reason);
2833         ieee80211_set_associated(wpa_s, 0);
2834         return 0;
2835 }
2836
2837
2838 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2839 {
2840         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2841
2842         if (!wpa_s->mlme.associated)
2843                 return -1;
2844
2845         ieee80211_send_disassoc(wpa_s, reason);
2846         ieee80211_set_associated(wpa_s, 0);
2847         return 0;
2848 }
2849
2850
2851 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2852                       struct ieee80211_rx_status *rx_status)
2853 {
2854         struct ieee80211_mgmt *mgmt;
2855         u16 fc;
2856         const u8 *pos;
2857
2858         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2859
2860         if (wpa_s->mlme.sta_scanning) {
2861                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2862                 return;
2863         }
2864
2865         if (len < 24)
2866                 return;
2867
2868         mgmt = (struct ieee80211_mgmt *) buf;
2869         fc = le_to_host16(mgmt->frame_control);
2870
2871         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2872                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2873         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2874                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2875                     WLAN_FC_FROMDS)
2876                         return;
2877                 /* mgmt->sa is actually BSSID for FromDS data frames */
2878                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2879                         return;
2880                 /* Skip IEEE 802.11 and LLC headers */
2881                 pos = buf + 24 + 6;
2882                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2883                         return;
2884                 pos += 2;
2885                 /* mgmt->bssid is actually BSSID for SA data frames */
2886                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2887                                         pos, buf + len - pos);
2888         }
2889 }
2890
2891
2892 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2893                                     size_t num_hw_features)
2894 {
2895         size_t i;
2896
2897         if (hw_features == NULL)
2898                 return;
2899
2900         for (i = 0; i < num_hw_features; i++) {
2901                 os_free(hw_features[i].channels);
2902                 os_free(hw_features[i].rates);
2903         }
2904
2905         os_free(hw_features);
2906 }
2907
2908
2909 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
2910 {
2911         u16 num_modes, flags;
2912
2913         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
2914                                                         &flags);
2915         if (wpa_s->mlme.modes == NULL) {
2916                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
2917                            "channels and rates from the driver");
2918                 return -1;
2919         }
2920
2921         wpa_s->mlme.num_modes = num_modes;
2922
2923         wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
2924         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
2925         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
2926
2927         return 0;
2928 }
2929
2930
2931 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
2932 {
2933         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
2934         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
2935         os_free(wpa_s->mlme.extra_ie);
2936         wpa_s->mlme.extra_ie = NULL;
2937         os_free(wpa_s->mlme.extra_probe_ie);
2938         wpa_s->mlme.extra_probe_ie = NULL;
2939         os_free(wpa_s->mlme.assocreq_ies);
2940         wpa_s->mlme.assocreq_ies = NULL;
2941         os_free(wpa_s->mlme.assocresp_ies);
2942         wpa_s->mlme.assocresp_ies = NULL;
2943         ieee80211_bss_list_deinit(wpa_s);
2944         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
2945                                        wpa_s->mlme.num_modes);
2946 #ifdef CONFIG_IEEE80211R
2947         os_free(wpa_s->mlme.ft_ies);
2948         wpa_s->mlme.ft_ies = NULL;
2949         wpa_s->mlme.ft_ies_len = 0;
2950 #endif /* CONFIG_IEEE80211R */
2951 }
2952
2953
2954 #ifdef CONFIG_IEEE80211R
2955
2956 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2957                                 const u8 *ies, size_t ies_len)
2958 {
2959         if (md == NULL) {
2960                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
2961                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
2962         } else {
2963                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
2964                            MAC2STR(md));
2965                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
2966         }
2967
2968         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
2969         os_free(wpa_s->mlme.ft_ies);
2970         wpa_s->mlme.ft_ies = os_malloc(ies_len);
2971         if (wpa_s->mlme.ft_ies == NULL)
2972                 return -1;
2973         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
2974         wpa_s->mlme.ft_ies_len = ies_len;
2975
2976         return 0;
2977 }
2978
2979
2980 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
2981                                  const u8 *target_ap,
2982                                  const u8 *ies, size_t ies_len)
2983 {
2984         u8 *buf;
2985         size_t len;
2986         struct ieee80211_mgmt *mgmt;
2987         int res;
2988
2989         /*
2990          * Action frame payload:
2991          * Category[1] = 6 (Fast BSS Transition)
2992          * Action[1] = 1 (Fast BSS Transition Request)
2993          * STA Address
2994          * Target AP Address
2995          * FT IEs
2996          */
2997
2998         buf = os_zalloc(sizeof(*mgmt) + ies_len);
2999         if (buf == NULL) {
3000                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3001                            "FT action frame");
3002                 return -1;
3003         }
3004
3005         mgmt = (struct ieee80211_mgmt *) buf;
3006         len = 24;
3007         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3008         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3009         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3010         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3011                                            WLAN_FC_STYPE_ACTION);
3012         mgmt->u.action.category = WLAN_ACTION_FT;
3013         mgmt->u.action.u.ft_action_req.action = action;
3014         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3015                   ETH_ALEN);
3016         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3017                   ETH_ALEN);
3018         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3019         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3020
3021         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3022                    "Target AP=" MACSTR " body_len=%d",
3023                    action, MAC2STR(target_ap), ies_len);
3024
3025         res = ieee80211_sta_tx(wpa_s, buf, len);
3026         os_free(buf);
3027
3028         return res;
3029 }
3030
3031 #endif /* CONFIG_IEEE80211R */
3032
3033
3034 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
3035                                    size_t ies_len)
3036 {
3037         os_free(wpa_s->mlme.extra_probe_ie);
3038         wpa_s->mlme.extra_probe_ie = NULL;
3039         wpa_s->mlme.extra_probe_ie_len = 0;
3040
3041         if (ies == NULL)
3042                 return 0;
3043
3044         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3045         if (wpa_s->mlme.extra_probe_ie == NULL)
3046                 return -1;
3047
3048         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3049         wpa_s->mlme.extra_probe_ie_len = ies_len;
3050
3051         return 0;
3052 }