src/drivers/driver_madwifi.c

   1 /*
   2  * WPA Supplicant - driver interaction with MADWIFI 802.11 driver
   3  * Copyright (c) 2004, Sam Leffler <sam@errno.com>
   4  * Copyright (c) 2004, Video54 Technologies
   5  * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  *
  16  * While this driver wrapper supports both AP (hostapd) and station
  17  * (wpa_supplicant) operations, the station side is deprecated and
  18  * driver_wext.c should be used instead. This driver wrapper should only be
  19  * used with hostapd for AP mode functionality.
  20  */
  21
  22 #include "includes.h"
  23 #include <sys/ioctl.h>
  24
  25 #include "common.h"
  26 #include "driver.h"
  27 #include "driver_wext.h"
  28 #include "eloop.h"
  29 #include "common/ieee802_11_defs.h"
  30 #include "wireless_copy.h"
  31
  32 /*
  33  * Avoid conflicts with wpa_supplicant definitions by undefining a definition.
  34  */
  35 #undef WME_OUI_TYPE
  36
  37 #include <include/compat.h>
  38 #include <net80211/ieee80211.h>
  39 #ifdef WME_NUM_AC
  40 /* Assume this is built against BSD branch of madwifi driver. */
  41 #define MADWIFI_BSD
  42 #include <net80211/_ieee80211.h>
  43 #endif /* WME_NUM_AC */
  44 #include <net80211/ieee80211_crypto.h>
  45 #include <net80211/ieee80211_ioctl.h>
  46
  47 #ifdef CONFIG_WPS
  48 #ifdef IEEE80211_IOCTL_FILTERFRAME
  49 #include <netpacket/packet.h>
  50
  51 #ifndef ETH_P_80211_RAW
  52 #define ETH_P_80211_RAW 0x0019
  53 #endif
  54 #endif /* IEEE80211_IOCTL_FILTERFRAME */
  55 #endif /* CONFIG_WPS */
  56
  57 /*
  58  * Avoid conflicts with hostapd definitions by undefining couple of defines
  59  * from madwifi header files.
  60  */
  61 #undef RSN_VERSION
  62 #undef WPA_VERSION
  63 #undef WPA_OUI_TYPE
  64 #undef WME_OUI_TYPE
  65
  66
  67 #ifdef IEEE80211_IOCTL_SETWMMPARAMS
  68 /* Assume this is built against madwifi-ng */
  69 #define MADWIFI_NG
  70 #endif /* IEEE80211_IOCTL_SETWMMPARAMS */
  71
  72
  73 #ifdef HOSTAPD
  74
  75 #include "priv_netlink.h"
  76 #include "netlink.h"
  77 #include "l2_packet/l2_packet.h"
  78
  79
  80 struct madwifi_driver_data {
  81         struct hostapd_data *hapd;              /* back pointer */
  82
  83         char    iface[IFNAMSIZ + 1];
  84         int     ifindex;
  85         struct l2_packet_data *sock_xmit;       /* raw packet xmit socket */
  86         struct l2_packet_data *sock_recv;       /* raw packet recv socket */
  87         int     ioctl_sock;                     /* socket for ioctl() use */
  88         struct netlink_data *netlink;
  89         int     we_version;
  90         u8      acct_mac[ETH_ALEN];
  91         struct hostap_sta_driver_data acct_data;
  92
  93         struct l2_packet_data *sock_raw; /* raw 802.11 management frames */
  94 };
  95
  96 static int madwifi_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
  97                               int reason_code);
  98
  99 static int
 100 set80211priv(struct madwifi_driver_data *drv, int op, void *data, int len)
 101 {
 102         struct iwreq iwr;
 103         int do_inline = len < IFNAMSIZ;
 104
 105         memset(&iwr, 0, sizeof(iwr));
 106         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 107 #ifdef IEEE80211_IOCTL_FILTERFRAME
 108         /* FILTERFRAME must be NOT inline, regardless of size. */
 109         if (op == IEEE80211_IOCTL_FILTERFRAME)
 110                 do_inline = 0;
 111 #endif /* IEEE80211_IOCTL_FILTERFRAME */
 112         if (op == IEEE80211_IOCTL_SET_APPIEBUF)
 113                 do_inline = 0;
 114         if (do_inline) {
 115                 /*
 116                  * Argument data fits inline; put it there.
 117                  */
 118                 memcpy(iwr.u.name, data, len);
 119         } else {
 120                 /*
 121                  * Argument data too big for inline transfer; setup a
 122                  * parameter block instead; the kernel will transfer
 123                  * the data for the driver.
 124                  */
 125                 iwr.u.data.pointer = data;
 126                 iwr.u.data.length = len;
 127         }
 128
 129         if (ioctl(drv->ioctl_sock, op, &iwr) < 0) {
 130 #ifdef MADWIFI_NG
 131                 int first = IEEE80211_IOCTL_SETPARAM;
 132                 static const char *opnames[] = {
 133                         "ioctl[IEEE80211_IOCTL_SETPARAM]",
 134                         "ioctl[IEEE80211_IOCTL_GETPARAM]",
 135                         "ioctl[IEEE80211_IOCTL_SETMODE]",
 136                         "ioctl[IEEE80211_IOCTL_GETMODE]",
 137                         "ioctl[IEEE80211_IOCTL_SETWMMPARAMS]",
 138                         "ioctl[IEEE80211_IOCTL_GETWMMPARAMS]",
 139                         "ioctl[IEEE80211_IOCTL_SETCHANLIST]",
 140                         "ioctl[IEEE80211_IOCTL_GETCHANLIST]",
 141                         "ioctl[IEEE80211_IOCTL_CHANSWITCH]",
 142                         "ioctl[IEEE80211_IOCTL_GET_APPIEBUF]",
 143                         "ioctl[IEEE80211_IOCTL_SET_APPIEBUF]",
 144                         "ioctl[IEEE80211_IOCTL_GETSCANRESULTS]",
 145                         "ioctl[IEEE80211_IOCTL_FILTERFRAME]",
 146                         "ioctl[IEEE80211_IOCTL_GETCHANINFO]",
 147                         "ioctl[IEEE80211_IOCTL_SETOPTIE]",
 148                         "ioctl[IEEE80211_IOCTL_GETOPTIE]",
 149                         "ioctl[IEEE80211_IOCTL_SETMLME]",
 150                         NULL,
 151                         "ioctl[IEEE80211_IOCTL_SETKEY]",
 152                         NULL,
 153                         "ioctl[IEEE80211_IOCTL_DELKEY]",
 154                         NULL,
 155                         "ioctl[IEEE80211_IOCTL_ADDMAC]",
 156                         NULL,
 157                         "ioctl[IEEE80211_IOCTL_DELMAC]",
 158                         NULL,
 159                         "ioctl[IEEE80211_IOCTL_WDSMAC]",
 160                         NULL,
 161                         "ioctl[IEEE80211_IOCTL_WDSDELMAC]",
 162                         NULL,
 163                         "ioctl[IEEE80211_IOCTL_KICKMAC]",
 164                 };
 165 #else /* MADWIFI_NG */
 166                 int first = IEEE80211_IOCTL_SETPARAM;
 167                 static const char *opnames[] = {
 168                         "ioctl[IEEE80211_IOCTL_SETPARAM]",
 169                         "ioctl[IEEE80211_IOCTL_GETPARAM]",
 170                         "ioctl[IEEE80211_IOCTL_SETKEY]",
 171                         "ioctl[SIOCIWFIRSTPRIV+3]",
 172                         "ioctl[IEEE80211_IOCTL_DELKEY]",
 173                         "ioctl[SIOCIWFIRSTPRIV+5]",
 174                         "ioctl[IEEE80211_IOCTL_SETMLME]",
 175                         "ioctl[SIOCIWFIRSTPRIV+7]",
 176                         "ioctl[IEEE80211_IOCTL_SETOPTIE]",
 177                         "ioctl[IEEE80211_IOCTL_GETOPTIE]",
 178                         "ioctl[IEEE80211_IOCTL_ADDMAC]",
 179                         "ioctl[SIOCIWFIRSTPRIV+11]",
 180                         "ioctl[IEEE80211_IOCTL_DELMAC]",
 181                         "ioctl[SIOCIWFIRSTPRIV+13]",
 182                         "ioctl[IEEE80211_IOCTL_CHANLIST]",
 183                         "ioctl[SIOCIWFIRSTPRIV+15]",
 184                         "ioctl[IEEE80211_IOCTL_GETRSN]",
 185                         "ioctl[SIOCIWFIRSTPRIV+17]",
 186                         "ioctl[IEEE80211_IOCTL_GETKEY]",
 187                 };
 188 #endif /* MADWIFI_NG */
 189                 int idx = op - first;
 190                 if (first <= op &&
 191                     idx < (int) (sizeof(opnames) / sizeof(opnames[0])) &&
 192                     opnames[idx])
 193                         perror(opnames[idx]);
 194                 else
 195                         perror("ioctl[unknown???]");
 196                 return -1;
 197         }
 198         return 0;
 199 }
 200
 201 static int
 202 set80211param(struct madwifi_driver_data *drv, int op, int arg)
 203 {
 204         struct iwreq iwr;
 205
 206         memset(&iwr, 0, sizeof(iwr));
 207         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 208         iwr.u.mode = op;
 209         memcpy(iwr.u.name+sizeof(__u32), &arg, sizeof(arg));
 210
 211         if (ioctl(drv->ioctl_sock, IEEE80211_IOCTL_SETPARAM, &iwr) < 0) {
 212                 perror("ioctl[IEEE80211_IOCTL_SETPARAM]");
 213                 wpa_printf(MSG_DEBUG, "%s: Failed to set parameter (op %d "
 214                            "arg %d)", __func__, op, arg);
 215                 return -1;
 216         }
 217         return 0;
 218 }
 219
 220 #ifndef CONFIG_NO_STDOUT_DEBUG
 221 static const char *
 222 ether_sprintf(const u8 *addr)
 223 {
 224         static char buf[sizeof(MACSTR)];
 225
 226         if (addr != NULL)
 227                 snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr));
 228         else
 229                 snprintf(buf, sizeof(buf), MACSTR, 0,0,0,0,0,0);
 230         return buf;
 231 }
 232 #endif /* CONFIG_NO_STDOUT_DEBUG */
 233
 234 /*
 235  * Configure WPA parameters.
