wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "driver_i.h"
  24 #include "wpa.h"
  25 #include "ieee802_11_defs.h"
  26 #include "ieee802_11_common.h"
  27 #include "mlme.h"
  28
  29
  30 /* Timeouts and intervals in milliseconds */
  31 #define IEEE80211_AUTH_TIMEOUT (200)
  32 #define IEEE80211_AUTH_MAX_TRIES 3
  33 #define IEEE80211_ASSOC_TIMEOUT (200)
  34 #define IEEE80211_ASSOC_MAX_TRIES 3
  35 #define IEEE80211_MONITORING_INTERVAL (2000)
  36 #define IEEE80211_PROBE_INTERVAL (60000)
  37 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  38 #define IEEE80211_SCAN_INTERVAL (2000)
  39 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  40 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  41
  42 #define IEEE80211_PROBE_DELAY (33)
  43 #define IEEE80211_CHANNEL_TIME (33)
  44 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  45 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  46 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  47 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  48
  49 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  50
  51
  52 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  53
  54
  55 struct ieee80211_sta_bss {
  56         struct ieee80211_sta_bss *next;
  57         struct ieee80211_sta_bss *hnext;
  58
  59         u8 bssid[ETH_ALEN];
  60         u8 ssid[MAX_SSID_LEN];
  61         size_t ssid_len;
  62         u16 capability; /* host byte order */
  63         int hw_mode;
  64         int channel;
  65         int freq;
  66         int rssi;
  67         u8 *ie;
  68         size_t ie_len;
  69         u8 *wpa_ie;
  70         size_t wpa_ie_len;
  71         u8 *rsn_ie;
  72         size_t rsn_ie_len;
  73         u8 *wmm_ie;
  74         size_t wmm_ie_len;
  75         u8 *mdie;
  76         size_t mdie_len;
  77 #define IEEE80211_MAX_SUPP_RATES 32
  78         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  79         size_t supp_rates_len;
  80         int beacon_int;
  81         u64 timestamp;
  82
  83         int probe_resp;
  84         struct os_time last_update;
  85 };
  86
  87
  88 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  89                                      const u8 *dst,
  90                                      const u8 *ssid, size_t ssid_len);
  91 static struct ieee80211_sta_bss *
  92 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  93 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  94 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  95 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  96 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  97 static void ieee80211_build_tspec(struct wpabuf *buf);
  98
  99
 100 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 101                                      hostapd_hw_mode phymode, int chan,
 102                                      int freq)
 103 {
 104         size_t i;
 105         struct hostapd_hw_modes *mode;
 106
 107         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 108                 mode = &wpa_s->mlme.modes[i];
 109                 if (mode->mode == phymode) {
 110                         wpa_s->mlme.curr_rates = mode->rates;
 111                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 112                         break;
 113                 }
 114         }
 115
 116         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 117 }
 118
 119
 120 static int ecw2cw(int ecw)
 121 {
 122         int cw = 1;
 123         while (ecw > 0) {
 124                 cw <<= 1;
 125                 ecw--;
 126         }
 127         return cw - 1;
 128 }
 129
 130
 131 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 132                                      u8 *wmm_param, size_t wmm_param_len)
 133 {
 134         size_t left;
 135         int count;
 136         u8 *pos;
 137         u8 wmm_acm;
 138
 139         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 140                 return;
 141         count = wmm_param[6] & 0x0f;
 142         if (count == wpa_s->mlme.wmm_last_param_set)
 143                 return;
 144         wpa_s->mlme.wmm_last_param_set = count;
 145
 146         pos = wmm_param + 8;
 147         left = wmm_param_len - 8;
 148
 149         wmm_acm = 0;
 150         for (; left >= 4; left -= 4, pos += 4) {
 151                 int aci = (pos[0] >> 5) & 0x03;
 152                 int acm = (pos[0] >> 4) & 0x01;
 153                 int aifs, cw_max, cw_min, burst_time;
 154
 155                 switch (aci) {
 156                 case 1: /* AC_BK */
 157                         if (acm)
 158                                 wmm_acm |= BIT(1) | BIT(2); /* BK/- */
 159                         break;
 160                 case 2: /* AC_VI */
 161                         if (acm)
 162                                 wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
 163                         break;
 164                 case 3: /* AC_VO */
 165                         if (acm)
 166                                 wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
 167                         break;
 168                 case 0: /* AC_BE */
 169                 default:
 170                         if (acm)
 171                                 wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
 172                         break;
 173                 }
 174
 175                 aifs = pos[0] & 0x0f;
 176                 cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 177                 cw_min = ecw2cw(pos[1] & 0x0f);
 178                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 179                 burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 180                 wpa_printf(MSG_DEBUG, "MLME: WMM aci=%d acm=%d aifs=%d "
 181                            "cWmin=%d cWmax=%d burst=%d",
 182                            aci, acm, aifs, cw_min, cw_max, burst_time);
 183                 /* TODO: driver configuration */
 184         }
 185 }
 186
 187
 188 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 189 {
 190         if (wpa_s->mlme.associated == assoc && !assoc)
 191                 return;
 192
 193         wpa_s->mlme.associated = assoc;
 194
 195         if (assoc) {
 196                 union wpa_event_data data;
 197                 os_memset(&data, 0, sizeof(data));
 198                 wpa_s->mlme.prev_bssid_set = 1;
 199                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 200                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 201                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 202                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 203                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 204                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 205         } else {
 206                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 207         }
 208         os_get_time(&wpa_s->mlme.last_probe);
 209 }
 210
 211
 212 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 213                             size_t len)
 214 {
 215         return wpa_drv_send_mlme(wpa_s, buf, len);
 216 }
 217
 218
 219 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 220                                 int transaction, u8 *extra, size_t extra_len,
 221                                 int encrypt)
 222 {
 223         u8 *buf;
 224         size_t len;
 225         struct ieee80211_mgmt *mgmt;
 226
 227         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 228         if (buf == NULL) {
 229                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 230                            "auth frame");
 231                 return;
 232         }
 233
 234         mgmt = (struct ieee80211_mgmt *) buf;
 235         len = 24 + 6;
 236         os_memset(mgmt, 0, 24 + 6);
 237         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 238                                            WLAN_FC_STYPE_AUTH);
 239         if (encrypt)
 240                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 241         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 242         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 243         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 244         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 245         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 246         wpa_s->mlme.auth_transaction = transaction + 1;
 247         mgmt->u.auth.status_code = host_to_le16(0);
 248         if (extra) {
 249                 os_memcpy(buf + len, extra, extra_len);
 250                 len += extra_len;
 251         }
 252
 253         ieee80211_sta_tx(wpa_s, buf, len);
 254         os_free(buf);
 255 }
 256
 257
 258 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 259 {
 260         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 261         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 262                                ieee80211_sta_timer, wpa_s, NULL);
 263 }
 264
 265
 266 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 267 {
 268         u8 *extra;
 269         size_t extra_len;
 270
 271         wpa_s->mlme.auth_tries++;
 272         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 273                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 274                            " timed out", MAC2STR(wpa_s->bssid));
 275                 return;
 276         }
 277
 278         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 279         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 280                    MAC2STR(wpa_s->bssid));
 281
 282         extra = NULL;
 283         extra_len = 0;
 284
 285 #ifdef CONFIG_IEEE80211R
 286         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 287              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 288             wpa_s->mlme.ft_ies) {
 289                 struct ieee80211_sta_bss *bss;
 290                 struct rsn_mdie *mdie = NULL;
 291                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 292                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 293                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 294                 if (mdie &&
 295                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 296                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 297                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 298                                    "over-the-air");
 299                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 300                         extra = wpa_s->mlme.ft_ies;
 301                         extra_len = wpa_s->mlme.ft_ies_len;
 302                 }
 303         }
 304 #endif /* CONFIG_IEEE80211R */
 305
 306         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 307
 308         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 309 }
 310
 311
 312 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 313 {
 314         struct ieee80211_mgmt *mgmt;
 315         u8 *pos, *ies, *buf;
 316         int i, len;
 317         u16 capab;
 318         struct ieee80211_sta_bss *bss;
 319         int wmm = 0;
 320         size_t blen, buflen;
 321
 322         if (wpa_s->mlme.curr_rates == NULL) {
 323                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 324                 return;
 325         }
 326
 327         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 328                 wpa_s->mlme.ssid_len;
 329 #ifdef CONFIG_IEEE80211R
 330         if (wpa_s->mlme.ft_ies)
 331                 buflen += wpa_s->mlme.ft_ies_len;
 332 #endif /* CONFIG_IEEE80211R */
 333         buf = os_malloc(buflen);
 334         if (buf == NULL) {
 335                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 336                            "assoc frame");
 337                 return;
 338         }
 339         blen = 0;
 340
 341         capab = wpa_s->mlme.capab;
 342         if (wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211G) {
 343                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 344                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 345         }
 346         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 347         if (bss) {
 348                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 349                         capab |= WLAN_CAPABILITY_PRIVACY;
 350                 if (bss->wmm_ie) {
 351                         wmm = 1;
 352                 }
 353         }
 354
 355         mgmt = (struct ieee80211_mgmt *) buf;
 356         blen += 24;
 357         os_memset(mgmt, 0, 24);
 358         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 359         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 360         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 361
 362         if (wpa_s->mlme.prev_bssid_set) {
 363                 blen += 10;
 364                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 365                                                    WLAN_FC_STYPE_REASSOC_REQ);
 366                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 367                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 368                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 369                           wpa_s->mlme.prev_bssid,
 370                           ETH_ALEN);
 371         } else {
 372                 blen += 4;
 373                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 374                                                    WLAN_FC_STYPE_ASSOC_REQ);
 375                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 376                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 377         }
 378
 379         /* SSID */
 380         ies = pos = buf + blen;
 381         blen += 2 + wpa_s->mlme.ssid_len;
 382         *pos++ = WLAN_EID_SSID;
 383         *pos++ = wpa_s->mlme.ssid_len;
 384         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 385
 386         len = wpa_s->mlme.num_curr_rates;
 387         if (len > 8)
 388                 len = 8;
 389         pos = buf + blen;
 390         blen += len + 2;
 391         *pos++ = WLAN_EID_SUPP_RATES;
 392         *pos++ = len;
 393         for (i = 0; i < len; i++) {
 394                 int rate = wpa_s->mlme.curr_rates[i].rate;
 395                 *pos++ = (u8) (rate / 5);
 396         }
 397
 398         if (wpa_s->mlme.num_curr_rates > len) {
 399                 pos = buf + blen;
 400                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 401                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 402                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 403                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
 404                         int rate = wpa_s->mlme.curr_rates[i].rate;
 405                         *pos++ = (u8) (rate / 5);
 406                 }
 407         }
 408
 409         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 410                 pos = buf + blen;
 411                 blen += wpa_s->mlme.extra_ie_len;
 412                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 413         }
 414
 415 #ifdef CONFIG_IEEE80211R
 416         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 417              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 418             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 419             bss && bss->mdie &&
