www.project-moonshot.org Git - mech_eap.orig/blob - wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "wpa.h"
  24 #include "drivers/driver.h"
  25 #include "ieee802_11_defs.h"
  26 #include "ieee802_11_common.h"
  27 #include "mlme.h"
  28
  29
  30 /* Timeouts and intervals in milliseconds */
  31 #define IEEE80211_AUTH_TIMEOUT (200)
  32 #define IEEE80211_AUTH_MAX_TRIES 3
  33 #define IEEE80211_ASSOC_TIMEOUT (200)
  34 #define IEEE80211_ASSOC_MAX_TRIES 3
  35 #define IEEE80211_MONITORING_INTERVAL (2000)
  36 #define IEEE80211_PROBE_INTERVAL (60000)
  37 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  38 #define IEEE80211_SCAN_INTERVAL (2000)
  39 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  40 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  41
  42 #define IEEE80211_PROBE_DELAY (33)
  43 #define IEEE80211_CHANNEL_TIME (33)
  44 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  45 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  46 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  47 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  48
  49 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  50
  51
  52 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  53
  54
  55 struct ieee80211_sta_bss {
  56         struct ieee80211_sta_bss *next;
  57         struct ieee80211_sta_bss *hnext;
  58
  59         u8 bssid[ETH_ALEN];
  60         u8 ssid[MAX_SSID_LEN];
  61         size_t ssid_len;
  62         u16 capability; /* host byte order */
  63         int hw_mode;
  64         int channel;
  65         int freq;
  66         int rssi;
  67         u8 *ie;
  68         size_t ie_len;
  69         u8 *wpa_ie;
  70         size_t wpa_ie_len;
  71         u8 *rsn_ie;
  72         size_t rsn_ie_len;
  73         u8 *wmm_ie;
  74         size_t wmm_ie_len;
  75         u8 *mdie;
  76         size_t mdie_len;
  77 #define IEEE80211_MAX_SUPP_RATES 32
  78         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  79         size_t supp_rates_len;
  80         int beacon_int;
  81         u64 timestamp;
  82
  83         int probe_resp;
  84         struct os_time last_update;
  85 };
  86
  87
  88 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  89                                      const u8 *dst,
  90                                      const u8 *ssid, size_t ssid_len);
  91 static struct ieee80211_sta_bss *
  92 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  93 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  94 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  95 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  96 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  97
  98
  99 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 100                                      wpa_hw_mode phymode, int chan,
 101                                      int freq)
 102 {
 103         size_t i;
 104         struct wpa_hw_modes *mode;
 105
 106         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 107                 mode = &wpa_s->mlme.modes[i];
 108                 if (mode->mode == phymode) {
 109                         wpa_s->mlme.curr_rates = mode->rates;
 110                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 111                         break;
 112                 }
 113         }
 114
 115         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 116 }
 117
 118
 119 static int ecw2cw(int ecw)
 120 {
 121         int cw = 1;
 122         while (ecw > 0) {
 123                 cw <<= 1;
 124                 ecw--;
 125         }
 126         return cw - 1;
 127 }
 128
 129
 130 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 131                                      u8 *wmm_param, size_t wmm_param_len)
 132 {
 133         size_t left;
 134         int count;
 135         u8 *pos;
 136         u8 wmm_acm;
 137
 138         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 139                 return;
 140         count = wmm_param[6] & 0x0f;
 141         if (count == wpa_s->mlme.wmm_last_param_set)
 142                 return;
 143         wpa_s->mlme.wmm_last_param_set = count;
 144
 145         pos = wmm_param + 8;
 146         left = wmm_param_len - 8;
 147
 148         wmm_acm = 0;
 149         for (; left >= 4; left -= 4, pos += 4) {
 150                 int aci = (pos[0] >> 5) & 0x03;
 151                 int acm = (pos[0] >> 4) & 0x01;
 152                 int aifs, cw_max, cw_min, burst_time;
 153
 154                 switch (aci) {
 155                 case 1: /* AC_BK */
 156                         if (acm)
 157                                 wmm_acm |= BIT(1) | BIT(2); /* BK/- */
 158                         break;
 159                 case 2: /* AC_VI */
 160                         if (acm)
 161                                 wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
 162                         break;
 163                 case 3: /* AC_VO */
 164                         if (acm)
 165                                 wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
 166                         break;
 167                 case 0: /* AC_BE */
 168                 default:
 169                         if (acm)
 170                                 wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
 171                         break;
 172                 }
 173
 174                 aifs = pos[0] & 0x0f;
 175                 cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 176                 cw_min = ecw2cw(pos[1] & 0x0f);
 177                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 178                 burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 179                 wpa_printf(MSG_DEBUG, "MLME: WMM aci=%d acm=%d aifs=%d "
 180                            "cWmin=%d cWmax=%d burst=%d",
 181                            aci, acm, aifs, cw_min, cw_max, burst_time);
 182                 /* TODO: driver configuration */
 183         }
 184 }
 185
 186
 187 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 188 {
 189         if (wpa_s->mlme.associated == assoc && !assoc)
 190                 return;
 191
 192         wpa_s->mlme.associated = assoc;
 193
 194         if (assoc) {
 195                 union wpa_event_data data;
 196                 os_memset(&data, 0, sizeof(data));
 197                 wpa_s->mlme.prev_bssid_set = 1;
 198                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 199                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 200                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 201                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 202                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 203                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 204         } else {
 205                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 206         }
 207         os_get_time(&wpa_s->mlme.last_probe);
 208 }
 209
 210
 211 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 212                             size_t len)
 213 {
 214         return wpa_drv_send_mlme(wpa_s, buf, len);
 215 }
 216
 217
 218 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 219                                 int transaction, u8 *extra, size_t extra_len,
 220                                 int encrypt)
 221 {
 222         u8 *buf;
 223         size_t len;
 224         struct ieee80211_mgmt *mgmt;
 225
 226         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 227         if (buf == NULL) {
 228                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 229                            "auth frame");
 230                 return;
 231         }
 232
 233         mgmt = (struct ieee80211_mgmt *) buf;
 234         len = 24 + 6;
 235         os_memset(mgmt, 0, 24 + 6);
 236         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 237                                            WLAN_FC_STYPE_AUTH);
 238         if (encrypt)
 239                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 240         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 241         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 242         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 243         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 244         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 245         wpa_s->mlme.auth_transaction = transaction + 1;
 246         mgmt->u.auth.status_code = host_to_le16(0);
 247         if (extra) {
 248                 os_memcpy(buf + len, extra, extra_len);
 249                 len += extra_len;
 250         }
 251
 252         ieee80211_sta_tx(wpa_s, buf, len);
 253         os_free(buf);
 254 }
 255
 256
 257 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 258 {
 259         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 260         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 261                                ieee80211_sta_timer, wpa_s, NULL);
 262 }
 263
 264
 265 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 266 {
 267         u8 *extra;
 268         size_t extra_len;
 269
 270         wpa_s->mlme.auth_tries++;
 271         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 272                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 273                            " timed out", MAC2STR(wpa_s->bssid));
 274                 return;
 275         }
 276
 277         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 278         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 279                    MAC2STR(wpa_s->bssid));
 280
 281         extra = NULL;
 282         extra_len = 0;
 283
 284 #ifdef CONFIG_IEEE80211R
 285         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 286              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 287             wpa_s->mlme.ft_ies) {
 288                 struct ieee80211_sta_bss *bss;
 289                 struct rsn_mdie *mdie = NULL;
 290                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 291                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 292                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 293                 if (mdie &&
 294                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 295                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 296                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 297                                    "over-the-air");
 298                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 299                         extra = wpa_s->mlme.ft_ies;
 300                         extra_len = wpa_s->mlme.ft_ies_len;
 301                 }
 302         }
 303 #endif /* CONFIG_IEEE80211R */
 304
 305         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 306
 307         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 308 }
 309
 310
 311 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 312 {
 313         struct ieee80211_mgmt *mgmt;
 314         u8 *pos, *ies, *buf;
 315         int i, len;
 316         u16 capab;
 317         struct ieee80211_sta_bss *bss;
 318         int wmm = 0;
 319         size_t blen, buflen;
 320
 321         if (wpa_s->mlme.curr_rates == NULL) {
 322                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 323                 return;
 324         }
 325
 326         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 327                 wpa_s->mlme.ssid_len;
 328 #ifdef CONFIG_IEEE80211R
 329         if (wpa_s->mlme.ft_ies)
 330                 buflen += wpa_s->mlme.ft_ies_len;
 331 #endif /* CONFIG_IEEE80211R */
 332         buf = os_malloc(buflen);
 333         if (buf == NULL) {
 334                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 335                            "assoc frame");
 336                 return;
 337         }
 338         blen = 0;
 339
 340         capab = wpa_s->mlme.capab;
 341         if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
 342                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 343                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 344         }
 345         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 346         if (bss) {
 347                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 348                         capab |= WLAN_CAPABILITY_PRIVACY;
 349                 if (bss->wmm_ie) {
 350                         wmm = 1;
 351                 }
 352         }
 353
 354         mgmt = (struct ieee80211_mgmt *) buf;
 355         blen += 24;
 356         os_memset(mgmt, 0, 24);
 357         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 358         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 359         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 360
 361         if (wpa_s->mlme.prev_bssid_set) {
 362                 blen += 10;
 363                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 364                                                    WLAN_FC_STYPE_REASSOC_REQ);
 365                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 366                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 367                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 368                           wpa_s->mlme.prev_bssid,
 369                           ETH_ALEN);
 370         } else {
 371                 blen += 4;
 372                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 373                                                    WLAN_FC_STYPE_ASSOC_REQ);
 374                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 375                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 376         }
 377
 378         /* SSID */
 379         ies = pos = buf + blen;
 380         blen += 2 + wpa_s->mlme.ssid_len;
 381         *pos++ = WLAN_EID_SSID;
 382         *pos++ = wpa_s->mlme.ssid_len;
 383         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 384
 385         len = wpa_s->mlme.num_curr_rates;
 386         if (len > 8)
 387                 len = 8;
 388         pos = buf + blen;
 389         blen += len + 2;
 390         *pos++ = WLAN_EID_SUPP_RATES;
 391         *pos++ = len;
 392         for (i = 0; i < len; i++) {
 393                 int rate = wpa_s->mlme.curr_rates[i].rate;
 394                 *pos++ = (u8) (rate / 5);
 395         }
 396
 397         if (wpa_s->mlme.num_curr_rates > len) {
 398                 pos = buf + blen;
 399                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 400                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 401                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 402                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
 403                         int rate = wpa_s->mlme.curr_rates[i].rate;
 404                         *pos++ = (u8) (rate / 5);
 405                 }
 406         }
 407
 408         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 409                 pos = buf + blen;
 410                 blen += wpa_s->mlme.extra_ie_len;
 411                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 412         }
 413
 414 #ifdef CONFIG_IEEE80211R
 415         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 416              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 417             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 418             bss && bss->mdie &&