 236  */
 237 static int
 238 madwifi_configure_wpa(struct madwifi_driver_data *drv,
 239                       struct wpa_bss_params *params)
 240 {
 241         int v;
 242
 243         switch (params->wpa_group) {
 244         case WPA_CIPHER_CCMP:
 245                 v = IEEE80211_CIPHER_AES_CCM;
 246                 break;
 247         case WPA_CIPHER_TKIP:
 248                 v = IEEE80211_CIPHER_TKIP;
 249                 break;
 250         case WPA_CIPHER_WEP104:
 251                 v = IEEE80211_CIPHER_WEP;
 252                 break;
 253         case WPA_CIPHER_WEP40:
 254                 v = IEEE80211_CIPHER_WEP;
 255                 break;
 256         case WPA_CIPHER_NONE:
 257                 v = IEEE80211_CIPHER_NONE;
 258                 break;
 259         default:
 260                 wpa_printf(MSG_ERROR, "Unknown group key cipher %u",
 261                            params->wpa_group);
 262                 return -1;
 263         }
 264         wpa_printf(MSG_DEBUG, "%s: group key cipher=%d", __func__, v);
 265         if (set80211param(drv, IEEE80211_PARAM_MCASTCIPHER, v)) {
 266                 printf("Unable to set group key cipher to %u\n", v);
 267                 return -1;
 268         }
 269         if (v == IEEE80211_CIPHER_WEP) {
 270                 /* key length is done only for specific ciphers */
 271                 v = (params->wpa_group == WPA_CIPHER_WEP104 ? 13 : 5);
 272                 if (set80211param(drv, IEEE80211_PARAM_MCASTKEYLEN, v)) {
 273                         printf("Unable to set group key length to %u\n", v);
 274                         return -1;
 275                 }
 276         }
 277
 278         v = 0;
 279         if (params->wpa_pairwise & WPA_CIPHER_CCMP)
 280                 v |= 1<<IEEE80211_CIPHER_AES_CCM;
 281         if (params->wpa_pairwise & WPA_CIPHER_TKIP)
 282                 v |= 1<<IEEE80211_CIPHER_TKIP;
 283         if (params->wpa_pairwise & WPA_CIPHER_NONE)
 284                 v |= 1<<IEEE80211_CIPHER_NONE;
 285         wpa_printf(MSG_DEBUG, "%s: pairwise key ciphers=0x%x", __func__, v);
 286         if (set80211param(drv, IEEE80211_PARAM_UCASTCIPHERS, v)) {
 287                 printf("Unable to set pairwise key ciphers to 0x%x\n", v);
 288                 return -1;
 289         }
 290
 291         wpa_printf(MSG_DEBUG, "%s: key management algorithms=0x%x",
 292                    __func__, params->wpa_key_mgmt);
 293         if (set80211param(drv, IEEE80211_PARAM_KEYMGTALGS,
 294                           params->wpa_key_mgmt)) {
 295                 printf("Unable to set key management algorithms to 0x%x\n",
 296                         params->wpa_key_mgmt);
 297                 return -1;
 298         }
 299
 300         v = 0;
 301         if (params->rsn_preauth)
 302                 v |= BIT(0);
 303         wpa_printf(MSG_DEBUG, "%s: rsn capabilities=0x%x",
 304                    __func__, params->rsn_preauth);
 305         if (set80211param(drv, IEEE80211_PARAM_RSNCAPS, v)) {
 306                 printf("Unable to set RSN capabilities to 0x%x\n", v);
 307                 return -1;
 308         }
 309
 310         wpa_printf(MSG_DEBUG, "%s: enable WPA=0x%x", __func__, params->wpa);
 311         if (set80211param(drv, IEEE80211_PARAM_WPA, params->wpa)) {
 312                 printf("Unable to set WPA to %u\n", params->wpa);
 313                 return -1;
 314         }
 315         return 0;
 316 }
 317
 318
 319 static int
 320 madwifi_set_iface_flags(void *priv, int dev_up)
 321 {
 322         struct madwifi_driver_data *drv = priv;
 323         struct ifreq ifr;
 324
 325         wpa_printf(MSG_DEBUG, "%s: dev_up=%d", __func__, dev_up);
 326
 327         if (drv->ioctl_sock < 0)
 328                 return -1;
 329
 330         memset(&ifr, 0, sizeof(ifr));
 331         os_strlcpy(ifr.ifr_name, drv->iface, IFNAMSIZ);
 332
 333         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) {
 334                 perror("ioctl[SIOCGIFFLAGS]");
 335                 return -1;
 336         }
 337
 338         if (dev_up)
 339                 ifr.ifr_flags |= IFF_UP;
 340         else
 341                 ifr.ifr_flags &= ~IFF_UP;
 342
 343         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) {
 344                 perror("ioctl[SIOCSIFFLAGS]");
 345                 return -1;
 346         }
 347
 348         return 0;
 349 }
 350
 351 static int
 352 madwifi_set_ieee8021x(void *priv, struct wpa_bss_params *params)
 353 {
 354         struct madwifi_driver_data *drv = priv;
 355
 356         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, params->enabled);
 357
 358         if (!params->enabled) {
 359                 /* XXX restore state */
 360                 return set80211param(priv, IEEE80211_PARAM_AUTHMODE,
 361                         IEEE80211_AUTH_AUTO);
 362         }
 363         if (!params->wpa && !params->ieee802_1x) {
 364                 hostapd_logger(drv->hapd, NULL, HOSTAPD_MODULE_DRIVER,
 365                         HOSTAPD_LEVEL_WARNING, "No 802.1X or WPA enabled!");
 366                 return -1;
 367         }
 368         if (params->wpa && madwifi_configure_wpa(drv, params) != 0) {
 369                 hostapd_logger(drv->hapd, NULL, HOSTAPD_MODULE_DRIVER,
 370                         HOSTAPD_LEVEL_WARNING, "Error configuring WPA state!");
 371                 return -1;
 372         }
 373         if (set80211param(priv, IEEE80211_PARAM_AUTHMODE,
 374                 (params->wpa ? IEEE80211_AUTH_WPA : IEEE80211_AUTH_8021X))) {
 375                 hostapd_logger(drv->hapd, NULL, HOSTAPD_MODULE_DRIVER,
 376                         HOSTAPD_LEVEL_WARNING, "Error enabling WPA/802.1X!");
 377                 return -1;
 378         }
 379
 380         return 0;
 381 }
 382
 383 static int
 384 madwifi_set_privacy(const char *ifname, void *priv, int enabled)
 385 {
 386         struct madwifi_driver_data *drv = priv;
 387
 388         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
 389
 390         return set80211param(drv, IEEE80211_PARAM_PRIVACY, enabled);
 391 }
 392
 393 static int
 394 madwifi_set_sta_authorized(void *priv, const u8 *addr, int authorized)
 395 {
 396         struct madwifi_driver_data *drv = priv;
 397         struct ieee80211req_mlme mlme;
 398         int ret;
 399
 400         wpa_printf(MSG_DEBUG, "%s: addr=%s authorized=%d",
 401                    __func__, ether_sprintf(addr), authorized);
 402
 403         if (authorized)
 404                 mlme.im_op = IEEE80211_MLME_AUTHORIZE;
 405         else
 406                 mlme.im_op = IEEE80211_MLME_UNAUTHORIZE;
 407         mlme.im_reason = 0;
 408         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 409         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 410         if (ret < 0) {
 411                 wpa_printf(MSG_DEBUG, "%s: Failed to %sauthorize STA " MACSTR,
 412                            __func__, authorized ? "" : "un", MAC2STR(addr));
 413         }
 414
 415         return ret;
 416 }
 417
 418 static int
 419 madwifi_sta_set_flags(void *priv, const u8 *addr, int total_flags,
 420                       int flags_or, int flags_and)
 421 {
 422         /* For now, only support setting Authorized flag */
 423         if (flags_or & WPA_STA_AUTHORIZED)
 424                 return madwifi_set_sta_authorized(priv, addr, 1);
 425         if (!(flags_and & WPA_STA_AUTHORIZED))
 426                 return madwifi_set_sta_authorized(priv, addr, 0);
 427         return 0;
 428 }
 429
 430 static int
 431 madwifi_del_key(void *priv, const u8 *addr, int key_idx)
 432 {
 433         struct madwifi_driver_data *drv = priv;
 434         struct ieee80211req_del_key wk;
 435         int ret;
 436
 437         wpa_printf(MSG_DEBUG, "%s: addr=%s key_idx=%d",
 438                    __func__, ether_sprintf(addr), key_idx);
 439
 440         memset(&wk, 0, sizeof(wk));
 441         if (addr != NULL) {
 442                 memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
 443                 wk.idk_keyix = (u8) IEEE80211_KEYIX_NONE;
 444         } else {
 445                 wk.idk_keyix = key_idx;
 446         }
 447
 448         ret = set80211priv(drv, IEEE80211_IOCTL_DELKEY, &wk, sizeof(wk));
 449         if (ret < 0) {
 450                 wpa_printf(MSG_DEBUG, "%s: Failed to delete key (addr %s"
 451                            " key_idx %d)", __func__, ether_sprintf(addr),
 452                            key_idx);
 453         }
 454
 455         return ret;
 456 }
 457
 458 static int
 459 wpa_driver_madwifi_set_key(const char *ifname, void *priv, wpa_alg alg,
 460                            const u8 *addr, int key_idx, int set_tx,
 461                            const u8 *seq, size_t seq_len,
 462                            const u8 *key, size_t key_len)