 420             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 421             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 422                 pos = buf + blen;
 423                 blen += 2 + sizeof(struct rsn_mdie);
 424                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 425                 *pos++ = sizeof(struct rsn_mdie);
 426                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 427                 pos += MOBILITY_DOMAIN_ID_LEN;
 428                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 429         }
 430
 431         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 432              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 433             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 434                 pos = buf + blen;
 435                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 436                 pos += wpa_s->mlme.ft_ies_len;
 437                 blen += wpa_s->mlme.ft_ies_len;
 438         }
 439 #endif /* CONFIG_IEEE80211R */
 440
 441         if (wmm && wpa_s->mlme.wmm_enabled) {
 442                 pos = buf + blen;
 443                 blen += 9;
 444                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 445                 *pos++ = 7; /* len */
 446                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 447                 *pos++ = 0x50;
 448                 *pos++ = 0xf2;
 449                 *pos++ = 2; /* WMM */
 450                 *pos++ = 0; /* WMM info */
 451                 *pos++ = 1; /* WMM ver */
 452                 *pos++ = 0;
 453         }
 454
 455         os_free(wpa_s->mlme.assocreq_ies);
 456         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 457         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 458         if (wpa_s->mlme.assocreq_ies) {
 459                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 460                           wpa_s->mlme.assocreq_ies_len);
 461         }
 462
 463         ieee80211_sta_tx(wpa_s, buf, blen);
 464         os_free(buf);
 465 }
 466
 467
 468 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 469 {
 470         u8 *buf;
 471         size_t len;
 472         struct ieee80211_mgmt *mgmt;
 473
 474         buf = os_zalloc(sizeof(*mgmt));
 475         if (buf == NULL) {
 476                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 477                            "deauth frame");
 478                 return;
 479         }
 480
 481         mgmt = (struct ieee80211_mgmt *) buf;
 482         len = 24;
 483         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 484         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 485         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 486         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 487                                            WLAN_FC_STYPE_DEAUTH);
 488         len += 2;
 489         mgmt->u.deauth.reason_code = host_to_le16(reason);
 490
 491         ieee80211_sta_tx(wpa_s, buf, len);
 492         os_free(buf);
 493 }
 494
 495
 496 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 497 {
 498         u8 *buf;
 499         size_t len;
 500         struct ieee80211_mgmt *mgmt;
 501
 502         buf = os_zalloc(sizeof(*mgmt));
 503         if (buf == NULL) {
 504                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 505                            "disassoc frame");
 506                 return;
 507         }
 508
 509         mgmt = (struct ieee80211_mgmt *) buf;
 510         len = 24;
 511         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 512         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 513         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 514         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 515                                            WLAN_FC_STYPE_DISASSOC);
 516         len += 2;
 517         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 518
 519         ieee80211_sta_tx(wpa_s, buf, len);
 520         os_free(buf);
 521 }
 522
 523
 524 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 525 {
 526         struct ieee80211_sta_bss *bss;
 527         int res = 0;
 528
 529         if (wpa_s->mlme.mixed_cell ||
 530             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 531                 return 0;
 532
 533         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 534         if (bss == NULL)
 535                 return 0;
 536
 537         if (ieee80211_sta_wep_configured(wpa_s) !=
 538             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 539                 res = 1;
 540
 541         return res;
 542 }
 543
 544
 545 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 546 {
 547         wpa_s->mlme.assoc_tries++;
 548         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 549                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 550                            " timed out", MAC2STR(wpa_s->bssid));
 551                 return;
 552         }
 553
 554         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 555         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 556                    MAC2STR(wpa_s->bssid));
 557         if (ieee80211_privacy_mismatch(wpa_s)) {
 558                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 559                            "configuration and mixed-cell disabled - abort "
 560                            "association");
 561                 return;
 562         }
 563
 564         ieee80211_send_assoc(wpa_s);
 565
 566         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 567 }
 568
 569
 570 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 571 {
 572         int disassoc;
 573
 574         /* TODO: start monitoring current AP signal quality and number of
 575          * missed beacons. Scan other channels every now and then and search
 576          * for better APs. */
 577         /* TODO: remove expired BSSes */
 578
 579         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 580
 581 #if 0 /* FIX */
 582         sta = sta_info_get(local, wpa_s->bssid);
 583         if (sta == NULL) {
 584                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 585                            MAC2STR(wpa_s->bssid));
 586                 disassoc = 1;
 587         } else {
 588                 disassoc = 0;
 589                 if (time_after(jiffies,
 590                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 591                         if (wpa_s->mlme.probereq_poll) {
 592                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 593                                            "current AP " MACSTR " - assume "
 594                                            "out of range",
 595                                            MAC2STR(wpa_s->bssid));
 596                                 disassoc = 1;
 597                         } else {
 598                                 ieee80211_send_probe_req(
 599                                         wpa_s->bssid,
 600                                         wpa_s->mlme.scan_ssid,
 601                                         wpa_s->mlme.scan_ssid_len);
 602                                 wpa_s->mlme.probereq_poll = 1;
 603                         }
 604                 } else {
 605                         wpa_s->mlme.probereq_poll = 0;
 606                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 607                                        IEEE80211_PROBE_INTERVAL)) {
 608                                 wpa_s->mlme.last_probe = jiffies;
 609                                 ieee80211_send_probe_req(wpa_s->bssid,
 610                                                          wpa_s->mlme.ssid,
 611                                                          wpa_s->mlme.ssid_len);
 612                         }
 613                 }
 614                 sta_info_release(local, sta);
 615         }
 616 #else
 617         disassoc = 0;
 618 #endif
 619         if (disassoc) {
 620                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 621                 ieee80211_reschedule_timer(wpa_s,
 622                                            IEEE80211_MONITORING_INTERVAL +
 623                                            30000);
 624         } else {
 625                 ieee80211_reschedule_timer(wpa_s,
 626                                            IEEE80211_MONITORING_INTERVAL);
 627         }
 628 }
 629
 630
 631 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 632                                      const u8 *dst,
 633                                      const u8 *ssid, size_t ssid_len)
 634 {
 635         u8 *buf;
 636         size_t len;
 637         struct ieee80211_mgmt *mgmt;
 638         u8 *pos, *supp_rates;
 639         u8 *esupp_rates = NULL;
 640         int i;
 641
 642         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 643         if (buf == NULL) {
 644                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 645                            "probe request");
 646                 return;
 647         }
 648
 649         mgmt = (struct ieee80211_mgmt *) buf;
 650         len = 24;
 651         os_memset(mgmt, 0, 24);
 652         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 653                                            WLAN_FC_STYPE_PROBE_REQ);
 654         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 655         if (dst) {
 656                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 657                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 658         } else {
 659                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 660                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 661         }
 662         pos = buf + len;
 663         len += 2 + ssid_len;
 664         *pos++ = WLAN_EID_SSID;
 665         *pos++ = ssid_len;
 666         os_memcpy(pos, ssid, ssid_len);
 667
 668         supp_rates = buf + len;
 669         len += 2;
 670         supp_rates[0] = WLAN_EID_SUPP_RATES;
 671         supp_rates[1] = 0;
 672         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 673                 struct hostapd_rate_data *rate = &wpa_s->mlme.curr_rates[i];
 674                 if (esupp_rates) {
 675                         pos = buf + len;
 676                         len++;
 677                         esupp_rates[1]++;
 678                 } else if (supp_rates[1] == 8) {
 679                         esupp_rates = pos;
 680                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 681                         esupp_rates[1] = 1;
 682                         pos = &esupp_rates[2];
 683                         len += 3;
 684                 } else {
 685                         pos = buf + len;
 686                         len++;
 687                         supp_rates[1]++;
 688                 }
 689                 *pos++ = rate->rate / 5;
 690         }
 691
 692         if (wpa_s->mlme.extra_probe_ie) {
 693                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 694                           wpa_s->mlme.extra_probe_ie_len);
 695                 len += wpa_s->mlme.extra_probe_ie_len;
 696         }
 697
 698         ieee80211_sta_tx(wpa_s, buf, len);
 699         os_free(buf);
 700 }
 701
 702
 703 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 704 {
 705 #if 0 /* FIX */
 706         if (sdata == NULL || sdata->default_key == NULL ||
 707             sdata->default_key->alg != ALG_WEP)
 708                 return 0;
 709         return 1;
 710 #else
 711         return 0;
 712 #endif
 713 }
 714
 715
 716 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 717 {
 718         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 719         wpa_s->mlme.authenticated = 1;
 720         ieee80211_associate(wpa_s);
 721 }
 722
 723
 724 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 725                                      struct ieee80211_mgmt *mgmt,
 726                                      size_t len,
 727                                      struct ieee80211_rx_status *rx_status)
 728 {
 729         u8 *pos;
 730         struct ieee802_11_elems elems;
 731
 732         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 733         pos = mgmt->u.auth.variable;
 734         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
 735             == ParseFailed) {
 736                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 737                 return;
 738         }
 739         if (elems.challenge == NULL) {
 740                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 741                            "auth frame");
 742                 return;
 743         }
 744         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 745                             elems.challenge_len + 2, 1);
 746 }
 747
 748
 749 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 750                                    struct ieee80211_mgmt *mgmt,
 751                                    size_t len,
 752                                    struct ieee80211_rx_status *rx_status)
 753 {
 754         struct wpa_ssid *ssid = wpa_s->current_ssid;
 755         u16 auth_alg, auth_transaction, status_code;
 756         int adhoc;
 757
 758         adhoc = ssid && ssid->mode == 1;
 759
 760         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 761                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 762                            "from " MACSTR ", but not in authenticate state - "
 763                            "ignored", MAC2STR(mgmt->sa));
 764                 return;
 765         }
 766
 767         if (len < 24 + 6) {
 768                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 769                            "frame received from " MACSTR " - ignored",
 770                            (unsigned long) len, MAC2STR(mgmt->sa));
 771                 return;
 772         }
 773
 774         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 775                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 776                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 777                            ") - ignored",
 778                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 779                 return;
 780         }
 781
 782         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 783                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 784                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 785                            ") - ignored",
 786                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 787                 return;
 788         }
 789
 790         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 791         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 792         status_code = le_to_host16(mgmt->u.auth.status_code);
 793
 794         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 795                    " (alg=%d transaction=%d status=%d)",
 796                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 797
 798         if (adhoc) {
 799                 /* IEEE 802.11 standard does not require authentication in IBSS
 800                  * networks and most implementations do not seem to use it.
 801                  * However, try to reply to authentication attempts if someone
 802                  * has actually implemented this.
