2 * WPA Supplicant - Client mode MLME
3 * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2004, Instant802 Networks, Inc.
5 * Copyright (c) 2005-2006, Devicescape Software, Inc.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Alternatively, this software may be distributed under the terms of BSD
14 * See README and COPYING for more details.
21 #include "config_ssid.h"
22 #include "wpa_supplicant_i.h"
24 #include "drivers/driver.h"
25 #include "ieee802_11_defs.h"
29 /* Timeouts and intervals in milliseconds */
30 #define IEEE80211_AUTH_TIMEOUT (200)
31 #define IEEE80211_AUTH_MAX_TRIES 3
32 #define IEEE80211_ASSOC_TIMEOUT (200)
33 #define IEEE80211_ASSOC_MAX_TRIES 3
34 #define IEEE80211_MONITORING_INTERVAL (2000)
35 #define IEEE80211_PROBE_INTERVAL (60000)
36 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
37 #define IEEE80211_SCAN_INTERVAL (2000)
38 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
39 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
41 #define IEEE80211_PROBE_DELAY (33)
42 #define IEEE80211_CHANNEL_TIME (33)
43 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
44 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
45 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
46 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
51 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
54 struct ieee80211_sta_bss {
55 struct ieee80211_sta_bss *next;
56 struct ieee80211_sta_bss *hnext;
59 u8 ssid[MAX_SSID_LEN];
61 u16 capability; /* host byte order */
76 #define IEEE80211_MAX_SUPP_RATES 32
77 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
78 size_t supp_rates_len;
83 struct os_time last_update;
87 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
89 const u8 *ssid, size_t ssid_len);
90 static struct ieee80211_sta_bss *
91 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
92 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
93 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
94 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
95 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
98 /* Parsed Information Elements */
99 struct ieee802_11_elems {
123 u8 ext_supp_rates_len;
134 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
137 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
138 struct ieee802_11_elems *elems)
144 os_memset(elems, 0, sizeof(*elems));
155 wpa_printf(MSG_MSGDUMP, "MLME: IEEE 802.11 element "
156 "parse failed (id=%d elen=%d left=%d)",
165 elems->ssid_len = elen;
167 case WLAN_EID_SUPP_RATES:
168 elems->supp_rates = pos;
169 elems->supp_rates_len = elen;
171 case WLAN_EID_FH_PARAMS:
172 elems->fh_params = pos;
173 elems->fh_params_len = elen;
175 case WLAN_EID_DS_PARAMS:
176 elems->ds_params = pos;
177 elems->ds_params_len = elen;
179 case WLAN_EID_CF_PARAMS:
180 elems->cf_params = pos;
181 elems->cf_params_len = elen;
185 elems->tim_len = elen;
187 case WLAN_EID_IBSS_PARAMS:
188 elems->ibss_params = pos;
189 elems->ibss_params_len = elen;
191 case WLAN_EID_CHALLENGE:
192 elems->challenge = pos;
193 elems->challenge_len = elen;
195 case WLAN_EID_VENDOR_SPECIFIC:
196 if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
198 /* Microsoft OUI (00:50:F2) */
200 /* OUI Type 1 - WPA IE */
202 elems->wpa_len = elen;
203 } else if (elen >= 5 && pos[3] == 2) {
205 elems->wmm_info = pos;
206 elems->wmm_info_len = elen;
207 } else if (pos[4] == 1) {
208 elems->wmm_param = pos;
209 elems->wmm_param_len = elen;
216 elems->rsn_len = elen;
218 case WLAN_EID_ERP_INFO:
219 elems->erp_info = pos;
220 elems->erp_info_len = elen;
222 case WLAN_EID_EXT_SUPP_RATES:
223 elems->ext_supp_rates = pos;
224 elems->ext_supp_rates_len = elen;
226 case WLAN_EID_MOBILITY_DOMAIN:
228 elems->mdie_len = elen;
230 case WLAN_EID_FAST_BSS_TRANSITION:
232 elems->ftie_len = elen;
236 wpa_printf(MSG_MSGDUMP "MLME: IEEE 802.11 element "
237 "parse ignored unknown element (id=%d "
238 "elen=%d)", id, elen);
251 return unknown ? ParseUnknown : ParseOK;
255 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
256 wpa_hw_mode phymode, int chan,
260 struct wpa_hw_modes *mode;
262 for (i = 0; i < wpa_s->mlme.num_modes; i++) {
263 mode = &wpa_s->mlme.modes[i];
264 if (mode->mode == phymode) {
265 wpa_s->mlme.curr_rates = mode->rates;
266 wpa_s->mlme.num_curr_rates = mode->num_rates;
271 return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
277 static int ecw2cw(int ecw)
289 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
290 u8 *wmm_param, size_t wmm_param_len)
296 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
298 count = wmm_param[6] & 0x0f;
299 if (count == wpa_s->mlme.wmm_last_param_set)
301 wpa_s->mlme.wmm_last_param_set = count;
304 left = wmm_param_len - 8;
308 for (; left >= 4; left -= 4, pos += 4) {
309 int aci = (pos[0] >> 5) & 0x03;
310 int acm = (pos[0] >> 4) & 0x01;
315 queue = IEEE80211_TX_QUEUE_DATA3;
317 wmm_acm |= BIT(1) | BIT(2);
320 queue = IEEE80211_TX_QUEUE_DATA1;
322 wmm_acm |= BIT(4) | BIT(5);
325 queue = IEEE80211_TX_QUEUE_DATA0;
327 wmm_acm |= BIT(6) | BIT(7);
331 queue = IEEE80211_TX_QUEUE_DATA2;
333 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
337 params.aifs = pos[0] & 0x0f;
338 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
339 params.cw_min = ecw2cw(pos[1] & 0x0f);
340 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
341 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
342 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
343 "aifs=%d cWmin=%d cWmax=%d burst=%d",
344 queue, aci, acm, params.aifs, params.cw_min,
345 params.cw_max, params.burst_time);
346 /* TODO: handle ACM (block TX, fallback to next lowest allowed
348 if (local->hw->conf_tx(local->mdev, queue, ¶ms)) {
349 wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
350 "parameters for queue %d", queue);
357 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
359 if (wpa_s->mlme.associated == assoc)
362 wpa_s->mlme.associated = assoc;
365 union wpa_event_data data;
366 os_memset(&data, 0, sizeof(data));
367 wpa_s->mlme.prev_bssid_set = 1;
368 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
369 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
370 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
371 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
372 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
373 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
375 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
377 os_get_time(&wpa_s->mlme.last_probe);
381 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
384 return wpa_drv_send_mlme(wpa_s, buf, len);
388 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
389 int transaction, u8 *extra, size_t extra_len,
394 struct ieee80211_mgmt *mgmt;
396 buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
398 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
403 mgmt = (struct ieee80211_mgmt *) buf;
405 os_memset(mgmt, 0, 24 + 6);
406 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
409 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
410 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
411 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
412 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
413 mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
414 mgmt->u.auth.auth_transaction = host_to_le16(transaction);
415 wpa_s->mlme.auth_transaction = transaction + 1;
416 mgmt->u.auth.status_code = host_to_le16(0);
418 os_memcpy(buf + len, extra, extra_len);
422 ieee80211_sta_tx(wpa_s, buf, len);
427 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
429 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
430 eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
431 ieee80211_sta_timer, wpa_s, NULL);
435 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
440 wpa_s->mlme.auth_tries++;
441 if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
442 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
443 " timed out", MAC2STR(wpa_s->bssid));
447 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
448 wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
449 MAC2STR(wpa_s->bssid));
454 #ifdef CONFIG_IEEE80211R
455 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
456 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
457 wpa_s->mlme.ft_ies) {
458 struct ieee80211_sta_bss *bss;
459 struct rsn_mdie *mdie = NULL;
460 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
461 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
462 mdie = (struct rsn_mdie *) (bss->mdie + 2);
464 os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
465 MOBILITY_DOMAIN_ID_LEN) == 0) {
466 wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
468 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
469 extra = wpa_s->mlme.ft_ies;
470 extra_len = wpa_s->mlme.ft_ies_len;
473 #endif /* CONFIG_IEEE80211R */
475 ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
477 ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
481 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
483 struct ieee80211_mgmt *mgmt;
487 struct ieee80211_sta_bss *bss;
491 if (wpa_s->mlme.curr_rates == NULL) {
492 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
496 buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
497 wpa_s->mlme.ssid_len;
498 #ifdef CONFIG_IEEE80211R
499 if (wpa_s->mlme.ft_ies)
500 buflen += wpa_s->mlme.ft_ies_len;
501 #endif /* CONFIG_IEEE80211R */
502 buf = os_malloc(buflen);
504 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
510 capab = wpa_s->mlme.capab;
511 if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
512 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
513 WLAN_CAPABILITY_SHORT_PREAMBLE;
515 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
517 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
518 capab |= WLAN_CAPABILITY_PRIVACY;
524 mgmt = (struct ieee80211_mgmt *) buf;
526 os_memset(mgmt, 0, 24);
527 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
528 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
529 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
531 if (wpa_s->mlme.prev_bssid_set) {
