hostapd/ieee802_11.c

   1 /*
   2  * hostapd / IEEE 802.11 Management
   3  * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2007-2008, Intel Corporation
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  *
  10  * Alternatively, this software may be distributed under the terms of BSD
  11  * license.
  12  *
  13  * See README and COPYING for more details.
  14  */
  15
  16 #include "includes.h"
  17
  18 #ifndef CONFIG_NATIVE_WINDOWS
  19
  20 #include <net/if.h>
  21
  22 #include "common.h"
  23 #include "eloop.h"
  24 #include "hostapd.h"
  25 #include "ieee802_11.h"
  26 #include "beacon.h"
  27 #include "hw_features.h"
  28 #include "radius/radius.h"
  29 #include "radius/radius_client.h"
  30 #include "ieee802_11_auth.h"
  31 #include "sta_flags.h"
  32 #include "sta_info.h"
  33 #include "crypto.h"
  34 #include "ieee802_1x.h"
  35 #include "wpa.h"
  36 #include "wme.h"
  37 #include "ap_list.h"
  38 #include "accounting.h"
  39 #include "driver_i.h"
  40 #include "mlme.h"
  41 #include "common/wpa_ctrl.h"
  42
  43
  44 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
  45 {
  46         u8 *pos = eid;
  47         int i, num, count;
  48
  49         if (hapd->iface->current_rates == NULL)
  50                 return eid;
  51
  52         *pos++ = WLAN_EID_SUPP_RATES;
  53         num = hapd->iface->num_rates;
  54         if (num > 8) {
  55                 /* rest of the rates are encoded in Extended supported
  56                  * rates element */
  57                 num = 8;
  58         }
  59
  60         *pos++ = num;
  61         count = 0;
  62         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
  63              i++) {
  64                 count++;
  65                 *pos = hapd->iface->current_rates[i].rate / 5;
  66                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  67                         *pos |= 0x80;
  68                 pos++;
  69         }
  70
  71         return pos;
  72 }
  73
  74
  75 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
  76 {
  77         u8 *pos = eid;
  78         int i, num, count;
  79
  80         if (hapd->iface->current_rates == NULL)
  81                 return eid;
  82
  83         num = hapd->iface->num_rates;
  84         if (num <= 8)
  85                 return eid;
  86         num -= 8;
  87
  88         *pos++ = WLAN_EID_EXT_SUPP_RATES;
  89         *pos++ = num;
  90         count = 0;
  91         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
  92              i++) {
  93                 count++;
  94                 if (count <= 8)
  95                         continue; /* already in SuppRates IE */
  96                 *pos = hapd->iface->current_rates[i].rate / 5;
  97                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  98                         *pos |= 0x80;
  99                 pos++;
 100         }
 101
 102         return pos;
 103 }
 104
 105
 106 u8 * hostapd_eid_ht_capabilities(struct hostapd_data *hapd, u8 *eid)
 107 {
 108 #ifdef CONFIG_IEEE80211N
 109         struct ieee80211_ht_capabilities *cap;
 110         u8 *pos = eid;
 111
 112         if (!hapd->iconf->ieee80211n)
 113                 return eid;
 114
 115         *pos++ = WLAN_EID_HT_CAP;
 116         *pos++ = sizeof(*cap);
 117
 118         cap = (struct ieee80211_ht_capabilities *) pos;
 119         os_memset(cap, 0, sizeof(*cap));
 120         cap->ht_capabilities_info = host_to_le16(hapd->iconf->ht_capab);
 121         cap->a_mpdu_params = hapd->iface->current_mode->a_mpdu_params;
 122         os_memcpy(cap->supported_mcs_set, hapd->iface->current_mode->mcs_set,
 123                   16);
 124
 125         /* TODO: ht_extended_capabilities (now fully disabled) */
 126         /* TODO: tx_bf_capability_info (now fully disabled) */
 127         /* TODO: asel_capabilities (now fully disabled) */
 128
 129         pos += sizeof(*cap);
 130
 131         return pos;
 132 #else /* CONFIG_IEEE80211N */
 133         return eid;
 134 #endif /* CONFIG_IEEE80211N */
 135 }
 136
 137
 138 u8 * hostapd_eid_ht_operation(struct hostapd_data *hapd, u8 *eid)
 139 {
 140 #ifdef CONFIG_IEEE80211N
 141         struct ieee80211_ht_operation *oper;
 142         u8 *pos = eid;
 143
 144         if (!hapd->iconf->ieee80211n)
 145                 return eid;
 146
 147         *pos++ = WLAN_EID_HT_OPERATION;
 148         *pos++ = sizeof(*oper);
 149
 150         oper = (struct ieee80211_ht_operation *) pos;
 151         os_memset(oper, 0, sizeof(*oper));
 152
 153         oper->control_chan = hapd->iconf->channel;
 154         oper->operation_mode = host_to_le16(hapd->iface->ht_op_mode);
 155         if (hapd->iconf->secondary_channel == 1)
 156                 oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE |
 157                         HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH;
 158         if (hapd->iconf->secondary_channel == -1)
 159                 oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW |
 160                         HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH;
 161
 162         pos += sizeof(*oper);
 163
 164         return pos;
 165 #else /* CONFIG_IEEE80211N */
 166         return eid;
 167 #endif /* CONFIG_IEEE80211N */
 168 }
 169
 170
 171 #ifdef CONFIG_IEEE80211N
 172
 173 /*
 174 op_mode
 175 Set to 0 (HT pure) under the followign conditions
 176         - all STAs in the BSS are 20/40 MHz HT in 20/40 MHz BSS or
 177         - all STAs in the BSS are 20 MHz HT in 20 MHz BSS
 178 Set to 1 (HT non-member protection) if there may be non-HT STAs
 179         in both the primary and the secondary channel
 180 Set to 2 if only HT STAs are associated in BSS,
 181         however and at least one 20 MHz HT STA is associated
 182 Set to 3 (HT mixed mode) when one or more non-HT STAs are associated
 183         (currently non-GF HT station is considered as non-HT STA also)
 184 */
 185 int hostapd_ht_operation_update(struct hostapd_iface *iface)
 186 {
 187         u16 cur_op_mode, new_op_mode;
 188         int op_mode_changes = 0;
 189
 190         if (!iface->conf->ieee80211n || iface->conf->ht_op_mode_fixed)
 191                 return 0;
 192
 193         wpa_printf(MSG_DEBUG, "%s current operation mode=0x%X",
 194                    __func__, iface->ht_op_mode);
 195
 196         if (!(iface->ht_op_mode & HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT)
 197             && iface->num_sta_ht_no_gf) {
 198                 iface->ht_op_mode |=
 199                         HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT;
 200                 op_mode_changes++;
 201         } else if ((iface->ht_op_mode &
 202                     HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT) &&
 203                    iface->num_sta_ht_no_gf == 0) {
 204                 iface->ht_op_mode &=
 205                         ~HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT;
 206                 op_mode_changes++;
 207         }
 208
 209         if (!(iface->ht_op_mode & HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT) &&
 210             (iface->num_sta_no_ht || iface->olbc_ht)) {
 211                 iface->ht_op_mode |= HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT;
 212                 op_mode_changes++;
 213         } else if ((iface->ht_op_mode &
 214                     HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT) &&
 215                    (iface->num_sta_no_ht == 0 && !iface->olbc_ht)) {
 216                 iface->ht_op_mode &=
 217                         ~HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT;
 218                 op_mode_changes++;
 219         }
 220
 221         /* Note: currently we switch to the MIXED op mode if HT non-greenfield
 222          * station is associated. Probably it's a theoretical case, since
 223          * it looks like all known HT STAs support greenfield.