 803                  * TODO: Could implement shared key authentication. */
 804                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 805                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 806                                    "authentication frame (alg=%d "
 807                                    "transaction=%d)",
 808                                    auth_alg, auth_transaction);
 809                         return;
 810                 }
 811                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 812         }
 813
 814         if (auth_alg != wpa_s->mlme.auth_alg ||
 815             auth_transaction != wpa_s->mlme.auth_transaction) {
 816                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 817                            "(alg=%d transaction=%d)",
 818                            auth_alg, auth_transaction);
 819                 return;
 820         }
 821
 822         if (status_code != WLAN_STATUS_SUCCESS) {
 823                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 824                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
 825                            status_code);
 826                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 827                         const int num_algs = 3;
 828                         u8 algs[num_algs];
 829                         int i, pos;
 830                         algs[0] = algs[1] = algs[2] = 0xff;
 831                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
 832                                 algs[0] = WLAN_AUTH_OPEN;
 833                         if (wpa_s->mlme.auth_algs &
 834                             IEEE80211_AUTH_ALG_SHARED_KEY)
 835                                 algs[1] = WLAN_AUTH_SHARED_KEY;
 836                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
 837                                 algs[2] = WLAN_AUTH_LEAP;
 838                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
 839                                 pos = 0;
 840                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
 841                                 pos = 1;
 842                         else
 843                                 pos = 2;
 844                         for (i = 0; i < num_algs; i++) {
 845                                 pos++;
 846                                 if (pos >= num_algs)
 847                                         pos = 0;
 848                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
 849                                     algs[pos] == 0xff)
 850                                         continue;
 851                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
 852                                     !ieee80211_sta_wep_configured(wpa_s))
 853                                         continue;
 854                                 wpa_s->mlme.auth_alg = algs[pos];
 855                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
 856                                            "for next try",
 857                                            wpa_s->mlme.auth_alg);
 858                                 break;
 859                         }
 860                 }
 861                 return;
 862         }
 863
 864         switch (wpa_s->mlme.auth_alg) {
 865         case WLAN_AUTH_OPEN:
 866         case WLAN_AUTH_LEAP:
 867                 ieee80211_auth_completed(wpa_s);
 868                 break;
 869         case WLAN_AUTH_SHARED_KEY:
 870                 if (wpa_s->mlme.auth_transaction == 4)
 871                         ieee80211_auth_completed(wpa_s);
 872                 else
 873                         ieee80211_auth_challenge(wpa_s, mgmt, len,
 874                                                  rx_status);
 875                 break;
 876 #ifdef CONFIG_IEEE80211R
 877         case WLAN_AUTH_FT:
 878         {
 879                 union wpa_event_data data;
 880                 struct wpabuf *ric = NULL;
 881                 os_memset(&data, 0, sizeof(data));
 882                 data.ft_ies.ies = mgmt->u.auth.variable;
 883                 data.ft_ies.ies_len = len -
 884                         (mgmt->u.auth.variable - (u8 *) mgmt);
 885                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
 886                 if (os_strcmp(wpa_s->driver->name, "test") == 0 &&
 887                     wpa_s->mlme.wmm_enabled) {
 888                         ric = wpabuf_alloc(200);
 889                         if (ric) {
 890                                 /* Build simple RIC-Request: RDIE | TSPEC */
 891
 892                                 /* RIC Data (RDIE) */
 893                                 wpabuf_put_u8(ric, WLAN_EID_RIC_DATA);
 894                                 wpabuf_put_u8(ric, 4);
 895                                 wpabuf_put_u8(ric, 0); /* RDIE Identifier */
 896                                 wpabuf_put_u8(ric, 1); /* Resource Descriptor
 897                                                         * Count */
 898                                 wpabuf_put_le16(ric, 0); /* Status Code */
 899
 900                                 /* WMM TSPEC */
 901                                 ieee80211_build_tspec(ric);
 902
 903                                 data.ft_ies.ric_ies = wpabuf_head(ric);
 904                                 data.ft_ies.ric_ies_len = wpabuf_len(ric);
 905                         }
 906                 }
 907
 908                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
 909                 wpabuf_free(ric);
 910                 ieee80211_auth_completed(wpa_s);
 911                 break;
 912         }
 913 #endif /* CONFIG_IEEE80211R */
 914         }
 915 }
 916
 917
 918 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
 919                                      struct ieee80211_mgmt *mgmt,
 920                                      size_t len,
 921                                      struct ieee80211_rx_status *rx_status)
 922 {
 923         u16 reason_code;
 924
 925         if (len < 24 + 2) {
 926                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
 927                            "frame received from " MACSTR " - ignored",
 928                            (unsigned long) len, MAC2STR(mgmt->sa));
 929                 return;
 930         }
 931
 932         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 933                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
 934                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 935                            ") - ignored",
 936                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 937                 return;
 938         }
 939
 940         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
 941
 942         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
 943                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 944
 945         if (wpa_s->mlme.authenticated)
 946                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
 947
 948         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
 949             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
 950             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 951                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 952                 ieee80211_reschedule_timer(wpa_s,
 953                                            IEEE80211_RETRY_AUTH_INTERVAL);
 954         }
 955
 956         ieee80211_set_associated(wpa_s, 0);
 957         wpa_s->mlme.authenticated = 0;
 958 }
 959
 960
 961 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
 962                                        struct ieee80211_mgmt *mgmt,
 963                                        size_t len,
 964                                        struct ieee80211_rx_status *rx_status)
 965 {
 966         u16 reason_code;
 967
 968         if (len < 24 + 2) {
 969                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
 970                            "frame received from " MACSTR " - ignored",
 971                            (unsigned long) len, MAC2STR(mgmt->sa));
 972                 return;
 973         }
 974
 975         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 976                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
 977                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 978                            ") - ignored",
 979                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 980                 return;
 981         }
 982
 983         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
 984
 985         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
 986                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 987
 988         if (wpa_s->mlme.associated)
 989                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
 990
 991         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 992                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 993                 ieee80211_reschedule_timer(wpa_s,
 994                                            IEEE80211_RETRY_AUTH_INTERVAL);
 995         }
 996
 997         ieee80211_set_associated(wpa_s, 0);
 998 }
 999
1000
1001 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1002                                    struct ieee802_11_elems *elems)
1003 {
1004 #ifdef CONFIG_IEEE80211R
1005         const u8 *mobility_domain = NULL;
1006         const u8 *r0kh_id = NULL;
1007         size_t r0kh_id_len = 0;
1008         const u8 *r1kh_id = NULL;
1009         struct rsn_ftie *hdr;
1010         const u8 *pos, *end;
1011
1012         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1013                 mobility_domain = elems->mdie;
1014         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1015                 end = elems->ftie + elems->ftie_len;
1016                 hdr = (struct rsn_ftie *) elems->ftie;
1017                 pos = (const u8 *) (hdr + 1);
1018                 while (pos + 1 < end) {
1019                         if (pos + 2 + pos[1] > end)
1020                                 break;
1021                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1022                             pos[1] == FT_R1KH_ID_LEN)
1023                                 r1kh_id = pos + 2;
1024                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1025                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1026                                 r0kh_id = pos + 2;
1027                                 r0kh_id_len = pos[1];
1028                         }
1029                         pos += 2 + pos[1];
1030                 }
1031         }
1032         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1033                                     r0kh_id_len, r1kh_id);
1034 #else /* CONFIG_IEEE80211R */
1035         return 0;
1036 #endif /* CONFIG_IEEE80211R */
1037 }
1038
1039
1040 static void ieee80211_build_tspec(struct wpabuf *buf)
1041 {
1042         struct wmm_tspec_element *tspec;
1043         int tid, up;
1044
1045         tspec = wpabuf_put(buf, sizeof(*tspec));
1046         tspec->eid = WLAN_EID_VENDOR_SPECIFIC;
1047         tspec->length = sizeof(*tspec) - 2;
1048         tspec->oui[0] = 0x00;
1049         tspec->oui[1] = 0x50;
1050         tspec->oui[2] = 0xf2;
1051         tspec->oui_type = 2;
1052         tspec->oui_subtype = 2;
1053         tspec->version = 1;
1054
1055         tid = 1;
1056         up = 6; /* Voice */
1057         tspec->ts_info[0] = (tid << 1) |
1058                 (WMM_TSPEC_DIRECTION_BI_DIRECTIONAL << 5) |
1059                 BIT(7);
1060         tspec->ts_info[1] = up << 3;
1061         tspec->nominal_msdu_size = host_to_le16(1530);
1062         tspec->mean_data_rate = host_to_le32(128000); /* bits per second */
1063         tspec->minimum_phy_rate = host_to_le32(6000000);
1064         tspec->surplus_bandwidth_allowance = host_to_le16(0x3000); /* 150% */
1065 }
1066
1067
1068 static void ieee80211_tx_addts(struct wpa_supplicant *wpa_s)
1069 {
1070         struct wpabuf *buf;
1071         struct ieee80211_mgmt *mgmt;
1072         size_t alen;
1073
1074         wpa_printf(MSG_DEBUG, "MLME: Send ADDTS Request for Voice TSPEC");
1075         mgmt = NULL;
1076         alen = mgmt->u.action.u.wmm_action.variable - (u8 *) mgmt;
1077
1078         buf = wpabuf_alloc(alen + sizeof(struct wmm_tspec_element));
1079         if (buf == NULL)
1080                 return;
1081
1082         mgmt = wpabuf_put(buf, alen);
1083         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
1084         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1085         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1086         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1087                                            WLAN_FC_STYPE_ACTION);
1088         mgmt->u.action.category = WLAN_ACTION_WMM;
1089         mgmt->u.action.u.wmm_action.action_code = WMM_ACTION_CODE_ADDTS_REQ;
1090         mgmt->u.action.u.wmm_action.dialog_token = 1;
1091         mgmt->u.action.u.wmm_action.status_code = 0;
1092
1093         ieee80211_build_tspec(buf);
1094
1095         ieee80211_sta_tx(wpa_s, wpabuf_head(buf), wpabuf_len(buf));
1096         wpabuf_free(buf);
1097 }
1098
1099
1100 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1101                                          struct ieee80211_mgmt *mgmt,
1102                                          size_t len,
1103                                          struct ieee80211_rx_status *rx_status,
1104                                          int reassoc)
1105 {
1106         u8 rates[32];
1107         size_t rates_len;
1108         u16 capab_info, status_code, aid;
1109         struct ieee802_11_elems elems;
1110         u8 *pos;
1111
1112         /* AssocResp and ReassocResp have identical structure, so process both
1113          * of them in this function. */
1114
1115         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1116                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1117                            MACSTR ", but not in associate state - ignored",
1118                            MAC2STR(mgmt->sa));
1119                 return;
1120         }
1121
1122         if (len < 24 + 6) {
1123                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1124                            "frame received from " MACSTR " - ignored",
1125                            (unsigned long) len, MAC2STR(mgmt->sa));
1126                 return;
1127         }
1128
1129         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1130                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1131                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1132                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1133                 return;
1134         }
1135
1136         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1137         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1138         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1139         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1140                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1141                            "not set", aid);
1142         aid &= ~(BIT(15) | BIT(14));
1143
1144         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1145                    " (capab=0x%x status=%d aid=%d)",
1146                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1147                    capab_info, status_code, aid);
1148
1149         pos = mgmt->u.assoc_resp.variable;
1150         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
1151             == ParseFailed) {
1152                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1153                 return;
1154         }
1155
1156         if (status_code != WLAN_STATUS_SUCCESS) {
1157                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1158                            status_code);
1159 #ifdef CONFIG_IEEE80211W
1160                 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1161                     elems.timeout_int && elems.timeout_int_len == 5 &&
1162                     elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
1163                         u32 tu, ms;
1164                         tu = WPA_GET_LE32(elems.timeout_int + 1);
