wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "notify.h"
  24 #include "driver_i.h"
  25 #include "rsn_supp/wpa.h"
  26 #include "common/ieee802_11_defs.h"
  27 #include "common/ieee802_11_common.h"
  28 #include "mlme.h"
  29
  30
  31 /* Timeouts and intervals in milliseconds */
  32 #define IEEE80211_AUTH_TIMEOUT (200)
  33 #define IEEE80211_AUTH_MAX_TRIES 3
  34 #define IEEE80211_ASSOC_TIMEOUT (200)
  35 #define IEEE80211_ASSOC_MAX_TRIES 3
  36 #define IEEE80211_MONITORING_INTERVAL (2000)
  37 #define IEEE80211_PROBE_INTERVAL (60000)
  38 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  39 #define IEEE80211_SCAN_INTERVAL (2000)
  40 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  41 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  42
  43 #define IEEE80211_PROBE_DELAY (33)
  44 #define IEEE80211_CHANNEL_TIME (33)
  45 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  46 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  47 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  48 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  49
  50 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  51
  52
  53 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  54
  55
  56 struct ieee80211_sta_bss {
  57         struct ieee80211_sta_bss *next;
  58         struct ieee80211_sta_bss *hnext;
  59
  60         u8 bssid[ETH_ALEN];
  61         u8 ssid[MAX_SSID_LEN];
  62         size_t ssid_len;
  63         u16 capability; /* host byte order */
  64         int hw_mode;
  65         int channel;
  66         int freq;
  67         int rssi;
  68         u8 *ie;
  69         size_t ie_len;
  70         u8 *wpa_ie;
  71         size_t wpa_ie_len;
  72         u8 *rsn_ie;
  73         size_t rsn_ie_len;
  74         u8 *wmm_ie;
  75         size_t wmm_ie_len;
  76         u8 *mdie;
  77         size_t mdie_len;
  78 #define IEEE80211_MAX_SUPP_RATES 32
  79         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  80         size_t supp_rates_len;
  81         int beacon_int;
  82         u64 timestamp;
  83
  84         int probe_resp;
  85         struct os_time last_update;
  86 };
  87
  88
  89 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  90                                      const u8 *dst,
  91                                      const u8 *ssid, size_t ssid_len);
  92 static struct ieee80211_sta_bss *
  93 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  94 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  95 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  96 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  97 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  98 static void ieee80211_build_tspec(struct wpabuf *buf);
  99 static int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s,
 100                                           const u8 *ies, size_t ies_len);
 101
 102
 103 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 104                                      enum hostapd_hw_mode phymode, int chan,
 105                                      int freq)
 106 {
 107         size_t i;
 108         struct hostapd_hw_modes *mode;
 109
 110         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 111                 mode = &wpa_s->mlme.modes[i];
 112                 if (mode->mode == phymode) {
 113                         wpa_s->mlme.curr_rates = mode->rates;
 114                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 115                         break;
 116                 }
 117         }
 118
 119         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 120 }
 121
 122
 123 static int ecw2cw(int ecw)
 124 {
 125         int cw = 1;
 126         while (ecw > 0) {
 127                 cw <<= 1;
 128                 ecw--;
 129         }
 130         return cw - 1;
 131 }
 132
 133
 134 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 135                                      const u8 *wmm_param, size_t wmm_param_len)
 136 {
 137         size_t left;
 138         int count;
 139         const u8 *pos;
 140         u8 wmm_acm;
 141
 142         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 143                 return;
 144         count = wmm_param[6] & 0x0f;
 145         if (count == wpa_s->mlme.wmm_last_param_set)
 146                 return;
 147         wpa_s->mlme.wmm_last_param_set = count;
 148
 149         pos = wmm_param + 8;
 150         left = wmm_param_len - 8;
 151
 152         wmm_acm = 0;
 153         for (; left >= 4; left -= 4, pos += 4) {
 154                 int aci = (pos[0] >> 5) & 0x03;
 155                 int acm = (pos[0] >> 4) & 0x01;
 156                 int aifs, cw_max, cw_min, burst_time;
 157
 158                 switch (aci) {
 159                 case 1: /* AC_BK */
 160                         if (acm)
 161                                 wmm_acm |= BIT(1) | BIT(2); /* BK/- */
 162                         break;
 163                 case 2: /* AC_VI */
 164                         if (acm)
 165                                 wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
 166                         break;
 167                 case 3: /* AC_VO */
 168                         if (acm)
 169                                 wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
 170                         break;
 171                 case 0: /* AC_BE */
 172                 default:
 173                         if (acm)
 174                                 wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
 175                         break;
 176                 }
 177
 178                 aifs = pos[0] & 0x0f;
 179                 cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 180                 cw_min = ecw2cw(pos[1] & 0x0f);
 181                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 182                 burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 183                 wpa_printf(MSG_DEBUG, "MLME: WMM aci=%d acm=%d aifs=%d "
 184                            "cWmin=%d cWmax=%d burst=%d",
 185                            aci, acm, aifs, cw_min, cw_max, burst_time);
 186                 /* TODO: driver configuration */
 187         }
 188 }
 189
 190
 191 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 192 {
 193         if (wpa_s->mlme.associated == assoc && !assoc)
 194                 return;
 195
 196         wpa_s->mlme.associated = assoc;
 197
 198         if (assoc) {
 199                 union wpa_event_data data;
 200                 os_memset(&data, 0, sizeof(data));
 201                 wpa_s->mlme.prev_bssid_set = 1;
 202                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 203                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 204                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 205                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 206                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 207                 data.assoc_info.freq = wpa_s->mlme.freq;
 208                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 209         } else {
 210                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 211         }
 212         os_get_time(&wpa_s->mlme.last_probe);
 213 }
 214
 215
 216 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 217                             size_t len)
 218 {
 219         return wpa_drv_send_mlme(wpa_s, buf, len);
 220 }
 221
 222
 223 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 224                                 int transaction, const u8 *extra,
 225                                 size_t extra_len, int encrypt)
 226 {
 227         u8 *buf;
 228         size_t len;
 229         struct ieee80211_mgmt *mgmt;
 230
 231         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 232         if (buf == NULL) {
 233                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 234                            "auth frame");
 235                 return;
 236         }
 237
 238         mgmt = (struct ieee80211_mgmt *) buf;
 239         len = 24 + 6;
 240         os_memset(mgmt, 0, 24 + 6);
 241         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 242                                            WLAN_FC_STYPE_AUTH);
 243         if (encrypt)
 244                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 245         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 246         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 247         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 248         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 249         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 250         wpa_s->mlme.auth_transaction = transaction + 1;
 251         mgmt->u.auth.status_code = host_to_le16(0);
 252         if (extra) {
 253                 os_memcpy(buf + len, extra, extra_len);
 254                 len += extra_len;
 255         }
 256
 257         ieee80211_sta_tx(wpa_s, buf, len);
 258         os_free(buf);
 259 }
 260
 261
 262 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 263 {
 264         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 265         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 266                                ieee80211_sta_timer, wpa_s, NULL);
 267 }
 268
 269
 270 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 271 {
 272         u8 *extra;
 273         size_t extra_len;
 274
 275         wpa_s->mlme.auth_tries++;
 276         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 277                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 278                            " timed out", MAC2STR(wpa_s->bssid));
 279                 return;
 280         }
 281
 282         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 283         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 284                    MAC2STR(wpa_s->bssid));
 285
 286         extra = NULL;
 287         extra_len = 0;
 288
 289 #ifdef CONFIG_IEEE80211R
 290         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 291              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 292             wpa_s->mlme.ft_ies) {
 293                 struct ieee80211_sta_bss *bss;
 294                 struct rsn_mdie *mdie = NULL;
 295                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 296                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 297                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 298                 if (mdie &&
 299                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 300                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 301                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 302                                    "over-the-air");
 303                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 304                         extra = wpa_s->mlme.ft_ies;
 305                         extra_len = wpa_s->mlme.ft_ies_len;
 306                 }
 307         }
 308 #endif /* CONFIG_IEEE80211R */
 309
 310         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 311
 312         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 313 }
 314
 315
 316 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 317 {
 318         struct ieee80211_mgmt *mgmt;
 319         u8 *pos, *ies, *buf;
 320         int i, len;
 321         u16 capab;
 322         struct ieee80211_sta_bss *bss;
 323         int wmm = 0;
 324         size_t blen, buflen;
 325
 326         if (wpa_s->mlme.curr_rates == NULL) {
 327                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 328                 return;
 329         }
 330
 331         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 332                 wpa_s->mlme.ssid_len;
 333 #ifdef CONFIG_IEEE80211R
 334         if (wpa_s->mlme.ft_ies)
 335                 buflen += wpa_s->mlme.ft_ies_len;
 336 #endif /* CONFIG_IEEE80211R */
 337         buf = os_malloc(buflen);
 338         if (buf == NULL) {
 339                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 340                            "assoc frame");
 341                 return;
 342         }
 343         blen = 0;
 344
 345         capab = wpa_s->mlme.capab;
 346         if (wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211G) {
 347                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 348                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 349         }
 350         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 351         if (bss) {
 352                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 353                         capab |= WLAN_CAPABILITY_PRIVACY;
 354                 if (bss->wmm_ie) {
 355                         wmm = 1;
 356                 }
 357         }
 358
 359         mgmt = (struct ieee80211_mgmt *) buf;
 360         blen += 24;
 361         os_memset(mgmt, 0, 24);
 362         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 363         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 364         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 365
 366         if (wpa_s->mlme.prev_bssid_set) {
 367                 blen += 10;
 368                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 369                                                    WLAN_FC_STYPE_REASSOC_REQ);
 370                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 371                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 372                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 373                           wpa_s->mlme.prev_bssid,
 374                           ETH_ALEN);
 375         } else {
 376                 blen += 4;
 377                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 378                                                    WLAN_FC_STYPE_ASSOC_REQ);
 379                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 380                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 381         }
 382
 383         /* SSID */
 384         ies = pos = buf + blen;
 385         blen += 2 + wpa_s->mlme.ssid_len;
 386         *pos++ = WLAN_EID_SSID;
 387         *pos++ = wpa_s->mlme.ssid_len;
 388         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 389
 390         len = wpa_s->mlme.num_curr_rates;
 391         if (len > 8)
 392                 len = 8;
 393         pos = buf + blen;
 394         blen += len + 2;
 395         *pos++ = WLAN_EID_SUPP_RATES;
 396         *pos++ = len;
 397         for (i = 0; i < len; i++)
 398                 *pos++ = (u8) (wpa_s->mlme.curr_rates[i] / 5);
 399
 400         if (wpa_s->mlme.num_curr_rates > len) {
 401                 pos = buf + blen;
 402                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 403                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 404                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 405                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++)
 406                         *pos++ = (u8) (wpa_s->mlme.curr_rates[i] / 5);
 407         }
 408
 409         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 410                 pos = buf + blen;
 411                 blen += wpa_s->mlme.extra_ie_len;
 412                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 413         }
 414
 415 #ifdef CONFIG_IEEE80211R
 416         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 417              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 418             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 419             bss && bss->mdie &&