 463 {
 464         struct madwifi_driver_data *drv = priv;
 465         struct ieee80211req_key wk;
 466         u_int8_t cipher;
 467         int ret;
 468
 469         if (alg == WPA_ALG_NONE)
 470                 return madwifi_del_key(drv, addr, key_idx);
 471
 472         wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%s key_idx=%d",
 473                    __func__, alg, ether_sprintf(addr), key_idx);
 474
 475         if (alg == WPA_ALG_WEP)
 476                 cipher = IEEE80211_CIPHER_WEP;
 477         else if (alg == WPA_ALG_TKIP)
 478                 cipher = IEEE80211_CIPHER_TKIP;
 479         else if (alg == WPA_ALG_CCMP)
 480                 cipher = IEEE80211_CIPHER_AES_CCM;
 481         else {
 482                 printf("%s: unknown/unsupported algorithm %d\n",
 483                         __func__, alg);
 484                 return -1;
 485         }
 486
 487         if (key_len > sizeof(wk.ik_keydata)) {
 488                 printf("%s: key length %lu too big\n", __func__,
 489                        (unsigned long) key_len);
 490                 return -3;
 491         }
 492
 493         memset(&wk, 0, sizeof(wk));
 494         wk.ik_type = cipher;
 495         wk.ik_flags = IEEE80211_KEY_RECV | IEEE80211_KEY_XMIT;
 496         if (addr == NULL) {
 497                 memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
 498                 wk.ik_keyix = key_idx;
 499                 wk.ik_flags |= IEEE80211_KEY_DEFAULT;
 500         } else {
 501                 memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
 502                 wk.ik_keyix = IEEE80211_KEYIX_NONE;
 503         }
 504         wk.ik_keylen = key_len;
 505         memcpy(wk.ik_keydata, key, key_len);
 506
 507         ret = set80211priv(drv, IEEE80211_IOCTL_SETKEY, &wk, sizeof(wk));
 508         if (ret < 0) {
 509                 wpa_printf(MSG_DEBUG, "%s: Failed to set key (addr %s"
 510                            " key_idx %d alg %d key_len %lu set_tx %d)",
 511                            __func__, ether_sprintf(wk.ik_macaddr), key_idx,
 512                            alg, (unsigned long) key_len, set_tx);
 513         }
 514
 515         return ret;
 516 }
 517
 518
 519 static int
 520 madwifi_get_seqnum(const char *ifname, void *priv, const u8 *addr, int idx,
 521                    u8 *seq)
 522 {
 523         struct madwifi_driver_data *drv = priv;
 524         struct ieee80211req_key wk;
 525
 526         wpa_printf(MSG_DEBUG, "%s: addr=%s idx=%d",
 527                    __func__, ether_sprintf(addr), idx);
 528
 529         memset(&wk, 0, sizeof(wk));
 530         if (addr == NULL)
 531                 memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
 532         else
 533                 memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
 534         wk.ik_keyix = idx;
 535
 536         if (set80211priv(drv, IEEE80211_IOCTL_GETKEY, &wk, sizeof(wk))) {
 537                 wpa_printf(MSG_DEBUG, "%s: Failed to get encryption data "
 538                            "(addr " MACSTR " key_idx %d)",
 539                            __func__, MAC2STR(wk.ik_macaddr), idx);
 540                 return -1;
 541         }
 542
 543 #ifdef WORDS_BIGENDIAN
 544         {
 545                 /*
 546                  * wk.ik_keytsc is in host byte order (big endian), need to
 547                  * swap it to match with the byte order used in WPA.
 548                  */
 549                 int i;
 550                 u8 tmp[WPA_KEY_RSC_LEN];
 551                 memcpy(tmp, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
 552                 for (i = 0; i < WPA_KEY_RSC_LEN; i++) {
 553                         seq[i] = tmp[WPA_KEY_RSC_LEN - i - 1];
 554                 }
 555         }
 556 #else /* WORDS_BIGENDIAN */
 557         memcpy(seq, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
 558 #endif /* WORDS_BIGENDIAN */
 559         return 0;
 560 }
 561
 562
 563 static int
 564 madwifi_flush(void *priv)
 565 {
 566 #ifdef MADWIFI_BSD
 567         u8 allsta[IEEE80211_ADDR_LEN];
 568         memset(allsta, 0xff, IEEE80211_ADDR_LEN);
 569         return madwifi_sta_deauth(priv, NULL, allsta,
 570                                   IEEE80211_REASON_AUTH_LEAVE);
 571 #else /* MADWIFI_BSD */
 572         return 0;               /* XXX */
 573 #endif /* MADWIFI_BSD */
 574 }
 575
 576
 577 static int
 578 madwifi_read_sta_driver_data(void *priv, struct hostap_sta_driver_data *data,
 579                              const u8 *addr)
 580 {
 581         struct madwifi_driver_data *drv = priv;
 582
 583 #ifdef MADWIFI_BSD
 584         struct ieee80211req_sta_stats stats;
 585
 586         memset(data, 0, sizeof(*data));
 587
 588         /*
 589          * Fetch statistics for station from the system.
 590          */
 591         memset(&stats, 0, sizeof(stats));
 592         memcpy(stats.is_u.macaddr, addr, IEEE80211_ADDR_LEN);
 593         if (set80211priv(drv,
 594 #ifdef MADWIFI_NG
 595                          IEEE80211_IOCTL_STA_STATS,
 596 #else /* MADWIFI_NG */
 597                          IEEE80211_IOCTL_GETSTASTATS,
 598 #endif /* MADWIFI_NG */
 599                          &stats, sizeof(stats))) {
 600                 wpa_printf(MSG_DEBUG, "%s: Failed to fetch STA stats (addr "
 601                            MACSTR ")", __func__, MAC2STR(addr));
 602                 if (memcmp(addr, drv->acct_mac, ETH_ALEN) == 0) {
 603                         memcpy(data, &drv->acct_data, sizeof(*data));
 604                         return 0;
 605                 }
 606
 607                 printf("Failed to get station stats information element.\n");
 608                 return -1;
 609         }
 610
 611         data->rx_packets = stats.is_stats.ns_rx_data;
 612         data->rx_bytes = stats.is_stats.ns_rx_bytes;
 613         data->tx_packets = stats.is_stats.ns_tx_data;
 614         data->tx_bytes = stats.is_stats.ns_tx_bytes;
 615         return 0;
 616
 617 #else /* MADWIFI_BSD */
 618
 619         char buf[1024], line[128], *pos;
 620         FILE *f;
 621         unsigned long val;
 622
 623         memset(data, 0, sizeof(*data));
 624         snprintf(buf, sizeof(buf), "/proc/net/madwifi/%s/" MACSTR,
 625                  drv->iface, MAC2STR(addr));
 626
 627         f = fopen(buf, "r");
 628         if (!f) {
 629                 if (memcmp(addr, drv->acct_mac, ETH_ALEN) != 0)
 630                         return -1;
 631                 memcpy(data, &drv->acct_data, sizeof(*data));
 632                 return 0;
 633         }
 634         /* Need to read proc file with in one piece, so use large enough
 635          * buffer. */
 636         setbuffer(f, buf, sizeof(buf));
 637
 638         while (fgets(line, sizeof(line), f)) {
 639                 pos = strchr(line, '=');
 640                 if (!pos)
 641                         continue;
 642                 *pos++ = '\0';
 643                 val = strtoul(pos, NULL, 10);
 644                 if (strcmp(line, "rx_packets") == 0)
 645                         data->rx_packets = val;
 646                 else if (strcmp(line, "tx_packets") == 0)
 647                         data->tx_packets = val;
 648                 else if (strcmp(line, "rx_bytes") == 0)
 649                         data->rx_bytes = val;
 650                 else if (strcmp(line, "tx_bytes") == 0)
 651                         data->tx_bytes = val;
 652         }
 653
 654         fclose(f);
 655
 656         return 0;
 657 #endif /* MADWIFI_BSD */
 658 }
 659
 660
 661 static int
 662 madwifi_sta_clear_stats(void *priv, const u8 *addr)
 663 {
 664 #if defined(MADWIFI_BSD) && defined(IEEE80211_MLME_CLEAR_STATS)
 665         struct madwifi_driver_data *drv = priv;
 666         struct ieee80211req_mlme mlme;
 667         int ret;
 668
 669         wpa_printf(MSG_DEBUG, "%s: addr=%s", __func__, ether_sprintf(addr));
 670
 671         mlme.im_op = IEEE80211_MLME_CLEAR_STATS;
 672         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 673         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme,
 674                            sizeof(mlme));
 675         if (ret < 0) {
 676                 wpa_printf(MSG_DEBUG, "%s: Failed to clear STA stats (addr "
 677                            MACSTR ")", __func__, MAC2STR(addr));
 678         }
 679
 680         return ret;
 681 #else /* MADWIFI_BSD && IEEE80211_MLME_CLEAR_STATS */
 682         return 0; /* FIX */
 683 #endif /* MADWIFI_BSD && IEEE80211_MLME_CLEAR_STATS */
 684 }
 685
 686
 687 static int
 688 madwifi_set_opt_ie(const char *ifname, void *priv, const u8 *ie, size_t ie_len)
 689 {
 690         /*
 691          * Do nothing; we setup parameters at startup that define the
 692          * contents of the beacon information element.