 419             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 420             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 421                 pos = buf + blen;
 422                 blen += 2 + sizeof(struct rsn_mdie);
 423                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 424                 *pos++ = sizeof(struct rsn_mdie);
 425                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 426                 pos += MOBILITY_DOMAIN_ID_LEN;
 427                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 428         }
 429
 430         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 431              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 432             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 433                 pos = buf + blen;
 434                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 435                 pos += wpa_s->mlme.ft_ies_len;
 436                 blen += wpa_s->mlme.ft_ies_len;
 437         }
 438 #endif /* CONFIG_IEEE80211R */
 439
 440         if (wmm && wpa_s->mlme.wmm_enabled) {
 441                 pos = buf + blen;
 442                 blen += 9;
 443                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 444                 *pos++ = 7; /* len */
 445                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 446                 *pos++ = 0x50;
 447                 *pos++ = 0xf2;
 448                 *pos++ = 2; /* WMM */
 449                 *pos++ = 0; /* WMM info */
 450                 *pos++ = 1; /* WMM ver */
 451                 *pos++ = 0;
 452         }
 453
 454         os_free(wpa_s->mlme.assocreq_ies);
 455         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 456         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 457         if (wpa_s->mlme.assocreq_ies) {
 458                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 459                           wpa_s->mlme.assocreq_ies_len);
 460         }
 461
 462         ieee80211_sta_tx(wpa_s, buf, blen);
 463         os_free(buf);
 464 }
 465
 466
 467 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 468 {
 469         u8 *buf;
 470         size_t len;
 471         struct ieee80211_mgmt *mgmt;
 472
 473         buf = os_zalloc(sizeof(*mgmt));
 474         if (buf == NULL) {
 475                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 476                            "deauth frame");
 477                 return;
 478         }
 479
 480         mgmt = (struct ieee80211_mgmt *) buf;
 481         len = 24;
 482         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 483         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 484         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 485         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 486                                            WLAN_FC_STYPE_DEAUTH);
 487         len += 2;
 488         mgmt->u.deauth.reason_code = host_to_le16(reason);
 489
 490         ieee80211_sta_tx(wpa_s, buf, len);
 491         os_free(buf);
 492 }
 493
 494
 495 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 496 {
 497         u8 *buf;
 498         size_t len;
 499         struct ieee80211_mgmt *mgmt;
 500
 501         buf = os_zalloc(sizeof(*mgmt));
 502         if (buf == NULL) {
 503                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 504                            "disassoc frame");
 505                 return;
 506         }
 507
 508         mgmt = (struct ieee80211_mgmt *) buf;
 509         len = 24;
 510         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 511         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 512         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 513         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 514                                            WLAN_FC_STYPE_DISASSOC);
 515         len += 2;
 516         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 517
 518         ieee80211_sta_tx(wpa_s, buf, len);
 519         os_free(buf);
 520 }
 521
 522
 523 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 524 {
 525         struct ieee80211_sta_bss *bss;
 526         int res = 0;
 527
 528         if (wpa_s->mlme.mixed_cell ||
 529             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 530                 return 0;
 531
 532         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 533         if (bss == NULL)
 534                 return 0;
 535
 536         if (ieee80211_sta_wep_configured(wpa_s) !=
 537             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 538                 res = 1;
 539
 540         return res;
 541 }
 542
 543
 544 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 545 {
 546         wpa_s->mlme.assoc_tries++;
 547         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 548                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 549                            " timed out", MAC2STR(wpa_s->bssid));
 550                 return;
 551         }
 552
 553         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 554         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 555                    MAC2STR(wpa_s->bssid));
 556         if (ieee80211_privacy_mismatch(wpa_s)) {
 557                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 558                            "configuration and mixed-cell disabled - abort "
 559                            "association");
 560                 return;
 561         }
 562
 563         ieee80211_send_assoc(wpa_s);
 564
 565         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 566 }
 567
 568
 569 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 570 {
 571         int disassoc;
 572
 573         /* TODO: start monitoring current AP signal quality and number of
 574          * missed beacons. Scan other channels every now and then and search
 575          * for better APs. */
 576         /* TODO: remove expired BSSes */
 577
 578         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 579
 580 #if 0 /* FIX */
 581         sta = sta_info_get(local, wpa_s->bssid);
 582         if (sta == NULL) {
 583                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 584                            MAC2STR(wpa_s->bssid));
 585                 disassoc = 1;
 586         } else {
 587                 disassoc = 0;
 588                 if (time_after(jiffies,
 589                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 590                         if (wpa_s->mlme.probereq_poll) {
 591                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 592                                            "current AP " MACSTR " - assume "
 593                                            "out of range",
 594                                            MAC2STR(wpa_s->bssid));
 595                                 disassoc = 1;
 596                         } else {
 597                                 ieee80211_send_probe_req(
 598                                         wpa_s->bssid,
 599                                         wpa_s->mlme.scan_ssid,
 600                                         wpa_s->mlme.scan_ssid_len);
 601                                 wpa_s->mlme.probereq_poll = 1;
 602                         }
 603                 } else {
 604                         wpa_s->mlme.probereq_poll = 0;
 605                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 606                                        IEEE80211_PROBE_INTERVAL)) {
 607                                 wpa_s->mlme.last_probe = jiffies;
 608                                 ieee80211_send_probe_req(wpa_s->bssid,
 609                                                          wpa_s->mlme.ssid,
 610                                                          wpa_s->mlme.ssid_len);
 611                         }
 612                 }
 613                 sta_info_release(local, sta);
 614         }
 615 #else
 616         disassoc = 0;
 617 #endif
 618         if (disassoc) {
 619                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 620                 ieee80211_reschedule_timer(wpa_s,
 621                                            IEEE80211_MONITORING_INTERVAL +
 622                                            30000);
 623         } else {
 624                 ieee80211_reschedule_timer(wpa_s,
 625                                            IEEE80211_MONITORING_INTERVAL);
 626         }
 627 }
 628
 629
 630 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 631                                      const u8 *dst,
 632                                      const u8 *ssid, size_t ssid_len)
 633 {
 634         u8 *buf;
 635         size_t len;
 636         struct ieee80211_mgmt *mgmt;
 637         u8 *pos, *supp_rates;
 638         u8 *esupp_rates = NULL;
 639         int i;
 640
 641         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 642         if (buf == NULL) {
 643                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 644                            "probe request");
 645                 return;
 646         }
 647
 648         mgmt = (struct ieee80211_mgmt *) buf;
 649         len = 24;
 650         os_memset(mgmt, 0, 24);
 651         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 652                                            WLAN_FC_STYPE_PROBE_REQ);
 653         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 654         if (dst) {
 655                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 656                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 657         } else {
 658                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 659                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 660         }
 661         pos = buf + len;
 662         len += 2 + ssid_len;
 663         *pos++ = WLAN_EID_SSID;
 664         *pos++ = ssid_len;
 665         os_memcpy(pos, ssid, ssid_len);
 666
 667         supp_rates = buf + len;
 668         len += 2;
 669         supp_rates[0] = WLAN_EID_SUPP_RATES;
 670         supp_rates[1] = 0;
 671         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 672                 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
 673                 if (esupp_rates) {
 674                         pos = buf + len;
 675                         len++;
 676                         esupp_rates[1]++;
 677                 } else if (supp_rates[1] == 8) {
 678                         esupp_rates = pos;
 679                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 680                         esupp_rates[1] = 1;
 681                         pos = &esupp_rates[2];
 682                         len += 3;
 683                 } else {
 684                         pos = buf + len;
 685                         len++;
 686                         supp_rates[1]++;
 687                 }
 688                 *pos++ = rate->rate / 5;
 689         }
 690
 691         if (wpa_s->mlme.extra_probe_ie) {
 692                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 693                           wpa_s->mlme.extra_probe_ie_len);
 694                 len += wpa_s->mlme.extra_probe_ie_len;
 695         }
 696
 697         ieee80211_sta_tx(wpa_s, buf, len);
 698         os_free(buf);
 699 }
 700
 701
 702 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 703 {
 704 #if 0 /* FIX */
 705         if (sdata == NULL || sdata->default_key == NULL ||
 706             sdata->default_key->alg != ALG_WEP)
 707                 return 0;
 708         return 1;
 709 #else
 710         return 0;
 711 #endif
 712 }
 713
 714
 715 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 716 {
 717         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 718         wpa_s->mlme.authenticated = 1;
 719         ieee80211_associate(wpa_s);
 720 }
 721
 722
 723 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 724                                      struct ieee80211_mgmt *mgmt,
 725                                      size_t len,
 726                                      struct ieee80211_rx_status *rx_status)
 727 {
 728         u8 *pos;
 729         struct ieee802_11_elems elems;
 730
 731         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 732         pos = mgmt->u.auth.variable;
 733         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
 734             == ParseFailed) {
 735                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 736                 return;
 737         }
 738         if (elems.challenge == NULL) {
 739                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 740                            "auth frame");
 741                 return;
 742         }
 743         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 744                             elems.challenge_len + 2, 1);
 745 }
 746
 747
 748 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 749                                    struct ieee80211_mgmt *mgmt,
 750                                    size_t len,
 751                                    struct ieee80211_rx_status *rx_status)
 752 {
 753         struct wpa_ssid *ssid = wpa_s->current_ssid;
 754         u16 auth_alg, auth_transaction, status_code;
 755         int adhoc;
 756
 757         adhoc = ssid && ssid->mode == 1;
 758
 759         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 760                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 761                            "from " MACSTR ", but not in authenticate state - "
 762                            "ignored", MAC2STR(mgmt->sa));
 763                 return;
 764         }
 765
 766         if (len < 24 + 6) {
 767                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 768                            "frame received from " MACSTR " - ignored",
 769                            (unsigned long) len, MAC2STR(mgmt->sa));
 770                 return;
 771         }
 772
 773         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 774                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 775                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 776                            ") - ignored",
 777                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 778                 return;
 779         }
 780
 781         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 782                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 783                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 784                            ") - ignored",
 785                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 786                 return;
 787         }
 788
 789         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 790         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 791         status_code = le_to_host16(mgmt->u.auth.status_code);
 792
 793         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 794                    " (alg=%d transaction=%d status=%d)",
 795                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 796
 797         if (adhoc) {
 798                 /* IEEE 802.11 standard does not require authentication in IBSS
 799                  * networks and most implementations do not seem to use it.