 224          */
 225         new_op_mode = 0;
 226         if (iface->num_sta_no_ht ||
 227             (iface->ht_op_mode & HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT))
 228                 new_op_mode = OP_MODE_MIXED;
 229         else if ((iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
 230                  && iface->num_sta_ht_20mhz)
 231                 new_op_mode = OP_MODE_20MHZ_HT_STA_ASSOCED;
 232         else if (iface->olbc_ht)
 233                 new_op_mode = OP_MODE_MAY_BE_LEGACY_STAS;
 234         else
 235                 new_op_mode = OP_MODE_PURE;
 236
 237         cur_op_mode = iface->ht_op_mode & HT_INFO_OPERATION_MODE_OP_MODE_MASK;
 238         if (cur_op_mode != new_op_mode) {
 239                 iface->ht_op_mode &= ~HT_INFO_OPERATION_MODE_OP_MODE_MASK;
 240                 iface->ht_op_mode |= new_op_mode;
 241                 op_mode_changes++;
 242         }
 243
 244         wpa_printf(MSG_DEBUG, "%s new operation mode=0x%X changes=%d",
 245                    __func__, iface->ht_op_mode, op_mode_changes);
 246
 247         return op_mode_changes;
 248 }
 249
 250 #endif /* CONFIG_IEEE80211N */
 251
 252
 253 u16 hostapd_own_capab_info(struct hostapd_data *hapd, struct sta_info *sta,
 254                            int probe)
 255 {
 256         int capab = WLAN_CAPABILITY_ESS;
 257         int privacy;
 258
 259         if (hapd->iface->num_sta_no_short_preamble == 0 &&
 260             hapd->iconf->preamble == SHORT_PREAMBLE)
 261                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 262
 263         privacy = hapd->conf->ssid.wep.keys_set;
 264
 265         if (hapd->conf->ieee802_1x &&
 266             (hapd->conf->default_wep_key_len ||
 267              hapd->conf->individual_wep_key_len))
 268                 privacy = 1;
 269
 270         if (hapd->conf->wpa)
 271                 privacy = 1;
 272
 273         if (sta) {
 274                 int policy, def_klen;
 275                 if (probe && sta->ssid_probe) {
 276                         policy = sta->ssid_probe->security_policy;
 277                         def_klen = sta->ssid_probe->wep.default_len;
 278                 } else {
 279                         policy = sta->ssid->security_policy;
 280                         def_klen = sta->ssid->wep.default_len;
 281                 }
 282                 privacy = policy != SECURITY_PLAINTEXT;
 283                 if (policy == SECURITY_IEEE_802_1X && def_klen == 0)
 284                         privacy = 0;
 285         }
 286
 287         if (privacy)
 288                 capab |= WLAN_CAPABILITY_PRIVACY;
 289
 290         if (hapd->iface->current_mode &&
 291             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
 292             hapd->iface->num_sta_no_short_slot_time == 0)
 293                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 294
 295         return capab;
 296 }
 297
 298
 299 #ifdef CONFIG_IEEE80211W
 300 static u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
 301                                             struct sta_info *sta, u8 *eid)
 302 {
 303         u8 *pos = eid;
 304         u32 timeout, tu;
 305         struct os_time now, passed;
 306
 307         *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
 308         *pos++ = 5;
 309         *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
 310         os_get_time(&now);
 311         os_time_sub(&now, &sta->sa_query_start, &passed);
 312         tu = (passed.sec * 1000000 + passed.usec) / 1024;
 313         if (hapd->conf->assoc_sa_query_max_timeout > tu)
 314                 timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
 315         else
 316                 timeout = 0;
 317         if (timeout < hapd->conf->assoc_sa_query_max_timeout)
 318                 timeout++; /* add some extra time for local timers */
 319         WPA_PUT_LE32(pos, timeout);
 320         pos += 4;
 321
 322         return pos;
 323 }
 324 #endif /* CONFIG_IEEE80211W */
 325
 326
 327 void ieee802_11_print_ssid(char *buf, const u8 *ssid, u8 len)
 328 {
 329         int i;
 330         if (len > HOSTAPD_MAX_SSID_LEN)
 331                 len = HOSTAPD_MAX_SSID_LEN;
 332         for (i = 0; i < len; i++) {
 333                 if (ssid[i] >= 32 && ssid[i] < 127)
 334                         buf[i] = ssid[i];
 335                 else
 336                         buf[i] = '.';
 337         }
 338         buf[len] = '\0';
 339 }
 340
 341
 342 /**
 343  * ieee802_11_send_deauth - Send Deauthentication frame
 344  * @hapd: hostapd BSS data
 345  * @addr: Address of the destination STA
 346  * @reason: Reason code for Deauthentication
 347  */
 348 void ieee802_11_send_deauth(struct hostapd_data *hapd, u8 *addr, u16 reason)
 349 {
 350         struct ieee80211_mgmt mgmt;
 351
 352         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
 353                        HOSTAPD_LEVEL_DEBUG,
 354                        "deauthenticate - reason %d", reason);
 355         os_memset(&mgmt, 0, sizeof(mgmt));
 356         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 357                                           WLAN_FC_STYPE_DEAUTH);
 358         os_memcpy(mgmt.da, addr, ETH_ALEN);
 359         os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
 360         os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
 361         mgmt.u.deauth.reason_code = host_to_le16(reason);
 362         if (hostapd_send_mgmt_frame(hapd, &mgmt, IEEE80211_HDRLEN +
 363                                     sizeof(mgmt.u.deauth)) < 0)
 364                 perror("ieee802_11_send_deauth: send");
 365 }
 366
 367
 368 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
 369                            u16 auth_transaction, u8 *challenge, int iswep)
 370 {
 371         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 372                        HOSTAPD_LEVEL_DEBUG,
 373                        "authentication (shared key, transaction %d)",
 374                        auth_transaction);
 375
 376         if (auth_transaction == 1) {
 377                 if (!sta->challenge) {
 378                         /* Generate a pseudo-random challenge */
 379                         u8 key[8];
 380                         time_t now;
 381                         int r;
 382                         sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
 383                         if (sta->challenge == NULL)
 384                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 385
 386                         now = time(NULL);
 387                         r = random();
 388                         os_memcpy(key, &now, 4);
 389                         os_memcpy(key + 4, &r, 4);
 390                         rc4_skip(key, sizeof(key), 0,
 391                                  sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
 392                 }
 393                 return 0;
 394         }
 395
 396         if (auth_transaction != 3)
 397                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 398
 399         /* Transaction 3 */
 400         if (!iswep || !sta->challenge || !challenge ||
 401             os_memcmp(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) {
 402                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 403                                HOSTAPD_LEVEL_INFO,
 404                                "shared key authentication - invalid "
 405                                "challenge-response");
 406                 return WLAN_STATUS_CHALLENGE_FAIL;
 407         }
 408
 409         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 410                        HOSTAPD_LEVEL_DEBUG,
 411                        "authentication OK (shared key)");
 412 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 413         /* Station will be marked authenticated if it ACKs the
 414          * authentication reply. */
 415 #else
 416         sta->flags |= WLAN_STA_AUTH;
 417         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 418 #endif
 419         os_free(sta->challenge);
 420         sta->challenge = NULL;
 421
 422         return 0;
 423 }
 424
 425
 426 static void send_auth_reply(struct hostapd_data *hapd,
 427                             const u8 *dst, const u8 *bssid,
 428                             u16 auth_alg, u16 auth_transaction, u16 resp,
 429                             const u8 *ies, size_t ies_len)
 430 {
 431         struct ieee80211_mgmt *reply;
 432         u8 *buf;
 433         size_t rlen;
 434
 435         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
 436         buf = os_zalloc(rlen);
 437         if (buf == NULL)
 438                 return;
 439
 440         reply = (struct ieee80211_mgmt *) buf;
 441         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 442                                             WLAN_FC_STYPE_AUTH);
 443         os_memcpy(reply->da, dst, ETH_ALEN);
 444         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 445         os_memcpy(reply->bssid, bssid, ETH_ALEN);
 446
 447         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 448         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 449         reply->u.auth.status_code = host_to_le16(resp);
 450
 451         if (ies && ies_len)
 452                 os_memcpy(reply->u.auth.variable, ies, ies_len);
 453
 454         wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
 455                    " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
 456                    MAC2STR(dst), auth_alg, auth_transaction,
 457                    resp, (unsigned long) ies_len);
 458         if (hostapd_send_mgmt_frame(hapd, reply, rlen) < 0)
 459                 perror("send_auth_reply: send");
 460
 461         os_free(buf);
 462 }
 463
 464
 465 #ifdef CONFIG_IEEE80211R
 466 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
 467                                   u16 auth_transaction, u16 status,
 468                                   const u8 *ies, size_t ies_len)
 469 {
 470         struct hostapd_data *hapd = ctx;
 471         struct sta_info *sta;
 472
 473         send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT, auth_transaction,
 474                         status, ies, ies_len);
 475
 476         if (status != WLAN_STATUS_SUCCESS)
 477                 return;
 478
 479         sta = ap_get_sta(hapd, dst);
 480         if (sta == NULL)
 481                 return;
 482
 483         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 484                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 485         sta->flags |= WLAN_STA_AUTH;
 486         mlme_authenticate_indication(hapd, sta);
 487 }
 488 #endif /* CONFIG_IEEE80211R */
 489
 490
 491 static void handle_auth(struct hostapd_data *hapd, struct ieee80211_mgmt *mgmt,
 492                         size_t len)
 493 {
 494         u16 auth_alg, auth_transaction, status_code;
 495         u16 resp = WLAN_STATUS_SUCCESS;
 496         struct sta_info *sta = NULL;
 497         int res;
 498         u16 fc;
 499         u8 *challenge = NULL;
 500         u32 session_timeout, acct_interim_interval;
 501         int vlan_id = 0;
 502         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 503         size_t resp_ies_len = 0;
 504