 693          */
 694         return 0;
 695 }
 696
 697 static int
 698 madwifi_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
 699                    int reason_code)
 700 {
 701         struct madwifi_driver_data *drv = priv;
 702         struct ieee80211req_mlme mlme;
 703         int ret;
 704
 705         wpa_printf(MSG_DEBUG, "%s: addr=%s reason_code=%d",
 706                    __func__, ether_sprintf(addr), reason_code);
 707
 708         mlme.im_op = IEEE80211_MLME_DEAUTH;
 709         mlme.im_reason = reason_code;
 710         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 711         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 712         if (ret < 0) {
 713                 wpa_printf(MSG_DEBUG, "%s: Failed to deauth STA (addr " MACSTR
 714                            " reason %d)",
 715                            __func__, MAC2STR(addr), reason_code);
 716         }
 717
 718         return ret;
 719 }
 720
 721 static int
 722 madwifi_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
 723                      int reason_code)
 724 {
 725         struct madwifi_driver_data *drv = priv;
 726         struct ieee80211req_mlme mlme;
 727         int ret;
 728
 729         wpa_printf(MSG_DEBUG, "%s: addr=%s reason_code=%d",
 730                    __func__, ether_sprintf(addr), reason_code);
 731
 732         mlme.im_op = IEEE80211_MLME_DISASSOC;
 733         mlme.im_reason = reason_code;
 734         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 735         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 736         if (ret < 0) {
 737                 wpa_printf(MSG_DEBUG, "%s: Failed to disassoc STA (addr "
 738                            MACSTR " reason %d)",
 739                            __func__, MAC2STR(addr), reason_code);
 740         }
 741
 742         return ret;
 743 }
 744
 745 #ifdef CONFIG_WPS
 746 #ifdef IEEE80211_IOCTL_FILTERFRAME
 747 static void madwifi_raw_receive(void *ctx, const u8 *src_addr, const u8 *buf,
 748                                 size_t len)
 749 {
 750         struct madwifi_driver_data *drv = ctx;
 751         const struct ieee80211_mgmt *mgmt;
 752         const u8 *end, *ie;
 753         u16 fc;
 754         size_t ie_len;
 755
 756         /* Send Probe Request information to WPS processing */
 757
 758         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req))
 759                 return;
 760         mgmt = (const struct ieee80211_mgmt *) buf;
 761
 762         fc = le_to_host16(mgmt->frame_control);
 763         if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT ||
 764             WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_PROBE_REQ)
 765                 return;
 766
 767         end = buf + len;
 768         ie = mgmt->u.probe_req.variable;
 769         ie_len = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req));
 770
 771         hostapd_probe_req_rx(drv->hapd, mgmt->sa, ie, ie_len);
 772 }
 773 #endif /* IEEE80211_IOCTL_FILTERFRAME */
 774 #endif /* CONFIG_WPS */
 775
 776 static int madwifi_receive_probe_req(struct madwifi_driver_data *drv)
 777 {
 778         int ret = 0;
 779 #ifdef CONFIG_WPS
 780 #ifdef IEEE80211_IOCTL_FILTERFRAME
 781         struct ieee80211req_set_filter filt;
 782
 783         wpa_printf(MSG_DEBUG, "%s Enter", __func__);
 784         filt.app_filterype = IEEE80211_FILTER_TYPE_PROBE_REQ;
 785
 786         ret = set80211priv(drv, IEEE80211_IOCTL_FILTERFRAME, &filt,
 787                            sizeof(struct ieee80211req_set_filter));
 788         if (ret)
 789                 return ret;
 790
 791         drv->sock_raw = l2_packet_init(drv->iface, NULL, ETH_P_80211_RAW,
 792                                        madwifi_raw_receive, drv, 1);
 793         if (drv->sock_raw == NULL)
 794                 return -1;
 795 #endif /* IEEE80211_IOCTL_FILTERFRAME */
 796 #endif /* CONFIG_WPS */
 797         return ret;
 798 }
 799
 800 #ifdef CONFIG_WPS
 801 static int
 802 madwifi_set_wps_ie(void *priv, const u8 *ie, size_t len, u32 frametype)
 803 {
 804         struct madwifi_driver_data *drv = priv;
 805         u8 buf[256];
 806         struct ieee80211req_getset_appiebuf *beac_ie;
 807
 808         wpa_printf(MSG_DEBUG, "%s buflen = %lu", __func__,
 809                    (unsigned long) len);
 810
 811         beac_ie = (struct ieee80211req_getset_appiebuf *) buf;
 812         beac_ie->app_frmtype = frametype;
 813         beac_ie->app_buflen = len;
 814         memcpy(&(beac_ie->app_buf[0]), ie, len);
 815
 816         return set80211priv(drv, IEEE80211_IOCTL_SET_APPIEBUF, beac_ie,
 817                             sizeof(struct ieee80211req_getset_appiebuf) + len);
 818 }
 819
 820 static int
 821 madwifi_set_ap_wps_ie(const char *ifname, void *priv,
 822                       const struct wpabuf *beacon,
 823                       const struct wpabuf *proberesp)
 824 {
 825         if (madwifi_set_wps_ie(priv, beacon ? wpabuf_head(beacon) : NULL,
 826                                beacon ? wpabuf_len(beacon) : 0,
 827                                IEEE80211_APPIE_FRAME_BEACON) < 0)
 828                 return -1;
 829         return madwifi_set_wps_ie(priv,
 830                                   proberesp ? wpabuf_head(proberesp) : NULL,
 831                                   proberesp ? wpabuf_len(proberesp) : 0,
 832                                   IEEE80211_APPIE_FRAME_PROBE_RESP);
 833 }
 834 #else /* CONFIG_WPS */
 835 #define madwifi_set_ap_wps_ie NULL
 836 #endif /* CONFIG_WPS */
 837
 838 static int
 839 madwifi_new_sta(struct madwifi_driver_data *drv, u8 addr[IEEE80211_ADDR_LEN])
 840 {
 841         struct hostapd_data *hapd = drv->hapd;
 842         struct ieee80211req_wpaie ie;
 843         int ielen = 0, res;
 844         u8 *iebuf = NULL;
 845
 846         /*
 847          * Fetch negotiated WPA/RSN parameters from the system.
 848          */
 849         memset(&ie, 0, sizeof(ie));
 850         memcpy(ie.wpa_macaddr, addr, IEEE80211_ADDR_LEN);
 851         if (set80211priv(drv, IEEE80211_IOCTL_GETWPAIE, &ie, sizeof(ie))) {
 852                 wpa_printf(MSG_DEBUG, "%s: Failed to get WPA/RSN IE",
 853                            __func__);
 854                 goto no_ie;
 855         }
 856         wpa_hexdump(MSG_MSGDUMP, "madwifi req WPA IE",
 857                     ie.wpa_ie, IEEE80211_MAX_OPT_IE);
 858         iebuf = ie.wpa_ie;
 859         /* madwifi seems to return some random data if WPA/RSN IE is not set.
 860          * Assume the IE was not included if the IE type is unknown. */
 861         if (iebuf[0] != WLAN_EID_VENDOR_SPECIFIC)
 862                 iebuf[1] = 0;
 863 #ifdef MADWIFI_NG
 864         wpa_hexdump(MSG_MSGDUMP, "madwifi req RSN IE",
 865                     ie.rsn_ie, IEEE80211_MAX_OPT_IE);
 866         if (iebuf[1] == 0 && ie.rsn_ie[1] > 0) {
 867                 /* madwifi-ng svn #1453 added rsn_ie. Use it, if wpa_ie was not
 868                  * set. This is needed for WPA2. */
 869                 iebuf = ie.rsn_ie;
 870                 if (iebuf[0] != WLAN_EID_RSN)
 871                         iebuf[1] = 0;
 872         }
 873 #endif /* MADWIFI_NG */
 874
 875         ielen = iebuf[1];
 876         if (ielen == 0)
 877                 iebuf = NULL;
 878         else
 879                 ielen += 2;
 880
 881 no_ie:
 882         res = hostapd_notif_assoc(hapd, addr, iebuf, ielen);
 883
 884         if (memcmp(addr, drv->acct_mac, ETH_ALEN) == 0) {
 885                 /* Cached accounting data is not valid anymore. */
 886                 memset(drv->acct_mac, 0, ETH_ALEN);
 887                 memset(&drv->acct_data, 0, sizeof(drv->acct_data));
 888         }
 889
 890         return res;
 891 }
 892
 893 static void
 894 madwifi_wireless_event_wireless_custom(struct madwifi_driver_data *drv,
 895                                        char *custom)
 896 {
 897         wpa_printf(MSG_DEBUG, "Custom wireless event: '%s'", custom);
 898
 899         if (strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
 900                 char *pos;
 901                 u8 addr[ETH_ALEN];
 902                 pos = strstr(custom, "addr=");
 903                 if (pos == NULL) {
 904                         wpa_printf(MSG_DEBUG,
 905                                    "MLME-MICHAELMICFAILURE.indication "
 906                                    "without sender address ignored");
 907                         return;
 908                 }
 909                 pos += 5;
 910                 if (hwaddr_aton(pos, addr) == 0) {
 911                         union wpa_event_data data;
 912                         os_memset(&data, 0, sizeof(data));
 913                         data.michael_mic_failure.unicast = 1;
 914                         data.michael_mic_failure.src = addr;
 915                         wpa_supplicant_event(drv->hapd,
 916                                              EVENT_MICHAEL_MIC_FAILURE, &data);
 917                 } else {
 918                         wpa_printf(MSG_DEBUG,
 919                                    "MLME-MICHAELMICFAILURE.indication "
 920                                    "with invalid MAC address");
 921                 }
 922         } else if (strncmp(custom, "STA-TRAFFIC-STAT", 16) == 0) {
 923                 char *key, *value;
 924                 u32 val;
 925                 key = custom;
 926                 while ((key = strchr(key, '\n')) != NULL) {
 927                         key++;
 928                         value = strchr(key, '=');
 929                         if (value == NULL)
 930                                 continue;
 931                         *value++ = '\0';
 932                         val = strtoul(value, NULL, 10);
 933                         if (strcmp(key, "mac") == 0)
 934                                 hwaddr_aton(value, drv->acct_mac);
 935                         else if (strcmp(key, "rx_packets") == 0)
 936                                 drv->acct_data.rx_packets = val;
 937                         else if (strcmp(key, "tx_packets") == 0)
 938                                 drv->acct_data.tx_packets = val;
 939                         else if (strcmp(key, "rx_bytes") == 0)
 940                                 drv->acct_data.rx_bytes = val;
 941                         else if (strcmp(key, "tx_bytes") == 0)
 942                                 drv->acct_data.tx_bytes = val;
 943                         key = value;
 944                 }
 945         }
 946 }
 947
 948 static void
 949 madwifi_wireless_event_wireless(struct madwifi_driver_data *drv,
 950                                             char *data, int len)
 951 {
 952         struct iw_event iwe_buf, *iwe = &iwe_buf;