 420             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 421             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 422                 pos = buf + blen;
 423                 blen += 2 + sizeof(struct rsn_mdie);
 424                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 425                 *pos++ = sizeof(struct rsn_mdie);
 426                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 427                 pos += MOBILITY_DOMAIN_ID_LEN;
 428                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 429         }
 430
 431         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 432              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 433             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 434                 pos = buf + blen;
 435                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 436                 pos += wpa_s->mlme.ft_ies_len;
 437                 blen += wpa_s->mlme.ft_ies_len;
 438         }
 439 #endif /* CONFIG_IEEE80211R */
 440
 441         if (wmm && wpa_s->mlme.wmm_enabled) {
 442                 pos = buf + blen;
 443                 blen += 9;
 444                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 445                 *pos++ = 7; /* len */
 446                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 447                 *pos++ = 0x50;
 448                 *pos++ = 0xf2;
 449                 *pos++ = 2; /* WMM */
 450                 *pos++ = 0; /* WMM info */
 451                 *pos++ = 1; /* WMM ver */
 452                 *pos++ = 0;
 453         }
 454
 455         os_free(wpa_s->mlme.assocreq_ies);
 456         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 457         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 458         if (wpa_s->mlme.assocreq_ies) {
 459                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 460                           wpa_s->mlme.assocreq_ies_len);
 461         }
 462
 463         ieee80211_sta_tx(wpa_s, buf, blen);
 464         os_free(buf);
 465 }
 466
 467
 468 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 469 {
 470         u8 *buf;
 471         size_t len;
 472         struct ieee80211_mgmt *mgmt;
 473
 474         buf = os_zalloc(sizeof(*mgmt));
 475         if (buf == NULL) {
 476                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 477                            "deauth frame");
 478                 return;
 479         }
 480
 481         mgmt = (struct ieee80211_mgmt *) buf;
 482         len = 24;
 483         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 484         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 485         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 486         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 487                                            WLAN_FC_STYPE_DEAUTH);
 488         len += 2;
 489         mgmt->u.deauth.reason_code = host_to_le16(reason);
 490
 491         ieee80211_sta_tx(wpa_s, buf, len);
 492         os_free(buf);
 493 }
 494
 495
 496 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 497 {
 498         u8 *buf;
 499         size_t len;
 500         struct ieee80211_mgmt *mgmt;
 501
 502         buf = os_zalloc(sizeof(*mgmt));
 503         if (buf == NULL) {
 504                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 505                            "disassoc frame");
 506                 return;
 507         }
 508
 509         mgmt = (struct ieee80211_mgmt *) buf;
 510         len = 24;
 511         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 512         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 513         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 514         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 515                                            WLAN_FC_STYPE_DISASSOC);
 516         len += 2;
 517         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 518
 519         ieee80211_sta_tx(wpa_s, buf, len);
 520         os_free(buf);
 521 }
 522
 523
 524 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 525 {
 526         struct ieee80211_sta_bss *bss;
 527         int res = 0;
 528
 529         if (wpa_s->mlme.mixed_cell ||
 530             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 531                 return 0;
 532
 533         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 534         if (bss == NULL)
 535                 return 0;
 536
 537         if (ieee80211_sta_wep_configured(wpa_s) !=
 538             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 539                 res = 1;
 540
 541         return res;
 542 }
 543
 544
 545 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 546 {
 547         wpa_s->mlme.assoc_tries++;
 548         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 549                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 550                            " timed out", MAC2STR(wpa_s->bssid));
 551                 return;
 552         }
 553
 554         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 555         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 556                    MAC2STR(wpa_s->bssid));
 557         if (ieee80211_privacy_mismatch(wpa_s)) {
 558                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 559                            "configuration and mixed-cell disabled - abort "
 560                            "association");
 561                 return;
 562         }
 563
 564         ieee80211_send_assoc(wpa_s);
 565
 566         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 567 }
 568
 569
 570 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 571 {
 572         int disassoc;
 573
 574         /* TODO: start monitoring current AP signal quality and number of
 575          * missed beacons. Scan other channels every now and then and search
 576          * for better APs. */
 577         /* TODO: remove expired BSSes */
 578
 579         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 580
 581 #if 0 /* FIX */
 582         sta = sta_info_get(local, wpa_s->bssid);
 583         if (sta == NULL) {
 584                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 585                            MAC2STR(wpa_s->bssid));
 586                 disassoc = 1;
 587         } else {
 588                 disassoc = 0;
 589                 if (time_after(jiffies,
 590                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 591                         if (wpa_s->mlme.probereq_poll) {
 592                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 593                                            "current AP " MACSTR " - assume "
 594                                            "out of range",
 595                                            MAC2STR(wpa_s->bssid));
 596                                 disassoc = 1;
 597                         } else {
 598                                 ieee80211_send_probe_req(
 599                                         wpa_s->bssid,
 600                                         wpa_s->mlme.scan_ssid,
 601                                         wpa_s->mlme.scan_ssid_len);
 602                                 wpa_s->mlme.probereq_poll = 1;
 603                         }
 604                 } else {
 605                         wpa_s->mlme.probereq_poll = 0;
 606                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 607                                        IEEE80211_PROBE_INTERVAL)) {
 608                                 wpa_s->mlme.last_probe = jiffies;
 609                                 ieee80211_send_probe_req(wpa_s->bssid,
 610                                                          wpa_s->mlme.ssid,
 611                                                          wpa_s->mlme.ssid_len);
 612                         }
 613                 }
 614                 sta_info_release(local, sta);
 615         }
 616 #else
 617         disassoc = 0;
 618 #endif
 619         if (disassoc) {
 620                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 621                 ieee80211_reschedule_timer(wpa_s,
 622                                            IEEE80211_MONITORING_INTERVAL +
 623                                            30000);
 624         } else {
 625                 ieee80211_reschedule_timer(wpa_s,
 626                                            IEEE80211_MONITORING_INTERVAL);
 627         }
 628 }
 629
 630
 631 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 632                                      const u8 *dst,
 633                                      const u8 *ssid, size_t ssid_len)
 634 {
 635         u8 *buf;
 636         size_t len;
 637         struct ieee80211_mgmt *mgmt;
 638         u8 *pos, *supp_rates;
 639         u8 *esupp_rates = NULL;
 640         int i;
 641
 642         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 643         if (buf == NULL) {
 644                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 645                            "probe request");
 646                 return;
 647         }
 648
 649         mgmt = (struct ieee80211_mgmt *) buf;
 650         len = 24;
 651         os_memset(mgmt, 0, 24);
 652         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 653                                            WLAN_FC_STYPE_PROBE_REQ);
 654         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 655         if (dst) {
 656                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 657                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 658         } else {
 659                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 660                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 661         }
 662         pos = buf + len;
 663         len += 2 + ssid_len;
 664         *pos++ = WLAN_EID_SSID;
 665         *pos++ = ssid_len;
 666         os_memcpy(pos, ssid, ssid_len);
 667
 668         supp_rates = buf + len;
 669         len += 2;
 670         supp_rates[0] = WLAN_EID_SUPP_RATES;
 671         supp_rates[1] = 0;
 672         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 673                 if (esupp_rates) {
 674                         pos = buf + len;
 675                         len++;
 676                         esupp_rates[1]++;
 677                 } else if (supp_rates[1] == 8) {
 678                         esupp_rates = pos;
 679                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 680                         esupp_rates[1] = 1;
 681                         pos = &esupp_rates[2];
 682                         len += 3;
 683                 } else {
 684                         pos = buf + len;
 685                         len++;
 686                         supp_rates[1]++;
 687                 }
 688                 *pos++ = wpa_s->mlme.curr_rates[i] / 5;
 689         }
 690
 691         if (wpa_s->mlme.extra_probe_ie) {
 692                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 693                           wpa_s->mlme.extra_probe_ie_len);
 694                 len += wpa_s->mlme.extra_probe_ie_len;
 695         }
 696
 697         ieee80211_sta_tx(wpa_s, buf, len);
 698         os_free(buf);
 699 }
 700
 701
 702 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 703 {
 704 #if 0 /* FIX */
 705         if (sdata == NULL || sdata->default_key == NULL ||
 706             sdata->default_key->alg != ALG_WEP)
 707                 return 0;
 708         return 1;
 709 #else
 710         return 0;
 711 #endif
 712 }
 713
 714
 715 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 716 {
 717         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 718         wpa_s->mlme.authenticated = 1;
 719         ieee80211_associate(wpa_s);
 720 }
 721
 722
 723 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 724                                      struct ieee80211_mgmt *mgmt,
 725                                      size_t len,
 726                                      struct ieee80211_rx_status *rx_status)
 727 {
 728         u8 *pos;
 729         struct ieee802_11_elems elems;
 730
 731         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 732         pos = mgmt->u.auth.variable;
 733         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
 734             == ParseFailed) {
 735                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 736                 return;
 737         }
 738         if (elems.challenge == NULL) {
 739                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 740                            "auth frame");
 741                 return;
 742         }
 743         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 744                             elems.challenge_len + 2, 1);
 745 }
 746
 747
 748 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 749                                    struct ieee80211_mgmt *mgmt,
 750                                    size_t len,
 751                                    struct ieee80211_rx_status *rx_status)
 752 {
 753         struct wpa_ssid *ssid = wpa_s->current_ssid;
 754         u16 auth_alg, auth_transaction, status_code;
 755         int adhoc;
 756
 757         adhoc = ssid && ssid->mode == WPAS_MODE_IBSS;
 758
 759         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 760                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 761                            "from " MACSTR ", but not in authenticate state - "
 762                            "ignored", MAC2STR(mgmt->sa));
 763                 return;
 764         }
 765
 766         if (len < 24 + 6) {
 767                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 768                            "frame received from " MACSTR " - ignored",
 769                            (unsigned long) len, MAC2STR(mgmt->sa));
 770                 return;
 771         }
 772
 773         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 774                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 775                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 776                            ") - ignored",
 777                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 778                 return;
 779         }
 780
 781         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 782                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 783                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 784                            ") - ignored",
 785                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 786                 return;
 787         }
 788
 789         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 790         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 791         status_code = le_to_host16(mgmt->u.auth.status_code);
 792
 793         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 794                    " (alg=%d transaction=%d status=%d)",
 795                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 796
 797         if (adhoc) {
 798                 /* IEEE 802.11 standard does not require authentication in IBSS
 799                  * networks and most implementations do not seem to use it.
 800                  * However, try to reply to authentication attempts if someone
 801                  * has actually implemented this.