 800                  * However, try to reply to authentication attempts if someone
 801                  * has actually implemented this.
 802                  * TODO: Could implement shared key authentication. */
 803                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 804                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 805                                    "authentication frame (alg=%d "
 806                                    "transaction=%d)",
 807                                    auth_alg, auth_transaction);
 808                         return;
 809                 }
 810                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 811         }
 812
 813         if (auth_alg != wpa_s->mlme.auth_alg ||
 814             auth_transaction != wpa_s->mlme.auth_transaction) {
 815                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 816                            "(alg=%d transaction=%d)",
 817                            auth_alg, auth_transaction);
 818                 return;
 819         }
 820
 821         if (status_code != WLAN_STATUS_SUCCESS) {
 822                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 823                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
 824                            status_code);
 825                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 826                         const int num_algs = 3;
 827                         u8 algs[num_algs];
 828                         int i, pos;
 829                         algs[0] = algs[1] = algs[2] = 0xff;
 830                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
 831                                 algs[0] = WLAN_AUTH_OPEN;
 832                         if (wpa_s->mlme.auth_algs &
 833                             IEEE80211_AUTH_ALG_SHARED_KEY)
 834                                 algs[1] = WLAN_AUTH_SHARED_KEY;
 835                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
 836                                 algs[2] = WLAN_AUTH_LEAP;
 837                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
 838                                 pos = 0;
 839                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
 840                                 pos = 1;
 841                         else
 842                                 pos = 2;
 843                         for (i = 0; i < num_algs; i++) {
 844                                 pos++;
 845                                 if (pos >= num_algs)
 846                                         pos = 0;
 847                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
 848                                     algs[pos] == 0xff)
 849                                         continue;
 850                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
 851                                     !ieee80211_sta_wep_configured(wpa_s))
 852                                         continue;
 853                                 wpa_s->mlme.auth_alg = algs[pos];
 854                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
 855                                            "for next try",
 856                                            wpa_s->mlme.auth_alg);
 857                                 break;
 858                         }
 859                 }
 860                 return;
 861         }
 862
 863         switch (wpa_s->mlme.auth_alg) {
 864         case WLAN_AUTH_OPEN:
 865         case WLAN_AUTH_LEAP:
 866                 ieee80211_auth_completed(wpa_s);
 867                 break;
 868         case WLAN_AUTH_SHARED_KEY:
 869                 if (wpa_s->mlme.auth_transaction == 4)
 870                         ieee80211_auth_completed(wpa_s);
 871                 else
 872                         ieee80211_auth_challenge(wpa_s, mgmt, len,
 873                                                  rx_status);
 874                 break;
 875 #ifdef CONFIG_IEEE80211R
 876         case WLAN_AUTH_FT:
 877         {
 878                 union wpa_event_data data;
 879                 os_memset(&data, 0, sizeof(data));
 880                 data.ft_ies.ies = mgmt->u.auth.variable;
 881                 data.ft_ies.ies_len = len -
 882                         (mgmt->u.auth.variable - (u8 *) mgmt);
 883                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
 884                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
 885                 ieee80211_auth_completed(wpa_s);
 886                 break;
 887         }
 888 #endif /* CONFIG_IEEE80211R */
 889         }
 890 }
 891
 892
 893 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
 894                                      struct ieee80211_mgmt *mgmt,
 895                                      size_t len,
 896                                      struct ieee80211_rx_status *rx_status)
 897 {
 898         u16 reason_code;
 899
 900         if (len < 24 + 2) {
 901                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
 902                            "frame received from " MACSTR " - ignored",
 903                            (unsigned long) len, MAC2STR(mgmt->sa));
 904                 return;
 905         }
 906
 907         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 908                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
 909                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 910                            ") - ignored",
 911                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 912                 return;
 913         }
 914
 915         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
 916
 917         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
 918                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 919
 920         if (wpa_s->mlme.authenticated)
 921                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
 922
 923         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
 924             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
 925             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 926                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 927                 ieee80211_reschedule_timer(wpa_s,
 928                                            IEEE80211_RETRY_AUTH_INTERVAL);
 929         }
 930
 931         ieee80211_set_associated(wpa_s, 0);
 932         wpa_s->mlme.authenticated = 0;
 933 }
 934
 935
 936 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
 937                                        struct ieee80211_mgmt *mgmt,
 938                                        size_t len,
 939                                        struct ieee80211_rx_status *rx_status)
 940 {
 941         u16 reason_code;
 942
 943         if (len < 24 + 2) {
 944                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
 945                            "frame received from " MACSTR " - ignored",
 946                            (unsigned long) len, MAC2STR(mgmt->sa));
 947                 return;
 948         }
 949
 950         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 951                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
 952                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 953                            ") - ignored",
 954                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 955                 return;
 956         }
 957
 958         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
 959
 960         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
 961                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 962
 963         if (wpa_s->mlme.associated)
 964                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
 965
 966         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 967                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 968                 ieee80211_reschedule_timer(wpa_s,
 969                                            IEEE80211_RETRY_AUTH_INTERVAL);
 970         }
 971
 972         ieee80211_set_associated(wpa_s, 0);
 973 }
 974
 975
 976 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
 977                                    struct ieee802_11_elems *elems)
 978 {
 979 #ifdef CONFIG_IEEE80211R
 980         const u8 *mobility_domain = NULL;
 981         const u8 *r0kh_id = NULL;
 982         size_t r0kh_id_len = 0;
 983         const u8 *r1kh_id = NULL;
 984         struct rsn_ftie *hdr;
 985         const u8 *pos, *end;
 986
 987         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
 988                 mobility_domain = elems->mdie;
 989         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
 990                 end = elems->ftie + elems->ftie_len;
 991                 hdr = (struct rsn_ftie *) elems->ftie;
 992                 pos = (const u8 *) (hdr + 1);
 993                 while (pos + 1 < end) {
 994                         if (pos + 2 + pos[1] > end)
 995                                 break;
 996                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
 997                             pos[1] == FT_R1KH_ID_LEN)
 998                                 r1kh_id = pos + 2;
 999                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1000                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1001                                 r0kh_id = pos + 2;
1002                                 r0kh_id_len = pos[1];
1003                         }
1004                         pos += 2 + pos[1];
1005                 }
1006         }
1007         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1008                                     r0kh_id_len, r1kh_id);
1009 #else /* CONFIG_IEEE80211R */
1010         return 0;
1011 #endif /* CONFIG_IEEE80211R */
1012 }
1013
1014
1015 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1016                                          struct ieee80211_mgmt *mgmt,
1017                                          size_t len,
1018                                          struct ieee80211_rx_status *rx_status,
1019                                          int reassoc)
1020 {
1021         u8 rates[32];
1022         size_t rates_len;
1023         u16 capab_info, status_code, aid;
1024         struct ieee802_11_elems elems;
1025         u8 *pos;
1026
1027         /* AssocResp and ReassocResp have identical structure, so process both
1028          * of them in this function. */
1029
1030         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1031                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1032                            MACSTR ", but not in associate state - ignored",
1033                            MAC2STR(mgmt->sa));
1034                 return;
1035         }
1036
1037         if (len < 24 + 6) {
1038                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1039                            "frame received from " MACSTR " - ignored",
1040                            (unsigned long) len, MAC2STR(mgmt->sa));
1041                 return;
1042         }
1043
1044         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1045                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1046                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1047                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1048                 return;
1049         }
1050
1051         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1052         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1053         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1054         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1055                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1056                            "not set", aid);
1057         aid &= ~(BIT(15) | BIT(14));
1058
1059         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1060                    " (capab=0x%x status=%d aid=%d)",
1061                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1062                    capab_info, status_code, aid);
1063
1064         pos = mgmt->u.assoc_resp.variable;
1065         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
1066             == ParseFailed) {
1067                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1068                 return;
1069         }
1070
1071         if (status_code != WLAN_STATUS_SUCCESS) {
1072                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1073                            status_code);
1074 #ifdef CONFIG_IEEE80211W
1075                 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1076                     elems.timeout_int && elems.timeout_int_len == 5 &&
1077                     elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
1078                         u32 tu, ms;
1079                         tu = WPA_GET_LE32(elems.timeout_int + 1);
1080                         ms = tu * 1024 / 1000;
1081                         wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1082                                    "temporarily; comeback duration %u TU "
1083                                    "(%u ms)", tu, ms);
1084                         if (ms > IEEE80211_ASSOC_TIMEOUT) {
1085                                 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1086                                            "based on comeback duration");
1087                                 ieee80211_reschedule_timer(wpa_s, ms);
1088                         }
1089                 }
1090 #endif /* CONFIG_IEEE80211W */
1091                 return;
1092         }
1093
1094         if (elems.supp_rates == NULL) {
1095                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1096                            "AssocResp");
1097                 return;
1098         }
1099
1100         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1101                 if (!reassoc) {
1102                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1103                                    "association, not reassociation, response "
1104                                    "with FT");
1105                         return;
1106                 }
1107                 if (wpa_ft_validate_reassoc_resp(
1108                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1109                             mgmt->sa) < 0) {
1110                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1111                                    "Resp failed");
1112                         return;
1113                 }
1114         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1115                 return;
1116
1117         wpa_printf(MSG_DEBUG, "MLME: associated");
1118         wpa_s->mlme.aid = aid;
1119         wpa_s->mlme.ap_capab = capab_info;
1120
1121         os_free(wpa_s->mlme.assocresp_ies);