 505         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 506                 printf("handle_auth - too short payload (len=%lu)\n",
 507                        (unsigned long) len);
 508                 return;
 509         }
 510
 511         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 512         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 513         status_code = le_to_host16(mgmt->u.auth.status_code);
 514         fc = le_to_host16(mgmt->frame_control);
 515
 516         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 517             2 + WLAN_AUTH_CHALLENGE_LEN &&
 518             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 519             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 520                 challenge = &mgmt->u.auth.variable[2];
 521
 522         wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
 523                    "auth_transaction=%d status_code=%d wep=%d%s",
 524                    MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 525                    status_code, !!(fc & WLAN_FC_ISWEP),
 526                    challenge ? " challenge" : "");
 527
 528         if (hapd->tkip_countermeasures) {
 529                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 530                 goto fail;
 531         }
 532
 533         if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
 534                auth_alg == WLAN_AUTH_OPEN) ||
 535 #ifdef CONFIG_IEEE80211R
 536               (hapd->conf->wpa &&
 537                (hapd->conf->wpa_key_mgmt &
 538                 (WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK)) &&
 539                auth_alg == WLAN_AUTH_FT) ||
 540 #endif /* CONFIG_IEEE80211R */
 541               ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
 542                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 543                 printf("Unsupported authentication algorithm (%d)\n",
 544                        auth_alg);
 545                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 546                 goto fail;
 547         }
 548
 549         if (!(auth_transaction == 1 ||
 550               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
 551                 printf("Unknown authentication transaction number (%d)\n",
 552                        auth_transaction);
 553                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 554                 goto fail;
 555         }
 556
 557         if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
 558                 printf("Station " MACSTR " not allowed to authenticate.\n",
 559                        MAC2STR(mgmt->sa));
 560                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 561                 goto fail;
 562         }
 563
 564         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
 565                                       &session_timeout,
 566                                       &acct_interim_interval, &vlan_id);
 567         if (res == HOSTAPD_ACL_REJECT) {
 568                 printf("Station " MACSTR " not allowed to authenticate.\n",
 569                        MAC2STR(mgmt->sa));
 570                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 571                 goto fail;
 572         }
 573         if (res == HOSTAPD_ACL_PENDING) {
 574                 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
 575                            " waiting for an external authentication",
 576                            MAC2STR(mgmt->sa));
 577                 /* Authentication code will re-send the authentication frame
 578                  * after it has received (and cached) information from the
 579                  * external source. */
 580                 return;
 581         }
 582
 583         sta = ap_sta_add(hapd, mgmt->sa);
 584         if (!sta) {
 585                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 586                 goto fail;
 587         }
 588
 589         if (vlan_id > 0) {
 590                 if (hostapd_get_vlan_id_ifname(hapd->conf->vlan,
 591                                                vlan_id) == NULL) {
 592                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 593                                        HOSTAPD_LEVEL_INFO, "Invalid VLAN ID "
 594                                        "%d received from RADIUS server",
 595                                        vlan_id);
 596                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 597                         goto fail;
 598                 }
 599                 sta->vlan_id = vlan_id;
 600                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 601                                HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
 602         }
 603
 604         sta->flags &= ~WLAN_STA_PREAUTH;
 605         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 606
 607         if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
 608                 sta->acct_interim_interval = acct_interim_interval;
 609         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
 610                 ap_sta_session_timeout(hapd, sta, session_timeout);
 611         else
 612                 ap_sta_no_session_timeout(hapd, sta);
 613
 614         switch (auth_alg) {
 615         case WLAN_AUTH_OPEN:
 616                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 617                                HOSTAPD_LEVEL_DEBUG,
 618                                "authentication OK (open system)");
 619 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 620                 /* Station will be marked authenticated if it ACKs the
 621                  * authentication reply. */
 622 #else
 623                 sta->flags |= WLAN_STA_AUTH;
 624                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 625                 sta->auth_alg = WLAN_AUTH_OPEN;
 626                 mlme_authenticate_indication(hapd, sta);
 627 #endif
 628                 break;
 629         case WLAN_AUTH_SHARED_KEY:
 630                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
 631                                        fc & WLAN_FC_ISWEP);
 632                 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
 633                 mlme_authenticate_indication(hapd, sta);
 634                 if (sta->challenge && auth_transaction == 1) {
 635                         resp_ies[0] = WLAN_EID_CHALLENGE;
 636                         resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
 637                         os_memcpy(resp_ies + 2, sta->challenge,
 638                                   WLAN_AUTH_CHALLENGE_LEN);
 639                         resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
 640                 }
 641                 break;
 642 #ifdef CONFIG_IEEE80211R
 643         case WLAN_AUTH_FT:
 644                 sta->auth_alg = WLAN_AUTH_FT;
 645                 if (sta->wpa_sm == NULL)
 646                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 647                                                         sta->addr);
 648                 if (sta->wpa_sm == NULL) {
 649                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
 650                                    "state machine");
 651                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 652                         goto fail;
 653                 }
 654                 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
 655                                     auth_transaction, mgmt->u.auth.variable,
 656                                     len - IEEE80211_HDRLEN -
 657                                     sizeof(mgmt->u.auth),
 658                                     handle_auth_ft_finish, hapd);
 659                 /* handle_auth_ft_finish() callback will complete auth. */
 660                 return;
 661 #endif /* CONFIG_IEEE80211R */
 662         }
 663
 664  fail:
 665         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
 666                         auth_transaction + 1, resp, resp_ies, resp_ies_len);
 667 }
 668
 669
 670 static int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
 671 {
 672         int i, j = 32, aid;
 673
 674         /* get a unique AID */
 675         if (sta->aid > 0) {
 676                 wpa_printf(MSG_DEBUG, "  old AID %d", sta->aid);
 677                 return 0;
 678         }
 679
 680         for (i = 0; i < AID_WORDS; i++) {
 681                 if (hapd->sta_aid[i] == (u32) -1)
 682                         continue;
 683                 for (j = 0; j < 32; j++) {
 684                         if (!(hapd->sta_aid[i] & BIT(j)))
 685                                 break;
 686                 }
 687                 if (j < 32)
 688                         break;
 689         }
 690         if (j == 32)
 691                 return -1;
 692         aid = i * 32 + j + 1;
 693         if (aid > 2007)
 694                 return -1;
 695
 696         sta->aid = aid;
 697         hapd->sta_aid[i] |= BIT(j);
 698         wpa_printf(MSG_DEBUG, "  new AID %d", sta->aid);
 699         return 0;
 700 }
 701
 702
 703 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
 704                       const u8 *ssid_ie, size_t ssid_ie_len)
 705 {
 706         if (ssid_ie == NULL)
 707                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 708
 709         if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
 710             os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
 711                 char ssid_txt[33];
 712                 ieee802_11_print_ssid(ssid_txt, ssid_ie, ssid_ie_len);
 713                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 714                                HOSTAPD_LEVEL_INFO,
 715                                "Station tried to associate with unknown SSID "
 716                                "'%s'", ssid_txt);
 717                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 718         }
 719
 720         return WLAN_STATUS_SUCCESS;
 721 }
 722
 723
 724 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
 725                      const u8 *wmm_ie, size_t wmm_ie_len)
 726 {
 727         sta->flags &= ~WLAN_STA_WMM;
 728         if (wmm_ie && hapd->conf->wmm_enabled) {
 729                 if (hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len))
 730                         hostapd_logger(hapd, sta->addr,
 731                                        HOSTAPD_MODULE_WPA,
 732                                        HOSTAPD_LEVEL_DEBUG,
 733                                        "invalid WMM element in association "
 734                                        "request");
 735                 else
 736                         sta->flags |= WLAN_STA_WMM;
 737         }
 738         return WLAN_STATUS_SUCCESS;
 739 }
 740
 741
 742 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
 743                            struct ieee802_11_elems *elems)
 744 {
 745         if (!elems->supp_rates) {
 746                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 747                                HOSTAPD_LEVEL_DEBUG,
 748                                "No supported rates element in AssocReq");
 749                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 750         }
 751
 752         if (elems->supp_rates_len > sizeof(sta->supported_rates)) {