 802                  * TODO: Could implement shared key authentication. */
 803                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 804                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 805                                    "authentication frame (alg=%d "
 806                                    "transaction=%d)",
 807                                    auth_alg, auth_transaction);
 808                         return;
 809                 }
 810                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 811         }
 812
 813         if (auth_alg != wpa_s->mlme.auth_alg ||
 814             auth_transaction != wpa_s->mlme.auth_transaction) {
 815                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 816                            "(alg=%d transaction=%d)",
 817                            auth_alg, auth_transaction);
 818                 return;
 819         }
 820
 821         if (status_code != WLAN_STATUS_SUCCESS) {
 822                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 823                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
 824                            status_code);
 825                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 826                         const int num_algs = 3;
 827                         u8 algs[num_algs];
 828                         int i, pos;
 829                         algs[0] = algs[1] = algs[2] = 0xff;
 830                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
 831                                 algs[0] = WLAN_AUTH_OPEN;
 832                         if (wpa_s->mlme.auth_algs &
 833                             IEEE80211_AUTH_ALG_SHARED_KEY)
 834                                 algs[1] = WLAN_AUTH_SHARED_KEY;
 835                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
 836                                 algs[2] = WLAN_AUTH_LEAP;
 837                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
 838                                 pos = 0;
 839                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
 840                                 pos = 1;
 841                         else
 842                                 pos = 2;
 843                         for (i = 0; i < num_algs; i++) {
 844                                 pos++;
 845                                 if (pos >= num_algs)
 846                                         pos = 0;
 847                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
 848                                     algs[pos] == 0xff)
 849                                         continue;
 850                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
 851                                     !ieee80211_sta_wep_configured(wpa_s))
 852                                         continue;
 853                                 wpa_s->mlme.auth_alg = algs[pos];
 854                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
 855                                            "for next try",
 856                                            wpa_s->mlme.auth_alg);
 857                                 break;
 858                         }
 859                 }
 860                 return;
 861         }
 862
 863         switch (wpa_s->mlme.auth_alg) {
 864         case WLAN_AUTH_OPEN:
 865         case WLAN_AUTH_LEAP:
 866                 ieee80211_auth_completed(wpa_s);
 867                 break;
 868         case WLAN_AUTH_SHARED_KEY:
 869                 if (wpa_s->mlme.auth_transaction == 4)
 870                         ieee80211_auth_completed(wpa_s);
 871                 else
 872                         ieee80211_auth_challenge(wpa_s, mgmt, len,
 873                                                  rx_status);
 874                 break;
 875 #ifdef CONFIG_IEEE80211R
 876         case WLAN_AUTH_FT:
 877         {
 878                 union wpa_event_data data;
 879                 struct wpabuf *ric = NULL;
 880                 os_memset(&data, 0, sizeof(data));
 881                 data.ft_ies.ies = mgmt->u.auth.variable;
 882                 data.ft_ies.ies_len = len -
 883                         (mgmt->u.auth.variable - (u8 *) mgmt);
 884                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
 885                 if (os_strcmp(wpa_s->driver->name, "test") == 0 &&
 886                     wpa_s->mlme.wmm_enabled) {
 887                         ric = wpabuf_alloc(200);
 888                         if (ric) {
 889                                 /* Build simple RIC-Request: RDIE | TSPEC */
 890
 891                                 /* RIC Data (RDIE) */
 892                                 wpabuf_put_u8(ric, WLAN_EID_RIC_DATA);
 893                                 wpabuf_put_u8(ric, 4);
 894                                 wpabuf_put_u8(ric, 0); /* RDIE Identifier */
 895                                 wpabuf_put_u8(ric, 1); /* Resource Descriptor
 896                                                         * Count */
 897                                 wpabuf_put_le16(ric, 0); /* Status Code */
 898
 899                                 /* WMM TSPEC */
 900                                 ieee80211_build_tspec(ric);
 901
 902                                 data.ft_ies.ric_ies = wpabuf_head(ric);
 903                                 data.ft_ies.ric_ies_len = wpabuf_len(ric);
 904                         }
 905                 }
 906
 907                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
 908                 wpabuf_free(ric);
 909                 ieee80211_auth_completed(wpa_s);
 910                 break;
 911         }
 912 #endif /* CONFIG_IEEE80211R */
 913         }
 914 }
 915
 916
 917 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
 918                                      struct ieee80211_mgmt *mgmt,
 919                                      size_t len,
 920                                      struct ieee80211_rx_status *rx_status)
 921 {
 922         u16 reason_code;
 923
 924         if (len < 24 + 2) {
 925                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
 926                            "frame received from " MACSTR " - ignored",
 927                            (unsigned long) len, MAC2STR(mgmt->sa));
 928                 return;
 929         }
 930
 931         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 932                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
 933                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 934                            ") - ignored",
 935                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 936                 return;
 937         }
 938
 939         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
 940
 941         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
 942                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 943
 944         if (wpa_s->mlme.authenticated)
 945                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
 946
 947         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
 948             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
 949             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 950                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 951                 ieee80211_reschedule_timer(wpa_s,
 952                                            IEEE80211_RETRY_AUTH_INTERVAL);
 953         }
 954
 955         ieee80211_set_associated(wpa_s, 0);
 956         wpa_s->mlme.authenticated = 0;
 957 }
 958
 959
 960 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
 961                                        struct ieee80211_mgmt *mgmt,
 962                                        size_t len,
 963                                        struct ieee80211_rx_status *rx_status)
 964 {
 965         u16 reason_code;
 966
 967         if (len < 24 + 2) {
 968                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
 969                            "frame received from " MACSTR " - ignored",
 970                            (unsigned long) len, MAC2STR(mgmt->sa));
 971                 return;
 972         }
 973
 974         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 975                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
 976                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 977                            ") - ignored",
 978                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 979                 return;
 980         }
 981
 982         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
 983
 984         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
 985                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 986
 987         if (wpa_s->mlme.associated)
 988                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
 989
 990         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 991                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 992                 ieee80211_reschedule_timer(wpa_s,
 993                                            IEEE80211_RETRY_AUTH_INTERVAL);
 994         }
 995
 996         ieee80211_set_associated(wpa_s, 0);
 997 }
 998
 999
1000 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1001                                    struct ieee802_11_elems *elems)
1002 {
1003 #ifdef CONFIG_IEEE80211R
1004         const u8 *mobility_domain = NULL;
1005         const u8 *r0kh_id = NULL;
1006         size_t r0kh_id_len = 0;
1007         const u8 *r1kh_id = NULL;
1008         struct rsn_ftie *hdr;
1009         const u8 *pos, *end;
1010
1011         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1012                 mobility_domain = elems->mdie;
1013         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1014                 end = elems->ftie + elems->ftie_len;
1015                 hdr = (struct rsn_ftie *) elems->ftie;
1016                 pos = (const u8 *) (hdr + 1);
1017                 while (pos + 1 < end) {
1018                         if (pos + 2 + pos[1] > end)
1019                                 break;
1020                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1021                             pos[1] == FT_R1KH_ID_LEN)
1022                                 r1kh_id = pos + 2;
1023                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1024                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1025                                 r0kh_id = pos + 2;
1026                                 r0kh_id_len = pos[1];
1027                         }
1028                         pos += 2 + pos[1];
1029                 }
1030         }
1031         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1032                                     r0kh_id_len, r1kh_id);
1033 #else /* CONFIG_IEEE80211R */
1034         return 0;
1035 #endif /* CONFIG_IEEE80211R */
1036 }
1037
1038
1039 static void ieee80211_build_tspec(struct wpabuf *buf)
1040 {
1041         struct wmm_tspec_element *tspec;
1042         int tid, up;
1043
1044         tspec = wpabuf_put(buf, sizeof(*tspec));
1045         tspec->eid = WLAN_EID_VENDOR_SPECIFIC;
1046         tspec->length = sizeof(*tspec) - 2;
1047         tspec->oui[0] = 0x00;
1048         tspec->oui[1] = 0x50;
1049         tspec->oui[2] = 0xf2;
1050         tspec->oui_type = 2;
1051         tspec->oui_subtype = 2;
1052         tspec->version = 1;
1053
1054         tid = 1;
1055         up = 6; /* Voice */
1056         tspec->ts_info[0] = (tid << 1) |
1057                 (WMM_TSPEC_DIRECTION_BI_DIRECTIONAL << 5) |
1058                 BIT(7);
1059         tspec->ts_info[1] = up << 3;
1060         tspec->nominal_msdu_size = host_to_le16(1530);
1061         tspec->mean_data_rate = host_to_le32(128000); /* bits per second */
1062         tspec->minimum_phy_rate = host_to_le32(6000000);
1063         tspec->surplus_bandwidth_allowance = host_to_le16(0x3000); /* 150% */
1064 }
1065
1066
1067 static void ieee80211_tx_addts(struct wpa_supplicant *wpa_s)
1068 {
1069         struct wpabuf *buf;
1070         struct ieee80211_mgmt *mgmt;
1071         size_t alen;
1072
1073         wpa_printf(MSG_DEBUG, "MLME: Send ADDTS Request for Voice TSPEC");
1074         mgmt = NULL;
1075         alen = mgmt->u.action.u.wmm_action.variable - (u8 *) mgmt;
1076
1077         buf = wpabuf_alloc(alen + sizeof(struct wmm_tspec_element));
1078         if (buf == NULL)
1079                 return;
1080
1081         mgmt = wpabuf_put(buf, alen);
1082         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
1083         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1084         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1085         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1086                                            WLAN_FC_STYPE_ACTION);
1087         mgmt->u.action.category = WLAN_ACTION_WMM;
1088         mgmt->u.action.u.wmm_action.action_code = WMM_ACTION_CODE_ADDTS_REQ;
1089         mgmt->u.action.u.wmm_action.dialog_token = 1;
1090         mgmt->u.action.u.wmm_action.status_code = 0;
1091
1092         ieee80211_build_tspec(buf);
1093
1094         ieee80211_sta_tx(wpa_s, wpabuf_head(buf), wpabuf_len(buf));
1095         wpabuf_free(buf);
1096 }
1097
1098
1099 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1100                                          struct ieee80211_mgmt *mgmt,
1101                                          size_t len,
1102                                          struct ieee80211_rx_status *rx_status,
1103                                          int reassoc)
1104 {
1105         u8 rates[32];
1106         size_t rates_len;
1107         u16 capab_info, status_code, aid;
1108         struct ieee802_11_elems elems;
1109         u8 *pos;
1110
1111         /* AssocResp and ReassocResp have identical structure, so process both
1112          * of them in this function. */
1113
1114         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1115                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1116                            MACSTR ", but not in associate state - ignored",
1117                            MAC2STR(mgmt->sa));
1118                 return;
1119         }
1120
1121         if (len < 24 + 6) {
1122                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1123                            "frame received from " MACSTR " - ignored",
1124                            (unsigned long) len, MAC2STR(mgmt->sa));
1125                 return;
1126         }
1127
1128         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1129                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1130                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1131                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1132                 return;
1133         }
1134
1135         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1136         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1137         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1138         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1139                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1140                            "not set", aid);
1141         aid &= ~(BIT(15) | BIT(14));
1142
1143         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1144                    " (capab=0x%x status=%d aid=%d)",
1145                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1146                    capab_info, status_code, aid);
1147
1148         pos = mgmt->u.assoc_resp.variable;
1149         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
1150             == ParseFailed) {
1151                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1152                 return;
1153         }
1154
1155         if (status_code != WLAN_STATUS_SUCCESS) {
1156                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1157                            status_code);
1158 #ifdef CONFIG_IEEE80211W
1159                 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1160                     elems.timeout_int && elems.timeout_int_len == 5 &&
1161                     elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
1162                         u32 tu, ms;
1163                         tu = WPA_GET_LE32(elems.timeout_int + 1);
1164                         ms = tu * 1024 / 1000;
1165                         wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1166                                    "temporarily; comeback duration %u TU "
1167                                    "(%u ms)", tu, ms);
1168                         if (ms > IEEE80211_ASSOC_TIMEOUT) {