1165                         ms = tu * 1024 / 1000;
1166                         wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1167                                    "temporarily; comeback duration %u TU "
1168                                    "(%u ms)", tu, ms);
1169                         if (ms > IEEE80211_ASSOC_TIMEOUT) {
1170                                 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1171                                            "based on comeback duration");
1172                                 ieee80211_reschedule_timer(wpa_s, ms);
1173                         }
1174                 }
1175 #endif /* CONFIG_IEEE80211W */
1176                 return;
1177         }
1178
1179         if (elems.supp_rates == NULL) {
1180                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1181                            "AssocResp");
1182                 return;
1183         }
1184
1185         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1186                 if (!reassoc) {
1187                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1188                                    "association, not reassociation, response "
1189                                    "with FT");
1190                         return;
1191                 }
1192                 if (wpa_ft_validate_reassoc_resp(
1193                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1194                             mgmt->sa) < 0) {
1195                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1196                                    "Resp failed");
1197                         return;
1198                 }
1199         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1200                 return;
1201
1202         wpa_printf(MSG_DEBUG, "MLME: associated");
1203         wpa_s->mlme.aid = aid;
1204         wpa_s->mlme.ap_capab = capab_info;
1205
1206         os_free(wpa_s->mlme.assocresp_ies);
1207         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1208         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1209         if (wpa_s->mlme.assocresp_ies) {
1210                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1211                           wpa_s->mlme.assocresp_ies_len);
1212         }
1213
1214         ieee80211_set_associated(wpa_s, 1);
1215
1216         rates_len = elems.supp_rates_len;
1217         if (rates_len > sizeof(rates))
1218                 rates_len = sizeof(rates);
1219         os_memcpy(rates, elems.supp_rates, rates_len);
1220         if (elems.ext_supp_rates) {
1221                 size_t _len = elems.ext_supp_rates_len;
1222                 if (_len > sizeof(rates) - rates_len)
1223                         _len = sizeof(rates) - rates_len;
1224                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1225                 rates_len += _len;
1226         }
1227
1228         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1229                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1230                            "netstack");
1231         }
1232         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1233             0) {
1234                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1235                            "netstack");
1236         }
1237
1238         /* Remove STA entry before adding a new one just in case to avoid
1239          * problems with existing configuration (e.g., keys). */
1240         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1241         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1242                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1243                            "netstack");
1244         }
1245
1246         if (elems.wmm && wpa_s->mlme.wmm_enabled)
1247                 ieee80211_sta_wmm_params(wpa_s, elems.wmm, elems.wmm_len);
1248
1249         ieee80211_associated(wpa_s);
1250
1251         if (wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
1252             os_strcmp(wpa_s->driver->name, "test") == 0 &&
1253             elems.wmm && wpa_s->mlme.wmm_enabled) {
1254                 /* Test WMM-AC - send ADDTS for WMM TSPEC */
1255                 ieee80211_tx_addts(wpa_s);
1256         }
1257 }
1258
1259
1260 /* Caller must hold local->sta_bss_lock */
1261 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1262                                      struct ieee80211_sta_bss *bss)
1263 {
1264         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1265         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1266 }
1267
1268
1269 /* Caller must hold local->sta_bss_lock */
1270 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1271                                      struct ieee80211_sta_bss *bss)
1272 {
1273         struct ieee80211_sta_bss *b, *prev = NULL;
1274         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1275         while (b) {
1276                 if (b == bss) {
1277                         if (prev == NULL) {
1278                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1279                                         = bss->hnext;
1280                         } else {
1281                                 prev->hnext = bss->hnext;
1282                         }
1283                         break;
1284                 }
1285                 prev = b;
1286                 b = b->hnext;
1287         }
1288 }
1289
1290
1291 static struct ieee80211_sta_bss *
1292 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1293 {
1294         struct ieee80211_sta_bss *bss;
1295
1296         bss = os_zalloc(sizeof(*bss));
1297         if (bss == NULL)
1298                 return NULL;
1299         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1300
1301         /* TODO: order by RSSI? */
1302         bss->next = wpa_s->mlme.sta_bss_list;
1303         wpa_s->mlme.sta_bss_list = bss;
1304         __ieee80211_bss_hash_add(wpa_s, bss);
1305         return bss;
1306 }
1307
1308
1309 static struct ieee80211_sta_bss *
1310 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1311 {
1312         struct ieee80211_sta_bss *bss;
1313
1314         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1315         while (bss) {
1316                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1317                         break;
1318                 bss = bss->hnext;
1319         }
1320         return bss;
1321 }
1322
1323
1324 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1325                                struct ieee80211_sta_bss *bss)
1326 {
1327         __ieee80211_bss_hash_del(wpa_s, bss);
1328         os_free(bss->ie);
1329         os_free(bss->wpa_ie);
1330         os_free(bss->rsn_ie);
1331         os_free(bss->wmm_ie);
1332         os_free(bss->mdie);
1333         os_free(bss);
1334 }
1335
1336
1337 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1338 {
1339         struct ieee80211_sta_bss *bss, *prev;
1340
1341         bss = wpa_s->mlme.sta_bss_list;
1342         wpa_s->mlme.sta_bss_list = NULL;
1343         while (bss) {
1344                 prev = bss;
1345                 bss = bss->next;
1346                 ieee80211_bss_free(wpa_s, prev);
1347         }
1348 }
1349
1350
1351 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1352                                struct ieee80211_mgmt *mgmt,
1353                                size_t len,
1354                                struct ieee80211_rx_status *rx_status,
1355                                int beacon)
1356 {
1357         struct ieee802_11_elems elems;
1358         size_t baselen;
1359         int channel, invalid = 0, clen;
1360         struct ieee80211_sta_bss *bss;
1361         u64 timestamp;
1362         u8 *pos, *ie_pos;
1363         size_t ie_len;
1364
1365         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1366                 return; /* ignore ProbeResp to foreign address */
1367
1368 #if 0
1369         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1370                    beacon ? "Beacon" : "Probe Response",
1371                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1372 #endif
1373
1374         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1375         if (baselen > len)
1376                 return;
1377
1378         pos = mgmt->u.beacon.timestamp;
1379         timestamp = WPA_GET_LE64(pos);
1380
1381 #if 0 /* FIX */
1382         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1383             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1384 #ifdef IEEE80211_IBSS_DEBUG
1385                 static unsigned long last_tsf_debug = 0;
1386                 u64 tsf;
1387                 if (local->hw->get_tsf)
1388                         tsf = local->hw->get_tsf(local->mdev);
1389                 else
1390                         tsf = -1LLU;
1391                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1392                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1393                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1394                                    "@%ld",
1395                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1396                                    tsf, timestamp, tsf - timestamp, jiffies);
1397                         last_tsf_debug = jiffies;
1398                 }
1399 #endif /* IEEE80211_IBSS_DEBUG */
1400         }
1401 #endif
1402
1403         ie_pos = mgmt->u.beacon.variable;
1404         ie_len = len - baselen;
1405         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems, 0) == ParseFailed)
1406                 invalid = 1;
1407
1408 #if 0 /* FIX */
1409         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1410             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1411             (sta = sta_info_get(local, mgmt->sa))) {
1412                 struct ieee80211_rate *rates;
1413                 size_t num_rates;
1414                 u32 supp_rates, prev_rates;
1415                 int i, j, oper_mode;
1416
1417                 rates = local->curr_rates;
1418                 num_rates = local->num_curr_rates;
1419                 oper_mode = wpa_s->mlme.sta_scanning ?
1420                         local->scan_oper_phymode : local->conf.phymode;
1421                 for (i = 0; i < local->hw->num_modes; i++) {
1422                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1423                         if (oper_mode == mode->mode) {
1424                                 rates = mode->rates;
1425                                 num_rates = mode->num_rates;
1426                                 break;
1427                         }
1428                 }
1429
1430                 supp_rates = 0;
1431                 for (i = 0; i < elems.supp_rates_len +
1432                              elems.ext_supp_rates_len; i++) {
1433                         u8 rate = 0;
1434                         int own_rate;
1435                         if (i < elems.supp_rates_len)
1436                                 rate = elems.supp_rates[i];
1437                         else if (elems.ext_supp_rates)
1438                                 rate = elems.ext_supp_rates
1439                                         [i - elems.supp_rates_len];
1440                         own_rate = 5 * (rate & 0x7f);
1441                         if (oper_mode == MODE_ATHEROS_TURBO)
1442                                 own_rate *= 2;
1443                         for (j = 0; j < num_rates; j++)
1444                                 if (rates[j].rate == own_rate)
1445                                         supp_rates |= BIT(j);
1446                 }
1447
1448                 prev_rates = sta->supp_rates;
1449                 sta->supp_rates &= supp_rates;
1450                 if (sta->supp_rates == 0) {
1451                         /* No matching rates - this should not really happen.
1452                          * Make sure that at least one rate is marked
1453                          * supported to avoid issues with TX rate ctrl. */
1454                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1455                 }
1456                 if (sta->supp_rates != prev_rates) {
1457                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1458                                    "for " MACSTR " based on beacon info "
1459                                    "(0x%x & 0x%x -> 0x%x)",
1460                                    MAC2STR(sta->addr), prev_rates,
1461                                    supp_rates, sta->supp_rates);
1462                 }
1463                 sta_info_release(local, sta);
1464         }
1465 #endif
1466
1467         if (elems.ssid == NULL)
1468                 return;
1469
1470         if (elems.ds_params && elems.ds_params_len == 1)
1471                 channel = elems.ds_params[0];
1472         else
1473                 channel = rx_status->channel;
1474
1475         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1476         if (bss == NULL) {
1477                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1478                 if (bss == NULL)
1479                         return;
1480         } else {
1481 #if 0
1482                 /* TODO: order by RSSI? */
1483                 spin_lock_bh(&local->sta_bss_lock);
1484                 list_move_tail(&bss->list, &local->sta_bss_list);
1485                 spin_unlock_bh(&local->sta_bss_lock);
1486 #endif
1487         }
1488
1489         if (bss->probe_resp && beacon) {
1490                 /* Do not allow beacon to override data from Probe Response. */
1491                 return;
1492         }
1493
1494         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1495         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1496
1497         if (bss->ie == NULL || bss->ie_len < ie_len) {
1498                 os_free(bss->ie);
1499                 bss->ie = os_malloc(ie_len);
1500         }
1501         if (bss->ie) {
1502                 os_memcpy(bss->ie, ie_pos, ie_len);
1503                 bss->ie_len = ie_len;
1504         }
1505
1506         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1507                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1508                 bss->ssid_len = elems.ssid_len;
1509         }
1510
1511         bss->supp_rates_len = 0;
1512         if (elems.supp_rates) {
1513                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1514                 if (clen > elems.supp_rates_len)
1515                         clen = elems.supp_rates_len;
1516                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1517                           elems.supp_rates, clen);
1518                 bss->supp_rates_len += clen;
1519         }
1520         if (elems.ext_supp_rates) {
1521                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1522                 if (clen > elems.ext_supp_rates_len)
1523                         clen = elems.ext_supp_rates_len;
1524                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1525                           elems.ext_supp_rates, clen);
1526                 bss->supp_rates_len += clen;
1527         }
1528
1529         if (elems.wpa_ie &&
1530             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_ie_len ||
1531              os_memcmp(bss->wpa_ie, elems.wpa_ie, elems.wpa_ie_len))) {
1532                 os_free(bss->wpa_ie);
1533                 bss->wpa_ie = os_malloc(elems.wpa_ie_len + 2);
1534                 if (bss->wpa_ie) {
1535                         os_memcpy(bss->wpa_ie, elems.wpa_ie - 2,
1536                                   elems.wpa_ie_len + 2);
1537                         bss->wpa_ie_len = elems.wpa_ie_len + 2;
1538                 } else
1539                         bss->wpa_ie_len = 0;
1540         } else if (!elems.wpa_ie && bss->wpa_ie) {
1541                 os_free(bss->wpa_ie);
1542                 bss->wpa_ie = NULL;
1543                 bss->wpa_ie_len = 0;
1544         }
1545
1546         if (elems.rsn_ie &&
1547             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_ie_len ||
1548              os_memcmp(bss->rsn_ie, elems.rsn_ie, elems.rsn_ie_len))) {
1549                 os_free(bss->rsn_ie);
1550                 bss->rsn_ie = os_malloc(elems.rsn_ie_len + 2);
1551                 if (bss->rsn_ie) {
1552                         os_memcpy(bss->rsn_ie, elems.rsn_ie - 2,