533 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
534 WLAN_FC_STYPE_REASSOC_REQ);
535 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
536 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
537 os_memcpy(mgmt->u.reassoc_req.current_ap,
538 wpa_s->mlme.prev_bssid,
542 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
543 WLAN_FC_STYPE_ASSOC_REQ);
544 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
545 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
549 ies = pos = buf + blen;
550 blen += 2 + wpa_s->mlme.ssid_len;
551 *pos++ = WLAN_EID_SSID;
552 *pos++ = wpa_s->mlme.ssid_len;
553 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
555 len = wpa_s->mlme.num_curr_rates;
560 *pos++ = WLAN_EID_SUPP_RATES;
562 for (i = 0; i < len; i++) {
563 int rate = wpa_s->mlme.curr_rates[i].rate;
564 *pos++ = (u8) (rate / 5);
567 if (wpa_s->mlme.num_curr_rates > len) {
569 blen += wpa_s->mlme.num_curr_rates - len + 2;
570 *pos++ = WLAN_EID_EXT_SUPP_RATES;
571 *pos++ = wpa_s->mlme.num_curr_rates - len;
572 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
573 int rate = wpa_s->mlme.curr_rates[i].rate;
574 *pos++ = (u8) (rate / 5);
578 if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
580 blen += wpa_s->mlme.extra_ie_len;
581 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
584 #ifdef CONFIG_IEEE80211R
585 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
586 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
587 wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
589 bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
590 bss->mdie[1] >= sizeof(struct rsn_mdie)) {
592 blen += 2 + sizeof(struct rsn_mdie);
593 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
594 *pos++ = sizeof(struct rsn_mdie);
595 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
596 pos += MOBILITY_DOMAIN_ID_LEN;
597 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
600 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
601 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
602 wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
604 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
605 pos += wpa_s->mlme.ft_ies_len;
606 blen += wpa_s->mlme.ft_ies_len;
608 #endif /* CONFIG_IEEE80211R */
610 if (wmm && wpa_s->mlme.wmm_enabled) {
613 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
614 *pos++ = 7; /* len */
615 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
618 *pos++ = 2; /* WME */
619 *pos++ = 0; /* WME info */
620 *pos++ = 1; /* WME ver */
624 os_free(wpa_s->mlme.assocreq_ies);
625 wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
626 wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
627 if (wpa_s->mlme.assocreq_ies) {
628 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
629 wpa_s->mlme.assocreq_ies_len);
632 ieee80211_sta_tx(wpa_s, buf, blen);
637 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
641 struct ieee80211_mgmt *mgmt;
643 buf = os_zalloc(sizeof(*mgmt));
645 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
650 mgmt = (struct ieee80211_mgmt *) buf;
652 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
653 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
654 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
655 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
656 WLAN_FC_STYPE_DEAUTH);
658 mgmt->u.deauth.reason_code = host_to_le16(reason);
660 ieee80211_sta_tx(wpa_s, buf, len);
665 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
669 struct ieee80211_mgmt *mgmt;
671 buf = os_zalloc(sizeof(*mgmt));
673 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
678 mgmt = (struct ieee80211_mgmt *) buf;
680 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
681 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
682 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
683 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
684 WLAN_FC_STYPE_DISASSOC);
686 mgmt->u.disassoc.reason_code = host_to_le16(reason);
688 ieee80211_sta_tx(wpa_s, buf, len);
693 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
695 struct ieee80211_sta_bss *bss;
698 if (wpa_s->mlme.mixed_cell ||
699 wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
702 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
706 if (ieee80211_sta_wep_configured(wpa_s) !=
707 !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
714 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
716 wpa_s->mlme.assoc_tries++;
717 if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
718 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
719 " timed out", MAC2STR(wpa_s->bssid));
723 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
724 wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
725 MAC2STR(wpa_s->bssid));
726 if (ieee80211_privacy_mismatch(wpa_s)) {
727 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
728 "configuration and mixed-cell disabled - abort "
733 ieee80211_send_assoc(wpa_s);
735 ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
739 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
743 /* TODO: start monitoring current AP signal quality and number of
744 * missed beacons. Scan other channels every now and then and search
746 /* TODO: remove expired BSSes */
748 wpa_s->mlme.state = IEEE80211_ASSOCIATED;
751 sta = sta_info_get(local, wpa_s->bssid);
753 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
754 MAC2STR(wpa_s->bssid));
758 if (time_after(jiffies,
759 sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
760 if (wpa_s->mlme.probereq_poll) {
761 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
762 "current AP " MACSTR " - assume "
764 MAC2STR(wpa_s->bssid));
767 ieee80211_send_probe_req(
769 wpa_s->mlme.scan_ssid,
770 wpa_s->mlme.scan_ssid_len);
771 wpa_s->mlme.probereq_poll = 1;
774 wpa_s->mlme.probereq_poll = 0;
775 if (time_after(jiffies, wpa_s->mlme.last_probe +
776 IEEE80211_PROBE_INTERVAL)) {
777 wpa_s->mlme.last_probe = jiffies;
778 ieee80211_send_probe_req(wpa_s->bssid,
780 wpa_s->mlme.ssid_len);
783 sta_info_release(local, sta);
789 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
790 ieee80211_reschedule_timer(wpa_s,
791 IEEE80211_MONITORING_INTERVAL +
794 ieee80211_reschedule_timer(wpa_s,
795 IEEE80211_MONITORING_INTERVAL);
800 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
802 const u8 *ssid, size_t ssid_len)
806 struct ieee80211_mgmt *mgmt;
807 u8 *pos, *supp_rates;
808 u8 *esupp_rates = NULL;
811 buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
813 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
818 mgmt = (struct ieee80211_mgmt *) buf;
820 os_memset(mgmt, 0, 24);
821 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
822 WLAN_FC_STYPE_PROBE_REQ);
823 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
825 os_memcpy(mgmt->da, dst, ETH_ALEN);
826 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
828 os_memset(mgmt->da, 0xff, ETH_ALEN);
829 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
833 *pos++ = WLAN_EID_SSID;
835 os_memcpy(pos, ssid, ssid_len);
837 supp_rates = buf + len;
839 supp_rates[0] = WLAN_EID_SUPP_RATES;
841 for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
842 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
843 if (!(rate->flags & WPA_RATE_SUPPORTED))
849 } else if (supp_rates[1] == 8) {
851 esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
853 pos = &esupp_rates[2];
859 *pos++ = rate->rate / 5;
862 if (wpa_s->mlme.extra_probe_ie) {
863 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
864 wpa_s->mlme.extra_probe_ie_len);
865 len += wpa_s->mlme.extra_probe_ie_len;
868 ieee80211_sta_tx(wpa_s, buf, len);
873 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
876 if (sdata == NULL || sdata->default_key == NULL ||
877 sdata->default_key->alg != ALG_WEP)
886 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
888 wpa_printf(MSG_DEBUG, "MLME: authenticated");
889 wpa_s->mlme.authenticated = 1;
890 ieee80211_associate(wpa_s);
894 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
895 struct ieee80211_mgmt *mgmt,
897 struct ieee80211_rx_status *rx_status)
900 struct ieee802_11_elems elems;
902 wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
903 pos = mgmt->u.auth.variable;
904 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
906 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
909 if (elems.challenge == NULL) {
910 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
914 ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
915 elems.challenge_len + 2, 1);
919 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
920 struct ieee80211_mgmt *mgmt,
922 struct ieee80211_rx_status *rx_status)
924 struct wpa_ssid *ssid = wpa_s->current_ssid;
925 u16 auth_alg, auth_transaction, status_code;
928 adhoc = ssid && ssid->mode == 1;
930 if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
931 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
932 "from " MACSTR ", but not in authenticate state - "
933 "ignored", MAC2STR(mgmt->sa));
938 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
939 "frame received from " MACSTR " - ignored",
940 (unsigned long) len, MAC2STR(mgmt->sa));
944 if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
945 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
946 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
948 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
952 if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
953 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
954 "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
956 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
960 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
961 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
962 status_code = le_to_host16(mgmt->u.auth.status_code);
964 wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
965 " (alg=%d transaction=%d status=%d)",
966 MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
969 /* IEEE 802.11 standard does not require authentication in IBSS
970 * networks and most implementations do not seem to use it.