1169                                 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1170                                            "based on comeback duration");
1171                                 ieee80211_reschedule_timer(wpa_s, ms);
1172                         }
1173                 }
1174 #endif /* CONFIG_IEEE80211W */
1175                 return;
1176         }
1177
1178         if (elems.supp_rates == NULL) {
1179                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1180                            "AssocResp");
1181                 return;
1182         }
1183
1184         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1185                 if (!reassoc) {
1186                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1187                                    "association, not reassociation, response "
1188                                    "with FT");
1189                         return;
1190                 }
1191                 if (wpa_ft_validate_reassoc_resp(
1192                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1193                             mgmt->sa) < 0) {
1194                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1195                                    "Resp failed");
1196                         return;
1197                 }
1198         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1199                 return;
1200
1201         wpa_printf(MSG_DEBUG, "MLME: associated");
1202         wpa_s->mlme.aid = aid;
1203         wpa_s->mlme.ap_capab = capab_info;
1204
1205         os_free(wpa_s->mlme.assocresp_ies);
1206         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1207         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1208         if (wpa_s->mlme.assocresp_ies) {
1209                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1210                           wpa_s->mlme.assocresp_ies_len);
1211         }
1212
1213         ieee80211_set_associated(wpa_s, 1);
1214
1215         rates_len = elems.supp_rates_len;
1216         if (rates_len > sizeof(rates))
1217                 rates_len = sizeof(rates);
1218         os_memcpy(rates, elems.supp_rates, rates_len);
1219         if (elems.ext_supp_rates) {
1220                 size_t _len = elems.ext_supp_rates_len;
1221                 if (_len > sizeof(rates) - rates_len)
1222                         _len = sizeof(rates) - rates_len;
1223                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1224                 rates_len += _len;
1225         }
1226
1227         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1228                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1229                            "netstack");
1230         }
1231         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1232             0) {
1233                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1234                            "netstack");
1235         }
1236
1237         /* Remove STA entry before adding a new one just in case to avoid
1238          * problems with existing configuration (e.g., keys). */
1239         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1240         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1241                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1242                            "netstack");
1243         }
1244
1245         if (elems.wmm && wpa_s->mlme.wmm_enabled)
1246                 ieee80211_sta_wmm_params(wpa_s, elems.wmm, elems.wmm_len);
1247
1248         ieee80211_associated(wpa_s);
1249
1250         if (wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
1251             os_strcmp(wpa_s->driver->name, "test") == 0 &&
1252             elems.wmm && wpa_s->mlme.wmm_enabled) {
1253                 /* Test WMM-AC - send ADDTS for WMM TSPEC */
1254                 ieee80211_tx_addts(wpa_s);
1255         }
1256 }
1257
1258
1259 /* Caller must hold local->sta_bss_lock */
1260 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1261                                      struct ieee80211_sta_bss *bss)
1262 {
1263         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1264         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1265 }
1266
1267
1268 /* Caller must hold local->sta_bss_lock */
1269 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1270                                      struct ieee80211_sta_bss *bss)
1271 {
1272         struct ieee80211_sta_bss *b, *prev = NULL;
1273         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1274         while (b) {
1275                 if (b == bss) {
1276                         if (prev == NULL) {
1277                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1278                                         = bss->hnext;
1279                         } else {
1280                                 prev->hnext = bss->hnext;
1281                         }
1282                         break;
1283                 }
1284                 prev = b;
1285                 b = b->hnext;
1286         }
1287 }
1288
1289
1290 static struct ieee80211_sta_bss *
1291 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1292 {
1293         struct ieee80211_sta_bss *bss;
1294
1295         bss = os_zalloc(sizeof(*bss));
1296         if (bss == NULL)
1297                 return NULL;
1298         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1299
1300         /* TODO: order by RSSI? */
1301         bss->next = wpa_s->mlme.sta_bss_list;
1302         wpa_s->mlme.sta_bss_list = bss;
1303         __ieee80211_bss_hash_add(wpa_s, bss);
1304         return bss;
1305 }
1306
1307
1308 static struct ieee80211_sta_bss *
1309 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1310 {
1311         struct ieee80211_sta_bss *bss;
1312
1313         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1314         while (bss) {
1315                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1316                         break;
1317                 bss = bss->hnext;
1318         }
1319         return bss;
1320 }
1321
1322
1323 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1324                                struct ieee80211_sta_bss *bss)
1325 {
1326         __ieee80211_bss_hash_del(wpa_s, bss);
1327         os_free(bss->ie);
1328         os_free(bss->wpa_ie);
1329         os_free(bss->rsn_ie);
1330         os_free(bss->wmm_ie);
1331         os_free(bss->mdie);
1332         os_free(bss);
1333 }
1334
1335
1336 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1337 {
1338         struct ieee80211_sta_bss *bss, *prev;
1339
1340         bss = wpa_s->mlme.sta_bss_list;
1341         wpa_s->mlme.sta_bss_list = NULL;
1342         while (bss) {
1343                 prev = bss;
1344                 bss = bss->next;
1345                 ieee80211_bss_free(wpa_s, prev);
1346         }
1347 }
1348
1349
1350 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1351                                struct ieee80211_mgmt *mgmt,
1352                                size_t len,
1353                                struct ieee80211_rx_status *rx_status,
1354                                int beacon)
1355 {
1356         struct ieee802_11_elems elems;
1357         size_t baselen;
1358         int channel, invalid = 0, clen;
1359         struct ieee80211_sta_bss *bss;
1360         u64 timestamp;
1361         u8 *pos, *ie_pos;
1362         size_t ie_len;
1363
1364         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1365                 return; /* ignore ProbeResp to foreign address */
1366
1367 #if 0
1368         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1369                    beacon ? "Beacon" : "Probe Response",
1370                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1371 #endif
1372
1373         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1374         if (baselen > len)
1375                 return;
1376
1377         pos = mgmt->u.beacon.timestamp;
1378         timestamp = WPA_GET_LE64(pos);
1379
1380 #if 0 /* FIX */
1381         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1382             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1383 #ifdef IEEE80211_IBSS_DEBUG
1384                 static unsigned long last_tsf_debug = 0;
1385                 u64 tsf;
1386                 if (local->hw->get_tsf)
1387                         tsf = local->hw->get_tsf(local->mdev);
1388                 else
1389                         tsf = -1LLU;
1390                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1391                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1392                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1393                                    "@%ld",
1394                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1395                                    tsf, timestamp, tsf - timestamp, jiffies);
1396                         last_tsf_debug = jiffies;
1397                 }
1398 #endif /* IEEE80211_IBSS_DEBUG */
1399         }
1400 #endif
1401
1402         ie_pos = mgmt->u.beacon.variable;
1403         ie_len = len - baselen;
1404         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems, 0) == ParseFailed)
1405                 invalid = 1;
1406
1407 #if 0 /* FIX */
1408         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1409             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1410             (sta = sta_info_get(local, mgmt->sa))) {
1411                 struct ieee80211_rate *rates;
1412                 size_t num_rates;
1413                 u32 supp_rates, prev_rates;
1414                 int i, j, oper_mode;
1415
1416                 rates = local->curr_rates;
1417                 num_rates = local->num_curr_rates;
1418                 oper_mode = wpa_s->mlme.sta_scanning ?
1419                         local->scan_oper_phymode : local->conf.phymode;
1420                 for (i = 0; i < local->hw->num_modes; i++) {
1421                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1422                         if (oper_mode == mode->mode) {
1423                                 rates = mode->rates;
1424                                 num_rates = mode->num_rates;
1425                                 break;
1426                         }
1427                 }
1428
1429                 supp_rates = 0;
1430                 for (i = 0; i < elems.supp_rates_len +
1431                              elems.ext_supp_rates_len; i++) {
1432                         u8 rate = 0;
1433                         int own_rate;
1434                         if (i < elems.supp_rates_len)
1435                                 rate = elems.supp_rates[i];
1436                         else if (elems.ext_supp_rates)
1437                                 rate = elems.ext_supp_rates
1438                                         [i - elems.supp_rates_len];
1439                         own_rate = 5 * (rate & 0x7f);
1440                         if (oper_mode == MODE_ATHEROS_TURBO)
1441                                 own_rate *= 2;
1442                         for (j = 0; j < num_rates; j++)
1443                                 if (rates[j].rate == own_rate)
1444                                         supp_rates |= BIT(j);
1445                 }
1446
1447                 prev_rates = sta->supp_rates;
1448                 sta->supp_rates &= supp_rates;
1449                 if (sta->supp_rates == 0) {
1450                         /* No matching rates - this should not really happen.
1451                          * Make sure that at least one rate is marked
1452                          * supported to avoid issues with TX rate ctrl. */
1453                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1454                 }
1455                 if (sta->supp_rates != prev_rates) {
1456                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1457                                    "for " MACSTR " based on beacon info "
1458                                    "(0x%x & 0x%x -> 0x%x)",
1459                                    MAC2STR(sta->addr), prev_rates,
1460                                    supp_rates, sta->supp_rates);
1461                 }
1462                 sta_info_release(local, sta);
1463         }
1464 #endif
1465
1466         if (elems.ssid == NULL)
1467                 return;
1468
1469         if (elems.ds_params && elems.ds_params_len == 1)
1470                 channel = elems.ds_params[0];
1471         else
1472                 channel = rx_status->channel;
1473
1474         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1475         if (bss == NULL) {
1476                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1477                 if (bss == NULL)
1478                         return;
1479         } else {
1480 #if 0
1481                 /* TODO: order by RSSI? */
1482                 spin_lock_bh(&local->sta_bss_lock);
1483                 list_move_tail(&bss->list, &local->sta_bss_list);
1484                 spin_unlock_bh(&local->sta_bss_lock);
1485 #endif
1486         }
1487
1488         if (bss->probe_resp && beacon) {
1489                 /* Do not allow beacon to override data from Probe Response. */
1490                 return;
1491         }
1492
1493         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1494         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1495
1496         if (bss->ie == NULL || bss->ie_len < ie_len) {
1497                 os_free(bss->ie);
1498                 bss->ie = os_malloc(ie_len);
1499         }
1500         if (bss->ie) {
1501                 os_memcpy(bss->ie, ie_pos, ie_len);
1502                 bss->ie_len = ie_len;
1503         }
1504
1505         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1506                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1507                 bss->ssid_len = elems.ssid_len;
1508         }
1509
1510         bss->supp_rates_len = 0;
1511         if (elems.supp_rates) {
1512                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1513                 if (clen > elems.supp_rates_len)
1514                         clen = elems.supp_rates_len;
1515                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1516                           elems.supp_rates, clen);
1517                 bss->supp_rates_len += clen;
1518         }
1519         if (elems.ext_supp_rates) {
1520                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1521                 if (clen > elems.ext_supp_rates_len)
1522                         clen = elems.ext_supp_rates_len;
1523                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1524                           elems.ext_supp_rates, clen);
1525                 bss->supp_rates_len += clen;
1526         }
1527
1528         if (elems.wpa_ie &&
1529             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_ie_len ||
1530              os_memcmp(bss->wpa_ie, elems.wpa_ie, elems.wpa_ie_len))) {
1531                 os_free(bss->wpa_ie);
1532                 bss->wpa_ie = os_malloc(elems.wpa_ie_len + 2);
1533                 if (bss->wpa_ie) {
1534                         os_memcpy(bss->wpa_ie, elems.wpa_ie - 2,
1535                                   elems.wpa_ie_len + 2);
1536                         bss->wpa_ie_len = elems.wpa_ie_len + 2;
1537                 } else
1538                         bss->wpa_ie_len = 0;
1539         } else if (!elems.wpa_ie && bss->wpa_ie) {
1540                 os_free(bss->wpa_ie);
1541                 bss->wpa_ie = NULL;
1542                 bss->wpa_ie_len = 0;
1543         }
1544
1545         if (elems.rsn_ie &&
1546             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_ie_len ||
1547              os_memcmp(bss->rsn_ie, elems.rsn_ie, elems.rsn_ie_len))) {
1548                 os_free(bss->rsn_ie);
1549                 bss->rsn_ie = os_malloc(elems.rsn_ie_len + 2);
1550                 if (bss->rsn_ie) {
1551                         os_memcpy(bss->rsn_ie, elems.rsn_ie - 2,
1552                                   elems.rsn_ie_len + 2);
1553                         bss->rsn_ie_len = elems.rsn_ie_len + 2;
1554                 } else
1555                         bss->rsn_ie_len = 0;
1556         } else if (!elems.rsn_ie && bss->rsn_ie) {
1557                 os_free(bss->rsn_ie);
1558                 bss->rsn_ie = NULL;
1559                 bss->rsn_ie_len = 0;
1560         }
1561
1562         if (elems.wmm &&
1563             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_len ||
1564              os_memcmp(bss->wmm_ie, elems.wmm, elems.wmm_len))) {
1565                 os_free(bss->wmm_ie);
1566                 bss->wmm_ie = os_malloc(elems.wmm_len + 2);
1567                 if (bss->wmm_ie) {