 753                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 754                                HOSTAPD_LEVEL_DEBUG,
 755                                "Invalid supported rates element length %d",
 756                                elems->supp_rates_len);
 757                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 758         }
 759
 760         os_memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
 761         os_memcpy(sta->supported_rates, elems->supp_rates,
 762                   elems->supp_rates_len);
 763         sta->supported_rates_len = elems->supp_rates_len;
 764
 765         if (elems->ext_supp_rates) {
 766                 if (elems->supp_rates_len + elems->ext_supp_rates_len >
 767                     sizeof(sta->supported_rates)) {
 768                         hostapd_logger(hapd, sta->addr,
 769                                        HOSTAPD_MODULE_IEEE80211,
 770                                        HOSTAPD_LEVEL_DEBUG,
 771                                        "Invalid supported rates element length"
 772                                        " %d+%d", elems->supp_rates_len,
 773                                        elems->ext_supp_rates_len);
 774                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 775                 }
 776
 777                 os_memcpy(sta->supported_rates + elems->supp_rates_len,
 778                           elems->ext_supp_rates, elems->ext_supp_rates_len);
 779                 sta->supported_rates_len += elems->ext_supp_rates_len;
 780         }
 781
 782         return WLAN_STATUS_SUCCESS;
 783 }
 784
 785
 786 #ifdef CONFIG_IEEE80211N
 787
 788 static u16 copy_sta_ht_capab(struct sta_info *sta, const u8 *ht_capab,
 789                              size_t ht_capab_len)
 790 {
 791         if (!ht_capab ||
 792             ht_capab_len < sizeof(struct ieee80211_ht_capabilities)) {
 793                 sta->flags &= ~WLAN_STA_HT;
 794                 os_free(sta->ht_capabilities);
 795                 sta->ht_capabilities = NULL;
 796                 return WLAN_STATUS_SUCCESS;
 797         }
 798
 799         if (sta->ht_capabilities == NULL) {
 800                 sta->ht_capabilities =
 801                         os_zalloc(sizeof(struct ieee80211_ht_capabilities));
 802                 if (sta->ht_capabilities == NULL)
 803                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 804         }
 805
 806         sta->flags |= WLAN_STA_HT;
 807         os_memcpy(sta->ht_capabilities, ht_capab,
 808                   sizeof(struct ieee80211_ht_capabilities));
 809
 810         return WLAN_STATUS_SUCCESS;
 811 }
 812
 813
 814 static void update_sta_ht(struct hostapd_data *hapd, struct sta_info *sta)
 815 {
 816         u16 ht_capab;
 817
 818         ht_capab = le_to_host16(sta->ht_capabilities->ht_capabilities_info);
 819         wpa_printf(MSG_DEBUG, "HT: STA " MACSTR " HT Capabilities Info: "
 820                    "0x%04x", MAC2STR(sta->addr), ht_capab);
 821         if ((ht_capab & HT_CAP_INFO_GREEN_FIELD) == 0) {
 822                 if (!sta->no_ht_gf_set) {
 823                         sta->no_ht_gf_set = 1;
 824                         hapd->iface->num_sta_ht_no_gf++;
 825                 }
 826                 wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - no greenfield, num "
 827                            "of non-gf stations %d",
 828                            __func__, MAC2STR(sta->addr),
 829                            hapd->iface->num_sta_ht_no_gf);
 830         }
 831         if ((ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET) == 0) {
 832                 if (!sta->ht_20mhz_set) {
 833                         sta->ht_20mhz_set = 1;
 834                         hapd->iface->num_sta_ht_20mhz++;
 835                 }
 836                 wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - 20 MHz HT, num of "
 837                            "20MHz HT STAs %d",
 838                            __func__, MAC2STR(sta->addr),
 839                            hapd->iface->num_sta_ht_20mhz);
 840         }
 841 }
 842
 843
 844 static void update_sta_no_ht(struct hostapd_data *hapd, struct sta_info *sta)
 845 {
 846         if (!sta->no_ht_set) {
 847                 sta->no_ht_set = 1;
 848                 hapd->iface->num_sta_no_ht++;
 849         }
 850         if (hapd->iconf->ieee80211n) {
 851                 wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - no HT, num of "
 852                            "non-HT stations %d",
 853                            __func__, MAC2STR(sta->addr),
 854                            hapd->iface->num_sta_no_ht);
 855         }
 856 }
 857
 858
 859 static void update_ht_state(struct hostapd_data *hapd, struct sta_info *sta)
 860 {
 861         if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities)
 862                 update_sta_ht(hapd, sta);
 863         else
 864                 update_sta_no_ht(hapd, sta);
 865
 866         if (hostapd_ht_operation_update(hapd->iface) > 0)
 867                 ieee802_11_set_beacons(hapd->iface);
 868 }
 869
 870 #else /* CONFIG_IEEE80211N */
 871
 872 static u16 copy_sta_ht_capab(struct sta_info *sta, const u8 *ht_capab,
 873                              size_t ht_capab_len)
 874 {
 875         return WLAN_STATUS_SUCCESS;
 876 }
 877
 878
 879 static void update_ht_state(struct hostapd_data *hapd, struct sta_info *sta)
 880 {
 881 }
 882
 883 #endif /* CONFIG_IEEE80211N */
 884
 885
 886 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
 887                            u8 *ies, size_t ies_len, int reassoc)
 888 {
 889         struct ieee802_11_elems elems;
 890         u16 resp;
 891         u8 *wpa_ie;
 892         size_t wpa_ie_len;
 893
 894         if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
 895                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 896                                HOSTAPD_LEVEL_INFO, "Station sent an invalid "
 897                                "association request");
 898                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 899         }
 900
 901         resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
 902         if (resp != WLAN_STATUS_SUCCESS)
 903                 return resp;
 904         resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
 905         if (resp != WLAN_STATUS_SUCCESS)
 906                 return resp;
 907         resp = copy_supp_rates(hapd, sta, &elems);
 908         if (resp != WLAN_STATUS_SUCCESS)
 909                 return resp;
 910         resp = copy_sta_ht_capab(sta, elems.ht_capabilities,
 911                                  elems.ht_capabilities_len);
 912         if (resp != WLAN_STATUS_SUCCESS)
 913                 return resp;
 914
 915         if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
 916                 wpa_ie = elems.rsn_ie;
 917                 wpa_ie_len = elems.rsn_ie_len;
 918         } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
 919                    elems.wpa_ie) {
 920                 wpa_ie = elems.wpa_ie;
 921                 wpa_ie_len = elems.wpa_ie_len;
 922         } else {
 923                 wpa_ie = NULL;
 924                 wpa_ie_len = 0;
 925         }
 926
 927 #ifdef CONFIG_WPS
 928         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
 929         if (hapd->conf->wps_state && wpa_ie == NULL) {
 930                 if (elems.wps_ie) {
 931                         wpa_printf(MSG_DEBUG, "STA included WPS IE in "
 932                                    "(Re)Association Request - assume WPS is "
 933                                    "used");
 934                         sta->flags |= WLAN_STA_WPS;
 935                         wpabuf_free(sta->wps_ie);
 936                         sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4,
 937                                                         elems.wps_ie_len - 4);
 938                 } else {
 939                         wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE "
 940                                    "in (Re)Association Request - possible WPS "
 941                                    "use");
 942                         sta->flags |= WLAN_STA_MAYBE_WPS;
 943                 }
 944         } else
 945 #endif /* CONFIG_WPS */
 946         if (hapd->conf->wpa && wpa_ie == NULL) {
 947                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 948                                HOSTAPD_LEVEL_INFO,
 949                                "No WPA/RSN IE in association request");
 950                 return WLAN_STATUS_INVALID_IE;
 951         }
 952
 953         if (hapd->conf->wpa && wpa_ie) {
 954                 int res;
 955                 wpa_ie -= 2;
 956                 wpa_ie_len += 2;
 957                 if (sta->wpa_sm == NULL)
 958                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 959                                                         sta->addr);
 960                 if (sta->wpa_sm == NULL) {
 961                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
 962                                    "state machine");
 963                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 964                 }
 965                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
 966                                           wpa_ie, wpa_ie_len,
 967                                           elems.mdie, elems.mdie_len);
 968                 if (res == WPA_INVALID_GROUP)
 969                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 970                 else if (res == WPA_INVALID_PAIRWISE)
 971                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
 972                 else if (res == WPA_INVALID_AKMP)
 973                         resp = WLAN_STATUS_AKMP_NOT_VALID;
 974                 else if (res == WPA_ALLOC_FAIL)
 975                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 976 #ifdef CONFIG_IEEE80211W
 977                 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
 978                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
 979                 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
 980                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
 981 #endif /* CONFIG_IEEE80211W */
 982                 else if (res == WPA_INVALID_MDIE)
 983                         resp = WLAN_STATUS_INVALID_MDIE;
 984                 else if (res != WPA_IE_OK)
 985                         resp = WLAN_STATUS_INVALID_IE;
 986                 if (resp != WLAN_STATUS_SUCCESS)
 987                         return resp;
 988 #ifdef CONFIG_IEEE80211W
 989                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 990                     sta->sa_query_count > 0)
 991                         ap_check_sa_query_timeout(hapd, sta);
 992                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 993                     (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
 994                         /*
 995                          * STA has already been associated with MFP and SA
 996                          * Query timeout has not been reached. Reject the
 997                          * association attempt temporarily and start SA Query,
 998                          * if one is not pending.