971 * However, try to reply to authentication attempts if someone
972 * has actually implemented this.
973 * TODO: Could implement shared key authentication. */
974 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
975 wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
976 "authentication frame (alg=%d "
978 auth_alg, auth_transaction);
981 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
984 if (auth_alg != wpa_s->mlme.auth_alg ||
985 auth_transaction != wpa_s->mlme.auth_transaction) {
986 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
987 "(alg=%d transaction=%d)",
988 auth_alg, auth_transaction);
992 if (status_code != WLAN_STATUS_SUCCESS) {
993 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
994 "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
996 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
997 const int num_algs = 3;
1000 algs[0] = algs[1] = algs[2] = 0xff;
1001 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
1002 algs[0] = WLAN_AUTH_OPEN;
1003 if (wpa_s->mlme.auth_algs &
1004 IEEE80211_AUTH_ALG_SHARED_KEY)
1005 algs[1] = WLAN_AUTH_SHARED_KEY;
1006 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
1007 algs[2] = WLAN_AUTH_LEAP;
1008 if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
1010 else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
1014 for (i = 0; i < num_algs; i++) {
1016 if (pos >= num_algs)
1018 if (algs[pos] == wpa_s->mlme.auth_alg ||
1021 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1022 !ieee80211_sta_wep_configured(wpa_s))
1024 wpa_s->mlme.auth_alg = algs[pos];
1025 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
1027 wpa_s->mlme.auth_alg);
1034 switch (wpa_s->mlme.auth_alg) {
1035 case WLAN_AUTH_OPEN:
1036 case WLAN_AUTH_LEAP:
1037 ieee80211_auth_completed(wpa_s);
1039 case WLAN_AUTH_SHARED_KEY:
1040 if (wpa_s->mlme.auth_transaction == 4)
1041 ieee80211_auth_completed(wpa_s);
1043 ieee80211_auth_challenge(wpa_s, mgmt, len,
1046 #ifdef CONFIG_IEEE80211R
1049 union wpa_event_data data;
1050 os_memset(&data, 0, sizeof(data));
1051 data.ft_ies.ies = mgmt->u.auth.variable;
1052 data.ft_ies.ies_len = len -
1053 (mgmt->u.auth.variable - (u8 *) mgmt);
1054 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1055 ieee80211_auth_completed(wpa_s);
1058 #endif /* CONFIG_IEEE80211R */
1063 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
1064 struct ieee80211_mgmt *mgmt,
1066 struct ieee80211_rx_status *rx_status)
1071 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
1072 "frame received from " MACSTR " - ignored",
1073 (unsigned long) len, MAC2STR(mgmt->sa));
1077 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1078 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
1079 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1081 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1085 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1087 wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
1088 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1090 if (wpa_s->mlme.authenticated)
1091 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
1093 if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
1094 wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
1095 wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1096 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
1097 ieee80211_reschedule_timer(wpa_s,
1098 IEEE80211_RETRY_AUTH_INTERVAL);
1101 ieee80211_set_associated(wpa_s, 0);
1102 wpa_s->mlme.authenticated = 0;
1106 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
1107 struct ieee80211_mgmt *mgmt,
1109 struct ieee80211_rx_status *rx_status)
1114 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
1115 "frame received from " MACSTR " - ignored",
1116 (unsigned long) len, MAC2STR(mgmt->sa));
1120 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1121 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
1122 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1124 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1128 reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
1130 wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
1131 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1133 if (wpa_s->mlme.associated)
1134 wpa_printf(MSG_DEBUG, "MLME: disassociated");
1136 if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1137 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
1138 ieee80211_reschedule_timer(wpa_s,
1139 IEEE80211_RETRY_AUTH_INTERVAL);
1142 ieee80211_set_associated(wpa_s, 0);
1146 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1147 struct ieee802_11_elems *elems)
1149 #ifdef CONFIG_IEEE80211R
1150 const u8 *mobility_domain = NULL;
1151 const u8 *r0kh_id = NULL;
1152 size_t r0kh_id_len = 0;
1153 const u8 *r1kh_id = NULL;
1154 struct rsn_ftie *hdr;
1155 const u8 *pos, *end;
1157 if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1158 mobility_domain = elems->mdie;
1159 if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1160 end = elems->ftie + elems->ftie_len;
1161 hdr = (struct rsn_ftie *) elems->ftie;
1162 pos = (const u8 *) (hdr + 1);
1163 while (pos + 1 < end) {
1164 if (pos + 2 + pos[1] > end)
1166 if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1167 pos[1] == FT_R1KH_ID_LEN)
1169 else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1170 pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1172 r0kh_id_len = pos[1];
1177 return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1178 r0kh_id_len, r1kh_id);
1179 #else /* CONFIG_IEEE80211R */
1181 #endif /* CONFIG_IEEE80211R */
1185 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1186 struct ieee80211_mgmt *mgmt,
1188 struct ieee80211_rx_status *rx_status,
1193 u16 capab_info, status_code, aid;
1194 struct ieee802_11_elems elems;
1197 /* AssocResp and ReassocResp have identical structure, so process both
1198 * of them in this function. */
1200 if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1201 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1202 MACSTR ", but not in associate state - ignored",
1208 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1209 "frame received from " MACSTR " - ignored",
1210 (unsigned long) len, MAC2STR(mgmt->sa));
1214 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1215 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1216 "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1217 "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1221 capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1222 status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1223 aid = le_to_host16(mgmt->u.assoc_resp.aid);
1224 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1225 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1227 aid &= ~(BIT(15) | BIT(14));