1568                         os_memcpy(bss->wmm_ie, elems.wmm - 2,
1569                                   elems.wmm_len + 2);
1570                         bss->wmm_ie_len = elems.wmm_len + 2;
1571                 } else
1572                         bss->wmm_ie_len = 0;
1573         } else if (!elems.wmm && bss->wmm_ie) {
1574                 os_free(bss->wmm_ie);
1575                 bss->wmm_ie = NULL;
1576                 bss->wmm_ie_len = 0;
1577         }
1578
1579 #ifdef CONFIG_IEEE80211R
1580         if (elems.mdie &&
1581             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1582              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1583                 os_free(bss->mdie);
1584                 bss->mdie = os_malloc(elems.mdie_len + 2);
1585                 if (bss->mdie) {
1586                         os_memcpy(bss->mdie, elems.mdie - 2,
1587                                   elems.mdie_len + 2);
1588                         bss->mdie_len = elems.mdie_len + 2;
1589                 } else
1590                         bss->mdie_len = 0;
1591         } else if (!elems.mdie && bss->mdie) {
1592                 os_free(bss->mdie);
1593                 bss->mdie = NULL;
1594                 bss->mdie_len = 0;
1595         }
1596 #endif /* CONFIG_IEEE80211R */
1597
1598         bss->hw_mode = wpa_s->mlme.phymode;
1599         bss->channel = channel;
1600         bss->freq = wpa_s->mlme.freq;
1601         if (channel != wpa_s->mlme.channel &&
1602             (wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211G ||
1603              wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211B) &&
1604             channel >= 1 && channel <= 14) {
1605                 static const int freq_list[] = {
1606                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1607                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1608                 };
1609                 /* IEEE 802.11g/b mode can receive packets from neighboring
1610                  * channels, so map the channel into frequency. */
1611                 bss->freq = freq_list[channel - 1];
1612         }
1613         bss->timestamp = timestamp;
1614         os_get_time(&bss->last_update);
1615         bss->rssi = rx_status->ssi;
1616         if (!beacon)
1617                 bss->probe_resp++;
1618 }
1619
1620
1621 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1622                                          struct ieee80211_mgmt *mgmt,
1623                                          size_t len,
1624                                          struct ieee80211_rx_status *rx_status)
1625 {
1626         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1627 }
1628
1629
1630 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1631                                      struct ieee80211_mgmt *mgmt,
1632                                      size_t len,
1633                                      struct ieee80211_rx_status *rx_status)
1634 {
1635         int use_protection;
1636         size_t baselen;
1637         struct ieee802_11_elems elems;
1638
1639         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1640
1641         if (!wpa_s->mlme.associated ||
1642             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1643                 return;
1644
1645         /* Process beacon from the current BSS */
1646         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1647         if (baselen > len)
1648                 return;
1649
1650         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1651                                    &elems, 0) == ParseFailed)
1652                 return;
1653
1654         use_protection = 0;
1655         if (elems.erp_info && elems.erp_info_len >= 1) {
1656                 use_protection =
1657                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1658         }
1659
1660         if (use_protection != !!wpa_s->mlme.use_protection) {
1661                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1662                            ")",
1663                            use_protection ? "enabled" : "disabled",
1664                            MAC2STR(wpa_s->bssid));
1665                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1666                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1667         }
1668
1669         if (elems.wmm && wpa_s->mlme.wmm_enabled) {
1670                 ieee80211_sta_wmm_params(wpa_s, elems.wmm,
1671                                          elems.wmm_len);
1672         }
1673 }
1674
1675
1676 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1677                                         struct ieee80211_mgmt *mgmt,
1678                                         size_t len,
1679                                         struct ieee80211_rx_status *rx_status)
1680 {
1681         int tx_last_beacon, adhoc;
1682 #if 0 /* FIX */
1683         struct ieee80211_mgmt *resp;
1684 #endif
1685         u8 *pos, *end;
1686         struct wpa_ssid *ssid = wpa_s->current_ssid;
1687
1688         adhoc = ssid && ssid->mode == WPAS_MODE_IBSS;
1689
1690         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1691             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1692                 return;
1693
1694 #if 0 /* FIX */
1695         if (local->hw->tx_last_beacon)
1696                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1697         else
1698 #endif
1699                 tx_last_beacon = 1;
1700
1701 #ifdef IEEE80211_IBSS_DEBUG
1702         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1703                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1704                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1705                    MAC2STR(mgmt->bssid), tx_last_beacon);
1706 #endif /* IEEE80211_IBSS_DEBUG */
1707
1708         if (!tx_last_beacon)
1709                 return;
1710
1711         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1712             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1713                 return;
1714
1715         end = ((u8 *) mgmt) + len;
1716         pos = mgmt->u.probe_req.variable;
1717         if (pos[0] != WLAN_EID_SSID ||
1718             pos + 2 + pos[1] > end) {
1719                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1720                            MACSTR, MAC2STR(mgmt->sa));
1721                 return;
1722         }
1723         if (pos[1] != 0 &&
1724             (pos[1] != wpa_s->mlme.ssid_len ||
1725              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1726         {
1727                 /* Ignore ProbeReq for foreign SSID */
1728                 return;
1729         }
1730
1731 #if 0 /* FIX */
1732         /* Reply with ProbeResp */
1733         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1734         if (skb == NULL)
1735                 return;
1736
1737         resp = (struct ieee80211_mgmt *) skb->data;
1738         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1739 #ifdef IEEE80211_IBSS_DEBUG
1740         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1741                    MAC2STR(resp->da));
1742 #endif /* IEEE80211_IBSS_DEBUG */
1743         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1744 #endif
1745 }
1746
1747
1748 #ifdef CONFIG_IEEE80211R
1749 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1750                                         struct ieee80211_mgmt *mgmt,
1751                                         size_t len,
1752                                         struct ieee80211_rx_status *rx_status)
1753 {
1754         union wpa_event_data data;
1755         u16 status;
1756         u8 *sta_addr, *target_ap_addr;
1757
1758         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1759                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1760                 return;
1761         }
1762
1763         /*
1764          * Only FT Action Response is needed for now since reservation
1765          * protocol is not supported.
1766          */
1767         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1768                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1769                            mgmt->u.action.u.ft_action_resp.action);
1770                 return;
1771         }
1772
1773         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1774         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1775         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1776         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1777                    " TargetAP " MACSTR " Status Code %d",
1778                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1779         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1780                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1781                            " in FT Action Response", MAC2STR(sta_addr));
1782                 return;
1783         }
1784
1785         if (status) {
1786                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1787                            "failure (status code %d)", status);
1788                 /* TODO: report error to FT code(?) */
1789                 return;
1790         }
1791
1792         os_memset(&data, 0, sizeof(data));
1793         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1794         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1795                                      (u8 *) mgmt);
1796         data.ft_ies.ft_action = 1;
1797         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1798         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1799         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1800          * successfully */
1801         wpa_s->mlme.prev_bssid_set = 1;
1802         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1803         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1804         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1805         ieee80211_associate(wpa_s);
1806 }
1807 #endif /* CONFIG_IEEE80211R */
1808
1809
1810 #ifdef CONFIG_IEEE80211W
1811
1812 /* MLME-SAQuery.response */
1813 static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
1814                                             const u8 *addr, const u8 *trans_id)
1815 {
1816         struct ieee80211_mgmt *mgmt;
1817         int res;
1818         size_t len;
1819
1820         mgmt = os_zalloc(sizeof(*mgmt));
1821         if (mgmt == NULL) {
1822                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1823                            "SA Query action frame");
1824                 return -1;
1825         }
1826
1827         len = 24;
1828         os_memcpy(mgmt->da, addr, ETH_ALEN);
1829         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1830         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1831         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1832                                            WLAN_FC_STYPE_ACTION);
1833         mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
1834         mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
1835         os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
1836                   WLAN_SA_QUERY_TR_ID_LEN);
1837         len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
1838
1839         res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1840         os_free(mgmt);
1841
1842         return res;
1843 }
1844
1845
1846 static void ieee80211_rx_mgmt_sa_query_action(
1847         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1848         struct ieee80211_rx_status *rx_status)
1849 {
1850         if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
1851                 wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
1852                 return;
1853         }
1854
1855         if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
1856                 wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
1857                            mgmt->u.action.u.sa_query_req.action);
1858                 return;
1859         }
1860
1861         if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1862                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
1863                            "source " MACSTR, MAC2STR(mgmt->sa));
1864                 return;
1865         }
1866
1867         if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1868                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
1869                            "association process");
1870                 return;
1871         }
1872
1873         wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
1874         ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
1875                                          sa_query_req.trans_id);
1876 }
1877
1878 #endif /* CONFIG_IEEE80211W */
1879
1880
1881 static void dump_tspec(struct wmm_tspec_element *tspec)
1882 {
1883         int up, psb, dir, tid;
1884         u16 val;
1885
1886         up = (tspec->ts_info[1] >> 3) & 0x07;
1887         psb = (tspec->ts_info[1] >> 2) & 0x01;
1888         dir = (tspec->ts_info[0] >> 5) & 0x03;
1889         tid = (tspec->ts_info[0] >> 1) & 0x0f;
1890         wpa_printf(MSG_DEBUG, "WMM: TS Info: UP=%d PSB=%d Direction=%d TID=%d",
1891                    up, psb, dir, tid);
1892         val = le_to_host16(tspec->nominal_msdu_size);
1893         wpa_printf(MSG_DEBUG, "WMM: Nominal MSDU Size: %d%s",
1894                    val & 0x7fff, val & 0x8000 ? " (fixed)" : "");
1895         wpa_printf(MSG_DEBUG, "WMM: Mean Data Rate: %u bps",
1896                    le_to_host32(tspec->mean_data_rate));
1897         wpa_printf(MSG_DEBUG, "WMM: Minimum PHY Rate: %u bps",
1898                    le_to_host32(tspec->minimum_phy_rate));
1899         val = le_to_host16(tspec->surplus_bandwidth_allowance);
1900         wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance: %u.%04u",
1901                    val >> 13, 10000 * (val & 0x1fff) / 0x2000);
1902         val = le_to_host16(tspec->medium_time);
1903         wpa_printf(MSG_DEBUG, "WMM: Medium Time: %u (= %u usec/sec)",
1904                    val, 32 * val);
1905 }
1906
1907
1908 static int is_wmm_tspec(const u8 *ie, size_t len)
1909 {
1910         const struct wmm_tspec_element *tspec;
1911
1912         if (len < sizeof(*tspec))
1913                 return 0;
1914
1915         tspec = (const struct wmm_tspec_element *) ie;
1916         if (tspec->eid != WLAN_EID_VENDOR_SPECIFIC ||
1917             tspec->length < sizeof(*tspec) - 2 ||
1918             tspec->oui[0] != 0x00 || tspec->oui[1] != 0x50 ||
1919             tspec->oui[2] != 0xf2 || tspec->oui_type != 2 ||
1920             tspec->oui_subtype != 2 || tspec->version != 1)
1921                 return 0;
1922
1923         return 1;
1924 }
1925
1926
1927 static void ieee80211_rx_addts_resp(
1928         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1929         size_t var_len)
1930 {
1931         struct wmm_tspec_element *tspec;
1932
1933         wpa_printf(MSG_DEBUG, "WMM: Received ADDTS Response");
1934         wpa_hexdump(MSG_MSGDUMP, "WMM: ADDTS Response IE(s)",
1935                     mgmt->u.action.u.wmm_action.variable, var_len);
1936         if (!is_wmm_tspec(mgmt->u.action.u.wmm_action.variable, var_len))
1937                 return;
1938         tspec = (struct wmm_tspec_element *)
1939                 mgmt->u.action.u.wmm_action.variable;
1940         dump_tspec(tspec);
1941 }
1942
1943
1944 static void ieee80211_rx_delts(
1945         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1946         size_t var_len)
1947 {
1948         struct wmm_tspec_element *tspec;
1949
1950         wpa_printf(MSG_DEBUG, "WMM: Received DELTS");
1951         wpa_hexdump(MSG_MSGDUMP, "WMM: DELTS IE(s)",
1952                     mgmt->u.action.u.wmm_action.variable, var_len);
1953         if (!is_wmm_tspec(mgmt->u.action.u.wmm_action.variable, var_len))
1954                 return;
1955         tspec = (struct wmm_tspec_element *)
1956                 mgmt->u.action.u.wmm_action.variable;
1957         dump_tspec(tspec);
1958 }
1959
1960
1961 static void ieee80211_rx_mgmt_wmm_action(
1962         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1963         struct ieee80211_rx_status *rx_status)
1964 {
1965         size_t alen;
1966
1967         alen = mgmt->u.action.u.wmm_action.variable - (u8 *) mgmt;
1968         if (len < alen) {
1969                 wpa_printf(MSG_DEBUG, "WMM: Received Action frame too short");
1970                 return;
1971         }
1972
1973         wpa_printf(MSG_DEBUG, "WMM: Received Action frame: Action Code %d, "
1974                    "Dialog Token %d, Status Code %d",
1975                    mgmt->u.action.u.wmm_action.action_code,