 999                          */
1000
1001                         if (sta->sa_query_count == 0)
1002                                 ap_sta_start_sa_query(hapd, sta);
1003
1004                         return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
1005                 }
1006
1007                 if (wpa_auth_uses_mfp(sta->wpa_sm))
1008                         sta->flags |= WLAN_STA_MFP;
1009                 else
1010                         sta->flags &= ~WLAN_STA_MFP;
1011 #endif /* CONFIG_IEEE80211W */
1012
1013 #ifdef CONFIG_IEEE80211R
1014                 if (sta->auth_alg == WLAN_AUTH_FT) {
1015                         if (!reassoc) {
1016                                 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
1017                                            "to use association (not "
1018                                            "re-association) with FT auth_alg",
1019                                            MAC2STR(sta->addr));
1020                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1021                         }
1022
1023                         resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
1024                                                        ies_len);
1025                         if (resp != WLAN_STATUS_SUCCESS)
1026                                 return resp;
1027                 }
1028 #endif /* CONFIG_IEEE80211R */
1029
1030 #ifdef CONFIG_IEEE80211N
1031                 if ((sta->flags & WLAN_STA_HT) &&
1032                     wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
1033                         hostapd_logger(hapd, sta->addr,
1034                                        HOSTAPD_MODULE_IEEE80211,
1035                                        HOSTAPD_LEVEL_INFO,
1036                                        "Station tried to use TKIP with HT "
1037                                        "association");
1038                         return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1039                 }
1040 #endif /* CONFIG_IEEE80211N */
1041         } else
1042                 wpa_auth_sta_no_wpa(sta->wpa_sm);
1043
1044         return WLAN_STATUS_SUCCESS;
1045 }
1046
1047
1048 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
1049                         u16 reason_code)
1050 {
1051         int send_len;
1052         struct ieee80211_mgmt reply;
1053
1054         os_memset(&reply, 0, sizeof(reply));
1055         reply.frame_control =
1056                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
1057         os_memcpy(reply.da, addr, ETH_ALEN);
1058         os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
1059         os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
1060
1061         send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
1062         reply.u.deauth.reason_code = host_to_le16(reason_code);
1063
1064         if (hostapd_send_mgmt_frame(hapd, &reply, send_len) < 0)
1065                 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
1066                            strerror(errno));
1067 }
1068
1069
1070 static void send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
1071                             u16 status_code, int reassoc, u8 *ies,
1072                             size_t ies_len)
1073 {
1074         int send_len;
1075         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
1076         struct ieee80211_mgmt *reply;
1077         u8 *p;
1078
1079         os_memset(buf, 0, sizeof(buf));
1080         reply = (struct ieee80211_mgmt *) buf;
1081         reply->frame_control =
1082                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1083                              (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
1084                               WLAN_FC_STYPE_ASSOC_RESP));
1085         os_memcpy(reply->da, sta->addr, ETH_ALEN);
1086         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
1087         os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
1088
1089         send_len = IEEE80211_HDRLEN;
1090         send_len += sizeof(reply->u.assoc_resp);
1091         reply->u.assoc_resp.capab_info =
1092                 host_to_le16(hostapd_own_capab_info(hapd, sta, 0));
1093         reply->u.assoc_resp.status_code = host_to_le16(status_code);
1094         reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0)
1095                                                | BIT(14) | BIT(15));
1096         /* Supported rates */
1097         p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
1098         /* Extended supported rates */
1099         p = hostapd_eid_ext_supp_rates(hapd, p);
1100         if (sta->flags & WLAN_STA_WMM)
1101                 p = hostapd_eid_wmm(hapd, p);
1102
1103         p = hostapd_eid_ht_capabilities(hapd, p);
1104         p = hostapd_eid_ht_operation(hapd, p);
1105
1106 #ifdef CONFIG_IEEE80211R
1107         if (status_code == WLAN_STATUS_SUCCESS) {
1108                 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
1109                  * Transition Information, RSN, [RIC Response] */
1110                 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
1111                                                 buf + sizeof(buf) - p,
1112                                                 sta->auth_alg, ies, ies_len);
1113         }
1114 #endif /* CONFIG_IEEE80211R */
1115
1116 #ifdef CONFIG_IEEE80211W
1117         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
1118                 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
1119 #endif /* CONFIG_IEEE80211W */
1120
1121         send_len += p - reply->u.assoc_resp.variable;
1122
1123         if (hostapd_send_mgmt_frame(hapd, reply, send_len) < 0)
1124                 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
1125                            strerror(errno));
1126 }
1127
1128
1129 static void handle_assoc(struct hostapd_data *hapd,
1130                          struct ieee80211_mgmt *mgmt, size_t len, int reassoc)
1131 {
1132         u16 capab_info, listen_interval;
1133         u16 resp = WLAN_STATUS_SUCCESS;
1134         u8 *pos;
1135         int left, i;
1136         struct sta_info *sta;
1137
1138         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
1139                                       sizeof(mgmt->u.assoc_req))) {
1140                 printf("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
1141                        "\n", reassoc, (unsigned long) len);
1142                 return;
1143         }
1144
1145         if (reassoc) {
1146                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
1147                 listen_interval = le_to_host16(
1148                         mgmt->u.reassoc_req.listen_interval);
1149                 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
1150                            " capab_info=0x%02x listen_interval=%d current_ap="
1151                            MACSTR,
1152                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1153                            MAC2STR(mgmt->u.reassoc_req.current_ap));
1154                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
1155                 pos = mgmt->u.reassoc_req.variable;
1156         } else {
1157                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
1158                 listen_interval = le_to_host16(
1159                         mgmt->u.assoc_req.listen_interval);
1160                 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
1161                            " capab_info=0x%02x listen_interval=%d",
1162                            MAC2STR(mgmt->sa), capab_info, listen_interval);
1163                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
1164                 pos = mgmt->u.assoc_req.variable;
1165         }
1166
1167         sta = ap_get_sta(hapd, mgmt->sa);
1168 #ifdef CONFIG_IEEE80211R
1169         if (sta && sta->auth_alg == WLAN_AUTH_FT &&
1170             (sta->flags & WLAN_STA_AUTH) == 0) {
1171                 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
1172                            "prior to authentication since it is using "
1173                            "over-the-DS FT", MAC2STR(mgmt->sa));
1174         } else
1175 #endif /* CONFIG_IEEE80211R */
1176         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
1177                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1178                                HOSTAPD_LEVEL_INFO, "Station tried to "
1179                                "associate before authentication "
1180                                "(aid=%d flags=0x%x)",
1181                                sta ? sta->aid : -1,
1182                                sta ? sta->flags : 0);
1183                 send_deauth(hapd, mgmt->sa,
1184                             WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
1185                 return;
1186         }
1187
1188         if (hapd->tkip_countermeasures) {
1189                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
1190                 goto fail;
1191         }
1192
1193         if (listen_interval > hapd->conf->max_listen_interval) {
1194                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1195                                HOSTAPD_LEVEL_DEBUG,
1196                                "Too large Listen Interval (%d)",
1197                                listen_interval);
1198                 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
1199                 goto fail;
1200         }
1201
1202         /* followed by SSID and Supported rates; and HT capabilities if 802.11n
1203          * is used */
1204         resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
1205         if (resp != WLAN_STATUS_SUCCESS)
1206                 goto fail;
1207
1208         if (hostapd_get_aid(hapd, sta) < 0) {