1229 wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1230 " (capab=0x%x status=%d aid=%d)",
1231 reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1232 capab_info, status_code, aid);
1234 if (status_code != WLAN_STATUS_SUCCESS) {
1235 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1240 pos = mgmt->u.assoc_resp.variable;
1241 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1243 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1247 if (elems.supp_rates == NULL) {
1248 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1253 if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1255 wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1256 "association, not reassociation, response "
1260 if (wpa_ft_validate_reassoc_resp(
1261 wpa_s->wpa, pos, len - (pos - (u8 *) mgmt)) < 0) {
1262 wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1266 } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1269 wpa_printf(MSG_DEBUG, "MLME: associated");
1270 wpa_s->mlme.aid = aid;
1271 wpa_s->mlme.ap_capab = capab_info;
1273 os_free(wpa_s->mlme.assocresp_ies);
1274 wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1275 wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1276 if (wpa_s->mlme.assocresp_ies) {
1277 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1278 wpa_s->mlme.assocresp_ies_len);
1281 ieee80211_set_associated(wpa_s, 1);
1283 rates_len = elems.supp_rates_len;
1284 if (rates_len > sizeof(rates))
1285 rates_len = sizeof(rates);
1286 os_memcpy(rates, elems.supp_rates, rates_len);
1287 if (elems.ext_supp_rates) {
1288 size_t _len = elems.ext_supp_rates_len;
1289 if (_len > sizeof(rates) - rates_len)
1290 _len = sizeof(rates) - rates_len;
1291 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1295 if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1296 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1299 if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1301 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1305 /* Remove STA entry before adding a new one just in case to avoid
1306 * problems with existing configuration (e.g., keys). */
1307 wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1308 if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1309 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1316 if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1317 sta->flags |= WLAN_STA_WME;
1318 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1319 elems.wmm_param_len);
1323 ieee80211_associated(wpa_s);
1327 /* Caller must hold local->sta_bss_lock */
1328 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1329 struct ieee80211_sta_bss *bss)
1331 bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1332 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1336 /* Caller must hold local->sta_bss_lock */
1337 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1338 struct ieee80211_sta_bss *bss)
1340 struct ieee80211_sta_bss *b, *prev = NULL;
1341 b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1345 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1348 prev->hnext = bss->hnext;
1358 static struct ieee80211_sta_bss *
1359 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1361 struct ieee80211_sta_bss *bss;
1363 bss = os_zalloc(sizeof(*bss));
1366 os_memcpy(bss->bssid, bssid, ETH_ALEN);
1368 /* TODO: order by RSSI? */
1369 bss->next = wpa_s->mlme.sta_bss_list;
1370 wpa_s->mlme.sta_bss_list = bss;
1371 __ieee80211_bss_hash_add(wpa_s, bss);
1376 static struct ieee80211_sta_bss *
1377 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1379 struct ieee80211_sta_bss *bss;
1381 bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1383 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1391 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1392 struct ieee80211_sta_bss *bss)
1394 __ieee80211_bss_hash_del(wpa_s, bss);
1396 os_free(bss->wpa_ie);
1397 os_free(bss->rsn_ie);
1398 os_free(bss->wmm_ie);
1404 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1406 struct ieee80211_sta_bss *bss, *prev;
1408 bss = wpa_s->mlme.sta_bss_list;
1409 wpa_s->mlme.sta_bss_list = NULL;
1413 ieee80211_bss_free(wpa_s, prev);
1418 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1419 struct ieee80211_mgmt *mgmt,
1421 struct ieee80211_rx_status *rx_status,
1424 struct ieee802_11_elems elems;
1426 int channel, invalid = 0, clen;
1427 struct ieee80211_sta_bss *bss;
1432 if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1433 return; /* ignore ProbeResp to foreign address */
1436 wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1437 beacon ? "Beacon" : "Probe Response",
1438 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1441 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1445 pos = mgmt->u.beacon.timestamp;
1446 timestamp = WPA_GET_LE64(pos);
1449 if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1450 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1451 #ifdef IEEE80211_IBSS_DEBUG
1452 static unsigned long last_tsf_debug = 0;
1454 if (local->hw->get_tsf)
1455 tsf = local->hw->get_tsf(local->mdev);
1458 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1459 wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1460 MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1462 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1463 tsf, timestamp, tsf - timestamp, jiffies);
1464 last_tsf_debug = jiffies;
1466 #endif /* IEEE80211_IBSS_DEBUG */
1470 ie_pos = mgmt->u.beacon.variable;
1471 ie_len = len - baselen;
1472 if (ieee802_11_parse_elems(ie_pos, ie_len, &elems) == ParseFailed)
1476 if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1477 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1478 (sta = sta_info_get(local, mgmt->sa))) {
1479 struct ieee80211_rate *rates;
1481 u32 supp_rates, prev_rates;
1482 int i, j, oper_mode;
1484 rates = local->curr_rates;
1485 num_rates = local->num_curr_rates;
1486 oper_mode = wpa_s->mlme.sta_scanning ?
1487 local->scan_oper_phymode : local->conf.phymode;
1488 for (i = 0; i < local->hw->num_modes; i++) {
1489 struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1490 if (oper_mode == mode->mode) {
1491 rates = mode->rates;
1492 num_rates = mode->num_rates;
1498 for (i = 0; i < elems.supp_rates_len +
1499 elems.ext_supp_rates_len; i++) {
1502 if (i < elems.supp_rates_len)
1503 rate = elems.supp_rates[i];
1504 else if (elems.ext_supp_rates)
1505 rate = elems.ext_supp_rates
1506 [i - elems.supp_rates_len];
1507 own_rate = 5 * (rate & 0x7f);
1508 if (oper_mode == MODE_ATHEROS_TURBO)
1510 for (j = 0; j < num_rates; j++)
1511 if (rates[j].rate == own_rate)
1512 supp_rates |= BIT(j);
1515 prev_rates = sta->supp_rates;
1516 sta->supp_rates &= supp_rates;
1517 if (sta->supp_rates == 0) {
1518 /* No matching rates - this should not really happen.