 953         char *pos, *end, *custom, *buf;
 954
 955         pos = data;
 956         end = data + len;
 957
 958         while (pos + IW_EV_LCP_LEN <= end) {
 959                 /* Event data may be unaligned, so make a local, aligned copy
 960                  * before processing. */
 961                 memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
 962                 wpa_printf(MSG_MSGDUMP, "Wireless event: cmd=0x%x len=%d",
 963                            iwe->cmd, iwe->len);
 964                 if (iwe->len <= IW_EV_LCP_LEN)
 965                         return;
 966
 967                 custom = pos + IW_EV_POINT_LEN;
 968                 if (drv->we_version > 18 &&
 969                     (iwe->cmd == IWEVMICHAELMICFAILURE ||
 970                      iwe->cmd == IWEVCUSTOM)) {
 971                         /* WE-19 removed the pointer from struct iw_point */
 972                         char *dpos = (char *) &iwe_buf.u.data.length;
 973                         int dlen = dpos - (char *) &iwe_buf;
 974                         memcpy(dpos, pos + IW_EV_LCP_LEN,
 975                                sizeof(struct iw_event) - dlen);
 976                 } else {
 977                         memcpy(&iwe_buf, pos, sizeof(struct iw_event));
 978                         custom += IW_EV_POINT_OFF;
 979                 }
 980
 981                 switch (iwe->cmd) {
 982                 case IWEVEXPIRED:
 983                         hostapd_notif_disassoc(drv->hapd,
 984                                                (u8 *) iwe->u.addr.sa_data);
 985                         break;
 986                 case IWEVREGISTERED:
 987                         madwifi_new_sta(drv, (u8 *) iwe->u.addr.sa_data);
 988                         break;
 989                 case IWEVCUSTOM:
 990                         if (custom + iwe->u.data.length > end)
 991                                 return;
 992                         buf = malloc(iwe->u.data.length + 1);
 993                         if (buf == NULL)
 994                                 return;         /* XXX */
 995                         memcpy(buf, custom, iwe->u.data.length);
 996                         buf[iwe->u.data.length] = '\0';
 997                         madwifi_wireless_event_wireless_custom(drv, buf);
 998                         free(buf);
 999                         break;
1000                 }
1001
1002                 pos += iwe->len;
1003         }
1004 }
1005
1006
1007 static void
1008 madwifi_wireless_event_rtm_newlink(void *ctx, struct ifinfomsg *ifi,
1009                                    u8 *buf, size_t len)
1010 {
1011         struct madwifi_driver_data *drv = ctx;
1012         int attrlen, rta_len;
1013         struct rtattr *attr;
1014
1015         if (ifi->ifi_index != drv->ifindex)
1016                 return;
1017
1018         attrlen = len;
1019         attr = (struct rtattr *) buf;
1020
1021         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1022         while (RTA_OK(attr, attrlen)) {
1023                 if (attr->rta_type == IFLA_WIRELESS) {
1024                         madwifi_wireless_event_wireless(
1025                                 drv, ((char *) attr) + rta_len,
1026                                 attr->rta_len - rta_len);
1027                 }
1028                 attr = RTA_NEXT(attr, attrlen);
1029         }
1030 }
1031
1032
1033 static int
1034 madwifi_get_we_version(struct madwifi_driver_data *drv)
1035 {
1036         struct iw_range *range;
1037         struct iwreq iwr;
1038         int minlen;
1039         size_t buflen;
1040
1041         drv->we_version = 0;
1042
1043         /*
1044          * Use larger buffer than struct iw_range in order to allow the
1045          * structure to grow in the future.
1046          */
1047         buflen = sizeof(struct iw_range) + 500;
1048         range = os_zalloc(buflen);
1049         if (range == NULL)
1050                 return -1;
1051
1052         memset(&iwr, 0, sizeof(iwr));
1053         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1054         iwr.u.data.pointer = (caddr_t) range;
1055         iwr.u.data.length = buflen;
1056
1057         minlen = ((char *) &range->enc_capa) - (char *) range +
1058                 sizeof(range->enc_capa);
1059
1060         if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
1061                 perror("ioctl[SIOCGIWRANGE]");
1062                 free(range);
1063                 return -1;
1064         } else if (iwr.u.data.length >= minlen &&
1065                    range->we_version_compiled >= 18) {
1066                 wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
1067                            "WE(source)=%d enc_capa=0x%x",
1068                            range->we_version_compiled,
1069                            range->we_version_source,
1070                            range->enc_capa);
1071                 drv->we_version = range->we_version_compiled;
1072         }
1073
1074         free(range);
1075         return 0;
1076 }
1077
1078
1079 static int
1080 madwifi_wireless_event_init(struct madwifi_driver_data *drv)
1081 {
1082         struct netlink_config *cfg;
1083
1084         madwifi_get_we_version(drv);
1085
1086         cfg = os_zalloc(sizeof(*cfg));
1087         if (cfg == NULL)
1088                 return -1;
1089         cfg->ctx = drv;
1090         cfg->newlink_cb = madwifi_wireless_event_rtm_newlink;
1091         drv->netlink = netlink_init(cfg);
1092         if (drv->netlink == NULL) {
1093                 os_free(cfg);
1094                 return -1;
1095         }
1096
1097         return 0;
1098 }
1099
1100
1101 static int
1102 madwifi_send_eapol(void *priv, const u8 *addr, const u8 *data, size_t data_len,
1103                    int encrypt, const u8 *own_addr)
1104 {
1105         struct madwifi_driver_data *drv = priv;
1106         unsigned char buf[3000];
1107         unsigned char *bp = buf;
1108         struct l2_ethhdr *eth;
1109         size_t len;
1110         int status;
1111
1112         /*
1113          * Prepend the Ethernet header.  If the caller left us
1114          * space at the front we could just insert it but since
1115          * we don't know we copy to a local buffer.  Given the frequency
1116          * and size of frames this probably doesn't matter.
1117          */
1118         len = data_len + sizeof(struct l2_ethhdr);
1119         if (len > sizeof(buf)) {
1120                 bp = malloc(len);
1121                 if (bp == NULL) {
1122                         printf("EAPOL frame discarded, cannot malloc temp "
1123                                "buffer of size %lu!\n", (unsigned long) len);
1124                         return -1;
1125                 }
1126         }
1127         eth = (struct l2_ethhdr *) bp;
1128         memcpy(eth->h_dest, addr, ETH_ALEN);
1129         memcpy(eth->h_source, own_addr, ETH_ALEN);
1130         eth->h_proto = host_to_be16(ETH_P_EAPOL);
1131         memcpy(eth+1, data, data_len);
1132
1133         wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", bp, len);
1134
1135         status = l2_packet_send(drv->sock_xmit, addr, ETH_P_EAPOL, bp, len);
1136
1137         if (bp != buf)
1138                 free(bp);
1139         return status;
1140 }
1141
1142 static void
1143 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
1144 {
1145         struct madwifi_driver_data *drv = ctx;
1146         hostapd_eapol_receive(drv->hapd, src_addr,
1147                               buf + sizeof(struct l2_ethhdr),
1148                               len - sizeof(struct l2_ethhdr));
1149 }
1150
1151 static void *
1152 madwifi_init(struct hostapd_data *hapd, struct wpa_init_params *params)
1153 {
1154         struct madwifi_driver_data *drv;
1155         struct ifreq ifr;
1156         struct iwreq iwr;
1157
1158         drv = os_zalloc(sizeof(struct madwifi_driver_data));
1159         if (drv == NULL) {
1160                 printf("Could not allocate memory for madwifi driver data\n");
1161                 return NULL;
1162         }
1163
1164         drv->hapd = hapd;
1165         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1166         if (drv->ioctl_sock < 0) {
1167                 perror("socket[PF_INET,SOCK_DGRAM]");
1168                 goto bad;
1169         }
1170         memcpy(drv->iface, params->ifname, sizeof(drv->iface));
1171
1172         memset(&ifr, 0, sizeof(ifr));
1173         os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
1174         if (ioctl(drv->ioctl_sock, SIOCGIFINDEX, &ifr) != 0) {
1175                 perror("ioctl(SIOCGIFINDEX)");
1176                 goto bad;
1177         }
1178         drv->ifindex = ifr.ifr_ifindex;
1179
1180         drv->sock_xmit = l2_packet_init(drv->iface, NULL, ETH_P_EAPOL,
1181                                         handle_read, drv, 1);
1182         if (drv->sock_xmit == NULL)
1183                 goto bad;
1184         if (l2_packet_get_own_addr(drv->sock_xmit, params->own_addr))
1185                 goto bad;
1186         if (params->bridge[0]) {
1187                 wpa_printf(MSG_DEBUG, "Configure bridge %s for EAPOL traffic.",
1188                            params->bridge[0]);
1189                 drv->sock_recv = l2_packet_init(params->bridge[0], NULL,
1190                                                 ETH_P_EAPOL, handle_read, drv,
1191                                                 1);
1192                 if (drv->sock_recv == NULL)
1193                         goto bad;
1194         } else
1195                 drv->sock_recv = drv->sock_xmit;
1196
1197         memset(&iwr, 0, sizeof(iwr));
1198         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1199
1200         iwr.u.mode = IW_MODE_MASTER;
1201
1202         if (ioctl(drv->ioctl_sock, SIOCSIWMODE, &iwr) < 0) {
1203                 perror("ioctl[SIOCSIWMODE]");
1204                 printf("Could not set interface to master mode!\n");
1205                 goto bad;
1206         }
1207
1208         madwifi_set_iface_flags(drv, 0);        /* mark down during setup */
1209         madwifi_set_privacy(drv->iface, drv, 0); /* default to no privacy */
1210
1211         madwifi_receive_probe_req(drv);
1212
1213         if (madwifi_wireless_event_init(drv))
1214                 goto bad;
1215
1216         return drv;
1217 bad:
1218         if (drv->sock_xmit != NULL)
1219                 l2_packet_deinit(drv->sock_xmit);
1220         if (drv->ioctl_sock >= 0)
1221                 close(drv->ioctl_sock);
1222         if (drv != NULL)
1223                 free(drv);
1224         return NULL;
1225 }
1226
1227
1228 static void
1229 madwifi_deinit(void *priv)
1230 {
1231         struct madwifi_driver_data *drv = priv;
1232