1209                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1210                                HOSTAPD_LEVEL_INFO, "No room for more AIDs");
1211                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1212                 goto fail;
1213         }
1214
1215         sta->capability = capab_info;
1216         sta->listen_interval = listen_interval;
1217
1218         if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
1219                 sta->flags |= WLAN_STA_NONERP;
1220         for (i = 0; i < sta->supported_rates_len; i++) {
1221                 if ((sta->supported_rates[i] & 0x7f) > 22) {
1222                         sta->flags &= ~WLAN_STA_NONERP;
1223                         break;
1224                 }
1225         }
1226         if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
1227                 sta->nonerp_set = 1;
1228                 hapd->iface->num_sta_non_erp++;
1229                 if (hapd->iface->num_sta_non_erp == 1)
1230                         ieee802_11_set_beacons(hapd->iface);
1231         }
1232
1233         if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
1234             !sta->no_short_slot_time_set) {
1235                 sta->no_short_slot_time_set = 1;
1236                 hapd->iface->num_sta_no_short_slot_time++;
1237                 if (hapd->iface->current_mode->mode ==
1238                     HOSTAPD_MODE_IEEE80211G &&
1239                     hapd->iface->num_sta_no_short_slot_time == 1)
1240                         ieee802_11_set_beacons(hapd->iface);
1241         }
1242
1243         if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1244                 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
1245         else
1246                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1247
1248         if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
1249             !sta->no_short_preamble_set) {
1250                 sta->no_short_preamble_set = 1;
1251                 hapd->iface->num_sta_no_short_preamble++;
1252                 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
1253                     && hapd->iface->num_sta_no_short_preamble == 1)
1254                         ieee802_11_set_beacons(hapd->iface);
1255         }
1256
1257         update_ht_state(hapd, sta);
1258
1259         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1260                        HOSTAPD_LEVEL_DEBUG,
1261                        "association OK (aid %d)", sta->aid);
1262         /* Station will be marked associated, after it acknowledges AssocResp
1263          */
1264
1265 #ifdef CONFIG_IEEE80211W
1266         if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
1267                 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
1268                            "SA Query procedure", reassoc ? "re" : "");
1269                 /* TODO: Send a protected Disassociate frame to the STA using
1270                  * the old key and Reason Code "Previous Authentication no
1271                  * longer valid". Make sure this is only sent protected since
1272                  * unprotected frame would be received by the STA that is now
1273                  * trying to associate.
1274                  */
1275         }
1276 #endif /* CONFIG_IEEE80211W */
1277
1278         if (reassoc) {
1279                 os_memcpy(sta->previous_ap, mgmt->u.reassoc_req.current_ap,
1280                           ETH_ALEN);
1281         }
1282
1283         if (sta->last_assoc_req)
1284                 os_free(sta->last_assoc_req);
1285         sta->last_assoc_req = os_malloc(len);
1286         if (sta->last_assoc_req)
1287                 os_memcpy(sta->last_assoc_req, mgmt, len);
1288
1289         /* Make sure that the previously registered inactivity timer will not
1290          * remove the STA immediately. */
1291         sta->timeout_next = STA_NULLFUNC;
1292
1293  fail:
1294         send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
1295 }
1296
1297
1298 static void handle_disassoc(struct hostapd_data *hapd,
1299                             struct ieee80211_mgmt *mgmt, size_t len)
1300 {
1301         struct sta_info *sta;
1302
1303         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
1304                 printf("handle_disassoc - too short payload (len=%lu)\n",
1305                        (unsigned long) len);
1306                 return;
1307         }
1308
1309         wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
1310                    MAC2STR(mgmt->sa),
1311                    le_to_host16(mgmt->u.disassoc.reason_code));
1312
1313         sta = ap_get_sta(hapd, mgmt->sa);
1314         if (sta == NULL) {
1315                 printf("Station " MACSTR " trying to disassociate, but it "
1316                        "is not associated.\n", MAC2STR(mgmt->sa));
1317                 return;
1318         }
1319
1320         sta->flags &= ~WLAN_STA_ASSOC;
1321         wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
1322                 MAC2STR(sta->addr));
1323         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
1324         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1325                        HOSTAPD_LEVEL_INFO, "disassociated");
1326         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1327         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1328         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
1329          * authenticated. */
1330         accounting_sta_stop(hapd, sta);
1331         ieee802_1x_free_station(sta);
1332         hostapd_sta_remove(hapd, sta->addr);
1333
1334         if (sta->timeout_next == STA_NULLFUNC ||
1335             sta->timeout_next == STA_DISASSOC) {
1336                 sta->timeout_next = STA_DEAUTH;
1337                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1338                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
1339                                        hapd, sta);
1340         }
1341
1342         mlme_disassociate_indication(
1343                 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
1344 }
1345
1346
1347 static void handle_deauth(struct hostapd_data *hapd,
1348                           struct ieee80211_mgmt *mgmt, size_t len)
1349 {
1350         struct sta_info *sta;
1351
1352         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
1353                 printf("handle_deauth - too short payload (len=%lu)\n",
1354                        (unsigned long) len);
1355                 return;
1356         }
1357
1358         wpa_printf(MSG_DEBUG, "deauthentication: STA=" MACSTR
1359                    " reason_code=%d",
1360                    MAC2STR(mgmt->sa),
1361                    le_to_host16(mgmt->u.deauth.reason_code));
1362
1363         sta = ap_get_sta(hapd, mgmt->sa);
1364         if (sta == NULL) {
1365                 printf("Station " MACSTR " trying to deauthenticate, but it "
1366                        "is not authenticated.\n", MAC2STR(mgmt->sa));
1367                 return;
1368         }
1369
1370         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
1371         wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
1372                 MAC2STR(sta->addr));
1373         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1374         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1375                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
1376         mlme_deauthenticate_indication(
1377                 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
1378         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1379         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1380         ap_free_sta(hapd, sta);
1381 }
1382
1383
1384 static void handle_beacon(struct hostapd_data *hapd,
1385                           struct ieee80211_mgmt *mgmt, size_t len,
1386                           struct hostapd_frame_info *fi)
1387 {
1388         struct ieee802_11_elems elems;
1389
1390         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
1391                 printf("handle_beacon - too short payload (len=%lu)\n",
1392                        (unsigned long) len);
1393                 return;
1394         }
1395
1396         (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
1397                                       len - (IEEE80211_HDRLEN +
1398                                              sizeof(mgmt->u.beacon)), &elems,
1399                                       0);
1400
1401         ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
1402 }
1403
1404
1405 #ifdef CONFIG_IEEE80211W
1406
1407 /* MLME-SAQuery.request */
1408 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
1409                                   const u8 *addr, const u8 *trans_id)
1410 {
1411         struct ieee80211_mgmt mgmt;
1412         u8 *end;
1413
1414         wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
1415                    MACSTR, MAC2STR(addr));
1416         wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
1417                     trans_id, WLAN_SA_QUERY_TR_ID_LEN);
1418
1419         os_memset(&mgmt, 0, sizeof(mgmt));
1420         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1421                                           WLAN_FC_STYPE_ACTION);
1422         os_memcpy(mgmt.da, addr, ETH_ALEN);
1423         os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
1424         os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
1425         mgmt.u.action.category = WLAN_ACTION_SA_QUERY;
1426         mgmt.u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
1427         os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id,
1428                   WLAN_SA_QUERY_TR_ID_LEN);
1429         end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
1430         if (hostapd_send_mgmt_frame(hapd, &mgmt, end - (u8 *) &mgmt) < 0)
1431                 perror("ieee802_11_send_sa_query_req: send");
1432 }
1433
1434