1122         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1123         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1124         if (wpa_s->mlme.assocresp_ies) {
1125                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1126                           wpa_s->mlme.assocresp_ies_len);
1127         }
1128
1129         ieee80211_set_associated(wpa_s, 1);
1130
1131         rates_len = elems.supp_rates_len;
1132         if (rates_len > sizeof(rates))
1133                 rates_len = sizeof(rates);
1134         os_memcpy(rates, elems.supp_rates, rates_len);
1135         if (elems.ext_supp_rates) {
1136                 size_t _len = elems.ext_supp_rates_len;
1137                 if (_len > sizeof(rates) - rates_len)
1138                         _len = sizeof(rates) - rates_len;
1139                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1140                 rates_len += _len;
1141         }
1142
1143         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1144                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1145                            "netstack");
1146         }
1147         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1148             0) {
1149                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1150                            "netstack");
1151         }
1152
1153         /* Remove STA entry before adding a new one just in case to avoid
1154          * problems with existing configuration (e.g., keys). */
1155         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1156         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1157                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1158                            "netstack");
1159         }
1160
1161         if (elems.wmm && wpa_s->mlme.wmm_enabled)
1162                 ieee80211_sta_wmm_params(wpa_s, elems.wmm, elems.wmm_len);
1163
1164         ieee80211_associated(wpa_s);
1165 }
1166
1167
1168 /* Caller must hold local->sta_bss_lock */
1169 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1170                                      struct ieee80211_sta_bss *bss)
1171 {
1172         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1173         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1174 }
1175
1176
1177 /* Caller must hold local->sta_bss_lock */
1178 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1179                                      struct ieee80211_sta_bss *bss)
1180 {
1181         struct ieee80211_sta_bss *b, *prev = NULL;
1182         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1183         while (b) {
1184                 if (b == bss) {
1185                         if (prev == NULL) {
1186                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1187                                         = bss->hnext;
1188                         } else {
1189                                 prev->hnext = bss->hnext;
1190                         }
1191                         break;
1192                 }
1193                 prev = b;
1194                 b = b->hnext;
1195         }
1196 }
1197
1198
1199 static struct ieee80211_sta_bss *
1200 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1201 {
1202         struct ieee80211_sta_bss *bss;
1203
1204         bss = os_zalloc(sizeof(*bss));
1205         if (bss == NULL)
1206                 return NULL;
1207         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1208
1209         /* TODO: order by RSSI? */
1210         bss->next = wpa_s->mlme.sta_bss_list;
1211         wpa_s->mlme.sta_bss_list = bss;
1212         __ieee80211_bss_hash_add(wpa_s, bss);
1213         return bss;
1214 }
1215
1216
1217 static struct ieee80211_sta_bss *
1218 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1219 {
1220         struct ieee80211_sta_bss *bss;
1221
1222         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1223         while (bss) {
1224                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1225                         break;
1226                 bss = bss->hnext;
1227         }
1228         return bss;
1229 }
1230
1231
1232 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1233                                struct ieee80211_sta_bss *bss)
1234 {
1235         __ieee80211_bss_hash_del(wpa_s, bss);
1236         os_free(bss->ie);
1237         os_free(bss->wpa_ie);
1238         os_free(bss->rsn_ie);
1239         os_free(bss->wmm_ie);
1240         os_free(bss->mdie);
1241         os_free(bss);
1242 }
1243
1244
1245 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1246 {
1247         struct ieee80211_sta_bss *bss, *prev;
1248
1249         bss = wpa_s->mlme.sta_bss_list;
1250         wpa_s->mlme.sta_bss_list = NULL;
1251         while (bss) {
1252                 prev = bss;
1253                 bss = bss->next;
1254                 ieee80211_bss_free(wpa_s, prev);
1255         }
1256 }
1257
1258
1259 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1260                                struct ieee80211_mgmt *mgmt,
1261                                size_t len,
1262                                struct ieee80211_rx_status *rx_status,
1263                                int beacon)
1264 {
1265         struct ieee802_11_elems elems;
1266         size_t baselen;
1267         int channel, invalid = 0, clen;
1268         struct ieee80211_sta_bss *bss;
1269         u64 timestamp;
1270         u8 *pos, *ie_pos;
1271         size_t ie_len;
1272
1273         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1274                 return; /* ignore ProbeResp to foreign address */
1275
1276 #if 0
1277         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1278                    beacon ? "Beacon" : "Probe Response",
1279                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1280 #endif
1281
1282         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1283         if (baselen > len)
1284                 return;
1285
1286         pos = mgmt->u.beacon.timestamp;
1287         timestamp = WPA_GET_LE64(pos);
1288
1289 #if 0 /* FIX */
1290         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1291             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1292 #ifdef IEEE80211_IBSS_DEBUG
1293                 static unsigned long last_tsf_debug = 0;
1294                 u64 tsf;
1295                 if (local->hw->get_tsf)
1296                         tsf = local->hw->get_tsf(local->mdev);
1297                 else
1298                         tsf = -1LLU;
1299                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1300                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1301                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1302                                    "@%ld",
1303                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1304                                    tsf, timestamp, tsf - timestamp, jiffies);
1305                         last_tsf_debug = jiffies;
1306                 }
1307 #endif /* IEEE80211_IBSS_DEBUG */
1308         }
1309 #endif
1310
1311         ie_pos = mgmt->u.beacon.variable;
1312         ie_len = len - baselen;
1313         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems, 0) == ParseFailed)
1314                 invalid = 1;
1315
1316 #if 0 /* FIX */
1317         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1318             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1319             (sta = sta_info_get(local, mgmt->sa))) {
1320                 struct ieee80211_rate *rates;
1321                 size_t num_rates;
1322                 u32 supp_rates, prev_rates;
1323                 int i, j, oper_mode;
1324
1325                 rates = local->curr_rates;
1326                 num_rates = local->num_curr_rates;
1327                 oper_mode = wpa_s->mlme.sta_scanning ?
1328                         local->scan_oper_phymode : local->conf.phymode;
1329                 for (i = 0; i < local->hw->num_modes; i++) {
1330                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1331                         if (oper_mode == mode->mode) {
1332                                 rates = mode->rates;
1333                                 num_rates = mode->num_rates;
1334                                 break;
1335                         }
1336                 }
1337
1338                 supp_rates = 0;
1339                 for (i = 0; i < elems.supp_rates_len +
1340                              elems.ext_supp_rates_len; i++) {
1341                         u8 rate = 0;
1342                         int own_rate;
1343                         if (i < elems.supp_rates_len)
1344                                 rate = elems.supp_rates[i];
1345                         else if (elems.ext_supp_rates)
1346                                 rate = elems.ext_supp_rates
1347                                         [i - elems.supp_rates_len];
1348                         own_rate = 5 * (rate & 0x7f);
1349                         if (oper_mode == MODE_ATHEROS_TURBO)
1350                                 own_rate *= 2;
1351                         for (j = 0; j < num_rates; j++)
1352                                 if (rates[j].rate == own_rate)
1353                                         supp_rates |= BIT(j);
1354                 }
1355
1356                 prev_rates = sta->supp_rates;
1357                 sta->supp_rates &= supp_rates;
1358                 if (sta->supp_rates == 0) {
1359                         /* No matching rates - this should not really happen.
1360                          * Make sure that at least one rate is marked
1361                          * supported to avoid issues with TX rate ctrl. */
1362                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1363                 }
1364                 if (sta->supp_rates != prev_rates) {
1365                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1366                                    "for " MACSTR " based on beacon info "
1367                                    "(0x%x & 0x%x -> 0x%x)",
1368                                    MAC2STR(sta->addr), prev_rates,
1369                                    supp_rates, sta->supp_rates);
1370                 }
1371                 sta_info_release(local, sta);
1372         }
1373 #endif
1374
1375         if (elems.ssid == NULL)
1376                 return;
1377
1378         if (elems.ds_params && elems.ds_params_len == 1)
1379                 channel = elems.ds_params[0];
1380         else
1381                 channel = rx_status->channel;
1382
1383         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1384         if (bss == NULL) {
1385                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1386                 if (bss == NULL)
1387                         return;
1388         } else {
1389 #if 0
1390                 /* TODO: order by RSSI? */
1391                 spin_lock_bh(&local->sta_bss_lock);
1392                 list_move_tail(&bss->list, &local->sta_bss_list);
1393                 spin_unlock_bh(&local->sta_bss_lock);
1394 #endif
1395         }
1396
1397         if (bss->probe_resp && beacon) {
1398                 /* Do not allow beacon to override data from Probe Response. */
1399                 return;
1400         }
1401
1402         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1403         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1404
1405         if (bss->ie == NULL || bss->ie_len < ie_len) {
1406                 os_free(bss->ie);
1407                 bss->ie = os_malloc(ie_len);
1408         }
1409         if (bss->ie) {
1410                 os_memcpy(bss->ie, ie_pos, ie_len);
1411                 bss->ie_len = ie_len;
1412         }
1413
1414         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1415                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1416                 bss->ssid_len = elems.ssid_len;
1417         }
1418
1419         bss->supp_rates_len = 0;
1420         if (elems.supp_rates) {
1421                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1422                 if (clen > elems.supp_rates_len)
1423                         clen = elems.supp_rates_len;
1424                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1425                           elems.supp_rates, clen);
1426                 bss->supp_rates_len += clen;
1427         }
1428         if (elems.ext_supp_rates) {
1429                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1430                 if (clen > elems.ext_supp_rates_len)
1431                         clen = elems.ext_supp_rates_len;
1432                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1433                           elems.ext_supp_rates, clen);
1434                 bss->supp_rates_len += clen;
1435         }
1436
1437         if (elems.wpa_ie &&
1438             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_ie_len ||
1439              os_memcmp(bss->wpa_ie, elems.wpa_ie, elems.wpa_ie_len))) {
1440                 os_free(bss->wpa_ie);
1441                 bss->wpa_ie = os_malloc(elems.wpa_ie_len + 2);
1442                 if (bss->wpa_ie) {
1443                         os_memcpy(bss->wpa_ie, elems.wpa_ie - 2,
1444                                   elems.wpa_ie_len + 2);
1445                         bss->wpa_ie_len = elems.wpa_ie_len + 2;
1446                 } else
1447                         bss->wpa_ie_len = 0;
1448         } else if (!elems.wpa_ie && bss->wpa_ie) {
1449                 os_free(bss->wpa_ie);
1450                 bss->wpa_ie = NULL;
1451                 bss->wpa_ie_len = 0;
1452         }
1453
1454         if (elems.rsn_ie &&
1455             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_ie_len ||
1456              os_memcmp(bss->rsn_ie, elems.rsn_ie, elems.rsn_ie_len))) {
1457                 os_free(bss->rsn_ie);
1458                 bss->rsn_ie = os_malloc(elems.rsn_ie_len + 2);
1459                 if (bss->rsn_ie) {
1460                         os_memcpy(bss->rsn_ie, elems.rsn_ie - 2,
1461                                   elems.rsn_ie_len + 2);
1462                         bss->rsn_ie_len = elems.rsn_ie_len + 2;
1463                 } else
1464                         bss->rsn_ie_len = 0;
1465         } else if (!elems.rsn_ie && bss->rsn_ie) {
1466                 os_free(bss->rsn_ie);
1467                 bss->rsn_ie = NULL;
1468                 bss->rsn_ie_len = 0;
1469         }
1470
1471         if (elems.wmm &&
1472             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_len ||
1473              os_memcmp(bss->wmm_ie, elems.wmm, elems.wmm_len))) {
1474                 os_free(bss->wmm_ie);
1475                 bss->wmm_ie = os_malloc(elems.wmm_len + 2);
1476                 if (bss->wmm_ie) {
1477                         os_memcpy(bss->wmm_ie, elems.wmm - 2,
1478                                   elems.wmm_len + 2);
1479                         bss->wmm_ie_len = elems.wmm_len + 2;