1976                    mgmt->u.action.u.wmm_action.dialog_token,
1977                    mgmt->u.action.u.wmm_action.status_code);
1978
1979         switch (mgmt->u.action.u.wmm_action.action_code) {
1980         case WMM_ACTION_CODE_ADDTS_RESP:
1981                 ieee80211_rx_addts_resp(wpa_s, mgmt, len, len - alen);
1982                 break;
1983         case WMM_ACTION_CODE_DELTS:
1984                 ieee80211_rx_delts(wpa_s, mgmt, len, len - alen);
1985                 break;
1986         default:
1987                 wpa_printf(MSG_DEBUG, "WMM: Unsupported Action Code %d",
1988                            mgmt->u.action.u.wmm_action.action_code);
1989                 break;
1990         }
1991 }
1992
1993
1994 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1995                                      struct ieee80211_mgmt *mgmt,
1996                                      size_t len,
1997                                      struct ieee80211_rx_status *rx_status)
1998 {
1999         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
2000
2001         if (len < 25)
2002                 return;
2003
2004         switch (mgmt->u.action.category) {
2005 #ifdef CONFIG_IEEE80211R
2006         case WLAN_ACTION_FT:
2007                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
2008                 break;
2009 #endif /* CONFIG_IEEE80211R */
2010 #ifdef CONFIG_IEEE80211W
2011         case WLAN_ACTION_SA_QUERY:
2012                 ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
2013                 break;
2014 #endif /* CONFIG_IEEE80211W */
2015         case WLAN_ACTION_WMM:
2016                 ieee80211_rx_mgmt_wmm_action(wpa_s, mgmt, len, rx_status);
2017                 break;
2018         default:
2019                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
2020                            mgmt->u.action.category);
2021                 break;
2022         }
2023 }
2024
2025
2026 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
2027                                   const u8 *buf, size_t len,
2028                                   struct ieee80211_rx_status *rx_status)
2029 {
2030         struct ieee80211_mgmt *mgmt;
2031         u16 fc;
2032
2033         if (len < 24)
2034                 return;
2035
2036         mgmt = (struct ieee80211_mgmt *) buf;
2037         fc = le_to_host16(mgmt->frame_control);
2038
2039         switch (WLAN_FC_GET_STYPE(fc)) {
2040         case WLAN_FC_STYPE_PROBE_REQ:
2041                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
2042                 break;
2043         case WLAN_FC_STYPE_PROBE_RESP:
2044                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
2045                 break;
2046         case WLAN_FC_STYPE_BEACON:
2047                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2048                 break;
2049         case WLAN_FC_STYPE_AUTH:
2050                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
2051                 break;
2052         case WLAN_FC_STYPE_ASSOC_RESP:
2053                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
2054                 break;
2055         case WLAN_FC_STYPE_REASSOC_RESP:
2056                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
2057                 break;
2058         case WLAN_FC_STYPE_DEAUTH:
2059                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
2060                 break;
2061         case WLAN_FC_STYPE_DISASSOC:
2062                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
2063                 break;
2064         case WLAN_FC_STYPE_ACTION:
2065                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
2066                 break;
2067         default:
2068                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
2069                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
2070                 break;
2071         }
2072 }
2073
2074
2075 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
2076                                   const u8 *buf, size_t len,
2077                                   struct ieee80211_rx_status *rx_status)
2078 {
2079         struct ieee80211_mgmt *mgmt;
2080         u16 fc;
2081
2082         if (len < 24)
2083                 return;
2084
2085         mgmt = (struct ieee80211_mgmt *) buf;
2086         fc = le_to_host16(mgmt->frame_control);
2087
2088         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
2089                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
2090                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
2091                                                      len, rx_status);
2092                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
2093                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2094                 }
2095         }
2096 }
2097
2098
2099 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
2100 {
2101         int active = 0;
2102
2103 #if 0 /* FIX */
2104         list_for_each(ptr, &local->sta_list) {
2105                 sta = list_entry(ptr, struct sta_info, list);
2106                 if (sta->dev == dev &&
2107                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2108                                jiffies)) {
2109                         active++;
2110                         break;
2111                 }
2112         }
2113 #endif
2114
2115         return active;
2116 }
2117
2118
2119 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
2120 {
2121 #if 0 /* FIX */
2122         list_for_each_safe(ptr, n, &local->sta_list) {
2123                 sta = list_entry(ptr, struct sta_info, list);
2124                 if (time_after(jiffies, sta->last_rx +
2125                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2126                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
2127                                    MACSTR, MAC2STR(sta->addr));
2128                         sta_info_free(local, sta, 1);
2129                 }
2130         }
2131 #endif
2132 }
2133
2134
2135 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2136 {
2137         struct wpa_driver_scan_params params;
2138
2139         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2140
2141         ieee80211_sta_expire(wpa_s);
2142         if (ieee80211_sta_active_ibss(wpa_s))
2143                 return;
2144
2145         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2146                    "other IBSS networks with same SSID (merge)");
2147         os_memset(&params, 0, sizeof(params));
2148         params.ssids[0].ssid = wpa_s->mlme.ssid;
2149         params.ssids[0].ssid_len = wpa_s->mlme.ssid_len;
2150         params.num_ssids = wpa_s->mlme.ssid ? 1 : 0;
2151         ieee80211_sta_req_scan(wpa_s, &params);
2152 }
2153
2154
2155 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2156 {
2157         struct wpa_supplicant *wpa_s = eloop_ctx;
2158
2159         switch (wpa_s->mlme.state) {
2160         case IEEE80211_DISABLED:
2161                 break;
2162         case IEEE80211_AUTHENTICATE:
2163                 ieee80211_authenticate(wpa_s);
2164                 break;
2165         case IEEE80211_ASSOCIATE:
2166                 ieee80211_associate(wpa_s);
2167                 break;
2168         case IEEE80211_ASSOCIATED:
2169                 ieee80211_associated(wpa_s);
2170                 break;
2171         case IEEE80211_IBSS_SEARCH:
2172                 ieee80211_sta_find_ibss(wpa_s);
2173                 break;
2174         case IEEE80211_IBSS_JOINED:
2175                 ieee80211_sta_merge_ibss(wpa_s);
2176                 break;
2177         default:
2178                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2179                            wpa_s->mlme.state);
2180                 break;
2181         }
2182
2183         if (ieee80211_privacy_mismatch(wpa_s)) {
2184                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2185                            "and mixed-cell disabled - disassociate");
2186
2187                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2188                 ieee80211_set_associated(wpa_s, 0);
2189         }
2190 }
2191
2192
2193 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2194 {
2195         struct wpa_ssid *ssid = wpa_s->current_ssid;
2196         if (ssid && ssid->mode != WPAS_MODE_INFRA)
2197                 return;
2198
2199 #if 0 /* FIX */
2200         if (local->hw->reset_tsf) {
2201                 /* Reset own TSF to allow time synchronization work. */
2202                 local->hw->reset_tsf(local->mdev);
2203         }
2204 #endif
2205
2206         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2207
2208
2209         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2210                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2211         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2212                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2213         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2214                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2215         else
2216                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2217         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2218                    wpa_s->mlme.auth_alg);
2219         wpa_s->mlme.auth_transaction = -1;
2220         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2221         ieee80211_authenticate(wpa_s);
2222 }
2223
2224
2225 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2226 {
2227 #if 0 /* FIX */
2228         int m, c;
2229
2230         for (m = 0; m < local->hw->num_modes; m++) {
2231                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2232                 if (mode->mode != local->conf.phymode)
2233                         continue;
2234                 for (c = 0; c < mode->num_channels; c++) {
2235                         struct ieee80211_channel *chan = &mode->channels[c];
2236                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2237                             chan->chan == local->conf.channel) {
2238                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2239                                         return 1;
2240                                 break;
2241                         }
2242                 }
2243         }
2244 #endif
2245
2246         return 0;
2247 }
2248
2249
2250 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2251                                    struct ieee80211_sta_bss *bss)
2252 {
2253         int res = 0, rates, done = 0, bssid_changed;
2254         struct ieee80211_mgmt *mgmt;
2255 #if 0 /* FIX */
2256         struct ieee80211_tx_control control;
2257         struct ieee80211_rate *rate;
2258         struct rate_control_extra extra;
2259 #endif
2260         u8 *pos, *buf;
2261         size_t len;
2262
2263         /* Remove possible STA entries from other IBSS networks. */
2264 #if 0 /* FIX */
2265         sta_info_flush(local, NULL);
2266
2267         if (local->hw->reset_tsf) {
2268                 /* Reset own TSF to allow time synchronization work. */
2269                 local->hw->reset_tsf(local->mdev);
2270         }
2271 #endif
2272         bssid_changed = os_memcmp(wpa_s->bssid, bss->bssid, ETH_ALEN);
2273         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2274         if (bssid_changed)
2275                 wpas_notify_bssid_changed(wpa_s);
2276
2277 #if 0 /* FIX */
2278         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2279
2280         sdata->drop_unencrypted = bss->capability &
2281                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2282 #endif
2283
2284 #if 0 /* FIX */
2285         os_memset(&rq, 0, sizeof(rq));
2286         rq.m = bss->freq * 100000;
2287         rq.e = 1;
2288         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2289 #endif
2290
2291         if (!ieee80211_ibss_allowed(wpa_s)) {
2292 #if 0 /* FIX */
2293                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2294                            "(%d MHz)", local->conf.channel,
2295                            local->conf.freq);
2296 #endif
2297                 return -1;
2298         }
2299
2300         /* Set beacon template based on scan results */
2301         buf = os_malloc(400);
2302         len = 0;
2303         do {
2304                 if (buf == NULL)
2305                         break;
2306
2307                 mgmt = (struct ieee80211_mgmt *) buf;
2308                 len += 24 + sizeof(mgmt->u.beacon);
2309                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2310                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2311                                                    WLAN_FC_STYPE_BEACON);
2312                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2313                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2314                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2315 #if 0 /* FIX */
2316                 mgmt->u.beacon.beacon_int =
2317                         host_to_le16(local->conf.beacon_int);
2318 #endif
2319                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2320
2321                 pos = buf + len;
2322                 len += 2 + wpa_s->mlme.ssid_len;
2323                 *pos++ = WLAN_EID_SSID;
2324                 *pos++ = wpa_s->mlme.ssid_len;
2325                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2326
2327                 rates = bss->supp_rates_len;
2328                 if (rates > 8)
2329                         rates = 8;
2330                 pos = buf + len;
2331                 len += 2 + rates;
2332                 *pos++ = WLAN_EID_SUPP_RATES;
2333                 *pos++ = rates;
2334                 os_memcpy(pos, bss->supp_rates, rates);
2335
2336                 pos = buf + len;
2337                 len += 2 + 1;
2338                 *pos++ = WLAN_EID_DS_PARAMS;
2339                 *pos++ = 1;
2340                 *pos++ = bss->channel;
2341
2342                 pos = buf + len;
2343                 len += 2 + 2;
2344                 *pos++ = WLAN_EID_IBSS_PARAMS;
2345                 *pos++ = 2;
2346                 /* FIX: set ATIM window based on scan results */
2347                 *pos++ = 0;
2348                 *pos++ = 0;
2349
2350                 if (bss->supp_rates_len > 8) {
2351                         rates = bss->supp_rates_len - 8;
2352                         pos = buf + len;
2353                         len += 2 + rates;
2354                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2355                         *pos++ = rates;
2356                         os_memcpy(pos, &bss->supp_rates[8], rates);
2357                 }
2358
2359 #if 0 /* FIX */
2360                 os_memset(&control, 0, sizeof(control));
2361                 control.pkt_type = PKT_PROBE_RESP;
2362                 os_memset(&extra, 0, sizeof(extra));
2363                 extra.endidx = local->num_curr_rates;
2364                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2365                 if (rate == NULL) {
2366                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2367                                    "rate for IBSS beacon");
2368                         break;
2369                 }
2370                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2371                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2372                         rate->val2 : rate->val;
2373                 control.antenna_sel = local->conf.antenna_sel;
2374                 control.power_level = local->conf.power_level;
2375                 control.no_ack = 1;
2376                 control.retry_limit = 1;
2377                 control.rts_cts_duration = 0;
2378 #endif
2379
2380 #if 0 /* FIX */
2381                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2382                 if (wpa_s->mlme.probe_resp) {
2383                         mgmt = (struct ieee80211_mgmt *)
2384                                 wpa_s->mlme.probe_resp->data;
2385                         mgmt->frame_control =
2386                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2387                                              WLAN_FC_STYPE_PROBE_RESP);
2388                 } else {
2389                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2390                                    "ProbeResp template for IBSS");
2391                 }
2392
2393                 if (local->hw->beacon_update &&
2394                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2395                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2396                                    "template based on scan results");
2397                         skb = NULL;