1553                                   elems.rsn_ie_len + 2);
1554                         bss->rsn_ie_len = elems.rsn_ie_len + 2;
1555                 } else
1556                         bss->rsn_ie_len = 0;
1557         } else if (!elems.rsn_ie && bss->rsn_ie) {
1558                 os_free(bss->rsn_ie);
1559                 bss->rsn_ie = NULL;
1560                 bss->rsn_ie_len = 0;
1561         }
1562
1563         if (elems.wmm &&
1564             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_len ||
1565              os_memcmp(bss->wmm_ie, elems.wmm, elems.wmm_len))) {
1566                 os_free(bss->wmm_ie);
1567                 bss->wmm_ie = os_malloc(elems.wmm_len + 2);
1568                 if (bss->wmm_ie) {
1569                         os_memcpy(bss->wmm_ie, elems.wmm - 2,
1570                                   elems.wmm_len + 2);
1571                         bss->wmm_ie_len = elems.wmm_len + 2;
1572                 } else
1573                         bss->wmm_ie_len = 0;
1574         } else if (!elems.wmm && bss->wmm_ie) {
1575                 os_free(bss->wmm_ie);
1576                 bss->wmm_ie = NULL;
1577                 bss->wmm_ie_len = 0;
1578         }
1579
1580 #ifdef CONFIG_IEEE80211R
1581         if (elems.mdie &&
1582             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1583              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1584                 os_free(bss->mdie);
1585                 bss->mdie = os_malloc(elems.mdie_len + 2);
1586                 if (bss->mdie) {
1587                         os_memcpy(bss->mdie, elems.mdie - 2,
1588                                   elems.mdie_len + 2);
1589                         bss->mdie_len = elems.mdie_len + 2;
1590                 } else
1591                         bss->mdie_len = 0;
1592         } else if (!elems.mdie && bss->mdie) {
1593                 os_free(bss->mdie);
1594                 bss->mdie = NULL;
1595                 bss->mdie_len = 0;
1596         }
1597 #endif /* CONFIG_IEEE80211R */
1598
1599         bss->hw_mode = wpa_s->mlme.phymode;
1600         bss->channel = channel;
1601         bss->freq = wpa_s->mlme.freq;
1602         if (channel != wpa_s->mlme.channel &&
1603             (wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211G ||
1604              wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211B) &&
1605             channel >= 1 && channel <= 14) {
1606                 static const int freq_list[] = {
1607                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1608                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1609                 };
1610                 /* IEEE 802.11g/b mode can receive packets from neighboring
1611                  * channels, so map the channel into frequency. */
1612                 bss->freq = freq_list[channel - 1];
1613         }
1614         bss->timestamp = timestamp;
1615         os_get_time(&bss->last_update);
1616         bss->rssi = rx_status->ssi;
1617         if (!beacon)
1618                 bss->probe_resp++;
1619 }
1620
1621
1622 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1623                                          struct ieee80211_mgmt *mgmt,
1624                                          size_t len,
1625                                          struct ieee80211_rx_status *rx_status)
1626 {
1627         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1628 }
1629
1630
1631 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1632                                      struct ieee80211_mgmt *mgmt,
1633                                      size_t len,
1634                                      struct ieee80211_rx_status *rx_status)
1635 {
1636         int use_protection;
1637         size_t baselen;
1638         struct ieee802_11_elems elems;
1639
1640         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1641
1642         if (!wpa_s->mlme.associated ||
1643             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1644                 return;
1645
1646         /* Process beacon from the current BSS */
1647         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1648         if (baselen > len)
1649                 return;
1650
1651         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1652                                    &elems, 0) == ParseFailed)
1653                 return;
1654
1655         use_protection = 0;
1656         if (elems.erp_info && elems.erp_info_len >= 1) {
1657                 use_protection =
1658                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1659         }
1660
1661         if (use_protection != !!wpa_s->mlme.use_protection) {
1662                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1663                            ")",
1664                            use_protection ? "enabled" : "disabled",
1665                            MAC2STR(wpa_s->bssid));
1666                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1667                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1668         }
1669
1670         if (elems.wmm && wpa_s->mlme.wmm_enabled) {
1671                 ieee80211_sta_wmm_params(wpa_s, elems.wmm,
1672                                          elems.wmm_len);
1673         }
1674 }
1675
1676
1677 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1678                                         struct ieee80211_mgmt *mgmt,
1679                                         size_t len,
1680                                         struct ieee80211_rx_status *rx_status)
1681 {
1682         int tx_last_beacon, adhoc;
1683 #if 0 /* FIX */
1684         struct ieee80211_mgmt *resp;
1685 #endif
1686         u8 *pos, *end;
1687         struct wpa_ssid *ssid = wpa_s->current_ssid;
1688
1689         adhoc = ssid && ssid->mode == 1;
1690
1691         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1692             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1693                 return;
1694
1695 #if 0 /* FIX */
1696         if (local->hw->tx_last_beacon)
1697                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1698         else
1699 #endif
1700                 tx_last_beacon = 1;
1701
1702 #ifdef IEEE80211_IBSS_DEBUG
1703         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1704                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1705                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1706                    MAC2STR(mgmt->bssid), tx_last_beacon);
1707 #endif /* IEEE80211_IBSS_DEBUG */
1708
1709         if (!tx_last_beacon)
1710                 return;
1711
1712         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1713             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1714                 return;
1715
1716         end = ((u8 *) mgmt) + len;
1717         pos = mgmt->u.probe_req.variable;
1718         if (pos[0] != WLAN_EID_SSID ||
1719             pos + 2 + pos[1] > end) {
1720                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1721                            MACSTR, MAC2STR(mgmt->sa));
1722                 return;
1723         }
1724         if (pos[1] != 0 &&
1725             (pos[1] != wpa_s->mlme.ssid_len ||
1726              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1727         {
1728                 /* Ignore ProbeReq for foreign SSID */
1729                 return;
1730         }
1731
1732 #if 0 /* FIX */
1733         /* Reply with ProbeResp */
1734         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1735         if (skb == NULL)
1736                 return;
1737
1738         resp = (struct ieee80211_mgmt *) skb->data;
1739         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1740 #ifdef IEEE80211_IBSS_DEBUG
1741         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1742                    MAC2STR(resp->da));
1743 #endif /* IEEE80211_IBSS_DEBUG */
1744         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1745 #endif
1746 }
1747
1748
1749 #ifdef CONFIG_IEEE80211R
1750 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1751                                         struct ieee80211_mgmt *mgmt,
1752                                         size_t len,
1753                                         struct ieee80211_rx_status *rx_status)
1754 {
1755         union wpa_event_data data;
1756         u16 status;
1757         u8 *sta_addr, *target_ap_addr;
1758
1759         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1760                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1761                 return;
1762         }
1763
1764         /*
1765          * Only FT Action Response is needed for now since reservation
1766          * protocol is not supported.
1767          */
1768         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1769                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1770                            mgmt->u.action.u.ft_action_resp.action);
1771                 return;
1772         }
1773
1774         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1775         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1776         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1777         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1778                    " TargetAP " MACSTR " Status Code %d",
1779                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1780         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1781                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1782                            " in FT Action Response", MAC2STR(sta_addr));
1783                 return;
1784         }
1785
1786         if (status) {
1787                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1788                            "failure (status code %d)", status);
1789                 /* TODO: report error to FT code(?) */
1790                 return;
1791         }
1792
1793         os_memset(&data, 0, sizeof(data));
1794         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1795         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1796                                      (u8 *) mgmt);
1797         data.ft_ies.ft_action = 1;
1798         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1799         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1800         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1801          * successfully */
1802         wpa_s->mlme.prev_bssid_set = 1;
1803         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1804         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1805         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1806         ieee80211_associate(wpa_s);
1807 }
1808 #endif /* CONFIG_IEEE80211R */
1809
1810
1811 #ifdef CONFIG_IEEE80211W
1812
1813 /* MLME-SAQuery.response */
1814 static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
1815                                             const u8 *addr, const u8 *trans_id)
1816 {
1817         struct ieee80211_mgmt *mgmt;
1818         int res;
1819         size_t len;
1820
1821         mgmt = os_zalloc(sizeof(*mgmt));
1822         if (mgmt == NULL) {
1823                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1824                            "SA Query action frame");
1825                 return -1;
1826         }
1827
1828         len = 24;
1829         os_memcpy(mgmt->da, addr, ETH_ALEN);
1830         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1831         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1832         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1833                                            WLAN_FC_STYPE_ACTION);
1834         mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
1835         mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
1836         os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
1837                   WLAN_SA_QUERY_TR_ID_LEN);
1838         len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
1839
1840         res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1841         os_free(mgmt);
1842
1843         return res;
1844 }
1845
1846
1847 static void ieee80211_rx_mgmt_sa_query_action(
1848         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1849         struct ieee80211_rx_status *rx_status)
1850 {
1851         if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
1852                 wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
1853                 return;
1854         }
1855
1856         if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
1857                 wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
1858                            mgmt->u.action.u.sa_query_req.action);
1859                 return;
1860         }
1861
1862         if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1863                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
1864                            "source " MACSTR, MAC2STR(mgmt->sa));
1865                 return;
1866         }
1867
1868         if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1869                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
1870                            "association process");
1871                 return;
1872         }
1873
1874         wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
1875         ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
1876                                          sa_query_req.trans_id);
1877 }
1878
1879 #endif /* CONFIG_IEEE80211W */
1880
1881
1882 static void dump_tspec(struct wmm_tspec_element *tspec)
1883 {
1884         int up, psb, dir, tid;
1885         u16 val;
1886
1887         up = (tspec->ts_info[1] >> 3) & 0x07;
1888         psb = (tspec->ts_info[1] >> 2) & 0x01;
1889         dir = (tspec->ts_info[0] >> 5) & 0x03;
1890         tid = (tspec->ts_info[0] >> 1) & 0x0f;
1891         wpa_printf(MSG_DEBUG, "WMM: TS Info: UP=%d PSB=%d Direction=%d TID=%d",
1892                    up, psb, dir, tid);
1893         val = le_to_host16(tspec->nominal_msdu_size);
1894         wpa_printf(MSG_DEBUG, "WMM: Nominal MSDU Size: %d%s",
1895                    val & 0x7fff, val & 0x8000 ? " (fixed)" : "");
1896         wpa_printf(MSG_DEBUG, "WMM: Mean Data Rate: %u bps",
1897                    le_to_host32(tspec->mean_data_rate));
1898         wpa_printf(MSG_DEBUG, "WMM: Minimum PHY Rate: %u bps",
1899                    le_to_host32(tspec->minimum_phy_rate));
1900         val = le_to_host16(tspec->surplus_bandwidth_allowance);
1901         wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance: %u.%04u",
1902                    val >> 13, 10000 * (val & 0x1fff) / 0x2000);
1903         val = le_to_host16(tspec->medium_time);
1904         wpa_printf(MSG_DEBUG, "WMM: Medium Time: %u (= %u usec/sec)",
1905                    val, 32 * val);
1906 }
1907
1908
1909 static int is_wmm_tspec(const u8 *ie, size_t len)
1910 {
1911         const struct wmm_tspec_element *tspec;
1912
1913         if (len < sizeof(*tspec))
1914                 return 0;
1915
1916         tspec = (const struct wmm_tspec_element *) ie;
1917         if (tspec->eid != WLAN_EID_VENDOR_SPECIFIC ||
1918             tspec->length < sizeof(*tspec) - 2 ||
1919             tspec->oui[0] != 0x00 || tspec->oui[1] != 0x50 ||
1920             tspec->oui[2] != 0xf2 || tspec->oui_type != 2 ||
1921             tspec->oui_subtype != 2 || tspec->version != 1)
1922                 return 0;
1923
1924         return 1;
1925 }
1926
1927
1928 static void ieee80211_rx_addts_resp(
1929         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1930         size_t var_len)
1931 {
1932         struct wmm_tspec_element *tspec;
1933
1934         wpa_printf(MSG_DEBUG, "WMM: Received ADDTS Response");
1935         wpa_hexdump(MSG_MSGDUMP, "WMM: ADDTS Response IE(s)",
1936                     mgmt->u.action.u.wmm_action.variable, var_len);
1937         if (!is_wmm_tspec(mgmt->u.action.u.wmm_action.variable, var_len))
1938                 return;
1939         tspec = (struct wmm_tspec_element *)
1940                 mgmt->u.action.u.wmm_action.variable;
1941         dump_tspec(tspec);
1942 }
1943
1944
1945 static void ieee80211_rx_delts(
1946         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1947         size_t var_len)
1948 {
1949         struct wmm_tspec_element *tspec;