1480                 } else
1481                         bss->wmm_ie_len = 0;
1482         } else if (!elems.wmm && bss->wmm_ie) {
1483                 os_free(bss->wmm_ie);
1484                 bss->wmm_ie = NULL;
1485                 bss->wmm_ie_len = 0;
1486         }
1487
1488 #ifdef CONFIG_IEEE80211R
1489         if (elems.mdie &&
1490             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1491              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1492                 os_free(bss->mdie);
1493                 bss->mdie = os_malloc(elems.mdie_len + 2);
1494                 if (bss->mdie) {
1495                         os_memcpy(bss->mdie, elems.mdie - 2,
1496                                   elems.mdie_len + 2);
1497                         bss->mdie_len = elems.mdie_len + 2;
1498                 } else
1499                         bss->mdie_len = 0;
1500         } else if (!elems.mdie && bss->mdie) {
1501                 os_free(bss->mdie);
1502                 bss->mdie = NULL;
1503                 bss->mdie_len = 0;
1504         }
1505 #endif /* CONFIG_IEEE80211R */
1506
1507         bss->hw_mode = wpa_s->mlme.phymode;
1508         bss->channel = channel;
1509         bss->freq = wpa_s->mlme.freq;
1510         if (channel != wpa_s->mlme.channel &&
1511             (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1512              wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1513             channel >= 1 && channel <= 14) {
1514                 static const int freq_list[] = {
1515                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1516                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1517                 };
1518                 /* IEEE 802.11g/b mode can receive packets from neighboring
1519                  * channels, so map the channel into frequency. */
1520                 bss->freq = freq_list[channel - 1];
1521         }
1522         bss->timestamp = timestamp;
1523         os_get_time(&bss->last_update);
1524         bss->rssi = rx_status->ssi;
1525         if (!beacon)
1526                 bss->probe_resp++;
1527 }
1528
1529
1530 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1531                                          struct ieee80211_mgmt *mgmt,
1532                                          size_t len,
1533                                          struct ieee80211_rx_status *rx_status)
1534 {
1535         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1536 }
1537
1538
1539 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1540                                      struct ieee80211_mgmt *mgmt,
1541                                      size_t len,
1542                                      struct ieee80211_rx_status *rx_status)
1543 {
1544         int use_protection;
1545         size_t baselen;
1546         struct ieee802_11_elems elems;
1547
1548         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1549
1550         if (!wpa_s->mlme.associated ||
1551             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1552                 return;
1553
1554         /* Process beacon from the current BSS */
1555         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1556         if (baselen > len)
1557                 return;
1558
1559         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1560                                    &elems, 0) == ParseFailed)
1561                 return;
1562
1563         use_protection = 0;
1564         if (elems.erp_info && elems.erp_info_len >= 1) {
1565                 use_protection =
1566                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1567         }
1568
1569         if (use_protection != !!wpa_s->mlme.use_protection) {
1570                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1571                            ")",
1572                            use_protection ? "enabled" : "disabled",
1573                            MAC2STR(wpa_s->bssid));
1574                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1575                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1576         }
1577
1578         if (elems.wmm && wpa_s->mlme.wmm_enabled) {
1579                 ieee80211_sta_wmm_params(wpa_s, elems.wmm,
1580                                          elems.wmm_len);
1581         }
1582 }
1583
1584
1585 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1586                                         struct ieee80211_mgmt *mgmt,
1587                                         size_t len,
1588                                         struct ieee80211_rx_status *rx_status)
1589 {
1590         int tx_last_beacon, adhoc;
1591 #if 0 /* FIX */
1592         struct ieee80211_mgmt *resp;
1593 #endif
1594         u8 *pos, *end;
1595         struct wpa_ssid *ssid = wpa_s->current_ssid;
1596
1597         adhoc = ssid && ssid->mode == 1;
1598
1599         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1600             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1601                 return;
1602
1603 #if 0 /* FIX */
1604         if (local->hw->tx_last_beacon)
1605                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1606         else
1607 #endif
1608                 tx_last_beacon = 1;
1609
1610 #ifdef IEEE80211_IBSS_DEBUG
1611         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1612                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1613                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1614                    MAC2STR(mgmt->bssid), tx_last_beacon);
1615 #endif /* IEEE80211_IBSS_DEBUG */
1616
1617         if (!tx_last_beacon)
1618                 return;
1619
1620         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1621             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1622                 return;
1623
1624         end = ((u8 *) mgmt) + len;
1625         pos = mgmt->u.probe_req.variable;
1626         if (pos[0] != WLAN_EID_SSID ||
1627             pos + 2 + pos[1] > end) {
1628                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1629                            MACSTR, MAC2STR(mgmt->sa));
1630                 return;
1631         }
1632         if (pos[1] != 0 &&
1633             (pos[1] != wpa_s->mlme.ssid_len ||
1634              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1635         {
1636                 /* Ignore ProbeReq for foreign SSID */
1637                 return;
1638         }
1639
1640 #if 0 /* FIX */
1641         /* Reply with ProbeResp */
1642         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1643         if (skb == NULL)
1644                 return;
1645
1646         resp = (struct ieee80211_mgmt *) skb->data;
1647         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1648 #ifdef IEEE80211_IBSS_DEBUG
1649         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1650                    MAC2STR(resp->da));
1651 #endif /* IEEE80211_IBSS_DEBUG */
1652         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1653 #endif
1654 }
1655
1656
1657 #ifdef CONFIG_IEEE80211R
1658 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1659                                         struct ieee80211_mgmt *mgmt,
1660                                         size_t len,
1661                                         struct ieee80211_rx_status *rx_status)
1662 {
1663         union wpa_event_data data;
1664         u16 status;
1665         u8 *sta_addr, *target_ap_addr;
1666
1667         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1668                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1669                 return;
1670         }
1671
1672         /*
1673          * Only FT Action Response is needed for now since reservation
1674          * protocol is not supported.
1675          */
1676         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1677                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1678                            mgmt->u.action.u.ft_action_resp.action);
1679                 return;
1680         }
1681
1682         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1683         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1684         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1685         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1686                    " TargetAP " MACSTR " Status Code %d",
1687                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1688         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1689                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1690                            " in FT Action Response", MAC2STR(sta_addr));
1691                 return;
1692
1693         }
1694
1695         if (status) {
1696                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1697                            "failure (status code %d)", status);
1698                 /* TODO: report error to FT code(?) */
1699                 return;
1700         }
1701
1702         os_memset(&data, 0, sizeof(data));
1703         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1704         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1705                                      (u8 *) mgmt);
1706         data.ft_ies.ft_action = 1;
1707         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1708         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1709         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1710          * successfully */
1711         wpa_s->mlme.prev_bssid_set = 1;
1712         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1713         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1714         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1715         ieee80211_associate(wpa_s);
1716 }
1717 #endif /* CONFIG_IEEE80211R */
1718
1719
1720 #ifdef CONFIG_IEEE80211W
1721
1722 /* MLME-SAQuery.response */
1723 static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
1724                                             const u8 *addr, const u8 *trans_id)
1725 {
1726         struct ieee80211_mgmt *mgmt;
1727         int res;
1728         size_t len;
1729
1730         mgmt = os_zalloc(sizeof(*mgmt));
1731         if (mgmt == NULL) {
1732                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1733                            "SA Query action frame");
1734                 return -1;
1735         }
1736
1737         len = 24;
1738         os_memcpy(mgmt->da, addr, ETH_ALEN);
1739         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1740         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1741         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1742                                            WLAN_FC_STYPE_ACTION);
1743         mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
1744         mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
1745         os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
1746                   WLAN_SA_QUERY_TR_ID_LEN);
1747         len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
1748
1749         res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1750         os_free(mgmt);
1751
1752         return res;
1753 }
1754
1755
1756 static void ieee80211_rx_mgmt_sa_query_action(
1757         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1758         struct ieee80211_rx_status *rx_status)
1759 {
1760         if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
1761                 wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
1762                 return;
1763         }
1764
1765         if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
1766                 wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
1767                            mgmt->u.action.u.sa_query_req.action);
1768                 return;
1769         }
1770
1771         if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1772                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
1773                            "source " MACSTR, MAC2STR(mgmt->sa));
1774                 return;
1775         }
1776
1777         if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1778                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
1779                            "association process");
1780                 return;
1781         }
1782
1783         wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
1784         ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
1785                                          sa_query_req.trans_id);
1786 }
1787
1788 #endif /* CONFIG_IEEE80211W */
1789
1790
1791 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1792                                      struct ieee80211_mgmt *mgmt,
1793                                      size_t len,
1794                                      struct ieee80211_rx_status *rx_status)
1795 {
1796         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1797
1798         if (len < 25)
1799                 return;
1800
1801         switch (mgmt->u.action.category) {
1802 #ifdef CONFIG_IEEE80211R
1803         case WLAN_ACTION_FT:
1804                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1805                 break;
1806 #endif /* CONFIG_IEEE80211R */
1807 #ifdef CONFIG_IEEE80211W
1808         case WLAN_ACTION_SA_QUERY:
1809                 ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
1810                 break;
1811 #endif /* CONFIG_IEEE80211W */
1812         default:
1813                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1814                            mgmt->u.action.category);
1815                 break;
1816         }
1817 }
1818
1819
1820 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
1821                                   const u8 *buf, size_t len,
1822                                   struct ieee80211_rx_status *rx_status)
1823 {
1824         struct ieee80211_mgmt *mgmt;
1825         u16 fc;
1826
1827         if (len < 24)
1828                 return;
1829
1830         mgmt = (struct ieee80211_mgmt *) buf;
1831         fc = le_to_host16(mgmt->frame_control);
1832
1833         switch (WLAN_FC_GET_STYPE(fc)) {
1834         case WLAN_FC_STYPE_PROBE_REQ:
1835                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
1836                 break;
1837         case WLAN_FC_STYPE_PROBE_RESP:
1838                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
1839                 break;
1840         case WLAN_FC_STYPE_BEACON:
1841                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1842                 break;
1843         case WLAN_FC_STYPE_AUTH:
1844                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
1845                 break;
1846         case WLAN_FC_STYPE_ASSOC_RESP:
1847                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
1848                 break;
1849         case WLAN_FC_STYPE_REASSOC_RESP:
1850                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
1851                 break;
1852         case WLAN_FC_STYPE_DEAUTH:
1853                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
1854                 break;
1855         case WLAN_FC_STYPE_DISASSOC:
1856                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
1857                 break;
1858         case WLAN_FC_STYPE_ACTION:
1859                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
1860                 break;
1861         default:
1862                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
1863                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
1864                 break;
1865         }
1866 }
1867
1868
1869 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
1870                                   const u8 *buf, size_t len,
1871                                   struct ieee80211_rx_status *rx_status)
1872 {
1873         struct ieee80211_mgmt *mgmt;
1874         u16 fc;
1875
1876         if (len < 24)
1877                 return;
1878
1879         mgmt = (struct ieee80211_mgmt *) buf;
1880         fc = le_to_host16(mgmt->frame_control);
1881
1882         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
1883                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
1884                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
1885                                                      len, rx_status);
1886                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
1887                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1888                 }
1889         }
1890 }
1891
1892
1893 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
1894 {
1895         int active = 0;
1896
1897 #if 0 /* FIX */
1898         list_for_each(ptr, &local->sta_list) {
1899                 sta = list_entry(ptr, struct sta_info, list);
1900                 if (sta->dev == dev &&
1901                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1902                                jiffies)) {
1903                         active++;
1904                         break;
1905                 }
1906         }
1907 #endif
1908
1909         return active;
1910 }
1911
1912
1913 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
1914 {
1915 #if 0 /* FIX */
1916         list_for_each_safe(ptr, n, &local->sta_list) {
1917                 sta = list_entry(ptr, struct sta_info, list);
1918                 if (time_after(jiffies, sta->last_rx +
1919                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1920                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
1921                                    MACSTR, MAC2STR(sta->addr));
1922                         sta_info_free(local, sta, 1);
1923                 }
1924         }
1925 #endif
1926 }
1927
1928
1929 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
1930 {
1931         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
1932
1933         ieee80211_sta_expire(wpa_s);
1934         if (ieee80211_sta_active_ibss(wpa_s))
1935                 return;
1936
1937         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
1938                    "other IBSS networks with same SSID (merge)");
1939         ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
1940 }
1941
1942
1943 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
1944 {
1945         struct wpa_supplicant *wpa_s = eloop_ctx;
1946
1947         switch (wpa_s->mlme.state) {
1948         case IEEE80211_DISABLED:
1949                 break;
1950         case IEEE80211_AUTHENTICATE:
1951                 ieee80211_authenticate(wpa_s);
1952                 break;
1953         case IEEE80211_ASSOCIATE:
1954                 ieee80211_associate(wpa_s);
1955                 break;
1956         case IEEE80211_ASSOCIATED:
1957                 ieee80211_associated(wpa_s);
1958                 break;
1959         case IEEE80211_IBSS_SEARCH:
1960                 ieee80211_sta_find_ibss(wpa_s);
1961                 break;
1962         case IEEE80211_IBSS_JOINED:
1963                 ieee80211_sta_merge_ibss(wpa_s);
1964                 break;
1965         default:
1966                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
1967                            wpa_s->mlme.state);
1968                 break;
1969         }
1970
1971         if (ieee80211_privacy_mismatch(wpa_s)) {
1972                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
1973                            "and mixed-cell disabled - disassociate");
1974
1975                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
1976                 ieee80211_set_associated(wpa_s, 0);
1977         }
1978 }
1979
1980
1981 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
1982 {
1983         struct wpa_ssid *ssid = wpa_s->current_ssid;
1984         if (ssid && ssid->mode != 0)
1985                 return;
1986
1987 #if 0 /* FIX */
1988         if (local->hw->reset_tsf) {
1989                 /* Reset own TSF to allow time synchronization work. */
1990                 local->hw->reset_tsf(local->mdev);
1991         }
1992 #endif
1993
1994         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
1995
1996
1997         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
1998                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
1999         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2000                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2001         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2002                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2003         else
2004                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2005         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2006                    wpa_s->mlme.auth_alg);
2007         wpa_s->mlme.auth_transaction = -1;
2008         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2009         ieee80211_authenticate(wpa_s);
2010 }
2011
2012
2013 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2014 {
2015 #if 0 /* FIX */
2016         int m, c;
2017
2018         for (m = 0; m < local->hw->num_modes; m++) {
2019                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2020                 if (mode->mode != local->conf.phymode)
2021                         continue;
2022                 for (c = 0; c < mode->num_channels; c++) {
2023                         struct ieee80211_channel *chan = &mode->channels[c];
2024                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2025                             chan->chan == local->conf.channel) {
2026                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2027                                         return 1;
2028                                 break;
2029                         }
2030                 }
2031         }
2032 #endif
2033
2034         return 0;
2035 }
2036
2037
2038 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2039                                    struct ieee80211_sta_bss *bss)
2040 {
2041         int res = 0, rates, done = 0;
2042         struct ieee80211_mgmt *mgmt;
2043 #if 0 /* FIX */
2044         struct ieee80211_tx_control control;
2045         struct ieee80211_rate *rate;
2046         struct rate_control_extra extra;
2047 #endif
2048         u8 *pos, *buf;
2049         size_t len;
2050
2051         /* Remove possible STA entries from other IBSS networks. */
2052 #if 0 /* FIX */
2053         sta_info_flush(local, NULL);
2054
2055         if (local->hw->reset_tsf) {
2056                 /* Reset own TSF to allow time synchronization work. */
2057                 local->hw->reset_tsf(local->mdev);
2058         }
2059 #endif
2060         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2061
2062 #if 0 /* FIX */
2063         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2064
2065         sdata->drop_unencrypted = bss->capability &
2066                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2067 #endif
2068
2069 #if 0 /* FIX */
2070         os_memset(&rq, 0, sizeof(rq));
2071         rq.m = bss->freq * 100000;
2072         rq.e = 1;
2073         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2074 #endif
2075
2076         if (!ieee80211_ibss_allowed(wpa_s)) {
2077 #if 0 /* FIX */
2078                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2079                            "(%d MHz)", local->conf.channel,
2080                            local->conf.freq);
2081 #endif
2082                 return -1;
2083         }
2084
2085         /* Set beacon template based on scan results */
2086         buf = os_malloc(400);
2087         len = 0;
2088         do {
2089                 if (buf == NULL)
2090                         break;
2091
2092                 mgmt = (struct ieee80211_mgmt *) buf;
2093                 len += 24 + sizeof(mgmt->u.beacon);
2094                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2095                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2096                                                    WLAN_FC_STYPE_BEACON);
2097                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2098                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2099                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2100 #if 0 /* FIX */
2101                 mgmt->u.beacon.beacon_int =
2102                         host_to_le16(local->conf.beacon_int);
2103 #endif
2104                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2105
2106                 pos = buf + len;
2107                 len += 2 + wpa_s->mlme.ssid_len;
2108                 *pos++ = WLAN_EID_SSID;
2109                 *pos++ = wpa_s->mlme.ssid_len;
2110                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2111
2112                 rates = bss->supp_rates_len;
2113                 if (rates > 8)
2114                         rates = 8;
2115                 pos = buf + len;
2116                 len += 2 + rates;
2117                 *pos++ = WLAN_EID_SUPP_RATES;
2118                 *pos++ = rates;
2119                 os_memcpy(pos, bss->supp_rates, rates);
2120
2121                 pos = buf + len;
2122                 len += 2 + 1;
2123                 *pos++ = WLAN_EID_DS_PARAMS;
2124                 *pos++ = 1;
2125                 *pos++ = bss->channel;
2126
2127                 pos = buf + len;
2128                 len += 2 + 2;
2129                 *pos++ = WLAN_EID_IBSS_PARAMS;
2130                 *pos++ = 2;
2131                 /* FIX: set ATIM window based on scan results */
2132                 *pos++ = 0;
2133                 *pos++ = 0;
2134
2135                 if (bss->supp_rates_len > 8) {
2136                         rates = bss->supp_rates_len - 8;
2137                         pos = buf + len;
2138                         len += 2 + rates;
2139                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2140                         *pos++ = rates;
2141                         os_memcpy(pos, &bss->supp_rates[8], rates);
2142                 }
2143
2144 #if 0 /* FIX */
2145                 os_memset(&control, 0, sizeof(control));
2146                 control.pkt_type = PKT_PROBE_RESP;
2147                 os_memset(&extra, 0, sizeof(extra));
2148                 extra.endidx = local->num_curr_rates;
2149                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2150                 if (rate == NULL) {
2151                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2152                                    "rate for IBSS beacon");
2153                         break;
2154                 }
2155                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2156                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2157                         rate->val2 : rate->val;
2158                 control.antenna_sel = local->conf.antenna_sel;
2159                 control.power_level = local->conf.power_level;
2160                 control.no_ack = 1;
2161                 control.retry_limit = 1;
2162                 control.rts_cts_duration = 0;
2163 #endif
2164
2165 #if 0 /* FIX */
2166                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2167                 if (wpa_s->mlme.probe_resp) {
2168                         mgmt = (struct ieee80211_mgmt *)
2169                                 wpa_s->mlme.probe_resp->data;
2170                         mgmt->frame_control =
2171                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2172                                              WLAN_FC_STYPE_PROBE_RESP);
2173                 } else {
2174                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2175                                    "ProbeResp template for IBSS");
2176                 }
2177
2178                 if (local->hw->beacon_update &&
2179                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2180                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2181                                    "template based on scan results");
2182                         skb = NULL;
2183                 }
2184
2185                 rates = 0;
2186                 for (i = 0; i < bss->supp_rates_len; i++) {
2187                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2188                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2189                                 rate *= 2;
2190                         for (j = 0; j < local->num_curr_rates; j++)
2191                                 if (local->curr_rates[j].rate == rate)
2192                                         rates |= BIT(j);
2193                 }
2194                 wpa_s->mlme.supp_rates_bits = rates;
2195 #endif
2196                 done = 1;
2197         } while (0);
2198
2199         os_free(buf);
2200         if (!done) {
2201                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2202                            "template");
2203         }
2204
2205         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2206         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2207
2208         return res;
2209 }
2210
2211
2212 #if 0 /* FIX */
2213 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2214 {
2215         struct ieee80211_sta_bss *bss;
2216         u8 bssid[ETH_ALEN], *pos;
2217         int i;
2218
2219 #if 0
2220         /* Easier testing, use fixed BSSID. */
2221         os_memset(bssid, 0xfe, ETH_ALEN);
2222 #else
2223         /* Generate random, not broadcast, locally administered BSSID. Mix in
2224          * own MAC address to make sure that devices that do not have proper
2225          * random number generator get different BSSID. */
2226         os_get_random(bssid, ETH_ALEN);
2227         for (i = 0; i < ETH_ALEN; i++)
2228                 bssid[i] ^= wpa_s->own_addr[i];
2229         bssid[0] &= ~0x01;
2230         bssid[0] |= 0x02;