2398                 }
2399
2400                 rates = 0;
2401                 for (i = 0; i < bss->supp_rates_len; i++) {
2402                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2403                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2404                                 rate *= 2;
2405                         for (j = 0; j < local->num_curr_rates; j++)
2406                                 if (local->curr_rates[j] == rate)
2407                                         rates |= BIT(j);
2408                 }
2409                 wpa_s->mlme.supp_rates_bits = rates;
2410 #endif
2411                 done = 1;
2412         } while (0);
2413
2414         os_free(buf);
2415         if (!done) {
2416                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2417                            "template");
2418         }
2419
2420         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2421         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2422
2423         return res;
2424 }
2425
2426
2427 #if 0 /* FIX */
2428 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2429 {
2430         struct ieee80211_sta_bss *bss;
2431         u8 bssid[ETH_ALEN], *pos;
2432         int i;
2433
2434 #if 0
2435         /* Easier testing, use fixed BSSID. */
2436         os_memset(bssid, 0xfe, ETH_ALEN);
2437 #else
2438         /* Generate random, not broadcast, locally administered BSSID. Mix in
2439          * own MAC address to make sure that devices that do not have proper
2440          * random number generator get different BSSID. */
2441         os_get_random(bssid, ETH_ALEN);
2442         for (i = 0; i < ETH_ALEN; i++)
2443                 bssid[i] ^= wpa_s->own_addr[i];
2444         bssid[0] &= ~0x01;
2445         bssid[0] |= 0x02;
2446 #endif
2447
2448         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2449                    MACSTR "", MAC2STR(bssid));
2450
2451         bss = ieee80211_bss_add(wpa_s, bssid);
2452         if (bss == NULL)
2453                 return -ENOMEM;
2454
2455 #if 0 /* FIX */
2456         if (local->conf.beacon_int == 0)
2457                 local->conf.beacon_int = 100;
2458         bss->beacon_int = local->conf.beacon_int;
2459         bss->hw_mode = local->conf.phymode;
2460         bss->channel = local->conf.channel;
2461         bss->freq = local->conf.freq;
2462 #endif
2463         os_get_time(&bss->last_update);
2464         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2465 #if 0 /* FIX */
2466         if (sdata->default_key) {
2467                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2468         } else
2469                 sdata->drop_unencrypted = 0;
2470         bss->supp_rates_len = local->num_curr_rates;
2471 #endif
2472         pos = bss->supp_rates;
2473 #if 0 /* FIX */
2474         for (i = 0; i < local->num_curr_rates; i++) {
2475                 int rate = local->curr_rates[i];
2476                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2477                         rate /= 2;
2478                 *pos++ = (u8) (rate / 5);
2479         }
2480 #endif
2481
2482         return ieee80211_sta_join_ibss(wpa_s, bss);
2483 }
2484 #endif
2485
2486
2487 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2488 {
2489         struct ieee80211_sta_bss *bss;
2490         int found = 0;
2491         u8 bssid[ETH_ALEN];
2492         int active_ibss;
2493         struct os_time now;
2494
2495         if (wpa_s->mlme.ssid_len == 0)
2496                 return -EINVAL;
2497
2498         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2499 #ifdef IEEE80211_IBSS_DEBUG
2500         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2501                    active_ibss);
2502 #endif /* IEEE80211_IBSS_DEBUG */
2503         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2504                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2505                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2506                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2507                         continue;
2508 #ifdef IEEE80211_IBSS_DEBUG
2509                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2510                            MAC2STR(bss->bssid));
2511 #endif /* IEEE80211_IBSS_DEBUG */
2512                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2513                 found = 1;
2514                 if (active_ibss ||
2515                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2516                         break;
2517         }
2518
2519 #ifdef IEEE80211_IBSS_DEBUG
2520         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2521                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2522 #endif /* IEEE80211_IBSS_DEBUG */
2523         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2524             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2525                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2526                            " based on configured SSID",
2527                            MAC2STR(bssid));
2528                 return ieee80211_sta_join_ibss(wpa_s, bss);
2529         }
2530 #ifdef IEEE80211_IBSS_DEBUG
2531         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2532 #endif /* IEEE80211_IBSS_DEBUG */
2533
2534         /* Selected IBSS not found in current scan results - try to scan */
2535         os_get_time(&now);
2536 #if 0 /* FIX */
2537         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2538             !ieee80211_sta_active_ibss(wpa_s)) {
2539                 ieee80211_reschedule_timer(wpa_s,
2540                                            IEEE80211_IBSS_MERGE_INTERVAL);
2541         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2542                               IEEE80211_SCAN_INTERVAL)) {
2543                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2544                            "to join");
2545                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2546                                               wpa_s->mlme.ssid_len);
2547         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2548                 int interval = IEEE80211_SCAN_INTERVAL;
2549
2550                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2551                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2552                         if (wpa_s->mlme.create_ibss &&
2553                             ieee80211_ibss_allowed(wpa_s))
2554                                 return ieee80211_sta_create_ibss(wpa_s);
2555                         if (wpa_s->mlme.create_ibss) {
2556                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2557                                            "on the configured channel %d "
2558                                            "(%d MHz)",
2559                                            local->conf.channel,
2560                                            local->conf.freq);
2561                         }
2562
2563                         /* No IBSS found - decrease scan interval and continue
2564                          * scanning. */
2565                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2566                 }
2567
2568                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2569                 ieee80211_reschedule_timer(wpa_s, interval);
2570                 return 0;
2571         }
2572 #endif
2573
2574         return 0;
2575 }
2576
2577
2578 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2579                            size_t *len)
2580 {
2581         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2582         *len = wpa_s->mlme.ssid_len;
2583         return 0;
2584 }
2585
2586
2587 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2588                             struct wpa_driver_associate_params *params)
2589 {
2590         struct ieee80211_sta_bss *bss;
2591         int bssid_changed;
2592
2593         wpa_s->mlme.bssid_set = 0;
2594         wpa_s->mlme.freq = params->freq;
2595         if (params->bssid) {
2596                 bssid_changed = os_memcmp(wpa_s->bssid, params->bssid,
2597                                           ETH_ALEN);
2598                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2599                 if (bssid_changed)
2600                         wpas_notify_bssid_changed(wpa_s);
2601
2602                 if (!is_zero_ether_addr(params->bssid))
2603                         wpa_s->mlme.bssid_set = 1;
2604                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2605                 if (bss) {
2606                         wpa_s->mlme.phymode = bss->hw_mode;
2607                         wpa_s->mlme.channel = bss->channel;
2608                         wpa_s->mlme.freq = bss->freq;
2609                 }
2610         }
2611
2612 #if 0 /* FIX */
2613         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2614          * not defined. */
2615         if (local->hw->conf_tx) {
2616                 struct ieee80211_tx_queue_params qparam;
2617                 int i;
2618
2619                 os_memset(&qparam, 0, sizeof(qparam));
2620                 /* TODO: are these ok defaults for all hw_modes? */
2621                 qparam.aifs = 2;
2622                 qparam.cw_min =
2623                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2624                 qparam.cw_max = 1023;
2625                 qparam.burst_time = 0;
2626                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2627                 {
2628                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2629                                            &qparam);
2630                 }
2631                 /* IBSS uses different parameters for Beacon sending */
2632                 qparam.cw_min++;
2633                 qparam.cw_min *= 2;
2634                 qparam.cw_min--;
2635                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2636         }
2637 #endif
2638
2639         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2640             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2641                 wpa_s->mlme.prev_bssid_set = 0;
2642         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2643         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2644                   MAX_SSID_LEN - params->ssid_len);
2645         wpa_s->mlme.ssid_len = params->ssid_len;
2646         wpa_s->mlme.ssid_set = 1;
2647
2648         os_free(wpa_s->mlme.extra_ie);
2649         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2650                 wpa_s->mlme.extra_ie = NULL;
2651                 wpa_s->mlme.extra_ie_len = 0;
2652         } else {
2653                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2654                 if (wpa_s->mlme.extra_ie == NULL) {
2655                         wpa_s->mlme.extra_ie_len = 0;
2656                         return -1;
2657                 }
2658                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2659                           params->wpa_ie_len);
2660                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2661         }
2662
2663         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2664
2665         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2666                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2667
2668         if (params->mode == WPAS_MODE_IBSS && !wpa_s->mlme.bssid_set) {
2669                 os_get_time(&wpa_s->mlme.ibss_join_req);
2670                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2671                 return ieee80211_sta_find_ibss(wpa_s);
2672         }
2673
2674         if (wpa_s->mlme.bssid_set)
2675                 ieee80211_sta_new_auth(wpa_s);
2676
2677         return 0;
2678 }
2679
2680
2681 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2682 {
2683         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2684         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2685         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2686 }
2687
2688
2689 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2690 {
2691         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2692         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2693         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2694         if (wpa_s->mlme.freq == 0)
2695                 return 0;
2696         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2697                                          wpa_s->mlme.channel,
2698                                          wpa_s->mlme.freq);
2699 }
2700
2701
2702 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2703 {
2704         size_t m;
2705         int c;
2706
2707         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2708                 struct hostapd_hw_modes *mode = &wpa_s->mlme.modes[m];
2709                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2710                         continue;
2711                 for (c = 0; c < mode->num_channels; c++) {
2712                         struct hostapd_channel_data *chan = &mode->channels[c];
2713                         if (!(chan->flag & HOSTAPD_CHAN_DISABLED) &&
2714                             chan->chan == wpa_s->mlme.channel) {
2715                                 if (!(chan->flag & HOSTAPD_CHAN_PASSIVE_SCAN))
2716                                         return 1;
2717                                 break;
2718                         }
2719                 }
2720         }
2721
2722         return 0;
2723 }
2724
2725
2726 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2727 {
2728         struct wpa_supplicant *wpa_s = eloop_ctx;
2729         struct hostapd_hw_modes *mode;
2730         struct hostapd_channel_data *chan;
2731         int skip = 0;
2732         int timeout = 0;
2733         struct wpa_ssid *ssid = wpa_s->current_ssid;
2734         int adhoc;
2735
2736         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2737                 return;
2738
2739         adhoc = ssid && ssid->mode == 1;
2740
2741         switch (wpa_s->mlme.scan_state) {
2742         case SCAN_SET_CHANNEL:
2743                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2744                 if (wpa_s->mlme.scan_hw_mode_idx >=
2745                     (int) wpa_s->mlme.num_modes ||
2746                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2747                      (int) wpa_s->mlme.num_modes
2748                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2749                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2750                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2751                                            "restore operational channel after "
2752                                            "scan");
2753                         }
2754                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2755                         wpa_s->mlme.sta_scanning = 0;
2756                         os_get_time(&wpa_s->mlme.last_scan_completed);
2757                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2758                         if (adhoc) {
2759                                 if (!wpa_s->mlme.bssid_set ||
2760                                     (wpa_s->mlme.state ==
2761                                      IEEE80211_IBSS_JOINED &&
2762                                      !ieee80211_sta_active_ibss(wpa_s)))
2763                                         ieee80211_sta_find_ibss(wpa_s);
2764                         }
2765                         return;
2766                 }
2767                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2768                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2769                 if ((chan->flag & HOSTAPD_CHAN_DISABLED) ||
2770                     (adhoc && (chan->flag & HOSTAPD_CHAN_NO_IBSS)) ||
2771                     (wpa_s->mlme.hw_modes & (1 << HOSTAPD_MODE_IEEE80211G) &&
2772                      mode->mode == HOSTAPD_MODE_IEEE80211B &&
2773                      wpa_s->mlme.scan_skip_11b))
2774                         skip = 1;
2775                 if (!skip && wpa_s->mlme.scan_freqs) {
2776                         int i, found = 0;
2777                         for (i = 0; wpa_s->mlme.scan_freqs[i]; i++) {
2778                                 if (wpa_s->mlme.scan_freqs[i] == chan->freq) {
2779                                         found = 1;
2780                                         break;
2781                                 }
2782                         }
2783                         if (!found)
2784                                 skip = 1;
2785                 }
2786
2787                 if (!skip) {