1950
1951         wpa_printf(MSG_DEBUG, "WMM: Received DELTS");
1952         wpa_hexdump(MSG_MSGDUMP, "WMM: DELTS IE(s)",
1953                     mgmt->u.action.u.wmm_action.variable, var_len);
1954         if (!is_wmm_tspec(mgmt->u.action.u.wmm_action.variable, var_len))
1955                 return;
1956         tspec = (struct wmm_tspec_element *)
1957                 mgmt->u.action.u.wmm_action.variable;
1958         dump_tspec(tspec);
1959 }
1960
1961
1962 static void ieee80211_rx_mgmt_wmm_action(
1963         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1964         struct ieee80211_rx_status *rx_status)
1965 {
1966         size_t alen;
1967
1968         alen = mgmt->u.action.u.wmm_action.variable - (u8 *) mgmt;
1969         if (len < alen) {
1970                 wpa_printf(MSG_DEBUG, "WMM: Received Action frame too short");
1971                 return;
1972         }
1973
1974         wpa_printf(MSG_DEBUG, "WMM: Received Action frame: Action Code %d, "
1975                    "Dialog Token %d, Status Code %d",
1976                    mgmt->u.action.u.wmm_action.action_code,
1977                    mgmt->u.action.u.wmm_action.dialog_token,
1978                    mgmt->u.action.u.wmm_action.status_code);
1979
1980         switch (mgmt->u.action.u.wmm_action.action_code) {
1981         case WMM_ACTION_CODE_ADDTS_RESP:
1982                 ieee80211_rx_addts_resp(wpa_s, mgmt, len, len - alen);
1983                 break;
1984         case WMM_ACTION_CODE_DELTS:
1985                 ieee80211_rx_delts(wpa_s, mgmt, len, len - alen);
1986                 break;
1987         default:
1988                 wpa_printf(MSG_DEBUG, "WMM: Unsupported Action Code %d",
1989                            mgmt->u.action.u.wmm_action.action_code);
1990                 break;
1991         }
1992 }
1993
1994
1995 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1996                                      struct ieee80211_mgmt *mgmt,
1997                                      size_t len,
1998                                      struct ieee80211_rx_status *rx_status)
1999 {
2000         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
2001
2002         if (len < 25)
2003                 return;
2004
2005         switch (mgmt->u.action.category) {
2006 #ifdef CONFIG_IEEE80211R
2007         case WLAN_ACTION_FT:
2008                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
2009                 break;
2010 #endif /* CONFIG_IEEE80211R */
2011 #ifdef CONFIG_IEEE80211W
2012         case WLAN_ACTION_SA_QUERY:
2013                 ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
2014                 break;
2015 #endif /* CONFIG_IEEE80211W */
2016         case WLAN_ACTION_WMM:
2017                 ieee80211_rx_mgmt_wmm_action(wpa_s, mgmt, len, rx_status);
2018                 break;
2019         default:
2020                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
2021                            mgmt->u.action.category);
2022                 break;
2023         }
2024 }
2025
2026
2027 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
2028                                   const u8 *buf, size_t len,
2029                                   struct ieee80211_rx_status *rx_status)
2030 {
2031         struct ieee80211_mgmt *mgmt;
2032         u16 fc;
2033
2034         if (len < 24)
2035                 return;
2036
2037         mgmt = (struct ieee80211_mgmt *) buf;
2038         fc = le_to_host16(mgmt->frame_control);
2039
2040         switch (WLAN_FC_GET_STYPE(fc)) {
2041         case WLAN_FC_STYPE_PROBE_REQ:
2042                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
2043                 break;
2044         case WLAN_FC_STYPE_PROBE_RESP:
2045                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
2046                 break;
2047         case WLAN_FC_STYPE_BEACON:
2048                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2049                 break;
2050         case WLAN_FC_STYPE_AUTH:
2051                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
2052                 break;
2053         case WLAN_FC_STYPE_ASSOC_RESP:
2054                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
2055                 break;
2056         case WLAN_FC_STYPE_REASSOC_RESP:
2057                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
2058                 break;
2059         case WLAN_FC_STYPE_DEAUTH:
2060                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
2061                 break;
2062         case WLAN_FC_STYPE_DISASSOC:
2063                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
2064                 break;
2065         case WLAN_FC_STYPE_ACTION:
2066                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
2067                 break;
2068         default:
2069                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
2070                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
2071                 break;
2072         }
2073 }
2074
2075
2076 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
2077                                   const u8 *buf, size_t len,
2078                                   struct ieee80211_rx_status *rx_status)
2079 {
2080         struct ieee80211_mgmt *mgmt;
2081         u16 fc;
2082
2083         if (len < 24)
2084                 return;
2085
2086         mgmt = (struct ieee80211_mgmt *) buf;
2087         fc = le_to_host16(mgmt->frame_control);
2088
2089         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
2090                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
2091                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
2092                                                      len, rx_status);
2093                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
2094                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2095                 }
2096         }
2097 }
2098
2099
2100 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
2101 {
2102         int active = 0;
2103
2104 #if 0 /* FIX */
2105         list_for_each(ptr, &local->sta_list) {
2106                 sta = list_entry(ptr, struct sta_info, list);
2107                 if (sta->dev == dev &&
2108                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2109                                jiffies)) {
2110                         active++;
2111                         break;
2112                 }
2113         }
2114 #endif
2115
2116         return active;
2117 }
2118
2119
2120 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
2121 {
2122 #if 0 /* FIX */
2123         list_for_each_safe(ptr, n, &local->sta_list) {
2124                 sta = list_entry(ptr, struct sta_info, list);
2125                 if (time_after(jiffies, sta->last_rx +
2126                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2127                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
2128                                    MACSTR, MAC2STR(sta->addr));
2129                         sta_info_free(local, sta, 1);
2130                 }
2131         }
2132 #endif
2133 }
2134
2135
2136 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2137 {
2138         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2139
2140         ieee80211_sta_expire(wpa_s);
2141         if (ieee80211_sta_active_ibss(wpa_s))
2142                 return;
2143
2144         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2145                    "other IBSS networks with same SSID (merge)");
2146         ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2147 }
2148
2149
2150 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2151 {
2152         struct wpa_supplicant *wpa_s = eloop_ctx;
2153
2154         switch (wpa_s->mlme.state) {
2155         case IEEE80211_DISABLED:
2156                 break;
2157         case IEEE80211_AUTHENTICATE:
2158                 ieee80211_authenticate(wpa_s);
2159                 break;
2160         case IEEE80211_ASSOCIATE:
2161                 ieee80211_associate(wpa_s);
2162                 break;
2163         case IEEE80211_ASSOCIATED:
2164                 ieee80211_associated(wpa_s);
2165                 break;
2166         case IEEE80211_IBSS_SEARCH:
2167                 ieee80211_sta_find_ibss(wpa_s);
2168                 break;
2169         case IEEE80211_IBSS_JOINED:
2170                 ieee80211_sta_merge_ibss(wpa_s);
2171                 break;
2172         default:
2173                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2174                            wpa_s->mlme.state);
2175                 break;
2176         }
2177
2178         if (ieee80211_privacy_mismatch(wpa_s)) {
2179                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2180                            "and mixed-cell disabled - disassociate");
2181
2182                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2183                 ieee80211_set_associated(wpa_s, 0);
2184         }
2185 }
2186
2187
2188 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2189 {
2190         struct wpa_ssid *ssid = wpa_s->current_ssid;
2191         if (ssid && ssid->mode != 0)
2192                 return;
2193
2194 #if 0 /* FIX */
2195         if (local->hw->reset_tsf) {
2196                 /* Reset own TSF to allow time synchronization work. */
2197                 local->hw->reset_tsf(local->mdev);
2198         }
2199 #endif
2200
2201         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2202
2203
2204         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2205                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2206         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2207                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2208         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2209                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2210         else
2211                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2212         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2213                    wpa_s->mlme.auth_alg);
2214         wpa_s->mlme.auth_transaction = -1;
2215         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2216         ieee80211_authenticate(wpa_s);
2217 }
2218
2219
2220 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2221 {
2222 #if 0 /* FIX */
2223         int m, c;
2224
2225         for (m = 0; m < local->hw->num_modes; m++) {
2226                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2227                 if (mode->mode != local->conf.phymode)
2228                         continue;
2229                 for (c = 0; c < mode->num_channels; c++) {
2230                         struct ieee80211_channel *chan = &mode->channels[c];
2231                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2232                             chan->chan == local->conf.channel) {
2233                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2234                                         return 1;
2235                                 break;
2236                         }
2237                 }
2238         }
2239 #endif
2240
2241         return 0;
2242 }
2243
2244
2245 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2246                                    struct ieee80211_sta_bss *bss)
2247 {
2248         int res = 0, rates, done = 0;
2249         struct ieee80211_mgmt *mgmt;
2250 #if 0 /* FIX */
2251         struct ieee80211_tx_control control;
2252         struct ieee80211_rate *rate;
2253         struct rate_control_extra extra;
2254 #endif
2255         u8 *pos, *buf;
2256         size_t len;
2257
2258         /* Remove possible STA entries from other IBSS networks. */
2259 #if 0 /* FIX */
2260         sta_info_flush(local, NULL);
2261
2262         if (local->hw->reset_tsf) {
2263                 /* Reset own TSF to allow time synchronization work. */
2264                 local->hw->reset_tsf(local->mdev);
2265         }
2266 #endif
2267         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2268
2269 #if 0 /* FIX */
2270         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2271
2272         sdata->drop_unencrypted = bss->capability &
2273                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2274 #endif
2275
2276 #if 0 /* FIX */
2277         os_memset(&rq, 0, sizeof(rq));
2278         rq.m = bss->freq * 100000;
2279         rq.e = 1;
2280         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2281 #endif
2282
2283         if (!ieee80211_ibss_allowed(wpa_s)) {
2284 #if 0 /* FIX */
2285                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2286                            "(%d MHz)", local->conf.channel,
2287                            local->conf.freq);
2288 #endif
2289                 return -1;
2290         }
2291
2292         /* Set beacon template based on scan results */
2293         buf = os_malloc(400);
2294         len = 0;
2295         do {
2296                 if (buf == NULL)
2297                         break;
2298
2299                 mgmt = (struct ieee80211_mgmt *) buf;
2300                 len += 24 + sizeof(mgmt->u.beacon);
2301                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2302                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2303                                                    WLAN_FC_STYPE_BEACON);
2304                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2305                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2306                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2307 #if 0 /* FIX */
2308                 mgmt->u.beacon.beacon_int =
2309                         host_to_le16(local->conf.beacon_int);
2310 #endif
2311                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2312
2313                 pos = buf + len;
2314                 len += 2 + wpa_s->mlme.ssid_len;
2315                 *pos++ = WLAN_EID_SSID;
2316                 *pos++ = wpa_s->mlme.ssid_len;
2317                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2318
2319                 rates = bss->supp_rates_len;
2320                 if (rates > 8)
2321                         rates = 8;
2322                 pos = buf + len;
2323                 len += 2 + rates;
2324                 *pos++ = WLAN_EID_SUPP_RATES;
2325                 *pos++ = rates;
2326                 os_memcpy(pos, bss->supp_rates, rates);
2327
2328                 pos = buf + len;
2329                 len += 2 + 1;
2330                 *pos++ = WLAN_EID_DS_PARAMS;
2331                 *pos++ = 1;
2332                 *pos++ = bss->channel;
2333
2334                 pos = buf + len;
2335                 len += 2 + 2;
2336                 *pos++ = WLAN_EID_IBSS_PARAMS;
2337                 *pos++ = 2;
2338                 /* FIX: set ATIM window based on scan results */
2339                 *pos++ = 0;
2340                 *pos++ = 0;
2341
2342                 if (bss->supp_rates_len > 8) {
2343                         rates = bss->supp_rates_len - 8;
2344                         pos = buf + len;
2345                         len += 2 + rates;
2346                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2347                         *pos++ = rates;
2348                         os_memcpy(pos, &bss->supp_rates[8], rates);
2349                 }
2350
2351 #if 0 /* FIX */
2352                 os_memset(&control, 0, sizeof(control));
2353                 control.pkt_type = PKT_PROBE_RESP;
2354                 os_memset(&extra, 0, sizeof(extra));
2355                 extra.endidx = local->num_curr_rates;
2356                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2357                 if (rate == NULL) {
2358                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2359                                    "rate for IBSS beacon");
2360                         break;
2361                 }
2362                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2363                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2364                         rate->val2 : rate->val;
2365                 control.antenna_sel = local->conf.antenna_sel;
2366                 control.power_level = local->conf.power_level;
2367                 control.no_ack = 1;
2368                 control.retry_limit = 1;