1519 * Make sure that at least one rate is marked
1520 * supported to avoid issues with TX rate ctrl. */
1521 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1523 if (sta->supp_rates != prev_rates) {
1524 wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1525 "for " MACSTR " based on beacon info "
1526 "(0x%x & 0x%x -> 0x%x)",
1527 MAC2STR(sta->addr), prev_rates,
1528 supp_rates, sta->supp_rates);
1530 sta_info_release(local, sta);
1534 if (elems.ssid == NULL)
1537 if (elems.ds_params && elems.ds_params_len == 1)
1538 channel = elems.ds_params[0];
1540 channel = rx_status->channel;
1542 bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1544 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1549 /* TODO: order by RSSI? */
1550 spin_lock_bh(&local->sta_bss_lock);
1551 list_move_tail(&bss->list, &local->sta_bss_list);
1552 spin_unlock_bh(&local->sta_bss_lock);
1556 if (bss->probe_resp && beacon) {
1557 /* Do not allow beacon to override data from Probe Response. */
1561 bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1562 bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1564 if (bss->ie == NULL || bss->ie_len < ie_len) {
1566 bss->ie = os_malloc(ie_len);
1569 os_memcpy(bss->ie, ie_pos, ie_len);
1570 bss->ie_len = ie_len;
1573 if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1574 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1575 bss->ssid_len = elems.ssid_len;
1578 bss->supp_rates_len = 0;
1579 if (elems.supp_rates) {
1580 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1581 if (clen > elems.supp_rates_len)
1582 clen = elems.supp_rates_len;
1583 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1584 elems.supp_rates, clen);
1585 bss->supp_rates_len += clen;
1587 if (elems.ext_supp_rates) {
1588 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1589 if (clen > elems.ext_supp_rates_len)
1590 clen = elems.ext_supp_rates_len;
1591 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1592 elems.ext_supp_rates, clen);
1593 bss->supp_rates_len += clen;
1597 (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_len ||
1598 os_memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1599 os_free(bss->wpa_ie);
1600 bss->wpa_ie = os_malloc(elems.wpa_len + 2);
1602 os_memcpy(bss->wpa_ie, elems.wpa - 2,
1604 bss->wpa_ie_len = elems.wpa_len + 2;
1606 bss->wpa_ie_len = 0;
1607 } else if (!elems.wpa && bss->wpa_ie) {
1608 os_free(bss->wpa_ie);
1610 bss->wpa_ie_len = 0;
1614 (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_len ||
1615 os_memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1616 os_free(bss->rsn_ie);
1617 bss->rsn_ie = os_malloc(elems.rsn_len + 2);
1619 os_memcpy(bss->rsn_ie, elems.rsn - 2,
1621 bss->rsn_ie_len = elems.rsn_len + 2;
1623 bss->rsn_ie_len = 0;
1624 } else if (!elems.rsn && bss->rsn_ie) {
1625 os_free(bss->rsn_ie);
1627 bss->rsn_ie_len = 0;
1630 if (elems.wmm_param &&
1631 (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_param_len ||
1632 os_memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1633 os_free(bss->wmm_ie);
1634 bss->wmm_ie = os_malloc(elems.wmm_param_len + 2);
1636 os_memcpy(bss->wmm_ie, elems.wmm_param - 2,
1637 elems.wmm_param_len + 2);
1638 bss->wmm_ie_len = elems.wmm_param_len + 2;
1640 bss->wmm_ie_len = 0;
1641 } else if (!elems.wmm_param && bss->wmm_ie) {
1642 os_free(bss->wmm_ie);
1644 bss->wmm_ie_len = 0;
1647 #ifdef CONFIG_IEEE80211R
1649 (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1650 os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1652 bss->mdie = os_malloc(elems.mdie_len + 2);
1654 os_memcpy(bss->mdie, elems.mdie - 2,
1655 elems.mdie_len + 2);
1656 bss->mdie_len = elems.mdie_len + 2;
1659 } else if (!elems.mdie && bss->mdie) {
1664 #endif /* CONFIG_IEEE80211R */
1666 bss->hw_mode = wpa_s->mlme.phymode;
1667 bss->channel = channel;
1668 bss->freq = wpa_s->mlme.freq;
1669 if (channel != wpa_s->mlme.channel &&
1670 (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1671 wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1672 channel >= 1 && channel <= 14) {
1673 static const int freq_list[] = {
1674 2412, 2417, 2422, 2427, 2432, 2437, 2442,
1675 2447, 2452, 2457, 2462, 2467, 2472, 2484
1677 /* IEEE 802.11g/b mode can receive packets from neighboring
1678 * channels, so map the channel into frequency. */
1679 bss->freq = freq_list[channel - 1];
1681 bss->timestamp = timestamp;
1682 os_get_time(&bss->last_update);
1683 bss->rssi = rx_status->ssi;
1689 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1690 struct ieee80211_mgmt *mgmt,
1692 struct ieee80211_rx_status *rx_status)
1694 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1698 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1699 struct ieee80211_mgmt *mgmt,
1701 struct ieee80211_rx_status *rx_status)
1705 struct ieee802_11_elems elems;
1707 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1709 if (!wpa_s->mlme.associated ||
1710 os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1713 /* Process beacon from the current BSS */
1714 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1718 if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1719 &elems) == ParseFailed)
1723 if (elems.erp_info && elems.erp_info_len >= 1) {
1725 (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1728 if (use_protection != !!wpa_s->mlme.use_protection) {
1729 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1731 use_protection ? "enabled" : "disabled",
1732 MAC2STR(wpa_s->bssid));
1733 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1734 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1737 if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1738 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1739 elems.wmm_param_len);
1744 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1745 struct ieee80211_mgmt *mgmt,
1747 struct ieee80211_rx_status *rx_status)
1749 int tx_last_beacon, adhoc;
1751 struct ieee80211_mgmt *resp;
1754 struct wpa_ssid *ssid = wpa_s->current_ssid;
1756 adhoc = ssid && ssid->mode == 1;
1758 if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1759 len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1763 if (local->hw->tx_last_beacon)
1764 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1769 #ifdef IEEE80211_IBSS_DEBUG
1770 wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1771 " BSSID=" MACSTR " (tx_last_beacon=%d)",
1772 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1773 MAC2STR(mgmt->bssid), tx_last_beacon);
1774 #endif /* IEEE80211_IBSS_DEBUG */
1776 if (!tx_last_beacon)
1779 if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1780 os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1783 end = ((u8 *) mgmt) + len;
1784 pos = mgmt->u.probe_req.variable;
1785 if (pos[0] != WLAN_EID_SSID ||
1786 pos + 2 + pos[1] > end) {
1787 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1788 MACSTR, MAC2STR(mgmt->sa));
1792 (pos[1] != wpa_s->mlme.ssid_len ||
1793 os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1795 /* Ignore ProbeReq for foreign SSID */
1800 /* Reply with ProbeResp */
1801 skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1805 resp = (struct ieee80211_mgmt *) skb->data;
1806 os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1807 #ifdef IEEE80211_IBSS_DEBUG
1808 wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1810 #endif /* IEEE80211_IBSS_DEBUG */
1811 ieee80211_sta_tx(wpa_s, skb, 0, 1);
1816 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1817 struct ieee80211_mgmt *mgmt,
1819 struct ieee80211_rx_status *rx_status)
1821 union wpa_event_data data;
1823 u8 *sta_addr, *target_ap_addr;
1825 if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1826 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1831 * Only FT Action Response is needed for now since reservation
1832 * protocol is not supported.
1834 if (mgmt->u.action.u.ft_action_resp.action != 2) {
1835 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1836 mgmt->u.action.u.ft_action_resp.action);
1840 status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1841 sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1842 target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1843 wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1844 " TargetAP " MACSTR " Status Code %d",
1845 MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1846 if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1847 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1848 " in FT Action Response", MAC2STR(sta_addr));
1854 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1855 "failure (status code %d)", status);
1856 /* TODO: report error to FT code(?) */
1860 os_memset(&data, 0, sizeof(data));
1861 data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1862 data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1864 data.ft_ies.ft_action = 1;
1865 os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1866 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1867 /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1869 wpa_s->mlme.prev_bssid_set = 1;
1870 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1871 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1872 os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1873 ieee80211_associate(wpa_s);
1877 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1878 struct ieee80211_mgmt *mgmt,