2788                         wpa_printf(MSG_MSGDUMP,
2789                                    "MLME: scan channel %d (%d MHz)",
2790                                    chan->chan, chan->freq);
2791
2792                         wpa_s->mlme.channel = chan->chan;
2793                         wpa_s->mlme.freq = chan->freq;
2794                         wpa_s->mlme.phymode = mode->mode;
2795                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2796                                                       chan->chan, chan->freq))
2797                         {
2798                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2799                                            "channel %d (%d MHz) for scan",
2800                                            chan->chan, chan->freq);
2801                                 skip = 1;
2802                         }
2803                 }
2804
2805                 wpa_s->mlme.scan_channel_idx++;
2806                 if (wpa_s->mlme.scan_channel_idx >=
2807                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2808                     num_channels) {
2809                         wpa_s->mlme.scan_hw_mode_idx++;
2810                         wpa_s->mlme.scan_channel_idx = 0;
2811                 }
2812
2813                 if (skip) {
2814                         timeout = 0;
2815                         break;
2816                 }
2817
2818                 timeout = IEEE80211_PROBE_DELAY;
2819                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2820                 break;
2821         case SCAN_SEND_PROBE:
2822                 if (ieee80211_active_scan(wpa_s)) {
2823                         ieee80211_send_probe_req(wpa_s, NULL,
2824                                                  wpa_s->mlme.scan_ssid,
2825                                                  wpa_s->mlme.scan_ssid_len);
2826                         timeout = IEEE80211_CHANNEL_TIME;
2827                 } else {
2828                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2829                 }
2830                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2831                 break;
2832         }
2833
2834         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2835                                ieee80211_sta_scan_timer, wpa_s, NULL);
2836 }
2837
2838
2839 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s,
2840                            struct wpa_driver_scan_params *params)
2841 {
2842         const u8 *ssid = params->ssids[0].ssid;
2843         size_t ssid_len = params->ssids[0].ssid_len;
2844
2845         if (ssid_len > MAX_SSID_LEN)
2846                 return -1;
2847
2848         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2849          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2850          * BSSID: MACAddress
2851          * SSID
2852          * ScanType: ACTIVE, PASSIVE
2853          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2854          *    a Probe frame during active scanning
2855          * ChannelList
2856          * MinChannelTime (>= ProbeDelay), in TU
2857          * MaxChannelTime: (>= MinChannelTime), in TU
2858          */
2859
2860          /* MLME-SCAN.confirm
2861           * BSSDescriptionSet
2862           * ResultCode: SUCCESS, INVALID_PARAMETERS
2863          */
2864
2865         /* TODO: if assoc, move to power save mode for the duration of the
2866          * scan */
2867
2868         if (wpa_s->mlme.sta_scanning)
2869                 return -1;
2870
2871         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2872
2873         ieee80211_sta_set_probe_req_ie(wpa_s, params->extra_ies,
2874                                        params->extra_ies_len);
2875
2876         os_free(wpa_s->mlme.scan_freqs);
2877         if (params->freqs) {
2878                 int i;
2879                 for (i = 0; params->freqs[i]; i++)
2880                         ;
2881                 wpa_s->mlme.scan_freqs = os_malloc((i + 1) * sizeof(int));
2882                 if (wpa_s->mlme.scan_freqs)
2883                         os_memcpy(wpa_s->mlme.scan_freqs, params->freqs,
2884                                   (i + 1) * sizeof(int));
2885         } else
2886                 wpa_s->mlme.scan_freqs = NULL;
2887
2888         ieee80211_sta_save_oper_chan(wpa_s);
2889
2890         wpa_s->mlme.sta_scanning = 1;
2891         /* TODO: stop TX queue? */
2892
2893         if (ssid) {
2894                 wpa_s->mlme.scan_ssid_len = ssid_len;
2895                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2896         } else
2897                 wpa_s->mlme.scan_ssid_len = 0;
2898         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2899                                         * supported */
2900         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2901         wpa_s->mlme.scan_hw_mode_idx = 0;
2902         wpa_s->mlme.scan_channel_idx = 0;
2903         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2904
2905         return 0;
2906 }
2907
2908
2909 struct wpa_scan_results *
2910 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2911 {
2912         size_t ap_num = 0;
2913         struct wpa_scan_results *res;
2914         struct wpa_scan_res *r;
2915         struct ieee80211_sta_bss *bss;
2916
2917         res = os_zalloc(sizeof(*res));
2918         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2919                 ap_num++;
2920         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2921         if (res->res == NULL) {
2922                 os_free(res);
2923                 return NULL;
2924         }
2925
2926         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2927                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2928                 if (r == NULL)
2929                         break;
2930                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2931                 r->freq = bss->freq;
2932                 r->beacon_int = bss->beacon_int;
2933                 r->caps = bss->capability;
2934                 r->level = bss->rssi;
2935                 r->tsf = bss->timestamp;
2936                 if (bss->ie) {
2937                         r->ie_len = bss->ie_len;
2938                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2939                 }
2940
2941                 res->res[res->num++] = r;
2942         }
2943
2944         return res;
2945 }
2946
2947
2948 #if 0 /* FIX */
2949 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2950                                          struct sk_buff *skb, u8 *bssid,
2951                                          u8 *addr)
2952 {
2953         struct ieee80211_local *local = dev->priv;
2954         struct list_head *ptr;
2955         struct sta_info *sta;
2956         struct wpa_supplicant *sta_dev = NULL;
2957
2958         /* TODO: Could consider removing the least recently used entry and
2959          * allow new one to be added. */
2960         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2961                 if (net_ratelimit()) {
2962                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2963                                    "STA entry " MACSTR, MAC2STR(addr));
2964                 }
2965                 return NULL;
2966         }
2967
2968         spin_lock_bh(&local->sub_if_lock);
2969         list_for_each(ptr, &local->sub_if_list) {
2970                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2971                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2972                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2973                         sta_dev = sdata->dev;
2974                         break;
2975                 }
2976         }
2977         spin_unlock_bh(&local->sub_if_lock);
2978
2979         if (sta_dev == NULL)
2980                 return NULL;
2981
2982         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2983                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2984
2985         sta = sta_info_add(wpa_s, addr);
2986         if (sta == NULL) {
2987                 return NULL;
2988         }
2989
2990         sta->dev = sta_dev;
2991         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2992
2993         rate_control_rate_init(local, sta);
2994
2995         return sta; /* caller will call sta_info_release() */
2996 }
2997 #endif
2998
2999
3000 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
3001 {
3002         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
3003
3004         ieee80211_send_deauth(wpa_s, reason);
3005         ieee80211_set_associated(wpa_s, 0);
3006         return 0;
3007 }
3008
3009
3010 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
3011 {
3012         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
3013
3014         if (!wpa_s->mlme.associated)
3015                 return -1;
3016
3017         ieee80211_send_disassoc(wpa_s, reason);
3018         ieee80211_set_associated(wpa_s, 0);
3019         return 0;
3020 }
3021
3022
3023 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
3024                       struct ieee80211_rx_status *rx_status)
3025 {
3026         struct ieee80211_mgmt *mgmt;
3027         u16 fc;
3028         const u8 *pos;
3029
3030         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
3031
3032         if (wpa_s->mlme.sta_scanning) {
3033                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
3034                 return;
3035         }
3036
3037         if (len < 24)
3038                 return;
3039
3040         mgmt = (struct ieee80211_mgmt *) buf;
3041         fc = le_to_host16(mgmt->frame_control);
3042
3043         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
3044                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
3045         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
3046                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
3047                     WLAN_FC_FROMDS)
3048                         return;
3049                 /* mgmt->sa is actually BSSID for FromDS data frames */
3050                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
3051                         return;
3052                 /* Skip IEEE 802.11 and LLC headers */
3053                 pos = buf + 24 + 6;
3054                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
3055                         return;
3056                 pos += 2;
3057                 /* mgmt->bssid is actually BSSID for SA data frames */
3058                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
3059                                         pos, buf + len - pos);
3060         }
3061 }
3062
3063
3064 void ieee80211_sta_free_hw_features(struct hostapd_hw_modes *hw_features,
3065                                     size_t num_hw_features)
3066 {
3067         size_t i;
3068
3069         if (hw_features == NULL)
3070                 return;
3071
3072         for (i = 0; i < num_hw_features; i++) {
3073                 os_free(hw_features[i].channels);
3074                 os_free(hw_features[i].rates);
3075         }
3076
3077         os_free(hw_features);
3078 }
3079
3080
3081 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
3082 {
3083         u16 num_modes, flags;
3084
3085         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
3086                                                         &flags);
3087         if (wpa_s->mlme.modes == NULL) {
3088                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
3089                            "channels and rates from the driver");
3090                 return -1;
3091         }
3092
3093         wpa_s->mlme.num_modes = num_modes;
3094
3095         wpa_s->mlme.hw_modes = 1 << HOSTAPD_MODE_IEEE80211A;
3096         wpa_s->mlme.hw_modes |= 1 << HOSTAPD_MODE_IEEE80211B;
3097         wpa_s->mlme.hw_modes |= 1 << HOSTAPD_MODE_IEEE80211G;
3098
3099         wpa_s->mlme.wmm_enabled = 1;
3100
3101         return 0;
3102 }
3103
3104
3105 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
3106 {
3107         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
3108         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
3109         os_free(wpa_s->mlme.extra_ie);
3110         wpa_s->mlme.extra_ie = NULL;
3111         os_free(wpa_s->mlme.extra_probe_ie);
3112         wpa_s->mlme.extra_probe_ie = NULL;
3113         os_free(wpa_s->mlme.assocreq_ies);
3114         wpa_s->mlme.assocreq_ies = NULL;
3115         os_free(wpa_s->mlme.assocresp_ies);
3116         wpa_s->mlme.assocresp_ies = NULL;
3117         ieee80211_bss_list_deinit(wpa_s);
3118         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
3119                                        wpa_s->mlme.num_modes);
3120 #ifdef CONFIG_IEEE80211R
3121         os_free(wpa_s->mlme.ft_ies);
3122         wpa_s->mlme.ft_ies = NULL;
3123         wpa_s->mlme.ft_ies_len = 0;
3124 #endif /* CONFIG_IEEE80211R */
3125
3126         os_free(wpa_s->mlme.scan_freqs);
3127         wpa_s->mlme.scan_freqs = NULL;
3128 }
3129
3130
3131 #ifdef CONFIG_IEEE80211R
3132
3133 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
3134                                 const u8 *ies, size_t ies_len)
3135 {
3136         if (md == NULL) {
3137                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
3138                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
3139         } else {
3140                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
3141                            MAC2STR(md));
3142                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
3143         }
3144
3145         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
3146         os_free(wpa_s->mlme.ft_ies);
3147         wpa_s->mlme.ft_ies = os_malloc(ies_len);
3148         if (wpa_s->mlme.ft_ies == NULL)
3149                 return -1;
3150         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
3151         wpa_s->mlme.ft_ies_len = ies_len;
3152
3153         return 0;
3154 }
3155
3156
3157 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
3158                                  const u8 *target_ap,
3159                                  const u8 *ies, size_t ies_len)
3160 {
3161         u8 *buf;
3162         size_t len;
3163         struct ieee80211_mgmt *mgmt;
3164         int res;
3165
3166         /*
3167          * Action frame payload:
3168          * Category[1] = 6 (Fast BSS Transition)
3169          * Action[1] = 1 (Fast BSS Transition Request)
3170          * STA Address
3171          * Target AP Address
3172          * FT IEs
3173          */
3174
3175         buf = os_zalloc(sizeof(*mgmt) + ies_len);
3176         if (buf == NULL) {
3177                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3178                            "FT action frame");
3179                 return -1;
3180         }
3181
3182         mgmt = (struct ieee80211_mgmt *) buf;
3183         len = 24;
3184         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3185         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3186         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3187         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3188                                            WLAN_FC_STYPE_ACTION);
3189         mgmt->u.action.category = WLAN_ACTION_FT;
3190         mgmt->u.action.u.ft_action_req.action = action;
3191         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3192                   ETH_ALEN);
3193         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3194                   ETH_ALEN);
3195         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3196         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3197
3198         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3199                    "Target AP=" MACSTR " body_len=%lu",
3200                    action, MAC2STR(target_ap), (unsigned long) ies_len);
3201
3202         res = ieee80211_sta_tx(wpa_s, buf, len);
3203         os_free(buf);
3204
3205         return res;
3206 }
3207
3208 #endif /* CONFIG_IEEE80211R */
3209
3210
3211 static int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s,
3212                                           const u8 *ies, size_t ies_len)
3213 {
3214         os_free(wpa_s->mlme.extra_probe_ie);
3215         wpa_s->mlme.extra_probe_ie = NULL;
3216         wpa_s->mlme.extra_probe_ie_len = 0;
3217
3218         if (ies == NULL)
3219                 return 0;
3220
3221         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3222         if (wpa_s->mlme.extra_probe_ie == NULL)
3223                 return -1;
3224
3225         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3226         wpa_s->mlme.extra_probe_ie_len = ies_len;
3227
3228         return 0;
3229 }