2369                 control.rts_cts_duration = 0;
2370 #endif
2371
2372 #if 0 /* FIX */
2373                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2374                 if (wpa_s->mlme.probe_resp) {
2375                         mgmt = (struct ieee80211_mgmt *)
2376                                 wpa_s->mlme.probe_resp->data;
2377                         mgmt->frame_control =
2378                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2379                                              WLAN_FC_STYPE_PROBE_RESP);
2380                 } else {
2381                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2382                                    "ProbeResp template for IBSS");
2383                 }
2384
2385                 if (local->hw->beacon_update &&
2386                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2387                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2388                                    "template based on scan results");
2389                         skb = NULL;
2390                 }
2391
2392                 rates = 0;
2393                 for (i = 0; i < bss->supp_rates_len; i++) {
2394                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2395                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2396                                 rate *= 2;
2397                         for (j = 0; j < local->num_curr_rates; j++)
2398                                 if (local->curr_rates[j].rate == rate)
2399                                         rates |= BIT(j);
2400                 }
2401                 wpa_s->mlme.supp_rates_bits = rates;
2402 #endif
2403                 done = 1;
2404         } while (0);
2405
2406         os_free(buf);
2407         if (!done) {
2408                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2409                            "template");
2410         }
2411
2412         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2413         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2414
2415         return res;
2416 }
2417
2418
2419 #if 0 /* FIX */
2420 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2421 {
2422         struct ieee80211_sta_bss *bss;
2423         u8 bssid[ETH_ALEN], *pos;
2424         int i;
2425
2426 #if 0
2427         /* Easier testing, use fixed BSSID. */
2428         os_memset(bssid, 0xfe, ETH_ALEN);
2429 #else
2430         /* Generate random, not broadcast, locally administered BSSID. Mix in
2431          * own MAC address to make sure that devices that do not have proper
2432          * random number generator get different BSSID. */
2433         os_get_random(bssid, ETH_ALEN);
2434         for (i = 0; i < ETH_ALEN; i++)
2435                 bssid[i] ^= wpa_s->own_addr[i];
2436         bssid[0] &= ~0x01;
2437         bssid[0] |= 0x02;
2438 #endif
2439
2440         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2441                    MACSTR "", MAC2STR(bssid));
2442
2443         bss = ieee80211_bss_add(wpa_s, bssid);
2444         if (bss == NULL)
2445                 return -ENOMEM;
2446
2447 #if 0 /* FIX */
2448         if (local->conf.beacon_int == 0)
2449                 local->conf.beacon_int = 100;
2450         bss->beacon_int = local->conf.beacon_int;
2451         bss->hw_mode = local->conf.phymode;
2452         bss->channel = local->conf.channel;
2453         bss->freq = local->conf.freq;
2454 #endif
2455         os_get_time(&bss->last_update);
2456         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2457 #if 0 /* FIX */
2458         if (sdata->default_key) {
2459                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2460         } else
2461                 sdata->drop_unencrypted = 0;
2462         bss->supp_rates_len = local->num_curr_rates;
2463 #endif
2464         pos = bss->supp_rates;
2465 #if 0 /* FIX */
2466         for (i = 0; i < local->num_curr_rates; i++) {
2467                 int rate = local->curr_rates[i].rate;
2468                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2469                         rate /= 2;
2470                 *pos++ = (u8) (rate / 5);
2471         }
2472 #endif
2473
2474         return ieee80211_sta_join_ibss(wpa_s, bss);
2475 }
2476 #endif
2477
2478
2479 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2480 {
2481         struct ieee80211_sta_bss *bss;
2482         int found = 0;
2483         u8 bssid[ETH_ALEN];
2484         int active_ibss;
2485         struct os_time now;
2486
2487         if (wpa_s->mlme.ssid_len == 0)
2488                 return -EINVAL;
2489
2490         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2491 #ifdef IEEE80211_IBSS_DEBUG
2492         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2493                    active_ibss);
2494 #endif /* IEEE80211_IBSS_DEBUG */
2495         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2496                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2497                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2498                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2499                         continue;
2500 #ifdef IEEE80211_IBSS_DEBUG
2501                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2502                            MAC2STR(bss->bssid));
2503 #endif /* IEEE80211_IBSS_DEBUG */
2504                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2505                 found = 1;
2506                 if (active_ibss ||
2507                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2508                         break;
2509         }
2510
2511 #ifdef IEEE80211_IBSS_DEBUG
2512         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2513                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2514 #endif /* IEEE80211_IBSS_DEBUG */
2515         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2516             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2517                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2518                            " based on configured SSID",
2519                            MAC2STR(bssid));
2520                 return ieee80211_sta_join_ibss(wpa_s, bss);
2521         }
2522 #ifdef IEEE80211_IBSS_DEBUG
2523         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2524 #endif /* IEEE80211_IBSS_DEBUG */
2525
2526         /* Selected IBSS not found in current scan results - try to scan */
2527         os_get_time(&now);
2528 #if 0 /* FIX */
2529         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2530             !ieee80211_sta_active_ibss(wpa_s)) {
2531                 ieee80211_reschedule_timer(wpa_s,
2532                                            IEEE80211_IBSS_MERGE_INTERVAL);
2533         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2534                               IEEE80211_SCAN_INTERVAL)) {
2535                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2536                            "to join");
2537                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2538                                               wpa_s->mlme.ssid_len);
2539         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2540                 int interval = IEEE80211_SCAN_INTERVAL;
2541
2542                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2543                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2544                         if (wpa_s->mlme.create_ibss &&
2545                             ieee80211_ibss_allowed(wpa_s))
2546                                 return ieee80211_sta_create_ibss(wpa_s);
2547                         if (wpa_s->mlme.create_ibss) {
2548                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2549                                            "on the configured channel %d "
2550                                            "(%d MHz)",
2551                                            local->conf.channel,
2552                                            local->conf.freq);
2553                         }
2554
2555                         /* No IBSS found - decrease scan interval and continue
2556                          * scanning. */
2557                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2558                 }
2559
2560                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2561                 ieee80211_reschedule_timer(wpa_s, interval);
2562                 return 0;
2563         }
2564 #endif
2565
2566         return 0;
2567 }
2568
2569
2570 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2571                            size_t *len)
2572 {
2573         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2574         *len = wpa_s->mlme.ssid_len;
2575         return 0;
2576 }
2577
2578
2579 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2580                             struct wpa_driver_associate_params *params)
2581 {
2582         struct ieee80211_sta_bss *bss;
2583
2584         wpa_s->mlme.bssid_set = 0;
2585         wpa_s->mlme.freq = params->freq;
2586         if (params->bssid) {
2587                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2588                 if (!is_zero_ether_addr(params->bssid))
2589                         wpa_s->mlme.bssid_set = 1;
2590                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2591                 if (bss) {
2592                         wpa_s->mlme.phymode = bss->hw_mode;
2593                         wpa_s->mlme.channel = bss->channel;
2594                         wpa_s->mlme.freq = bss->freq;
2595                 }
2596         }
2597
2598 #if 0 /* FIX */
2599         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2600          * not defined. */
2601         if (local->hw->conf_tx) {
2602                 struct ieee80211_tx_queue_params qparam;
2603                 int i;
2604
2605                 os_memset(&qparam, 0, sizeof(qparam));
2606                 /* TODO: are these ok defaults for all hw_modes? */
2607                 qparam.aifs = 2;
2608                 qparam.cw_min =
2609                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2610                 qparam.cw_max = 1023;
2611                 qparam.burst_time = 0;
2612                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2613                 {
2614                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2615                                            &qparam);
2616                 }
2617                 /* IBSS uses different parameters for Beacon sending */
2618                 qparam.cw_min++;
2619                 qparam.cw_min *= 2;
2620                 qparam.cw_min--;
2621                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2622         }
2623 #endif
2624
2625         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2626             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2627                 wpa_s->mlme.prev_bssid_set = 0;
2628         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2629         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2630                   MAX_SSID_LEN - params->ssid_len);
2631         wpa_s->mlme.ssid_len = params->ssid_len;
2632         wpa_s->mlme.ssid_set = 1;
2633
2634         os_free(wpa_s->mlme.extra_ie);
2635         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2636                 wpa_s->mlme.extra_ie = NULL;
2637                 wpa_s->mlme.extra_ie_len = 0;
2638         } else {
2639                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2640                 if (wpa_s->mlme.extra_ie == NULL) {
2641                         wpa_s->mlme.extra_ie_len = 0;
2642                         return -1;
2643                 }
2644                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2645                           params->wpa_ie_len);
2646                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2647         }
2648
2649         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2650
2651         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2652                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2653
2654         if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2655                 os_get_time(&wpa_s->mlme.ibss_join_req);
2656                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2657                 return ieee80211_sta_find_ibss(wpa_s);
2658         }
2659
2660         if (wpa_s->mlme.bssid_set)
2661                 ieee80211_sta_new_auth(wpa_s);
2662
2663         return 0;
2664 }
2665
2666
2667 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2668 {
2669         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2670         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2671         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2672 }
2673
2674
2675 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2676 {
2677         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2678         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2679         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2680         if (wpa_s->mlme.freq == 0)
2681                 return 0;
2682         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2683                                          wpa_s->mlme.channel,
2684                                          wpa_s->mlme.freq);
2685 }
2686
2687
2688 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2689 {
2690         size_t m;
2691         int c;
2692
2693         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2694                 struct hostapd_hw_modes *mode = &wpa_s->mlme.modes[m];
2695                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2696                         continue;
2697                 for (c = 0; c < mode->num_channels; c++) {
2698                         struct hostapd_channel_data *chan = &mode->channels[c];
2699                         if (!(chan->flag & HOSTAPD_CHAN_DISABLED) &&
2700                             chan->chan == wpa_s->mlme.channel) {
2701                                 if (!(chan->flag & HOSTAPD_CHAN_PASSIVE_SCAN))
2702                                         return 1;
2703                                 break;
2704                         }
2705                 }
2706         }
2707
2708         return 0;
2709 }
2710
2711
2712 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2713 {
2714         struct wpa_supplicant *wpa_s = eloop_ctx;
2715         struct hostapd_hw_modes *mode;
2716         struct hostapd_channel_data *chan;
2717         int skip = 0;
2718         int timeout = 0;
2719         struct wpa_ssid *ssid = wpa_s->current_ssid;
2720         int adhoc;
2721
2722         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2723                 return;
2724
2725         adhoc = ssid && ssid->mode == 1;
2726
2727         switch (wpa_s->mlme.scan_state) {
2728         case SCAN_SET_CHANNEL:
2729                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2730                 if (wpa_s->mlme.scan_hw_mode_idx >=
2731                     (int) wpa_s->mlme.num_modes ||
2732                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2733                      (int) wpa_s->mlme.num_modes
2734                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2735                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2736                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2737                                            "restore operational channel after "
2738                                            "scan");
2739                         }
2740                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2741                         wpa_s->mlme.sta_scanning = 0;
2742                         os_get_time(&wpa_s->mlme.last_scan_completed);
2743                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2744                         if (adhoc) {
2745                                 if (!wpa_s->mlme.bssid_set ||
2746                                     (wpa_s->mlme.state ==
2747                                      IEEE80211_IBSS_JOINED &&
2748                                      !ieee80211_sta_active_ibss(wpa_s)))
2749                                         ieee80211_sta_find_ibss(wpa_s);
2750                         }
2751                         return;
2752                 }