1435 static void hostapd_sa_query_action(struct hostapd_data *hapd,
1436                                     struct ieee80211_mgmt *mgmt, size_t len)
1437 {
1438         struct sta_info *sta;
1439         u8 *end;
1440         int i;
1441
1442         end = mgmt->u.action.u.sa_query_resp.trans_id +
1443                 WLAN_SA_QUERY_TR_ID_LEN;
1444         if (((u8 *) mgmt) + len < end) {
1445                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
1446                            "frame (len=%lu)", (unsigned long) len);
1447                 return;
1448         }
1449
1450         if (mgmt->u.action.u.sa_query_resp.action != WLAN_SA_QUERY_RESPONSE) {
1451                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
1452                            "Action %d", mgmt->u.action.u.sa_query_resp.action);
1453                 return;
1454         }
1455
1456         wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
1457                    MACSTR, MAC2STR(mgmt->sa));
1458         wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
1459                     mgmt->u.action.u.sa_query_resp.trans_id,
1460                     WLAN_SA_QUERY_TR_ID_LEN);
1461
1462         /* MLME-SAQuery.confirm */
1463
1464         sta = ap_get_sta(hapd, mgmt->sa);
1465         if (sta == NULL || sta->sa_query_trans_id == NULL) {
1466                 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
1467                            "pending SA Query request found");
1468                 return;
1469         }
1470
1471         for (i = 0; i < sta->sa_query_count; i++) {
1472                 if (os_memcmp(sta->sa_query_trans_id +
1473                               i * WLAN_SA_QUERY_TR_ID_LEN,
1474                               mgmt->u.action.u.sa_query_resp.trans_id,
1475                               WLAN_SA_QUERY_TR_ID_LEN) == 0)
1476                         break;
1477         }
1478
1479         if (i >= sta->sa_query_count) {
1480                 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
1481                            "transaction identifier found");
1482                 return;
1483         }
1484
1485         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1486                        HOSTAPD_LEVEL_DEBUG,
1487                        "Reply to pending SA Query received");
1488         ap_sta_stop_sa_query(hapd, sta);
1489 }
1490
1491
1492 static int robust_action_frame(u8 category)
1493 {
1494         return category != WLAN_ACTION_PUBLIC &&
1495                 category != WLAN_ACTION_HT;
1496 }
1497 #endif /* CONFIG_IEEE80211W */
1498
1499
1500 static void handle_action(struct hostapd_data *hapd,
1501                           struct ieee80211_mgmt *mgmt, size_t len)
1502 {
1503         struct sta_info *sta;
1504
1505         if (len < IEEE80211_HDRLEN + 1) {
1506                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1507                                HOSTAPD_LEVEL_DEBUG,
1508                                "handle_action - too short payload (len=%lu)",
1509                                (unsigned long) len);
1510                 return;
1511         }
1512
1513         sta = ap_get_sta(hapd, mgmt->sa);
1514 #ifdef CONFIG_IEEE80211W
1515         if (sta && (sta->flags & WLAN_STA_MFP) &&
1516             !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
1517               robust_action_frame(mgmt->u.action.category))) {
1518                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1519                                HOSTAPD_LEVEL_DEBUG,
1520                                "Dropped unprotected Robust Action frame from "
1521                                "an MFP STA");
1522                 return;
1523         }
1524 #endif /* CONFIG_IEEE80211W */
1525
1526         switch (mgmt->u.action.category) {
1527 #ifdef CONFIG_IEEE80211R
1528         case WLAN_ACTION_FT:
1529         {
1530                 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
1531                         wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored FT Action "
1532                                    "frame from unassociated STA " MACSTR,
1533                                    MAC2STR(mgmt->sa));
1534                         return;
1535                 }
1536
1537                 if (wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
1538                                      len - IEEE80211_HDRLEN))
1539                         break;
1540
1541                 return;
1542         }
1543 #endif /* CONFIG_IEEE80211R */
1544         case WLAN_ACTION_WMM:
1545                 hostapd_wmm_action(hapd, mgmt, len);
1546                 return;
1547 #ifdef CONFIG_IEEE80211W
1548         case WLAN_ACTION_SA_QUERY:
1549                 hostapd_sa_query_action(hapd, mgmt, len);
1550                 return;
1551 #endif /* CONFIG_IEEE80211W */
1552         }
1553
1554         hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1555                        HOSTAPD_LEVEL_DEBUG,
1556                        "handle_action - unknown action category %d or invalid "
1557                        "frame",
1558                        mgmt->u.action.category);
1559         if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
1560             !(mgmt->sa[0] & 0x01)) {
1561                 /*
1562                  * IEEE 802.11-REVma/D9.0 - 7.3.1.11
1563                  * Return the Action frame to the source without change
1564                  * except that MSB of the Category set to 1.
1565                  */
1566                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
1567                            "frame back to sender");
1568                 os_memcpy(mgmt->da, mgmt->sa, ETH_ALEN);
1569                 os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
1570                 os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
1571                 mgmt->u.action.category |= 0x80;
1572
1573                 hostapd_send_mgmt_frame(hapd, mgmt, len);
1574         }
1575 }
1576
1577
1578 /**
1579  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
1580  * @hapd: hostapd BSS data structure (the BSS to which the management frame was
1581  * sent to)
1582  * @buf: management frame data (starting from IEEE 802.11 header)
1583  * @len: length of frame data in octets
1584  * @stype: management frame subtype from frame control field
1585  * @fi: meta data about received frame (signal level, etc.)
1586  *
1587  * Process all incoming IEEE 802.11 management frames. This will be called for
1588  * each frame received from the kernel driver through wlan#ap interface. In
1589  * addition, it can be called to re-inserted pending frames (e.g., when using
1590  * external RADIUS server as an MAC ACL).
1591  */
1592 void ieee802_11_mgmt(struct hostapd_data *hapd, u8 *buf, size_t len, u16 stype,
1593                      struct hostapd_frame_info *fi)
1594 {
1595         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) buf;
1596         int broadcast;
1597
1598         if (stype == WLAN_FC_STYPE_BEACON) {
1599                 handle_beacon(hapd, mgmt, len, fi);
1600                 return;
1601         }
1602
1603         broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
1604                 mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
1605                 mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
1606
1607         if (!broadcast &&
1608             os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
1609                 printf("MGMT: BSSID=" MACSTR " not our address\n",
1610                        MAC2STR(mgmt->bssid));
1611                 return;
1612         }
1613
1614
1615         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
1616                 handle_probe_req(hapd, mgmt, len);
1617                 return;
1618         }
1619
1620         if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
1621                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1622                                HOSTAPD_LEVEL_DEBUG,
1623                                "MGMT: DA=" MACSTR " not our address",
1624                                MAC2STR(mgmt->da));
1625                 return;
1626         }
1627
1628         switch (stype) {
1629         case WLAN_FC_STYPE_AUTH:
1630                 wpa_printf(MSG_DEBUG, "mgmt::auth");
1631                 handle_auth(hapd, mgmt, len);
1632                 break;
1633         case WLAN_FC_STYPE_ASSOC_REQ:
1634                 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
1635                 handle_assoc(hapd, mgmt, len, 0);
1636                 break;
1637         case WLAN_FC_STYPE_REASSOC_REQ:
1638                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
1639                 handle_assoc(hapd, mgmt, len, 1);
1640                 break;
1641         case WLAN_FC_STYPE_DISASSOC:
1642                 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
1643                 handle_disassoc(hapd, mgmt, len);
1644                 break;
1645         case WLAN_FC_STYPE_DEAUTH:
1646                 wpa_printf(MSG_DEBUG, "mgmt::deauth");
1647                 handle_deauth(hapd, mgmt, len);
1648                 break;
1649         case WLAN_FC_STYPE_ACTION:
1650                 wpa_printf(MSG_DEBUG, "mgmt::action");
1651                 handle_action(hapd, mgmt, len);
1652                 break;
1653         default:
1654                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1655                                HOSTAPD_LEVEL_DEBUG,
1656                                "unknown mgmt frame subtype %d", stype);
1657                 break;
1658         }
1659 }
1660
1661
1662 static void handle_auth_cb(struct hostapd_data *hapd,
1663                            struct ieee80211_mgmt *mgmt,
1664                            size_t len, int ok)
1665 {
1666         u16 auth_alg, auth_transaction, status_code;
1667         struct sta_info *sta;
1668
1669         if (!ok) {