1233         netlink_deinit(drv->netlink);
1234         (void) madwifi_set_iface_flags(drv, 0);
1235         if (drv->ioctl_sock >= 0)
1236                 close(drv->ioctl_sock);
1237         if (drv->sock_recv != NULL && drv->sock_recv != drv->sock_xmit)
1238                 l2_packet_deinit(drv->sock_recv);
1239         if (drv->sock_xmit != NULL)
1240                 l2_packet_deinit(drv->sock_xmit);
1241         if (drv->sock_raw)
1242                 l2_packet_deinit(drv->sock_raw);
1243         free(drv);
1244 }
1245
1246 static int
1247 madwifi_set_ssid(const char *ifname, void *priv, const u8 *buf, int len)
1248 {
1249         struct madwifi_driver_data *drv = priv;
1250         struct iwreq iwr;
1251
1252         memset(&iwr, 0, sizeof(iwr));
1253         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1254         iwr.u.essid.flags = 1; /* SSID active */
1255         iwr.u.essid.pointer = (caddr_t) buf;
1256         iwr.u.essid.length = len + 1;
1257
1258         if (ioctl(drv->ioctl_sock, SIOCSIWESSID, &iwr) < 0) {
1259                 perror("ioctl[SIOCSIWESSID]");
1260                 printf("len=%d\n", len);
1261                 return -1;
1262         }
1263         return 0;
1264 }
1265
1266 static int
1267 madwifi_get_ssid(const char *ifname, void *priv, u8 *buf, int len)
1268 {
1269         struct madwifi_driver_data *drv = priv;
1270         struct iwreq iwr;
1271         int ret = 0;
1272
1273         memset(&iwr, 0, sizeof(iwr));
1274         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1275         iwr.u.essid.pointer = (caddr_t) buf;
1276         iwr.u.essid.length = len;
1277
1278         if (ioctl(drv->ioctl_sock, SIOCGIWESSID, &iwr) < 0) {
1279                 perror("ioctl[SIOCGIWESSID]");
1280                 ret = -1;
1281         } else
1282                 ret = iwr.u.essid.length;
1283
1284         return ret;
1285 }
1286
1287 static int
1288 madwifi_set_countermeasures(void *priv, int enabled)
1289 {
1290         struct madwifi_driver_data *drv = priv;
1291         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
1292         return set80211param(drv, IEEE80211_PARAM_COUNTERMEASURES, enabled);
1293 }
1294
1295 static int
1296 madwifi_commit(void *priv)
1297 {
1298         return madwifi_set_iface_flags(priv, 1);
1299 }
1300
1301 #else /* HOSTAPD */
1302
1303 struct wpa_driver_madwifi_data {
1304         void *wext; /* private data for driver_wext */
1305         void *ctx;
1306         char ifname[IFNAMSIZ + 1];
1307         int sock;
1308 };
1309
1310 static int wpa_driver_madwifi_set_auth_alg(void *priv, int auth_alg);
1311 static int wpa_driver_madwifi_set_probe_req_ie(void *priv, const u8 *ies,
1312                                                size_t ies_len);
1313
1314
1315 static int
1316 set80211priv(struct wpa_driver_madwifi_data *drv, int op, void *data, int len,
1317              int show_err)
1318 {
1319         struct iwreq iwr;
1320
1321         os_memset(&iwr, 0, sizeof(iwr));
1322         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
1323         if (len < IFNAMSIZ &&
1324             op != IEEE80211_IOCTL_SET_APPIEBUF) {
1325                 /*
1326                  * Argument data fits inline; put it there.
1327                  */
1328                 os_memcpy(iwr.u.name, data, len);
1329         } else {
1330                 /*
1331                  * Argument data too big for inline transfer; setup a
1332                  * parameter block instead; the kernel will transfer
1333                  * the data for the driver.
1334                  */
1335                 iwr.u.data.pointer = data;
1336                 iwr.u.data.length = len;
1337         }
1338
1339         if (ioctl(drv->sock, op, &iwr) < 0) {
1340                 if (show_err) {
1341 #ifdef MADWIFI_NG
1342                         int first = IEEE80211_IOCTL_SETPARAM;
1343                         int last = IEEE80211_IOCTL_KICKMAC;
1344                         static const char *opnames[] = {
1345                                 "ioctl[IEEE80211_IOCTL_SETPARAM]",
1346                                 "ioctl[IEEE80211_IOCTL_GETPARAM]",
1347                                 "ioctl[IEEE80211_IOCTL_SETMODE]",
1348                                 "ioctl[IEEE80211_IOCTL_GETMODE]",
1349                                 "ioctl[IEEE80211_IOCTL_SETWMMPARAMS]",
1350                                 "ioctl[IEEE80211_IOCTL_GETWMMPARAMS]",
1351                                 "ioctl[IEEE80211_IOCTL_SETCHANLIST]",
1352                                 "ioctl[IEEE80211_IOCTL_GETCHANLIST]",
1353                                 "ioctl[IEEE80211_IOCTL_CHANSWITCH]",
1354                                 NULL,
1355                                 "ioctl[IEEE80211_IOCTL_SET_APPIEBUF]",
1356                                 "ioctl[IEEE80211_IOCTL_GETSCANRESULTS]",
1357                                 NULL,
1358                                 "ioctl[IEEE80211_IOCTL_GETCHANINFO]",
1359                                 "ioctl[IEEE80211_IOCTL_SETOPTIE]",
1360                                 "ioctl[IEEE80211_IOCTL_GETOPTIE]",
1361                                 "ioctl[IEEE80211_IOCTL_SETMLME]",
1362                                 NULL,
1363                                 "ioctl[IEEE80211_IOCTL_SETKEY]",
1364                                 NULL,
1365                                 "ioctl[IEEE80211_IOCTL_DELKEY]",
1366                                 NULL,
1367                                 "ioctl[IEEE80211_IOCTL_ADDMAC]",
1368                                 NULL,
1369                                 "ioctl[IEEE80211_IOCTL_DELMAC]",
1370                                 NULL,
1371                                 "ioctl[IEEE80211_IOCTL_WDSMAC]",
1372                                 NULL,
1373                                 "ioctl[IEEE80211_IOCTL_WDSDELMAC]",
1374                                 NULL,
1375                                 "ioctl[IEEE80211_IOCTL_KICKMAC]",
1376                         };
1377 #else /* MADWIFI_NG */
1378                         int first = IEEE80211_IOCTL_SETPARAM;
1379                         int last = IEEE80211_IOCTL_CHANLIST;
1380                         static const char *opnames[] = {
1381                                 "ioctl[IEEE80211_IOCTL_SETPARAM]",
1382                                 "ioctl[IEEE80211_IOCTL_GETPARAM]",
1383                                 "ioctl[IEEE80211_IOCTL_SETKEY]",
1384                                 "ioctl[IEEE80211_IOCTL_GETKEY]",
1385                                 "ioctl[IEEE80211_IOCTL_DELKEY]",
1386                                 NULL,
1387                                 "ioctl[IEEE80211_IOCTL_SETMLME]",
1388                                 NULL,
1389                                 "ioctl[IEEE80211_IOCTL_SETOPTIE]",
1390                                 "ioctl[IEEE80211_IOCTL_GETOPTIE]",
1391                                 "ioctl[IEEE80211_IOCTL_ADDMAC]",
1392                                 NULL,
1393                                 "ioctl[IEEE80211_IOCTL_DELMAC]",
1394                                 NULL,
1395                                 "ioctl[IEEE80211_IOCTL_CHANLIST]",
1396                         };
1397 #endif /* MADWIFI_NG */
1398                         int idx = op - first;
1399                         if (first <= op && op <= last &&
1400                             idx < (int) (sizeof(opnames) / sizeof(opnames[0]))
1401                             && opnames[idx])
1402                                 perror(opnames[idx]);
1403                         else
1404                                 perror("ioctl[unknown???]");
1405                 }
1406                 return -1;
1407         }
1408         return 0;
1409 }
1410
1411 static int
1412 set80211param(struct wpa_driver_madwifi_data *drv, int op, int arg,
1413               int show_err)
1414 {
1415         struct iwreq iwr;
1416
1417         os_memset(&iwr, 0, sizeof(iwr));
1418         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
1419         iwr.u.mode = op;
1420         os_memcpy(iwr.u.name+sizeof(u32), &arg, sizeof(arg));
1421
1422         if (ioctl(drv->sock, IEEE80211_IOCTL_SETPARAM, &iwr) < 0) {
1423                 if (show_err)
1424                         perror("ioctl[IEEE80211_IOCTL_SETPARAM]");
1425                 return -1;
1426         }
1427         return 0;
1428 }
1429
1430 static int
1431 wpa_driver_madwifi_set_wpa_ie(struct wpa_driver_madwifi_data *drv,
1432                               const u8 *wpa_ie, size_t wpa_ie_len)
1433 {
1434         struct iwreq iwr;
1435
1436         os_memset(&iwr, 0, sizeof(iwr));
1437         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
1438         /* NB: SETOPTIE is not fixed-size so must not be inlined */
1439         iwr.u.data.pointer = (void *) wpa_ie;
1440         iwr.u.data.length = wpa_ie_len;
1441
1442         if (ioctl(drv->sock, IEEE80211_IOCTL_SETOPTIE, &iwr) < 0) {
1443                 perror("ioctl[IEEE80211_IOCTL_SETOPTIE]");
1444                 return -1;
1445         }
1446         return 0;
1447 }
1448
1449 static int
1450 wpa_driver_madwifi_del_key(struct wpa_driver_madwifi_data *drv, int key_idx,
1451                            const u8 *addr)
1452 {
1453         struct ieee80211req_del_key wk;
1454
1455         wpa_printf(MSG_DEBUG, "%s: keyidx=%d", __FUNCTION__, key_idx);
1456         os_memset(&wk, 0, sizeof(wk));
1457         wk.idk_keyix = key_idx;
1458         if (addr != NULL)
1459                 os_memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
1460
1461         return set80211priv(drv, IEEE80211_IOCTL_DELKEY, &wk, sizeof(wk), 1);
1462 }
1463
1464 static int
1465 wpa_driver_madwifi_set_key(const char *ifname, void *priv, wpa_alg alg,
1466                            const u8 *addr, int key_idx, int set_tx,
1467                            const u8 *seq, size_t seq_len,
1468                            const u8 *key, size_t key_len)
1469 {
1470         struct wpa_driver_madwifi_data *drv = priv;
1471         struct ieee80211req_key wk;
1472         char *alg_name;
1473         u_int8_t cipher;
1474
1475         if (alg == WPA_ALG_NONE)
1476                 return wpa_driver_madwifi_del_key(drv, key_idx, addr);
1477
1478         switch (alg) {
1479         case WPA_ALG_WEP:
1480                 if (addr == NULL || os_memcmp(addr, "\xff\xff\xff\xff\xff\xff",
1481                                               ETH_ALEN) == 0) {
1482                         /*
1483                          * madwifi did not seem to like static WEP key
1484                          * configuration with IEEE80211_IOCTL_SETKEY, so use
1485                          * Linux wireless extensions ioctl for this.