2231 #endif
2232
2233         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2234                    MACSTR "", MAC2STR(bssid));
2235
2236         bss = ieee80211_bss_add(wpa_s, bssid);
2237         if (bss == NULL)
2238                 return -ENOMEM;
2239
2240 #if 0 /* FIX */
2241         if (local->conf.beacon_int == 0)
2242                 local->conf.beacon_int = 100;
2243         bss->beacon_int = local->conf.beacon_int;
2244         bss->hw_mode = local->conf.phymode;
2245         bss->channel = local->conf.channel;
2246         bss->freq = local->conf.freq;
2247 #endif
2248         os_get_time(&bss->last_update);
2249         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2250 #if 0 /* FIX */
2251         if (sdata->default_key) {
2252                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2253         } else
2254                 sdata->drop_unencrypted = 0;
2255         bss->supp_rates_len = local->num_curr_rates;
2256 #endif
2257         pos = bss->supp_rates;
2258 #if 0 /* FIX */
2259         for (i = 0; i < local->num_curr_rates; i++) {
2260                 int rate = local->curr_rates[i].rate;
2261                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2262                         rate /= 2;
2263                 *pos++ = (u8) (rate / 5);
2264         }
2265 #endif
2266
2267         return ieee80211_sta_join_ibss(wpa_s, bss);
2268 }
2269 #endif
2270
2271
2272 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2273 {
2274         struct ieee80211_sta_bss *bss;
2275         int found = 0;
2276         u8 bssid[ETH_ALEN];
2277         int active_ibss;
2278         struct os_time now;
2279
2280         if (wpa_s->mlme.ssid_len == 0)
2281                 return -EINVAL;
2282
2283         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2284 #ifdef IEEE80211_IBSS_DEBUG
2285         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2286                    active_ibss);
2287 #endif /* IEEE80211_IBSS_DEBUG */
2288         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2289                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2290                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2291                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2292                         continue;
2293 #ifdef IEEE80211_IBSS_DEBUG
2294                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2295                            MAC2STR(bss->bssid));
2296 #endif /* IEEE80211_IBSS_DEBUG */
2297                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2298                 found = 1;
2299                 if (active_ibss ||
2300                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2301                         break;
2302         }
2303
2304 #ifdef IEEE80211_IBSS_DEBUG
2305         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2306                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2307 #endif /* IEEE80211_IBSS_DEBUG */
2308         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2309             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2310                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2311                            " based on configured SSID",
2312                            MAC2STR(bssid));
2313                 return ieee80211_sta_join_ibss(wpa_s, bss);
2314         }
2315 #ifdef IEEE80211_IBSS_DEBUG
2316         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2317 #endif /* IEEE80211_IBSS_DEBUG */
2318
2319         /* Selected IBSS not found in current scan results - try to scan */
2320         os_get_time(&now);
2321 #if 0 /* FIX */
2322         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2323             !ieee80211_sta_active_ibss(wpa_s)) {
2324                 ieee80211_reschedule_timer(wpa_s,
2325                                            IEEE80211_IBSS_MERGE_INTERVAL);
2326         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2327                               IEEE80211_SCAN_INTERVAL)) {
2328                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2329                            "to join");
2330                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2331                                               wpa_s->mlme.ssid_len);
2332         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2333                 int interval = IEEE80211_SCAN_INTERVAL;
2334
2335                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2336                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2337                         if (wpa_s->mlme.create_ibss &&
2338                             ieee80211_ibss_allowed(wpa_s))
2339                                 return ieee80211_sta_create_ibss(wpa_s);
2340                         if (wpa_s->mlme.create_ibss) {
2341                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2342                                            "on the configured channel %d "
2343                                            "(%d MHz)",
2344                                            local->conf.channel,
2345                                            local->conf.freq);
2346                         }
2347
2348                         /* No IBSS found - decrease scan interval and continue
2349                          * scanning. */
2350                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2351                 }
2352
2353                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2354                 ieee80211_reschedule_timer(wpa_s, interval);
2355                 return 0;
2356         }
2357 #endif
2358
2359         return 0;
2360 }
2361
2362
2363 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2364                            size_t *len)
2365 {
2366         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2367         *len = wpa_s->mlme.ssid_len;
2368         return 0;
2369 }
2370
2371
2372 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2373                             struct wpa_driver_associate_params *params)
2374 {
2375         struct ieee80211_sta_bss *bss;
2376
2377         wpa_s->mlme.bssid_set = 0;
2378         wpa_s->mlme.freq = params->freq;
2379         if (params->bssid) {
2380                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2381                 if (!is_zero_ether_addr(params->bssid))
2382                         wpa_s->mlme.bssid_set = 1;
2383                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2384                 if (bss) {
2385                         wpa_s->mlme.phymode = bss->hw_mode;
2386                         wpa_s->mlme.channel = bss->channel;
2387                         wpa_s->mlme.freq = bss->freq;
2388                 }
2389         }
2390
2391 #if 0 /* FIX */
2392         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2393          * not defined. */
2394         if (local->hw->conf_tx) {
2395                 struct ieee80211_tx_queue_params qparam;
2396                 int i;
2397
2398                 os_memset(&qparam, 0, sizeof(qparam));
2399                 /* TODO: are these ok defaults for all hw_modes? */
2400                 qparam.aifs = 2;
2401                 qparam.cw_min =
2402                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2403                 qparam.cw_max = 1023;
2404                 qparam.burst_time = 0;
2405                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2406                 {
2407                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2408                                            &qparam);
2409                 }
2410                 /* IBSS uses different parameters for Beacon sending */
2411                 qparam.cw_min++;
2412                 qparam.cw_min *= 2;
2413                 qparam.cw_min--;
2414                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2415         }
2416 #endif
2417
2418         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2419             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2420                 wpa_s->mlme.prev_bssid_set = 0;
2421         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2422         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2423                   MAX_SSID_LEN - params->ssid_len);
2424         wpa_s->mlme.ssid_len = params->ssid_len;
2425         wpa_s->mlme.ssid_set = 1;
2426
2427         os_free(wpa_s->mlme.extra_ie);
2428         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2429                 wpa_s->mlme.extra_ie = NULL;
2430                 wpa_s->mlme.extra_ie_len = 0;
2431         } else {
2432                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2433                 if (wpa_s->mlme.extra_ie == NULL) {
2434                         wpa_s->mlme.extra_ie_len = 0;
2435                         return -1;
2436                 }
2437                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2438                           params->wpa_ie_len);
2439                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2440         }
2441
2442         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2443
2444         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2445                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2446
2447         if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2448                 os_get_time(&wpa_s->mlme.ibss_join_req);
2449                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2450                 return ieee80211_sta_find_ibss(wpa_s);
2451         }
2452
2453         if (wpa_s->mlme.bssid_set)
2454                 ieee80211_sta_new_auth(wpa_s);
2455
2456         return 0;
2457 }
2458
2459
2460 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2461 {
2462         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2463         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2464         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2465 }
2466
2467
2468 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2469 {
2470         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2471         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2472         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2473         if (wpa_s->mlme.freq == 0)
2474                 return 0;
2475         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2476                                          wpa_s->mlme.channel,
2477                                          wpa_s->mlme.freq);
2478 }
2479
2480
2481 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2482 {
2483         size_t m;
2484         int c;
2485
2486         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2487                 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2488                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2489                         continue;
2490                 for (c = 0; c < mode->num_channels; c++) {
2491                         struct wpa_channel_data *chan = &mode->channels[c];
2492                         if (chan->flag & WPA_CHAN_W_SCAN &&
2493                             chan->chan == wpa_s->mlme.channel) {
2494                                 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2495                                         return 1;
2496                                 break;
2497                         }
2498                 }
2499         }
2500
2501         return 0;
2502 }
2503
2504
2505 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2506 {
2507         struct wpa_supplicant *wpa_s = eloop_ctx;
2508         struct wpa_hw_modes *mode;
2509         struct wpa_channel_data *chan;
2510         int skip = 0;
2511         int timeout = 0;
2512         struct wpa_ssid *ssid = wpa_s->current_ssid;
2513         int adhoc;
2514
2515         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2516                 return;
2517
2518         adhoc = ssid && ssid->mode == 1;
2519
2520         switch (wpa_s->mlme.scan_state) {
2521         case SCAN_SET_CHANNEL:
2522                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2523                 if (wpa_s->mlme.scan_hw_mode_idx >=
2524                     (int) wpa_s->mlme.num_modes ||
2525                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2526                      (int) wpa_s->mlme.num_modes
2527                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2528                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2529                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2530                                            "restore operational channel after "
2531                                            "scan");
2532                         }
2533                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2534                         wpa_s->mlme.sta_scanning = 0;
2535                         os_get_time(&wpa_s->mlme.last_scan_completed);
2536                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2537                         if (adhoc) {
2538                                 if (!wpa_s->mlme.bssid_set ||
2539                                     (wpa_s->mlme.state ==
2540                                      IEEE80211_IBSS_JOINED &&
2541                                      !ieee80211_sta_active_ibss(wpa_s)))
2542                                         ieee80211_sta_find_ibss(wpa_s);
2543                         }
2544                         return;
2545                 }
2546                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2547                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2548                 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2549                     (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2550                     (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2551                      mode->mode == WPA_MODE_IEEE80211B &&
2552                      wpa_s->mlme.scan_skip_11b))
2553                         skip = 1;
2554
2555                 if (!skip) {
2556                         wpa_printf(MSG_MSGDUMP,
2557                                    "MLME: scan channel %d (%d MHz)",
2558                                    chan->chan, chan->freq);
2559
2560                         wpa_s->mlme.channel = chan->chan;
2561                         wpa_s->mlme.freq = chan->freq;
2562                         wpa_s->mlme.phymode = mode->mode;
2563                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2564                                                       chan->chan, chan->freq))
2565                         {
2566                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2567                                            "channel %d (%d MHz) for scan",
2568                                            chan->chan, chan->freq);
2569                                 skip = 1;