1670                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1671                                HOSTAPD_LEVEL_NOTICE,
1672                                "did not acknowledge authentication response");
1673                 return;
1674         }
1675
1676         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1677                 printf("handle_auth_cb - too short payload (len=%lu)\n",
1678                        (unsigned long) len);
1679                 return;
1680         }
1681
1682         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1683         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1684         status_code = le_to_host16(mgmt->u.auth.status_code);
1685
1686         sta = ap_get_sta(hapd, mgmt->da);
1687         if (!sta) {
1688                 printf("handle_auth_cb: STA " MACSTR " not found\n",
1689                        MAC2STR(mgmt->da));
1690                 return;
1691         }
1692
1693         if (status_code == WLAN_STATUS_SUCCESS &&
1694             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
1695              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
1696                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1697                                HOSTAPD_LEVEL_INFO, "authenticated");
1698                 sta->flags |= WLAN_STA_AUTH;
1699         }
1700 }
1701
1702
1703 #ifdef CONFIG_IEEE80211N
1704 static void
1705 hostapd_get_ht_capab(struct hostapd_data *hapd,
1706                      struct ieee80211_ht_capabilities *ht_cap,
1707                      struct ieee80211_ht_capabilities *neg_ht_cap)
1708 {
1709         u16 cap;
1710
1711         if (ht_cap == NULL)
1712                 return;
1713         os_memcpy(neg_ht_cap, ht_cap, sizeof(*neg_ht_cap));
1714         cap = le_to_host16(neg_ht_cap->ht_capabilities_info);
1715         cap &= hapd->iconf->ht_capab;
1716         cap |= (hapd->iconf->ht_capab & HT_CAP_INFO_SMPS_DISABLED);
1717
1718         /* FIXME: Rx STBC needs to be handled specially */
1719         cap |= (hapd->iconf->ht_capab & HT_CAP_INFO_RX_STBC_MASK);
1720         neg_ht_cap->ht_capabilities_info = host_to_le16(cap);
1721 }
1722 #endif /* CONFIG_IEEE80211N */
1723
1724
1725 static void handle_assoc_cb(struct hostapd_data *hapd,
1726                             struct ieee80211_mgmt *mgmt,
1727                             size_t len, int reassoc, int ok)
1728 {
1729         u16 status;
1730         struct sta_info *sta;
1731         int new_assoc = 1;
1732 #ifdef CONFIG_IEEE80211N
1733         struct ieee80211_ht_capabilities ht_cap;
1734 #endif /* CONFIG_IEEE80211N */
1735         struct ieee80211_ht_capabilities *ht_cap_ptr = NULL;
1736         int set_flags, flags_and, flags_or;
1737
1738         if (!ok) {
1739                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1740                                HOSTAPD_LEVEL_DEBUG,
1741                                "did not acknowledge association response");
1742                 return;
1743         }
1744
1745         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
1746                                       sizeof(mgmt->u.assoc_resp))) {
1747                 printf("handle_assoc_cb(reassoc=%d) - too short payload "
1748                        "(len=%lu)\n", reassoc, (unsigned long) len);
1749                 return;
1750         }
1751
1752         if (reassoc)
1753                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
1754         else
1755                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
1756
1757         sta = ap_get_sta(hapd, mgmt->da);
1758         if (!sta) {
1759                 printf("handle_assoc_cb: STA " MACSTR " not found\n",
1760                        MAC2STR(mgmt->da));
1761                 return;
1762         }
1763
1764         if (status != WLAN_STATUS_SUCCESS)
1765                 goto fail;
1766
1767         /* Stop previous accounting session, if one is started, and allocate
1768          * new session id for the new session. */
1769         accounting_sta_stop(hapd, sta);
1770
1771         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1772                        HOSTAPD_LEVEL_INFO,
1773                        "associated (aid %d)",
1774                        sta->aid);
1775
1776         if (sta->flags & WLAN_STA_ASSOC)
1777                 new_assoc = 0;
1778         sta->flags |= WLAN_STA_ASSOC;
1779         if (!hapd->conf->ieee802_1x && !hapd->conf->wpa) {
1780                 /* Open or static WEP; no separate authorization */
1781                 sta->flags |= WLAN_STA_AUTHORIZED;
1782                 wpa_msg(hapd->msg_ctx, MSG_INFO,
1783                         AP_STA_CONNECTED MACSTR, MAC2STR(sta->addr));
1784         }
1785
1786         if (reassoc)
1787                 mlme_reassociate_indication(hapd, sta);
1788         else
1789                 mlme_associate_indication(hapd, sta);
1790
1791 #ifdef CONFIG_IEEE80211N
1792         if (sta->flags & WLAN_STA_HT) {
1793                 ht_cap_ptr = &ht_cap;
1794                 hostapd_get_ht_capab(hapd, sta->ht_capabilities, ht_cap_ptr);
1795         }
1796 #endif /* CONFIG_IEEE80211N */
1797
1798 #ifdef CONFIG_IEEE80211W
1799         sta->sa_query_timed_out = 0;
1800 #endif /* CONFIG_IEEE80211W */
1801
1802         /*
1803          * Remove the STA entry in order to make sure the STA PS state gets
1804          * cleared and configuration gets updated in case of reassociation back
1805          * to the same AP.
1806          */
1807         hostapd_sta_remove(hapd, sta->addr);
1808
1809         if (hostapd_sta_add(hapd->conf->iface, hapd, sta->addr, sta->aid,
1810                             sta->capability, sta->supported_rates,
1811                             sta->supported_rates_len, 0, sta->listen_interval,
1812                             ht_cap_ptr))
1813         {
1814                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1815                                HOSTAPD_LEVEL_NOTICE,
1816                                "Could not add STA to kernel driver");
1817         }
1818
1819         if (sta->eapol_sm == NULL) {
1820                 /*
1821                  * This STA does not use RADIUS server for EAP authentication,
1822                  * so bind it to the selected VLAN interface now, since the
1823                  * interface selection is not going to change anymore.
1824                  */
1825                 ap_sta_bind_vlan(hapd, sta, 0);
1826         } else if (sta->vlan_id) {
1827                 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
1828                 ap_sta_bind_vlan(hapd, sta, 0);
1829         }
1830
1831         set_flags = WLAN_STA_SHORT_PREAMBLE | WLAN_STA_WMM | WLAN_STA_MFP;
1832         if (!hapd->conf->ieee802_1x && !hapd->conf->wpa &&
1833             sta->flags & WLAN_STA_AUTHORIZED)
1834                 set_flags |= WLAN_STA_AUTHORIZED;
1835         flags_or = sta->flags & set_flags;
1836         flags_and = sta->flags | ~set_flags;
1837         hostapd_sta_set_flags(hapd, sta->addr, sta->flags,
1838                               flags_or, flags_and);
1839
1840         if (sta->auth_alg == WLAN_AUTH_FT)
1841                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
1842         else
1843                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
1844         hostapd_new_assoc_sta(hapd, sta, !new_assoc);
1845
1846         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
1847
1848  fail:
1849         /* Copy of the association request is not needed anymore */
1850         if (sta->last_assoc_req) {
1851                 os_free(sta->last_assoc_req);
1852                 sta->last_assoc_req = NULL;
1853         }
1854 }
1855
1856
1857 /**
1858  * ieee802_11_mgmt_cb - Process management frame TX status callback
1859  * @hapd: hostapd BSS data structure (the BSS from which the management frame
1860  * was sent from)
1861  * @buf: management frame data (starting from IEEE 802.11 header)
1862  * @len: length of frame data in octets
1863  * @stype: management frame subtype from frame control field
1864  * @ok: Whether the frame was ACK'ed
1865  */
1866 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, u8 *buf, size_t len,
1867                         u16 stype, int ok)
1868 {
1869         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) buf;
1870
1871         switch (stype) {
1872         case WLAN_FC_STYPE_AUTH:
1873                 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
1874                 handle_auth_cb(hapd, mgmt, len, ok);
1875                 break;
1876         case WLAN_FC_STYPE_ASSOC_RESP:
1877                 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
1878                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
1879                 break;
1880         case WLAN_FC_STYPE_REASSOC_RESP:
1881                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
1882                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
1883                 break;
1884         case WLAN_FC_STYPE_PROBE_RESP:
1885                 wpa_printf(MSG_DEBUG, "mgmt::proberesp cb");
1886                 break;
1887         case WLAN_FC_STYPE_DEAUTH:
1888                 /* ignore */
1889                 break;
1890         case WLAN_FC_STYPE_ACTION:
1891                 wpa_printf(MSG_DEBUG, "mgmt::action cb");
1892                 break;
1893         default:
1894                 printf("unknown mgmt cb frame subtype %d\n", stype);
1895                 break;
1896         }
1897 }
1898
1899
1900 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1901 {
1902         /* TODO */
1903         return 0;
1904 }
1905
1906
1907 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1908                            char *buf, size_t buflen)
1909 {
1910         /* TODO */
1911         return 0;
1912 }
1913
1914 #endif /* CONFIG_NATIVE_WINDOWS */