1486                          */
1487                         return wpa_driver_wext_set_key(ifname, drv->wext, alg,
1488                                                        addr, key_idx, set_tx,
1489                                                        seq, seq_len,
1490                                                        key, key_len);
1491                 }
1492                 alg_name = "WEP";
1493                 cipher = IEEE80211_CIPHER_WEP;
1494                 break;
1495         case WPA_ALG_TKIP:
1496                 alg_name = "TKIP";
1497                 cipher = IEEE80211_CIPHER_TKIP;
1498                 break;
1499         case WPA_ALG_CCMP:
1500                 alg_name = "CCMP";
1501                 cipher = IEEE80211_CIPHER_AES_CCM;
1502                 break;
1503         default:
1504                 wpa_printf(MSG_DEBUG, "%s: unknown/unsupported algorithm %d",
1505                         __FUNCTION__, alg);
1506                 return -1;
1507         }
1508
1509         wpa_printf(MSG_DEBUG, "%s: alg=%s key_idx=%d set_tx=%d seq_len=%lu "
1510                    "key_len=%lu", __FUNCTION__, alg_name, key_idx, set_tx,
1511                    (unsigned long) seq_len, (unsigned long) key_len);
1512
1513         if (seq_len > sizeof(u_int64_t)) {
1514                 wpa_printf(MSG_DEBUG, "%s: seq_len %lu too big",
1515                            __FUNCTION__, (unsigned long) seq_len);
1516                 return -2;
1517         }
1518         if (key_len > sizeof(wk.ik_keydata)) {
1519                 wpa_printf(MSG_DEBUG, "%s: key length %lu too big",
1520                            __FUNCTION__, (unsigned long) key_len);
1521                 return -3;
1522         }
1523
1524         os_memset(&wk, 0, sizeof(wk));
1525         wk.ik_type = cipher;
1526         wk.ik_flags = IEEE80211_KEY_RECV;
1527         if (addr == NULL ||
1528             os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) == 0)
1529                 wk.ik_flags |= IEEE80211_KEY_GROUP;
1530         if (set_tx) {
1531                 wk.ik_flags |= IEEE80211_KEY_XMIT | IEEE80211_KEY_DEFAULT;
1532                 os_memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
1533         } else
1534                 os_memset(wk.ik_macaddr, 0, IEEE80211_ADDR_LEN);
1535         wk.ik_keyix = key_idx;
1536         wk.ik_keylen = key_len;
1537 #ifdef WORDS_BIGENDIAN
1538 #define WPA_KEY_RSC_LEN 8
1539         {
1540                 size_t i;
1541                 u8 tmp[WPA_KEY_RSC_LEN];
1542                 os_memset(tmp, 0, sizeof(tmp));
1543                 for (i = 0; i < seq_len; i++)
1544                         tmp[WPA_KEY_RSC_LEN - i - 1] = seq[i];
1545                 os_memcpy(&wk.ik_keyrsc, tmp, WPA_KEY_RSC_LEN);
1546         }
1547 #else /* WORDS_BIGENDIAN */
1548         os_memcpy(&wk.ik_keyrsc, seq, seq_len);
1549 #endif /* WORDS_BIGENDIAN */
1550         os_memcpy(wk.ik_keydata, key, key_len);
1551
1552         return set80211priv(drv, IEEE80211_IOCTL_SETKEY, &wk, sizeof(wk), 1);
1553 }
1554
1555 static int
1556 wpa_driver_madwifi_set_countermeasures(void *priv, int enabled)
1557 {
1558         struct wpa_driver_madwifi_data *drv = priv;
1559         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
1560         return set80211param(drv, IEEE80211_PARAM_COUNTERMEASURES, enabled, 1);
1561 }
1562
1563 static int
1564 wpa_driver_madwifi_deauthenticate(void *priv, const u8 *addr, int reason_code)
1565 {
1566         struct wpa_driver_madwifi_data *drv = priv;
1567         struct ieee80211req_mlme mlme;
1568
1569         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
1570         mlme.im_op = IEEE80211_MLME_DEAUTH;
1571         mlme.im_reason = reason_code;
1572         os_memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
1573         return set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme), 1);
1574 }
1575
1576 static int
1577 wpa_driver_madwifi_disassociate(void *priv, const u8 *addr, int reason_code)
1578 {
1579         struct wpa_driver_madwifi_data *drv = priv;
1580         struct ieee80211req_mlme mlme;
1581
1582         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
1583         mlme.im_op = IEEE80211_MLME_DISASSOC;
1584         mlme.im_reason = reason_code;
1585         os_memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
1586         return set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme), 1);
1587 }
1588
1589 static int
1590 wpa_driver_madwifi_associate(void *priv,
1591                              struct wpa_driver_associate_params *params)
1592 {
1593         struct wpa_driver_madwifi_data *drv = priv;
1594         struct ieee80211req_mlme mlme;
1595         int ret = 0, privacy = 1;
1596
1597         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
1598
1599         if (set80211param(drv, IEEE80211_PARAM_DROPUNENCRYPTED,
1600                           params->drop_unencrypted, 1) < 0)
1601                 ret = -1;
1602         if (wpa_driver_madwifi_set_auth_alg(drv, params->auth_alg) < 0)
1603                 ret = -1;
1604
1605         /*
1606          * NB: Don't need to set the freq or cipher-related state as
1607          *     this is implied by the bssid which is used to locate
1608          *     the scanned node state which holds it.  The ssid is
1609          *     needed to disambiguate an AP that broadcasts multiple
1610          *     ssid's but uses the same bssid.