1880 struct ieee80211_rx_status *rx_status)
1882 wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1887 if (mgmt->u.action.category == WLAN_ACTION_FT)
1888 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1890 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1891 mgmt->u.action.category);
1895 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
1896 const u8 *buf, size_t len,
1897 struct ieee80211_rx_status *rx_status)
1899 struct ieee80211_mgmt *mgmt;
1905 mgmt = (struct ieee80211_mgmt *) buf;
1906 fc = le_to_host16(mgmt->frame_control);
1908 switch (WLAN_FC_GET_STYPE(fc)) {
1909 case WLAN_FC_STYPE_PROBE_REQ:
1910 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
1912 case WLAN_FC_STYPE_PROBE_RESP:
1913 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
1915 case WLAN_FC_STYPE_BEACON:
1916 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1918 case WLAN_FC_STYPE_AUTH:
1919 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
1921 case WLAN_FC_STYPE_ASSOC_RESP:
1922 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
1924 case WLAN_FC_STYPE_REASSOC_RESP:
1925 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
1927 case WLAN_FC_STYPE_DEAUTH:
1928 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
1930 case WLAN_FC_STYPE_DISASSOC:
1931 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
1933 case WLAN_FC_STYPE_ACTION:
1934 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
1937 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
1938 "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
1944 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
1945 const u8 *buf, size_t len,
1946 struct ieee80211_rx_status *rx_status)
1948 struct ieee80211_mgmt *mgmt;
1954 mgmt = (struct ieee80211_mgmt *) buf;
1955 fc = le_to_host16(mgmt->frame_control);
1957 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
1958 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
1959 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
1961 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
1962 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1968 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
1973 list_for_each(ptr, &local->sta_list) {
1974 sta = list_entry(ptr, struct sta_info, list);
1975 if (sta->dev == dev &&
1976 time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1988 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
1991 list_for_each_safe(ptr, n, &local->sta_list) {
1992 sta = list_entry(ptr, struct sta_info, list);
1993 if (time_after(jiffies, sta->last_rx +
1994 IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1995 wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
1996 MACSTR, MAC2STR(sta->addr));
1997 sta_info_free(local, sta, 1);
2004 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2006 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2008 ieee80211_sta_expire(wpa_s);
2009 if (ieee80211_sta_active_ibss(wpa_s))
2012 wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2013 "other IBSS networks with same SSID (merge)");
2014 ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2018 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2020 struct wpa_supplicant *wpa_s = eloop_ctx;
2022 switch (wpa_s->mlme.state) {
2023 case IEEE80211_DISABLED:
2025 case IEEE80211_AUTHENTICATE:
2026 ieee80211_authenticate(wpa_s);
2028 case IEEE80211_ASSOCIATE:
2029 ieee80211_associate(wpa_s);
2031 case IEEE80211_ASSOCIATED:
2032 ieee80211_associated(wpa_s);
2034 case IEEE80211_IBSS_SEARCH:
2035 ieee80211_sta_find_ibss(wpa_s);
2037 case IEEE80211_IBSS_JOINED:
2038 ieee80211_sta_merge_ibss(wpa_s);
2041 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2046 if (ieee80211_privacy_mismatch(wpa_s)) {
2047 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2048 "and mixed-cell disabled - disassociate");
2050 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2051 ieee80211_set_associated(wpa_s, 0);
2056 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2058 struct wpa_ssid *ssid = wpa_s->current_ssid;
2059 if (ssid && ssid->mode != 0)
2063 if (local->hw->reset_tsf) {
2064 /* Reset own TSF to allow time synchronization work. */
2065 local->hw->reset_tsf(local->mdev);
2069 wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2072 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2073 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2074 else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2075 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2076 else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2077 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2079 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2080 wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2081 wpa_s->mlme.auth_alg);
2082 wpa_s->mlme.auth_transaction = -1;
2083 wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2084 ieee80211_authenticate(wpa_s);
2088 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2093 for (m = 0; m < local->hw->num_modes; m++) {
2094 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2095 if (mode->mode != local->conf.phymode)
2097 for (c = 0; c < mode->num_channels; c++) {
2098 struct ieee80211_channel *chan = &mode->channels[c];
2099 if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2100 chan->chan == local->conf.channel) {
2101 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2113 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2114 struct ieee80211_sta_bss *bss)
2116 int res = 0, rates, done = 0;
2117 struct ieee80211_mgmt *mgmt;
2119 struct ieee80211_tx_control control;
2120 struct ieee80211_rate *rate;
2121 struct rate_control_extra extra;
2126 /* Remove possible STA entries from other IBSS networks. */
2128 sta_info_flush(local, NULL);
2130 if (local->hw->reset_tsf) {
2131 /* Reset own TSF to allow time synchronization work. */
2132 local->hw->reset_tsf(local->mdev);
2135 os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2138 local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2140 sdata->drop_unencrypted = bss->capability &
2141 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2145 os_memset(&rq, 0, sizeof(rq));
2146 rq.m = bss->freq * 100000;
2148 res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2151 if (!ieee80211_ibss_allowed(wpa_s)) {
2153 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2154 "(%d MHz)", local->conf.channel,
2160 /* Set beacon template based on scan results */
2161 buf = os_malloc(400);
2167 mgmt = (struct ieee80211_mgmt *) buf;
2168 len += 24 + sizeof(mgmt->u.beacon);
2169 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2170 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2171 WLAN_FC_STYPE_BEACON);
2172 os_memset(mgmt->da, 0xff, ETH_ALEN);
2173 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2174 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2176 mgmt->u.beacon.beacon_int =
2177 host_to_le16(local->conf.beacon_int);
2179 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2182 len += 2 + wpa_s->mlme.ssid_len;
2183 *pos++ = WLAN_EID_SSID;
2184 *pos++ = wpa_s->mlme.ssid_len;
2185 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2187 rates = bss->supp_rates_len;
2192 *pos++ = WLAN_EID_SUPP_RATES;
2194 os_memcpy(pos, bss->supp_rates, rates);
2198 *pos++ = WLAN_EID_DS_PARAMS;
2200 *pos++ = bss->channel;
2204 *pos++ = WLAN_EID_IBSS_PARAMS;
2206 /* FIX: set ATIM window based on scan results */
2210 if (bss->supp_rates_len > 8) {
2211 rates = bss->supp_rates_len - 8;
2214 *pos++ = WLAN_EID_EXT_SUPP_RATES;
2216 os_memcpy(pos, &bss->supp_rates[8], rates);
2220 os_memset(&control, 0, sizeof(control));
2221 control.pkt_type = PKT_PROBE_RESP;
2222 os_memset(&extra, 0, sizeof(extra));
2223 extra.endidx = local->num_curr_rates;
2224 rate = rate_control_get_rate(wpa_s, skb, &extra);
2226 wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2227 "rate for IBSS beacon");
2230 control.tx_rate = (wpa_s->mlme.short_preamble &&
2231 (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2232 rate->val2 : rate->val;
2233 control.antenna_sel = local->conf.antenna_sel;
2234 control.power_level = local->conf.power_level;
2236 control.retry_limit = 1;
2237 control.rts_cts_duration = 0;
2241 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2242 if (wpa_s->mlme.probe_resp) {
2243 mgmt = (struct ieee80211_mgmt *)
2244 wpa_s->mlme.probe_resp->data;
2245 mgmt->frame_control =
2246 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2247 WLAN_FC_STYPE_PROBE_RESP);
2249 wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2250 "ProbeResp template for IBSS");
2253 if (local->hw->beacon_update &&
2254 local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2255 wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2256 "template based on scan results");
2261 for (i = 0; i < bss->supp_rates_len; i++) {
2262 int rate = (bss->supp_rates[i] & 0x7f) * 5;
2263 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2265 for (j = 0; j < local->num_curr_rates; j++)
2266 if (local->curr_rates[j].rate == rate)
2269 wpa_s->mlme.supp_rates_bits = rates;
2276 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2280 wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2281 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2288 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2290 struct ieee80211_sta_bss *bss;