2753                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2754                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2755                 if ((chan->flag & HOSTAPD_CHAN_DISABLED) ||
2756                     (adhoc && (chan->flag & HOSTAPD_CHAN_NO_IBSS)) ||
2757                     (wpa_s->mlme.hw_modes & (1 << HOSTAPD_MODE_IEEE80211G) &&
2758                      mode->mode == HOSTAPD_MODE_IEEE80211B &&
2759                      wpa_s->mlme.scan_skip_11b))
2760                         skip = 1;
2761
2762                 if (!skip) {
2763                         wpa_printf(MSG_MSGDUMP,
2764                                    "MLME: scan channel %d (%d MHz)",
2765                                    chan->chan, chan->freq);
2766
2767                         wpa_s->mlme.channel = chan->chan;
2768                         wpa_s->mlme.freq = chan->freq;
2769                         wpa_s->mlme.phymode = mode->mode;
2770                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2771                                                       chan->chan, chan->freq))
2772                         {
2773                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2774                                            "channel %d (%d MHz) for scan",
2775                                            chan->chan, chan->freq);
2776                                 skip = 1;
2777                         }
2778                 }
2779
2780                 wpa_s->mlme.scan_channel_idx++;
2781                 if (wpa_s->mlme.scan_channel_idx >=
2782                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2783                     num_channels) {
2784                         wpa_s->mlme.scan_hw_mode_idx++;
2785                         wpa_s->mlme.scan_channel_idx = 0;
2786                 }
2787
2788                 if (skip) {
2789                         timeout = 0;
2790                         break;
2791                 }
2792
2793                 timeout = IEEE80211_PROBE_DELAY;
2794                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2795                 break;
2796         case SCAN_SEND_PROBE:
2797                 if (ieee80211_active_scan(wpa_s)) {
2798                         ieee80211_send_probe_req(wpa_s, NULL,
2799                                                  wpa_s->mlme.scan_ssid,
2800                                                  wpa_s->mlme.scan_ssid_len);
2801                         timeout = IEEE80211_CHANNEL_TIME;
2802                 } else {
2803                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2804                 }
2805                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2806                 break;
2807         }
2808
2809         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2810                                ieee80211_sta_scan_timer, wpa_s, NULL);
2811 }
2812
2813
2814 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2815                            size_t ssid_len)
2816 {
2817         if (ssid_len > MAX_SSID_LEN)
2818                 return -1;
2819
2820         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2821          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2822          * BSSID: MACAddress
2823          * SSID
2824          * ScanType: ACTIVE, PASSIVE
2825          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2826          *    a Probe frame during active scanning
2827          * ChannelList
2828          * MinChannelTime (>= ProbeDelay), in TU
2829          * MaxChannelTime: (>= MinChannelTime), in TU
2830          */
2831
2832          /* MLME-SCAN.confirm
2833           * BSSDescriptionSet
2834           * ResultCode: SUCCESS, INVALID_PARAMETERS
2835          */
2836
2837         /* TODO: if assoc, move to power save mode for the duration of the
2838          * scan */
2839
2840         if (wpa_s->mlme.sta_scanning)
2841                 return -1;
2842
2843         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2844
2845         ieee80211_sta_save_oper_chan(wpa_s);
2846
2847         wpa_s->mlme.sta_scanning = 1;
2848         /* TODO: stop TX queue? */
2849
2850         if (ssid) {
2851                 wpa_s->mlme.scan_ssid_len = ssid_len;
2852                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2853         } else
2854                 wpa_s->mlme.scan_ssid_len = 0;
2855         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2856                                         * supported */
2857         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2858         wpa_s->mlme.scan_hw_mode_idx = 0;
2859         wpa_s->mlme.scan_channel_idx = 0;
2860         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2861
2862         return 0;
2863 }
2864
2865
2866 struct wpa_scan_results *
2867 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2868 {
2869         size_t ap_num = 0;
2870         struct wpa_scan_results *res;
2871         struct wpa_scan_res *r;
2872         struct ieee80211_sta_bss *bss;
2873
2874         res = os_zalloc(sizeof(*res));
2875         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2876                 ap_num++;
2877         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2878         if (res->res == NULL) {
2879                 os_free(res);
2880                 return NULL;
2881         }
2882
2883         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2884                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2885                 if (r == NULL)
2886                         break;
2887                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2888                 r->freq = bss->freq;
2889                 r->beacon_int = bss->beacon_int;
2890                 r->caps = bss->capability;
2891                 r->level = bss->rssi;
2892                 r->tsf = bss->timestamp;
2893                 if (bss->ie) {
2894                         r->ie_len = bss->ie_len;
2895                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2896                 }
2897
2898                 res->res[res->num++] = r;
2899         }
2900
2901         return res;
2902 }
2903
2904
2905 #if 0 /* FIX */
2906 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2907                                          struct sk_buff *skb, u8 *bssid,
2908                                          u8 *addr)
2909 {
2910         struct ieee80211_local *local = dev->priv;
2911         struct list_head *ptr;
2912         struct sta_info *sta;
2913         struct wpa_supplicant *sta_dev = NULL;
2914
2915         /* TODO: Could consider removing the least recently used entry and
2916          * allow new one to be added. */
2917         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2918                 if (net_ratelimit()) {
2919                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2920                                    "STA entry " MACSTR, MAC2STR(addr));
2921                 }
2922                 return NULL;
2923         }
2924
2925         spin_lock_bh(&local->sub_if_lock);
2926         list_for_each(ptr, &local->sub_if_list) {
2927                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2928                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2929                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2930                         sta_dev = sdata->dev;
2931                         break;
2932                 }
2933         }
2934         spin_unlock_bh(&local->sub_if_lock);
2935
2936         if (sta_dev == NULL)
2937                 return NULL;
2938
2939         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2940                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2941
2942         sta = sta_info_add(wpa_s, addr);
2943         if (sta == NULL) {
2944                 return NULL;
2945         }
2946
2947         sta->dev = sta_dev;
2948         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2949
2950         rate_control_rate_init(local, sta);
2951
2952         return sta; /* caller will call sta_info_release() */
2953 }
2954 #endif
2955
2956
2957 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2958 {
2959         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2960
2961         ieee80211_send_deauth(wpa_s, reason);
2962         ieee80211_set_associated(wpa_s, 0);
2963         return 0;
2964 }
2965
2966
2967 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2968 {
2969         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2970
2971         if (!wpa_s->mlme.associated)
2972                 return -1;
2973
2974         ieee80211_send_disassoc(wpa_s, reason);
2975         ieee80211_set_associated(wpa_s, 0);
2976         return 0;
2977 }
2978
2979
2980 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2981                       struct ieee80211_rx_status *rx_status)
2982 {
2983         struct ieee80211_mgmt *mgmt;
2984         u16 fc;
2985         const u8 *pos;
2986
2987         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2988
2989         if (wpa_s->mlme.sta_scanning) {
2990                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2991                 return;
2992         }
2993
2994         if (len < 24)
2995                 return;
2996
2997         mgmt = (struct ieee80211_mgmt *) buf;
2998         fc = le_to_host16(mgmt->frame_control);
2999
3000         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
3001                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
3002         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
3003                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
3004                     WLAN_FC_FROMDS)
3005                         return;
3006                 /* mgmt->sa is actually BSSID for FromDS data frames */
3007                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
3008                         return;
3009                 /* Skip IEEE 802.11 and LLC headers */
3010                 pos = buf + 24 + 6;
3011                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
3012                         return;
3013                 pos += 2;
3014                 /* mgmt->bssid is actually BSSID for SA data frames */
3015                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
3016                                         pos, buf + len - pos);
3017         }
3018 }
3019
3020
3021 void ieee80211_sta_free_hw_features(struct hostapd_hw_modes *hw_features,
3022                                     size_t num_hw_features)
3023 {
3024         size_t i;
3025
3026         if (hw_features == NULL)
3027                 return;
3028
3029         for (i = 0; i < num_hw_features; i++) {
3030                 os_free(hw_features[i].channels);
3031                 os_free(hw_features[i].rates);
3032         }
3033
3034         os_free(hw_features);
3035 }
3036
3037
3038 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
3039 {
3040         u16 num_modes, flags;
3041
3042         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
3043                                                         &flags);
3044         if (wpa_s->mlme.modes == NULL) {
3045                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
3046                            "channels and rates from the driver");
3047                 return -1;
3048         }
3049
3050         wpa_s->mlme.num_modes = num_modes;
3051
3052         wpa_s->mlme.hw_modes = 1 << HOSTAPD_MODE_IEEE80211A;
3053         wpa_s->mlme.hw_modes |= 1 << HOSTAPD_MODE_IEEE80211B;
3054         wpa_s->mlme.hw_modes |= 1 << HOSTAPD_MODE_IEEE80211G;
3055
3056         wpa_s->mlme.wmm_enabled = 1;
3057
3058         return 0;
3059 }
3060
3061
3062 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
3063 {
3064         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
3065         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
3066         os_free(wpa_s->mlme.extra_ie);
3067         wpa_s->mlme.extra_ie = NULL;
3068         os_free(wpa_s->mlme.extra_probe_ie);
3069         wpa_s->mlme.extra_probe_ie = NULL;
3070         os_free(wpa_s->mlme.assocreq_ies);
3071         wpa_s->mlme.assocreq_ies = NULL;
3072         os_free(wpa_s->mlme.assocresp_ies);
3073         wpa_s->mlme.assocresp_ies = NULL;
3074         ieee80211_bss_list_deinit(wpa_s);
3075         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
3076                                        wpa_s->mlme.num_modes);
3077 #ifdef CONFIG_IEEE80211R
3078         os_free(wpa_s->mlme.ft_ies);
3079         wpa_s->mlme.ft_ies = NULL;
3080         wpa_s->mlme.ft_ies_len = 0;
3081 #endif /* CONFIG_IEEE80211R */
3082 }
3083
3084
3085 #ifdef CONFIG_IEEE80211R
3086
3087 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
3088                                 const u8 *ies, size_t ies_len)
3089 {
3090         if (md == NULL) {
3091                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
3092                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
3093         } else {
3094                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
3095                            MAC2STR(md));
3096                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
3097         }
3098
3099         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
3100         os_free(wpa_s->mlme.ft_ies);
3101         wpa_s->mlme.ft_ies = os_malloc(ies_len);
3102         if (wpa_s->mlme.ft_ies == NULL)
3103                 return -1;
3104         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
3105         wpa_s->mlme.ft_ies_len = ies_len;
3106
3107         return 0;
3108 }
3109
3110
3111 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
3112                                  const u8 *target_ap,
3113                                  const u8 *ies, size_t ies_len)
3114 {
3115         u8 *buf;
3116         size_t len;
3117         struct ieee80211_mgmt *mgmt;
3118         int res;
3119
3120         /*
3121          * Action frame payload:
3122          * Category[1] = 6 (Fast BSS Transition)
3123          * Action[1] = 1 (Fast BSS Transition Request)
3124          * STA Address
3125          * Target AP Address
3126          * FT IEs
3127          */
3128
3129         buf = os_zalloc(sizeof(*mgmt) + ies_len);
3130         if (buf == NULL) {
3131                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3132                            "FT action frame");
3133                 return -1;
3134         }
3135
3136         mgmt = (struct ieee80211_mgmt *) buf;
3137         len = 24;
3138         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3139         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3140         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3141         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3142                                            WLAN_FC_STYPE_ACTION);
3143         mgmt->u.action.category = WLAN_ACTION_FT;
3144         mgmt->u.action.u.ft_action_req.action = action;
3145         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3146                   ETH_ALEN);
3147         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3148                   ETH_ALEN);
3149         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3150         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3151
3152         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3153                    "Target AP=" MACSTR " body_len=%lu",
3154                    action, MAC2STR(target_ap), (unsigned long) ies_len);
3155
3156         res = ieee80211_sta_tx(wpa_s, buf, len);
3157         os_free(buf);
3158
3159         return res;
3160 }
3161
3162 #endif /* CONFIG_IEEE80211R */
3163
3164
3165 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
3166                                    size_t ies_len)
3167 {
3168         os_free(wpa_s->mlme.extra_probe_ie);
3169         wpa_s->mlme.extra_probe_ie = NULL;
3170         wpa_s->mlme.extra_probe_ie_len = 0;
3171
3172         if (ies == NULL)
3173                 return 0;
3174
3175         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3176         if (wpa_s->mlme.extra_probe_ie == NULL)
3177                 return -1;
3178
3179         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3180         wpa_s->mlme.extra_probe_ie_len = ies_len;
3181
3182         return 0;
3183 }