1611          */
1612         /* XXX error handling is wrong but unclear what to do... */
1613         if (wpa_driver_madwifi_set_wpa_ie(drv, params->wpa_ie,
1614                                           params->wpa_ie_len) < 0)
1615                 ret = -1;
1616
1617         if (params->pairwise_suite == CIPHER_NONE &&
1618             params->group_suite == CIPHER_NONE &&
1619             params->key_mgmt_suite == KEY_MGMT_NONE &&
1620             params->wpa_ie_len == 0)
1621                 privacy = 0;
1622
1623         if (set80211param(drv, IEEE80211_PARAM_PRIVACY, privacy, 1) < 0)
1624                 ret = -1;
1625
1626         if (params->wpa_ie_len &&
1627             set80211param(drv, IEEE80211_PARAM_WPA,
1628                           params->wpa_ie[0] == WLAN_EID_RSN ? 2 : 1, 1) < 0)
1629                 ret = -1;
1630
1631         if (params->bssid == NULL) {
1632                 /* ap_scan=2 mode - driver takes care of AP selection and
1633                  * roaming */
1634                 /* FIX: this does not seem to work; would probably need to
1635                  * change something in the driver */
1636                 if (set80211param(drv, IEEE80211_PARAM_ROAMING, 0, 1) < 0)
1637                         ret = -1;
1638
1639                 if (wpa_driver_wext_set_ssid(drv->wext, params->ssid,
1640                                              params->ssid_len) < 0)
1641                         ret = -1;
1642         } else {
1643                 if (set80211param(drv, IEEE80211_PARAM_ROAMING, 2, 1) < 0)
1644                         ret = -1;
1645                 if (wpa_driver_wext_set_ssid(drv->wext, params->ssid,
1646                                              params->ssid_len) < 0)
1647                         ret = -1;
1648                 os_memset(&mlme, 0, sizeof(mlme));
1649                 mlme.im_op = IEEE80211_MLME_ASSOC;
1650                 os_memcpy(mlme.im_macaddr, params->bssid, IEEE80211_ADDR_LEN);
1651                 if (set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme,
1652                                  sizeof(mlme), 1) < 0) {
1653                         wpa_printf(MSG_DEBUG, "%s: SETMLME[ASSOC] failed",
1654                                    __func__);
1655                         ret = -1;
1656                 }
1657         }
1658
1659         return ret;
1660 }
1661
1662 static int
1663 wpa_driver_madwifi_set_auth_alg(void *priv, int auth_alg)
1664 {
1665         struct wpa_driver_madwifi_data *drv = priv;
1666         int authmode;
1667
1668         if ((auth_alg & AUTH_ALG_OPEN_SYSTEM) &&
1669             (auth_alg & AUTH_ALG_SHARED_KEY))
1670                 authmode = IEEE80211_AUTH_AUTO;
1671         else if (auth_alg & AUTH_ALG_SHARED_KEY)
1672                 authmode = IEEE80211_AUTH_SHARED;
1673         else
1674                 authmode = IEEE80211_AUTH_OPEN;
1675
1676         return set80211param(drv, IEEE80211_PARAM_AUTHMODE, authmode, 1);
1677 }
1678
1679 static int
1680 wpa_driver_madwifi_scan(void *priv, struct wpa_driver_scan_params *params)
1681 {
1682         struct wpa_driver_madwifi_data *drv = priv;
1683         struct iwreq iwr;
1684         int ret = 0;
1685         const u8 *ssid = params->ssids[0].ssid;
1686         size_t ssid_len = params->ssids[0].ssid_len;
1687
1688         wpa_driver_madwifi_set_probe_req_ie(drv, params->extra_ies,
1689                                             params->extra_ies_len);
1690
1691         os_memset(&iwr, 0, sizeof(iwr));
1692         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
1693
1694         /* set desired ssid before scan */
1695         /* FIX: scan should not break the current association, so using
1696          * set_ssid may not be the best way of doing this.. */
1697         if (wpa_driver_wext_set_ssid(drv->wext, ssid, ssid_len) < 0)
1698                 ret = -1;
1699
1700         if (ioctl(drv->sock, SIOCSIWSCAN, &iwr) < 0) {
1701                 perror("ioctl[SIOCSIWSCAN]");
1702                 ret = -1;
1703         }
1704
1705         /*
1706          * madwifi delivers a scan complete event so no need to poll, but
1707          * register a backup timeout anyway to make sure that we recover even
1708          * if the driver does not send this event for any reason. This timeout
1709          * will only be used if the event is not delivered (event handler will
1710          * cancel the timeout).
1711          */
1712         eloop_cancel_timeout(wpa_driver_wext_scan_timeout, drv->wext,
1713                              drv->ctx);
1714         eloop_register_timeout(30, 0, wpa_driver_wext_scan_timeout, drv->wext,
1715                                drv->ctx);
1716
1717         return ret;
1718 }
1719
1720 static int wpa_driver_madwifi_get_bssid(void *priv, u8 *bssid)
1721 {
1722         struct wpa_driver_madwifi_data *drv = priv;
1723         return wpa_driver_wext_get_bssid(drv->wext, bssid);
1724 }
1725
1726
1727 static int wpa_driver_madwifi_get_ssid(void *priv, u8 *ssid)
1728 {
1729         struct wpa_driver_madwifi_data *drv = priv;
1730         return wpa_driver_wext_get_ssid(drv->wext, ssid);
1731 }
1732
1733
1734 static struct wpa_scan_results *
1735 wpa_driver_madwifi_get_scan_results(void *priv)
1736 {
1737         struct wpa_driver_madwifi_data *drv = priv;
1738         return wpa_driver_wext_get_scan_results(drv->wext);
1739 }
1740
1741
1742 static int wpa_driver_madwifi_set_operstate(void *priv, int state)
1743 {
1744         struct wpa_driver_madwifi_data *drv = priv;
1745         return wpa_driver_wext_set_operstate(drv->wext, state);
1746 }
1747
1748
1749 static int wpa_driver_madwifi_set_probe_req_ie(void *priv, const u8 *ies,
1750                                                size_t ies_len)
1751 {
1752         struct ieee80211req_getset_appiebuf *probe_req_ie;
1753         int ret;
1754
1755         probe_req_ie = os_malloc(sizeof(*probe_req_ie) + ies_len);
1756         if (probe_req_ie == NULL)
1757                 return -1;
1758
1759         probe_req_ie->app_frmtype = IEEE80211_APPIE_FRAME_PROBE_REQ;
1760         probe_req_ie->app_buflen = ies_len;
1761         os_memcpy(probe_req_ie->app_buf, ies, ies_len);
1762
1763         ret = set80211priv(priv, IEEE80211_IOCTL_SET_APPIEBUF, probe_req_ie,
1764                            sizeof(struct ieee80211req_getset_appiebuf) +
1765                            ies_len, 1);
1766
1767         os_free(probe_req_ie);
1768
1769         return ret;
1770 }
1771
1772
1773 static void * wpa_driver_madwifi_init(void *ctx, const char *ifname)
1774 {
1775         struct wpa_driver_madwifi_data *drv;
1776
1777         drv = os_zalloc(sizeof(*drv));
1778         if (drv == NULL)
1779                 return NULL;
1780         drv->wext = wpa_driver_wext_init(ctx, ifname);
1781         if (drv->wext == NULL)
1782                 goto fail;
1783
1784         drv->ctx = ctx;
1785         os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
1786         drv->sock = socket(PF_INET, SOCK_DGRAM, 0);
1787         if (drv->sock < 0)
1788                 goto fail2;
1789
1790         if (set80211param(drv, IEEE80211_PARAM_ROAMING, 2, 1) < 0) {
1791                 wpa_printf(MSG_DEBUG, "%s: failed to set wpa_supplicant-based "
1792                            "roaming", __FUNCTION__);
1793                 goto fail3;
1794         }
1795
1796         if (set80211param(drv, IEEE80211_PARAM_WPA, 3, 1) < 0) {
1797                 wpa_printf(MSG_DEBUG, "%s: failed to enable WPA support",
1798                            __FUNCTION__);
1799                 goto fail3;
1800         }
1801
1802         return drv;
1803
1804 fail3:
1805         close(drv->sock);
1806 fail2:
1807         wpa_driver_wext_deinit(drv->wext);
1808 fail:
1809         os_free(drv);
1810         return NULL;
1811 }
1812
1813
1814 static void wpa_driver_madwifi_deinit(void *priv)
1815 {
1816         struct wpa_driver_madwifi_data *drv = priv;
1817
1818         if (wpa_driver_madwifi_set_wpa_ie(drv, NULL, 0) < 0) {
1819                 wpa_printf(MSG_DEBUG, "%s: failed to clear WPA IE",
1820                            __FUNCTION__);
1821         }
1822         if (set80211param(drv, IEEE80211_PARAM_ROAMING, 0, 1) < 0) {
1823                 wpa_printf(MSG_DEBUG, "%s: failed to enable driver-based "
1824                            "roaming", __FUNCTION__);
1825         }
1826         if (set80211param(drv, IEEE80211_PARAM_PRIVACY, 0, 1) < 0) {
1827                 wpa_printf(MSG_DEBUG, "%s: failed to disable forced Privacy "
1828                            "flag", __FUNCTION__);
1829         }
1830         if (set80211param(drv, IEEE80211_PARAM_WPA, 0, 1) < 0) {
1831                 wpa_printf(MSG_DEBUG, "%s: failed to disable WPA",
1832                            __FUNCTION__);
1833         }
1834
1835         wpa_driver_wext_deinit(drv->wext);
1836
1837         close(drv->sock);
1838         os_free(drv);
1839 }
1840
1841 #endif /* HOSTAPD */
1842
1843
1844 const struct wpa_driver_ops wpa_driver_madwifi_ops = {
1845         .name                   = "madwifi",
1846         .desc                   = "MADWIFI 802.11 support (Atheros, etc.)",
1847         .set_key                = wpa_driver_madwifi_set_key,
1848 #ifdef HOSTAPD
1849         .hapd_init              = madwifi_init,
1850         .hapd_deinit            = madwifi_deinit,
1851         .set_ieee8021x          = madwifi_set_ieee8021x,
1852         .set_privacy            = madwifi_set_privacy,
1853         .get_seqnum             = madwifi_get_seqnum,
1854         .flush                  = madwifi_flush,
1855         .set_generic_elem       = madwifi_set_opt_ie,
1856         .sta_set_flags          = madwifi_sta_set_flags,
1857         .read_sta_data          = madwifi_read_sta_driver_data,
1858         .hapd_send_eapol        = madwifi_send_eapol,
1859         .sta_disassoc           = madwifi_sta_disassoc,
1860         .sta_deauth             = madwifi_sta_deauth,
1861         .hapd_set_ssid          = madwifi_set_ssid,
1862         .hapd_get_ssid          = madwifi_get_ssid,
1863         .hapd_set_countermeasures       = madwifi_set_countermeasures,
1864         .sta_clear_stats        = madwifi_sta_clear_stats,
1865         .commit                 = madwifi_commit,
1866         .set_ap_wps_ie          = madwifi_set_ap_wps_ie,
1867 #else /* HOSTAPD */
1868         .get_bssid              = wpa_driver_madwifi_get_bssid,
1869         .get_ssid               = wpa_driver_madwifi_get_ssid,
1870         .init                   = wpa_driver_madwifi_init,
1871         .deinit                 = wpa_driver_madwifi_deinit,
1872         .set_countermeasures    = wpa_driver_madwifi_set_countermeasures,
1873         .scan2                  = wpa_driver_madwifi_scan,
1874         .get_scan_results2      = wpa_driver_madwifi_get_scan_results,
1875         .deauthenticate         = wpa_driver_madwifi_deauthenticate,
1876         .disassociate           = wpa_driver_madwifi_disassociate,
1877         .associate              = wpa_driver_madwifi_associate,
1878         .set_operstate          = wpa_driver_madwifi_set_operstate,
1879 #endif /* HOSTAPD */
1880 };