2291 u8 bssid[ETH_ALEN], *pos;
2295 /* Easier testing, use fixed BSSID. */
2296 os_memset(bssid, 0xfe, ETH_ALEN);
2298 /* Generate random, not broadcast, locally administered BSSID. Mix in
2299 * own MAC address to make sure that devices that do not have proper
2300 * random number generator get different BSSID. */
2301 os_get_random(bssid, ETH_ALEN);
2302 for (i = 0; i < ETH_ALEN; i++)
2303 bssid[i] ^= wpa_s->own_addr[i];
2308 wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2309 MACSTR "", MAC2STR(bssid));
2311 bss = ieee80211_bss_add(wpa_s, bssid);
2316 if (local->conf.beacon_int == 0)
2317 local->conf.beacon_int = 100;
2318 bss->beacon_int = local->conf.beacon_int;
2319 bss->hw_mode = local->conf.phymode;
2320 bss->channel = local->conf.channel;
2321 bss->freq = local->conf.freq;
2323 os_get_time(&bss->last_update);
2324 bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2326 if (sdata->default_key) {
2327 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2329 sdata->drop_unencrypted = 0;
2330 bss->supp_rates_len = local->num_curr_rates;
2332 pos = bss->supp_rates;
2334 for (i = 0; i < local->num_curr_rates; i++) {
2335 int rate = local->curr_rates[i].rate;
2336 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2338 *pos++ = (u8) (rate / 5);
2342 return ieee80211_sta_join_ibss(wpa_s, bss);
2347 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2349 struct ieee80211_sta_bss *bss;
2355 if (wpa_s->mlme.ssid_len == 0)
2358 active_ibss = ieee80211_sta_active_ibss(wpa_s);
2359 #ifdef IEEE80211_IBSS_DEBUG
2360 wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2362 #endif /* IEEE80211_IBSS_DEBUG */
2363 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2364 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2365 os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2366 || !(bss->capability & WLAN_CAPABILITY_IBSS))
2368 #ifdef IEEE80211_IBSS_DEBUG
2369 wpa_printf(MSG_DEBUG, " bssid=" MACSTR " found",
2370 MAC2STR(bss->bssid));
2371 #endif /* IEEE80211_IBSS_DEBUG */
2372 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2375 os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2379 #ifdef IEEE80211_IBSS_DEBUG
2380 wpa_printf(MSG_DEBUG, " sta_find_ibss: selected " MACSTR " current "
2381 MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2382 #endif /* IEEE80211_IBSS_DEBUG */
2383 if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2384 (bss = ieee80211_bss_get(wpa_s, bssid))) {
2385 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2386 " based on configured SSID",
2388 return ieee80211_sta_join_ibss(wpa_s, bss);
2390 #ifdef IEEE80211_IBSS_DEBUG
2391 wpa_printf(MSG_DEBUG, " did not try to join ibss");
2392 #endif /* IEEE80211_IBSS_DEBUG */
2394 /* Selected IBSS not found in current scan results - try to scan */
2397 if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2398 !ieee80211_sta_active_ibss(wpa_s)) {
2399 ieee80211_reschedule_timer(wpa_s,
2400 IEEE80211_IBSS_MERGE_INTERVAL);
2401 } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2402 IEEE80211_SCAN_INTERVAL)) {
2403 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2405 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2406 wpa_s->mlme.ssid_len);
2407 } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2408 int interval = IEEE80211_SCAN_INTERVAL;
2410 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2411 IEEE80211_IBSS_JOIN_TIMEOUT)) {
2412 if (wpa_s->mlme.create_ibss &&
2413 ieee80211_ibss_allowed(wpa_s))
2414 return ieee80211_sta_create_ibss(wpa_s);
2415 if (wpa_s->mlme.create_ibss) {
2416 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2417 "on the configured channel %d "
2419 local->conf.channel,
2423 /* No IBSS found - decrease scan interval and continue
2425 interval = IEEE80211_SCAN_INTERVAL_SLOW;
2428 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2429 ieee80211_reschedule_timer(wpa_s, interval);
2438 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2441 os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2442 *len = wpa_s->mlme.ssid_len;
2447 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2448 struct wpa_driver_associate_params *params)
2450 struct ieee80211_sta_bss *bss;
2452 wpa_s->mlme.bssid_set = 0;
2453 wpa_s->mlme.freq = params->freq;
2454 if (params->bssid) {
2455 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2456 if (os_memcmp(params->bssid, "\x00\x00\x00\x00\x00\x00",
2458 wpa_s->mlme.bssid_set = 1;
2459 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2461 wpa_s->mlme.phymode = bss->hw_mode;
2462 wpa_s->mlme.channel = bss->channel;
2463 wpa_s->mlme.freq = bss->freq;
2468 /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2470 if (local->hw->conf_tx) {
2471 struct ieee80211_tx_queue_params qparam;
2474 os_memset(&qparam, 0, sizeof(qparam));
2475 /* TODO: are these ok defaults for all hw_modes? */
2478 local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2479 qparam.cw_max = 1023;
2480 qparam.burst_time = 0;
2481 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2483 local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2486 /* IBSS uses different parameters for Beacon sending */
2490 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2494 if (wpa_s->mlme.ssid_len != params->ssid_len ||
2495 os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2496 wpa_s->mlme.prev_bssid_set = 0;
2497 os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2498 os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2499 MAX_SSID_LEN - params->ssid_len);
2500 wpa_s->mlme.ssid_len = params->ssid_len;
2501 wpa_s->mlme.ssid_set = 1;
2503 os_free(wpa_s->mlme.extra_ie);
2504 if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2505 wpa_s->mlme.extra_ie = NULL;
2506 wpa_s->mlme.extra_ie_len = 0;
2508 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2509 if (wpa_s->mlme.extra_ie == NULL) {
2510 wpa_s->mlme.extra_ie_len = 0;
2513 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2514 params->wpa_ie_len);
2515 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2518 wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2520 ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2521 wpa_s->mlme.channel, wpa_s->mlme.freq);
2523 if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2524 os_get_time(&wpa_s->mlme.ibss_join_req);
2525 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2526 return ieee80211_sta_find_ibss(wpa_s);
2529 if (wpa_s->mlme.bssid_set)
2530 ieee80211_sta_new_auth(wpa_s);
2536 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2538 wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2539 wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2540 wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2544 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2546 wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2547 wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2548 wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2549 if (wpa_s->mlme.freq == 0)
2551 return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2552 wpa_s->mlme.channel,
2557 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2562 for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2563 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2564 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2566 for (c = 0; c < mode->num_channels; c++) {
2567 struct wpa_channel_data *chan = &mode->channels[c];
2568 if (chan->flag & WPA_CHAN_W_SCAN &&
2569 chan->chan == wpa_s->mlme.channel) {
2570 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2581 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2583 struct wpa_supplicant *wpa_s = eloop_ctx;
2584 struct wpa_hw_modes *mode;
2585 struct wpa_channel_data *chan;
2588 struct wpa_ssid *ssid = wpa_s->current_ssid;
2591 if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2594 adhoc = ssid && ssid->mode == 1;
2596 switch (wpa_s->mlme.scan_state) {
2597 case SCAN_SET_CHANNEL:
2598 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2599 if (wpa_s->mlme.scan_hw_mode_idx >=
2600 (int) wpa_s->mlme.num_modes ||
2601 (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2602 (int) wpa_s->mlme.num_modes
2603 && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2604 if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2605 wpa_printf(MSG_DEBUG, "MLME: failed to "
2606 "restore operational channel after "
2609 wpa_printf(MSG_DEBUG, "MLME: scan completed");
2610 wpa_s->mlme.sta_scanning = 0;
2611 os_get_time(&wpa_s->mlme.last_scan_completed);
2612 wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2614 if (!wpa_s->mlme.bssid_set ||
2615 (wpa_s->mlme.state ==
2616 IEEE80211_IBSS_JOINED &&
2617 !ieee80211_sta_active_ibss(wpa_s)))
2618 ieee80211_sta_find_ibss(wpa_s);
2622 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2623 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2624 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2625 (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2626 (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2627 mode->mode == WPA_MODE_IEEE80211B &&
2628 wpa_s->mlme.scan_skip_11b))
2632 wpa_printf(MSG_MSGDUMP,
2633 "MLME: scan channel %d (%d MHz)",
2634 chan->chan, chan->freq);
2636 wpa_s->mlme.channel = chan->chan;
2637 wpa_s->mlme.freq = chan->freq;
2638 wpa_s->mlme.phymode = mode->mode;