2570                         }
2571                 }
2572
2573                 wpa_s->mlme.scan_channel_idx++;
2574                 if (wpa_s->mlme.scan_channel_idx >=
2575                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2576                     num_channels) {
2577                         wpa_s->mlme.scan_hw_mode_idx++;
2578                         wpa_s->mlme.scan_channel_idx = 0;
2579                 }
2580
2581                 if (skip) {
2582                         timeout = 0;
2583                         break;
2584                 }
2585
2586                 timeout = IEEE80211_PROBE_DELAY;
2587                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2588                 break;
2589         case SCAN_SEND_PROBE:
2590                 if (ieee80211_active_scan(wpa_s)) {
2591                         ieee80211_send_probe_req(wpa_s, NULL,
2592                                                  wpa_s->mlme.scan_ssid,
2593                                                  wpa_s->mlme.scan_ssid_len);
2594                         timeout = IEEE80211_CHANNEL_TIME;
2595                 } else {
2596                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2597                 }
2598                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2599                 break;
2600         }
2601
2602         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2603                                ieee80211_sta_scan_timer, wpa_s, NULL);
2604 }
2605
2606
2607 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2608                            size_t ssid_len)
2609 {
2610         if (ssid_len > MAX_SSID_LEN)
2611                 return -1;
2612
2613         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2614          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2615          * BSSID: MACAddress
2616          * SSID
2617          * ScanType: ACTIVE, PASSIVE
2618          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2619          *    a Probe frame during active scanning
2620          * ChannelList
2621          * MinChannelTime (>= ProbeDelay), in TU
2622          * MaxChannelTime: (>= MinChannelTime), in TU
2623          */
2624
2625          /* MLME-SCAN.confirm
2626           * BSSDescriptionSet
2627           * ResultCode: SUCCESS, INVALID_PARAMETERS
2628          */
2629
2630         /* TODO: if assoc, move to power save mode for the duration of the
2631          * scan */
2632
2633         if (wpa_s->mlme.sta_scanning)
2634                 return -1;
2635
2636         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2637
2638         ieee80211_sta_save_oper_chan(wpa_s);
2639
2640         wpa_s->mlme.sta_scanning = 1;
2641         /* TODO: stop TX queue? */
2642
2643         if (ssid) {
2644                 wpa_s->mlme.scan_ssid_len = ssid_len;
2645                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2646         } else
2647                 wpa_s->mlme.scan_ssid_len = 0;
2648         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2649                                         * supported */
2650         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2651         wpa_s->mlme.scan_hw_mode_idx = 0;
2652         wpa_s->mlme.scan_channel_idx = 0;
2653         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2654
2655         return 0;
2656 }
2657
2658
2659 struct wpa_scan_results *
2660 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2661 {
2662         size_t ap_num = 0;
2663         struct wpa_scan_results *res;
2664         struct wpa_scan_res *r;
2665         struct ieee80211_sta_bss *bss;
2666
2667         res = os_zalloc(sizeof(*res));
2668         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2669                 ap_num++;
2670         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2671         if (res->res == NULL) {
2672                 os_free(res);
2673                 return NULL;
2674         }
2675
2676         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2677                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2678                 if (r == NULL)
2679                         break;
2680                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2681                 r->freq = bss->freq;
2682                 r->beacon_int = bss->beacon_int;
2683                 r->caps = bss->capability;
2684                 r->level = bss->rssi;
2685                 r->tsf = bss->timestamp;
2686                 if (bss->ie) {
2687                         r->ie_len = bss->ie_len;
2688                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2689                 }
2690
2691                 res->res[res->num++] = r;
2692         }
2693
2694         return res;
2695 }
2696
2697
2698 #if 0 /* FIX */
2699 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2700                                          struct sk_buff *skb, u8 *bssid,
2701                                          u8 *addr)
2702 {
2703         struct ieee80211_local *local = dev->priv;
2704         struct list_head *ptr;
2705         struct sta_info *sta;
2706         struct wpa_supplicant *sta_dev = NULL;
2707
2708         /* TODO: Could consider removing the least recently used entry and
2709          * allow new one to be added. */
2710         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2711                 if (net_ratelimit()) {
2712                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2713                                    "STA entry " MACSTR, MAC2STR(addr));
2714                 }
2715                 return NULL;
2716         }
2717
2718         spin_lock_bh(&local->sub_if_lock);
2719         list_for_each(ptr, &local->sub_if_list) {
2720                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2721                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2722                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2723                         sta_dev = sdata->dev;
2724                         break;
2725                 }
2726         }
2727         spin_unlock_bh(&local->sub_if_lock);
2728
2729         if (sta_dev == NULL)
2730                 return NULL;
2731
2732         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2733                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2734
2735         sta = sta_info_add(wpa_s, addr);
2736         if (sta == NULL) {
2737                 return NULL;
2738         }
2739
2740         sta->dev = sta_dev;
2741         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2742
2743         rate_control_rate_init(local, sta);
2744
2745         return sta; /* caller will call sta_info_release() */
2746 }
2747 #endif
2748
2749
2750 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2751 {
2752         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2753
2754         ieee80211_send_deauth(wpa_s, reason);
2755         ieee80211_set_associated(wpa_s, 0);
2756         return 0;
2757 }
2758
2759
2760 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2761 {
2762         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2763
2764         if (!wpa_s->mlme.associated)
2765                 return -1;
2766
2767         ieee80211_send_disassoc(wpa_s, reason);
2768         ieee80211_set_associated(wpa_s, 0);
2769         return 0;
2770 }
2771
2772
2773 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2774                       struct ieee80211_rx_status *rx_status)
2775 {
2776         struct ieee80211_mgmt *mgmt;
2777         u16 fc;
2778         const u8 *pos;
2779
2780         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2781
2782         if (wpa_s->mlme.sta_scanning) {
2783                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2784                 return;
2785         }
2786
2787         if (len < 24)
2788                 return;
2789
2790         mgmt = (struct ieee80211_mgmt *) buf;
2791         fc = le_to_host16(mgmt->frame_control);
2792
2793         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2794                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2795         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2796                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2797                     WLAN_FC_FROMDS)
2798                         return;
2799                 /* mgmt->sa is actually BSSID for FromDS data frames */
2800                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2801                         return;
2802                 /* Skip IEEE 802.11 and LLC headers */
2803                 pos = buf + 24 + 6;
2804                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2805                         return;
2806                 pos += 2;
2807                 /* mgmt->bssid is actually BSSID for SA data frames */
2808                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2809                                         pos, buf + len - pos);
2810         }
2811 }
2812
2813
2814 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2815                                     size_t num_hw_features)
2816 {
2817         size_t i;
2818
2819         if (hw_features == NULL)
2820                 return;
2821
2822         for (i = 0; i < num_hw_features; i++) {
2823                 os_free(hw_features[i].channels);
2824                 os_free(hw_features[i].rates);
2825         }
2826
2827         os_free(hw_features);
2828 }
2829
2830
2831 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
2832 {
2833         u16 num_modes, flags;
2834
2835         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
2836                                                         &flags);
2837         if (wpa_s->mlme.modes == NULL) {
2838                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
2839                            "channels and rates from the driver");
2840                 return -1;
2841         }
2842
2843         wpa_s->mlme.num_modes = num_modes;
2844
2845         wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
2846         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
2847         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
2848
2849         wpa_s->mlme.wmm_enabled = 1;
2850
2851         return 0;
2852 }
2853
2854
2855 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
2856 {
2857         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
2858         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
2859         os_free(wpa_s->mlme.extra_ie);
2860         wpa_s->mlme.extra_ie = NULL;
2861         os_free(wpa_s->mlme.extra_probe_ie);
2862         wpa_s->mlme.extra_probe_ie = NULL;
2863         os_free(wpa_s->mlme.assocreq_ies);
2864         wpa_s->mlme.assocreq_ies = NULL;
2865         os_free(wpa_s->mlme.assocresp_ies);
2866         wpa_s->mlme.assocresp_ies = NULL;
2867         ieee80211_bss_list_deinit(wpa_s);
2868         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
2869                                        wpa_s->mlme.num_modes);
2870 #ifdef CONFIG_IEEE80211R
2871         os_free(wpa_s->mlme.ft_ies);
2872         wpa_s->mlme.ft_ies = NULL;
2873         wpa_s->mlme.ft_ies_len = 0;
2874 #endif /* CONFIG_IEEE80211R */
2875 }
2876
2877
2878 #ifdef CONFIG_IEEE80211R
2879
2880 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2881                                 const u8 *ies, size_t ies_len)
2882 {
2883         if (md == NULL) {
2884                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
2885                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
2886         } else {
2887                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
2888                            MAC2STR(md));
2889                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
2890         }
2891
2892         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
2893         os_free(wpa_s->mlme.ft_ies);
2894         wpa_s->mlme.ft_ies = os_malloc(ies_len);
2895         if (wpa_s->mlme.ft_ies == NULL)
2896                 return -1;
2897         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
2898         wpa_s->mlme.ft_ies_len = ies_len;
2899
2900         return 0;
2901 }
2902
2903
2904 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
2905                                  const u8 *target_ap,
2906                                  const u8 *ies, size_t ies_len)
2907 {
2908         u8 *buf;
2909         size_t len;
2910         struct ieee80211_mgmt *mgmt;
2911         int res;
2912
2913         /*
2914          * Action frame payload:
2915          * Category[1] = 6 (Fast BSS Transition)
2916          * Action[1] = 1 (Fast BSS Transition Request)
2917          * STA Address
2918          * Target AP Address
2919          * FT IEs
2920          */
2921
2922         buf = os_zalloc(sizeof(*mgmt) + ies_len);
2923         if (buf == NULL) {
2924                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
2925                            "FT action frame");
2926                 return -1;
2927         }
2928
2929         mgmt = (struct ieee80211_mgmt *) buf;
2930         len = 24;
2931         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
2932         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2933         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2934         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2935                                            WLAN_FC_STYPE_ACTION);
2936         mgmt->u.action.category = WLAN_ACTION_FT;
2937         mgmt->u.action.u.ft_action_req.action = action;
2938         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
2939                   ETH_ALEN);
2940         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
2941                   ETH_ALEN);
2942         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
2943         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
2944
2945         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
2946                    "Target AP=" MACSTR " body_len=%lu",
2947                    action, MAC2STR(target_ap), (unsigned long) ies_len);
2948
2949         res = ieee80211_sta_tx(wpa_s, buf, len);
2950         os_free(buf);
2951
2952         return res;
2953 }
2954
2955 #endif /* CONFIG_IEEE80211R */
2956
2957
2958 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
2959                                    size_t ies_len)
2960 {
2961         os_free(wpa_s->mlme.extra_probe_ie);
2962         wpa_s->mlme.extra_probe_ie = NULL;
2963         wpa_s->mlme.extra_probe_ie_len = 0;
2964
2965         if (ies == NULL)
2966                 return 0;
2967
2968         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
2969         if (wpa_s->mlme.extra_probe_ie == NULL)
2970                 return -1;
2971
2972         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
2973         wpa_s->mlme.extra_probe_ie_len = ies_len;
2974
2975         return 0;
2976 }