2639 if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2640 chan->chan, chan->freq))
2642 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2643 "channel %d (%d MHz) for scan",
2644 chan->chan, chan->freq);
2649 wpa_s->mlme.scan_channel_idx++;
2650 if (wpa_s->mlme.scan_channel_idx >=
2651 wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2653 wpa_s->mlme.scan_hw_mode_idx++;
2654 wpa_s->mlme.scan_channel_idx = 0;
2662 timeout = IEEE80211_PROBE_DELAY;
2663 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2665 case SCAN_SEND_PROBE:
2666 if (ieee80211_active_scan(wpa_s)) {
2667 ieee80211_send_probe_req(wpa_s, NULL,
2668 wpa_s->mlme.scan_ssid,
2669 wpa_s->mlme.scan_ssid_len);
2670 timeout = IEEE80211_CHANNEL_TIME;
2672 timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2674 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2678 eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2679 ieee80211_sta_scan_timer, wpa_s, NULL);
2683 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2686 if (ssid_len > MAX_SSID_LEN)
2689 /* MLME-SCAN.request (page 118) page 144 (11.1.3.1)
2690 * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2693 * ScanType: ACTIVE, PASSIVE
2694 * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2695 * a Probe frame during active scanning
2697 * MinChannelTime (>= ProbeDelay), in TU
2698 * MaxChannelTime: (>= MinChannelTime), in TU
2701 /* MLME-SCAN.confirm
2703 * ResultCode: SUCCESS, INVALID_PARAMETERS
2706 /* TODO: if assoc, move to power save mode for the duration of the
2709 if (wpa_s->mlme.sta_scanning)
2712 wpa_printf(MSG_DEBUG, "MLME: starting scan");
2714 ieee80211_sta_save_oper_chan(wpa_s);
2716 wpa_s->mlme.sta_scanning = 1;
2717 /* TODO: stop TX queue? */
2720 wpa_s->mlme.scan_ssid_len = ssid_len;
2721 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2723 wpa_s->mlme.scan_ssid_len = 0;
2724 wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2726 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2727 wpa_s->mlme.scan_hw_mode_idx = 0;
2728 wpa_s->mlme.scan_channel_idx = 0;
2729 eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2735 struct wpa_scan_results *
2736 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2739 struct wpa_scan_results *res;
2740 struct wpa_scan_res *r;
2741 struct ieee80211_sta_bss *bss;
2743 res = os_zalloc(sizeof(*res));
2744 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2746 res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2747 if (res->res == NULL) {
2752 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2753 r = os_zalloc(sizeof(*r) + bss->ie_len);
2756 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2757 r->freq = bss->freq;
2758 r->beacon_int = bss->beacon_int;
2759 r->caps = bss->capability;
2760 r->level = bss->rssi;
2761 r->tsf = bss->timestamp;
2763 r->ie_len = bss->ie_len;
2764 os_memcpy(r + 1, bss->ie, bss->ie_len);
2767 res->res[res->num++] = r;
2775 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2776 struct sk_buff *skb, u8 *bssid,
2779 struct ieee80211_local *local = dev->priv;
2780 struct list_head *ptr;
2781 struct sta_info *sta;
2782 struct wpa_supplicant *sta_dev = NULL;
2784 /* TODO: Could consider removing the least recently used entry and
2785 * allow new one to be added. */
2786 if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2787 if (net_ratelimit()) {
2788 wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2789 "STA entry " MACSTR, MAC2STR(addr));
2794 spin_lock_bh(&local->sub_if_lock);
2795 list_for_each(ptr, &local->sub_if_list) {
2796 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2797 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2798 os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2799 sta_dev = sdata->dev;
2803 spin_unlock_bh(&local->sub_if_lock);
2805 if (sta_dev == NULL)
2808 wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2809 " (dev=%s)", MAC2STR(addr), sta_dev->name);
2811 sta = sta_info_add(wpa_s, addr);
2817 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2819 rate_control_rate_init(local, sta);
2821 return sta; /* caller will call sta_info_release() */
2826 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2828 wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2830 ieee80211_send_deauth(wpa_s, reason);
2831 ieee80211_set_associated(wpa_s, 0);
2836 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2838 wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2840 if (!wpa_s->mlme.associated)
2843 ieee80211_send_disassoc(wpa_s, reason);
2844 ieee80211_set_associated(wpa_s, 0);
2849 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2850 struct ieee80211_rx_status *rx_status)
2852 struct ieee80211_mgmt *mgmt;
2856 /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2858 if (wpa_s->mlme.sta_scanning) {
2859 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2866 mgmt = (struct ieee80211_mgmt *) buf;
2867 fc = le_to_host16(mgmt->frame_control);
2869 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2870 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2871 else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2872 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2875 /* mgmt->sa is actually BSSID for FromDS data frames */
2876 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2878 /* Skip IEEE 802.11 and LLC headers */
2880 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2883 /* mgmt->bssid is actually BSSID for SA data frames */
2884 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2885 pos, buf + len - pos);
2890 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2891 size_t num_hw_features)
2895 if (hw_features == NULL)
2898 for (i = 0; i < num_hw_features; i++) {
2899 os_free(hw_features[i].channels);
2900 os_free(hw_features[i].rates);
2903 os_free(hw_features);
2907 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
2909 u16 num_modes, flags;
2911 wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
2913 if (wpa_s->mlme.modes == NULL) {
2914 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
2915 "channels and rates from the driver");
2919 wpa_s->mlme.num_modes = num_modes;
2921 wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
2922 wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
2923 wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
2929 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
2931 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
2932 eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
2933 os_free(wpa_s->mlme.extra_ie);
2934 wpa_s->mlme.extra_ie = NULL;
2935 os_free(wpa_s->mlme.extra_probe_ie);
2936 wpa_s->mlme.extra_probe_ie = NULL;
2937 os_free(wpa_s->mlme.assocreq_ies);
2938 wpa_s->mlme.assocreq_ies = NULL;
2939 os_free(wpa_s->mlme.assocresp_ies);
2940 wpa_s->mlme.assocresp_ies = NULL;
2941 ieee80211_bss_list_deinit(wpa_s);
2942 ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
2943 wpa_s->mlme.num_modes);
2944 #ifdef CONFIG_IEEE80211R
2945 os_free(wpa_s->mlme.ft_ies);
2946 wpa_s->mlme.ft_ies = NULL;
2947 wpa_s->mlme.ft_ies_len = 0;
2948 #endif /* CONFIG_IEEE80211R */
2952 #ifdef CONFIG_IEEE80211R
2954 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2955 const u8 *ies, size_t ies_len)
2958 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
2959 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
2961 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
2963 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
2966 wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
2967 os_free(wpa_s->mlme.ft_ies);
2968 wpa_s->mlme.ft_ies = os_malloc(ies_len);
2969 if (wpa_s->mlme.ft_ies == NULL)
2971 os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
2972 wpa_s->mlme.ft_ies_len = ies_len;
2978 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
2979 const u8 *target_ap,
2980 const u8 *ies, size_t ies_len)
2984 struct ieee80211_mgmt *mgmt;
2988 * Action frame payload:
2989 * Category[1] = 6 (Fast BSS Transition)
2990 * Action[1] = 1 (Fast BSS Transition Request)
2996 buf = os_zalloc(sizeof(*mgmt) + ies_len);
2998 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3003 mgmt = (struct ieee80211_mgmt *) buf;
3005 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3006 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3007 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3008 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3009 WLAN_FC_STYPE_ACTION);
3010 mgmt->u.action.category = WLAN_ACTION_FT;
3011 mgmt->u.action.u.ft_action_req.action = action;
3012 os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3014 os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3016 os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3017 len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3019 wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3020 "Target AP=" MACSTR " body_len=%d",
3021 action, MAC2STR(target_ap), ies_len);
3023 res = ieee80211_sta_tx(wpa_s, buf, len);
3029 #endif /* CONFIG_IEEE80211R */
3032 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
3035 os_free(wpa_s->mlme.extra_probe_ie);
3036 wpa_s->mlme.extra_probe_ie = NULL;
3037 wpa_s->mlme.extra_probe_ie_len = 0;
3042 wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3043 if (wpa_s->mlme.extra_probe_ie == NULL)
3046 os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3047 wpa_s->mlme.extra_probe_ie_len = ies_len;